Information processing method, electronic equipment, storage medium and product

Abstract

The invention discloses an information processing method, electronic equipment, a storage medium and a product. The method comprises the following steps: acquiring at least one event which is recorded by network security equipment and relates to a network threat; each event comprises corresponding feature information; the feature information comprises at least one quantifiable parameter used for describing network threats; dividing the events into at least one event group based on the feature information; determining dependency degree information among different event groups based on the historical occurrence frequency of the event groups; determining an association graph based on the dependency degree information, and determining a first score of each branch of the association graph based on the dependency degree information between adjacent event groups in the association graph; the first score represents the threat degree of each branch of the association graph. Therefore, according to the scheme provided by the invention, the information density of event representation can be improved, the high-level threat event association graph is constructed, threat degree scoring is performed on the association graph, and a user can be helped to understand multi-source and massive alarm events.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to an information processing method, electronic device, storage medium and product. Background Technology

[0002] Cyber ​​intrusion refers to an unauthorized entity gaining access to a computer network or system. These intrusions can lead to data breaches, service disruptions, and financial losses. Enterprises typically deploy various network intrusion detection devices, such as Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), Web Application Firewalls (WAF), and devices with Endpoint Detection and Response (EDR). Different security devices provide specialized protection for different security threats and scenarios. For example, IDS primarily monitors network traffic and analyzes potential malicious activities; IPS proactively blocks attacks when detected; WAFs specifically protect web applications from attacks such as SQL injection and cross-site scripting; and EDRs focus on the endpoint, providing detection and response to malware. However, these security devices often generate a large number of threat alerts, making it extremely difficult for system security analysts to distinguish truly significant cyberattacks from this massive volume of alerts. Summary of the Invention

[0003] In view of this, embodiments of this application provide an information processing method, electronic device, storage medium, and product, which are designed to facilitate system security analysts in analyzing alarm events from network security devices.

[0004] The technical solution of this application embodiment is implemented as follows: In a first aspect, embodiments of this application provide an information processing method, including: The system acquires at least one event related to a network threat recorded by a network security device; each event includes corresponding feature information; the feature information includes at least one quantifiable parameter for describing the network threat. Based on the feature information, the events are divided into at least one event group; Determine the degree of dependency between different event groups based on the historical occurrence frequency of the event groups; A correlation graph is determined based on the dependency information, and a first score is determined for each branch of the correlation graph based on the dependency information between adjacent event groups in the correlation graph; the first score characterizes the threat level of each branch of the correlation graph.

[0005] In the above scheme, dividing the events into at least one event group based on the feature information includes: The events are arranged in chronological order to obtain the events within a preset time range; Based on the feature information corresponding to the events within a preset time range, similarity information between the events within the preset time range is determined; The events are divided into at least one event group based on the similarity information.

[0006] In the above scheme, determining the first score of each branch of the association graph based on the dependency information between adjacent event groups in the association graph includes: Determine a second score for each event group in the association graph; the second score characterizes the threat level of each event group in the association graph. The first score of each branch of the association graph is determined based on the dependency information between adjacent event groups in the association graph and the second score.

[0007] In the above scheme, determining the second score of each event group in the association graph includes: The second score is determined based on the events in each event group in the association diagram and the Common Vulnerability Scoring System (CVSS).

[0008] In the above scheme, determining the dependency information between different event groups based on the historical occurrence frequency of the event groups includes: Based on the historical occurrence time of the event groups, determine the number of the first occurrences of each pair of event groups within a preset time range in history; Determine the total number of times one of the two event groups has occurred in history based on the historical occurrence count of the event groups; The dependency information between each pair of event groups is determined based on the first count and the total count.

[0009] The above solution is applied to an electronic device including a display screen, and the method further includes: The branches of the association graph are sorted based on the first score to determine the sorting result; Control the electronic device to display the sorting results.

[0010] In the above scheme, the network security equipment includes one or more of the following: Intrusion Detection System (IDS), Intrusion Prevention System (IPS), Network Application Firewall (WAF), and equipment equipped with Endpoint Detection and Response (EDR).

[0011] In a second aspect, embodiments of this application provide an electronic device, including a processor and a memory for storing a computer program capable of running on the processor, wherein the processor executes the computer program to implement the steps of the method described in the first aspect.

[0012] Thirdly, embodiments of this application provide a computer storage medium storing a computer program, which, when executed by a processor, implements the steps of the method described in the first aspect.

[0013] Fourthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the steps of the method described in the first aspect.

[0014] The technical solution provided in this application embodiment obtains at least one event involving network threats recorded by a network security device; each event includes corresponding feature information; the feature information includes at least one quantifiable parameter for describing the network threat; the events are divided into at least one event group based on the feature information; the dependency information between different event groups is determined based on the historical occurrence frequency of the event groups; a correlation graph is determined based on the dependency information, and a first score is determined for each branch of the correlation graph based on the dependency information between adjacent event groups in the correlation graph; the first score characterizes the threat level of each branch of the correlation graph.

[0015] This method acquires basic threat events (i.e., events) recorded by various network security devices. These basic threat events are then merged into at least one high-level threat event (event group) based on their characteristic information (such as the source of the network threat, target IP address, port number, etc.). Each high-level threat event includes one or more basic threat events. The dependency information between different high-level threat events is determined based on their historical occurrence frequency, thereby establishing a correlation graph. Based on the dependency information of adjacent high-level threat events in the correlation graph, the total threat level score (i.e., the first score) for each branch of the correlation graph (i.e., a complete network attack process) is determined. Thus, the solution provided in this application merges similar or related basic threat events from multiple network security devices into higher-level threat events, increasing the information density of event representation, reducing redundancy, and improving operability. Constructing a high-level threat event correlation graph and scoring its threat level helps users understand multi-source and massive amounts of alert events, improving the efficiency of identifying and handling potential security threats and abnormal behaviors. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating the information processing method according to an embodiment of this application; Figure 2This is a schematic diagram illustrating the basic threat event acquisition via a sliding window in an embodiment of this application. Figure 3 This is a structural schematic diagram of the association diagram in the embodiments of this application; Figure 4 This is a detailed implementation process of the information processing method used in this application. Figure 5 This application provides a specific implementation process for merging multi-source basic threat events; Figure 6 This application provides a specific implementation process for high-level threat event association. Figure 7 This is a schematic diagram of the structure of the information processing device according to an embodiment of this application; Figure 8 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0017] The present application will now be described in further detail with reference to the accompanying drawings and embodiments.

[0018] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application.

[0019] While digital transformation brings significant progress and increased efficiency to businesses, it also exposes them to a growing number of cyber threats. Among these threats, cyber intrusion has become a prevalent and persistent one. Cyber ​​intrusion refers to an unauthorized entity gaining access to a computer network or system, which can lead to data breaches, service disruptions, and financial losses. Therefore, businesses need to protect their digital assets from these threats.

[0020] In related technologies, enterprises typically deploy various network intrusion detection devices, such as Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), Web Application Firewalls (WAF), and devices with Endpoint Detection and Response (EDR). These security devices monitor network traffic for suspicious patterns and behaviors. When anomalies are detected, the security devices generate alerts, enabling system security analysts to investigate and mitigate potential threats. Different security devices provide specialized protection for different security threats and scenarios. For example, IDS is mainly used to monitor network traffic and analyze potential malicious activities; while IPS can proactively take measures to block attacks when they are detected; WAF specifically protects web applications, preventing attacks such as SQL injection and cross-site scripting; and EDR focuses on the endpoint, providing detection and response to malware. However, these security devices often generate a large number of threat alert events, making it very difficult for system security analysts to distinguish truly significant network attacks from the massive number of threat alert events.

[0021] In various embodiments of this application, basic threat events (i.e., events) recorded by various network security devices are acquired. These basic threat events are then merged into at least one high-level threat event (event group) based on their characteristic information (such as the source of the network threat, target IP address, port number, etc.). Each high-level threat event includes one or more basic threat events. The dependency information between different high-level threat events is determined based on their historical occurrence frequency, thereby establishing a correlation graph composed of these high-level threat events. Based on the dependency information of adjacent high-level threat events in the correlation graph, the total threat level score (i.e., the first score) for each branch of the correlation graph (i.e., a complete network attack process) is determined. Thus, the solution provided by this application merges similar or related basic threat events from multiple network security devices into higher-level threat events, increasing the information density of event representation, reducing redundancy, and improving operability. Constructing a high-level threat event correlation graph and scoring its threat level helps users understand multi-source and massive amounts of alarm events, improving the efficiency of identifying and handling potential security threats and abnormal behaviors.

[0022] This application provides an information processing method, such as... Figure 1 As shown, it includes: Step 101: Obtain at least one event involving a network threat recorded by a network security device; each event includes corresponding feature information; the feature information includes at least one quantifiable parameter used to describe the network threat; For example, network security devices include one or more of IDS, IPS, WAF, and devices equipped with EDR. In practical applications, when facing network attacks (or network threats), network security devices can record traces of network attacks or relevant parameters that can be used to identify and analyze network attacks. Specifically, network security devices can record the threat event characteristics (i.e., characteristic information) of a basic threat event (i.e., the event itself). Threat event characteristics may specifically include: source (the attacker's IP address), target IP address, port number, protocol type, user identifier, executed command, accessed object, etc. Here, network security devices may also include other devices. This application embodiment does not limit the specific number and type of network security devices; threat event characteristics can be determined according to actual conditions. This application embodiment does not limit the specific number and type of threat event characteristics.

[0023] It should be noted that IDS, IPS, WAF, and the device with EDR installed can be the same device, that is, a device with software that provides IDS, IPS, WAF, EDR and other functions installed, or they can be different devices, each of which has at least one of the software that provides IDS, IPS, WAF, EDR and other functions installed. This application does not limit this.

[0024] In some embodiments, after obtaining the feature information corresponding to each event collected by the network security device, the feature information corresponding to each event can be converted into a unified standardized format. Specifically, all feature information can be converted into the CEF standardized log format (a standardized, text-based log format designed specifically for security events) to facilitate subsequent analysis and processing of events from multiple sources.

[0025] Step 102: Divide the events into at least one event group based on feature information; Here, based on the similarity of characteristic information of different events, similar or related basic threat events from multiple network security devices can be merged into higher-level threat events to improve the information density of event representation, reduce redundancy, and improve the operability of system security analysts in managing threat events.

[0026] Step 103: Determine the dependency information between different event groups based on the historical occurrence frequency of event groups; Here, based on the historical occurrence count of high-level threat events (i.e. event groups), we can determine the number of times two high-level threat events occur sequentially or simultaneously within a short period of time, as well as the total number of times one of the high-level threat events has occurred historically. This allows us to determine the probability that there is a dependency relationship between the two event groups, i.e., the degree of dependency information.

[0027] Step 104: Determine the association graph based on the dependency information, and determine the first score of each branch of the association graph based on the dependency information between adjacent event groups in the association graph; the first score represents the threat level of each branch of the association graph.

[0028] Here, a correlation graph is determined based on the probability of dependencies between high-level threat events. A score (i.e., a first score) for a branch in the correlation graph is then determined based on all high-level threat events (event groups) and the degree of dependency between adjacent events within these high-level threat events. This first score is then presented to the system security analyst. Each branch in the correlation graph represents the entire process of a network attack, and the first score represents the probability of success of that attack, thus drawing the attention of the system security analyst. This approach helps users (system security analysts) understand the numerous and diverse alerts from multiple sources, improving the efficiency of identifying and handling potential security threats and abnormal behaviors.

[0029] In some embodiments, classifying the events into at least one event group based on the feature information includes: The events are arranged in chronological order to obtain the events within a preset time range; Based on the feature information corresponding to the events within a preset time range, similarity information between the events within the preset time range is determined; The events are divided into at least one event group based on the similarity information.

[0030] Here, after converting the feature information corresponding to each event (basic threat event) into a unified standardized format, the events can be aligned according to their timestamps. That is, the feature information corresponding to each event is aligned according to its timestamp, and all events within a preset time range are obtained based on a sliding window. The duration of the sliding window is the preset time range. For example, the preset time range can be 1 hour, and events are obtained according to a 1-hour sliding window, meaning that all events of the past hour can be obtained every 1 hour. Here, the specific size of the preset time range can be determined according to the actual situation, and this application embodiment does not limit the specific size of the preset time range.

[0031] In some embodiments, before acquiring all events within a preset time range based on a sliding window, the feature information in a standardized format can be preprocessed, including deduplication, formatting, and normalization, to reduce redundant information and facilitate subsequent analysis and processing. The specific methods for deduplication, formatting, and normalization can be understood by referring to relevant technologies, and will not be elaborated here.

[0032] In some embodiments, before acquiring all events within a preset time range using a sliding window, known false positives can be removed from the basic threat events based on preset rules to filter out some known network threat false positives. Specifically, the preset rules can be formulated based on prior knowledge, historical data, or expert experience, and can be a mapping table. This mapping table is used to determine whether a basic threat event is malicious based on various feature information in the basic threat event, thereby eliminating some obvious false positives. This application embodiment does not limit the specific content and generation method of the preset rules.

[0033] After acquiring all events within a preset time range using a sliding window, the feature information of the acquired events is extracted. Specifically, the acquired events may include basic threat events from devices such as IDS, IPS, WAF, and EDR devices. Therefore, the threat event features (feature information) corresponding to each basic threat event may also include those from devices such as IDS, IPS, WAF, and EDR devices. Threat event feature X i This can be expressed as formula (1): (1) Among them, X i Let x represent the i-th basic threat event, n be the number of feature information included in the i-th basic threat event, and x be the number of feature information included in the i-th basic threat event. i1 This represents the first characteristic information of the i-th basic threat event. The n characteristics information may include source, target IP address, port number, protocol type, user identifier, executed command, accessed object, etc.

[0034] For example, the duration of the sliding window is A diagram illustrating how to retrieve i basic threat events by sliding a window is shown below. Figure 2 As shown, where, t1 and The duration of time period t2 is... t, sliding window in Within the time period t1, acquire i basic threat events and wait. After the duration of t, slide to Get the i new basic threat events within the time period t2.

[0035] After acquiring basic threat events using a sliding window, considering that the feature information originates from security devices at different levels, a weighted approach is used to calculate the similarity of each feature. Specifically, a similarity matrix S can be defined, where S(i,j) represents the similarity between event i and event j. For example, the two basic threat events are represented as feature vectors. and Where n is the number of feature information. The similarity measure (i.e., similarity information) between two basic threat events is defined as S(X1, X2), and formula (2) is the formula for calculating S(X1, X2): (2) Where Si(x) 1i x 2i () is a similarity measure between the i-th feature information of X1 and the i-th feature information of X2. This represents the weight of the i-th feature information. For each feature information, an appropriate similarity measurement method can be selected, including but not limited to Euclidean distance, Manhattan distance, cosine similarity, etc. Here, the specific method used to determine the similarity information between the i-th feature information of X1 and the i-th feature information of X2 is not limited in this embodiment.

[0036] Here, feature weights The setting needs to consider the importance and influence of feature information on system behavior. The weight can be determined by the variance δ of the feature information. The larger the variance of the feature information, the greater its weight. For example, for the feature information of target IP address, the greater the difference in target IP addresses of different basic threat events, the greater the variance, and the greater the weight of the target IP address. Formula (3) is used to calculate the feature weight of the i-th feature information. The formula is given, where n is the number of feature information.

[0037] (3) For example, events are grouped into at least one event group based on similarity information, i.e., events within a sliding window are merged. The specific steps are as follows: Each basic threat event is used as an initial cluster. For every two basic threat events, the similarity information between them is calculated based on all their feature information, and a similarity threshold is set. If the similarity information between two basic threat events is greater than the similarity threshold, and the similarity information between these two basic threat events is the highest compared to other basic threat events, then the two basic threat events are merged. This process is repeated until no cluster pairs with similarity greater than the similarity threshold can be found. Here, each cluster pair is an event group, i.e., a high-level threat event.

[0038] In some embodiments, if there are multiple basic threat events, and the similarity information of each pair of events is greater than a similarity threshold, then the multiple basic threat events can be clustered into high-level threat events.

[0039] In some embodiments, determining the dependency information between different event groups based on the historical occurrence count of the event groups includes: Based on the historical occurrence time of the event groups, determine the number of the first occurrences of each pair of event groups within a preset time range in history; Determine the total number of times one of the two event groups has occurred in history based on the historical occurrence count of the event groups; The dependency information between each pair of event groups is determined based on the first count and the total count.

[0040] For example, all high-level threat events obtained by the sliding window in history are recorded. The total number of times each high-level threat event in the current sliding window has occurred in history is determined, and the first occurrence of each pair of high-level threat events occurring together in the same sliding window in history is determined. Thus, the probability of inter-event dependencies is estimated based on the frequency of interactions between historical events. Assuming there exist high-level threat event pairs Vi and Vj that satisfy a chronological order, the probability that the event pair has a dependency relationship, i.e., the probability that event Vj occurs after event Vi, is... (i.e., dependency information), also known as the probability of the information flow dependency relationship between events Vi and Vj. As shown in formula (4).

[0041] (4) in, M(Vi) represents the number of times events Vi and Vj occur simultaneously in historical data, and M(Vi) represents the total number of times event Vi has occurred historically. Here, the historical occurrence time of high-level threat events can be determined as the occurrence time of the earliest underlying threat event among the high-level threat events. For example, assuming the sliding window duration is 1 hour, if events Vi and Vj occur sequentially or simultaneously within the same sliding window, they are considered to have occurred simultaneously, thus obtaining the number of times events Vi and Vj occur simultaneously. In some embodiments, assuming the sliding window duration is 1 hour (a preset duration range), if one of events Vi and Vj occurs, and the other occurs within 1 hour (within the preset duration range), it can also be considered that events Vi and Vj have occurred simultaneously.

[0042] In some embodiments, a dependency graph can be drawn before calculating the dependency information of high-level threat events. For example, high-level threat events are first classified according to ATT&CK's enumeration of common attack patterns and descriptions of the classification of common attack patterns (referring to ATT&CK's official description of classifying and explaining attackers' attack behaviors).

[0043] Here, ATT&CK is a network threat intelligence framework based on real-world attack cases. It standardizes and structures attackers' "behavioral patterns," thereby helping security teams understand the logic of network attacks and improve their defense and detection capabilities. High-level threat events are arranged chronologically and grouped according to ATT&CK's enumeration and classification of common attack patterns, combined with the threat event characteristics of the high-level threat events. Specifically, a high-level threat event is abstractly represented as a node Vi, which represents the phased objectives (or tactics) that a network attacker wants to achieve in the attack lifecycle. These phased objectives can include initial access, execution, persistence, privilege escalation, defense bypass, credential access, exploration and discovery, lateral movement, information gathering, command and control, data leakage, and impact. Vi can represent one of these phased objectives. The specific content of ATT&CK's phased objectives can be understood by referring to relevant technologies.

[0044] If there are dependencies between higher-level threat events, the following situations may occur: 1. Direct data path dependency: If there is a direct data transmission path between events, then there is a potential dependency between them.

[0045] 2. Service Dependency: If a service or application involved in one event is a dependency of another event, then there is a dependency relationship between the two events.

[0046] 3. Shared resource usage: If two events affect the same resource (such as a database, file system, etc.), then these two events may have a dependency relationship.

[0047] Therefore, a directed dependency graph can be constructed based on the high-level threat events V1, V2…Vn that exhibit direct data path dependencies, service dependencies, and shared resource usage. In this graph, nodes represent high-level threat events, and directed arrows indicate potential dependencies between two different high-level threat events. By first identifying high-level threat events with potential dependencies and then excluding those without such dependencies, computational resources and time can be saved, improving the efficiency of subsequent dependency information calculations.

[0048] It is understandable that the dependency graph is a further filtered version of the dependency graph, which can exclude some nodes and directed arrows in the dependency graph.

[0049] In some embodiments, determining the first score of each branch of the association graph based on the dependency information between adjacent event groups in the association graph includes: Determine a second score for each event group in the association graph; the second score characterizes the threat level of each event group in the association graph. The first score of each branch of the association graph is determined based on the dependency information between adjacent event groups in the association graph and the second score.

[0050] For example, a threshold τ is set based on actual conditions (such as historical data statistical experience) to determine the probability of event Vj occurring after event Vi. Compared with the threshold τ, if If the value is greater than τ, then it can be determined that there is a directed edge between event Vj and event Vi, as expressed in formula (5). This application does not limit the specific size of the threshold τ in its embodiments.

[0051] (5) Wherein, the probability of transitioning to event Vj after event Vi occurs is: Assuming the high-level threat events ordered chronologically are V1, V2, V3, V4, V5, V6, and V7, the information flow between these high-level threat events and the relationship between information flow and thresholds are shown in Table 1. Table 1

[0052] The "-" indicates that the relevant events are based on the order of their occurrence and do not involve the calculation of information flow.

[0053] For example, the calculations in Table 1 The nodes are nodes in the dependency graph. The nodes in the dependency graph are compared with the threshold τ to obtain the nodes in the association graph. Specifically, if the dependency information between two nodes is greater than the threshold τ, then the two nodes are determined to be nodes in the association graph. If the dependency information between two nodes is less than the threshold τ, then the two nodes are determined not to be nodes in the association graph and need to be excluded.

[0054] The relationship diagram that can be determined based on Table 1 is as follows: Figure 3As shown, the relationship graph includes two branches: the first branch is V1→V2→V4→V5→V7, and the second branch is V1→V3→V6→V7. Here, based on its characteristic information, the high-level threat event V1 represents the tactic of initial access in ATT&CK; V2 and V3 represent the tactic of execution; V4 represents the tactic of privilege escalation; V5 and V6 represent the tactic of command and control; and V7 represents the tactic of data leakage. Thus, to prevent the relationship graph from becoming too large, a threshold τ is set based on historical data statistical experience to exclude nodes with weak dependencies. It can be understood that the relationship graph is the dependency graph filtered by the threshold τ. While the relationship graph can be drawn directly, drawing the above dependency graph helps save computational resources and time, and improves the efficiency of subsequent calculations of dependency information.

[0055] In some embodiments, determining a second score for each event group in the association graph includes: The second score is determined based on the events in each event group in the association diagram and the Common Vulnerability Scoring System (CVSS).

[0056] Based on the above example, based on each node Vi in the association graph, an initial occurrence probability P(Vi) is assigned to node Vi. Formula (6) is the formula for calculating the initial occurrence probability P(Vi), and formula (7) is the formula for calculating the second fraction Svi of node Vi: (6) (7) Where 'n' represents the number of basic threat events within the higher-level threat event Vi, and AV, AC, and PR represent three measures of the basic threat event in the Common Vulnerability Scoring System (CVSS): attack path, attack complexity, and authentication. Here, attack path, attack complexity, and authentication can be included in the signature information or obtained through signature information analysis. For example, if the signature information determines that the attacker does not need authorization before launching the attack and therefore does not need access to settings or files to execute the attack, then a higher authentication score indicates that the attacker is more likely to successfully exploit this basic threat event to launch a network attack.

[0057] Here, the second score is the exploitability score (or exploit success rate) in CVSS. The exploitability score in CVSS represents the ease with which an attacker can successfully exploit a vulnerability. The higher the score, the easier it is for an attacker to successfully exploit the vulnerability, which means that it is easier for an attacker to use this high-level threat event to launch a network attack. It can be understood that the specific scoring principles for attack paths, attack complexity and identity authentication in CVSS, as well as the calculation of the exploitability score (such as the coefficient 8.22 in formula (7)), can be understood with reference to relevant technologies. This application embodiment does not limit this.

[0058] It is understood that the initial occurrence probability P(Vi) of each node Vi can also be calculated based on each node of the above dependency graph, and this application does not limit it in this way.

[0059] Based on the above example, the formula for calculating the first score T of each branch of the association graph is determined based on the second score of each event group in the association graph and the dependency information between adjacent event groups in the association graph, as shown in formula (8): (8) Where Svi stands for the second fraction. This refers to the dependency information between adjacent high-level threat events. Wvi is the weight of node Vi. The weight can be assigned according to the position of Vi in the ATT&CK process. The weight gradually increases as the ATT&CK process evolves. For example, if V4 is in the weighting stage, then the weight of V4 should be greater than that of V2 and V1 in the execution stage. The specific value of the weight of node Vi is not limited in the embodiments of this application.

[0060] Based on the above example, for the branch V1→V3→V6→V7, the formula for calculating the total threat score (i.e., the first score T) for this branch can be: T=Sv1 Wv1 ×φ13×Sv3 Wv3 ×φ36×Sv6 Wv6 ×φ67×Sv7 Wv7 .

[0061] In some embodiments, the present application is applied to an electronic device including a display screen, and the method further includes: The branches of the association graph are sorted based on the first score to determine the sorting result; Control the electronic device to display the sorting results.

[0062] In some embodiments, the control electronic device displays an association diagram.

[0063] In this way, the correlation diagram and the first score of each branch of the correlation diagram can be displayed from high to low, so that system security analysts can analyze the network attack process represented by each branch, which can help identify the most serious security risks and help system security analysts quickly identify and deal with potential security threats and abnormal behaviors.

[0064] The technical solution provided in this application embodiment obtains at least one event involving network threats recorded by a network security device; each event includes corresponding feature information; the feature information includes at least one quantifiable parameter for describing the network threat; the events are divided into at least one event group based on the feature information; the dependency information between different event groups is determined based on the historical occurrence frequency of the event groups; a correlation graph is determined based on the dependency information, and a first score is determined for each branch of the correlation graph based on the dependency information between adjacent event groups in the correlation graph; the first score characterizes the threat level of each branch of the correlation graph.

[0065] This method acquires basic threat events (i.e., events) recorded by various network security devices. These basic threat events are then merged into at least one high-level threat event (event group) based on their characteristic information (such as the source of the network threat, target IP address, port number, etc.). Each high-level threat event includes one or more basic threat events. The dependency information between different high-level threat events is determined based on their historical occurrence frequency, thereby establishing a correlation graph. Based on the dependency information of adjacent high-level threat events in the correlation graph, the total threat level score (i.e., the first score) for each branch of the correlation graph (i.e., a complete network attack process) is determined. Thus, the solution provided in this application merges similar or related basic threat events from multiple network security devices into higher-level threat events, increasing the information density of event representation, reducing redundancy, and improving operability. Constructing a high-level threat event correlation graph and scoring its threat level helps users understand multi-source and massive amounts of alert events, improving the efficiency of identifying and handling potential security threats and abnormal behaviors.

[0066] The following section provides a more detailed description of this application with reference to application examples.

[0067] In network security intrusion detection and network security operations, the specific implementation process of the information processing method provided in this application is as follows: Figure 4 As shown, it includes: Step 401: Collect and standardize multi-source threat events, then proceed to step 402; Here, security event log data (i.e. basic threat events) is collected from different network security devices (such as IDS, IPS, WAF, EDR devices, etc.), and this data is converted into a unified standardized format, such as using the CEF standardized log format, and timestamp aligned to facilitate data integration between different devices and applications.

[0068] Step 402, basic threat event preprocessing, then proceed to step 403; Here, the collected basic threat events are preprocessed, including deduplication, formatting, and normalization, to reduce redundant information and prepare data for subsequent analysis.

[0069] Step 403: Remove known false alarm events based on rules, and then proceed to step 404; Here, rules are designed and applied to filter out some known false positives. These rules can be based on prior knowledge, historical data, or expert experience, and are used to exclude some obvious false positives.

[0070] Step 404: Merge multi-source basic threat events, then proceed to step 405; Here, based on the sliding window approach, basic threat events within the sliding window are identified. The feature information of these basic threat events is used to measure similarity, and similar or related basic threat events from multiple network security devices are merged into high-level threat events.

[0071] Step 405: Correlate high-level threat events, then proceed to step 406; Here, a high-level threat correlation graph is constructed by utilizing the probability of dependency relationships between high-level threat events, and a threat score is applied to the correlation graph to help system security analysts quickly identify potential security threats and abnormal behaviors.

[0072] Step 406: Sorting the threat scores of related events.

[0073] Here, the correlation diagram and the first score of each branch of the correlation diagram can be displayed from high to low, so that system security analysts can analyze the network attack process represented by each branch of the correlation diagram.

[0074] The specific implementation process for merging multi-source basic threat events is as follows: Figure 5 As shown, it includes: Step 501: Extract event window features, then proceed to step 502; Here, a fixed-size event window time, denoted as Δt, is set. The window size can be adjusted according to actual conditions to adapt to the rapid evolution of threat events. Based on the chronological order of occurrence of basic threat events, features are extracted from different data sources (multiple network security devices) within the Δt window range, including threat event features from IDS, IPS, WAF, and EDR.

[0075] Step 502: Calculate feature similarity, then proceed to step 503; Here, based on each feature information in the two basic threat events, the similarity information of each feature information can be calculated using methods such as Euclidean distance, Manhattan distance, and cosine similarity. The similarity information of each feature information is summed to obtain the similarity information between the two basic threat events.

[0076] Step 503: Basic threat event merging and processing.

[0077] Here, a similarity threshold is set, and the two most similar basic threat events are selected. If their similarity information is greater than the similarity threshold, they are merged into a new cluster. This process is repeated until no cluster pairs with similarity information greater than the similarity threshold can be found.

[0078] The specific implementation process for linking high-level threat events is as follows: Figure 6 As shown, it includes: Step 601: Event abstraction and representation, then proceed to step 602; Here, based on ATT&CK's description of enumeration and classification of common attack patterns, the merged high-level threat events are categorized into the phased goals in ATT&CK, and the high-level threat events are abstractly represented as nodes.

[0079] Step 602: Establish a graph of potential dependencies between security events, and then proceed to step 603; After abstracting high-level threat events as nodes, a directed dependency graph is established. In this graph, nodes represent high-level threat events, and directed arrows between nodes represent possible dependencies between two different high-level threat events.

[0080] These dependencies can be based on the following factors: Direct data path dependency: If there is a direct data transmission path between two high-level threat events, then they are considered to have a potential dependency relationship.

[0081] Service dependency: If a service or application involved in a high-level threat incident is a dependency of another high-level threat incident, then there is a dependency between the two incidents.

[0082] Shared resource usage: If two high-level threat events affect the same resource (such as a database, file system, etc.), then the two events may be dependent on each other.

[0083] Step 603: Calculate the probability of the dependency, and then proceed to step 604; Here, the dependency level information of high-level threat events with dependencies in the dependency graph is calculated.

[0084] Step 604: Construct a high-level threat association graph, and then proceed to step 605; Here, based on the comparison between the threshold τ and the dependency information between each high-level threat event in the dependency graph, high-level threat events and directed edges are filtered from the dependency graph, and nodes with too weak dependencies are excluded to obtain the association graph.

[0085] Step 605: Sort the threat scores in the association graph.

[0086] Here, the first score of each branch of the association diagram can be displayed from high to low, so that system security analysts can analyze the network attack process represented by each branch of the association diagram.

[0087] Based on the analysis of the above embodiments, this application proposes a multi-source dynamic merging and dependency graph-driven threat detection method. Through two core technologies—dynamic weighted clustering of multi-source features and threat score aggregation based on contextual dependencies—it achieves efficient merging of threat events and accurate identification of multi-step attack chains, thereby reducing false positive redundancy and improving the accuracy of threat association. Its innovation lies in the adaptive processing of dynamic weights for multi-source heterogeneous data, the design of dependency probability modeling, and the threat score fusion mechanism, specifically: 1. Improve the event merging process by adding dynamic weight allocation of feature variance and hierarchical clustering steps to improve the accuracy of time aggregation. Specifically, based on the dynamic allocation of weights according to feature variance, a weighted similarity matrix is ​​designed to address the differences in feature importance of devices at different levels, and a hierarchical clustering algorithm is combined to realize the dynamic merging of multi-source events. 2. Improve the threat association algorithm by adding a multi-dimensional dependency modeling dimension to improve the accuracy of multi-step attack chain identification. Specifically, based on the multi-dimensional dependency relationship of network topology, service dependency, and resource sharing, construct a probabilistic directed dependency graph, and combine the threat grouping and transition probability calculation of the ATT&CK framework to quantify the threat score of multi-step attack chains.

[0088] In summary, this solution addresses the pain points of weak feature fusion capabilities and lack of multi-step attack logic modeling in existing technologies through the core innovation of multi-source dynamic merging and dependency graph-driven approach. It significantly outperforms existing solutions in key technical indicators such as multi-step attack detection coverage and algorithm dynamic adaptability, providing a feasible technical path for threat operations in complex network environments.

[0089] In order to implement the method of the embodiments of this application, the embodiments of this application also provide an information processing device, which corresponds to the above-described method. The steps in the above-described information processing method embodiments are also fully applicable to the information processing device embodiments.

[0090] like Figure 7 As shown, the information processing device includes: The acquisition module 701 is used to acquire at least one event involving network threats recorded by a network security device; each event includes corresponding feature information; the feature information includes at least one quantifiable parameter for describing the network threat; Processing module 702 is used to divide the event into at least one event group based on the feature information; The first determining module 703 determines the dependency information between different event groups based on the historical occurrence count of the event groups; The second determining module 704 is used to determine an association graph based on the dependency information, and to determine a first score for each branch of the association graph based on the dependency information between adjacent event groups in the association graph; the first score characterizes the threat level of each branch of the association graph.

[0091] In some embodiments, the processing module 702 is specifically used for: The events are arranged in chronological order to obtain the events within a preset time range; Based on the feature information corresponding to the events within a preset time range, similarity information between the events within the preset time range is determined; The events are divided into at least one event group based on the similarity information.

[0092] In some embodiments, the second determining module 704 is specifically used for: Determine a second score for each event group in the association graph; the second score characterizes the threat level of each event group in the association graph. The first score of each branch of the association graph is determined based on the dependency information between adjacent event groups in the association graph and the second score.

[0093] In some embodiments, the second determining module 704 is specifically used for: The second score is determined based on the events in each event group in the association diagram and the Common Vulnerability Scoring System (CVSS).

[0094] In some embodiments, the first determining module 703 is specifically used for: Based on the historical occurrence time of the event groups, determine the number of the first occurrences of each pair of event groups within a preset time range in history; Determine the total number of times one of the two event groups has occurred in history based on the historical occurrence count of the event groups; The dependency information between each pair of event groups is determined based on the first count and the total count.

[0095] In some embodiments, the device further includes a display module 705, configured to: The branches of the association graph are sorted based on the first score to determine the sorting result; The electronic device is controlled to display the sorting results.

[0096] It should be noted that the information processing device provided in the above embodiments is only illustrated by the division of the above program modules. In practical applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program modules to complete all or part of the processing described above. In addition, the information processing device and the information processing method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0097] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiments of this application, the embodiments of this application also provide an electronic device. Figure 8 The diagram shows only an exemplary structure of the electronic device, not the entire structure; implementation is possible as needed. Figure 8 The structure shown may be part or all of the structure.

[0098] like Figure 8 As shown, the electronic device 800 provided in this application embodiment includes at least one processor 801, a memory 802, and a user interface 803. The various components in the electronic device 800 are coupled together via a bus system 804. It can be understood that the bus system 804 is used to implement communication between these components. In addition to a data bus, the bus system 804 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 8 The general labeled all buses as Bus System 804.

[0099] The user interface 803 may include a monitor, keyboard, mouse, trackball, click wheel, buttons, touchpad, or touch screen.

[0100] The memory 802 in this embodiment is used to store various types of data to support the operation of the electronic device 800. Examples of such data include any computer program used to operate on the electronic device 800.

[0101] The information processing method disclosed in this application can be applied to or implemented by the processor 801. The processor 801 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the information processing method can be completed by the integrated logic circuitry in the hardware of the processor 801 or by instructions in software form. The processor 801 can be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor 801 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiments of this application can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software modules can be located in a storage medium, specifically in memory 802. The processor 801 reads information from memory 802 and, in conjunction with its hardware, completes the steps of the information processing method provided in the embodiments of this application.

[0102] In an exemplary embodiment, the electronic device 800 may be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to perform the aforementioned method.

[0103] It is understood that memory 802 can be volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), ferromagnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM); magnetic surface memory can be disk storage or magnetic tape storage. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), Sync Link Dynamic Random Access Memory (SLDRAM), and Direct Rambus Random Access Memory (DRRAM).The memories described in the embodiments of this application are intended to include, but are not limited to, these and any other suitable types of memories.

[0104] In an exemplary embodiment, this application also provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, such as a memory 802 storing a computer program. This computer program can be executed by the processor 801 of the electronic device 800 to complete the steps described in the method of this application embodiment. The computer-readable storage medium can be a ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disc, or CD-ROM, etc.

[0105] In an exemplary embodiment, this application also provides a computer program product, including a computer program that can be executed by a processor 801 of an electronic device 800 to perform the steps described in the method of this application embodiment.

[0106] It should be noted that terms such as "first" and "second" are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. In this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0107] It should be understood that the phrase "some embodiments" throughout the specification means that a particular feature, structure, or characteristic related to an embodiment is included in at least one embodiment of this application. Therefore, "some embodiments" appearing throughout the specification does not necessarily refer to the same embodiment.

[0108] Furthermore, the technical solutions described in the embodiments of this application can be combined arbitrarily without conflict.

[0109] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An information processing method, characterized in that, include: Acquire at least one event involving a network threat recorded by a network security device; each event includes corresponding characteristic information; The feature information includes at least one quantifiable parameter used to describe network threats; Based on the feature information, the events are divided into at least one event group; Determine the degree of dependency between different event groups based on the historical occurrence frequency of the event groups; A correlation graph is determined based on the dependency information, and a first score is determined for each branch of the correlation graph based on the dependency information between adjacent event groups in the correlation graph; the first score characterizes the threat level of each branch of the correlation graph.

2. The method according to claim 1, characterized in that, The process of dividing the events into at least one event group based on the feature information includes: The events are arranged in chronological order to obtain the events within a preset time range; Based on the feature information corresponding to the events within a preset time range, similarity information between the events within the preset time range is determined; The events are divided into at least one event group based on the similarity information.

3. The method according to claim 1, characterized in that, Determining the first score of each branch of the association graph based on the dependency information between adjacent event groups in the association graph includes: Determine a second score for each event group in the association graph; the second score characterizes the threat level of each event group in the association graph. The first score of each branch of the association graph is determined based on the dependency information between adjacent event groups in the association graph and the second score.

4. The method according to claim 3, characterized in that, Determining the second score for each event group in the association graph includes: The second score is determined based on the events in each event group in the association diagram and the Common Vulnerability Scoring System (CVSS).

5. The method according to claim 1, characterized in that, The determination of the dependency information between different event groups based on the historical occurrence frequency of the event groups includes: Based on the historical occurrence time of the event groups, determine the number of the first occurrences of each pair of event groups within a preset time range in history; Determine the total number of times one of the two event groups has occurred in history based on the historical occurrence count of the event groups; The dependency information between each pair of event groups is determined based on the first count and the total count.

6. The method according to claim 1, characterized in that, Applied to an electronic device including a display screen, the method further includes: The branches of the association graph are sorted based on the first score to determine the sorting result; Control the electronic device to display the sorting results.

7. The method according to any one of claims 1-6, characterized in that, The network security equipment includes one or more of the following: Intrusion Detection System (IDS), Intrusion Prevention System (IPS), Network Application Firewall (WAF), and equipment equipped with Endpoint Detection and Response (EDR).

8. An electronic device comprising a processor and a memory for storing a computer program capable of running on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method as described in any one of claims 1 to 7.

9. A computer storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images