Risk disposal method and device based on exposed surface knowledge graph, equipment and storage medium

Abstract

The invention provides a risk disposal method and device based on an exposed surface knowledge graph, equipment and a storage medium, and the method comprises the steps: obtaining the asset information and the configuration information of assets, building the exposed surface knowledge graph through a graph data model according to the asset information and the configuration information, and carrying out the construction of the exposed surface knowledge graph. Association between unified and dispersed data and recorded data can be standardized; on the basis of the preset exposed surface detection rule, the exposed surface knowledge graph is traversed, the target exposed path with the risk is recognized, multi-table association query is not needed, and the analysis response efficiency can be improved; according to the target exposure path, the processing tasks are automatically generated and dispatched, the generation and distribution of the processing tasks do not need manual intervention, the efficiency is improved, and omission is avoided.

Description

Technical Field

[0001] This application relates to the field of information security, and in particular to a risk management method, apparatus, device, and storage medium based on an exposure surface knowledge graph. Background Technology

[0002] As the number, form, and relationships of enterprise network assets increase, higher demands are placed on threat surface management. Currently, exposure surface governance suffers from at least the following shortcomings: 1. Data silos and poor correlation: Data such as assets, vulnerabilities, configurations, cloud resources, and threat intelligence are stored in scattered systems, making it impossible to effectively model and store the complex and dynamic network relationships between these data, resulting in security teams being unable to see risk paths from a global perspective; 2. Low analysis and response efficiency: When impact surface analysis (such as which assets a vulnerability affects) or attack path deduction is required, it relies on a large number of time-consuming multi-table join queries, making it impossible to respond within the golden time frame of attack and defense confrontation (usually requiring minutes); 3. Fragmented governance process: It usually only involves a single step such as "discovery" or "detection". After discovery, relevant personnel need to find the detection results, and then manually query the detection personnel of the corresponding assets for processing and tracking, which is inefficient and prone to omissions. Summary of the Invention

[0003] This application provides a risk management method, apparatus, device, and storage medium based on exposure surface knowledge graphs to solve at least one problem existing in related technologies. The technical solution is as follows: In a first aspect, embodiments of this application provide a risk management method based on an exposure surface knowledge graph, including: Obtain asset information and asset configuration information; Based on the asset information and the configuration information, an exposure surface knowledge graph is constructed using a graph data model; Based on preset exposure surface detection rules, the exposure surface knowledge graph is traversed to identify target exposure paths with risks. Based on the target exposure path, disposal tasks are automatically generated and assigned.

[0004] In one implementation, the asset information includes assets and the person responsible for the assets; the step of constructing an exposure surface knowledge graph using a graph data model based on the asset information and the configuration information includes: Based on the asset and the asset responsible person, create asset nodes and asset responsible person nodes respectively through the graph data model, and establish the belonging edge between the asset node and the asset responsible person node; Based on the configuration information, entity nodes associated with the asset nodes are created through the graph data model, and association edges between the entity nodes and the asset nodes, as well as association edges between the entity nodes, are established. An exposure surface knowledge graph is constructed based on the asset nodes, the asset responsible person nodes, the entity nodes, the attribution edges, and the association edges.

[0005] In one implementation, the configuration information includes IP address, port information, service information, domain name information, and protection policy information; the step of creating entity nodes associated with the asset nodes through the graph data model based on the configuration information, and establishing association edges between the entity nodes and the asset nodes, as well as association edges between the entity nodes, includes: Based on the IP address and the port information, IP address nodes and port nodes are created respectively through the graph data model, and ownership edges between the asset node and the IP address node and exposure edges between the asset node and the port node are established; A service node is created based on the service information, and a running edge is established between the service node and the port node; Create domain name nodes and load balancer nodes based on the domain name information, establish domain name resolution edges between the domain name nodes and the load balancer nodes and / or between the domain name nodes and the IP address nodes, and establish a transmission edge between the load balancer nodes and the asset nodes; A security policy node is created based on the protection policy information, and a protection edge is established between the security policy node and the domain name node; The entity nodes include the IP address node, the port node, the service node, the domain name node, the load balancing node, and the security policy node, and the associated edges include the exposure edge, the running edge, the domain name resolution edge, the transmission edge, and the protection edge.

[0006] In one implementation, the step of traversing the exposure surface knowledge graph based on preset exposure surface detection rules to identify risky target exposure paths includes: The preset exposure surface detection rules are converted into graph query statements; Based on a preset period or in response to an event, the graph query statement is used to traverse the exposure surface knowledge graph and identify the target exposure paths that pose a risk. The preset exposure surface detection rules include at least one of the following: rules for identifying external exposure surfaces, security vulnerability exposure surfaces, security configuration redundancy, protection deficiencies, and architectural compliance.

[0007] In one implementation, the step of traversing the exposure surface knowledge graph using the graph query statement to identify risky target exposure paths includes at least one of the following: When the entity nodes of the exposure surface knowledge graph include port nodes, if the asset node, exposure edge and port node are found using the graph query statement and the port node is in the open state, a target exposure path with external exposure surface risk is determined. When the entity nodes of the exposure surface knowledge graph include service nodes and port nodes, if the asset node, exposure edge, port node, running edge and service node are found by using the graph query statement and it is determined that the service node has a vulnerability, the target exposure path with security vulnerability exposure surface risk is determined. When the entity nodes of the exposure surface knowledge graph include security policy nodes, domain name nodes, and IP address nodes, if the security policy node, protection edge, and domain name node are found using the graph query statement and the domain name node does not have a domain name resolution edge with the IP address node, a target exposure path with security configuration redundancy risk is determined. When the entity nodes of the exposure surface knowledge graph include security policy nodes and domain name nodes, if the graph query statement finds that there is no protection edge between the security policy node and the domain name node, a target exposure path with a risk of protection deficiency is determined. When the entity nodes of the exposure surface knowledge graph include domain name nodes and load balancer nodes, if the domain name node, domain name resolution edge and load balancer node are found by using the graph query statement and the vendor attribute in the load balancer node is not a preset source, a target exposure path with architectural compliance risk is determined. When the entity nodes of the exposure surface knowledge graph include at least one of IP address nodes and domain name nodes, if external threat information is detected, the graph query statement is used to query the external threat information to find that the external threat information involves at least one of IP address nodes and domain name nodes, and the target exposure path with security vulnerability exposure surface risk is determined. If the entity nodes of the exposure surface knowledge graph include domain name nodes, and the last domain name resolution time of the domain name node is found to exceed a preset time interval when the graph query statement is used, a target exposure path with security configuration redundancy risk is determined.

[0008] In one implementation, automatically generating and assigning disposal tasks based on the target exposure path includes: Based on the target exposure path, target exposure information and the corresponding asset responsible person are determined. The target exposure information includes target nodes with risks, and at least one of the following: target detection rules triggered in the preset exposure surface detection rules, associated nodes affected by the target nodes, and the importance of the target nodes. Based on the target exposure information, disposal tasks are automatically generated and assigned to the asset responsible person for disposal.

[0009] In one embodiment, the method further includes: The disposal task is monitored. When the asset responsible person completes the disposal task, new configuration information is obtained, and the target exposure path is verified through the new configuration information. Once the verification is successful, the exposure surface knowledge graph is dynamically updated based on the new configuration information.

[0010] Secondly, embodiments of this application provide a risk management device based on an exposure surface knowledge graph, comprising: The acquisition module is used to acquire asset information and asset configuration information; The construction module is used to construct an exposure surface knowledge graph based on the asset information and the configuration information using a graph data model; The identification module is used to traverse the exposure surface knowledge graph based on preset exposure surface detection rules to identify target exposure paths that pose a risk. The handling module is used to automatically generate and assign handling tasks based on the target exposure path.

[0011] In one embodiment, the processing module is further configured to: The disposal task is monitored. When the asset responsible person completes the disposal task, new configuration information is obtained, and the target exposure path is verified through the new configuration information. Once the verification is successful, the exposure surface knowledge graph is dynamically updated based on the new configuration information.

[0012] Thirdly, embodiments of this application provide an electronic device, including: a processor and a memory, wherein the memory stores instructions that are loaded and executed by the processor to implement the methods in any of the above-described embodiments.

[0013] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when executed, implements the methods in any of the above-described embodiments.

[0014] The beneficial effects of the above technical solution include at least the following: By acquiring asset information and its configuration information, and constructing an exposure surface knowledge graph using a graph data model, it is beneficial to standardize and unify scattered data and record the relationships between data. Based on preset exposure surface detection rules, the exposure surface knowledge graph is traversed to identify risky target exposure paths without the need for multi-table join queries, which improves analysis and response efficiency. Based on the target exposure paths, disposal tasks are automatically generated and assigned. The generation and allocation of disposal tasks do not require manual intervention, which improves efficiency and avoids omissions.

[0015] The above overview is for illustrative purposes only and is not intended to be limiting in any way. In addition to the illustrative aspects, embodiments, and features described above, these aspects, embodiments, and features will become readily apparent from the accompanying drawings and the following detailed description. Attached Figure Description

[0016] In the accompanying drawings, unless otherwise specified, the same reference numerals throughout the various drawings denote the same or similar parts or elements. These drawings are not necessarily drawn to scale. It should be understood that these drawings depict only some embodiments disclosed in this application and should not be construed as limiting the scope of this application.

[0017] Figure 1 This is a schematic flowchart illustrating the steps of a risk management method based on an exposure surface knowledge graph according to an embodiment of this application; Figure 2 This is a schematic diagram of an exposure surface knowledge graph according to an embodiment of this application; Figure 3 This is a structural block diagram of a risk management device based on an exposure surface knowledge graph according to an embodiment of this application; Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0018] In the following description, only certain exemplary embodiments are briefly described. As those skilled in the art will recognize, the described embodiments can be modified in various ways without departing from the spirit or scope of this application. Therefore, the drawings and description are considered to be exemplary in nature and not restrictive.

[0019] Reference Figure 1 The flowchart illustrates a risk management method based on an exposure surface knowledge graph according to an embodiment of this application. This risk management method based on the exposure surface knowledge graph may include at least steps S100-S400: S100: Obtain asset information and asset configuration information.

[0020] S200. Based on asset information and configuration information, construct an exposure surface knowledge graph using a graph data model.

[0021] S300: Based on preset exposure surface detection rules, traverse the exposure surface knowledge graph to identify target exposure paths with risks.

[0022] S400: Automatically generate and assign disposal tasks based on the target exposure path.

[0023] The technical solution of this application embodiment obtains asset information and asset configuration information, and constructs an exposure surface knowledge graph through a graph data model based on the asset information and configuration information. This is beneficial for standardizing and unifying scattered data and recording the relationships between data. Based on preset exposure surface detection rules, the exposure surface knowledge graph is traversed to identify target exposure paths with risks, without the need for multi-table join queries, which is beneficial for improving analysis and response efficiency. According to the target exposure path, disposal tasks are automatically generated and assigned. The generation and assignment of disposal tasks do not require manual intervention, which is beneficial for improving efficiency and avoiding omissions.

[0024] It should be noted that the system architecture of this application embodiment includes a data source layer, a graph construction layer, a core analysis layer, and an application display layer. In step S100, asset information is obtained from the asset list of at least one data source and configuration information of the assets is obtained from at least one data source through the data source layer; the asset information includes, but is not limited to, the asset's value (criticality), and the person responsible for the asset; for ease of explanation, exemplarily, such as... Figure 2 As shown, the asset is server (APP-Srv-01), and the owner of the asset is Zhang San.

[0025] In addition, configuration information includes, but is not limited to, configuration content associated with assets, such as CMDB (Configuration Management Database), port scanners (such as Nmap), DNS records, protection platforms (such as WAF, DDoS), IP addresses, port information, service information, domain name information, protection policy information, etc. in vulnerability scanners. Through this information, we can know what IP addresses, ports, services, protection policies, mutual resolution, operation, traffic transmission, dependencies, ownership, and other relationships exist, providing a data foundation for the subsequent generation of exposure surface knowledge graphs.

[0026] In one implementation, the graph construction layer performs step S200 to construct the exposure surface knowledge graph; step S200 includes steps S210-S230: S210. Based on the assets and the asset responsible persons, create asset nodes and asset responsible person nodes respectively through the graph data model, and establish the belonging edges between the asset nodes and the asset responsible person nodes.

[0027] like Figure 2 As shown, asset nodes are created using a graph data model based on assets, such as APP-Srv-01, with a criticality of high and DB-Srv-01. Asset responsible persons are created using a graph data model based on asset responsible persons (i.e., personnel nodes Person, Employee, department: Application Department). Then, the belonging edge OWNS between asset nodes and asset responsible persons nodes is established: (Employee)-[OWNS]->(Asset).

[0028] Optionally, when there are business dependencies between different asset nodes, a dependency edge DEPENDS_ON can be established to represent the mutual dependencies and influences between asset nodes.

[0029] S220. Based on the configuration information, create entity nodes associated with asset nodes through the graph data model, and establish the association edges between entity nodes and asset nodes, as well as the association edges between entity nodes.

[0030] For example, with Figure 2 For example, an exposure surface knowledge graph is shown. Figure 2 The content does not limit the exposure surface knowledge graph and can be adjusted based on actual circumstances. Optionally, entity nodes include IP address nodes, port nodes, service nodes, domain name nodes, load balancing nodes, and security policy nodes, and associated edges include exposure edges, operation edges, domain name resolution edges, transmission edges, and protection edges.

[0031] Optionally, S220 includes S2201-S2204: S2201. Based on the IP address and port information, create IP address nodes and port nodes respectively through the graph data model, and establish the ownership edge between the asset node and the IP address node, as well as the exposure edge between the asset node and the port node.

[0032] Optionally, an IP address node is created using a graph data model based on the IP address, with the IP address being 203.0.113.10 and the type being public. Port nodes, such as Port443 and Port22, are created using a graph data model based on port information. Each port has a corresponding status, such as open or closed. An owned edge HAS (indicating that the asset node owns an IP address) is established between the asset node and the IP address node, and an exposed edge EXPOSES is established between the asset node and the port node, indicating that the asset node has opened a certain port.

[0033] S2202. Create a service node based on the service information and establish a running edge between the service node and the port node.

[0034] Optionally, service nodes can be created based on service information, such as Nginx v1.16 (Web service), and a running edge RUNS can be established between the service node and the port node, representing the service running on the port.

[0035] S2203. Create domain name nodes and load balancer nodes based on domain name information, and establish domain name resolution edges between domain name nodes and load balancer nodes and / or between domain name nodes and IP address nodes, as well as establish transmission edges between load balancer nodes and asset nodes.

[0036] Optionally, domain name nodes and load balancer nodes are created based on domain name information, such as domain name nodes Domain:api.example.com, Domain:shop.example.com, load balancer node CLB, and a domain name resolution edge (such as RESOLVES_TO, representing the domain name resolution relationship) is established between the domain name node and the load balancer node and / or between the domain name node and the IP address node, and a transmission edge FORWARDS_TO is established between the load balancer node and the asset node to represent the transmission of traffic.

[0037] S2204. Create a security policy node based on the protection policy information, and establish a protection edge between the security policy node and the domain name node.

[0038] Optionally, a security policy node, such as WAF Policy: Policy_Web, is created based on the protection policy information, and a protection edge PROTECTS is established between the security policy node and the domain name node, indicating that the protection policy protects the domain name node.

[0039] 230. Construct an exposure surface knowledge graph based on asset nodes, asset responsible person nodes, entity nodes, ownership edges, and association edges.

[0040] Therefore, based on asset nodes, asset responsible person nodes, entity nodes, ownership edges, and association edges, an exposure surface knowledge graph can be constructed.

[0041] In one implementation, the core analysis layer executes steps S300, S400, and S500 to traverse the exposure surface knowledge graph based on preset exposure surface detection rules, determine the target exposure path, generate and assign disposal tasks, and notify the graph construction layer to update the exposure surface knowledge graph after the disposal tasks are completed.

[0042] Step S300 includes steps S310-S320: S310. Convert the preset exposed surface detection rules into graph query statements.

[0043] The system includes preset exposure surface detection rules, which are pre-defined based on actual conditions and stored in an exposure surface detection rule base. This base is extensible, and the preset exposure surface detection rules within it can be efficiently queried using a rule engine combined with a graph database. For example, the preset exposure surface detection rules may include rules for identifying external exposure surfaces, security vulnerability exposure surfaces, redundant security configurations, inadequate protection, and architectural compliance. These rules can be numbered based on rule numbers such as R1-R10. Other embodiments may include one or more of the aforementioned rules. The system in this embodiment converts each rule in the preset exposure surface detection rules into a graph query statement using the rule engine, thereby automatically performing subsequent queries based on the graph query statement.

[0044] S320. Based on a preset period or in response to an event, use graph query statements to traverse the exposure surface knowledge graph and identify target exposure paths with risks.

[0045] Optionally, a preset period can be set, such as every hour or every 10 minutes. Based on this preset period, a graph query statement can be used to traverse the exposure surface knowledge graph. Alternatively, in response to an event-driven event, such as a user initiating a detection command, a graph query statement can be used to traverse the exposure surface knowledge graph, thereby identifying risky target exposure paths after the traversal. It should be noted that a target exposure path refers to the path determined by querying the nodes and edge connection directions of the exposure surface knowledge graph according to the graph query statement, leading to at least one risky entity node. Displaying the complete target exposure path is more beneficial for asset owners to understand the complete risk path than displaying only a single risky entity node.

[0046] Optionally, S320 includes at least one of steps S3201-S3207: S3201. When the entity nodes of the exposure surface knowledge graph include port nodes, if the asset node, exposure edge and port node are found by using the graph query statement and the port node is in the open state, the target exposure path with external exposure surface risk is determined.

[0047] Optionally, when the entity nodes of the exposure surface knowledge graph include port nodes, if the asset node, exposure edge, and port node are found using a graph query statement (e.g., converted from rule R1) and the port node is in an open state, the search path is "(Asset: Server)->[HAS]->EXPOSES_PORT {status: open}->(Port)", and the port node Port22 is found, the port node exposure risk is identified, and thus the target exposure path with external exposure surface risk is determined; where rule R1 is a rule for identifying external exposure surfaces, and the target is the port node of all asset nodes with public IP addresses.

[0048] S3202. When the entity nodes of the exposure surface knowledge graph include service nodes and port nodes, if the asset node, exposure edge, port node, running edge and service node are found by using the graph query statement and it is determined that the service node has a vulnerability, the target exposure path with security vulnerability exposure surface risk is determined.

[0049] Optionally, when the entity nodes of the exposure surface knowledge graph include service nodes and port nodes, if a graph query (e.g., derived from rule R2) retrieves asset nodes, exposure edges, port nodes, running edges, and service nodes, and determines that a service node has a vulnerability, the query path is: (Asset: Server)->EXPOSES_PORT>RUNS->Service. Then, the system detects and confirms that the service node Service has a vulnerability. At this point, the system automatically uses the graph data model to add the vulnerable edge HAS_VULN and the vulnerability node Vuinerability, which is CVE-2021-23017 with a severity of high. The final target exposure path for identifying the security vulnerability exposure surface risk is: Asset: Server)->EXPOSES_PORT>RUNS->Service->[HAS_VULN]->(Vuln). Rule R2 is a rule for identifying the security vulnerability exposure surface, and its target is all service nodes with vulnerabilities.

[0050] In one implementation, it may also include a graph query statement converted from rule R8, traversing the exposure surface knowledge graph, and after determining that the service node Service has a vulnerability detected by R1, further identifying whether the service node Service exposes the management backend. If the management backend is exposed, the above path Asset:Server)-[]->EXPOSES_PORT>RUNS->Service can also be used as the target exposure path of rule R8. R8 is also a rule for identifying external exposure surfaces.

[0051] S3203. When the entity nodes of the exposed surface knowledge graph include security policy nodes, domain name nodes, and IP address nodes, if a security policy node, protection edge, and domain name node are found using a graph query statement, and the domain name node does not have a domain name resolution edge with the IP address node, then the target exposed path with security configuration redundancy risk is determined.

[0052] Optionally, when the entity nodes of the exposed surface knowledge graph include security policy nodes, domain name nodes, and IP address nodes, if a graph query statement (e.g., converted from rule R3) is used to query security policy nodes, protection edges, and domain name nodes, and the domain name nodes do not have a domain name resolution edge with the IP address nodes, the query path is: service WAF_Policy->[PROTECTS]->(Domain). Then, the search continues and it is found that there is no domain name resolution edge RESOLVES_TO, thus determining the target exposure path with security configuration redundancy risk. Here, rule R3 is a rule for identifying security configuration redundancy, and its goal is to determine whether the security policies involved in all security policy nodes are effectively protected and to identify whether there is an invalid security configuration. If the security policy node is DDoS, then the rule used in S3203 is denoted as R4, which is also a rule for identifying security configuration redundancy.

[0053] S3204. When the entity nodes of the exposure surface knowledge graph include security policy nodes and domain name nodes, if a graph query statement is used to find that there is no protection edge between the security policy node and the domain name node, the target exposure path with the risk of protection deficiency is determined.

[0054] Optionally, when the entity nodes of the exposure surface knowledge graph include security policy nodes and domain name nodes, if a graph query (e.g., derived from rule R5) finds that there is no protection edge between the security policy node and the domain name node, for example, the path is: WAF_Policy->[PROTECTS]->(Domain), and it is found that only WAF_Policy can be found, while the protection edge PROTECTS is missing, then the target exposure path with a risk of protection deficiency is identified. Rule R5 is a rule for identifying protection deficiency, and its goal is to identify whether a domain name (such as a public domain name) is protected. If the security policy node is a DDoS attack, then the rule used in S3204 is denoted as R6, which is also a rule for identifying protection deficiency.

[0055] S3205. When the entity nodes of the exposed surface knowledge graph include domain name nodes and load balancer nodes, if a graph query statement is used to find domain name nodes, domain name resolution edges and load balancer nodes, and the vendor attribute in the load balancer node is not a preset source, the target exposure path with architectural compliance risk is determined.

[0056] Optionally, when the entity nodes of the exposed knowledge graph include domain name nodes and load balancer nodes, if a graph query (e.g., derived from rule R7) retrieves domain name nodes, domain name resolution edges, and load balancer nodes, and the vendor attribute in the load balancer node is not a preset source (e.g., the preset source is usually a self-developed load balancer), the path is: (Domain)-[RESOLVES_TO]->(CLB). If it is identified that the source is not a self-developed load balancer, but something else, such as not the self-developed load balancer APP-Srv-01, but a public cloud, then a target exposure path with architectural compliance risk is identified. Rule R7 is a rule for identifying architectural compliance risks, and its goal is to query the resolution records of all domain name nodes to analyze the domain name pointers.

[0057] S3206. When the entity nodes of the exposure surface knowledge graph include at least one of IP address nodes and domain name nodes, if external threat information is detected, the graph query statement is used to query the external threat information involving at least one of IP address nodes and domain name nodes, and the target exposure path with security vulnerability exposure surface risk is determined.

[0058] Optionally, when the entity nodes of the exposure surface knowledge graph include at least one of IP address nodes and domain name nodes, if external threat information is detected, a graph query (e.g., derived from rule R9) is used to query whether the external threat information involves at least one of the IP address nodes and domain name nodes. That is, if the query indicates that the external threat information may endanger at least one of the IP address nodes and domain name nodes, then it is necessary to search the exposure surface knowledge graph for the existence of the same IP address node and domain name node based on the external threat information. If so, the target exposure path with security vulnerability exposure surface risk is determined. For example, if external threat information from the attack group Attack_Group:APT41 is detected, with api.example.com as the attack target, the system will automatically establish corresponding threat intelligence source nodes, attack group nodes, and target edges TARGETS based on the threat intelligence source, attack group, and attack target: api.example.com. Rule R9 is a rule for identifying security vulnerability exposure surfaces, with the goal of locating potentially compromised or high-risk targets.

[0059] S3207. When the entity nodes of the exposed surface knowledge graph include domain name nodes, if the last domain name resolution time of the domain name node is found to exceed the preset time interval using a graph query statement, a target exposed path with a risk of security configuration redundancy is identified.

[0060] Optionally, when the entity nodes of the exposed knowledge graph include domain name nodes, if a graph query (e.g., derived from rule R10) finds that the last domain name resolution time of a domain name node exceeds a preset time interval (exemplarily 14 days), a target exposure path with security configuration redundancy risk is identified. For example, if the resolution time of a domain name node or a subdomain (not shown) under a domain name node is 30 days, a target exposure path with security configuration redundancy risk is identified, thus identifying the risk of abandoned assets. Rule R10 is a rule for identifying security configuration redundancy.

[0061] In some embodiments, specialized scanners (such as code scanners, protocol detectors, and domain name monitors) can be configured to detect relevant rules beyond R1-R10, identify risks of service nodes, and for example, if a scan discovers that a service uses the FTP protocol and there is a risk, the target exposed path can be identified and tagged with "protocol: insecure". Affected related nodes can be created and added to the graph. Furthermore, corresponding action orders can be generated subsequently.

[0062] In one implementation, after determining the target exposure path, an alarm can also be generated and displayed on a panoramic risk view.

[0063] In one embodiment, step S400 includes steps S410-S420: S410. Based on the target exposure path, determine the target exposure information and the corresponding asset responsible person, target exposure information.

[0064] Optionally, the target exposure information includes the target node with risk (i.e., the node with a problem detected based on the preset exposure surface detection rules or the node connected by the edge with the problem), the target detection rule triggered in the preset exposure surface detection rules (e.g., the rule number), the associated nodes affected by the target node (e.g., the nodes connected by the dependent edge), and the importance of the target node (the importance of each node is preset in the configuration information). Other embodiments may include one or more of the above information.

[0065] S420. Automatically generate disposal tasks based on target exposure information and assign them to asset responsible persons for disposal.

[0066] Optionally, the handling task can be in the form of a handling work order. A handling work order is automatically generated based on the target exposure information. In addition to the aforementioned target exposure information, the handling work order may also include handling suggestions. Figure 2In this example, there is only one asset responsible party. Therefore, all disposal work orders generated based on the exposure surface knowledge graph are automatically assigned to the asset responsible party, Zhang San. Zhang San then handles the disposal work orders accordingly. In some embodiments, multiple asset responsible parties can be set, for example, different asset responsible parties can be set based on the detection results corresponding to different rule numbers, to specifically handle disposal work orders corresponding to one or more rule numbers. Simultaneously, when the exposure surface knowledge graph determines to generate a disposal work order, it generates a work order node, recording the current status of the disposal work order, such as "processing," and automatically generating a title for the disposal work order. The title can be the corresponding disposal suggestion. It also generates tracking edges (TRACKS) between the work order node and the corresponding risky nodes for subsequent checks on whether the risk has been resolved. For example: For the target exposure path determined by R1, generate a handling work order (INC-001). Handling recommendation: shut down or harden port node Port22; For R2, generate a work order with the following suggestion: Zhang San upgrades the Nginx version. For R3, generate a work order with the following recommendations: Zhang San should assess whether to remove it from WAF, or Zhang San should contact the security team to assess whether to remove it from WAF_Policy; For R5, generate a high-priority action order with the following action suggestion: Zhang San or Zhang San contact should immediately connect the domain name to the security policy node so that protection edges (PROTECTS) can be automatically established when constructing the exposure surface knowledge graph later. For R7, generate a work order with the following suggestion: Zhang San or Zhang San should contact the architect to assess the necessity of migrating to the self-developed CLB. For R8, generate a high-priority work order with the following recommendations: It is recommended that Zhang San or Zhang San contact the administrator to immediately migrate the management backend to the intranet. For R9, generate a work order with the following recommendations: Inform Zhang San that a security incident has occurred and suggest further in-depth detection and monitoring. For R10, generate a work order with the following suggestion: It is recommended that Zhang San or Zhang San notify the domain administrator to confirm and clean up the site.

[0067] In one embodiment, the risk management method based on exposure surface knowledge graph of this application may further include steps S510-S520: S510. Monitor the disposal task. When it is detected that the person in charge of the asset has completed the disposal task, obtain new configuration information and verify the target exposure path through the new configuration information.

[0068] Optionally, the disposal task can be monitored through the work order node. When it is detected that the asset responsible person has completed the disposal task, the work order node will receive a completion status signal and then obtain new configuration information. This can refer to re-obtaining all configuration information as new configuration information, or it can refer to obtaining only the configuration information related to the entity node of the tracking edge TRACKS connected to the work order node as new configuration information, verifying the previously determined target exposure path, and determining whether the risk has been resolved.

[0069] S520. Once verification is successful, the knowledge graph of the exposed surface is dynamically updated based on the new configuration information.

[0070] Optionally, once the verification is successful, it indicates that the existing risks have been resolved. At this point, the exposure surface knowledge graph can be dynamically updated based on the new configuration information.

[0071] It should be noted that the system will periodically acquire new asset information and new configuration information based on preset intervals, and automatically and dynamically update the exposure surface knowledge graph to ensure its integrity.

[0072] For example, let's take an example of traversing using rule R5 to demonstrate a complete closed loop: [Initial] Exposure surface knowledge graph shows risk: In the exposure surface knowledge graph, Server: App-Srv-01 is associated with a port node: Port: 22 (state is open) through the exposure edge EXPOSES.

[0073] [Detection] Rule-triggered alarm: R5 rules executed periodically hit this path through graph query and generate an alarm.

[0074] [Closed Loop] Generate and process work orders: The system automatically creates a work order node, and the corresponding work order INC-001 is assigned to the asset manager Zhang San, who is advised to close port 22 or strengthen access control. Zhang San completes the processing.

[0075] [Monitoring] Verification and Knowledge Graph Update: The next round of port scanning verifies that port 22 is closed. If the verification is successful, the system will automatically update the status attribute of Port: 22 in the exposure surface knowledge graph to closed, and the work order status will be synchronized to "Resolved".

[0076] [Feedback] Loop Re-detection: After the status update, when the R5 rule is executed again, it will no longer hit App-Srv-01, and this risk item will be automatically closed. At the same time, monitoring continues to run. If this port is opened again in the future, it will be immediately scanned and the exposure surface knowledge graph will be updated, automatically triggering a new round of R5 detection and alerts, thus forming an autonomous loop of "perception-decision-action-learning".

[0077] The embodiments of this application have at least the following effects: 1. It can continuously collect asset information and configuration information from multiple data sources, unifying discrete data collection, providing comprehensive data, and automatically converting it into corresponding nodes and edges by combining graph data models, automatically and dynamically constructing an exposure surface knowledge graph, which is more convenient and efficient, and provides a unified and reliable source for deep association analysis.

[0078] 2. A pre-configured exposure surface detection rule library with preset exposure surface detection rules is connected to a graph database. Then, through the rule engine, the preset exposure surface detection rules are compiled into efficient graph query statements (such as Cypher and Gremlin). By traversing the graph in real time, nodes and target exposure paths that match high-risk scenario patterns are accurately discovered. By reusing the natural correlation characteristics and efficient traversal capabilities of the graph database, the analysis of complex attack paths and vulnerability impact ranges is achieved in seconds, improving the response speed by 1-2 orders of magnitude.

[0079] 3. After determining the target exposure path, the rules engine automatically generates and assigns disposal work orders based on the asset responsible person, and continuously monitors the feedback on whether the disposal work orders are completed to determine whether the risk has been resolved. After resolution, it updates the exposure surface knowledge graph, forming a governance closed loop of "discovery - alert - disposal - verification update". This greatly reduces manual intervention and context switching, significantly improves governance efficiency and thoroughness, and ensures that risks are traceable and verifiable.

[0080] 4. By utilizing work orders or the exposure surface knowledge graph, a visual representation of all nodes and edges can be provided, allowing personnel to observe a panoramic risk view. When new assets or configuration information are added, the exposure surface knowledge graph is automatically updated and re-traversed for detection, ensuring timeliness and providing continuous adaptive security capabilities. For example, by accessing the exposure surface knowledge graph through the application presentation layer, a panoramic risk view can be generated. For work orders, all work orders are displayed on the management console's control page for easy monitoring. Corresponding risk reports can be generated for detected risk nodes and target exposure paths, and data can be displayed through a metrics dashboard, showing the number of times the target exposure path was generated, the number of times different rules were triggered, and so on.

[0081] Reference Figure 3 The diagram illustrates a structural block diagram of a risk management device based on an exposure surface knowledge graph according to an embodiment of this application. The device may include: The acquisition module is used to acquire asset information and asset configuration information; The building module is used to construct an exposure surface knowledge graph based on asset information and configuration information using a graph data model; The identification module is used to traverse the exposure surface knowledge graph based on preset exposure surface detection rules to identify target exposure paths that pose a risk. The disposal module is used to automatically generate and assign disposal tasks based on the target exposure path.

[0082] In one implementation, the processing module is further configured to: Monitor the disposal task; when the asset responsible person completes the disposal task, obtain new configuration information and verify the target exposure path through the new configuration information. Once the verification is successful, the knowledge graph of the exposure surface will be dynamically updated based on the new configuration information.

[0083] The functions of each module in the device of this application embodiment can be found in the corresponding description in the above method, and will not be repeated here.

[0084] Reference Figure 4 The diagram illustrates a structural block diagram of an electronic device according to an embodiment of this application. The electronic device includes a memory 310 and a processor 320. The memory 310 stores instructions that can be executed on the processor 320. The processor 320 loads and executes these instructions to implement the risk management method based on exposure surface knowledge graphs in the above embodiment. The number of memories 310 and processors 320 can be one or more.

[0085] In one embodiment, the electronic device further includes a communication interface 330 for communicating with external devices and exchanging data. If the memory 310, processor 320, and communication interface 330 are implemented independently, they can be interconnected via a bus to communicate with each other. This bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. This bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0086] Optionally, in a specific implementation, if the memory 310, processor 320 and communication interface 330 are integrated on a single chip, the memory 310, processor 320 and communication interface 330 can communicate with each other through an internal interface.

[0087] This application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the risk management method based on exposure surface knowledge graph provided in the above embodiments.

[0088] This application also provides a chip, which includes a processor for calling and executing instructions stored in a memory, causing a communication device on which the chip is installed to perform the method provided in this application.

[0089] This application also provides a chip, including: an input interface, an output interface, a processor, and a memory. The input interface, output interface, processor, and memory are connected through an internal connection path. The processor is used to execute code in the memory. When the code is executed, the processor is used to execute the method provided in the application embodiment.

[0090] It should be understood that the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. General-purpose processors can be microprocessors or any conventional processor. It is worth noting that the processor can be a processor supporting the Advanced Reduced Instruction Set Computing (RISC) machine (ARM) architecture.

[0091] Further, optionally, the aforementioned memory may include read-only memory and random access memory, and may also include non-volatile random access memory. The memory may be volatile or non-volatile, or may include both. Non-volatile memory may include read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory may include random access memory (RAM), which serves as an external cache. Many forms of RAM are available by way of example, but not limitation. Examples include static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0092] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another.

[0093] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of those different embodiments or examples.

[0094] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "a plurality of" means two or more, unless otherwise explicitly specified.

[0095] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process. Furthermore, the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functionality involved.

[0096] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus or device (such as a computer-based system, a processor-included system or other system that can fetch and execute instructions from, an instruction execution system, apparatus or device).

[0097] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. All or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware, the program being stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiments.

[0098] Furthermore, the functional units in the various embodiments of this application can be integrated into a single processing module, or each unit can exist physically separately, or two or more units can be integrated into a single module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. This storage medium can be a read-only memory, a disk, or an optical disk, etc.

[0099] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various variations or substitutions within the technical scope disclosed in this application, and these should all be included within the scope of protection of this application.

Claims

1. A risk management method based on exposure surface knowledge graph, characterized in that, include: Obtain asset information and asset configuration information; Based on the asset information and the configuration information, an exposure surface knowledge graph is constructed using a graph data model; Based on preset exposure surface detection rules, the exposure surface knowledge graph is traversed to identify target exposure paths with risks. Based on the target exposure path, disposal tasks are automatically generated and assigned.

2. The risk management method based on exposure surface knowledge graph according to claim 1, characterized in that: The asset information includes assets and the person responsible for the assets; the step of constructing an exposure surface knowledge graph using a graph data model based on the asset information and the configuration information includes: Based on the asset and the asset responsible person, create asset nodes and asset responsible person nodes respectively through the graph data model, and establish the belonging edge between the asset node and the asset responsible person node; Based on the configuration information, entity nodes associated with the asset nodes are created through the graph data model, and association edges between the entity nodes and the asset nodes, as well as association edges between the entity nodes, are established. An exposure surface knowledge graph is constructed based on the asset nodes, the asset responsible person nodes, the entity nodes, the attribution edges, and the association edges.

3. The risk management method based on exposure surface knowledge graph according to claim 2, characterized in that: The configuration information includes IP address, port information, service information, domain name information, and protection policy information; the step of creating entity nodes associated with the asset nodes through the graph data model based on the configuration information, and establishing the association edges between the entity nodes and the asset nodes, as well as the association edges between the entity nodes, includes: Based on the IP address and the port information, IP address nodes and port nodes are created respectively through the graph data model, and ownership edges between the asset node and the IP address node and exposure edges between the asset node and the port node are established; A service node is created based on the service information, and a running edge is established between the service node and the port node; Create domain name nodes and load balancer nodes based on the domain name information, establish domain name resolution edges between the domain name nodes and the load balancer nodes and / or between the domain name nodes and the IP address nodes, and establish a transmission edge between the load balancer nodes and the asset nodes; A security policy node is created based on the protection policy information, and a protection edge is established between the security policy node and the domain name node; The entity nodes include the IP address node, the port node, the service node, the domain name node, the load balancing node, and the security policy node, and the associated edges include the exposure edge, the running edge, the domain name resolution edge, the transmission edge, and the protection edge.

4. The risk management method based on exposure surface knowledge graph according to claim 2, characterized in that: The step of traversing the exposure surface knowledge graph based on preset exposure surface detection rules to identify risky target exposure paths includes: The preset exposure surface detection rules are converted into graph query statements; Based on a preset period or in response to an event, the graph query statement is used to traverse the exposure surface knowledge graph and identify the target exposure paths that pose a risk. The preset exposure surface detection rules include at least one of the following: rules for identifying external exposure surfaces, security vulnerability exposure surfaces, security configuration redundancy, protection deficiencies, and architectural compliance.

5. The risk management method based on exposure surface knowledge graph according to claim 4, characterized in that: The step of using the graph query statement to traverse the exposure surface knowledge graph and identify risky target exposure paths includes at least one of the following: When the entity nodes of the exposure surface knowledge graph include port nodes, if the asset node, exposure edge and port node are found using the graph query statement and the port node is in the open state, a target exposure path with external exposure surface risk is determined. When the entity nodes of the exposure surface knowledge graph include service nodes and port nodes, if the asset node, exposure edge, port node, running edge and service node are found by using the graph query statement and it is determined that the service node has a vulnerability, the target exposure path with security vulnerability exposure surface risk is determined. When the entity nodes of the exposure surface knowledge graph include security policy nodes, domain name nodes, and IP address nodes, if the security policy node, protection edge, and domain name node are found using the graph query statement and the domain name node does not have a domain name resolution edge with the IP address node, a target exposure path with security configuration redundancy risk is determined. When the entity nodes of the exposure surface knowledge graph include security policy nodes and domain name nodes, if the graph query statement finds that there is no protection edge between the security policy node and the domain name node, a target exposure path with a risk of protection deficiency is determined. When the entity nodes of the exposure surface knowledge graph include domain name nodes and load balancer nodes, if the domain name node, domain name resolution edge and load balancer node are found by using the graph query statement and the vendor attribute in the load balancer node is not a preset source, a target exposure path with architectural compliance risk is determined. When the entity nodes of the exposure surface knowledge graph include at least one of IP address nodes and domain name nodes, if external threat information is detected, the graph query statement is used to query the external threat information to find that the external threat information involves at least one of IP address nodes and domain name nodes, and the target exposure path with security vulnerability exposure surface risk is determined. If the entity nodes of the exposure surface knowledge graph include domain name nodes, and the last domain name resolution time of the domain name node is found to exceed a preset time interval when the graph query statement is used, a target exposure path with security configuration redundancy risk is determined.

6. The risk management method based on exposure surface knowledge graph according to claim 2, characterized in that: The step of automatically generating and assigning disposal tasks based on the target exposure path includes: Based on the target exposure path, target exposure information and the corresponding asset responsible person are determined. The target exposure information includes target nodes with risks, and at least one of the following: target detection rules triggered in the preset exposure surface detection rules, associated nodes affected by the target nodes, and the importance of the target nodes. Based on the target exposure information, disposal tasks are automatically generated and assigned to the asset responsible person for disposal.

7. The risk management method based on exposure surface knowledge graph according to claim 6, characterized in that: The method further includes: The disposal task is monitored. When the asset responsible person completes the disposal task, new configuration information is obtained, and the target exposure path is verified through the new configuration information. Once the verification is successful, the exposure surface knowledge graph is dynamically updated based on the new configuration information.

8. A risk management device based on exposure surface knowledge graph, characterized in that, include: The acquisition module is used to acquire asset information and asset configuration information; The construction module is used to construct an exposure surface knowledge graph based on the asset information and the configuration information using a graph data model; The identification module is used to traverse the exposure surface knowledge graph based on preset exposure surface detection rules to identify target exposure paths that pose a risk. The handling module is used to automatically generate and assign handling tasks based on the target exposure path.

9. An electronic device, characterized in that, include: A processor and a memory, wherein instructions are stored in the memory and loaded and executed by the processor to implement the method as claimed in any one of claims 1-7.

10. A computer-readable storage medium storing a computer program therein, which, when executed, implements the method as described in any one of claims 1-7.

Images