Information determination method and device, computer readable storage medium and computer program product

Abstract

The embodiment of the invention provides an information determination method. The method comprises the steps of obtaining first operation data of a virtual machine after the virtual machine is attacked; based on the first operation data, determining first behavior characteristic data of an attack behavior aiming at the virtual machine; acquiring historical behavior characteristic data of historical attack behaviors aiming at the virtual machine; determining target behavior feature data of the attack behavior based on the first behavior feature data and the historical behavior feature data; and determining the target attack path of the attack behavior based on the target behavior feature data, thereby solving the problems of poor efficiency and low accuracy of a mode of manually determining the attack path in related technologies. The embodiment of the invention further provides information determination equipment, a computer readable storage medium and a computer program product.

Description

Technical Field

[0001] This application relates to the field of security technology, and in particular to an information determination method, apparatus, computer-readable storage medium, and computer program product. Background Technology

[0002] Currently, when cloud servers (i.e., virtual machines) are subjected to malicious attacks, the usual method is to manually analyze the collected virtual machine runtime data to trace the attack source, i.e., determine the attack path, and then promptly patch security vulnerabilities based on that path. However, due to the significant limitations of manual operation, this method of determining attack paths is not only inefficient but also inaccurate, resulting in the inability to patch security vulnerabilities in a timely manner, which in turn seriously affects the operational security of the equipment. Summary of the Invention

[0003] To address the aforementioned technical problems, this application aims to provide an information determination method, device, computer-readable storage medium, and computer program product, thereby resolving the issues of low efficiency and accuracy in related technologies where attack paths are determined manually.

[0004] To achieve the above objectives, the technical solution of this application embodiment is implemented as follows: An information determination method, the method comprising: Obtain the first running data of the virtual machine after it has been attacked; Based on the first running data, first behavioral characteristic data of the attack behavior against the virtual machine is determined; Obtain historical behavioral characteristic data of historical attack behaviors against the virtual machine; Based on the first behavioral feature data and the historical behavioral feature data, the target behavioral feature data of the attack behavior is determined; Based on the target behavior feature data, the target attack path of the attack behavior is determined.

[0005] In the above scheme, the step of determining the first behavioral characteristic data of the attack behavior against the virtual machine based on the first running data includes: The first running data is classified according to the attack methods of the attack behavior to obtain multiple types of running data; The multiple types of operational data are fused based on a target fusion strategy to obtain fused operational data. The fused operational data is processed using a deep data detection algorithm to obtain the first behavioral feature data.

[0006] In the above scheme, determining the target behavioral characteristic data of the attack behavior based on the first behavioral characteristic data and the historical behavioral characteristic data includes: Determine a first degree of difference value between the first behavioral feature data and the historical behavioral feature data; If the first difference value is less than the first threshold, the target behavioral feature data is determined to be the first behavioral feature data. If the first difference value is greater than or equal to the first threshold, the second running data of the virtual machine within the target duration from the current moment is obtained, and the second running data is processed by a deep data detection algorithm to obtain the second behavioral feature data; The target behavioral feature data is determined based on the first behavioral feature data and the second behavioral feature data.

[0007] In the above scheme, determining the target behavioral feature data based on the first behavioral feature data and the second behavioral feature data includes: Determine a second degree of difference value between the first behavioral feature data and the second behavioral feature data; If the second difference value is less than the second threshold, the target behavioral feature data is determined from the first behavioral feature data and the second behavioral feature data; If the second difference value is greater than or equal to the second threshold, the behavior data of the virtual machine within the target duration after being attacked is obtained from the target data management platform, and the behavior data is processed by the deep data detection algorithm to obtain the third behavior feature data. The target behavioral feature data is determined based on the first behavioral feature data, the second behavioral feature data, and the third behavioral feature data.

[0008] In the above scheme, determining the target behavioral feature data based on the first behavioral feature data, the second behavioral feature data, and the third behavioral feature data includes: A third degree of difference value is determined between the first behavioral feature data and the third behavioral feature data, and a fourth degree of difference value is determined between the second behavioral feature data and the third behavioral feature data; The target difference value is determined from the second difference value, the third difference value, and the fourth difference value; The target behavioral characteristic data is determined based on the behavioral characteristic data corresponding to the target difference value.

[0009] In the above scheme, determining the target attack path of the attack behavior based on the target behavior feature data includes: Multiple candidate attack paths are determined based on the target behavior feature data; Determine the characteristic information of each candidate attack path; Based on the target behavior feature data and the feature information, the target attack path is determined from the plurality of candidate attack paths.

[0010] In the above scheme, determining the target attack path from the plurality of candidate attack paths based on the target behavior feature data and the feature information includes: An initial matrix is ​​constructed based on the target behavior feature data, and the format of the initial matrix is ​​converted to obtain a sparse matrix; Based on each feature information, the target vector corresponding to the multiple candidate attack paths is determined; The sparse matrix and the target vector are processed using a target data processing algorithm to obtain the target value corresponding to each candidate attack path; The target attack path is determined from the multiple candidate attack paths based on multiple target values.

[0011] An information determining device, the device comprising: The first acquisition unit is used to acquire the first running data of the virtual machine after it has been attacked; The first determining unit is configured to determine first behavioral characteristic data of the attack behavior against the virtual machine based on the first running data. The second acquisition unit is used to acquire historical behavioral feature data of historical attack behaviors against the virtual machine. The second determining unit is used to determine the target behavioral feature data of the attack behavior based on the first behavioral feature data and the historical behavioral feature data. The third determining unit is used to determine the target attack path of the attack behavior based on the target behavior feature data.

[0012] An information determining device, the device comprising: a processor, a memory, and a communication bus; The communication bus is used to realize the communication connection between the processor and the memory; The processor is used to execute the information determination program in the memory to implement the steps of the information determination method described above.

[0013] A computer-readable storage medium storing one or more programs that can be executed by one or more processors to implement the steps of the information determination method described above.

[0014] A computer program product comprising a computer program that, when executed by a processor, implements the aforementioned information determination method.

[0015] The information determination method, apparatus, device, computer-readable storage medium, and computer program product provided in this application can acquire first running data of a virtual machine after it has been attacked; determine first behavioral feature data of an attack behavior against the virtual machine based on the first running data; acquire historical behavioral feature data of historical attack behaviors against the virtual machine; determine target behavioral feature data of the attack behavior based on the first behavioral feature data and the historical behavioral feature data; and determine the target attack path of the attack behavior based on the target behavioral feature data. This allows for the automatic determination of the target attack path of an attack behavior based on the target behavioral data of the attack behavior against the virtual machine, instead of requiring manual determination of the attack path as in related technologies. This solves the problem of low efficiency in attack path determination methods in related technologies. Furthermore, this application first processes the first running data of the virtual machine after the attack to obtain the first behavioral feature data of the attack behavior, then combines it with historical behavioral feature data to determine the target behavioral feature data, and finally determines the target attack path of the attack behavior based on the final target behavioral feature data, rather than directly analyzing the running data of the virtual machine. This further improves the accuracy of the determined target attack path, thereby solving the problem of low accuracy in attack path determination methods in related technologies. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating an information determination method provided in an embodiment of this application; Figure 2 This is a schematic diagram of the first process of determining the target attack path in an information determination method provided in an embodiment of this application; Figure 3 This is a schematic diagram of the second process for determining the target attack path in an information determination method provided in an embodiment of this application; Figure 4 This is a flowchart illustrating the process of determining target behavior feature data in an information determination method provided in this application embodiment; Figure 5 This is a schematic diagram of the structure of an information determination device provided in an embodiment of this application; Figure 6 This is a schematic diagram of the structure of an information determination device provided in an embodiment of this application.

[0017] It should be noted that the terms "first" and "second" mentioned above are only used to distinguish between different options and do not represent the degree of superiority or inferiority of the options or their priority in the implementation process. Detailed Implementation

[0018] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0019] It should be understood that the phrases "embodiments of this application" or "foreign embodiments" throughout the specification mean that a specific feature, structure, or characteristic related to an embodiment is included in at least one embodiment of this application. Therefore, "embodiments of this application" or "in the foreign embodiments" appearing throughout the specification do not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. In the various embodiments of this application, the sequence numbers of the above-described processes do not imply a sequential order of execution; the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application. The sequence numbers of the above-described embodiments are merely descriptive and do not represent the superiority or inferiority of the embodiments.

[0020] Unless otherwise specified, any step in the embodiments of this application performed by the electronic device may be executed by the processor of the electronic device. It is also worth noting that the embodiments of this application do not limit the order in which the electronic device performs the following steps. Furthermore, the methods used to process data in different embodiments may be the same or different methods. It should also be noted that any step in the embodiments of this application can be executed independently by the electronic device; that is, when the electronic device performs any step in the following embodiments, it may not depend on the execution of other steps.

[0021] It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of this application.

[0022] This application provides an information determination method, which can be applied to an information determination device. (Refer to...) Figure 1 As shown, the method may include the following steps.

[0023] Step 101: Obtain the first running data of the virtual machine after it has been attacked.

[0024] In this application embodiment, the information determining device may refer to a server, such as... Figure 2 As shown, a virtual machine is a cloud host deployed on a server. There can be multiple cloud hosts, including cloud host A, cloud host B, cloud host C, and so on.

[0025] In this embodiment, the first operational data can be network traffic collected by agent software deployed on the virtual machine. It should be noted that the agent software can perform micro-level traffic monitoring and collection, covering all network communications entering and leaving the virtual machine. This provides high flexibility and customizability at the application level, enhancing the accuracy of the collected data and thus ensuring the accuracy of the identified target attack path.

[0026] In this embodiment of the application, the first operating data may include communication data for communicating with external devices.

[0027] In the embodiments of this application, such as Figure 2 and 3 As shown, the Agent software integrates four sub-modules: a brute-force attack sub-module, an abnormal login sub-module, a reverse shell sub-module, and a dynamic honeypot sub-module. It should be noted that these four sub-modules correspond to four mainstream attack methods (brute-force attack, abnormal login, reverse shell, and dynamic honeypot), meaning each sub-module collects attack data for its respective attack method. A reverse shell typically refers to an attacker exploiting vulnerabilities or social engineering techniques to execute malicious code on a target system, making the target system under the attacker's control. Once the attack is successful, the target system establishes a connection with a server controlled by the attacker, transferring control to the attacker. Brute-force attacks can also be called "exhaustive attacks" or "dictionary attacks." In this attack method, attackers attempt to gain unauthorized access to the attacked device by trying a large number of possible username and password combinations. Specifically, attackers use automated tools or scripts to try various possible passwords, such as common passwords, dictionary words, numbers, or symbol combinations, in order to find the correct credentials for the system. Abnormal logins refer to unusual login behavior occurring on a network or system. This behavior may indicate that the system's security has been compromised or that there are unauthorized access attempts, including: ① login attempts from unusual geographical locations or IP addresses; ② unusual login times; ③ unusual login behavior; ④ multiple failed login attempts; ⑤ unusual login patterns. Dynamic honeypots are used to identify and capture the behavior of network attackers. Unlike traditional honeypots, dynamic honeypots do not simply simulate the target system but are actual, running systems that are enhanced in terms of security or specially configured. They can be real systems, services, or applications, but are set to monitor and log any illegal activities interacting with them.

[0028] In one feasible approach, each submodule integrated into the Agent software corresponds to a port of the virtual machine. This means that if a port is attacked, the corresponding submodule can directly collect abnormal data from that port. It's important to note that the "first runtime data" can refer to the runtime data collected when at least one submodule detects an attack. In other words, any submodule that detects an attack will immediately collect the virtual machine's current runtime data and then determine the attack path in real time based on this data. This approach offers high real-time performance, significantly reducing response time and achieving efficient and dynamic analysis of security protection for cloud hosts, i.e., virtual machines.

[0029] Step 102: Based on the first running data, determine the first behavioral characteristic data of the attack behavior against the virtual machine.

[0030] In this embodiment of the application, after obtaining the first running data, the first running data can be subjected to deep packet inspection through a traffic mirroring service platform to obtain the first behavioral feature data of the attack behavior against the virtual machine.

[0031] In this application embodiment, the first behavior characteristic data may refer to traffic metadata. In one possible implementation, the first behavior characteristic data may include the port to which the external request arrives, the identifier of the accessed service, which services / services the request flows between, and which port the request exits through, etc.

[0032] It should be noted that, as Figure 2 As shown, the server's data acquisition module stores the obtained first behavioral feature data in the traffic log platform.

[0033] Step 103: Obtain historical behavioral feature data of historical attack behaviors against virtual machines.

[0034] In this embodiment, historical attack behavior refers to attacks suffered by the virtual machine over a past period. Specifically, historical behavioral characteristic data can be obtained directly from a traffic log platform.

[0035] In this embodiment of the application, the historical behavioral feature data can be obtained by the traffic mirroring service platform after performing deep packet inspection on the historical operation data collected by the Agent software. After obtaining the historical behavioral feature data, it will be sent to the traffic log platform for storage.

[0036] It should be noted that the traffic mirroring service platform and the traffic log platform can be deployed on information-defined devices, i.e., servers.

[0037] Step 104: Based on the first behavioral feature data and historical behavioral feature data, determine the target behavioral feature data of the attack behavior.

[0038] In this embodiment of the application, a first degree of difference value between the first behavioral feature data and the historical behavioral feature data can be determined, and the target behavioral feature data of the attack behavior can be determined based on the comparison result of the first degree of difference value and the first threshold.

[0039] In this embodiment of the application, by combining the first behavioral feature data and historical behavioral feature data to determine the target behavioral feature data, the accuracy of the final target behavioral feature data can be guaranteed, thereby ensuring that the target attack path can be accurately determined.

[0040] Step 105: Based on the target behavior feature data, determine the target attack path of the attack behavior.

[0041] In this embodiment of the application, multiple candidate attack paths can be determined first based on target behavior feature data, and then the feature information of each candidate attack path can be determined. After that, the target attack path can be determined from multiple candidate attack paths based on the target behavior feature data and the feature information of each candidate attack path.

[0042] It should be noted that there can be only one target attack path or multiple target attack paths. For example, when a virtual machine is attacked by multiple methods simultaneously, there can be multiple target attack paths.

[0043] In other embodiments of this application, step 102 can be implemented in the following ways.

[0044] Step 102a: Classify the first running data based on the attack methods of the attack behavior to obtain multiple types of running data.

[0045] In the embodiments of this application, such as Figure 3 As shown, attack methods can include reverse shells, brute-force attacks, abnormal logins, and dynamic honeypots. Specifically, the first set of runtime data can be categorized according to the specific attack method of the attack behavior. Runtime data corresponding to reverse shell attacks is classified as the first category, runtime data corresponding to brute-force attacks is classified as the second category, runtime data corresponding to abnormal logins is classified as the third category, and runtime data corresponding to dynamic honeypots is classified as the fourth category, thus obtaining multiple categories of runtime data.

[0046] Step 102b: Based on the target fusion strategy, perform fusion processing on multiple types of operational data to obtain fused operational data.

[0047] In this application embodiment, the target fusion strategy can refer to a strategy for fusing multiple types of operational data. In one possible implementation, such as... Figure 3 As shown, after obtaining multiple types of operational data, the second and third types of operational data can be fused first according to the target fusion strategy, then the operational data after the first fusion can be fused with the first type of operational data, and finally the data after the second fusion can be fused with the fourth type of operational data to obtain the final fused operational data.

[0048] In another feasible approach, the first type of operational data can be merged with the second type of operational data, and the third type of operational data can be merged with the fourth type of operational data. Then, the two merged data are merged again to obtain the final merged data.

[0049] In this embodiment of the application, by classifying and merging the first running data, not only can the data format be unified, but the merged data can also be used to quickly trace the source of attacks in order to obtain accurate attack paths.

[0050] Step 102c: Process the fused running data using a deep data detection algorithm to obtain the first row of feature data.

[0051] In this embodiment, the deep data detection algorithm can refer to the Deep Packet Inspection (DPI) algorithm. Specifically, the traffic mirroring service platform can use the DPI algorithm to process the fused runtime data to obtain the first behavioral characteristic data of the attack behavior against the virtual machine.

[0052] In other embodiments of this application, step 104 can be implemented in the following ways.

[0053] Step 104a: Determine the first degree of difference between the first behavioral feature data and the historical behavioral feature data.

[0054] In this embodiment, the first degree of difference can be represented by variance. Specifically, the first behavioral feature data and historical behavioral feature data can be converted into numerical data according to a pre-set conversion rule. Then, the first variance between the two numerical data (the converted first behavioral feature data is the first data, and the converted historical behavioral feature data is the historical data) can be determined, thus obtaining the first degree of difference. The formula for calculating the first degree of difference is as follows: Formula (1): Formula (1) Where Var1 represents the first variance value (i.e., the first variance). Indicates the first data. This represents historical data.

[0055] In one feasible approach, the conversion rule can be: if the attack port is 22, the corresponding value is 0; if the attack port is 23, the corresponding value is 1; ...; service a corresponds to a value of 0, service b corresponds to a value of 1, service c corresponds to a value of 2; ...; if the traffic exit is port 40, the corresponding value is 0; if the traffic exit is 41, the corresponding value is 1.

[0056] For example, if the first line of characteristic data is attack port 23, and the attack first accesses service c, then service a, and finally exits through port 40, then the value obtained after conversion according to the conversion rules is 1200.

[0057] In the embodiments of this application, step 104b or steps 104c-104d can be executed after step 104a.

[0058] Step 104b: If the first difference value is less than the first threshold, the target behavioral feature data is determined as the first behavioral feature data.

[0059] In this embodiment, the first threshold can be preset according to actual needs. In one possible implementation, the first threshold can be 5%. Specifically, as shown... Figure 4 As shown, if the first difference value is less than the first threshold, it means that the difference between the first behavioral feature data and the historical behavioral feature data is small, that is, the similarity is high. This indicates that the obtained first behavioral feature data is relatively accurate and can accurately reflect the relevant information of the attack behavior. At this time, the target behavioral feature data can be directly determined as the first behavioral feature data.

[0060] Step 104c: If the first difference value is greater than or equal to the first threshold, obtain the second running data of the virtual machine within the target duration from the current moment, and use the deep data detection algorithm to process the second running data to obtain the second behavioral feature data.

[0061] In the embodiments of this application, such as Figure 4 As shown, if the first difference value is greater than the first threshold, it indicates that the difference between the first behavioral feature data and the historical behavioral feature data is large, that is, the similarity between the two is low. This means that the obtained first behavioral feature data may not be able to reflect the relevant information of the attack behavior (for example, the attack behavior has just occurred, and the running data reported by the Agent is not complete). Based on this, in order to ensure that the target attack path of the attack behavior can be accurately determined in the end, the second running data reported by the Agent software, which is the virtual machine within the target duration from the current moment, that is, within a period of time in the future, can be obtained, and the second running data can be processed by the DPI algorithm to obtain the second behavioral feature data.

[0062] Step 104d: Determine the target behavioral feature data based on the first behavioral feature data and the second behavioral feature data.

[0063] In this embodiment of the application, a second difference value between the first behavioral feature data and the second behavioral feature data can be determined, and the final target behavioral feature data can be determined based on the comparison result of the second difference value and the second threshold.

[0064] In other embodiments of this application, step 104d can be implemented in the following ways.

[0065] Step 104d1: Determine the second degree of difference value between the first behavioral feature data and the second behavioral feature data.

[0066] In this embodiment of the application, the second difference degree value can also be characterized by variance. Specifically, similar to step 104a, the first row feature data and the second row feature data can be converted into numerical data according to a pre-set conversion rule. Then, the second variance between the two numerical data (the first row feature data converted to the first data and the second row feature data converted to the second data) can be determined, thus obtaining the second difference degree value. The formula for calculating the second difference degree value can be shown in the following formula (2): Formula (2) Where Var2 represents the second variance value (i.e., the second variance). Indicates the first data. This indicates the second data point.

[0067] In this embodiment of the application, step 104d1 can be followed by step 104d2, or steps 104d3-104d4.

[0068] Step 104d2: If the second difference value is less than the second threshold, determine the target behavioral feature data from the first behavioral feature data and the second behavioral feature data.

[0069] In this embodiment, the second threshold can also be preset according to actual needs. In one possible implementation, the second threshold can be 3%. Specifically, as shown... Figure 4 As shown, if the second difference value is less than the second threshold, i.e. less than 5%, it means that the difference between the first behavioral feature data and the second behavioral feature data is not significant. That is, the first running data of the virtual machine at the current moment and the second running data within the target duration from the current moment are not significantly different. This means that the first running data collected at the current moment and the first behavioral feature data determined based on the first running data are not problematic. It is only possible that the current attack behavior is different from the historical attack behavior, so there are some differences between the first behavioral feature data and the historical behavioral feature data. However, the first behavioral feature data itself is not problematic. In this case, half of the data can be randomly selected from the first behavioral feature data, and half of the data can be randomly selected from the second behavioral feature data. Then, the two selected data can be aggregated and processed to obtain the target behavioral feature data.

[0070] Step 104d3: If the second difference value is greater than or equal to the second threshold, obtain the behavior data of the virtual machine within the target time after the attack from the target data management platform, and use the deep data detection algorithm to process the behavior data to obtain the third behavior feature data.

[0071] In this embodiment, the target data management platform is the traffic mirroring service platform; behavioral data can refer to all runtime data sent to the traffic mirroring service platform within the target time after the virtual machine is attacked.

[0072] In the embodiments of this application, such as Figure 4 As shown, if the second difference value is greater than or equal to the second threshold, it indicates a significant difference between the first running data of the virtual machine at the current moment and the second running data within the target duration from the current moment. In this case, to ensure the accuracy of the determined target behavioral feature data, data stored by the traffic mirroring service platform within the target duration can be introduced, combined with the first and second behavioral feature data, to jointly determine the target behavioral feature data. Specifically, the behavioral data of the virtual machine within the target duration after the attack can be obtained from the traffic mirroring service platform first, and then the behavioral data can be further processed by the traffic mirroring service platform using the DPI algorithm to obtain the third behavioral feature data.

[0073] Step 104d4: Based on the first behavioral feature data, the second behavioral feature data, and the third behavioral feature data, determine the target behavioral feature data.

[0074] In this embodiment of the application, a third degree of difference between the first behavioral feature data and the third behavioral feature data, and a fourth degree of difference between the second behavioral feature data and the third behavioral feature data can be determined respectively. Then, a target degree of difference value is determined from the second degree of difference value, the third degree of difference value and the fourth degree of difference value. Finally, the target behavioral feature data is determined from the first behavioral feature data, the second behavioral feature data and the third behavioral feature data according to the target degree of difference value.

[0075] In other embodiments of this application, step 104d4 can be implemented in the following ways.

[0076] Step 104d41: Determine the third degree of difference between the first behavioral feature data and the third behavioral feature data, and determine the fourth degree of difference between the second behavioral feature data and the third behavioral feature data.

[0077] In this embodiment, both the third and fourth difference values ​​can be represented by variance. That is, the third difference value is the third difference between the first and third behavioral feature data. The fourth variance value is the fourth variance between the second and third behavioral feature data. It should be noted that the third variance and the fourth variance can be obtained according to steps 104a or 104d41.

[0078] Step 104d42: Determine the target difference value from the second, third, and fourth difference values.

[0079] In this embodiment of the application, the second difference degree value, the third difference degree value and the fourth difference degree value can be compared pairwise, and the smallest difference degree value among the second difference degree value, the third difference degree value and the fourth difference degree value can be determined as the target difference degree value based on all the comparisons.

[0080] For example, if the second degree of difference is 1.3, the third degree of difference is 0.6, and the fourth degree of difference is 2.4, then by comparing these three degree of difference values ​​pairwise, the smallest third degree of difference value can be determined as the target degree of difference value.

[0081] Step 104d43: Determine the target behavioral characteristic data based on the behavioral characteristic data corresponding to the target difference value.

[0082] In this embodiment of the application, after determining the target difference value, the two behavioral feature data that yielded the target difference value can be combined to obtain the target behavioral feature data.

[0083] For example, if the target difference level is the third difference level, the first behavioral feature data and the third behavioral feature data can be combined to obtain the target behavioral feature data; if the target difference level is the fourth difference level, the second behavioral feature data and the third behavioral feature data can be combined to obtain the target behavioral feature data.

[0084] In this embodiment of the application, by performing variance comparison, behavioral feature data that can reflect the characteristics of attack behavior can be accurately determined, thereby improving the accuracy of the determined attack path.

[0085] In other embodiments of this application, step 105 can be implemented in the following ways.

[0086] Step 105a: Determine multiple candidate attack paths based on target behavior feature data.

[0087] In one feasible approach, target behavioral feature data can be converted into a timestamped multidimensional time series, and a sliding time window technique can be used to analyze the multidimensional time series to calculate the correlation between different events. Then, a causal reasoning algorithm can be used to analyze and process multiple correlations to trace the source of the attack behavior, thereby obtaining multiple candidate attack paths.

[0088] For example, a possible attack path could be: email attachment → user execution → exploit WinWord vulnerability → execute PowerShell → data theft.

[0089] Step 105b: Determine the characteristic information of each candidate attack path.

[0090] In this embodiment, the feature information of each candidate attack path may include semantic feature information and structural feature information. Semantic feature information may include attack intent feature information and attack scenario feature information; structural feature information may include the complexity and adjustment method of the candidate path, etc. Specifically, each candidate attack path can first be represented as an ordered sequence of nodes. Then, the metadata of each node (including asset type, security domain, permission level, etc.) can be queried from the virtual machine's asset database. Further, based on the metadata of each node and the node sequence, the path length and number of jumps for each candidate attack path can be calculated. Then, the path length and number of jumps can be combined to obtain the structural feature information. Additionally, a pre-built intent-behavior mapping library can be used to analyze the candidate attack paths to obtain their intent information. Then, contextual features such as asset attributes and service types involved in the attack behavior can be determined from the candidate attack paths. Further, these contextual features can be matched with a scenario rule base to determine the scenario category of the attack path. Finally, the intent information and scenario category can be combined to obtain the semantic feature information.

[0091] In the embodiments of this application, the attack path scenarios include application attacks (attacks through application vulnerabilities), supply chain attacks (attacks through third-party software and hardware), etc.

[0092] It should be noted that both the intent-behavior mapping library and the scenario rule library are pre-built based on historical data.

[0093] Step 105c: Based on the target behavior feature data and feature information, determine the target attack path from multiple candidate attack paths.

[0094] In this embodiment of the application, a sparse matrix can be constructed based on the target behavior feature data, and the target vector corresponding to multiple candidate attack paths can be determined based on the feature information of each candidate attack path. Then, the target attack path can be determined from multiple candidate attack paths based on the sparse matrix and the target vector.

[0095] In other embodiments of this application, step 105c may be implemented in the following manner.

[0096] Step 105c1: Construct an initial matrix based on the target behavior feature data, and perform format conversion on the initial matrix to obtain a sparse matrix. In this embodiment of the application, as in step 104a, the target behavior feature data can be converted into numerical data, i.e., target data, according to a preset conversion rule. Then, an initial matrix can be constructed based on the target data obtained after conversion. Furthermore, the position of 0 in the initial matrix can be determined. Finally, a sparse matrix can be obtained by converting the initial matrix based on the target data and the position of 0 in the initial matrix.

[0097] Step 105c2: Based on each feature information, determine the target vector corresponding to multiple candidate attack paths.

[0098] In this embodiment, a vector corresponding to each candidate attack path can be constructed based on the feature information of each candidate attack path. Then, the vectors of multiple candidate attack paths can be combined to obtain a target vector corresponding to multiple candidate attack paths. It should be noted that multiple candidate attack paths correspond to one target vector.

[0099] Step 105c3: Use the target data processing algorithm to process the sparse matrix and target vector to obtain the target value corresponding to each candidate attack path.

[0100] In the embodiments of this application, such as Figure 3 As shown, the target data processing algorithm can refer to the Modified Least Squares QR Factorization (M-LSQR) algorithm.

[0101] In this embodiment, multiple candidate attack paths can be constructed using the sparse matrix and the target vector, corresponding to the equation Ax=b. Here, A represents the sparse matrix, b represents the target vector, and x represents the target value for each candidate attack path.

[0102] It should be noted that the number of candidate attack paths corresponds to the number of x's.

[0103] Specifically, for any solution x0 in the system of equations, its residual difference can be defined. for Then, the optimal solution X* can be obtained using the least squares method, which minimizes the sum of squared residuals. Then, by expanding the sum of squares, we can obtain: Furthermore, we can differentiate the sum of squared residuals to make it equal to 0, and then solve for the result. Finally, the optimal solution can be obtained by transforming the formula. ,Right now .in, It is the generalized inverse matrix of A.

[0104] Then, the M-LSQR algorithm can be used to solve for X*, thereby obtaining the least-squares solution for each candidate attack path. Specifically, the least-squares solution can be determined as follows: A1. Initialize according to the following formulas (3)-(5): Formula (3) Formula (4) Formula (5) A2. Loop through the process, repeating steps A3-A6 for k=1,2…. Here, k is the number of candidate attack paths.

[0105] A3. Diagonalize the matrix according to formulas (6) and (7) to facilitate QR decomposition: Formula (6) Formula (7) A4. Perform QR decomposition using the undamped LSQR algorithm according to the following formulas (8)-(14): Formula (8) Formula (9) Formula (10) Formula (11) Formula (12) Formula (13) Formula (14) A5. Update and iterate according to the following formulas (15)-(16) to obtain the target value corresponding to each candidate attack path.

[0106] Formula (15) Formula (16) It should be noted that each candidate attack path corresponds to one target value.

[0107] For example, set the login port of virtual machine A to 22, the reverse shell port to 24, the web application server port to 8001, and the dynamic honeypot's enticement port to 9001.

[0108] If the target behavior feature data is: A_22:0,0; A_24:0,10; A_8001:0,20; A_9001:30,0.

[0109] Based on the above port settings, if we are to explore the attack source path, we can assume that the first candidate attack path is k1 and the second candidate attack path is k2. Then, we can obtain the following set of equations.

[0110] A_22(i): 0*k1+0*k2=0 A_22(o): 0*k1+0*k2=0 A_24(i): 0*k1+0*k2=0 A_24(o): 1*k1+0*k2=10… in, , .

[0111] Then, the M-LSQR algorithm can be used to solve the system of equations to obtain the solutions for k1 and k2, that is, the objective values ​​corresponding to k1 and k2.

[0112] Step 105c4: Determine the target attack path from multiple candidate attack paths based on multiple target values.

[0113] In this embodiment of the application, for each candidate attack path, if the corresponding target value is greater than 0, it means that the candidate attack path has been selected, and at this time, the candidate attack path can be determined to be the target attack path; correspondingly, if the corresponding target value is less than or equal to 0, it means that the candidate attack path is completely unrelated to the attack behavior that has occurred, that is, at this time, the candidate attack path can be determined not to be the target attack path.

[0114] For example, if we calculate k1=10 and k2=0, then it means that k1, the first candidate attack path, is the target attack path, while k2 is not the target attack path.

[0115] It should be noted that the target attack path can be one of the candidate attack paths, or multiple attack paths within the candidate attack paths.

[0116] In this embodiment of the application, after obtaining the target attack path, such as Figure 3 As shown, each target attack path can be displayed on the server's interface, and the target attack paths can also be stored in the database to help with subsequent security protection.

[0117] In this embodiment, the M-LSQR algorithm innovatively combines the matrix processing and real-time update mechanism of attack behavior behavior characteristic data with the application and optimization of the LSQR algorithm in attack attribution. This algorithm enables immediate data matrix calculation and generation for any attack traffic and any number of virtual machines after data reporting, significantly improving the flexibility and efficiency of data processing, making security analysis and response faster and more accurate. Simultaneously, by combining the LSQR algorithm to calculate non-negative integers for attack paths, and through convergence discrimination and iterative update, real-time and rapid attack attribution calculation is achieved, improving computational efficiency and providing security personnel with more effective support for data analysis, attribution display, and deduction. This comprehensive advancement means that when faced with complex attacks, security teams can more quickly identify attack sources and take effective measures to reduce potential damage.

[0118] Furthermore, by combining the analysis of the variance values ​​(i.e., the difference values) between various behavioral feature data, it is possible to accurately identify behavioral feature data that precisely reflects the characteristics of attack behavior, thereby accelerating the tracing of attack paths and improving the accuracy of attribution. Thus, even when facing complex and ever-changing cyberattacks, it can provide security teams with detailed and rapid data analysis and attribution reports, significantly enhancing their ability to respond to cybersecurity threats and improving decision-making efficiency. In addition, the combination of "variance + M-LSQR algorithm" is highly flexible and adaptable, making it an important tool for combating complex security challenges in various network environments, effectively controlling risks and reducing potential losses.

[0119] The information determination method provided in this application can automatically determine the target attack path of an attack based on the target behavior data of an attack on a virtual machine, instead of requiring manual determination of the attack path as in related technologies. This solves the problem of low efficiency in the methods of determining attack paths in related technologies. Furthermore, in this application, the first running data of the virtual machine after being attacked is processed to obtain the first behavior feature data of the attack behavior, and then the target behavior feature data is determined by combining it with historical behavior feature data. Finally, the target attack path of the attack behavior is determined based on the final target behavior feature data, instead of directly analyzing the running data of the virtual machine. This can further improve the accuracy of the determined target attack path, thereby solving the problem of low accuracy in the methods of determining attack paths in related technologies.

[0120] This application provides an information determining device, which can be applied to... Figure 1 In the information determination method provided in the corresponding embodiment, refer to Figure 5 As shown, the device 2 may include: a first acquisition unit 21, a first determination unit 22, a second acquisition unit 23, a second determination unit 24, and a third determination unit 25, wherein: The first acquisition unit 21 is used to acquire the first running data of the virtual machine after it has been attacked; The first determining unit 22 is used to determine first behavioral characteristic data of attack behavior against the virtual machine based on the first running data; The second acquisition unit 23 is used to acquire historical behavioral feature data of historical attack behaviors against virtual machines; The second determining unit 24 is used to determine the target behavioral characteristic data of the attack behavior based on the first behavioral characteristic data and the historical behavioral characteristic data. The third determining unit 25 is used to determine the target attack path of the attack behavior based on the target behavior feature data.

[0121] In other embodiments of this application, the first determining unit 22 is further configured to perform the following steps: The attack methods based on the attack behaviors are used to classify the first running data, resulting in multiple types of running data; Based on the target fusion strategy, multiple types of operational data are fused to obtain fused operational data; The fused running data is processed using a deep data detection algorithm to obtain the first row of feature data.

[0122] In other embodiments of this application, the second determining unit 24 is further configured to perform the following steps: Determine the first degree of difference between the first behavioral feature data and the historical behavioral feature data; If the first difference value is less than the first threshold, the target behavioral feature data is determined to be the first behavioral feature data. If the first difference value is greater than or equal to the first threshold, the second running data of the virtual machine within the target duration from the current moment is obtained, and the second running data is processed by the deep data detection algorithm to obtain the second behavioral feature data; Based on the first behavioral feature data and the second behavioral feature data, the target behavioral feature data is determined.

[0123] In other embodiments of this application, the second determining unit 24 is further configured to perform the following steps: Determine a second degree of difference between the first behavioral feature data and the second behavioral feature data; If the second difference value is less than the second threshold, the target behavioral feature data is determined from the first behavioral feature data and the second behavioral feature data; If the second difference value is greater than or equal to the second threshold, the behavior data of the virtual machine within the target time after the attack is obtained from the target data management platform, and the behavior data is processed by the deep data detection algorithm to obtain the third behavior feature data. Based on the first behavioral feature data, the second behavioral feature data, and the third behavioral feature data, the target behavioral feature data is determined.

[0124] In other embodiments of this application, the second determining unit 24 is further configured to perform the following steps: Determine the third degree of difference between the first and third behavioral feature data, and determine the fourth degree of difference between the second and third behavioral feature data; The target difference value is determined from the second, third, and fourth difference values; Based on the behavioral characteristic data corresponding to the target difference value, the target behavioral characteristic data is determined.

[0125] In other embodiments of this application, the third determining unit 25 is further configured to perform the following steps: Multiple candidate attack paths are identified based on target behavior characteristic data; Determine the characteristic information of each candidate attack path; Based on target behavior feature data and feature information, the target attack path is determined from multiple candidate attack paths.

[0126] In other embodiments of this application, the third determining unit 25 is further configured to perform the following steps: An initial matrix is ​​constructed based on the target behavior feature data, and the format of the initial matrix is ​​converted to obtain a sparse matrix; Based on each feature information, the target vector corresponding to multiple candidate attack paths is determined; The sparse matrix and target vector are processed using a target data processing algorithm to obtain the target value corresponding to each candidate attack path; The target attack path is determined from multiple candidate attack paths based on multiple target values.

[0127] It should be noted that the specific implementation process of the steps performed by each unit in the embodiments of this application can be referred to Figure 1 The implementation process of the information determination method provided in the corresponding embodiments will not be described in detail here.

[0128] The information determination device provided in this application embodiment can automatically determine the target attack path of an attack based on the target behavior data of an attack on a virtual machine, instead of requiring manual determination of the attack path as in related technologies. This solves the problem of low efficiency in the methods of determining attack paths in related technologies. Furthermore, in this application, the first running data of the virtual machine after being attacked is processed to obtain the first behavior feature data of the attack behavior, and then the target behavior feature data is determined by combining it with historical behavior feature data. Finally, the target attack path of the attack behavior is determined based on the final target behavior feature data, instead of directly analyzing the running data of the virtual machine. This can further improve the accuracy of the determined target attack path, thereby solving the problem of low accuracy in the methods of determining attack paths in related technologies.

[0129] This application provides an information determining device, which can be applied to... Figure 1 In the information determination method provided in the corresponding embodiment, refer to Figure 6 As shown, the information determining device 3 may include: a processor 31, a memory 32, and a communication bus 33; Communication bus 33 is used to realize the communication connection between processor 31 and memory 32; The processor 31 is used to execute the information determination program in the memory 32 to perform the following steps: Obtain the first running data of the virtual machine after it has been attacked; Based on the first runtime data, the first behavioral characteristic data of the attack behavior against the virtual machine is determined; Obtain historical behavioral characteristic data of historical attack behaviors against virtual machines; Based on the first behavioral feature data and historical behavioral feature data, the target behavioral feature data of the attack behavior is determined. Based on the target behavior characteristic data, the target attack path of the attack behavior is determined.

[0130] In other embodiments of this application, the processor 31 is used to execute the information determination program in the memory 32, and may also implement the following steps: The attack methods based on the attack behaviors are used to classify the first running data, resulting in multiple types of running data; Based on the target fusion strategy, multiple types of operational data are fused to obtain fused operational data; The fused running data is processed using a deep data detection algorithm to obtain the first row of feature data.

[0131] In other embodiments of this application, the processor 31 is used to execute the information determination program in the memory 32, and may also implement the following steps: Determine the first degree of difference between the first behavioral feature data and the historical behavioral feature data; If the first difference value is less than the first threshold, the target behavioral feature data is determined to be the first behavioral feature data. If the first difference value is greater than or equal to the first threshold, the second running data of the virtual machine within the target duration from the current moment is obtained, and the second running data is processed by the deep data detection algorithm to obtain the second behavioral feature data; Based on the first behavioral feature data and the second behavioral feature data, the target behavioral feature data is determined.

[0132] In other embodiments of this application, the processor 31 is used to execute the information determination program in the memory 32, and may also implement the following steps: Determine a second degree of difference between the first behavioral feature data and the second behavioral feature data; If the second difference value is less than the second threshold, the target behavioral feature data is determined from the first behavioral feature data and the second behavioral feature data; If the second difference value is greater than or equal to the second threshold, the behavior data of the virtual machine within the target time after the attack is obtained from the target data management platform, and the behavior data is processed by the deep data detection algorithm to obtain the third behavior feature data. Based on the first behavioral feature data, the second behavioral feature data, and the third behavioral feature data, the target behavioral feature data is determined.

[0133] In other embodiments of this application, the processor 31 is used to execute the information determination program in the memory 32, and may also implement the following steps: Determine the third degree of difference between the first and third behavioral feature data, and determine the fourth degree of difference between the second and third behavioral feature data; The target difference value is determined from the second, third, and fourth difference values; Based on the behavioral characteristic data corresponding to the target difference value, the target behavioral characteristic data is determined.

[0134] In other embodiments of this application, the processor 31 is used to execute the information determination program in the memory 32, and may also implement the following steps: Multiple candidate attack paths are identified based on target behavior characteristic data; Determine the characteristic information of each candidate attack path; Based on target behavior feature data and feature information, the target attack path is determined from multiple candidate attack paths.

[0135] In other embodiments of this application, the processor 31 is used to execute the information determination program in the memory 32, and may also implement the following steps: An initial matrix is ​​constructed based on the target behavior feature data, and the format of the initial matrix is ​​converted to obtain a sparse matrix; Based on each feature information, the target vector corresponding to multiple candidate attack paths is determined; The sparse matrix and target vector are processed using a target data processing algorithm to obtain the target value corresponding to each candidate attack path; The target attack path is determined from multiple candidate attack paths based on multiple target values.

[0136] It should be noted that a detailed description of the steps performed by the processor can be found in [reference needed]. Figure 1 The information determination method provided in the corresponding embodiments will not be described again here.

[0137] The information determination device provided in this application embodiment can automatically determine the target attack path of an attack based on the target behavior data of an attack on a virtual machine, instead of requiring manual determination of the attack path as in related technologies. This solves the problem of low efficiency in the methods of determining attack paths in related technologies. Furthermore, in this application, the first running data of the virtual machine after being attacked is processed to obtain the first behavior feature data of the attack behavior, and then the target behavior feature data is determined by combining it with historical behavior feature data. Finally, the target attack path of the attack behavior is determined based on the final target behavior feature data, instead of directly analyzing the running data of the virtual machine. This can further improve the accuracy of the determined target attack path, thereby solving the problem of low accuracy in the methods of determining attack paths in related technologies.

[0138] Based on the foregoing embodiments, this application provides a computer-readable storage medium storing one or more programs that can be executed by one or more processors to achieve... Figure 1 The corresponding embodiments provide the steps of the information determination method.

[0139] Based on the foregoing embodiments, this application provides a computer program product, including a computer program that can be executed by a processor 31 to perform... Figure 1 The corresponding embodiments provide the steps of the information determination method.

[0140] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for determining information, characterized in that, The method includes: Obtain the first running data of the virtual machine after it has been attacked; Based on the first running data, first behavioral characteristic data of the attack behavior against the virtual machine is determined; Obtain historical behavioral characteristic data of historical attack behaviors against the virtual machine; Based on the first behavioral feature data and the historical behavioral feature data, the target behavioral feature data of the attack behavior is determined; Based on the target behavior feature data, the target attack path of the attack behavior is determined.

2. The method according to claim 1, characterized in that, The first behavioral characteristic data for determining the attack behavior against the virtual machine based on the first operational data includes: The first running data is classified according to the attack methods of the attack behavior to obtain multiple types of running data; The multiple types of operational data are fused based on a target fusion strategy to obtain fused operational data. The fused operational data is processed using a deep data detection algorithm to obtain the first behavioral feature data.

3. The method according to claim 1, characterized in that, The step of determining the target behavioral characteristic data of the attack behavior based on the first behavioral characteristic data and the historical behavioral characteristic data includes: Determine a first degree of difference value between the first behavioral feature data and the historical behavioral feature data; If the first difference value is less than the first threshold, the target behavioral feature data is determined to be the first behavioral feature data. If the first difference value is greater than or equal to the first threshold, the second running data of the virtual machine within the target duration from the current moment is obtained, and the second running data is processed by a deep data detection algorithm to obtain the second behavioral feature data; The target behavioral feature data is determined based on the first behavioral feature data and the second behavioral feature data.

4. The method according to claim 3, characterized in that, The step of determining the target behavioral feature data based on the first behavioral feature data and the second behavioral feature data includes: Determine a second degree of difference value between the first behavioral feature data and the second behavioral feature data; If the second difference value is less than the second threshold, the target behavioral feature data is determined from the first behavioral feature data and the second behavioral feature data; If the second difference value is greater than or equal to the second threshold, the behavior data of the virtual machine within the target duration after being attacked is obtained from the target data management platform, and the behavior data is processed by the deep data detection algorithm to obtain the third behavior feature data. The target behavioral feature data is determined based on the first behavioral feature data, the second behavioral feature data, and the third behavioral feature data.

5. The method according to claim 4, characterized in that, The step of determining the target behavioral feature data based on the first behavioral feature data, the second behavioral feature data, and the third behavioral feature data includes: A third degree of difference value is determined between the first behavioral feature data and the third behavioral feature data, and a fourth degree of difference value is determined between the second behavioral feature data and the third behavioral feature data; The target difference value is determined from the second difference value, the third difference value, and the fourth difference value; The target behavioral characteristic data is determined based on the behavioral characteristic data corresponding to the target difference value.

6. The method according to claim 1, characterized in that, Determining the target attack path of the attack behavior based on the target behavior feature data includes: Multiple candidate attack paths are determined based on the target behavior feature data; Determine the characteristic information of each candidate attack path; Based on the target behavior feature data and the feature information, the target attack path is determined from the plurality of candidate attack paths.

7. The method according to claim 6, characterized in that, The step of determining the target attack path from the plurality of candidate attack paths based on the target behavior feature data and the feature information includes: An initial matrix is ​​constructed based on the target behavior feature data, and the format of the initial matrix is ​​converted to obtain a sparse matrix; Based on each feature information, the target vector corresponding to the multiple candidate attack paths is determined; The sparse matrix and the target vector are processed using a target data processing algorithm to obtain the target value corresponding to each candidate attack path; The target attack path is determined from the multiple candidate attack paths based on multiple target values.

8. An information determining device, characterized in that, The device includes: a processor, a memory, and a communication bus; The communication bus is used to realize the communication connection between the processor and the memory; The processor is used to execute an information determination program in memory to implement the steps of the information determination method as described in any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores one or more programs, which can be executed by one or more processors to implement the steps of the information determination method as described in any one of claims 1-7.

10. A computer program product, the computer program product comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the information determination method according to any one of claims 1-7.

Images