A terminal security-based big data analysis method

Abstract

The application discloses a kind of big data analysis methods based on terminal security, it is related to terminal security technical field, including the following steps: step one: collection terminal security operation data, forms terminal security basic data set;Step two: format is neat and is aligned, generates terminal security event record;Step three: determine session state, authority state and risk behavior state, generate state terminal node;Step four: construct time authority layered diagram;Step five: extract threat resource label;Step six: configure improved Suurballe algorithm and search main threat propagation path;Step seven: carry out edge weight re-indexing and search independent backup threat propagation path;Step eight: execute resource conflict verification, generates terminal attack path identification result and threat traceability result.The application improves the accuracy of terminal attack path identification and threat traceability.

Description

Technical Field

[0001] This invention relates to the field of terminal security technology, and in particular to a big data analysis method based on terminal security. Background Technology

[0002] With the continuous growth of enterprise endpoints, remote access scenarios, and the scale of security operation data, big data analysis technologies targeting endpoint behavior logs, account login records, network connection records, and vulnerability status records have received widespread attention. Existing endpoint security analysis methods mainly rely on static alert rules, single-point log correlation, and common attack graphs for risk identification; however, these methods generally suffer from the following problems in practical applications:

[0003] Endpoint security data is scattered and has highly variable field structures. Login, process, access, and connection behaviors of the same entity at different times and locations are difficult to form continuous event records, resulting in unclear temporal relationships and entity associations between security events. Existing attack path analysis usually relies on node connection relationships and lacks unified modeling of session states, permission states, and risk behavior states, which easily generates path results that do not conform to the time increment, permission change, and attack phase progression. Ordinary disjoint path algorithms only focus on graph edge separation and cannot identify whether two paths share account resources, vulnerability resources, and communication service resources, resulting in overlap between the main attack path and backup propagation path at the resource consumption level, affecting the accuracy of endpoint attack path identification and threat tracing results.

[0004] Therefore, how to provide a big data analysis method based on endpoint security is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] One objective of this invention is to propose a big data analysis method based on endpoint security. This invention constructs a temporal permission hierarchy graph through endpoint security event records and uses an improved Suurballe algorithm to search for the main threat propagation path and independent backup threat propagation paths. It can realize endpoint attack path identification and threat tracing analysis, and has the advantages of strong path causality, accurate resource conflict identification, and reliable tracing results.

[0006] A big data analysis method based on terminal security according to an embodiment of the present invention includes the following steps:

[0007] Step 1: Collect terminal security operation data to form a basic terminal security dataset;

[0008] Step 2: Standardize the format of the endpoint security basic dataset and align it according to time position and subject identifier to generate endpoint security event records;

[0009] Step 3: Determine the session state, permission state, and risk behavior state of the terminal at different times and locations based on the terminal security event records, and generate stateful terminal nodes;

[0010] Step 4: Connect stateful terminal nodes according to time increment relationship, permission change relationship and attack phase progression relationship to construct a temporal permission layering graph;

[0011] Step 5: Extract threat resource tags from the directed transition edges between stateful terminal nodes, so that the threat resource tags represent the occupancy relationship of account resources, vulnerability resources and communication service resources;

[0012] Step 6: Configure resource mutual exclusion constraints of the improved Suurballe algorithm based on threat resource tags, and search for the main threat propagation path in the temporal permission hierarchy graph;

[0013] Step 7: Based on the threat resource tags occupied by the main threat propagation path, re-label the edge weights of the temporal permission layering graph and search for independent backup threat propagation paths;

[0014] Step 8: Perform resource conflict verification on the primary threat propagation path and the independent backup threat propagation path to generate endpoint attack path identification results and threat tracing results.

[0015] Optionally, step one specifically includes:

[0016] Read process execution records, account login records, network connection records, file access records, and vulnerability status records from the terminal agent, and write the terminal identifier, subject identifier, time and location, and collection source for each record;

[0017] Establish terminal acquisition channels according to terminal identifiers, group records corresponding to the same terminal identifier into the same acquisition group, and arrange the records within the acquisition group according to time position;

[0018] Perform field integrity and time sequence checks on the collected data groups, delete invalid records with missing terminal identifiers, subject identifiers, and time locations, and write the checked records into the basic data table according to a unified field structure to form the terminal security basic dataset.

[0019] Optionally, step two specifically includes:

[0020] The basic data table is read from the endpoint security basic dataset. Based on the collection source, the record format template is matched, and the process execution record, account login record, network connection record, file access record and vulnerability status record are converted into a unified event field. The unified event field includes endpoint identifier, subject identifier, time and location, event type, event object, behavior result, risk mark and collection source.

[0021] The unified event fields are grouped according to the terminal identifier, and the unified event fields corresponding to the same terminal identifier are arranged according to the time position. Unified event fields with the same time position are written into the same time alignment unit.

[0022] Based on the subject identifier, the unified event fields within the time alignment unit are merged, event associations are established for unified event fields associated with the same subject identifier, and the event associations are labeled according to the event type;

[0023] The calibrated event relationships are written into the event log table, forming an endpoint security event record that includes endpoint identifier, subject identifier, time and location, event type, event object, behavior result, risk marker, and data collection source.

[0024] Optionally, step three specifically includes:

[0025] Read the endpoint identifier, subject identifier, time and location, event type, event object, behavior result and risk mark from the endpoint security event log, and build a status classification index according to the endpoint identifier and time and location;

[0026] Based on the terminal security event records and behavior results of the event type "account login", determine the login persistence status of the subject identifier at the time location and write the login persistence status into the session status field;

[0027] Based on the access permissions and behavior results corresponding to the event object, determine the permission change results of the subject identifier at the time location, and write the permission change results into the permission status field;

[0028] Based on the risk tags corresponding to endpoint security event records of event types such as process execution, network connection, file access, and vulnerability status, the risk behavior status of the endpoint at the time location is determined.

[0029] Write the state partitioning index, session state field, permission state field, and risk behavior state into the node attribute table, and generate stateful terminal nodes according to the node attribute table.

[0030] Optionally, step four specifically includes:

[0031] Read the terminal identifier, subject identifier, time and location, session state field, permission state field and risk behavior state from the stateful terminal nodes, build a node arrangement sequence according to the terminal identifier, and sort the node arrangement sequence according to the time and location.

[0032] Based on the sorted stateful terminal nodes, the session state fields of adjacent time positions are compared, and stateful terminal nodes with increasing time positions and consecutive session state fields are identified as time-increasing node pairs.

[0033] Based on the sorted stateful terminal nodes, the permission status fields of adjacent time positions are compared, and the stateful terminal nodes that maintain, promote, and degrade the permission status fields are identified as permission change node pairs.

[0034] The attack stage position corresponding to the stateful terminal node is determined based on the risk behavior status, and the attack stage progression relationship is established in the order of login anomaly, execution anomaly, connection anomaly, access anomaly and vulnerability exploitation.

[0035] When the time-incrementing node pairs, permission-changing node pairs, and attack phase progression relationships all satisfy the connection conditions, directed transition edges are established between the corresponding stateful terminal nodes. The stateful terminal nodes are treated as graph nodes, and the directed transition edges are treated as graph edges. The graph nodes are arranged hierarchically according to the time position and permission status fields to construct a temporal permission hierarchical graph.

[0036] Optionally, step five specifically includes:

[0037] Read stateful terminal nodes and directed transition edges from the temporal permission layering graph, and match terminal security event records within the time position of the starting node and the ending node according to the starting node and the ending node.

[0038] Extract account resources from the subject identifier in the endpoint security event log, extract vulnerability resources from the event object and risk marker, and extract communication service resources from the endpoint security event log with the event type of network connection.

[0039] Write account resources, vulnerability resources, and communication service resources into the resource tag field, and bind the resource tag field to the corresponding directed transition edge;

[0040] A tag index table is established based on the starting node, ending node, and resource tag field of the directed transition edge, so that the tag index table records the occupancy relationship of account resources, vulnerability resources, and communication service resources in threat propagation;

[0041] Write the tag index table into the temporal permission hierarchy graph to generate threat resource tags that characterize the relationship between account resources, vulnerability resources, and communication service resources.

[0042] Optionally, step six specifically includes:

[0043] Read stateful terminal nodes, directed transition edges, and threat resource tags from the temporal permission hierarchy graph, and determine the entry stateful terminal node and the target stateful terminal node based on the risk behavior status;

[0044] Based on the threat resource tags, read the account resources, vulnerability resources, and communication service resources bound to the directed transfer edge, and write the account resources, vulnerability resources, and communication service resources into the resource mutual exclusion constraint;

[0045] The search weights of directed transition edges are calculated based on time location, permission status field, risk behavior status, and threat resource tags, and the search weights are written into the temporal permission hierarchy graph.

[0046] The improved Suurballe algorithm uses the entry stateful terminal node as the search starting point and the target stateful terminal node as the search ending point, and configures the path search conditions according to resource mutual exclusion constraints.

[0047] An improved Suurballe algorithm is used to perform a minimum-cost path search in the temporal permission hierarchy graph according to the search weights, generating the main threat propagation path.

[0048] Optionally, the resource mutual exclusion constraint is used to limit the occupancy relationship of threat resource tags during the path search process of the improved Suurballe algorithm. The account resources, vulnerability resources, and communication service resources bound to the directed transfer edge are used as resource occupancy items, and the resource occupancy items already occupied by the main threat propagation path are written into the main path resource occupancy table. When searching for independent alternative threat propagation paths, the resource occupancy items bound to the candidate directed transfer edge are matched with the main path resource occupancy table. If there is any identical occupancy relationship among the same account resources, the same vulnerability resources, and the same communication service resources, the candidate directed transfer edge is marked as a resource conflict edge, and the edge weight is re-marked according to the resource conflict edge.

[0049] Optionally, step seven specifically includes:

[0050] Read the path node sequence and path edge sequence from the main threat propagation path, extract account resources, vulnerability resources and communication service resources based on the threat resource tags associated with the path edge sequence, and generate the main path resource usage table;

[0051] Based on the main path resource occupancy table, traverse the directed transfer edges in the temporal permission layering graph, and mark the directed transfer edges that have the same account resources, the same vulnerability resources, and the same communication service resources as the main path resource occupancy table as resource conflict edges.

[0052] Based on the threat resource tags corresponding to the resource conflict edges, the temporal permission layering graph is recalibrated to increase the search weight of the resource conflict edges to the preset conflict weight.

[0053] The alternative search starting point is determined based on the stateful terminal node of the starting point of the main threat propagation path, and the alternative search endpoint is determined based on the stateful terminal node of the ending point of the main threat propagation path. The alternative path search of the improved Suurballe algorithm is performed in the temporal permission layer graph after edge weight re-labeling.

[0054] The path edge sequences obtained from the alternative path search are matched with the main path resource occupancy table. Path edge sequences without resource conflicts are retained to generate independent alternative threat propagation paths.

[0055] Optionally, step eight specifically includes:

[0056] Read the path node sequence, path edge sequence, and threat resource tags from the primary threat propagation path and the independent backup threat propagation path, respectively;

[0057] The threat resource tags associated with the main threat propagation path are matched with the threat resource tags associated with the independent backup threat propagation path to obtain account resource matching results, vulnerability resource matching results, and communication service resource matching results.

[0058] When there is no identical occupancy relationship among the account resource matching results, vulnerability resource matching results, and communication service resource matching results, an independent resource verification result is generated.

[0059] When there is an identical occupancy relationship in the account resource matching results, vulnerability resource matching results, and communication service resource matching results, a resource conflict verification result is generated.

[0060] Based on the resource independence verification results and resource conflict verification results, the path independence status between the primary threat propagation path and the independent backup threat propagation path is marked, and the path independence status is written into the path verification record;

[0061] Based on the path node sequence, path edge sequence, and path verification record, the endpoint attack path identification result is generated, and based on the entry stateful endpoint node, target stateful endpoint node, and threat resource tag in the main threat propagation path, the threat tracing result is generated.

[0062] The beneficial effects of this invention are:

[0063] This invention transforms scattered process execution records, account login records, network connection records, file access records, and vulnerability status records into unified terminal security event records by formatting, aligning time and location, and merging subject identifiers of terminal security operation data. This enables terminal security data from different sources to form continuous associations within the same time location and subject scope. Furthermore, it generates stateful terminal nodes based on session state, permission state, and risk behavior state, and constructs a temporal permission hierarchy graph according to time increment relationships, permission change relationships, and attack stage progression relationships. This ensures that the connection relationships between terminal security events are no longer limited to ordinary log associations, but can reflect the evolution of attack behavior in terms of time sequence, permission changes, and attack stages, thereby improving the causal consistency and interpretability of attack path identification results.

[0064] This invention introduces an improved Suurballe algorithm into the temporal permission hierarchy graph and distinguishes between primary threat propagation paths and independent backup threat propagation paths through threat resource labels and resource mutual exclusion constraints. This allows the path search process to simultaneously consider the search weights of directed transition edges as well as the occupancy relationships of account resources, vulnerability resources, and communication service resources. After the primary threat propagation path is formed, the edge weights of the temporal permission hierarchy graph are recalibrated using the primary path resource occupancy table before searching for independent backup threat propagation paths and performing resource conflict checks. This avoids paths with different graph structures but the same threat resources being misjudged as independent paths, thereby improving the accuracy of backup propagation path identification and enhancing the reliability of endpoint attack path identification and threat tracing results. Attached Figure Description

[0065] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0066] Figure 1 This is a flowchart of a big data analysis method based on terminal security proposed in this invention;

[0067] Figure 2 This is a schematic diagram illustrating the construction of a temporal permission layering graph for a big data analysis method based on terminal security proposed in this invention.

[0068] Figure 3 This is a schematic diagram illustrating the path search of the improved Suurballe algorithm, a big data analysis method based on terminal security proposed in this invention. Detailed Implementation

[0069] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0070] refer to Figures 1-3 A big data analysis method based on endpoint security includes the following steps:

[0071] Step 1: Collect terminal security operation data to form a basic terminal security dataset;

[0072] Step 2: Standardize the format of the endpoint security basic dataset and align it according to time position and subject identifier to generate endpoint security event records;

[0073] Step 3: Determine the session state, permission state, and risk behavior state of the terminal at different times and locations based on the terminal security event records, and generate stateful terminal nodes;

[0074] Step 4: Connect stateful terminal nodes according to time increment relationship, permission change relationship and attack phase progression relationship to construct a temporal permission layering graph;

[0075] Step 5: Extract threat resource tags from the directed transition edges between stateful terminal nodes, so that the threat resource tags represent the occupancy relationship of account resources, vulnerability resources and communication service resources;

[0076] Step 6: Configure resource mutual exclusion constraints of the improved Suurballe algorithm based on threat resource tags, and search for the main threat propagation path in the temporal permission hierarchy graph;

[0077] Step 7: Based on the threat resource tags occupied by the main threat propagation path, re-label the edge weights of the temporal permission layering graph and search for independent backup threat propagation paths;

[0078] Step 8: Perform resource conflict verification on the primary threat propagation path and the independent backup threat propagation path to generate endpoint attack path identification results and threat tracing results.

[0079] In this embodiment, step one specifically includes:

[0080] The terminal agent reads process execution records, account login records, network connection records, file access records, and vulnerability status records. The terminal agent receives terminal system call information, login authentication information, connection session information, file operation information, and vulnerability scanning information according to the collection source. It then converts the received information into corresponding records and writes terminal identifier, subject identifier, time location, and collection source into each record, so that each record has a unified tracking field.

[0081] Establish terminal acquisition channels according to terminal identifiers, group records corresponding to the same terminal identifier into the same acquisition group, and arrange the records in the acquisition group according to time position, so that the process execution records, account login records, network connection records, file access records and vulnerability status records generated by the same terminal at consecutive time positions form a data sequence with consistent time order.

[0082] The data collection groups are subjected to field integrity checks and time sequence checks. Field integrity checks are used to determine whether there are any missing terminal identifiers, subject identifiers, and time positions in the records. Time sequence checks are used to determine whether the time positions within the same data collection group conform to the order of data collection. Invalid records with missing terminal identifiers, subject identifiers, and time positions are deleted. The verified records are written into the basic data table according to a unified field structure to form the terminal security basic dataset.

[0083] In this embodiment, step two specifically includes:

[0084] The basic data table is read from the endpoint security basic dataset. Based on the collection source carried by each record in the basic data table, the record format template is matched. The record format template is used to record the conversion relationship between the collection source field and the unified event field. Then, the field values ​​in the process execution record, account login record, network connection record, file access record and vulnerability status record are written into the unified event field, so that the records formed by different collection sources enter the same field structure. The unified event field includes endpoint identifier, subject identifier, time and location, event type, event object, behavior result, risk mark and collection source.

[0085] The unified event fields are grouped according to the terminal identifier, so that the unified event fields corresponding to the same terminal identifier are put into the same terminal field group. Then, the unified event fields in the same terminal field group are arranged according to the time position, and the unified event fields with the same time position are written into the same time alignment unit, so that the security events formed by the same terminal at the same time position have a unified time index.

[0086] Based on the subject identifier, the unified event fields within the time alignment unit are merged, so that process execution behavior, account login behavior, network connection behavior, file access behavior and vulnerability status behavior associated with the same subject identifier form event association relationships within the same subject scope. Then, the event association relationships are labeled according to the event type, so that the event association relationships have corresponding security behavior categories.

[0087] The calibrated event relationships are written into the event log table. The event log table retains the terminal identifier, subject identifier, time and location, event type, event object, behavior result, risk mark and collection source, so that the event log table forms a searchable record structure according to the terminal identifier, subject identifier and time and location, and generates terminal security event records.

[0088] In this embodiment, step three specifically includes:

[0089] Read the terminal identifier, subject identifier, time location, event type, event object, behavior result and risk mark from the terminal security event record. Use the terminal identifier to determine the terminal range and the time location to determine the state division position. Then write the terminal identifier and time location into the same index field to create a state division index, so that the state division index corresponds to the terminal security event record of the same terminal at the same time location.

[0090] Based on the terminal security event records and behavior results of the event type account login, read the login start record, login persistence record and login end record of the subject identifier at the time position, arrange the login start record, login persistence record and login end record according to the time position, determine the login persistence status of the subject identifier at the time position, and write the login persistence status into the session state field;

[0091] Based on the access permissions and behavior results corresponding to the event object, read the access results of the subject identifier to the event object, match the access results with the access permissions corresponding to the event object, determine whether the subject identifier has maintained permissions at the time position, the corresponding permission change results for permission elevation and permission reduction, and write the permission change results into the permission status field;

[0092] Based on the risk flags corresponding to the terminal security event records of event types such as process execution, network connection, file access, and vulnerability status, the risk flag values ​​under the same status division index are read, and the process risk status, connection risk status, file risk status, and vulnerability risk status of the terminal at the time position are determined according to the risk flag values. Then, the process risk status, connection risk status, file risk status, and vulnerability risk status are merged into risk behavior status.

[0093] Write the state partitioning index, session state field, permission state field, and risk behavior state into the node attribute table, so that the node attribute table records the session state, permission state, and risk behavior state of the terminal at the time location, and then generate stateful terminal nodes according to the node attribute table.

[0094] In this embodiment, step four specifically includes:

[0095] Read the terminal identifier, subject identifier, time location, session state field, permission state field and risk behavior state from the stateful terminal nodes. Use the terminal identifier as the node affiliation index to group the stateful terminal nodes under the same terminal identifier into the same node arrangement sequence. Then sort the node arrangement sequence from early to late according to the time location so that the node arrangement sequence reflects the state change process of the same terminal at different time locations.

[0096] Based on the sorted stateful terminal nodes, the session state fields of adjacent time positions are compared. The stateful terminal node with the earlier time position is taken as the starting node, and the stateful terminal node with the later time position is taken as the ending node. When the starting node and the ending node belong to the same subject identifier and the session state fields remain continuous, the starting node and the ending node are determined as a time-incrementing node pair.

[0097] Based on the sorted stateful terminal nodes, compare the permission status fields of adjacent time positions, read the permission status fields of the starting node and the ending node, and when the permission status fields show a change result of maintaining, improving or decreasing, determine the starting node and the ending node as a permission change node pair.

[0098] Based on the state of risk behavior, the attack stage position corresponding to the stateful terminal node is determined. The state of risk behavior is matched with login anomaly, execution anomaly, connection anomaly, access anomaly and vulnerability exploitation. Then, the attack stage progression relationship is established according to the order of login anomaly, execution anomaly, connection anomaly, access anomaly and vulnerability exploitation, so that the stateful terminal node has the attack stage position.

[0099] When the time-incrementing node pairs, permission-changing node pairs, and attack phase progression relationships all satisfy the connection conditions, a directed transition edge is established between the starting node and the ending node. The stateful terminal node is used as a graph node, the directed transition edge is used as a graph edge, and a time layer is formed according to the time position, and a permission layer is formed according to the permission status field. Graph nodes are arranged in the time layer and the permission layer to construct a temporal permission layered graph.

[0100] In this embodiment, step five specifically includes:

[0101] The stateful terminal nodes and directed transfer edges are read from the temporal permission layering diagram. The starting node of the directed transfer edge is taken as the threat propagation start state, and the ending node of the directed transfer edge is taken as the threat propagation arrival state. Then, based on the terminal identifier and time location carried by the starting node and the terminal identifier and time location carried by the ending node, the event records within the same time location range are matched in the terminal security event records, so that the directed transfer edge is associated with the terminal security event records that form the basis for the transfer.

[0102] The account value is read from the subject identifier in the endpoint security event log and written into the account resource field. The target object associated with the endpoint security event log is read according to the event object. The risk mark is then used to determine whether the target object has the meaning of vulnerability exploitation. Target objects with the meaning of vulnerability exploitation are written into the vulnerability resource field. The network connection object is read from the endpoint security event log with the event type of network connection and written into the communication service resource field.

[0103] The account resource field, vulnerability resource field, and communication service resource field are incorporated into the resource tag field, so that the resource tag field records the account resources, vulnerability resources, and communication service resources associated with the directed transfer edge. Then, the resource tag field is written into the edge attribute of the directed transfer edge, so that each directed transfer edge has the corresponding resource occupancy content.

[0104] A tag index table is established based on the starting node, ending node, and resource tag field of the directed transition edge. The starting node identifier, ending node identifier, account resource field, vulnerability resource field, and communication service resource field are recorded in the tag index table, so that the tag index table can represent the occupation relationship of account resources, vulnerability resources, and communication service resources in threat propagation.

[0105] Write the tag index table into the temporal permission hierarchy graph, so that the directed transition edges between stateful terminal nodes carry the corresponding resource tag fields, and then generate threat resource tags based on the resource tag fields. Threat resource tags are used to characterize the relationship between account resources, vulnerability resources and communication service resources.

[0106] In this embodiment, step six specifically includes:

[0107] Read stateful terminal nodes, directed transition edges and threat resource tags from the temporal permission layering graph. Read the risk behavior status corresponding to each stateful terminal node. Sort according to the attack stage position and time position corresponding to the risk behavior status. Determine the stateful terminal node corresponding to the starting position of the sorting as the entry stateful terminal node and the stateful terminal node corresponding to the ending position of the sorting as the target stateful terminal node.

[0108] Based on the threat resource tags, read the account resources, vulnerability resources, and communication service resources bound to the directed transfer edge, and write the account resources, vulnerability resources, and communication service resources into the resource mutual exclusion constraints respectively, so that the resource mutual exclusion constraints record the account resources, vulnerability resources, and communication service resources occupied by the directed transfer edge during the threat propagation process;

[0109] The time span between the stateful terminal nodes at both ends of the directed transfer edge is calculated based on the time position. The direction of permission change between the stateful terminal nodes at both ends of the directed transfer edge is determined based on the permission status field. The attack stage position corresponding to the directed transfer edge is determined based on the risk behavior status. The resource content occupied by the directed transfer edge is determined based on the threat resource tag. Then, the time span, permission change direction, attack stage position and resource content occupied are converted into search weights of the directed transfer edge, and the search weights are written into the temporal permission layering graph.

[0110] The entry stateful terminal node is used as the search starting point, and the target stateful terminal node is used as the search ending point. The improved Suurballe algorithm is configured with path search conditions according to resource mutual exclusion constraints, so that the path search conditions simultaneously limit the search weight of the directed transition edge and the occupancy relationship of the threat resource label.

[0111] An improved Suurballe algorithm is used to perform a minimum cost path search in the temporal permission hierarchy graph according to the search weight. During the search process, the search is extended from the starting point along the directed transition edge to the ending point. Directed transition edges with conflicting resource occupancy relationships are eliminated based on resource mutual exclusion constraints, and a main threat propagation path consisting of stateful terminal nodes and directed transition edges is generated.

[0112] In this embodiment, resource mutual exclusion constraints are used to limit the occupancy relationship of threat resource tags during the path search process of the improved Suurballe algorithm. The account resources, vulnerability resources, and communication service resources bound to the directed transfer edge are regarded as resource occupancy items, and the resource occupancy items already occupied by the main threat propagation path are written into the main path resource occupancy table. When searching for independent alternative threat propagation paths, the resource occupancy items bound to the candidate directed transfer edge are matched with the main path resource occupancy table. If there is any identical occupancy relationship among the same account resources, the same vulnerability resources, and the same communication service resources, the candidate directed transfer edge is marked as a resource conflict edge, and the edge weight is re-marked according to the resource conflict edge.

[0113] In this embodiment, step seven specifically includes:

[0114] The path node sequence and path edge sequence are read from the main threat propagation path. The path node sequence is used to record the stateful terminal node arrangement relationship of the main threat propagation path, and the path edge sequence is used to record the directed transfer edge arrangement relationship of the main threat propagation path. Then, the threat resource tags associated with the directed transfer edges are read item by item according to the path edge sequence. Account resources, vulnerability resources and communication service resources are extracted from the threat resource tags, and the extraction results are written into the main path resource occupancy table according to the arrangement relationship of the path edge sequence.

[0115] Based on the main path resource occupancy table, traverse the directed transfer edges in the temporal permission layering graph, read the threat resource tags bound to each directed transfer edge, and match the account resources, vulnerability resources, and communication service resources in the threat resource tags with the main path resource occupancy table respectively. When any of the matching results of account resources matching, vulnerability resources matching, and communication service resources matching is true, mark the corresponding directed transfer edge as a resource conflict edge.

[0116] Based on the threat resource labels corresponding to the resource conflict edges, the temporal permission layering graph is recalibrated. The original search weights of the resource conflict edges are read, and weight increments are generated based on the number of account resource conflicts, vulnerability resource conflicts, and communication service resource conflicts. The original search weights are added to the weight increments to form the conflict weights, and then the conflict weights are written back to the resource conflict edges to increase the search weights of the resource conflict edges to the conflict weights.

[0117] The backup search starting point is determined based on the stateful terminal node of the starting point of the main threat propagation path, and the backup search ending point is determined based on the stateful terminal node of the ending point of the main threat propagation path. The backup path search is performed by the improved Suurballe algorithm in the temporal permission layer graph after edge weight recalibration, so that the backup path search selects the directed transfer edge according to the recalibrated search weight within the same starting and ending range.

[0118] The path edge sequence obtained from the backup path search is matched with the main path resource occupancy table. Each directed transfer edge in the path edge sequence obtained from the backup path search is checked for account resource conflicts, vulnerability resource conflicts, and communication service resource conflicts. The path edge sequence without resource conflicts is retained, and the stateful terminal node arrangement relationship and directed transfer edge arrangement relationship corresponding to the retained path edge sequence are used to generate an independent backup threat propagation path.

[0119] In this embodiment, step eight specifically includes:

[0120] The path node sequence, path edge sequence, and threat resource tag are read from the main threat propagation path and the independent backup threat propagation path, respectively. The path node sequence is used to record the arrangement relationship of stateful terminal nodes in the threat propagation process. The path edge sequence is used to record the connection relationship of directed transfer edges in the threat propagation process. The threat resource tag is used to record the account resources, vulnerability resources, and communication service resources occupied by each directed transfer edge in the path edge sequence.

[0121] The threat resource tags associated with the main threat propagation path are matched with the threat resource tags associated with the independent backup threat propagation path. The field values ​​of account resources, vulnerability resources, and communication service resources are compared respectively. If the field values ​​of account resources are the same, an account resource same occupation tag is generated. If the field values ​​of vulnerability resources are the same, a vulnerability resource same occupation tag is generated. If the field values ​​of communication service resources are the same, a communication service resource same occupation tag is generated. Then, an account resource matching result is generated based on the account resource same occupation tag, a vulnerability resource matching result is generated based on the vulnerability resource same occupation tag, and a communication service resource matching result is generated based on the communication service resource same occupation tag.

[0122] When there is no identical occupation relationship among the account resource matching results, vulnerability resource matching results, and communication service resource matching results, an independent resource verification result is generated, and a corresponding relationship is established between the independent resource verification result and the main threat propagation path and the independent backup threat propagation path.

[0123] When there is the same occupation relationship in the account resource matching result, vulnerability resource matching result and communication service resource matching result, a resource conflict verification result is generated, and a corresponding relationship is established between the resource conflict verification result and the account resource, vulnerability resource and communication service resource that have the same occupation relationship.

[0124] Based on the resource independence verification results and resource conflict verification results, the path independence status between the primary threat propagation path and the independent backup threat propagation path is marked. When generating the resource independence verification results, the path independence status is marked as the resource independence status, and when generating the resource conflict verification results, the path independence status is marked as the resource conflict status. Then, the path independence status is written into the path verification record.

[0125] Based on the path node sequence, path edge sequence, and path verification record, the endpoint attack path identification result is generated. The endpoint attack path identification result records the main threat propagation path, independent backup threat propagation path, and path independent state. Based on the entry stateful endpoint node, target stateful endpoint node, and threat resource tag in the main threat propagation path, the threat tracing result is generated.

[0126] Example 1: To verify the feasibility of this invention in practice, it was applied to a scenario of enterprise office terminal security management. In this scenario, office terminals generate process execution records, account login records, network connection records, file access records, and vulnerability status records over a long period. The security platform receives a large number of alerts every day. However, traditional analysis methods mainly trace single alerts, single terminals, and ordinary network connection relationships. This easily leads to paths that share the same account resources, vulnerability resources, and communication service resources being identified as independent attack paths. As a result, security personnel find it difficult to determine whether attackers actually have backup propagation paths, and it is also difficult to locate the threat propagation relationship between the entry terminal and the target terminal in a timely manner.

[0127] In application scenarios, the terminal agent continuously reads terminal security operation data from managed terminals to form a basic terminal security dataset. The system formats the basic terminal security dataset and aligns it according to time position and subject identifier to generate terminal security event records. Subsequently, the system determines the session state, permission state, and risk behavior state of the terminal at different time positions based on the terminal security event records, generates stateful terminal nodes, and establishes directed transition edges according to time increment relationships, permission change relationships, and attack stage progression relationships to construct a temporal permission hierarchy graph. For each directed transition edge, the system extracts account resources, vulnerability resources, and communication service resources from the associated terminal security event records to form threat resource tags, and then configures resource mutual exclusion constraints of the improved Suurballe algorithm based on the threat resource tags. The system first searches for the main threat propagation path in the temporal permission hierarchy graph, then re-labels the edge weights of the directed transition edges according to the threat resource tags occupied by the main threat propagation path, thereby searching for independent backup threat propagation paths. Finally, it performs resource conflict verification on the main threat propagation path and the independent backup threat propagation path, and outputs the terminal attack path identification results and threat tracing results.

[0128] During the verification process, 800 managed terminals were selected, and terminal security operation data were continuously collected for 30 days, yielding approximately 3.12 million process execution records, approximately 460,000 account login records, approximately 1.28 million network connection records, approximately 2.05 million file access records, and approximately 96,000 vulnerability status records. 64 attack propagation events were manually verified, including 17 events where both primary and backup paths existed. This invention was compared with ordinary attack graph path analysis methods. Ordinary attack graph path analysis methods only rely on graph node and edge connection relationships for attack path tracing, while this invention simultaneously introduces time increment relationships, permission change relationships, attack phase progression relationships, and resource mutual exclusion constraints in path search. The comparison results are shown in Table 1.

[0129] Table 1. Comparison of Endpoint Threat Path Identification

[0130] Endpoint security event alignment accuracy 86.4% 96.8% Attack path identification accuracy 78.1% 92.6% Independent backup path identification accuracy 61.7% 88.2% Resource conflict misjudgment rate 24.5% 6.9% Threat Entry Point Location Accuracy 73.4% 90.1% Average analysis time per event 18.6 minutes 7.4 minutes The proportion of manual review workload reduced 31.2% 67.5%

[0131] As shown in Table 1, this invention outperforms conventional attack graph path analysis methods in terms of endpoint security event alignment, attack path identification, independent backup path identification, and threat entry point location. While conventional attack graph path analysis methods can generate attack paths based on the connection relationships between endpoints, they lack threat resource labels and resource mutual exclusion constraints, easily misclassifying paths sharing account resources, vulnerability resources, and communication service resources as independent paths. This invention ensures that paths conform to the evolutionary patterns of time, permissions, and attack stages through stateful endpoint nodes and a temporal permission hierarchy graph. Furthermore, it uses an improved Suurballe algorithm to search for primary threat propagation paths and independent backup threat propagation paths, reducing the resource conflict misjudgment rate from 24.5% to 6.9% and the average analysis time per event from 18.6 minutes to 7.4 minutes. This demonstrates that this invention can improve the accuracy of attack path identification and threat tracing in endpoint security big data environments.

[0132] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A big data analysis method based on terminal security, characterized in that, Includes the following steps: Step 1: Collect terminal security operation data to form a basic terminal security dataset; Step 2: Standardize the format of the endpoint security basic dataset and align it according to time position and subject identifier to generate endpoint security event records; Step 3: Determine the session state, permission state, and risk behavior state of the terminal at different times and locations based on the terminal security event records, and generate stateful terminal nodes; Step 4: Connect stateful terminal nodes according to time increment relationship, permission change relationship and attack phase progression relationship to construct a temporal permission layering graph; Step 5: Extract threat resource tags from the directed transition edges between stateful terminal nodes, so that the threat resource tags represent the occupancy relationship of account resources, vulnerability resources and communication service resources; Step 6: Configure resource mutual exclusion constraints of the improved Suurballe algorithm based on threat resource tags, and search for the main threat propagation path in the temporal permission hierarchy graph; Step 7: Based on the threat resource tags occupied by the main threat propagation path, re-label the edge weights of the temporal permission layering graph and search for independent backup threat propagation paths; Step 8: Perform resource conflict verification on the primary threat propagation path and the independent backup threat propagation path to generate endpoint attack path identification results and threat tracing results.

2. The big data analysis method based on terminal security according to claim 1, characterized in that, Step one specifically involves: Read process execution records, account login records, network connection records, file access records, and vulnerability status records from the terminal agent, and write the terminal identifier, subject identifier, time and location, and collection source for each record; Establish terminal acquisition channels according to terminal identifiers, group records corresponding to the same terminal identifier into the same acquisition group, and arrange the records within the acquisition group according to time position; Perform field integrity and time sequence checks on the collected data groups, delete invalid records with missing terminal identifiers, subject identifiers, and time locations, and write the checked records into the basic data table according to a unified field structure to form the terminal security basic dataset.

3. The big data analysis method based on terminal security according to claim 1, characterized in that, Step two specifically involves: The basic data table is read from the endpoint security basic dataset. Based on the collection source, the record format template is matched, and the process execution record, account login record, network connection record, file access record and vulnerability status record are converted into a unified event field. The unified event field includes endpoint identifier, subject identifier, time and location, event type, event object, behavior result, risk mark and collection source. The unified event fields are grouped according to the terminal identifier, and the unified event fields corresponding to the same terminal identifier are arranged according to the time position. Unified event fields with the same time position are written into the same time alignment unit. Based on the subject identifier, the unified event fields within the time alignment unit are merged, event associations are established for unified event fields associated with the same subject identifier, and the event associations are labeled according to the event type; The calibrated event relationships are written into the event log table, forming an endpoint security event record that includes endpoint identifier, subject identifier, time and location, event type, event object, behavior result, risk marker, and data collection source.

4. The big data analysis method based on terminal security according to claim 1, characterized in that, Step three specifically involves: Read the endpoint identifier, subject identifier, time and location, event type, event object, behavior result and risk mark from the endpoint security event log, and build a status classification index according to the endpoint identifier and time and location; Based on the terminal security event records and behavior results of the event type "account login", determine the login persistence status of the subject identifier at the time location and write the login persistence status into the session status field; Based on the access permissions and behavior results corresponding to the event object, determine the permission change results of the subject identifier at the time location, and write the permission change results into the permission status field; Based on the risk tags corresponding to endpoint security event records of event types such as process execution, network connection, file access, and vulnerability status, the risk behavior status of the endpoint at the time location is determined. Write the state partitioning index, session state field, permission state field, and risk behavior state into the node attribute table, and generate stateful terminal nodes according to the node attribute table.

5. The big data analysis method based on terminal security according to claim 1, characterized in that, Step four specifically involves: Read the terminal identifier, subject identifier, time and location, session state field, permission state field and risk behavior state from the stateful terminal nodes, build a node arrangement sequence according to the terminal identifier, and sort the node arrangement sequence according to the time and location. Based on the sorted stateful terminal nodes, the session state fields of adjacent time positions are compared, and stateful terminal nodes with increasing time positions and consecutive session state fields are identified as time-increasing node pairs. Based on the sorted stateful terminal nodes, the permission status fields of adjacent time positions are compared, and the stateful terminal nodes that maintain, promote, and degrade the permission status fields are identified as permission change node pairs. The attack stage position corresponding to the stateful terminal node is determined based on the risk behavior status, and the attack stage progression relationship is established in the order of login anomaly, execution anomaly, connection anomaly, access anomaly and vulnerability exploitation. When the time-incrementing node pairs, permission-changing node pairs, and attack phase progression relationships all satisfy the connection conditions, directed transition edges are established between the corresponding stateful terminal nodes. The stateful terminal nodes are treated as graph nodes, and the directed transition edges are treated as graph edges. The graph nodes are arranged hierarchically according to the time position and permission status fields to construct a temporal permission hierarchical graph.

6. The big data analysis method based on terminal security according to claim 1, characterized in that, Step five specifically involves: Read stateful terminal nodes and directed transition edges from the temporal permission layering graph, and match terminal security event records within the time position of the starting node and the ending node according to the starting node and the ending node. Extract account resources from the subject identifier in the endpoint security event log, extract vulnerability resources from the event object and risk marker, and extract communication service resources from the endpoint security event log with the event type of network connection. Write account resources, vulnerability resources, and communication service resources into the resource tag field, and bind the resource tag field to the corresponding directed transition edge; A tag index table is established based on the starting node, ending node, and resource tag field of the directed transition edge, so that the tag index table records the occupancy relationship of account resources, vulnerability resources, and communication service resources in threat propagation; Write the tag index table into the temporal permission hierarchy graph to generate threat resource tags that characterize the relationship between account resources, vulnerability resources, and communication service resources.

7. The big data analysis method based on terminal security according to claim 1, characterized in that, Step six specifically involves: Read stateful terminal nodes, directed transition edges, and threat resource tags from the temporal permission hierarchy graph, and determine the entry stateful terminal node and the target stateful terminal node based on the risk behavior status; Based on the threat resource tags, read the account resources, vulnerability resources, and communication service resources bound to the directed transfer edge, and write the account resources, vulnerability resources, and communication service resources into the resource mutual exclusion constraint; The search weights of directed transition edges are calculated based on time location, permission status field, risk behavior status, and threat resource tags, and the search weights are written into the temporal permission hierarchy graph. The improved Suurballe algorithm uses the entry stateful terminal node as the search starting point and the target stateful terminal node as the search ending point, and configures the path search conditions according to resource mutual exclusion constraints. An improved Suurballe algorithm is used to perform a minimum-cost path search in the temporal permission hierarchy graph according to the search weights, generating the main threat propagation path.

8. The big data analysis method based on terminal security according to claim 1, characterized in that, The resource mutual exclusion constraint is used to limit the occupancy relationship of threat resource tags during the path search process of the improved Suurballe algorithm. The account resources, vulnerability resources, and communication service resources bound to the directed transfer edge are regarded as resource occupancy items, and the resource occupancy items already occupied by the main threat propagation path are written into the main path resource occupancy table. When searching for independent alternative threat propagation paths, the resource occupancy items bound to the candidate directed transfer edge are matched with the main path resource occupancy table. If there is any identical occupancy relationship among the same account resources, the same vulnerability resources, and the same communication service resources, the candidate directed transfer edge is marked as a resource conflict edge, and the edge weight is re-marked according to the resource conflict edge.

9. The big data analysis method based on terminal security according to claim 1, characterized in that, Step seven specifically involves: Read the path node sequence and path edge sequence from the main threat propagation path, extract account resources, vulnerability resources and communication service resources based on the threat resource tags associated with the path edge sequence, and generate the main path resource usage table; Based on the main path resource occupancy table, traverse the directed transfer edges in the temporal permission layering graph, and mark the directed transfer edges that have the same account resources, the same vulnerability resources, and the same communication service resources as the main path resource occupancy table as resource conflict edges. Based on the threat resource tags corresponding to the resource conflict edges, the temporal permission layering graph is recalibrated to increase the search weight of the resource conflict edges to the preset conflict weight. The alternative search starting point is determined based on the stateful terminal node of the starting point of the main threat propagation path, and the alternative search endpoint is determined based on the stateful terminal node of the ending point of the main threat propagation path. The alternative path search of the improved Suurballe algorithm is performed in the temporal permission layer graph after edge weight re-labeling. The path edge sequences obtained from the alternative path search are matched with the main path resource occupancy table. Path edge sequences without resource conflicts are retained to generate independent alternative threat propagation paths.

10. A big data analysis method based on terminal security according to claim 1, characterized in that, Step eight specifically involves: Read the path node sequence, path edge sequence, and threat resource tags from the primary threat propagation path and the independent backup threat propagation path, respectively; The threat resource tags associated with the main threat propagation path are matched with the threat resource tags associated with the independent backup threat propagation path to obtain account resource matching results, vulnerability resource matching results, and communication service resource matching results. When there is no identical occupancy relationship among the account resource matching results, vulnerability resource matching results, and communication service resource matching results, an independent resource verification result is generated. When there is an identical occupancy relationship in the account resource matching results, vulnerability resource matching results, and communication service resource matching results, a resource conflict verification result is generated. Based on the resource independence verification results and resource conflict verification results, the path independence status between the primary threat propagation path and the independent backup threat propagation path is marked, and the path independence status is written into the path verification record; Based on the path node sequence, path edge sequence, and path verification record, the endpoint attack path identification result is generated, and based on the entry stateful endpoint node, target stateful endpoint node, and threat resource tag in the main threat propagation path, the threat tracing result is generated.

Images