Security sentry network early warning method based on edge computing and behavior analysis

Abstract

The application discloses a security sentry network early warning method based on edge computing and behavior analysis, relates to the technical field of network behavior analysis, and comprises the following steps: obtaining a sentry monitoring position and a simulative behavior; using a pre-warning behavior analysis method to obtain a first pre-warning parameter, a pre-warning sequence set and a buffer determination relationship; based on the data monitored by the security sentry and the pre-warning characteristic parameters of all the simulative behaviors, performing abnormal behavior pre-warning in a server; and the application is used for solving the problem that, in the prior art, in the aspect of distributed network security pre-warning, there is no method for cooperatively analyzing the monitoring data of multiple sentries in the time domain window with an anomaly, so that the progressive anomaly is determined to be a risk only according to a single-point monitoring result, and the cross-node weak anomaly in the incubation period is ignored.

Description

Technical Field

[0001] This invention relates to the field of network behavior analysis technology, specifically a security sentinel network early warning method based on edge computing and behavior analysis. Background Technology

[0002] Security Sentinel Network Early Warning typically refers to a proactive intelligent security early warning system that integrates technologies such as artificial intelligence, edge computing, the Internet of Things, and big data analytics. Its core function is to shift from the traditional "passive post-event handling" to "proactive pre-event early warning and real-time intervention during the event." Security Sentinel Network Early Warning, based on edge computing and behavioral analysis, is a proactive intelligent security protection and early warning system that integrates edge computing and AI behavioral recognition technologies, and achieves risk response within seconds by relying on a cloud-edge-device collaborative architecture.

[0003] Existing methods for security sentinel network early warning based on edge computing and behavioral analysis typically involve deploying AI sentinel terminals and edge computing devices within the equipment. This allows for the training and prediction of deep learning models within the device, enabling the use of deep learning models to perceive and warn of anomalies. While this improved approach enhances the accuracy of anomaly identification, the security sentinels operate independently. In distributed network security early warning, there is a lack of collaborative analysis of monitoring data from multiple sentinels within a time window where anomalies exist. This lack of a method to correlate and identify weak, homogeneous anomalies that have not reached alarm thresholds leads to progressive anomalies being assessed based solely on single-point monitoring results. Consequently, weak, cross-node anomalies in their incubation period are overlooked until attacks escalate and trigger security incidents. For example, patent application CN110225067A discloses an IoT security... The early warning system utilizes edge computing devices and AI sentinel terminals. On the edge computing devices, network traffic anomaly identification training and prediction based on convolutional neural networks are performed on the IoT network side, and timely alerts are issued via the AI ​​sentinel terminals. Other security sentinel network early warning methods based on edge computing and behavioral analysis typically focus on improvements in alarm event correlation analysis. In distributed network security early warning, they lack methods for collaborative analysis of monitoring data from multiple sentinels within an anomaly time window to identify weak, homogeneous anomalies that have not reached alarm thresholds. This results in progressive anomalies being assessed based solely on single-point monitoring results, leading to the neglect of weak cross-node anomalies in their incubation period until attacks escalate and security incidents occur. Therefore, it is necessary to improve existing security sentinel network early warning methods based on edge computing and behavioral analysis. Summary of the Invention

[0004] This invention aims to at least partially solve one of the technical problems in the prior art. It addresses the lack of a method in the prior art for collaborative analysis of monitoring data from multiple sentinels within a time window where anomalies exist, in order to identify weak, homogeneous anomalies that have not reached the alarm threshold. This results in progressive anomalies being judged based solely on single-point monitoring results, leading to the neglect of weak cross-node anomalies in the incubation period until the attack escalates and causes a security incident.

[0005] To achieve the above objectives, this application provides a security sentinel network early warning method based on edge computing and behavior analysis, including: The server used for network early warning is designated as the server to be analyzed; the location on the server to be analyzed where security sentinels can be deployed is designated as the sentinel monitoring location; and the behavior that can be simulated on the server to be analyzed and will cause network early warning on the server to be analyzed is designated as the simulateable behavior. The warning behavior analysis method is used to analyze each simulable behavior, and based on the analysis results, the first warning parameter, warning order set, and buffer judgment relationship of each simulable behavior and all security sentinels are obtained. When using Security Sentinel to monitor data on the server, abnormal behavior warnings are issued within the server based on the data monitored by Security Sentinel and the warning feature parameters of all simulateable behaviors. The warning feature parameters include the first warning parameter, the warning order set, and the buffer judgment relationship.

[0006] Furthermore, the step of defining the location where a security sentinel can be deployed on the server to be analyzed as a sentinel monitoring location, and defining the behavior that can be simulated on the server to be analyzed and will cause network alerts on the server to be analyzed as a simulateable behavior, also includes the following sub-steps: Security sentinels are deployed at each sentinel monitoring location. Based on the location of each security sentinel, the data types that the security sentinel can monitor at the sentinel monitoring location are recorded as the monitorable types of the security sentinel. A security sentinel can correspond to multiple monitorable types, and each monitorable type corresponds to only one parameter. When the same data type corresponds to multiple parameters, the same data type can be divided into multiple monitorable types. Obtain historical warning records of the server to be analyzed, and based on the abnormal behavior corresponding to each warning in the historical warning records, record the abnormal behavior that can be controlled and simulated within the server to be analyzed as simulateable behavior.

[0007] Furthermore, the early warning behavior analysis method includes: The operating state of the server to be analyzed is recorded as the simulated state when the server is running under standard operating conditions and all security sentinels at all sentinel monitoring locations are monitoring its corresponding measurable type. The standard operating condition is when all operating parameters within the server to be analyzed are within their corresponding normal range. For any simulable behavior: when the server to be analyzed is in a simulable state, at time T1, the simulable behavior is simulated in a controllable manner within the server to be analyzed, and the time when the server to be analyzed issues a risk warning for the simulable behavior based on the early warning module is recorded as T2. The time domain between T1 and T2 is recorded as the risk analysis time domain.

[0008] Furthermore, the early warning behavior analysis method also includes: For any security sentry at any sentry monitoring location: In the risk analysis time domain, the monitoring data of all measurable types corresponding to the security sentry are respectively denoted as parameter monitoring data CS1 to parameter monitoring data CS. t Where t is the number of detectable types corresponding to the sentry's monitoring position; For any parameter monitoring data: the name of the parameter monitored by the safety sentinel in the parameter monitoring data is recorded as the parameter to be analyzed, and the unit corresponding to the parameter to be analyzed is recorded as γ; establish a plane rectangular coordinate system with the unit of min on the horizontal axis and the unit of γ on the vertical axis, and record it as the parameter monitoring coordinate system.

[0009] Furthermore, the early warning behavior analysis method also includes: Based on parameter monitoring data, a time series curve of the parameter to be analyzed versus time is plotted in the parameter monitoring coordinate system, and the curve whose horizontal axis is in the risk analysis time domain is recorded as the risk analysis curve. The normal fluctuation range of the parameter to be analyzed in the server to be analyzed is recorded as the standard operating range; based on the warning standard of the security sentinel for the parameter to be analyzed, the range in which the parameter to be analyzed is located when the security sentinel needs to issue a warning for the parameter to be analyzed is recorded as the warning range; The minimum and maximum values ​​in the standard operating range are denoted as Y1 and Y2, respectively. The lines Y=Y1 and Y=Y2 are marked in the parameter monitoring coordinate system and denoted as the lower limit and upper limit of the standard operating range, respectively.

[0010] Furthermore, the early warning behavior analysis method also includes: The area between the standard operating lower limit and the standard operating upper limit is recorded as the standard operating area; based on the values ​​of the parameters to be analyzed in the warning range, the corresponding area of ​​the warning range is marked in the parameter monitoring coordinate system and recorded as the warning area; the area in the parameter monitoring coordinate system other than the standard operating area and the warning area is recorded as the buffer analysis area. When the risk analysis curve is completely between the lower limit and the upper limit of standard operation, the parameter to be analyzed is named an irrelevant parameter that can simulate behavior; When some curves in the risk analysis curve are within the warning zone, the risk analysis curves within the warning zone are recorded as the warning judgment curves, and the abscissa corresponding to the leftmost point of the warning judgment curve is marked as the warning time; the parameter to be analyzed is named the warning parameter of simulated behavior; When all regions in the risk analysis curve are not within the warning zone, and some curves are within the buffer analysis zone, the curves in the risk analysis curve that are within the buffer analysis zone are recorded as buffer analysis curves, and the time domain corresponding to the horizontal axis of the buffer analysis curve is recorded as the parameter buffer time domain; the parameter to be analyzed is named the buffer judgment parameter that can simulate behavior.

[0011] Furthermore, the early warning behavior analysis method also includes: Name the parameters to be analyzed corresponding to all parameter monitoring data as irrelevant parameters, warning parameters, or buffer judgment parameters; For the parameters to be analyzed that are named warning parameters: among all the warning times corresponding to the parameters to be analyzed, the parameter with the earliest warning time is recorded as the first warning parameter of the simulated behavior. Based on all the warning times from first to last, all warning parameters are sorted, and the set of the sorted parameters to be analyzed is recorded as the warning order set of the simulated behavior. For the parameter to be analyzed, which is named the buffer judgment parameter: take the warning time of the first warning parameter as the benchmark, mark the warning time of the first warning parameter and the buffer time domain of all parameters of the parameter to be analyzed in the time axis, and record the positional relationship between the warning time and the buffer time domain of all parameters in the time axis as the buffer judgment relationship between the buffer judgment parameter and the simulated behavior. Obtain the first warning parameters, warning order set, and buffer judgment relationship corresponding to the simulated behavior and the security sentry at all sentry monitoring locations.

[0012] Furthermore, the step of issuing abnormal behavior warnings within the server based on the data monitored by the security sentinel and the warning feature parameters of all simulable behaviors when using a security sentinel to monitor data on the server includes the following sub-steps: When using security sentinels to monitor data on the server, the monitoring data of each security sentinel for all monitorable types is acquired in real time and recorded as real-time monitoring data; For any real-time monitoring data of a safety sentinel A: when the value of any parameter β to be analyzed in the real-time monitoring data is within the warning range of parameter β to be analyzed, and parameter β to be analyzed is any simulated behavior α and the first warning parameter of safety sentinel A, parameter β to be analyzed is recorded as the risk judgment parameter. Let T be the time when the parameter β to be analyzed is recorded as the risk judgment parameter, and let Ω be the data in the time domain of the real-time monitoring data as the risk judgment data. Here, Ω is the time domain consisting of L before T and L after T, and L is the length of the risk analysis time domain of the simulated behavior α.

[0013] Furthermore, the step of issuing abnormal behavior warnings within the server based on the data monitored by the security sentinel and the warning feature parameters of all simulable behaviors when using a security sentinel to monitor data on the server also includes the following sub-steps: When the risk assessment data simultaneously meets both conditions 1 and 2, a safety warning that can simulate behavior α is sent, with the sentry monitoring location to which safety sentry A belongs as the warning occurrence point. Condition 1 is as follows: In the risk assessment data, when the value of the parameter to be analyzed is within the corresponding warning range, the parameter to be analyzed is marked as a warning assessment parameter. The same parameter to be analyzed can be marked repeatedly. Based on the time when all warning assessment parameters are marked, all warning assessment parameters are sorted from first to last. When the set obtained after sorting is the same as the warning order set corresponding to the simulated behavior α and the safety sentinel A, the risk assessment data is determined to satisfy condition 1.

[0014] Furthermore, the step of issuing abnormal behavior warnings within the server based on the data monitored by the security sentinel and the warning feature parameters of all simulable behaviors when using a security sentinel to monitor data on the server also includes the following sub-steps: Condition 2 is: For any buffer judgment parameter corresponding to the simulateable behavior α and the security sentinel A: the buffer judgment parameter obtained when analyzing the simulateable behavior α and the security sentinel A in the early warning behavior analysis method and the buffer judgment relationship of the simulateable behavior are denoted as the standard judgment relationship; Based on the early warning behavior analysis method and time T, the buffer judgment relationship corresponding to the buffer judgment parameter in the risk judgment data is obtained and recorded as the risk judgment relationship; when the positional relationship between the warning time and the buffer time domain of all parameters in the standard judgment relationship is exactly the same as the positional relationship between T and the buffer time domain of all parameters in the risk judgment relationship, the risk judgment data is determined to meet condition 2.

[0015] The beneficial effects of this invention are as follows: First, the locations in the server to be analyzed where security sentinels can be deployed are recorded as sentinel monitoring locations, and simulable behaviors are obtained. Then, the early warning behavior analysis method is used to analyze each simulable behavior separately, and based on the analysis results, the first early warning parameters, early warning order set, and buffer judgment relationship corresponding to each simulable behavior and all security sentinels are obtained. Finally, when security sentinels are used to monitor data in the server, abnormal behavior early warnings are issued within the server based on the data monitored by the security sentinels and the early warning characteristic parameters of all simulable behaviors. The advantage of this is that by using the early warning behavior analysis method to analyze each simulable behavior separately, the propagation timing characteristics of abnormal behaviors in the server network can be clearly identified, thereby supporting cross-sentinel temporal linkage analysis. Furthermore, by fully identifying weak, homogeneous anomalies within buffer zones and those that have not triggered single-point alarms, the limitations of single-point independent threshold judgments can be overcome, effectively capturing latent, progressive attacks, triggering security early warnings in advance, and preventing attacks from escalating and causing security incidents. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0017] Figure 1 This is a schematic flowchart of the method of the present invention; Figure 2 This is a schematic diagram of the risk analysis curve for this invention; Figure 3 This is a schematic diagram showing the locations of the standard operating area, early warning area, and buffer analysis area of ​​the present invention. Figure 4 This is a schematic diagram of the early warning judgment curve of the present invention; Figure 5 This is a schematic diagram of the markings in the timeline of this invention. Detailed Implementation

[0018] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0019] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be used interchangeably where appropriate so that the embodiments of the invention described herein can cover implementations in sequences other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0020] As server clusters expand and multi-layered distributed security sentinels are widely deployed, relying on edge behavior analysis to achieve full-domain network awareness and help identify abnormal behavior in server north-south external connections and internal network lateral movements. However, the incubation period of progressive network attacks can easily generate weak, single-point deviations in data, making it difficult for traditional independent threshold-based early warning models to capture cross-node threats originating from the same source, leading to the security risk of threats erupting prematurely. To address these issues, this application provides a security sentinel network early warning method based on edge computing and behavior analysis. Please refer to [link to relevant documentation]. Figure 1 As shown, it includes: Step S1: Record the server used for network early warning as the server to be analyzed; record the location in the server to be analyzed where security sentinels can be deployed as sentinel monitoring location; and record the behavior that can be simulated in the server to be analyzed and will cause network early warning of the server to be analyzed as simulateable behavior. The S1 step includes the following sub-steps: Step S101, deploy security sentries at each sentry monitoring location, and based on the location of each security sentry, record the data types that the security sentry can monitor at the sentry monitoring location as the monitorable types of the security sentry. A security sentry can correspond to multiple monitorable types, and each monitorable type corresponds to only one parameter. When the same data type corresponds to multiple parameters, the same data type can be divided into multiple monitorable types. In practical implementation, for example, during a data analysis, a security sentinel deployed at a sentinel monitoring location monitors network session traffic data. The network session traffic data contains monitorable parameters including session duration, single session packet size, number of packets per unit time, and uplink / downlink traffic ratio. Therefore, the monitorable types corresponding to the security sentinel should be: session duration (network session traffic data), single session packet size (network session traffic data), number of packets per unit time (network session traffic data), and uplink / downlink traffic ratio (network session traffic data), that is, the same data type "network session traffic data" is divided into multiple monitorable types. Step S102: Obtain the historical warning records of the server to be analyzed, and based on the abnormal behavior corresponding to each warning in the historical warning records, record the abnormal behavior that can be controlled and simulated within the server to be analyzed as the simulateable behavior. In the data analysis of this embodiment, for example, in a data analysis, the abnormal behavior corresponding to a warning obtained is "the application server continuously and slowly scanning the internal network segment". By analyzing the server's operating environment, it is found that the server can controllably simulate "the application server continuously and slowly scanning the internal network segment". Therefore, "the application server continuously and slowly scanning the internal network segment" can be recorded as a simulable behavior. For abnormal behaviors that cannot be controlled and simulated in the server, virtualization simulation can be performed by establishing a digital twin model.

[0021] Step S2: Use the early warning behavior analysis method to analyze each simulable behavior, and based on the analysis results, obtain the first early warning parameter, early warning order set, and buffer judgment relationship for each simulable behavior and all security sentinels. The early warning behavior analysis method includes: step S201, recording the operating state of the server to be analyzed as a simulated state when the server is running under standard operating conditions and all security sentinels at the sentinel monitoring positions are monitoring its corresponding monitorable type. The standard operating conditions are when all operating parameters in the server to be analyzed are within their corresponding normal range. Step S202: For any simulable behavior: When the server to be analyzed is in a simulable state, at time T1, the simulable behavior is simulated in a controllable manner within the server to be analyzed, and the time when the server to be analyzed issues a risk warning for the simulable behavior based on the warning module is recorded as T2. The time domain between T1 and T2 is recorded as the risk analysis time domain. In the data analysis of this embodiment, for example, in a controlled simulation of a simulateable behavior, at 12:00, a controlled simulation of "the application server continuously scanning the internal network segment's slow ports" is performed on the server to be analyzed. Based on the early warning module of the server to be analyzed, the time for issuing a risk warning for "the application server continuously scanning the internal network segment's slow ports" is 12:50. Therefore, the time domain between 12:00 and 12:50 can be recorded as the risk analysis time domain.

[0022] The early warning behavior analysis method also includes: step S203, for any security sentry at a sentry monitoring location: in the risk analysis time domain, record the monitoring data of all measurable types corresponding to the security sentry as parameter monitoring data CS1 to parameter monitoring data CS. t Where t is the number of detectable types corresponding to the sentry's monitoring position; Step S204: For any parameter monitoring data: Record the name of the parameter monitored by the safety sentinel in the parameter monitoring data as the parameter to be analyzed, and record the unit corresponding to the parameter to be analyzed as γ; establish a plane rectangular coordinate system with the unit of min for the horizontal axis and the unit of γ for the vertical axis, and record it as the parameter monitoring coordinate system.

[0023] The early warning behavior analysis method also includes: step S205, based on parameter monitoring data, plotting the time series curve of the parameter to be analyzed versus time in the parameter monitoring coordinate system, and recording the curve whose horizontal axis is in the risk analysis time domain as the risk analysis curve; In the data analysis of this embodiment, for example, in the controllable simulation of "application server continuously slow port scanning of internal network segments" mentioned above, the parameter to be analyzed corresponding to one of the monitored parameters is "average duration of a single session," and the unit of "average duration of a single session" is seconds; the risk analysis curve corresponding to "average duration of a single session" obtained in the parameter monitoring coordinate system is as follows: Figure 2 The curve PH is shown in the figure; Step S206: Record the normal fluctuation range of the parameter to be analyzed in the server to be analyzed as the standard operating range; based on the warning standard of the security sentinel for the parameter to be analyzed, record the range of the parameter to be analyzed when the security sentinel needs to issue a warning for the parameter to be analyzed as the warning range; In the data analysis of this embodiment, through data acquisition, the normal fluctuation range and warning range of the "average duration of a single session" in the server under analysis are obtained as [0.8s, 3.2s] and <0.3s, respectively. Analysis shows that in the parameter monitoring coordinate system corresponding to the above-mentioned "average duration of a single session," the standard operating area, warning area, and buffer analysis area are respectively... Figure 3 The area between the dashed lines CP1 and CP2, the area below the dashed line CP3, and the area between the dashed lines CP2 and CP3; Step S207: Record the minimum and maximum values ​​in the standard operating range as Y1 and Y2 respectively, mark the lines Y=Y1 and Y=Y2 in the parameter monitoring coordinate system respectively, and record them as the lower limit of standard operation and the upper limit of standard operation respectively.

[0024] The early warning behavior analysis method also includes: step S208, which marks the area between the standard operating lower limit and the standard operating upper limit as the standard operating area; based on the values ​​of the parameters to be analyzed in the early warning range, marks the area corresponding to the early warning range in the parameter monitoring coordinate system and marks it as the early warning area; and marks the area in the parameter monitoring coordinate system other than the standard operating area and the early warning area as the buffer analysis area. Step S209: When the risk analysis curve is completely between the lower limit of standard operation and the upper limit of standard operation, the parameter to be analyzed is named as an irrelevant parameter that can simulate behavior. Step S210: When some curves in the risk analysis curve are within the warning area, the risk analysis curves within the warning area are recorded as the warning judgment curves, and the axonogram corresponding to the leftmost point of the warning judgment curve is marked as the warning time; the parameter to be analyzed is named the warning parameter of simulated behavior. In the data analysis of this embodiment, by analyzing... Figure 3 Analyzing the positional relationship between the pH curve and the standard operating region, warning region, and buffer analysis region reveals that some curves in the risk analysis curve corresponding to the "average duration of a single session" fall within the warning region. Therefore, it is possible to... Figure 4 The curve JQ in the diagram is designated as the warning judgment curve, and the "average duration of a single session" is named the warning parameter for "application server's continuous slow port scanning of the internal network segment." Simultaneously, based on... Figure 4 Therefore, the warning time is 12:24; Step S211: When all regions in the risk analysis curve are not within the warning area, and some curves are within the buffer analysis area, the curves in the risk analysis curve that are within the buffer analysis area are recorded as buffer analysis curves, and the time domain corresponding to the horizontal axis of the buffer analysis curve is recorded as the parameter buffer time domain; the parameter to be analyzed is named the buffer judgment parameter that can simulate behavior.

[0025] The early warning behavior analysis method also includes: step S212, naming the parameters to be analyzed corresponding to all parameter monitoring data as irrelevant parameters, warning parameters, or buffer judgment parameters; Step S213: For the parameters to be analyzed that are named warning parameters: among all the warning times corresponding to the parameters to be analyzed, the parameter with the earliest warning time is recorded as the first warning parameter of the simulated behavior. Based on all the warning times from first to last, all the warning parameters are sorted, and the set of the sorted parameters to be analyzed is recorded as the warning order set of the simulated behavior. In the data analysis of this embodiment, for example, after a data analysis, all the parameters to be analyzed that are named warning parameters are: "average duration of a single session", "destination port dispersion" and "percentage of failed TCP connections", and the corresponding warning times are 12:24, 12:42 and 12:14 respectively; thus, the first warning parameter is "percentage of failed TCP connections", and the warning order set is ["percentage of failed TCP connections", "average duration of a single session", "destination port dispersion"].

[0026] Step S214, for the parameter to be analyzed named the buffer judgment parameter: based on the warning time of the first warning parameter, mark the warning time of the first warning parameter and the buffer time domain of all parameters of the parameter to be analyzed in the time axis, and record the positional relationship between the warning time and the buffer time domain of all parameters in the time axis as the buffer judgment relationship between the buffer judgment parameter and the simulated behavior. In the data analysis of this embodiment, for example, after a data analysis, a buffer judgment parameter is obtained as "target IP dispersion", and the warning time of the first warning parameter and the marking of the buffer time domain of all parameters of "target IP dispersion" on the time axis are as follows: Figure 5 As shown, CH1, CH2, CH3, and CH4 are all parameter buffer time domains corresponding to the "target IP dispersion", and 12:14 is the warning time of the first warning parameter; therefore, it can be concluded that... Figure 5 The positional relationship between the warning time and all parameter buffer time domains within the time axis is denoted as the buffer judgment relationship between "target IP dispersion" and "application server's continuous slow port scanning of internal network segments"; regarding the state when the warning time or parameter buffer time domain is recorded in the buffer judgment relationship, it is... Figure 5 Taking CH4 as an example, the positional relationship of CH4 can be recorded as follows: CH4 is located to the left of the warning time, and there are CH2 and CH3 between it and the warning time; Step S215: Obtain the first warning parameters, warning order set, and buffer judgment relationship corresponding to the simulated behavior and the security sentry at all sentry monitoring locations.

[0027] Step S3: When using the security sentinel to monitor the data in the server, based on the data monitored by the security sentinel and the warning feature parameters of all simulateable behaviors, an abnormal behavior warning is issued in the server. The warning feature parameters include the first warning parameter, the warning order set, and the buffer judgment relationship. The S3 step includes the following sub-steps: Step S301, when using security sentinels to monitor data in the server, real-time monitoring data of each security sentinel for all monitorable types is obtained and recorded as real-time monitoring data; Step S302: For any real-time monitoring data of a security sentinel A: when the value of any parameter β to be analyzed in the real-time monitoring data is within the warning range of the parameter β to be analyzed, and the parameter β to be analyzed is any simulated behavior α and the first warning parameter of security sentinel A, the parameter β to be analyzed is recorded as the risk judgment parameter. Step S303: The time when the parameter β to be analyzed is recorded as the risk judgment parameter is denoted as T, and the data in the time domain of the real-time monitoring data is denoted as the risk judgment data, where Ω is the time domain consisting of L before T and L after T, and L is the length of the risk analysis time domain of the simulated behavior α. In the data analysis of this embodiment, for example, in a single data analysis, the simulateable behavior α is "the application server continuously performs slow port scanning on the internal network segment", and the parameter to be analyzed β is "the average duration of a single session". Through the above analysis, it can be found that the length of the risk analysis time domain corresponding to "the application server continuously performs slow port scanning on the internal network segment" is 50 minutes, and the time when "the average duration of a single session" is recorded as the risk judgment parameter is 15:00. Therefore, T and L are 15:00 and 50 minutes respectively. The time domain [14:10, 15:50] consisting of 50 minutes before 15:00 and 50 minutes after 15:00 can be denoted as Ω.

[0028] The S3 step also includes the following sub-step: Step S304, when the risk judgment data simultaneously meets both condition 1 and condition 2, a safety warning that can simulate behavior α is sent with the sentry monitoring location to which the safety sentry A belongs as the warning occurrence point. Step S305, condition 1 is: In the risk judgment data, when the value of the parameter to be analyzed is within the corresponding warning range, the parameter to be analyzed is marked as a warning judgment parameter. The same parameter to be analyzed can be marked repeatedly. Based on the time when all warning judgment parameters are marked, all warning judgment parameters are sorted from first to last. When the set obtained after sorting is the same as the warning order set corresponding to the simulated behavior α and the safety sentinel A, it is determined that the risk judgment data satisfies condition 1. In the data analysis of this embodiment, for example, in a single data analysis, the set corresponding to all the warning judgment parameters after sorting is ["Percentage of failed TCP connections", "Average duration of a single session", "Destination port dispersion"]. Through the above analysis, the warning order set corresponding to "Application server's continuous slow port scanning of the internal network segment" and the security sentinel is ["Percentage of failed TCP connections", "Average duration of a single session", "Destination port dispersion"]. The two sets are completely identical, so it can be determined that the risk judgment data meets condition 1.

[0029] The S3 step also includes the following sub-step: Step S306, condition 2 is: for any buffer judgment parameter corresponding to the simulated behavior α and the security sentinel A: the buffer judgment parameter obtained when analyzing the simulated behavior α and the security sentinel A in the early warning behavior analysis method and the buffer judgment relationship of the simulated behavior are recorded as the standard judgment relationship; Step S307: Based on the early warning behavior analysis method and time T, obtain the buffer judgment relationship corresponding to the buffer judgment parameter in the risk judgment data, and record it as the risk judgment relationship; when the positional relationship between the warning time and all parameter buffer time domains in the standard judgment relationship is exactly the same as the positional relationship between T and all parameter buffer time domains in the risk judgment relationship, the risk judgment data is determined to meet condition 2. In the data analysis of this embodiment, for example, during a single data analysis, the positional relationship of CH4 in the time domain of the standard judgment relationship is recorded as follows: CH4 is located to the left of the warning time, and there are CH2 and CH3 between it and the warning time; in the risk judgment relationship obtained based on the early warning behavior analysis method and time T, the positional relationship of CH4 in the time domain is recorded as follows: CH4 is located to the left of the warning time, and there is CH3 between it and the warning time; through analysis, it can be found that there is a difference in the recording of the positional relationship of CH4 in the time domain in the above standard judgment relationship and risk judgment relationship, therefore it cannot be determined that the risk judgment data meets condition 2.

[0030] This application also provides an electronic device. This electronic device can be a server. Specifically, the server may include: at least one processor, at least one memory, a power supply, a communication interface, an input / output interface, and a communication bus. The memory stores a computer program, which is loaded and executed by the processor to implement the relevant steps in the methods disclosed in the foregoing embodiments.

[0031] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0032] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0033] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0034] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0035] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0036] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0037] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0038] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0039] Finally, it should be noted that other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A security sentinel network early warning method based on edge computing and behavior analysis, characterized in that, include: The server used for network early warning is designated as the server to be analyzed; The location on the server to be analyzed where a security sentinel can be deployed is recorded as the sentinel monitoring location, and the behavior that can be simulated on the server to be analyzed and will cause network alerts on the server to be analyzed is recorded as the simulateable behavior; The warning behavior analysis method is used to analyze each simulable behavior, and based on the analysis results, the first warning parameter, warning order set, and buffer judgment relationship of each simulable behavior and all security sentinels are obtained. When using Security Sentinel to monitor data on the server, abnormal behavior warnings are issued within the server based on the data monitored by Security Sentinel and the warning feature parameters of all simulateable behaviors. The warning feature parameters include the first warning parameter, the warning order set, and the buffer judgment relationship.

2. The method according to claim 1, characterized in that, The step of defining the location on the server to be analyzed where a security sentinel can be deployed as a sentinel monitoring location, and defining the behavior that can be simulated on the server to be analyzed and will cause network alerts on the server to be analyzed as a simulateable behavior, further includes the following sub-steps: Security sentinels are deployed at each sentinel monitoring location. Based on the location of each security sentinel, the data types that the security sentinel can monitor at the sentinel monitoring location are recorded as the monitorable types of the security sentinel. A security sentinel can correspond to multiple monitorable types, and each monitorable type corresponds to only one parameter. When the same data type corresponds to multiple parameters, the same data type can be divided into multiple monitorable types. Obtain historical warning records of the server to be analyzed, and based on the abnormal behavior corresponding to each warning in the historical warning records, record the abnormal behavior that can be controlled and simulated within the server to be analyzed as simulateable behavior.

3. The method according to claim 2, characterized in that, Early warning behavior analysis methods include: The operating state of the server to be analyzed is recorded as the simulated state when the server is running under standard operating conditions and all security sentinels at all sentinel monitoring locations are monitoring its corresponding measurable type. The standard operating condition is when all operating parameters within the server to be analyzed are within their corresponding normal range. For any simulable behavior: when the server to be analyzed is in a simulable state, at time T1, the simulable behavior is simulated in a controllable manner within the server to be analyzed, and the time when the server to be analyzed issues a risk warning for the simulable behavior based on the early warning module is recorded as T2. The time domain between T1 and T2 is recorded as the risk analysis time domain.

4. The method according to claim 3, characterized in that, Early warning behavior analysis also includes: For any security sentry at any sentry monitoring location: In the risk analysis time domain, the monitoring data of all measurable types corresponding to the security sentry are respectively denoted as parameter monitoring data CS1 to parameter monitoring data CS. t Where t is the number of detectable types corresponding to the sentry's monitoring position; For any parameter monitoring data: the name of the parameter monitored by the safety sentinel in the parameter monitoring data is recorded as the parameter to be analyzed, and the unit corresponding to the parameter to be analyzed is recorded as γ; establish a plane rectangular coordinate system with the unit of min on the horizontal axis and the unit of γ on the vertical axis, and record it as the parameter monitoring coordinate system.

5. The method according to claim 4, characterized in that, Early warning behavior analysis also includes: Based on parameter monitoring data, a time series curve of the parameter to be analyzed versus time is plotted in the parameter monitoring coordinate system, and the curve whose horizontal axis is in the risk analysis time domain is recorded as the risk analysis curve. The normal fluctuation range of the parameter to be analyzed in the server to be analyzed is recorded as the standard operating range; based on the warning standard of the security sentinel for the parameter to be analyzed, the range in which the parameter to be analyzed is located when the security sentinel needs to issue a warning for the parameter to be analyzed is recorded as the warning range; The minimum and maximum values ​​in the standard operating range are denoted as Y1 and Y2, respectively. The lines Y=Y1 and Y=Y2 are marked in the parameter monitoring coordinate system and denoted as the lower limit and upper limit of the standard operating range, respectively.

6. The method according to claim 5, characterized in that, Early warning behavior analysis also includes: The area between the standard operating lower limit and the standard operating upper limit is recorded as the standard operating area; based on the values ​​of the parameters to be analyzed in the warning range, the corresponding area of ​​the warning range is marked in the parameter monitoring coordinate system and recorded as the warning area; the area in the parameter monitoring coordinate system other than the standard operating area and the warning area is recorded as the buffer analysis area. When the risk analysis curve is completely between the lower limit and the upper limit of standard operation, the parameter to be analyzed is named an irrelevant parameter that can simulate behavior. When some curves in the risk analysis curve are within the warning zone, the risk analysis curves within the warning zone are recorded as the warning judgment curves, and the abscissa corresponding to the leftmost point of the warning judgment curve is marked as the warning time; the parameter to be analyzed is named the warning parameter of simulated behavior; When all regions in the risk analysis curve are not within the warning zone, and some curves are within the buffer analysis zone, the curves in the risk analysis curve that are within the buffer analysis zone are recorded as buffer analysis curves, and the time domain corresponding to the horizontal axis of the buffer analysis curve is recorded as the parameter buffer time domain; the parameter to be analyzed is named the buffer judgment parameter that can simulate behavior.

7. The method according to claim 6, characterized in that, Early warning behavior analysis also includes: Name the parameters to be analyzed corresponding to all parameter monitoring data as irrelevant parameters, warning parameters, or buffer judgment parameters; For the parameters to be analyzed that are named warning parameters: among all the warning times corresponding to the parameters to be analyzed, the parameter with the earliest warning time is recorded as the first warning parameter of the simulated behavior. Based on all the warning times from first to last, all warning parameters are sorted, and the set of the sorted parameters to be analyzed is recorded as the warning order set of the simulated behavior. For the parameter to be analyzed, which is named the buffer judgment parameter: take the warning time of the first warning parameter as the benchmark, mark the warning time of the first warning parameter and the buffer time domain of all parameters of the parameter to be analyzed in the time axis, and record the positional relationship between the warning time and the buffer time domain of all parameters in the time axis as the buffer judgment relationship between the buffer judgment parameter and the simulated behavior. Obtain the first warning parameters, warning order set, and buffer judgment relationship corresponding to the simulated behavior and the security sentry at all sentry monitoring locations.

8. The method according to claim 7, characterized in that, The process of issuing abnormal behavior warnings within the server based on the data monitored by the security sentinel and the warning feature parameters of all simulable behaviors when using a security sentinel to monitor data on the server includes the following sub-steps: When using security sentinels to monitor data on the server, the monitoring data of each security sentinel for all monitorable types is acquired in real time and recorded as real-time monitoring data; For any real-time monitoring data of a safety sentinel A: when the value of any parameter β to be analyzed in the real-time monitoring data is within the warning range of parameter β to be analyzed, and parameter β to be analyzed is any simulated behavior α and the first warning parameter of safety sentinel A, parameter β to be analyzed is recorded as the risk judgment parameter. Let T be the time when the parameter β to be analyzed is recorded as the risk judgment parameter, and let Ω be the data in the time domain of the real-time monitoring data as the risk judgment data. Here, Ω is the time domain consisting of L before T and L after T, and L is the length of the risk analysis time domain of the simulated behavior α.

9. The method according to claim 8, characterized in that, The process of issuing abnormal behavior warnings within the server based on the data monitored by the security sentinel and the warning feature parameters of all simulable behaviors when using a security sentinel to monitor data on the server also includes the following sub-steps: When the risk assessment data simultaneously meets both conditions 1 and 2, a safety warning that can simulate behavior α is sent, with the sentry monitoring location to which safety sentry A belongs as the warning occurrence point. Condition 1 is as follows: In the risk assessment data, when the value of the parameter to be analyzed is within the corresponding warning range, the parameter to be analyzed is marked as a warning assessment parameter. The same parameter to be analyzed can be marked repeatedly. Based on the time when all warning assessment parameters are marked, all warning assessment parameters are sorted from first to last. When the set obtained after sorting is the same as the warning order set corresponding to the simulated behavior α and the safety sentinel A, the risk assessment data is determined to satisfy condition 1.

10. The method according to claim 9, characterized in that, The process of issuing abnormal behavior warnings within the server based on the data monitored by the security sentinel and the warning feature parameters of all simulable behaviors when using a security sentinel to monitor data on the server also includes the following sub-steps: Condition 2 is: For any buffer judgment parameter corresponding to the simulateable behavior α and the security sentinel A: the buffer judgment parameter obtained when analyzing the simulateable behavior α and the security sentinel A in the early warning behavior analysis method and the buffer judgment relationship of the simulateable behavior are denoted as the standard judgment relationship; Based on the early warning behavior analysis method and time T, the buffer judgment relationship corresponding to the buffer judgment parameter in the risk judgment data is obtained and recorded as the risk judgment relationship; When the positional relationship between the warning time and all parameter buffer time domains in the standard judgment relationship is exactly the same as the positional relationship between T and all parameter buffer time domains in the risk judgment relationship, the risk judgment data satisfies condition 2.

Images