Intranet slow horizontal movement detection method and device

Abstract

The application provides an intranet slow horizontal movement detection method and device, the method comprising: collecting multi-dimensional network data, constructing a benchmark directed topology graph, a benchmark path library, a node benchmark entropy value set and a node permission classification table based on the network data, calculating the real-time access entropy value of each node in the network based on a preset rolling time slice, screening out suspected abnormal nodes and corresponding outgoing access paths based on the real-time access entropy value and the node benchmark entropy value set, calculating the single-hop permission span value based on the node permission classification table for the outgoing access path, and verifying the outgoing access path in combination with the benchmark path library to obtain a high-risk cross-level jump path, performing multi-dimensional fusion risk judgment on the high-risk cross-level jump path and executing a hierarchical disposal response according to the judgment result, and simultaneously adjusting the network data in reverse based on the review result of the security administrator.

Description

Technical Field

[0001] This application relates to the field of computer network security technology, and more specifically, to a method and apparatus for detecting slow lateral movement within an intranet. Background Technology

[0002] With the rapid development of network technology, Advanced Persistent Threats (APTs) have become one of the most severe challenges facing the cybersecurity field. APT attacks are characterized by their long duration, high stealth, and strong targeting. Statistics show that lateral movement accounts for more than 80% of the total duration of APT attacks. During this process, attackers typically utilize legitimate protocols such as SMB, WinRM, SSH, and LDAP to make covert jumps within the internal network, making lateral movement attacks extremely stealthy and dangerous.

[0003] Currently, intranet lateral movement detection solutions mainly rely on traditional intrusion detection systems and endpoint detection and response systems. The core technical approaches fall into two categories: one is a feature-based rule-matching scheme: by pre-setting traffic and log characteristics of known attack tools and methods, it matches network traffic and endpoint login events one by one, triggering an alarm when a feature rule is matched. The other is a threshold-based anomaly detection scheme: it collects endpoint login logs and network access session data, and uses fixed time windows to statistically analyze metrics such as the number of failed logins per node, the number of accesses to the target node per unit time, and the number of concurrent connections. When these metrics exceed preset thresholds, an anomaly is identified.

[0004] However, current intranet lateral movement detection solutions heavily rely on time-based thresholds, resulting in clear detection blind spots and making them unsuitable for slow lateral movement attack scenarios. Using single nodes and single sessions as detection units easily misses targeted attacks implemented in stages, leading to a high false negative rate. Applying a uniform judgment standard to all access behaviors results in low alarm value density, impacting the efficiency of operations and maintenance personnel. Furthermore, detection rules and thresholds are mostly manually and statically configured, requiring continuous manual maintenance and parameter tuning, resulting in high operational costs. Summary of the Invention

[0005] In view of this, the purpose of this application is to provide a method and device for detecting slow lateral movement in an intranet. By constructing a baseline directed topology graph, a baseline path library, a node baseline entropy value set, and a node permission hierarchy table for intranet access, it can effectively detect low-frequency, long-cycle slow lateral movement with intervals of several hours or even days, filling detection blind spots and adapting to slow lateral movement attack scenarios, thus improving the slow attack detection capability. By replacing single-point judgment with global path analysis, the false negative rate is significantly reduced. By introducing a node permission level dimension, high-risk path alarms are prioritized, increasing the alarm value density and avoiding the interference of massive low-value alarms on operation and maintenance personnel, thereby improving the efficiency of operation and maintenance personnel. Through security administrator review and feedback, a self-optimizing closed loop is formed, eliminating the need for continuous manual maintenance and parameter tuning, thus reducing operation and maintenance costs.

[0006] In a first aspect, embodiments of this application provide a method for detecting slow lateral movement within an intranet, the method comprising: Collect multi-dimensional network data, and construct a baseline directed topology graph, baseline path library, node baseline entropy value set, and node permission hierarchy table based on the network data; The real-time access entropy value of each node in the entire network is calculated based on a preset rolling time slice. Based on the real-time access entropy value and the node baseline entropy value set, suspected abnormal nodes and their corresponding outbound access paths are screened out. For the outbound access path, the single-hop permission span value is calculated based on the node permission hierarchy table, and the outbound access path is verified in conjunction with the benchmark path library to obtain the high-risk bypass jump path. The high-risk bypass paths are assessed using a multi-dimensional fusion risk assessment, and a tiered response is executed based on the assessment results. Simultaneously, the network data is fine-tuned based on the review results of the security administrator.

[0007] In one possible implementation, the collection of multi-dimensional network data, and the construction of a baseline directed topology graph, a baseline path library, a node baseline entropy value set, and a node permission hierarchy table based on the network data, include: Collect mirrored traffic from all core switches in the network, and connect to the domain controller server and CMDB asset system to extract session information and asset tags. Clean all network data into standardized session records and store them in a time-series database. Based on the standardized session records, a directed topology graph for intranet access is constructed with nodes as vertices and access relationships between nodes as directed edges. The frequency and direction of access between nodes are counted using the first target time as a sliding window to generate a baseline directed topology graph. Based on the aforementioned benchmark directed topology graph, a target path sequence model is used to extract continuous access paths of target length, and the historical occurrence frequency of each continuous access path is counted. Continuous access paths with a historical occurrence frequency higher than a preset threshold are included in the benchmark path library. Calculate the outbound access target distribution entropy value of each node according to the preset time period dimension, and generate a set of node baseline entropy values; Based on the network data, the nodes of the entire network are divided into multiple levels, and a node permission hierarchy table is generated.

[0008] In one possible implementation, the step of calculating the real-time access entropy value of each node in the entire network based on a preset rolling time slice, and filtering out suspected abnormal nodes and their corresponding outbound access paths based on the time-based access entropy value and the node baseline entropy value set, includes: Based on the preset rolling time slice, the outbound access target set of each node is statistically analyzed, and the real-time access entropy value of the current time slice is calculated based on the preset information entropy formula. The relative deviation between the real-time access entropy value and the baseline entropy value of the node of the same date type in the corresponding time period is calculated, and nodes with abnormal entropy values ​​whose deviation exceeds a preset deviation threshold are marked. The proportion of the entropy-abnormal nodes in the access target is verified, and when the proportion of the unfamiliar nodes exceeds the preset node proportion threshold, they are identified as suspected abnormal nodes, and all outbound access paths within the corresponding time slice are exported simultaneously.

[0009] In one possible implementation, the step of calculating a single-hop permission span value based on the node permission hierarchy table for the outbound access path, and verifying the outbound access path in conjunction with the benchmark path library to obtain a high-risk bypass path, includes: The node permission hierarchy table is called to obtain the permission scores of the source node and the destination node in each outbound access path, and the single-hop permission span value is calculated based on the permission scores of the destination node and the source node. The reference path library is called to verify whether the current outbound access path exists in the historical normal path. If the outbound access path is not in the reference path library and the single-hop permission span value is greater than a preset threshold, the jump is marked as a high-risk jump. All high-risk bypass redirection paths are aggregated, a subset of high-risk bypass redirection paths is generated, and quantitative indicators for each high-risk bypass redirection path are attached.

[0010] In one possible implementation, the step of performing a multi-dimensional risk assessment of the high-risk bypass path and executing a tiered response based on the assessment results includes: For each high-risk bypass path, multiple risk quantification indicators are taken, and a comprehensive risk score is calculated by weighting them according to preset weights; Calculate the comprehensive risk score of the high-risk bypass path, determine the corresponding risk level based on the comprehensive risk score, and execute the corresponding graded response.

[0011] In one possible implementation, it also includes: For medium- to high-risk alerts, trace back all access records of the source node within the second target time period; Based on the aforementioned baseline directed topology graph, the complete attack jump path is reconstructed, a visual tracing graph is generated, and the jump information for each hop is marked; wherein, the jump information includes at least time, account, protocol, and risk point.

[0012] In one possible implementation, the risk levels include low risk, medium risk, and high risk; the reverse fine-tuning of the network data based on the security administrator's review results includes: Receive the security administrator's review results for medium- and high-risk alerts, and add the paths marked as false alarms to the normal sample set; The threshold values ​​for the reverse fine-tuning point base entropy, the threshold values ​​for inclusion in the base path library, and the threshold values ​​for determining the span of node permissions.

[0013] Secondly, embodiments of this application also provide an intranet slow lateral movement detection device, the device comprising: The construction module is used to collect multi-dimensional network data and construct a baseline directed topology graph, a baseline path library, a node baseline entropy value set, and a node permission hierarchy table based on the network data. The filtering module is used to calculate the real-time access entropy value of each node in the entire network based on a preset rolling time slice, and to filter out suspected abnormal nodes and their corresponding outbound access paths based on the real-time access entropy value and the node baseline entropy value set. The acquisition module is used to calculate the single-hop permission span value based on the node permission hierarchy table for the outbound access path, and verify the outbound access path in combination with the benchmark path library to obtain the high-risk bypass jump path. The response module is used to perform multi-dimensional risk assessment on the high-risk bypass paths and execute graded response based on the assessment results. At the same time, it can fine-tune the network data based on the review results of the security administrator.

[0014] In one possible implementation, the building module is specifically used for: Collect mirrored traffic from all core switches in the network, and connect to the domain controller server and CMDB asset system to extract session information and asset tags. Clean all network data into standardized session records and store them in a time-series database. Based on the standardized session records, a directed topology graph for intranet access is constructed with nodes as vertices and access relationships between nodes as directed edges. The frequency and direction of access between nodes are counted using the first target time as a sliding window to generate a baseline directed topology graph. Based on the aforementioned benchmark directed topology graph, a target path sequence model is used to extract continuous access paths of target length, and the historical occurrence frequency of each continuous access path is counted. Continuous access paths with a historical occurrence frequency higher than a preset threshold are included in the benchmark path library. Calculate the outbound access target distribution entropy value of each node according to the preset time period dimension, and generate a set of node baseline entropy values; Based on the network data, the nodes of the entire network are divided into multiple levels, and a node permission hierarchy table is generated.

[0015] In one possible implementation, the filtering module is specifically used for: Based on the preset rolling time slice, the outbound access target set of each node is statistically analyzed, and the real-time access entropy value of the current time slice is calculated based on the preset information entropy formula. The relative deviation between the real-time access entropy value and the baseline entropy value of the node of the same date type in the corresponding time period is calculated, and nodes with abnormal entropy values ​​whose deviation exceeds a preset deviation threshold are marked. The proportion of the entropy-abnormal nodes in the access target is verified, and when the proportion of the unfamiliar nodes exceeds the preset node proportion threshold, they are identified as suspected abnormal nodes, and all outbound access paths within the corresponding time slice are exported simultaneously.

[0016] In one possible implementation, the acquisition module is specifically used for: The node permission hierarchy table is called to obtain the permission scores of the source node and the destination node in each outbound access path, and the single-hop permission span value is calculated based on the permission scores of the destination node and the source node. The reference path library is called to verify whether the current outbound access path exists in the historical normal path. If the outbound access path is not in the reference path library and the single-hop permission span value is greater than a preset threshold, the jump is marked as a high-risk jump. All high-risk bypass redirection paths are aggregated, a subset of high-risk bypass redirection paths is generated, and quantitative indicators for each high-risk bypass redirection path are attached.

[0017] In one possible implementation, the response module is specifically used for: For each high-risk bypass path, multiple risk quantification indicators are taken, and a comprehensive risk score is calculated by weighting them according to preset weights; Calculate the comprehensive risk score of the high-risk bypass path, determine the corresponding risk level based on the comprehensive risk score, and execute the corresponding graded response.

[0018] In one possible implementation, the device further includes: The backtracking module is used to backtrack all access records of the source node within the second target time period for medium- and high-risk alarms. The generation module is used to reconstruct the complete attack jump path based on the baseline directed topology graph, generate a visual tracing graph, and mark the jump information for each hop; wherein, the jump information includes at least time, account, protocol and risk point.

[0019] In one possible implementation, the risk levels include low risk, medium risk, and high risk; the response module is specifically used for: Receive the security administrator's review results for medium- and high-risk alerts, and add the paths marked as false alarms to the normal sample set; The threshold values ​​for the reverse fine-tuning point base entropy, the threshold values ​​for inclusion in the base path library, and the threshold values ​​for determining the span of node permissions.

[0020] Thirdly, embodiments of this application provide an electronic device, including: a processor, a storage medium, and a bus. The storage medium stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the storage medium via the bus, and the processor executes the machine-readable instructions to perform the steps of the intranet slow lateral movement detection method as described in any of the first aspects.

[0021] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the intranet slow lateral movement detection method described in any one of the first aspects.

[0022] This application provides a method and apparatus for detecting slow lateral movement in an intranet. It collects multi-dimensional network data and constructs a baseline directed topology graph, a baseline path library, a node baseline entropy value set, and a node permission hierarchy table based on the network data. It calculates the real-time access entropy value of each node in the entire network based on a preset rolling time slice. Based on the real-time access entropy value and the node baseline entropy value set, it filters out suspected abnormal nodes and their corresponding outbound access paths. For outbound access paths, it calculates the single-hop permission span value based on the node permission hierarchy table and verifies the outbound access path in conjunction with the baseline path library to obtain high-risk bypass paths. It performs multi-dimensional risk assessment on high-risk bypass paths and executes graded handling responses based on the assessment results. Simultaneously, it fine-tunes the network data based on the review results of the security administrator. This application constructs a baseline directed topology graph, baseline path library, node baseline entropy value set, and node permission hierarchy table for intranet access. It effectively detects low-frequency, long-cycle slow lateral movement with intervals of several hours or even days, filling detection blind spots and adapting to slow lateral movement attack scenarios, thus improving slow attack detection capabilities. By replacing single-point judgment with global path analysis, it significantly reduces the false negative rate. Introducing a node permission level dimension prioritizes high-risk path alerts, increasing alert value density and avoiding the interference of massive low-value alerts on operations and maintenance personnel, thereby improving their handling efficiency. Through security administrator review and feedback, a self-optimizing closed loop is formed, eliminating the need for continuous manual maintenance and parameter tuning, thus reducing operational costs.

[0023] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0024] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 This is a flowchart of an intranet slow lateral movement detection method provided according to an embodiment of this application; Figure 2 This is a schematic diagram of the internal network slow lateral movement detection device provided in the embodiments of this application; Figure 3 This is a schematic diagram of the structure of an electronic device provided according to an embodiment of this application. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the accompanying drawings in this application are for illustrative and descriptive purposes only and are not intended to limit the scope of protection of this application. Furthermore, it should be understood that the schematic drawings are not drawn to scale. The flowcharts used in this application illustrate operations implemented according to some embodiments of this application. It should be understood that the operations in the flowcharts may not be implemented in sequence, and steps without logical contextual relationships may be reversed or implemented simultaneously. In addition, those skilled in the art, guided by the content of this application, may add one or more other operations to the flowcharts, or remove one or more operations from the flowcharts.

[0027] Furthermore, the described embodiments are merely some, not all, of the embodiments of this application. The components of the embodiments of this application described and illustrated herein can typically be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0028] It should be noted that the term "comprising" will be used in the embodiments of this application to indicate the presence of the features declared thereafter, but does not exclude the addition of other features.

[0029] Given the rapid development of network technology, Advanced Persistent Threats (APTs) have become one of the most serious challenges facing the cybersecurity field. APT attacks are characterized by their long duration, high stealth, and strong targeting. Statistics show that lateral movement accounts for over 80% of the total duration of APT attacks. During this process, attackers typically utilize legitimate protocols such as SMB, WinRM, SSH, and LDAP to make covert jumps within the internal network, making lateral movement attacks extremely stealthy and dangerous.

[0030] Currently, intranet lateral movement detection solutions mainly rely on traditional intrusion detection systems and endpoint detection and response systems. The core technical approaches fall into two categories: one is a feature-based rule-matching scheme: by pre-setting traffic and log characteristics of known attack tools and methods, it matches network traffic and endpoint login events one by one, triggering an alarm when a feature rule is matched. The other is a threshold-based anomaly detection scheme: it collects endpoint login logs and network access session data, and uses fixed time windows to statistically analyze metrics such as the number of failed logins per node, the number of accesses to the target node per unit time, and the number of concurrent connections. When these metrics exceed preset thresholds, an anomaly is identified.

[0031] However, current intranet lateral movement detection solutions heavily rely on time-based thresholds, resulting in clear detection blind spots and making them unsuitable for slow lateral movement attack scenarios. Using single nodes and single sessions as detection units easily misses targeted attacks implemented in stages, leading to a high false negative rate. Applying a uniform judgment standard to all access behaviors results in low alarm value density, impacting the efficiency of operations and maintenance personnel. Furthermore, detection rules and thresholds are mostly manually and statically configured, requiring continuous manual maintenance and parameter tuning, resulting in high operational costs.

[0032] To address this issue, this application provides a method and apparatus for detecting slow lateral movement within an intranet. By constructing a baseline directed topology graph, a baseline path library, a node baseline entropy value set, and a node permission hierarchy table for intranet access, it effectively detects low-frequency, long-cycle slow lateral movement with intervals of several hours or even days, filling detection blind spots and adapting to slow lateral movement attack scenarios, thus improving slow attack detection capabilities. Replacing single-point judgment with global path analysis significantly reduces the false negative rate. Introducing a node permission level dimension prioritizes pushing high-risk path alerts, increasing alert value density and avoiding the interference of massive low-value alerts on maintenance personnel, thereby improving their handling efficiency. A self-optimizing closed loop is formed through security administrator review and feedback, eliminating the need for continuous manual maintenance and parameter tuning, thus reducing maintenance costs.

[0033] Figure 1 This is a flowchart of a method for detecting slow lateral movement in an intranet according to an embodiment of this application. Figure 1 As shown in the embodiment of this application, the method for detecting slow lateral movement in an intranet may specifically include: S101. Collect multi-dimensional network data, and construct a baseline directed topology graph, baseline path library, node baseline entropy value set, and node permission hierarchy table based on the network data.

[0034] S102. Calculate the real-time access entropy value of each node in the entire network based on the preset rolling time slice. Based on the real-time access entropy value and the node baseline entropy value set, filter out suspected abnormal nodes and their corresponding outbound access paths.

[0035] S103. For outbound access paths, calculate the single-hop permission span value based on the node permission hierarchy table, and verify the outbound access path in conjunction with the benchmark path library to obtain high-risk bypass jump paths.

[0036] S104. Perform multi-dimensional risk assessment on high-risk bypass paths and implement graded response measures based on the assessment results. At the same time, fine-tune network data based on the review results of the security administrator.

[0037] The aforementioned method for detecting slow lateral movement within an intranet effectively detects low-frequency, long-cycle slow lateral movement with intervals of several hours or even days by constructing a baseline directed topology graph, baseline path library, node baseline entropy value set, and node permission hierarchy table, regardless of the number of accesses per unit time. This fills detection blind spots, adapts to slow lateral movement attack scenarios, and improves slow attack detection capabilities. Replacing single-point judgment with global path analysis significantly reduces the false negative rate. Introducing a node permission level dimension prioritizes high-risk path alerts, increasing alert value density and preventing massive low-value alerts from interfering with operations and maintenance personnel, thus improving their handling efficiency. Furthermore, the security administrator's review and feedback form a self-optimizing closed loop, eliminating the need for continuous manual maintenance and parameter tuning, thereby reducing operational costs.

[0038] The exemplary steps described above in the embodiments of this application are illustrated below with specific examples: S101 collects multi-dimensional network data and constructs a baseline directed topology graph, baseline path library, node baseline entropy value set, and node permission hierarchy table based on the network data.

[0039] In this embodiment of the application, a baseline directed topology graph, a baseline path library, a node baseline entropy value set, and a node permission hierarchy table are constructed based on the collected multi-dimensional network data for subsequent processing.

[0040] In some implementations, mirrored traffic from all core switches across the network is collected. Simultaneously, the system connects to the domain controller server and the CMDB asset system to extract session information and asset tags. All network data is then uniformly cleaned into standardized session records and stored in a time-series database. Based on these standardized session records, a directed topology graph of the intranet access is constructed, with nodes as vertices and access relationships between nodes as directed edges. The frequency and direction of access between nodes are statistically analyzed using the first target time as a sliding window to generate a baseline directed topology graph. Based on this baseline directed topology graph, a target path sequence model is used to extract continuous access paths of target length. The historical frequency of each continuous access path is statistically analyzed, and continuous access paths with historical frequencies exceeding a preset threshold are included in the baseline path library. The outbound access target distribution entropy value of each node is calculated according to a preset time period dimension to generate a node baseline entropy value set. Finally, combined with network data, all nodes in the network are divided into multiple levels, generating a node permission hierarchy table.

[0041] The session information includes at least the internal network node IP, hostname, associated account, access direction, access protocol, and timestamp; the asset tag includes at least the asset business domain and data sensitivity tag; and the baseline directed topology graph represents the underlying reference for normal access relationships across the entire network.

[0042] Specifically, for example, bypassing the collection of mirrored traffic from the core switches across the entire network, while simultaneously connecting to the domain controller server login logs and the CMDB asset system, session information such as intranet node IPs, hostnames, associated accounts, access directions, access protocols, and timestamps, as well as asset business domains and data sensitivity tags, is extracted and uniformly cleaned into standardized session records and stored in a time-series database. Using nodes as vertices and the access relationships between nodes as directed edges, a directed topology graph of intranet access is constructed. Using a 30-day (first target time) sliding window, the access frequency and direction between all nodes are statistically analyzed. After removing single, occasional accesses, a baseline directed topology graph is generated as the underlying reference for normal access relationships across the entire network. Based on the baseline directed topology graph, a 3-gram path sequence algorithm (target path sequence model) is used to extract all continuous access paths with a length of 2-5 hops (target length). The historical frequency of each path is statistically analyzed, and paths with a frequency higher than the 95th percentile threshold (preset frequency threshold) are included in the baseline path library for subsequent determination of whether real-time access paths fall within the scope of normal operation and maintenance.

[0043] Continuing, based on weekday / non-weekday and working / non-working time periods, the outbound access target distribution entropy value of each node is calculated, generating a node baseline entropy value set as a benchmark for subsequent entropy deviation determination. Combining asset business domains and data sensitivity tags, all network nodes are divided into three levels: core data nodes, business service nodes, and office terminal nodes, generating a node permission hierarchy table to provide a scoring benchmark for subsequent permission span calculations.

[0044] S102: Calculate the real-time access entropy value of each node in the entire network based on the preset rolling time slice. Based on the real-time access entropy value and the node baseline entropy value set, filter out suspected abnormal nodes and their corresponding outbound access paths.

[0045] In this embodiment of the application, the real-time access entropy value of each node in the entire network is calculated based on the rolling time slice. Based on the real-time access entropy value and the node baseline entropy value set obtained in step S101, suspected abnormal nodes and outbound access paths are screened out for subsequent processing.

[0046] In some implementations, the outbound access target set of each node is statistically analyzed based on a preset rolling time slice, and the real-time access entropy value of the current time slice is calculated based on a preset information entropy formula. The relative deviation between the real-time access entropy value and the baseline entropy value of the node of the same date type in the corresponding time period is calculated, and nodes with abnormal entropy values ​​whose deviation exceeds a preset deviation threshold are marked. The proportion of unfamiliar nodes among the access targets of nodes with abnormal entropy values ​​is checked, and when the proportion of unfamiliar nodes exceeds a preset node proportion threshold, they are identified as suspected abnormal nodes, and all outbound access paths in the corresponding time slice are exported simultaneously.

[0047] Specifically, for example, using a 1-hour rolling time slice, the outbound access target distribution of each node is statistically analyzed. The real-time access entropy value for the current time slice is calculated based on the information entropy formula. A higher real-time access entropy value indicates a higher dispersion of the node's access targets, which better matches the behavioral characteristics of an attacker's lateral probing. The relative deviation between the real-time access entropy value and the baseline entropy value of nodes of the same time period and date type obtained in the previous steps is calculated. When the deviation exceeds 50% (a preset deviation threshold), the node is initially marked as an entropy value anomalous node. For the initially marked entropy value anomalous nodes, the proportion of unfamiliar nodes in their access targets is further verified. If the proportion of unfamiliar nodes exceeds 60% (a preset node proportion threshold), they are officially included in the suspected anomalous node set, and all outbound access paths within the corresponding time slice are simultaneously exported.

[0048] S103. For outbound access paths, calculate the single-hop permission span value based on the node permission hierarchy table, and verify the outbound access path in conjunction with the benchmark path library to obtain high-risk bypass jump paths.

[0049] In this embodiment of the application, for the outbound access path obtained in step S102, the single-hop permission span value is calculated based on the node permission hierarchy table obtained in step S101, and the outbound access path is verified in combination with the baseline path library obtained in step S101 to obtain the high-risk bypass jump path for subsequent processing.

[0050] In some implementations, the node permission hierarchy table is invoked to obtain the permission scores of the source and destination nodes in each outbound access path. A single-hop permission span value is calculated based on the destination node permission score and the source node permission score. A baseline path library is invoked to verify whether the current outbound access path exists in the historical normal paths. If the outbound access path is not in the baseline path library and the single-hop permission span value is greater than a preset threshold, the jump is marked as a high-risk bypass jump. All high-risk bypass jump paths are summarized to generate a subset of high-risk bypass jump paths, along with quantitative indicators for each high-risk bypass jump path. These quantitative indicators include at least three items: entropy deviation, permission span value, and path anomaly marker.

[0051] Specifically, for each suspected abnormal access path, the permission scores of the source and destination nodes are obtained from the node permission hierarchy table, and the single-hop permission span value is calculated: Permission span value = Destination node permission score - Source node permission score. The baseline path library is called to verify if the access path exists in the historical normal paths. If the path is not in the baseline path library and the permission span value is ≥4 points, the jump is marked as a high-risk bypass jump. For access paths with multiple consecutive hops, the permission span value of each hop is accumulated to obtain the cumulative permission span of the entire path. The higher the cumulative span, the stronger the attack intent of the path converging towards core assets. All high-risk bypass jump paths are summarized to generate a subset of high-risk paths, simultaneously including three quantitative indicators for each path: entropy deviation, permission span value, and path anomaly marking.

[0052] S104 performs multi-dimensional risk assessment on high-risk bypass paths and executes tiered response measures based on the assessment results. At the same time, it fine-tunes network data based on the review results of the security administrator.

[0053] In this embodiment of the application, the high-risk bypass path obtained in step S103 is subjected to multi-dimensional risk assessment, and a graded response is carried out based on the assessment results. At the same time, the network data is fine-tuned in reverse based on the review results of the security administrator.

[0054] Optionally, when performing multi-dimensional risk assessment on high-risk bypass paths and implementing tiered response measures based on the assessment results, for each high-risk bypass path, multiple risk quantification indicators are taken and weighted according to preset weights to calculate a comprehensive risk score; the comprehensive risk score of the high-risk bypass path is calculated, and the corresponding risk level is determined based on the comprehensive risk score and the corresponding tiered response measures are implemented.

[0055] Among them, the risk quantification indicators include at least the entropy deviation, path anomaly, and permission span normalization value; the path anomaly is determined by whether the path is taken from the benchmark path library, and the permission span normalization value is the percentage of the actual span value to the maximum span value; the risk level includes low risk, medium risk, and high risk.

[0056] Specifically, for example, for each high-risk path, three dimensions of indicators are taken: entropy deviation, path anomaly, and permission span value. The comprehensive risk score is calculated by weighting these three dimensions according to preset weights: Comprehensive Risk Score = Entropy Deviation × 0.3 + Path Anomaly × 0.3 + Permission Span Normalized Value × 0.4. Among these, the path anomaly value is determined by whether the path is in the baseline path library; it is 0 if it is in the library and 100 if it is not. The permission span normalized value is the percentage of the actual span value to the maximum span value.

[0057] In the tiered response, the risk level can be divided into three levels based on the comprehensive risk score: 0-30 points: low risk, only logs are retained; 30-0 points: medium risk, alarms are pushed to security operations personnel; 70 points and above: high risk, triggering emergency response, linking the firewall to block the corresponding session and freeze the associated account.

[0058] Optionally, when fine-tuning network data based on the security administrator's review results, the security administrator's review results for medium- and high-risk alarms are received, and paths marked as false alarms are added to the normal sample set; the threshold values ​​of the reverse fine-tuning point baseline entropy value, the baseline path library inclusion threshold, and the node permission span determination threshold are also included.

[0059] Specifically, the system receives the security administrator's review results of the alarms, adds the false alarm paths and the corresponding node data on the paths to the normal sample set, and fine-tunes the corresponding baseline entropy threshold, baseline path library inclusion threshold, and permission span determination threshold (corresponding to the node baseline entropy set, baseline path library, and node permission hierarchy table) when collecting network data, thereby achieving dynamic model iteration.

[0060] The intranet slow lateral movement detection method provided in this application collects multi-dimensional network data, constructs a baseline directed topology graph, a baseline path library, a node baseline entropy value set, and a node permission hierarchy table based on the network data, calculates the real-time access entropy value of each node in the entire network based on a preset rolling time slice, and filters out suspected abnormal nodes and their corresponding outbound access paths based on the real-time access entropy value and the node baseline entropy value set. For outbound access paths, the single-hop permission span value is calculated based on the node permission hierarchy table, and the outbound access path is verified in conjunction with the baseline path library to obtain high-risk bypass jump paths. The high-risk bypass jump paths are subject to multi-dimensional risk assessment and graded handling response based on the assessment results. At the same time, the network data is fine-tuned in reverse based on the review results of the security administrator. This application's method for detecting slow lateral movement within an intranet constructs a baseline directed topology graph, a baseline path library, a node baseline entropy value set, and a node permission hierarchy table. It is independent of the number of accesses per unit time and can effectively detect low-frequency, long-cycle slow lateral movement occurring at intervals of several hours or even days, filling detection blind spots. It is adaptable to slow lateral movement attack scenarios and improves slow attack detection capabilities. By replacing single-point judgment with global path analysis, the false negative rate is significantly reduced. The introduction of a node permission level dimension prioritizes high-risk path alerts, increasing alert value density and preventing a large number of low-value alerts from interfering with operations and maintenance personnel, thus improving their handling efficiency. Furthermore, a self-optimizing closed loop is formed through security administrator review and feedback, eliminating the need for continuous manual maintenance and parameter tuning, thereby reducing operational costs.

[0061] Furthermore, for medium- and high-risk alerts, all access records of the source node within the second target time period are traced back; the complete attack jump path is reconstructed based on the baseline directed topology graph, generating a visual tracing graph and marking the jump information for each hop. The jump information includes at least the time, account, protocol, and risk point.

[0062] Specifically, for medium- and high-risk alerts, the system automatically traces back all access records of the source node over the past 7 days, reconstructs the complete attack jump path based on the baseline directed topology graph, generates a visual source tracing graph, and marks the time, account, protocol, and risk point of each hop.

[0063] Figure 2 This is a schematic diagram of the internal network slow lateral movement detection device provided in the embodiments of this application; as shown below. Figure 2 As shown, the intranet slow lateral movement detection device 200 of this application embodiment may specifically include: Module 201 is used to collect multi-dimensional network data and construct a baseline directed topology graph, a baseline path library, a node baseline entropy value set, and a node permission hierarchy table based on the network data. The filtering module 202 is used to calculate the real-time access entropy value of each node in the entire network based on a preset rolling time slice, and to filter out suspected abnormal nodes and their corresponding outbound access paths based on the real-time access entropy value and the node baseline entropy value set. The acquisition module 203 is used to calculate the single-hop permission span value based on the node permission hierarchy table for the outbound access path, and verify the outbound access path in combination with the benchmark path library to obtain the high-risk bypass jump path. The response module 204 is used to perform multi-dimensional risk assessment on the high-risk bypass path and execute graded handling response based on the assessment results. At the same time, it fine-tunes the network data based on the review results of the security administrator.

[0064] In one possible implementation, the building module is specifically used for: Collect mirrored traffic from all core switches in the network, and connect to the domain controller server and CMDB asset system to extract session information and asset tags. Clean all network data into standardized session records and store them in a time-series database. Based on standardized session records, a directed topology graph for intranet access is constructed with nodes as vertices and access relationships between nodes as directed edges. The frequency and direction of access between nodes are counted using the first target time as a sliding window to generate a baseline directed topology graph. Based on the baseline directed topology graph, the target path sequence model is used to extract continuous access paths of target length, and the historical occurrence frequency of each continuous access path is counted. Continuous access paths with a historical occurrence frequency higher than a preset threshold are included in the baseline path library. Calculate the outbound access target distribution entropy value of each node according to the preset time period dimension, and generate a set of node baseline entropy values; By combining network data, the nodes of the entire network are divided into multiple levels, and a node permission hierarchy table is generated.

[0065] In one possible implementation, the filtering module is specifically used for: Based on the preset rolling time slice, the outbound access target set of each node is statistically analyzed, and the real-time access entropy value of the current time slice is calculated based on the preset information entropy formula. The relative deviation between the real-time access entropy value and the baseline entropy value of the same date type in the corresponding time period is calculated, and nodes with abnormal entropy values ​​whose deviation exceeds the preset deviation threshold are marked. Verify the proportion of unfamiliar nodes with abnormal entropy values ​​in the access target, and identify suspected abnormal nodes when the proportion of unfamiliar nodes exceeds the preset node proportion threshold, and simultaneously export all outbound access paths within the corresponding time slice.

[0066] In one possible implementation, the acquisition module is specifically used for: The node permission hierarchy table is called to obtain the permission scores of the source node and the destination node in each outbound access path. The single-hop permission span value is calculated based on the permission scores of the destination node and the source node. The system calls the baseline path library to verify whether the current outbound access path exists in the historical normal paths. If the outbound access path is not in the baseline path library and the single-hop permission span value is greater than the preset threshold, the jump is marked as a high-risk jump. All high-risk bypass redirection paths are aggregated, a subset of high-risk bypass redirection paths is generated, and quantitative indicators for each high-risk bypass redirection path are attached.

[0067] In one possible implementation, the response module is specifically used for: For each high-risk bypass path, multiple risk quantification indicators are taken, and a comprehensive risk score is calculated by weighting them according to preset weights; Calculate the comprehensive risk score of high-risk bypass paths, determine the corresponding risk level based on the comprehensive risk score, and execute the corresponding graded response.

[0068] In one possible implementation, the apparatus further includes: The backtracking module is used to backtrack all access records of the source node within the second target time period for medium- and high-risk alarms. The generation module is used to reconstruct the complete attack jump path based on the baseline directed topology graph, generate a visual tracing graph, and mark the jump information for each hop; the jump information includes at least time, account, protocol, and risk point.

[0069] In one possible implementation, the risk levels include low risk, medium risk, and high risk; the response module is specifically used for: Receive the security administrator's review results for medium- and high-risk alerts, and add the paths marked as false alarms to the normal sample set; The threshold values ​​for the reverse fine-tuning point base entropy, the threshold values ​​for inclusion in the base path library, and the threshold values ​​for determining the span of node permissions.

[0070] The intranet slow lateral movement detection device provided in this application collects multi-dimensional network data and constructs a baseline directed topology graph, a baseline path library, a node baseline entropy value set, and a node permission hierarchy table based on the network data. It calculates the real-time access entropy value of each node in the entire network based on a preset rolling time slice. Based on the real-time access entropy value and the node baseline entropy value set, it filters out suspected abnormal nodes and their corresponding outbound access paths. For outbound access paths, it calculates the single-hop permission span value based on the node permission hierarchy table and verifies the outbound access path in conjunction with the baseline path library to obtain high-risk bypass jump paths. It performs multi-dimensional risk assessment on high-risk bypass jump paths and executes graded handling responses based on the assessment results. Simultaneously, it fine-tunes the network data based on the review results of the security administrator. The intranet slow lateral movement detection device of this application constructs a baseline directed topology graph, baseline path library, node baseline entropy value set, and node permission hierarchy table for intranet access. It is independent of the number of accesses per unit time and can effectively detect low-frequency, long-cycle slow lateral movement with intervals of several hours or even days, filling detection blind spots. It can adapt to slow lateral movement attack scenarios and improve slow attack detection capabilities. By replacing single-point judgment with global path analysis, it significantly reduces the false negative rate. Introducing a node permission level dimension prioritizes pushing high-risk path alarms, increasing alarm value density and avoiding the interference of massive low-value alarms on maintenance personnel, thus improving their handling efficiency. Through security administrator review and feedback, a self-optimizing closed loop is formed, eliminating the need for continuous manual maintenance and parameter tuning, thereby reducing maintenance costs.

[0071] like Figure 3 As shown in the embodiment of this application, an electronic device 300 includes a processor 301, a memory 302, and a bus. The memory 302 stores machine-readable instructions that can be executed by the processor 301. When the electronic device is running, the processor 301 communicates with the memory 302 via the bus. The processor 301 executes the machine-readable instructions to perform the steps of the above-described intranet slow lateral movement detection method.

[0072] Specifically, the memory 302 and processor 301 mentioned above can be general-purpose memory and processor, without any specific limitations. When the processor 301 runs the computer program stored in the memory 302, it can execute the above-mentioned intranet slow lateral movement detection method.

[0073] Corresponding to the above-described method for detecting slow lateral movement in an intranet, this application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the above-described method for detecting slow lateral movement in an intranet.

[0074] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems and devices described above can be referred to the corresponding processes in the method embodiments, and will not be repeated here. In the several embodiments provided in this application, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed mutual coupling or direct coupling or communication connection can be through some communication interfaces; the indirect coupling or communication connection of devices or modules can be electrical, mechanical, or other forms.

[0075] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0076] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0077] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the deployment methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0078] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for detecting slow lateral movement in an intranet, characterized in that, The method includes: Collect multi-dimensional network data, and construct a baseline directed topology graph, baseline path library, node baseline entropy value set, and node permission hierarchy table based on the network data; The real-time access entropy value of each node in the entire network is calculated based on a preset rolling time slice. Based on the real-time access entropy value and the node baseline entropy value set, suspected abnormal nodes and their corresponding outbound access paths are screened out. For the outbound access path, the single-hop permission span value is calculated based on the node permission hierarchy table, and the outbound access path is verified in conjunction with the benchmark path library to obtain the high-risk bypass jump path. The high-risk bypass paths are assessed using a multi-dimensional fusion risk assessment, and a tiered response is executed based on the assessment results. Simultaneously, the network data is fine-tuned based on the review results of the security administrator.

2. The method according to claim 1, characterized in that, The collection of multi-dimensional network data, based on which a baseline directed topology graph for intranet access, a baseline path library, a node baseline entropy value set, and a node permission hierarchy table are constructed, includes: Collect mirrored traffic from all core switches in the network, and connect to the domain controller server and CMDB asset system to extract session information and asset tags. Clean all network data into standardized session records and store them in a time-series database. Based on the standardized session records, a directed topology graph for intranet access is constructed with nodes as vertices and access relationships between nodes as directed edges. The frequency and direction of access between nodes are counted using the first target time as a sliding window to generate a baseline directed topology graph. Based on the aforementioned benchmark directed topology graph, a target path sequence model is used to extract continuous access paths of target length, and the historical occurrence frequency of each continuous access path is counted. Continuous access paths with a historical occurrence frequency higher than a preset threshold are included in the benchmark path library. Calculate the outbound access target distribution entropy value of each node according to the preset time period dimension, and generate a set of node baseline entropy values; Based on the network data, the nodes of the entire network are divided into multiple levels, and a node permission hierarchy table is generated.

3. The method according to claim 1, characterized in that, The process involves calculating the real-time access entropy value of each node in the entire network based on a preset rolling time slice. Based on the real-time access entropy value and the node baseline entropy value set, suspected abnormal nodes and their corresponding outbound access paths are selected, including: Based on the preset rolling time slice, the outbound access target set of each node is statistically analyzed, and the real-time access entropy value of the current time slice is calculated based on the preset information entropy formula. The relative deviation between the real-time access entropy value and the baseline entropy value of the node of the same date type in the corresponding time period is calculated, and nodes with abnormal entropy values ​​whose deviation exceeds a preset deviation threshold are marked. The proportion of the entropy-abnormal nodes in the access target is verified, and when the proportion of the unfamiliar nodes exceeds the preset node proportion threshold, they are identified as suspected abnormal nodes, and all outbound access paths within the corresponding time slice are exported simultaneously.

4. The method according to claim 1, characterized in that, For the outbound access path, the single-hop permission span value is calculated based on the node permission hierarchy table, and the outbound access path is verified in conjunction with the benchmark path library to obtain high-risk bypass redirection paths, including: The node permission hierarchy table is called to obtain the permission scores of the source node and the destination node in each outbound access path, and the single-hop permission span value is calculated based on the permission scores of the destination node and the source node. The reference path library is called to verify whether the current outbound access path exists in the historical normal path. If the outbound access path is not in the reference path library and the single-hop permission span value is greater than a preset threshold, the jump is marked as a high-risk jump. All high-risk bypass redirection paths are aggregated, a subset of high-risk bypass redirection paths is generated, and quantitative indicators for each high-risk bypass redirection path are attached.

5. The method according to claim 1, characterized in that, The process of performing multi-dimensional risk assessment on the high-risk bypass paths and implementing tiered response measures based on the assessment results includes: For each high-risk bypass path, multiple risk quantification indicators are taken, and a comprehensive risk score is calculated by weighting them according to preset weights; Calculate the comprehensive risk score of the high-risk bypass path, determine the corresponding risk level based on the comprehensive risk score, and execute the corresponding graded response.

6. The method according to claim 1, characterized in that, Also includes: For medium- to high-risk alerts, trace back all access records of the source node within the second target time period; Based on the aforementioned baseline directed topology graph, the complete attack jump path is reconstructed, a visual tracing graph is generated, and the jump information for each hop is marked; wherein, the jump information includes at least time, account, protocol, and risk point.

7. The method according to claim 5, characterized in that, The risk levels include low risk, medium risk, and high risk; the reverse fine-tuning of the network data based on the security administrator's review results includes: Receive the security administrator's review results for medium- and high-risk alerts, and add the paths marked as false alarms to the normal sample set; The threshold values ​​for the reverse fine-tuning point base entropy, the threshold values ​​for inclusion in the base path library, and the threshold values ​​for determining the span of node permissions.

8. A device for detecting slow lateral movement in an intranet, characterized in that, The device includes: The construction module is used to collect multi-dimensional network data and construct a baseline directed topology graph, a baseline path library, a node baseline entropy value set, and a node permission hierarchy table based on the network data. The filtering module is used to calculate the real-time access entropy value of each node in the entire network based on a preset rolling time slice, and to filter out suspected abnormal nodes and their corresponding outbound access paths based on the real-time access entropy value and the node baseline entropy value set. The acquisition module is used to calculate the single-hop permission span value based on the node permission hierarchy table for the outbound access path, and verify the outbound access path in combination with the benchmark path library to obtain the high-risk bypass jump path. The response module is used to perform multi-dimensional risk assessment on the high-risk bypass paths and execute graded response based on the assessment results. At the same time, it can fine-tune the network data based on the review results of the security administrator.

9. An electronic device, characterized in that, include: The device includes a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, the steps of the intranet slow lateral movement detection method as described in any one of claims 1 to 7 are performed.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the steps of the intranet slow lateral movement detection method as described in any one of claims 1 to 7.

Images