Invention content
In view of the above technical problems, technical solutions according to the invention utilize the thought of group's portrait, and then are carried for user
For a kind of appreciable label for labelling method for threatening vector, and then find the strong correlating event in mass data source.
The present invention realizes with the following method:A kind of portrait method for Security Object based on vector mark, packet
It includes:
Analysis data source simultaneously extracts metadata;
Metadata is extracted into row vector based on preset rules, the vector of extraction is referred to label;
The label being labeled in metadata is corresponded in main body, object and behavior, and the collection of metadata to having marked label
Carry out statistical counting;
It is based on statistical counting as a result, it has been found that High relevancy between label, and then to the corresponding main body of respective labels, object and row
To carry out group's division;
The result divided according to group and the label for having High relevancy generate each group's description information;
Wherein, the metadata refers to the Expressive Features for characterize data source.
Further, the data source includes:Binary file, network message sequence, dynamic apis monitored results.
Further, the preset rules include:Producer's rule and User Defined rule.
Further, further include:Each metadata can be by one or more than one label for labelling.
Further, further include:The result that group is divided becomes statistics again as new main body, object or behavior
The basis of counting.
Following system may be used to realize in the present invention:A kind of portrait system for Security Object based on vector mark
System, including:
Metadata extraction module, for analyzing data source and extracting metadata;
Vector analysis module, for based on preset rules to metadata into row vector extract, with label come refer to extraction to
Amount;
Statistical analysis module, for the label being labeled in metadata to be corresponded to main body, object and behavior, and to having marked
The collection of metadata of label carries out statistical counting;
Group's division module is used for the output based on the statistical analysis module as a result, it has been found that High relevancy between label, in turn
Group's division is carried out to the corresponding main body of respective labels, object and behavior;
State description module, result for being divided according to group and the label for having High relevancy generate each group's description letter
Breath;
Wherein, the metadata refers to the Expressive Features for characterize data source.
Further, the data source includes:Binary file, network message sequence, dynamic apis monitored results.
Further, the preset rules include:Producer's rule and User Defined rule.
Further, further include:Each metadata can be by one or more than one label for labelling.
Further, further include:The result that group divides is fed back into the system as new main body, object or behavior
It counts in analysis module.
To sum up, the present invention provides a kind of portrait method and system for Security Object based on vector mark, by dividing
Analysis data source extracts metadata in turn, and based on the corresponding vector of preset rules extraction metadata, and can be referred to using label
Generation displaying, it is for statistical analysis to the collection of metadata for having marked label, and then find the High relevancy between label, it is finally completed
Group divides.Technical solution provided by the present invention can provide a kind of appreciable label for labelling side for threatening vector to the user
Method, and then find the strong correlating event in mass data source.
Specific implementation mode
The present invention gives it is a kind of based on vector mark the portrait method and system embodiment for Security Object, in order to
So that those skilled in the art is more fully understood the technical solution in the embodiment of the present invention, and makes the above-mentioned purpose of the present invention, spy
Advantage of seeking peace can be more obvious and easy to understand, is described in further detail below in conjunction with the accompanying drawings to technical solution in the present invention:
Present invention firstly provides a kind of portrait embodiments of the method for Security Object based on vector mark, as shown in Figure 1,
Including:
S101:Analysis data source simultaneously extracts metadata;Wherein, the data source includes but not limited to:Binary file, network report
Literary sequence, dynamic apis monitored results etc.;Wherein, the metadata refers to the Expressive Features for characterize data source, such as:
The metadata of analysis for network message sequence, extraction includes:The five-tuples information such as source IP, destination IP.
Wherein, the metadata that the binary file is extracted can specifically include:Binary executable it is potential
The network access informations such as IP address, domain name, the URL that can be extracted in ability, binary file, digital signature information etc..
S102:Metadata is extracted into row vector based on preset rules, the vector of extraction is referred to label;Wherein,
The preset rules include:Producer's rule and User Defined rule.Each metadata can be by one or more than one
Label for labelling.For any label, each metadata may be marked, it is also possible to be not marked, but there is no centres
State.
Wherein, vector of the present invention is equivalent to the combination of multiple any amounts, a kind of each corresponding generation of label of vector
Rule.Producer's rule includes but not limited to:Weak passwurd, with vulnerable software, by threaten attack etc.;The user is certainly
Set pattern then needs to generate according to user, can include but is not limited to:Connect whether initiator or target are critical asset etc..
S103:The label being labeled in metadata is corresponded in main body, object and behavior, and the member to having marked label
Data acquisition system carries out statistical counting;
Wherein, described to correspond to the label being labeled in metadata in main body, object and behavior, specifically, each metadata sheet
Corresponding main body, object and behavior will be expressed or be implied to body, such as:For every metadata of network message sequence, source IP and
Destination IP is exactly two main bodys;For HTTP downloads file, the both sides of transmission are two main bodys, and file of transmission itself is
Object, and HTTP downloads action is behavior;For being detached from for the single file of context, file itself is main body.It will mark
Label in metadata is beaten in main body, object or behavior.For single metadata, main body, object and the letter of behavior
It ceases and is generally assured that in S101, meanwhile, the main body, object and the information of behavior can also be based on group and divide(It draws
Picture)Result obtain.
Such as:Metadata is extracted into row vector for based on producer's rule, and marks label, and metadata will be labeled in
On label correspond in main body, object and behavior, then may finally show as:Main body has weak passwurd;Object is with weakness
Software;Or two main body transmit with vulnerable software etc..
Wherein, the collection of metadata to having marked label carries out statistical counting, specially:According to the mark of main body
(Such as IP address), object mark(Such as md5), behavior mark(As HTTP is downloaded), calculate separately its associated tag set
And the counting of collection resultant.Specific implementation means can be based on statistical method either be based on neural network, such as:For each
IP address will calculate the complete or collected works of the label of the IP address, and the quantity of corresponding each label;If being calculated based on statistical method,
Then direct statistical counting;If being calculated based on neural network, the intensity of corresponding each neuron connection is calculated.
S104:It is based on statistical counting as a result, it has been found that High relevancy between label, and then to the corresponding main body of respective labels,
Object and behavior carry out group's division;Specially:By counting the traversal statistical result calculated, or swashing by neural network
It is living, will find out the High relevancy between label and label in the label related to, and then to the corresponding main body of label, object and
Behavior carries out group's division.Wherein, the result that the group divides described by its associated label and will be supported.
Such as:A large amount of connections are established to a main body from the discovery of multiple main bodys, and connect the rows such as no data transmission
For label, it is possible to determine that find DDOS attack behavior.DDOS attack behavior is the part to the portrait of behavior;These main bodys
It is just being controlled at present by DDOS clients, it will be as a part for the portrait of these main bodys.
S105:The result divided according to group and the label for having High relevancy generate each group's description information;
S106:Result after group is divided becomes the basis of statistical counting as new main body, object or behavior again.
A specific embodiment based on EDR is given below:The abnormal behaviour discovery of EDR is needed to terminal(It is equivalent to this
Main body in invention)The behavior of generation is modeled;And the one kind for exactly modeling of drawing a portrait, the through the invention label for labelling
It draws a portrait with group, the behavior label that the normal population where can recognize that the terminal should have;For terminal, in terminal
The software of operation, the bearer documents of software belong to object of the present invention;The behavior that the operation of software, software generate belongs to this
The invention behavior;The file of terminal(Software)Label, terminal operating the corresponding label of behavior by the terminal(It is main
Body)It is associated on different dimensions;Ultimately form group's description information;If the terminal is found that an abnormal label,
The behavior that should be then marked to the label responds.
Secondly the present invention provides a kind of portrait system embodiment for Security Object based on vector mark, such as Fig. 2
It is shown, including:
Metadata extraction module 201, for analyzing data source and extracting metadata;
Vector analysis module 202 refers to extraction for being extracted into row vector to metadata based on preset rules with label
Vector;
Statistical analysis module 203, for the label being labeled in metadata to be corresponded to main body, object and behavior, and to
The collection of metadata for marking label carries out statistical counting;
Group's division module 204 is used for the output based on the statistical analysis module 203 as a result, it has been found that strong association between label
Property, and then group's division is carried out to the corresponding main body of respective labels, object and behavior;
State description module 205, result for being divided according to group and the label for having High relevancy generate the description of each group
Information;
Wherein, the metadata refers to the Expressive Features for characterize data source.
Preferably, the data source includes:Binary file, network message sequence, dynamic apis monitored results.
Preferably, the preset rules include:Producer's rule and User Defined rule.
Preferably, further include:Each metadata can be by one or more than one label for labelling.
Preferably, further include:The result that group divides is fed back into the statistics as new main body, object or behavior
In analysis module.
Each embodiment in this specification is described in a progressive manner, same or analogous between each embodiment
Just to refer each other for part, and each embodiment focuses on the differences from other embodiments.Especially for system
For embodiment, since it is substantially similar to the method embodiment, so description is fairly simple, related place is implemented referring to method
The part explanation of example.
As described above, above-described embodiment give it is a kind of based on vector mark for Security Object portrait method and be
System embodiment, and invention will be applied to information by innovative improvement applied to group's Portrait brand technology in the fields such as advertisement promotion and pacify
Full field.By analyzing mass data source and extracting metadata, and based on producer's rule or other users custom rule pair
Metadata is extracted into row vector, and corresponding vector is further referred to label, and all metadata to having marked label
Set carries out statistical counting, finds the High relevancy between label based on statistical result, and then complete the division to group, finally will
The result and respective labels divided according to group generates each group's description information.The above embodiment of the present invention is realized to right safely
More intuitively user is specifically showed as carrying out portrait description, and then by threat event.
Above example is to illustrative and not limiting technical scheme of the present invention.Appointing for spirit and scope of the invention is not departed from
What modification or part are replaced, and are intended to be within the scope of the claims of the invention.