WO2017152877A1 - 网络威胁事件评估方法及装置 - Google Patents

网络威胁事件评估方法及装置 Download PDF

Info

Publication number
WO2017152877A1
WO2017152877A1 PCT/CN2017/076305 CN2017076305W WO2017152877A1 WO 2017152877 A1 WO2017152877 A1 WO 2017152877A1 CN 2017076305 W CN2017076305 W CN 2017076305W WO 2017152877 A1 WO2017152877 A1 WO 2017152877A1
Authority
WO
WIPO (PCT)
Prior art keywords
threat event
threat
evaluated
event
attack
Prior art date
Application number
PCT/CN2017/076305
Other languages
English (en)
French (fr)
Inventor
王越
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2017152877A1 publication Critical patent/WO2017152877A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection

Definitions

  • the present disclosure relates to the field of network security technologies, and in particular, to a network threat event evaluation method and apparatus.
  • Recent major cybersecurity incidents such as Aurora Attack, Seismic Attack, and Sea Lotus Attack have demonstrated a new type of attack feature, namely advanced attack techniques, long duration, and special and precise attack targets.
  • This type of cyberattack is called an APT (Advanced Persistent Threat) attack.
  • APT Advanced Persistent Threat
  • This kind of attack not only uses the traditional virus, Trojan as an attack tool, but also uses the undetectable social engineering in the first part of the attack to induce the target system to trigger the 0Day vulnerability. Subsequently, the 0Day vulnerability was used to continuously improve the target system control authority, and tried to control the target system for a long time and collect valuable information. Ultimately, if an attack and stealing behavior is discovered, the attacker will safely evacuate or destroy the system.
  • APT attack detection and defense technology has become a research hotspot and difficulty in realizing network security defense under the new situation.
  • traditional defense technologies such as traditional firewalls, anti-virus software or intrusion detection systems have become unable to cope, especially in the qualitative and judgment of attack behaviors and threat events.
  • Accuracy highlights its weak side.
  • Most of the current attack detection methods are based on network data packets or sessions, and independent conclusions are obtained through the feature database comparison. The analysis of traffic is separated from the network environment or the system environment itself, and no effective connection is established between the conclusions. There is a problem that the cyber threat event is not accurately determined.
  • the main purpose of the present disclosure is to provide a method and device for evaluating a network threat event, which aims to improve the accuracy of the network threat event determination.
  • an embodiment of the present disclosure provides a network threat event evaluation method, where the network threat event evaluation method includes:
  • each single threat event in the threat event set to be evaluated is evaluated based on a preset event correlation factor and an environmental impact factor;
  • the evaluation result of the threat event set to be evaluated is output.
  • the method before the step of evaluating each single threat event in the threat event set to be evaluated based on the preset event correlation factor and the environmental impact factor, the method further includes:
  • the step of evaluating each single threat event in the threat event set to be evaluated based on the preset event correlation factor and the environmental impact factor is performed.
  • performing the tuning process on the acquired threat event set to be evaluated includes:
  • the key vector includes at least an attack time of a single threat event, a source IP address and a port, a destination IP address and port, an attack name, and an attack consequence, and the extracted each of the key vectors is to be evaluated.
  • Sorting a single threat event in a threat event set includes:
  • the single threat event in the threat event set to be evaluated is sorted based on the extracted attack consequences of each single threat event.
  • the step of evaluating each single threat event in the threat event set to be evaluated based on the preset event correlation factor and the environmental impact factor includes:
  • each time a single threat event is selected it is determined whether the selected single threat event satisfies the event correlation factor, and the confidence of the selected single threat event is increased, and whether the selected single threat event satisfies the environmental impact factor is determined. Increase the confidence of the selected single threat event;
  • an embodiment of the present disclosure further provides a network threat event evaluation apparatus, where the network threat event evaluation apparatus includes:
  • An evaluation module configured to: when obtaining the threat event set to be evaluated, evaluate each single threat event in the threat event set to be evaluated based on a preset event correlation factor and an environmental impact factor;
  • An output module configured to output an evaluation result of the threat event set to be evaluated.
  • the network threat event evaluation device further includes:
  • the tuning module is configured to perform the tuning process on the obtained threat event set to be evaluated when the acquiring module obtains the to-be-evaluated threat event set;
  • the evaluation module is further configured to: after the tuning module completes the tuning process, evaluate each single threat event in the threat event set to be evaluated based on a preset event correlation factor and an environmental impact factor.
  • the tuning module is further configured to extract the obtained key vectors of the single threat events in the threat event set to be evaluated; and collect the threat event events to be evaluated based on the extracted each of the key vector pairs.
  • Single threat events are sorted, counted, and merged.
  • the key vector includes at least an attack time, a source IP address, and a port of a single threat event, The destination IP address and port, the attack name, and the attack result, and the tuning module is further configured to sort the single threat event in the threat event set to be evaluated based on the attack result of each extracted single threat event.
  • the evaluating module is further configured to sequentially select a single threat event in the threat event set to be evaluated based on the sorting information of the threat event set to be evaluated; and determine a selected single each time a single threat event is selected Whether the threat event satisfies the event correlation factor is to increase the confidence of the selected single threat event, determine whether the selected single threat event satisfies the environmental impact factor, and increase the confidence of the selected single threat event; After completing the determination of the single threat event selected, continue to select other single threat events in order.
  • the method and device for evaluating a network threat event proposed by the present disclosure first acquires a threat event set to be evaluated, and then, based on a preset event correlation factor and an environmental impact factor, evaluates each single threat event in the collected threat event to be evaluated, and obtains Correlation between threat events, and the relationship between threat events and the environment, and finally outputting the evaluation results of threat events to be evaluated.
  • the inaccuracy caused by the independence of threat events is shielded, and the present disclosure can Improve the accuracy of cyber threat event determination.
  • FIG. 1 is a schematic flowchart of a first embodiment of a method for evaluating a network threat event according to the present disclosure
  • FIG. 2 is a schematic flowchart of a second embodiment of a method for evaluating a network threat event according to the present disclosure
  • FIG. 3 is a schematic diagram of a detailed process of evaluating a single threat event in a threat event set based on a preset event correlation factor and an environmental impact factor in FIG. 1;
  • FIG. 4 is a schematic diagram of functional modules of a first embodiment of a network threat event evaluation apparatus according to the present disclosure
  • FIG. 5 is a schematic diagram of functional modules of a second embodiment of the network threat event evaluation apparatus according to the present disclosure.
  • An embodiment of the present disclosure provides a network threat event evaluation method.
  • the network threat event evaluation method includes:
  • Step S10 obtaining a threat event set to be evaluated
  • the network threat event evaluation method provided by the embodiment of the present disclosure is performed by the network threat event evaluation device, and the network threat event evaluation device is deployed in the network system to evaluate the network threat event of the network system, or Evaluate cyber threat events from other network systems.
  • the threat defense includes three aspects: threat defense based on technology vulnerability, threat defense based on actual risk and threat defense based on attack motivation.
  • threats based on technical vulnerabilities refer to risks caused by security vulnerabilities, such as system vulnerabilities, vulnerabilities in firewall filtering rules, and the magnitude of virus samples of security software. Or detecting defects of rules, etc.; threats based on actual risks refer to risks caused by negligence in actual use, such as weak passwords; threats based on attack motives refer to risks caused by the social value of the system itself, and attacks by the system can be used. Benefits are measured.
  • a known vulnerability can be understood as a 0day vulnerability, a vulnerability discovered by a security technology enthusiast/organization or white hat and posted on a related forum or website, or a potential security flaw, as well as a vulnerability in the management field.
  • An unknown vulnerability is a vulnerability that is not discovered by a defender and is being exploited by an attacker or used as a backup attack resource. The long-term existence of unknown vulnerabilities also explains the long duration of APT attacks from another technical side.
  • the detection of security vulnerabilities can be described by threat events, and the threat events are identified by detection, which can be defined by the value of the detection algorithm and its parameters.
  • detection can be defined by the value of the detection algorithm and its parameters.
  • WAF Web Application Firewall
  • the network threat event evaluation device first acquires a threat event set based on the target system, and uses the acquired threat event set as a threat event set to be evaluated.
  • the target system may be a network system deployed by the network threat event evaluation device, or may be another network system.
  • the threat threat event set is a single threat event that does not meet the target system constraint, wherein the network threat event evaluation device may Passively receiving the set of threat events to be evaluated pushed by the pre-detection engine, and actively extracting the set of threat events to be evaluated from the pre-detection engine; the constraint is based on the target system setting, which is not limited in this embodiment.
  • this embodiment does not limit how the front-end detection engine identifies threat events.
  • the pre-detection engine can identify threat events by feature library comparison based on network data packets or sessions of the network system in which it is located.
  • step S20 when the threat event set to be evaluated is obtained, each single threat event in the threat event set to be evaluated is evaluated based on a preset event correlation factor and an environmental impact factor;
  • the network threat event evaluation device evaluates each single threat event in the threat event set based on the preset event correlation factor and the environmental impact factor, and obtains each event to be evaluated. The result of an assessment of a single threat event.
  • the attacker's intrusion behavior is not independent, but is related. From the perspective of an attack, the association between threat events is that they are generated by the same threat event behavior, including a single simple attack behavior or a complex attack behavior consisting of a series of attack steps. Event correlation technology is a comprehensive analysis of various data sources to correlate scattered single threat events to give a complete description of the event.
  • E (Attack-Id, Attack-Name, Attack-Precond, Attack-Postcond, Attack-Specif, Attack-Time, Attack-Respose)
  • the detect-id indicates the identifier of the data collector; source-ip, dest-ip indicates the source and destination IP addresses respectively; source-port, dest-port indicates the source and destination port numbers respectively; payload indicates the payload.
  • the "AttackPrecond", “Attack-Postcond” and "Attack-Specif" fields are used as the basis for the association analysis of threat events. Since the Attack-Precond and Attack-Postcond fields essentially describe the state of the entire network system, it is difficult to characterize it by a description method similar to the N-tuple. In the implementation, you can consider using XML language and Polylogic assertion (Predicate) as the basis of formal description, and expand accordingly.
  • ⁇ Cond-Scenario>script(Action, ‘winnuke$TargetAddress’) ⁇ /Cond-Scenario> indicates the scenario in which the winnuke attack occurs, and the run command in which the attacker attempts to launch an attack.
  • associations of threat events include redundant relationship associations and causal associations.
  • the analysis method of redundant relationship association is mainly based on the similarity between related attributes in the Attack-Specif field of the threat event, and the similarity is calculated by the method of probability and statistics.
  • the analysis method of causality correlation is mainly based on three fields of threat event model E: Attack-Precond, Attack-Postcond, and Attack-Specif.
  • the basic idea is to find out if there is a logical connection between the cause of an threat event (Attack-Precond) and the outcome of another threat event (Attack-Postcond). If there is a connection, it indicates that the two threat events are related.
  • the event correlation factor of the embodiment is constructed, including an event logic association model and an association condition and other analysis elements and analysis methods.
  • an environmental impact factor is also constructed, including a host environment model in the network system, and an analysis element and an analysis method such as a network environment model and an influence condition.
  • the single threat event is evaluated to determine whether the single threat event satisfies the event correlation factor and/or the environmental impact factor.
  • the network threat event assessment device has four meaningful meanings in the Attack-Specif based on the single threat event.
  • the attribute plus the Attack-Id field attribute determines whether the single threat event conforms to the event logical association model, and determines that the single threat event conforms to the event correlation factor;
  • the network threat event evaluation device determines the Attack-Postcond of the single threat event (attack consequence) Whether it conforms to the host environment model and/or the network environment model of the network system determines whether the threat event complies with the environmental impact factor.
  • the network threat event evaluation device may first analyze the redundancy relationship, cluster the repeated multiple threat events into one threat event, and then perform causal relationship analysis. Reduce unnecessary double counting and improve evaluation efficiency.
  • Step S30 outputting an evaluation result of the threat event set to be evaluated.
  • the network threat event evaluation device After completing the evaluation of each single threat event in the threat event set to be evaluated, the network threat event evaluation device outputs the evaluation result. It is easy to understand that, based on the foregoing description of the assessment, the number of evaluation results output may differ from the number of single threat events in the threat event set to be assessed due to the presence of clustering in the assessment.
  • the network threat event evaluation device may output the evaluation result based on the source of the threat event set to be evaluated.
  • the network system performs output. For example, if the threat event set to be evaluated is from the network system, the network threat event evaluation device outputs the evaluation result to the network system platform for display; if the threat event set to be evaluated is from another network system, the network threat event The evaluation device outputs the evaluation result to the source network system platform for display; or the network threat event evaluation device outputs the evaluation result to an input interface of a preset other approved evaluation result.
  • the cyber threat event evaluation method proposed in this embodiment first obtains a threat event set to be evaluated, and then, based on a preset event correlation factor and an environmental impact factor, evaluates a single threat event in the obtained threat event to be evaluated, and obtains a threat.
  • the association between the events, and the relationship between the threat events and the environment, and finally the evaluation results of the threat events to be evaluated, the inaccuracies caused by the independence of the threat events are shielded from the related technologies, and the implementation of the present disclosure This example can improve the accuracy of cyber threat event determination.
  • step S20 further includes:
  • Step S40 Perform the tuning process on the acquired threat event set to be evaluated when the threat event set to be evaluated is obtained;
  • step S20 After completing the tuning process, proceeding to step S20;
  • the network threat event evaluation device performs the tuning process on the acquired threat event set to be evaluated (that is, the threat event set based on the constraint of the target system), including:
  • the key vector extracted by the network threat event evaluation device includes at least Attack-Time (attack time, that is, when the threat event is detected), Attack-Name (attack name), Attack-Specif (attack feature) Source-ip (source IP address), dest-ip (destination IP address), source-port (source port), dest-port (destination port) and Attack-Postcond (attack consequence).
  • Attack-Time attack time
  • Attack-Name attack name
  • Attack-Specif attack feature
  • Source-ip source IP address
  • dest-ip destination IP address
  • source-port source port
  • dest-port destination port
  • Attack-Postcond attack consequence
  • the network threat event evaluation device After the statistical operation is completed, the network threat event evaluation device performs the clustering of the single threat event based on the statistical information, for example, the single threat event of the same same Attack-Name for the same dest-ip is merged and clustered into one threat event. And record the number of repetitions.
  • optimization processing such as sorting, statistics, and clustering can reduce unnecessary calculations and improve evaluation efficiency.
  • the network threat event evaluation device sorts, the single threat events in the threat event set to be evaluated are sorted based on the attack consequences of the extracted single threat events. For example, sorting individual threat events in descending order of the consequences of the attack.
  • the sorting operation performed by the network threat event evaluation device can be performed after the merged clustering operation is completed to avoid repeated sorting.
  • step S20 includes:
  • Step S201 sequentially select, according to the ranking information of the threat event set to be evaluated, a single threat event in the threat event set to be evaluated;
  • step S202 each time a single threat event is selected, it is determined whether the selected single threat event satisfies the event correlation factor, and the confidence of the selected single threat event is increased, and whether the selected single threat event satisfies the environmental impact is determined.
  • Factor which increases the confidence of the selected single threat event
  • Step S203 after completing the determining operation of the single selected threat event, continue to select other single threat events in order.
  • the network threat event evaluation device evaluates each single threat event in the threat event set in an orderly manner based on the sorting information of the tuning process.
  • the network threat event evaluation device sequentially selects a single threat event in the threat event set to be evaluated based on the ranking information of the threat event set to be evaluated, for example, the network threat event evaluation device is in the process of tuning According to the degree of descending order of the consequences of each single threat event, the cyber threat event evaluation device will first select a single threat event with the greatest degree of consequences of the threat event concentration to be evaluated for evaluation.
  • the cyber threat event evaluation device determines whether the selected single threat event satisfies the event correlation factor, and increases the confidence of the selected single threat event, otherwise it does not increase, for example, the network threat event evaluation.
  • the device may perform the analysis of the redundancy relationship, and the repeated multiple threat events are grouped into one threat event, and then the causal relationship is analyzed. For details, refer to the first embodiment, and details are not described herein again. It should be noted that when the network threat event evaluation device obtains the threat event set to be evaluated, an initial confidence level is allocated for each single threat event in the threat event to be evaluated, which may be based on the source pre-detection engine of the threat event set to be evaluated.
  • the detection performance is assigned to the initial confidence level, for example, if the source front detection engine is detectable If the energy is higher, the initial confidence level is assigned to the threat event set to be evaluated corresponding to the source pre-detection engine; if the detection performance of the source pre-detection engine is low, it is the corresponding source pre-detection engine. Evaluate the initial confidence level of the threat event set allocation.
  • the network threat event evaluation device determines whether the selected single threat event satisfies the environmental impact factor, and increases the confidence of the selected single threat event, otherwise it does not increase, for example, when a single threat event is selected, the network threat event The evaluation device determines whether the Attack-Postcond of the selected single threat event conforms to the host environment model and/or the network environment model of the target system, and determines that the selected single threat event complies with the environmental impact factor and increases its confidence. .
  • step S30 includes:
  • the embodiment of the present disclosure further provides a network threat event evaluation apparatus.
  • the network threat event evaluation apparatus includes:
  • the obtaining module 10 is configured to obtain a threat event set to be evaluated
  • the network threat event evaluation device provided by the embodiment of the present disclosure is deployed in a network system to evaluate network threat events of the network system, and may also evaluate network threat events of other network systems.
  • the acquiring module 10 first acquires a threat event set based on the target system, and uses the acquired threat event set as a threat event set to be evaluated.
  • the target system may be a network system deployed by the network threat event evaluation device, or may be another network system.
  • the acquiring module 10 discards a single threat event that does not meet the target system constraint when the target system-based threat event set is acquired by the front-end detection engine of the target system, where the acquiring module 10 can passively receive the front-end
  • the threat event set to be evaluated by the detection engine may also be actively pulled from the pre-detection engine to extract the threat event set to be evaluated; the constraint condition is based on the target system setting, which is not limited in this embodiment.
  • this embodiment does not limit how the front-end detection engine identifies threat events.
  • the pre-detection engine can identify threat events by feature library comparison based on network data packets or sessions of the network system in which it is located.
  • the evaluation module 20 is configured to: when acquiring the threat event set to be evaluated, evaluate each single threat event in the threat event set to be evaluated based on a preset event correlation factor and an environmental impact factor;
  • the evaluation module 20 evaluates each single threat event in the threat event set based on the preset event correlation factor and the environmental impact factor, and obtains the event concentration to be evaluated. The results of the assessment of each single threat event.
  • the attacker's intrusion behavior is not independent, but is related. From the perspective of an attack, the association between threat events is that they are generated by the same threat event behavior, including a single simple attack behavior or a complex attack behavior consisting of a series of attack steps. Event correlation technology is a comprehensive analysis of various data sources to correlate scattered single threat events to give a complete description of the event.
  • E (Attack-Id, Attack-Name, Attack-Precond, Attack-Postcond, Attack-Specif, Attack-Time, Attack-Respose)
  • the detect-id indicates the identifier of the data collector; source-ip, dest-ip indicates the source and destination IP addresses respectively; source-port, dest-port indicates the source and destination port numbers respectively; payload indicates the payload.
  • the "AttackPrecond", “Attack-Postcond” and "Attack-Specif" fields are used as the basis for the association analysis of threat events. Since the Attack-Precond and Attack-Postcond fields essentially describe the state of the entire network system, it is difficult to characterize it by a description method similar to the N-tuple. In the implementation, you can consider using XML language and Polylogic assertion (Predicate) as the basis of formal description, and expand accordingly.
  • ⁇ Cond-Scenario>script(Action, ‘winnuke$TargetAddress’) ⁇ /Cond-Scenario> indicates the scenario in which the winnuke attack occurs, and the run command in which the attacker attempts to launch an attack.
  • associations of threat events include redundant relationship associations and causal associations.
  • the analysis method of redundant relationship association is mainly based on the similarity between related attributes in the Attack-Specif field of the threat event, and the similarity is calculated by the method of probability and statistics.
  • the analysis method of causality correlation is mainly based on three fields of threat event model E: Attack-Precond, Attack-Postcond, and Attack-Specif.
  • the basic idea is to find out if there is a logical connection between the cause of an threat event (Attack-Precond) and the outcome of another threat event (Attack-Postcond). If there is a connection, it indicates that the two threat events are related.
  • the event correlation factor of the embodiment is constructed, including an event logic association model and an association condition and other analysis elements and analysis methods.
  • an environmental impact factor is also constructed, including a host environment model in the network system, and an analysis element and an analysis method such as a network environment model and an influence condition.
  • the evaluation module 20 evaluates a single threat event, that is, determines whether the single threat event satisfies the event correlation factor and/or the environmental impact factor. For example, the evaluation module 20 has 4 of the Attack-Specif based on the single threat event. The attribute of the meaning plus the Attack-Id field attribute determines whether the single threat event conforms to the event logical association model, and determines that the single threat event conforms to the event correlation factor; and the evaluation module 20 determines whether the Attack-Postcond of the single threat event is The host environment model and/or network environment model conforming to the network system determines that the single threat event conforms to the environmental impact factor.
  • the evaluation module 20 may first perform the analysis of the redundancy relationship, and cluster the repeated multiple threat events into one threat event, and then perform the causal relationship analysis to reduce the Repeat the necessary calculations to improve the efficiency of the assessment.
  • the output module 30 is configured to output an evaluation result of the threat event set to be evaluated.
  • the network threat event evaluation device After completing the evaluation of each single threat event in the threat event set to be evaluated, the network threat event evaluation device outputs the evaluation result. It is easy to understand that, based on the foregoing description of the assessment, the number of evaluation results output may differ from the number of single threat events in the threat event set to be assessed due to the presence of clustering in the assessment.
  • the output module 30 may output the evaluation result based on the source network system of the threat event set to be evaluated. Outputting, for example, if the threat event set to be evaluated is from the local network system, the output module 30 outputs the evaluation result to the network system platform for display; if the threat event set to be evaluated is from another network system, the output module 30 will evaluate the result. The output is output to the source network system platform for display; or the output module 30 outputs the evaluation result to an input interface of a preset other approved evaluation result.
  • the network threat event evaluation device proposed in this embodiment first obtains a threat event set to be evaluated, and then, based on a preset event correlation factor and an environmental impact factor, evaluates each single threat event in the collected threat event to be evaluated, and obtains a threat.
  • the association between the events, and the relationship between the threat events and the environment, and finally the evaluation results of the threat events to be evaluated, the inaccuracies caused by the independence of the threat events are shielded from the related technologies, and the implementation of the present disclosure This example can improve the accuracy of cyber threat event determination.
  • the network threat event evaluation apparatus further includes:
  • the tuning module 40 is configured to perform the tuning process on the acquired threat event set to be evaluated when the acquiring module 10 obtains the to-be-evaluated threat event set;
  • the evaluation module 20 is further configured to evaluate each single threat event in the threat event set to be evaluated based on a preset event correlation factor and an environmental impact factor after the tuning module 40 completes the tuning process.
  • the tuning module 40 performs a tuning process on the threat event set to be evaluated acquired by the acquiring module 10 (that is, the threat event set filtered by the acquiring module 10 based on the constraint of the target system). Specifically, The tuning module 40 extracts the key vectors of the single threat events in the acquired threat event set to be evaluated; and sorts, counts, and merges the single threat events in the collected threat event set to be acquired based on the extracted key vectors.
  • the key vector extracted by the tuning module 40 includes at least Attack-Time (attack time, that is, when the threat event is detected), Attack-Name (attack name), Attack-Specif (attack feature) Source-ip (source IP address), dest-ip (destination IP address), source-port (source port), dest-port (destination port), and Attack-Postcond (attack consequence).
  • Attack-Time attack time
  • Attack-Name attack name
  • Attack-Specif attack feature
  • Source-ip source IP address
  • dest-ip destination IP address
  • source-port source port
  • dest-port destination port
  • Attack-Postcond attack consequence
  • the tuning module 40 can sort and count according to one or more key vectors, such as Attack- according to a single threat event. Time sorting, sorting by Attack-Postcond for a single threat event, statistics for a single threat event for the same dest-ip, statistics for a single threat event for the same Attack-Name, etc.
  • the tuning module 40 performs the clustering of the single threat event based on the statistical information. For example, the single threat event of the same same Attack-Name for the same dest-ip is merged and clustered into one threat event. And record the number of repetitions.
  • optimization processing such as sorting, statistics, and clustering can reduce unnecessary calculations and improve evaluation efficiency.
  • the scheduling module 40 sorts, the single threat events in the threat event set to be evaluated are sorted based on the attack consequences of the extracted single threat events. For example, the tuning module 40 ranks each single threat event in descending order of the extent of the attack.
  • the sorting operation performed by the tuning module 40 can be performed after the merged clustering operation is completed to avoid repeated sorting.
  • the evaluation module 20 is further configured to select the to-be-selected based on the ranking information of the threat event set to be evaluated. Evaluating a single threat event in a threat event set; and determining whether the selected single threat event satisfies the event correlation factor each time a single threat event is selected, increasing the confidence of the selected single threat event and determining the selected single threat Whether the event satisfies the environmental impact factor is to increase the confidence of the selected single threat event; and after completing the determination operation of the single selected threat event, continue to select other single threat events in order.
  • the evaluation module 20 evaluates each single threat event in the threat event set in an orderly manner based on the sorting information of the tuning process.
  • the evaluation module 20 sequentially selects a single threat event in the threat event set to be evaluated based on the ranking information of the threat event set to be evaluated. For example, the tuning module 40 follows each single in the tuning process. The descending order of the consequences of the threat event attack, the evaluation module 20 will first select a single threat event with the greatest degree of consequences of the threat event concentration to be evaluated for evaluation.
  • the evaluation module 20 determines whether the selected single threat event satisfies the event correlation factor, and increases the confidence of the selected single threat event, otherwise it does not increase. For example, the evaluation module 20 may first perform The analysis of the redundancy relationship is performed by merging the repeated multiple threat events into one threat event, and then performing the analysis of the causal relationship. For details, refer to the first embodiment, and details are not described herein again. It should be noted that, when acquiring the threat event set to be evaluated, the obtaining module 10 allocates an initial confidence level for each single threat event to be evaluated in the threat event set, which may be based on the detection of the source pre-detection engine of the threat event set to be evaluated. Performance is initially assigned to the confidence level.
  • the evaluation module 20 determines whether the selected single threat event satisfies the environmental impact factor, and increases the confidence of the selected single threat event, otherwise it does not increase. For example, when a single threat event is selected, the evaluation module 20 determines that the selection is performed. Whether the Attack-Postcond of the single threat event conforms to the host environment model and/or the network environment model of the target system determines that the selected single threat event conforms to the environmental impact factor and increases its confidence.
  • the output module 30 is further configured to output a confidence level after evaluating each single threat event in the threat event set to be evaluated.
  • embodiments of the present disclosure can be provided as a method, system, or computer program product.
  • embodiments of the present disclosure may take the form of a hardware embodiment, a software embodiment, or a combination of software and hardware aspects.
  • embodiments of the present disclosure may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) including computer usable program code.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.
  • embodiments of the present disclosure also provide a non-transitory computer readable storage medium having stored therein instructions that, when one or more processors of a network threat event evaluation device execute the instructions, the network threat
  • the event evaluation apparatus performs a control method, and the method includes: acquiring a threat event set to be evaluated; and acquiring the threat to be evaluated based on a preset event correlation factor and an environmental impact factor when the threat event set to be evaluated is acquired Each single threat event in the event set is evaluated; and the evaluation result of the threat event set to be evaluated is output.
  • the embodiment of the present disclosure further provides a network threat event evaluation apparatus, including:
  • a memory for storing executable instructions of the processor
  • processor is set to:
  • each single threat event in the threat event set to be evaluated is evaluated based on a preset event correlation factor and an environmental impact factor;
  • the evaluation result of the threat event set to be evaluated is output.
  • the present disclosure relates to the field of network security technologies. Compared with related technologies, the inaccuracy caused by the independence of threat events is shielded, and the present disclosure can improve the accuracy of network threat event determination.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer And Data Communications (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本公开公开了一种网络威胁事件评估方法，所述网络威胁事件评估方法包括：获取待评估威胁事件集；在获取到所述待评估威胁事件集时，基于预设的事件关联因子和环境影响因子对所述待评估威胁事件集中的各单一威胁事件进行评估；输出所述待评估威胁事件集的评估结果。本公开还公开了一种网络威胁事件评估装置。本公开能够提高网络威胁事件判定的准确性。

Description

网络威胁事件评估方法及装置 技术领域
本公开涉及网络安全技术领域，尤其涉及一种网络威胁事件评估方法及装置。
背景技术
极光攻击、震网攻击、海莲花攻击等近期重大网络安全事件都展现了一种新型的攻击特征，即攻击手法高级、持续时间长、攻击目标特殊且精准。这类网络攻击称之为APT(Advanced Persistent Threat，高级持续性威胁)攻击。这类攻击不仅使用了传统的病毒、木马作为攻击工具，更是在攻击最先环节中利用了不易察觉的社会工程学，诱使目标***触发0Day漏洞等。随后，再利用0Day漏洞不断提升目标***控制权限，并试图长期控制目标***、收集有价值的信息。最终，假如攻击窃密行为被发现，攻击者将会安全撤离或者破坏***。
目前，APT攻击检测防御技术已经成为新形势下网络安全防御的研究热点和实现难点。针对这种新型的攻击思想，尤其是长期潜伏、长期控制这类特征，传统防火墙、反病毒软件或者入侵检测***等一般防御技术手段已显得无法应对，尤其在攻击行为、威胁事件的定性和判定准确性上更凸显其薄弱的一面。目前的攻击检测方法大多都是基于网络数据包或者会话，通过特征库比对方式得出独立的结论，对于流量的分析是脱离了网络环境或者***环境本身，结论之间也没有建立有效的联系，存在网络威胁事件判定不准确的问题。
发明内容
本公开的主要目的在于提供一种网络威胁事件评估方法及装置，旨在提高网络威胁事件判定的准确性。
为实现上述目的，本公开的实施例提供一种网络威胁事件评估方法，所述网络威胁事件评估方法包括：
获取待评估威胁事件集；
在获取到所述待评估威胁事件集时，基于预设的事件关联因子和环境影响因子对所述待评估威胁事件集中的各单一威胁事件进行评估；
输出所述待评估威胁事件集的评估结果。
可选的，所述基于预设的事件关联因子和环境影响因子对所述待评估威胁事件集中的各单一威胁事件进行评估的步骤之前，所述方法还包括：
在获取到所述待评估威胁事件集时，对获取的所述待评估威胁事件集进行调优处理；
在完成调优处理之后，执行所述基于预设的事件关联因子和环境影响因子对所述待评估威胁事件集中的各单一威胁事件进行评估的步骤。
可选的，对获取的所述待评估威胁事件集进行调优处理包括：
提取获取的所述待评估威胁事件集中各单一威胁事件的关键向量；
基于提取的各所述关键向量对获取的所述待评估威胁事件集中的单一威胁事件进行排序、统计以及归并聚类。
可选的，所述关键向量至少包括单一威胁事件的攻击时间、源IP地址及端口、目的IP地址及端口、攻击名称以及攻击后果，所述基于提取的各所述关键向量对所述待评估威胁事件集中的单一威胁事件进行排序包括：
基于提取的各单一威胁事件的攻击后果对所述待评估威胁事件集中的单一威胁事件进行排序。
可选的，所述基于预设的事件关联因子和环境影响因子对所述待评估威胁事件集中的各单一威胁事件进行评估的步骤包括：
基于所述待评估威胁事件集的排序信息依次选中所述待评估威胁事件集中的单一威胁事件；
在每次选中单一威胁事件时，判定选中的单一威胁事件是否满足所述事件关联因子，是则增加选中的单一威胁事件的置信度，判定选中的单一威胁事件是否满足所述环境影响因子，是则增加选中的单一威胁事件的置信度；
在完成当次选中的单一威胁事件的判定操作之后，继续按顺序选中其它单一威胁事件。
此外，为实现上述目的，本公开的实施例还提供了一种网络威胁事件评估装置，所述网络威胁事件评估装置包括：
获取模块，设置为获取待评估威胁事件集；
评估模块，设置为在获取到所述待评估威胁事件集时，基于预设的事件关联因子和环境影响因子对所述待评估威胁事件集中的各单一威胁事件进行评估；
输出模块，设置为输出所述待评估威胁事件集的评估结果。
可选的，所述网络威胁事件评估装置还包括：
调优模块，设置为在所述获取模块获取到所述待评估威胁事件集时，对获取的所述待评估威胁事件集进行调优处理；
所述评估模块还设置为在所述调优模块完成调优处理之后，基于预设的事件关联因子和环境影响因子对所述待评估威胁事件集中的各单一威胁事件进行评估。
可选的，所述调优模块还设置为提取获取的所述待评估威胁事件集中各单一威胁事件的关键向量；以及基于提取的各所述关键向量对获取的所述待评估威胁事件集中的单一威胁事件进行排序、统计以及归并聚类。
可选的，所述关键向量至少包括单一威胁事件的攻击时间、源IP地址及端口、 目的IP地址及端口、攻击名称以及攻击后果，所述调优模块还设置为基于提取的各单一威胁事件的攻击后果对所述待评估威胁事件集中的单一威胁事件进行排序。
可选的，所述评估模块还设置为基于所述待评估威胁事件集的排序信息依次选中所述待评估威胁事件集中的单一威胁事件；以及在每次选中单一威胁事件时，判定选中的单一威胁事件是否满足所述事件关联因子，是则增加选中的单一威胁事件的置信度，判定选中的单一威胁事件是否满足所述环境影响因子，是则增加选中的单一威胁事件的置信度；以及在完成当次选中的单一威胁事件的判定操作之后，继续按顺序选中其它单一威胁事件。
本公开提出的网络威胁事件评估方法及装置，首先获取到待评估威胁事件集，然后基于预设的事件关联因子和环境影响因子对获取到的待评估威胁事件集中各单一威胁事件进行评估，得到威胁事件之间的关联，以及威胁事件与环境之间的关联，最后输出待评估威胁事件的评估结果，相较于相关技术，屏蔽了威胁事件的独立性所造成的不准确性，本公开能够提升网络威胁事件判定的准确性。
附图说明
图1为本公开网络威胁事件评估方法第一实施例的流程示意图；
图2为本公开网络威胁事件评估方法第二实施例的流程示意图；
图3为图1中基于预设的事件关联因子和环境影响因子对待评估威胁事件集中的各单一威胁事件进行评估的细化流程示意图；
图4为本公开网络威胁事件评估装置第一实施例的功能模块示意图；
图5为本公开网络威胁事件评估装置第二实施例的功能模块示意图。
本公开目的的实现、功能特点及优点将结合实施例，参照附图做进一步说明。
具体实施方式
应当理解，此处所描述的具体实施例仅仅用以解释本公开，并不用于限定本公开。
本公开的实施例提供一种网络威胁事件评估方法，参照图1，在本公开网络威胁事件评估方法的第一实施例中，所述网络威胁事件评估方法包括：
步骤S10，获取待评估威胁事件集；
需要说明的是，本公开实施例提供的网络威胁事件评估方法由网络威胁事件评估装置执行，该网络威胁事件评估装置部署在网络***中运行，可对本网络***的网络威胁事件进行评估，也可对其它网络***的网络威胁事件进行评估。
下面对本公开涉及的专业名词进行解释，如安全漏洞和威胁事件等。
威胁的防御包括三个方面，分别是基于技术脆弱性的威胁防御、基于实际风险的威胁防御和基于攻击动机的威胁防御。其中，基于技术脆弱性的威胁是指由安全漏洞引起的风险，如***漏洞、防火墙过滤规则的漏洞，安全防护软件的病毒样本的量级 或者检测规则的缺陷等；基于实际风险的威胁是指在实际使用时疏忽引起的风险，如弱口令等；基于攻击动机的威胁是指***本身的社会价值引起的风险，可以用该***的攻击效益来衡量。
防御的安全漏洞是长期客观存在的，而且修补这些漏洞是一个永无休止的过程。目前在几乎所有的防护***中均存在这样的关系。已知漏洞可以理解为0day漏洞，是被某个安全技术爱好者/组织或者白帽子发现并在相关论坛或者网站公布的漏洞，或者是潜在的安全缺失，也包括管理领域的漏洞。未知漏洞是指未被防御者发现，正在被攻击者利用或者作为后备攻击资源的漏洞。未知漏洞长期的存在也就从另一个技术侧面解释了APT攻击持续时间长的特性。
对于安全漏洞的检测可以用威胁事件描述，威胁事件通过检测进行识别，具体可用检测算法及其参数的取值来限定。例如，某网站存在数据库注入漏洞，但是该网站前置部署了WAF(Web Application Firewall，网站应用防火墙)，因此常规的检测算法无法识别出该数据库注入漏洞。但是，采用某个特殊检测算法及其参数值，绕过WAF识别出该数据库注入漏洞，那么此检测算法及其参数具体取值构成一次威胁事件。
本实施例中，网络威胁事件评估装置首先获取基于目标***的威胁事件集，将获取的威胁事件集作为待评估威胁事件集。其中，该目标***可以是网络威胁事件评估装置部署的网络***，也可以是其它网络***。具体的，网络威胁事件评估装置在通过目标***的前置检测引擎获取到基于目标***的威胁事件集时，丢弃威胁事件集中不符合目标***约束的单一威胁事件，其中，网络威胁事件评估装置可以被动接收前置检测引擎推送的待评估威胁事件集，也可以主动从前置检测引擎拉取待评估威胁事件集；约束条件基于目标***设置，本实施例不作限定。
此外，本实施例并不限制前置检测引擎如何识别威胁事件，例如，前置检测引擎可基于其所在网络***的网络数据包或者会话，通过特征库比对方式识别威胁事件。
步骤S20，在获取到所述待评估威胁事件集时，基于预设的事件关联因子和环境影响因子对所述待评估威胁事件集中的各单一威胁事件进行评估；
本实施例中，在获取到待评估威胁事件集时，网络威胁事件评估装置基于预设的事件关联因子和环境影响因子对待评估威胁事件集中的各单一威胁事件进行评估，得到待评估事件集中各单一威胁事件的评估结果。
本领域技术人员可以理解的是，攻击者的入侵行为并不是独立的，而都是有所关联的。从攻击的角度出发，威胁事件之间的关联是指它们是同一个威胁事件行为所产生的，这种攻击行为包括单个简单攻击行为或由一系列攻击步骤组成的复杂攻击行为。事件关联技术是将各种数据来源进行综合分析，把分散的单一威胁事件关联起来，以给出完整的事件描述。
设威胁事件模型用E表示，则有:E＝(Attack-Id，Attack-Name，Attack-Precond， Attack-Postcond，Attack-Specif，Attack-Time，Attack-Respose)
其中，字段Attack-Id为攻击标志，表明攻击类型；Attack-Name为攻击名称；Attack-Precond为攻击前提，即攻击实施前所应该满足的条件集合；Attack-Postcond为攻击后果，即攻击实施后对网络***造成的所有可能影响的集合；Attack-Specif为攻击特征，即攻击报文的特征描述；Attack-Time为检测到攻击所发生时的时间；Attack-Respose为攻击响应，针对某个攻击，***所应采取的相应对策。由于Attack-Specif字段的数据来源主要是侦听到的网络攻击报文，因而可以进一步用一个六元组将其特征化。设一个报文用P表示，则有P＝(detect-id，source-ip，dest-ip，source-port，dest-port，payload)
其中，detect-id表示数据采集器的标识符；source-ip，dest-ip分别表示源、目的IP地址；source-port，dest-port分别表示源、目的端口号；payload表示有效载荷。在本实施例中，将“AttackPrecond”，“Attack-Postcond”和“Attack-Specif”字段作为威胁事件关联分析的依据。由于Attack-Precond和Attack-Postcond字段实质上描述了整个网络***的状态，因而很难用类似于N元组这类描述方法来将其特征化。在具体实施时，可以考虑采用XML语言和多元逻辑断言(Predicate)作为形式化描述的基础，并相应地进行扩展。例如，<Cond-Scenario>script(Action，‘winnuke$TargetAddress’)</Cond-Scenario>表示winnuke攻击发生的情景，及在这种情景下攻击者企图发动攻击的运行命令。
通常的，威胁事件的关联包括冗余关系关联和因果关系关联。
其中，冗余关系关联的分析方法主要是依据威胁事件Attack-Specif字段中相关属性之间的相似度，相似度采用概率统计的方法进行计算。
因果关系关联的分析方法主要基于威胁事件模型E的三个字段:Attack-Precond、Attack-Postcond和Attack-Specif。基本思想是:寻找一个威胁事件的前因(Attack-Precond)和另一个威胁事件的后果(Attack-Postcond)之间是否存在逻辑联系，如果存在联系，就表明这两个威胁事件是关联的。
基于前述事件关联的主旨思想，构建本实施例的事件关联因子，包括事件逻辑关联模型和关联条件等分析要素和分析方法。
此外，在本实施例中，还构建有环境影响因子，包括网络***内的主机环境模型以及网络环境模型和影响条件等分析要素和分析方法。
在本实施例中，对单一威胁事件进行评估即判断单一威胁事件是否满足事件关联因子和/或环境影响因子，例如，网络威胁事件评估装置基于单一威胁事件的Attack-Specif中的4个有意义的属性加上Attack-Id字段属性判断该单一威胁事件是否符合事件逻辑关联模型，是则判定该单一威胁事件符合事件关联因子；网络威胁事件评估装置判定单一威胁事件的Attack-Postcond(攻击后果)是否符合网络***的主机环境模型和/或网络环境模型，是则判定该威胁事件符合环境影响因子。
本实施例中在进行事件关联因子的判定时，网络威胁事件评估装置可先进行冗余关系的分析,将重复的多个威胁事件归并聚类为一个威胁事件,再进行因果关系的分析,以减少不必要的重复计算，提升评估效率。
步骤S30，输出所述待评估威胁事件集的评估结果。
本实施例中，在完成待评估威胁事件集中各单一威胁事件的评估之后，网络威胁事件评估装置输出评估结果。容易理解的是，基于前述关于评估的描述，由于存在评估时归并聚类的情况，输出的评估结果数量可能与待评估威胁事件集中单一威胁事件的数量不同。
本实施例中，由于待评估威胁事件集可来自网络威胁事件评估装置部署的网络***，也可来自其它网络***，网络威胁事件评估装置在输出评估结果时，可基于待评估威胁事件集的来源网络***进行输出，例如，若待评估威胁事件集来自本网络***，网络威胁事件评估装置则将评估结果输出至本网络***平台进行展示；若待评估威胁事件集来自其它网络***，网络威胁事件评估装置则将评估结果输出至来源网络***平台进行展示；或者，网络威胁事件评估装置将评估结果输出至预设的其它认可评估结果的输入接口。
本实施例提出的网络威胁事件评估方法，首先获取到待评估威胁事件集，然后基于预设的事件关联因子和环境影响因子对获取到的待评估威胁事件集中各单一威胁事件进行评估，得到威胁事件之间的关联，以及威胁事件与环境之间的关联，最后输出待评估威胁事件的评估结果，相较于相关技术，屏蔽了威胁事件的独立性所造成的不准确性，本公开的实施例能够提升网络威胁事件判定的准确性。
基于第一实施例，提出本公开网络威胁事件评估方法的第二实施例，参照图2，在本实施例中，步骤S20之前所述方法还包括：
步骤S40，在获取到所述待评估威胁事件集时，对获取的所述待评估威胁事件集进行调优处理；
在完成调优处理之后，转入执行步骤S20；
本实施例中，为提升评估效率，网络威胁事件评估装置对获取的待评估威胁事件集(即基于目标***之约束过滤后的威胁事件集)进行调优处理，包括：
提取获取的待评估威胁事件集中各单一威胁事件的关键向量；
基于提取的各关键向量对获取的待评估威胁事件集中的单一威胁事件进行排序、统计以及归并聚类。
在本实施例中，网络威胁事件评估装置提取的关键向量至少包括Attack-Time(攻击时间，即检测到威胁事件所发生时的时间)、Attack-Name(攻击名称)、Attack-Specif(攻击特征)中的source-ip(源IP地址)，dest-ip(目的IP地址)，source-port(源端口)，dest-port(目的端口)以及Attack-Postcond(攻击后果)。在进行调优处理时，可依据一个或多个关键向量进行排序与统计，如按照单一威胁事件的Attack- Time排序，按照单一威胁事件的Attack-Postcond排序，同一dest-ip的单一威胁事件的统计，同一Attack-Name的单一威胁事件的统计等。
在完成统计操作之后，网络威胁事件评估装置基于统计信息进行单一威胁事件的归并聚类，例如，将针对同一dest-ip的多次相同Attack-Name的单一威胁事件归并聚类处理为一条威胁事件，并记录重复次数。
可以理解的是，通过排序、统计以及归并聚类等调优处理，能够减少不必要重复计算，提升评估效率。
在本实施例中，网络威胁事件评估装置在排序时，基于提取的各单一威胁事件的攻击后果对所述待评估威胁事件集中的单一威胁事件进行排序。例如，按照攻击后果的程度降序排列各单一威胁事件。
本领域技术人员可以理解的是，网络威胁事件评估装置进行的排序操作可在完成归并聚类操作之后进行，以避免重复排序。
基于第二实施例，提出本公开网络威胁事件评估方法的第三实施例，参照图3，在本实施例中，步骤S20包括：
步骤S201，基于所述待评估威胁事件集的排序信息依次选中所述待评估威胁事件集中的单一威胁事件；
步骤S202，在每次选中单一威胁事件时，判定选中的单一威胁事件是否满足所述事件关联因子，是则增加选中的单一威胁事件的置信度，判定选中的单一威胁事件是否满足所述环境影响因子，是则增加选中的单一威胁事件的置信度；
步骤S203，在完成当次选中的单一威胁事件的判定操作之后，继续按顺序选中其它单一威胁事件。
在本实施例中，为高效的完成待评估威胁事件集中各单一威胁事件的评估，网络威胁事件评估装置基于调优处理的排序信息有序的对待评估威胁事件集中各单一威胁事件进行评估。
在一个示例性实施例中，网络威胁事件评估装置基于所述待评估威胁事件集的排序信息依次选中所述待评估威胁事件集中的单一威胁事件，例如，网络威胁事件评估装置在调优处理时按照各单一威胁事件攻击后果的程度降序排序，则网络威胁事件评估装置将首先选中待评估威胁事件集中攻击后果程度最大的单一威胁事件进行评估。
在每次选中单一威胁事件时，网络威胁事件评估装置判定选中的单一威胁事件是否满足所述事件关联因子，是则增加选中的单一威胁事件的置信度，否则不增加，例如，网络威胁事件评估装置可先进行冗余关系的分析,将重复的多个威胁事件归并聚类为一个威胁事件,再进行因果关系的分析，具体可参照第一实施例，此处不再赘述。需要说明的是，网络威胁事件评估装置在获取到待评估威胁事件集时，为待评估威胁事件集中各单一威胁事件分配有初始置信度，具体可基于待评估威胁事件集的来源前置检测引擎的检测性能进行初始置信度的分配，例如，若来源前置检测引擎的检测性 能较高，则为对应该来源前置检测引擎的待评估威胁事件集分配较高的初始置信度；若来源前置检测引擎的检测性能较低，则为对应该来源前置检测引擎的待评估威胁事件集分配较低的初始置信度。此外，网络威胁事件评估装置还判定选中的单一威胁事件是否满足所述环境影响因子，是则增加选中的单一威胁事件的置信度，否则不增加，例如，在选中单一威胁事件时，网络威胁事件评估装置判定选中的单一威胁事件的Attack-Postcond(攻击后果)是否符合目标***的主机环境模型和/或网络环境模型，是则判定该选中的单一威胁事件符合环境影响因子，并增加其置信度。
在本实施例中，步骤S30包括：
输出对待评估威胁事件集中各单一威胁事件进行评估后的置信度。
本公开的实施例还提供一种网络威胁事件评估装置，参照图4,在本公开网络威胁事件评估装置的第一实施例中，所述网络威胁事件评估装置包括：
获取模块10，设置为获取待评估威胁事件集；
需要说明的是，本公开实施例提供的网络威胁事件评估装置部署在网络***中运行，可对本网络***的网络威胁事件进行评估，也可对其它网络***的网络威胁事件进行评估。
本实施例中，获取模块10首先获取基于目标***的威胁事件集，将获取的威胁事件集作为待评估威胁事件集。其中，该目标***可以是网络威胁事件评估装置部署的网络***，也可以是其它网络***。具体的，获取模块10在通过目标***的前置检测引擎获取到基于目标***的威胁事件集时，丢弃威胁事件集中不符合目标***约束的单一威胁事件，其中，获取模块10可以被动接收前置检测引擎推送的待评估威胁事件集，也可以主动从前置检测引擎拉取待评估威胁事件集；约束条件基于目标***设置，本实施例不作限定。
此外，本实施例并不限制前置检测引擎如何识别威胁事件，例如，前置检测引擎可基于其所在网络***的网络数据包或者会话，通过特征库比对方式识别威胁事件。
评估模块20，设置为在获取到所述待评估威胁事件集时，基于预设的事件关联因子和环境影响因子对所述待评估威胁事件集中的各单一威胁事件进行评估；
本实施例中，在获取模块10获取到待评估威胁事件集时，评估模块20基于预设的事件关联因子和环境影响因子对待评估威胁事件集中的各单一威胁事件进行评估，得到待评估事件集中各单一威胁事件的评估结果。
本领域技术人员可以理解的是，攻击者的入侵行为并不是独立的，而都是有所关联的。从攻击的角度出发，威胁事件之间的关联是指它们是同一个威胁事件行为所产生的，这种攻击行为包括单个简单攻击行为或由一系列攻击步骤组成的复杂攻击行为。事件关联技术是将各种数据来源进行综合分析，把分散的单一威胁事件关联起来，以给出完整的事件描述。
设威胁事件模型用E表示，则有:E＝(Attack-Id，Attack-Name，Attack-Precond， Attack-Postcond，Attack-Specif，Attack-Time，Attack-Respose)
其中，字段Attack-Id为攻击标志，表明攻击类型；Attack-Name为攻击名称；Attack-Precond为攻击前提，即攻击实施前所应该满足的条件集合；Attack-Postcond为攻击后果，即攻击实施后对网络***造成的所有可能影响的集合；Attack-Specif为攻击特征，即攻击报文的特征描述；Attack-Time为检测到攻击所发生时的时间；Attack-Respose为攻击响应，针对某个攻击，***所应采取的相应对策。由于Attack-Specif字段的数据来源主要是侦听到的网络攻击报文，因而可以进一步用一个六元组将其特征化。设一个报文用P表示，则有P＝(detect-id，source-ip，dest-ip，source-port，dest-port，payload)
其中，detect-id表示数据采集器的标识符；source-ip，dest-ip分别表示源、目的IP地址；source-port，dest-port分别表示源、目的端口号；payload表示有效载荷。在本实施例中，将“AttackPrecond”，“Attack-Postcond”和“Attack-Specif”字段作为威胁事件关联分析的依据。由于Attack-Precond和Attack-Postcond字段实质上描述了整个网络***的状态，因而很难用类似于N元组这类描述方法来将其特征化。在具体实施时，可以考虑采用XML语言和多元逻辑断言(Predicate)作为形式化描述的基础，并相应地进行扩展。例如，<Cond-Scenario>script(Action，‘winnuke$TargetAddress’)</Cond-Scenario>表示winnuke攻击发生的情景，及在这种情景下攻击者企图发动攻击的运行命令。
通常的，威胁事件的关联包括冗余关系关联和因果关系关联。
其中，冗余关系关联的分析方法主要是依据威胁事件Attack-Specif字段中相关属性之间的相似度，相似度采用概率统计的方法进行计算。
因果关系关联的分析方法主要基于威胁事件模型E的三个字段:Attack-Precond、Attack-Postcond和Attack-Specif。基本思想是:寻找一个威胁事件的前因(Attack-Precond)和另一个威胁事件的后果(Attack-Postcond)之间是否存在逻辑联系，如果存在联系，就表明这两个威胁事件是关联的。
基于前述事件关联的主旨思想，构建本实施例的事件关联因子，包括事件逻辑关联模型和关联条件等分析要素和分析方法。
此外，在本实施例中，还构建有环境影响因子，包括网络***内的主机环境模型以及网络环境模型和影响条件等分析要素和分析方法。
在本实施例中，评估模块20对单一威胁事件进行评估即判断单一威胁事件是否满足事件关联因子和/或环境影响因子，例如，评估模块20基于单一威胁事件的Attack-Specif中的4个有意义的属性加上Attack-Id字段属性判断该单一威胁事件是否符合事件逻辑关联模型，是则判定该单一威胁事件符合事件关联因子；评估模块20判断单一威胁事件的Attack-Postcond(攻击后果)是否符合网络***的主机环境模型和/或网络环境模型，是则判定该单一威胁事件符合环境影响因子。
本实施例中在进行事件关联因子的判定时，评估模块20可先进行冗余关系的分析,将重复的多个威胁事件归并聚类为一个威胁事件,再进行因果关系的分析,以减少不必要的重复计算，提升评估效率。
输出模块30，设置为输出所述待评估威胁事件集的评估结果。
本实施例中，在完成待评估威胁事件集中各单一威胁事件的评估之后，网络威胁事件评估装置输出评估结果。容易理解的是，基于前述关于评估的描述，由于存在评估时归并聚类的情况，输出的评估结果数量可能与待评估威胁事件集中单一威胁事件的数量不同。
本实施例中，由于待评估威胁事件集可来自网络威胁事件评估装置部署的网络***，也可来自其它网络***，输出模块30在输出评估结果时，可基于待评估威胁事件集的来源网络***进行输出，例如，若待评估威胁事件集来自本网络***，输出模块30则将评估结果输出至本网络***平台进行展示；若待评估威胁事件集来自其它网络***，输出模块30则将评估结果输出至来源网络***平台进行展示；或者，输出模块30将评估结果输出至预设的其它认可评估结果的输入接口。
本实施例提出的网络威胁事件评估装置，首先获取到待评估威胁事件集，然后基于预设的事件关联因子和环境影响因子对获取到的待评估威胁事件集中各单一威胁事件进行评估，得到威胁事件之间的关联，以及威胁事件与环境之间的关联，最后输出待评估威胁事件的评估结果，相较于相关技术，屏蔽了威胁事件的独立性所造成的不准确性，本公开的实施例能够提升网络威胁事件判定的准确性。
基于第一实施例，提出本公开网络威胁事件评估装置的第二实施例，参照图5，在本实施例中，所述网络威胁事件评估装置还包括：
调优模块40，设置为在所述获取模块10获取到所述待评估威胁事件集时，对获取的所述待评估威胁事件集进行调优处理；
所述评估模块20还设置为在所述调优模块40完成调优处理之后，基于预设的事件关联因子和环境影响因子对所述待评估威胁事件集中的各单一威胁事件进行评估。
本实施例中，为提升评估效率，调优模块40对获取模块10获取的待评估威胁事件集(即获取模块10基于目标***之约束过滤后的威胁事件集)进行调优处理，具体的，调优模块40提取获取的待评估威胁事件集中各单一威胁事件的关键向量；以及基于提取的各关键向量对获取的待评估威胁事件集中的单一威胁事件进行排序、统计以及归并聚类。
在本实施例中，调优模块40提取的关键向量至少包括Attack-Time(攻击时间，即检测到威胁事件所发生时的时间)、Attack-Name(攻击名称)、Attack-Specif(攻击特征)中的source-ip(源IP地址)，dest-ip(目的IP地址)，source-port(源端口)，dest-port(目的端口)以及Attack-Postcond(攻击后果)。在进行调优处理时，调优模块40可依据一个或多个关键向量进行排序与统计，如按照单一威胁事件的Attack- Time排序，按照单一威胁事件的Attack-Postcond排序，同一dest-ip的单一威胁事件的统计，同一Attack-Name的单一威胁事件的统计等。
在完成统计操作之后，调优模块40基于统计信息进行单一威胁事件的归并聚类，例如，将针对同一dest-ip的多次相同Attack-Name的单一威胁事件归并聚类处理为一条威胁事件，并记录重复次数。
可以理解的是，通过排序、统计以及归并聚类等调优处理，能够减少不必要重复计算，提升评估效率。
在本实施例中，调优模块40在排序时，基于提取的各单一威胁事件的攻击后果对所述待评估威胁事件集中的单一威胁事件进行排序。例如，调优模块40按照攻击后果的程度降序排列各单一威胁事件。
本领域技术人员可以理解的是，调优模块40进行的排序操作可在完成归并聚类操作之后进行，以避免重复排序。
基于第二实施例，提出本公开网络威胁事件评估装置的第三实施例，在本实施例中，所述评估模块20还设置为基于所述待评估威胁事件集的排序信息依次选中所述待评估威胁事件集中的单一威胁事件；以及在每次选中单一威胁事件时，判定选中的单一威胁事件是否满足所述事件关联因子，是则增加选中的单一威胁事件的置信度，判定选中的单一威胁事件是否满足所述环境影响因子，是则增加选中的单一威胁事件的置信度；以及在完成当次选中的单一威胁事件的判定操作之后，继续按顺序选中其它单一威胁事件。
在本实施例中，为高效的完成待评估威胁事件集中各单一威胁事件的评估，评估模块20基于调优处理的排序信息有序的对待评估威胁事件集中各单一威胁事件进行评估。
在一个示例性实施例中，评估模块20基于所述待评估威胁事件集的排序信息依次选中所述待评估威胁事件集中的单一威胁事件，例如，调优模块40在调优处理时按照各单一威胁事件攻击后果的程度降序排序，则评估模块20将首先选中待评估威胁事件集中攻击后果程度最大的单一威胁事件进行评估。
在每次选中单一威胁事件时，评估模块20判定选中的单一威胁事件是否满足所述事件关联因子，是则增加选中的单一威胁事件的置信度，否则不增加，例如，评估模块20可先进行冗余关系的分析,将重复的多个威胁事件归并聚类为一个威胁事件,再进行因果关系的分析，具体可参照第一实施例，此处不再赘述。需要说明的是，获取模块10在获取到待评估威胁事件集时，为待评估威胁事件集中各单一威胁事件分配有初始置信度，具体可基于待评估威胁事件集的来源前置检测引擎的检测性能进行初始置信度的分配，例如，若来源前置检测引擎的检测性能较高，则为对应该来源前置检测引擎的待评估威胁事件集分配较高的初始置信度；若来源前置检测引擎的检测性能较低，则为对应该来源前置检测引擎的待评估威胁事件集分配较低的初始置信 度。此外，评估模块20还判定选中的单一威胁事件是否满足所述环境影响因子，是则增加选中的单一威胁事件的置信度，否则不增加，例如，在选中单一威胁事件时，评估模块20判定选中的单一威胁事件的Attack-Postcond(攻击后果)是否符合目标***的主机环境模型和/或网络环境模型，是则判定该选中的单一威胁事件符合环境影响因子，并增加其置信度。
在本实施例中，输出模块30还设置为输出对待评估威胁事件集中各单一威胁事件进行评估后的置信度。
本领域内的技术人员应明白，本公开的实施例可提供为方法、***、或计算机程序产品。因此，本公开实施例可采用硬件实施例、软件实施例、或结合软件和硬件方面的实施例的形式。而且，本公开实施例可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器和光学存储器等)上实施的计算机程序产品的形式。
本公开是参照本公开实施例的方法、设备(***)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
例如，本公开的实施例还提供一种非临时性计算机可读存储介质，其中存储有指令，当一种网络威胁事件评估装置的一个或多个处理器执行所述指令时，所述网络威胁事件评估装置执行一种控制方法，所述方法包括：获取待评估威胁事件集；在获取到所述待评估威胁事件集时，基于预设的事件关联因子和环境影响因子对所述待评估威胁事件集中的各单一威胁事件进行评估；输出所述待评估威胁事件集的评估结果。
本公开实施例还提供一种网络威胁事件评估装置，包括：
处理器；
用于存储处理器的可执行指令的存储器；
其中，所述处理器被设置为：
获取待评估威胁事件集；
在获取到所述待评估威胁事件集时，基于预设的事件关联因子和环境影响因子对所述待评估威胁事件集中的各单一威胁事件进行评估；
输出所述待评估威胁事件集的评估结果。
工业实用性
本公开涉及网络安全技术领域，相较于相关技术，屏蔽了威胁事件的独立性所造成的不准确性，本公开能够提升网络威胁事件判定的准确性。
以上仅为本公开的优选实施例，并非因此限制本公开的专利范围，凡是利用本公开说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其他相关的技术领域，均同理包括在本公开的专利保护范围内。

Claims (10)

  1. 一种网络威胁事件评估方法，包括：
    获取待评估威胁事件集；
    在获取到所述待评估威胁事件集时，基于预设的事件关联因子和环境影响因子对所述待评估威胁事件集中的各单一威胁事件进行评估；
    输出所述待评估威胁事件集的评估结果。
  2. 根据权利要求1所述的网络威胁事件评估方法，其中，所述基于预设的事件关联因子和环境影响因子对所述待评估威胁事件集中的各单一威胁事件进行评估的步骤之前，所述方法还包括：
    在获取到所述待评估威胁事件集时，对获取的所述待评估威胁事件集进行调优处理；
    在完成调优处理之后，执行所述基于预设的事件关联因子和环境影响因子对所述待评估威胁事件集中的各单一威胁事件进行评估的步骤。
  3. 根据权利要求2所述的网络威胁事件评估方法，其中，对获取的所述待评估威胁事件集进行调优处理包括：
    提取获取的所述待评估威胁事件集中各单一威胁事件的关键向量；
    基于提取的各所述关键向量对获取的所述待评估威胁事件集中的单一威胁事件进行排序、统计以及归并聚类。
  4. 根据权利要求3所述的网络威胁事件评估方法，其中，所述关键向量至少包括单一威胁事件的攻击时间、源IP地址及端口、目的IP地址及端口、攻击名称以及攻击后果，所述基于提取的各所述关键向量对所述待评估威胁事件集中的单一威胁事件进行排序包括：
    基于提取的各单一威胁事件的攻击后果对所述待评估威胁事件集中的单一威胁事件进行排序。
  5. 根据权利要求3所述的网络威胁事件评估方法，其中，所述基于预设的事件关联因子和环境影响因子对所述待评估威胁事件集中的各单一威胁事件进行评估的步骤包括：
    基于所述待评估威胁事件集的排序信息依次选中所述待评估威胁事件集中的单一威胁事件；
    在每次选中单一威胁事件时，判定选中的单一威胁事件是否满足所述事件关联因子，是则增加选中的单一威胁事件的置信度，判定选中的单一威胁事件是否满足所述环境影响因子，是则增加选中的单一威胁事件的置信度；
    在完成当次选中的单一威胁事件的判定操作之后，继续按顺序选中其它单一威胁事件。
  6. 一种网络威胁事件评估装置，包括：
    获取模块，设置为获取待评估威胁事件集；
    评估模块，设置为在获取到所述待评估威胁事件集时，基于预设的事件关联因子和环境影响因子对所述待评估威胁事件集中的各单一威胁事件进行评估；
    输出模块，设置为输出所述待评估威胁事件集的评估结果。
  7. 根据权利要求6所述的网络威胁事件评估装置，还包括：
    调优模块，设置为在所述获取模块获取到所述待评估威胁事件集时，对获取的所述待评估威胁事件集进行调优处理；
    所述评估模块还设置为在所述调优模块完成调优处理之后，基于预设的事件关联因子和环境影响因子对所述待评估威胁事件集中的各单一威胁事件进行评估。
  8. 根据权利要求7所述的网络威胁事件评估装置，其中，所述调优模块还设置为提取获取的所述待评估威胁事件集中各单一威胁事件的关键向量；以及基于提取的各所述关键向量对获取的所述待评估威胁事件集中的单一威胁事件进行排序、统计以及归并聚类。
  9. 根据权利要求8所述的网络威胁事件评估装置，其中，所述关键向量至少包括单一威胁事件的攻击时间、源IP地址及端口、目的IP地址及端口、攻击名称以及攻击后果，所述调优模块还设置为基于提取的各单一威胁事件的攻击后果对所述待评估威胁事件集中的单一威胁事件进行排序。
  10. 根据权利要求8所述的网络威胁事件评估装置，其中，所述评估模块还设置为基于所述待评估威胁事件集的排序信息依次选中所述待评估威胁事件集中的单一威胁事件；以及在每次选中单一威胁事件时，判定选中的单一威胁事件是否满足所述事件关联因子，是则增加选中的单一威胁事件的置信度，判定选中的单一威胁事件是否满足所述环境影响因子，是则增加选中的单一威胁事件的置信度；以及在完成当次选中的单一威胁事件的判定操作之后，继续按顺序选中其它单一威胁事件。
PCT/CN2017/076305 2016-03-11 2017-03-10 网络威胁事件评估方法及装置 WO2017152877A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610141483.6A CN107181726A (zh) 2016-03-11 2016-03-11 网络威胁事件评估方法及装置
CN201610141483.6 2016-03-11

Publications (1)

Publication Number Publication Date
WO2017152877A1 true WO2017152877A1 (zh) 2017-09-14

Family

ID=59788978

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/076305 WO2017152877A1 (zh) 2016-03-11 2017-03-10 网络威胁事件评估方法及装置

Country Status (2)

Country Link
CN (1) CN107181726A (zh)
WO (1) WO2017152877A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110768950A (zh) * 2019-08-14 2020-02-07 奇安信科技集团股份有限公司 渗透指令的发送方法及装置、存储介质、电子装置
CN112615888A (zh) * 2020-12-30 2021-04-06 绿盟科技集团股份有限公司 一种网络攻击行为的威胁评估方法及装置
CN113691552A (zh) * 2021-08-31 2021-11-23 上海观安信息技术股份有限公司 威胁情报有效性评估方法、装置、***及计算机存储介质
CN114465783A (zh) * 2022-01-19 2022-05-10 北京启明星辰信息安全技术有限公司 攻击点与业务报文的关联方法、关联***及存储介质
CN114726623A (zh) * 2022-04-08 2022-07-08 北京天融信网络安全技术有限公司 一种高级威胁攻击评估方法、装置、电子设备及存储介质

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107911231B (zh) * 2017-10-25 2020-12-25 北京神州绿盟信息安全科技股份有限公司 一种威胁数据的评估方法及装置
CN108712374A (zh) * 2018-04-03 2018-10-26 郑州云海信息技术有限公司 一种请求控制方法、控制器及电子设备
CN110881016B (zh) * 2018-09-05 2021-06-01 华为技术有限公司 一种网络安全威胁评估方法及装置
CN112181781B (zh) * 2020-10-15 2022-09-20 新华三信息安全技术有限公司 主机安全威胁程度的告警方法、装置、设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101222317A (zh) * 2007-11-29 2008-07-16 哈尔滨工程大学 一种深度优先的攻击图生成方法
CN101562537A (zh) * 2009-05-19 2009-10-21 华中科技大学 分布式自优化入侵检测报警关联***
CN102075516A (zh) * 2010-11-26 2011-05-25 哈尔滨工程大学 一种网络多步攻击识别和预测方法
CN102638445A (zh) * 2011-12-27 2012-08-15 中国航天科工集团第二研究院七〇六所 一种反馈式多步网络攻击智能检测方法及装置
CN105141598A (zh) * 2015-08-14 2015-12-09 中国传媒大学 基于恶意域名检测的apt攻击检测方法及装置

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101399698A (zh) * 2007-09-30 2009-04-01 华为技术有限公司 一种安全管理***、装置和方法
CN102098180B (zh) * 2011-02-17 2013-10-16 华北电力大学 一种网络安全态势感知方法
US8904531B1 (en) * 2011-06-30 2014-12-02 Emc Corporation Detecting advanced persistent threats
AU2014205737B2 (en) * 2013-01-08 2016-01-28 Secure-Nok As Method, device and computer program for monitoring an industrial control system

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101222317A (zh) * 2007-11-29 2008-07-16 哈尔滨工程大学 一种深度优先的攻击图生成方法
CN101562537A (zh) * 2009-05-19 2009-10-21 华中科技大学 分布式自优化入侵检测报警关联***
CN102075516A (zh) * 2010-11-26 2011-05-25 哈尔滨工程大学 一种网络多步攻击识别和预测方法
CN102638445A (zh) * 2011-12-27 2012-08-15 中国航天科工集团第二研究院七〇六所 一种反馈式多步网络攻击智能检测方法及装置
CN105141598A (zh) * 2015-08-14 2015-12-09 中国传媒大学 基于恶意域名检测的apt攻击检测方法及装置

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110768950A (zh) * 2019-08-14 2020-02-07 奇安信科技集团股份有限公司 渗透指令的发送方法及装置、存储介质、电子装置
CN112615888A (zh) * 2020-12-30 2021-04-06 绿盟科技集团股份有限公司 一种网络攻击行为的威胁评估方法及装置
CN112615888B (zh) * 2020-12-30 2022-08-12 绿盟科技集团股份有限公司 一种网络攻击行为的威胁评估方法及装置
CN113691552A (zh) * 2021-08-31 2021-11-23 上海观安信息技术股份有限公司 威胁情报有效性评估方法、装置、***及计算机存储介质
CN113691552B (zh) * 2021-08-31 2023-04-07 上海观安信息技术股份有限公司 威胁情报有效性评估方法、装置、***及计算机存储介质
CN114465783A (zh) * 2022-01-19 2022-05-10 北京启明星辰信息安全技术有限公司 攻击点与业务报文的关联方法、关联***及存储介质
CN114465783B (zh) * 2022-01-19 2024-03-26 北京启明星辰信息安全技术有限公司 攻击点与业务报文的关联方法、关联***及存储介质
CN114726623A (zh) * 2022-04-08 2022-07-08 北京天融信网络安全技术有限公司 一种高级威胁攻击评估方法、装置、电子设备及存储介质
CN114726623B (zh) * 2022-04-08 2023-11-28 北京天融信网络安全技术有限公司 一种高级威胁攻击评估方法、装置、电子设备及存储介质

Also Published As

Publication number Publication date
CN107181726A (zh) 2017-09-19

Similar Documents

Publication Publication Date Title
WO2017152877A1 (zh) 网络威胁事件评估方法及装置
US11159542B2 (en) Cloud view detection of virtual machine brute force attacks
US9419996B2 (en) Detection and prevention for malicious threats
CN112866023B (zh) 网络检测、模型训练方法、装置、设备及存储介质
CN111859400A (zh) 风险评估方法、装置、计算机***和介质
Mahmood et al. Intrusion detection system based on K-star classifier and feature set reduction
Xiao et al. From patching delays to infection symptoms: Using risk profiles for an early discovery of vulnerabilities exploited in the wild
RU2757597C1 (ru) Системы и способы сообщения об инцидентах компьютерной безопасности
Khosravi et al. Alerts correlation and causal analysis for APT based cyber attack detection
CN117081858B (zh) 一种基于多决策树入侵行为检测方法、***、设备及介质
Vadrevu et al. Maxs: Scaling malware execution with sequential multi-hypothesis testing
RU2610395C1 (ru) Способ расследования распределенных событий компьютерной безопасности
WO2017113948A1 (zh) 一种实现样本分析的方法、装置及动态引擎设备
RU148692U1 (ru) Система мониторинга событий компьютерной безопасности
CN114531283B (zh) 入侵检测模型的鲁棒性测定方法、***、存储介质及终端
Yang et al. {PROGRAPHER}: An Anomaly Detection System based on Provenance Graph Embedding
Silva et al. Attackers are not stealthy: Statistical analysis of the well-known and infamous KDD network security dataset
CN107920067B (zh) 一种主动对象存储***上的入侵检测方法
RU180789U1 (ru) Устройство аудита информационной безопасности в автоматизированных системах
Wen et al. Detecting and predicting APT based on the study of cyber kill chain with hierarchical knowledge reasoning
JP2018160170A (ja) 出力プログラム、情報処理装置、出力方法、生成プログラム、及び生成方法
Kumar et al. Detection of malware using deep learning techniques
CN112287340A (zh) 用于终端攻击的取证溯源方法、装置、计算机设备
CN114205146A (zh) 一种多源异构安全日志的处理方法及装置
Hao et al. AutoMal: automatic clustering and signature generation for malwares based on the network flow

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17762563

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 17762563

Country of ref document: EP

Kind code of ref document: A1