WO2021136317A1 - 一种基于组织内部邮件日志分析的安全可视化方法及*** - Google Patents

一种基于组织内部邮件日志分析的安全可视化方法及*** Download PDF

Info

Publication number
WO2021136317A1
WO2021136317A1 PCT/CN2020/141128 CN2020141128W WO2021136317A1 WO 2021136317 A1 WO2021136317 A1 WO 2021136317A1 CN 2020141128 W CN2020141128 W CN 2020141128W WO 2021136317 A1 WO2021136317 A1 WO 2021136317A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
mail
analysis
information
internal
Prior art date
Application number
PCT/CN2020/141128
Other languages
English (en)
French (fr)
Inventor
林延中
朱南皓
杨芸
潘文辉
伍燕宝
彭文浩
Original Assignee
论客科技（广州）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 论客科技（广州）有限公司 filed Critical 论客科技（广州）有限公司
Publication of WO2021136317A1 publication Critical patent/WO2021136317A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/10—File systems; File servers
    • G06F16/18—File system types
    • G06F16/182—Distributed file systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/21—Design, administration or maintenance of databases
    • G06F16/214—Database migration support
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/24—Querying
    • G06F16/245—Query processing
    • G06F16/2458—Special types of queries, e.g. statistical queries, fuzzy queries or distributed queries
    • G06F16/2471—Distributed queries
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/24—Querying
    • G06F16/248—Presentation of query results
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L51/00—User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
    • H04L51/42—Mailbox-related aspects, e.g. synchronisation of mailboxes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection

Definitions

  • the invention belongs to the technical field of network security, and in particular relates to a security visualization method and system based on analysis of internal mail logs of an organization.
  • email is basically configured by various organizational units. As a result, email has always been the hardest hit area for network security threats. Incidents such as data leakage, network attacks, Trojan horse virus intrusion, and internal espionage attacks caused by emails are numerous.
  • the purpose of the present invention is to provide a security visualization system based on the analysis of the internal mail log of the organization, through mining and judging and analyzing the multi-dimensional data of the mail log, and visually presenting the behavior of the internal personnel of the organization, which can effectively threaten the hidden dangers of the internal personnel. Behavior investigation.
  • an embodiment of the present invention provides a security visualization method based on analysis of an organization's internal mail log, including:
  • the data cleaning includes:
  • the mail log data is cleaned through the Spark data processing module, and the cleaned mail log data is stored in the distributed file system; wherein, the cleaning operation includes: Split, de-duplicate and fill default values of mail log data;
  • S2 data transmission, the data transmission includes:
  • Data storage where the data storage includes:
  • Distributed search and analysis engine is used to realize full-text search and analysis of stored data, and relational database is used for associated aggregation analysis of mail log data and as a back-end data interface that provides front-end data visualization;
  • the data processing includes:
  • the front-end visual presentation component is used to visualize the icon presentation, and output the internal personnel portrait after the in-depth analysis of the mail log.
  • the internal person portrait includes: a word cloud information diagram drawn according to the subject of an internal person’s email over a period of time, a time dimension-based email system access information diagram of the internal person, and statistical information about the spam and malicious email received by the internal person Figure.
  • the security visualization method based on the analysis of an organization's internal mail log further includes:
  • an embodiment of the present invention provides a security visualization system based on the analysis of an organization's internal mail log, including:
  • Data cleaning module data transmission module, data storage module, data processing module and data visualization module
  • the data cleaning module is used to store the mail log data generated within the organization into the distributed system of the big data analysis platform on a daily basis, according to the set security threats mining analysis requirements, through the Spark data processing module Performing a cleaning operation on the mail log data, and storing the cleaned mail log data in a distributed file system; wherein, the cleaning operation includes: splitting, deduplicating, and filling default values of the mail log data;
  • the data transmission module is used to use a data migration tool to transmit relevant preprocessed data from the distributed file system to a relational database; wherein, relevant data tables and fields need to be defined in advance;
  • Data storage module used to store all kinds of security logs related to mail logs, use distributed search analysis engine to realize full-text search and analysis of stored data, and use relational database for association aggregation analysis and provision of mail log data Back-end data interface for front-end data visualization;
  • the data processing module is used to analyze and count the time information involved in the mail log, IP information sent and received, the communication force of the sender and receiver, login information, subject word cloud, received and sent spam malicious mail information, and attachment information, and the processed information
  • the data is stored in a relational database to facilitate the call of visual presentation;
  • Data visualization module used to visualize icons based on email subject, sender and receiver relationship, IP address, domain name information, login system equipment, and time through the use of front-end visual presentation components to visualize icon presentations, and output internal staff portraits after in-depth analysis of email logs .
  • the internal person portrait includes: a word cloud information diagram drawn according to the subject of an internal person’s email over a period of time, a time dimension-based email system access information diagram of the internal person, and statistical information about the spam and malicious email received by the internal person Figure.
  • the security visualization system based on the analysis of the organization's internal mail log further includes:
  • the data processing module is also used to perform overall statistics on the internal mail logs of the organization, and obtain overall statistical information of the internal mail logs of the organization, so that the data visualization module can display the overall statistical information of the internal logs of the organization.
  • Hadoop is used as the big data analysis platform
  • Hadoop HDFS is used as the distributed system
  • Sqoop is used as the data migration tool
  • ElasticSearch is used as the distributed search analysis engine
  • MySQL is used as the relationship Type database
  • the visual presentation components include Echarts, Highcharts, inMap, D3 and AntV.
  • the embodiment of the present invention analyzes the multi-dimensional data of the mail log by mining and judging, and visually presents the behavior of the internal personnel of the organization, and effectively realizes the investigation of the hidden network security threat behavior of the internal personnel.
  • the embodiment of the present invention only focuses on analysis and mining of mail log data, and does not need to analyze log data other than mail log data, which reduces the difficulty and time-consuming analysis of multi-dimensional heterogeneous data, and improves work efficiency.
  • the mail data analyzed by the embodiment of the present invention has diversity, so that the effective integration analysis and visualization of the whole and the individual can be realized.
  • the target object of the embodiment of the present invention has universal applicability.
  • FIG. 1 is a schematic flowchart of a security visualization method based on analysis of an organization's internal mail log provided by an embodiment of the present invention
  • FIG. 2 is a schematic diagram of word cloud information drawn according to the subject of an internal person's email within a period of time according to a preferred embodiment of the present invention
  • FIG. 3 is a time-based mail system access information diagram for internal personnel provided by a preferred embodiment of the present invention.
  • Fig. 5 is a diagram of a network guiding diagram of an internal staff mail receiving and sending association relationship provided by a preferred embodiment of the present invention.
  • step numbers used in the text are only for the convenience of description, and are not used as a limitation on the order of execution of the steps.
  • an embodiment of the present invention provides a security visualization method based on analysis of an organization's internal mail log, including:
  • the data cleaning includes:
  • the mail log data is cleaned through the Spark data processing module, and the cleaned mail log data is stored in the distributed file system; wherein, the cleaning operation includes: Split, de-duplicate and fill default values of mail log data;
  • an organization refers to a collective or group that people cooperate with each other to achieve a certain goal, such as a party group organization, a trade union organization, an enterprise, a military organization, a school, and so on.
  • the narrow organization refers specifically to the crowd, and is used in social management.
  • organizations are social groups organized by people according to certain goals, tasks and forms.
  • S2 data transmission, the data transmission includes:
  • Data storage where the data storage includes:
  • Distributed search and analysis engine is used to realize full-text search and analysis of stored data, and relational database is used for associated aggregation analysis of mail log data and as a back-end data interface that provides front-end data visualization;
  • the data processing includes:
  • the front-end visual presentation component is used to visualize the icon presentation, and output the internal personnel portrait after the in-depth analysis of the mail log.
  • a word cloud information map drawn according to the subject of an internal staff’s email over a period of time a time dimension-based mail system access information map of internal staff, and statistics on spam and malicious mail received by internal staff infogram.
  • Figure 2 is a schematic diagram of word cloud information drawn by an insider's email subject over a period of time. The principle is that the most frequent topic is centered in the word cloud graph and the font is larger; based on this view, it can be effectively analyzed The degree of attention of insiders to daily things reflected in email communication over a period of time.
  • Figure 3 shows an information diagram of internal staff access to the mail system based on the time dimension, including login time, IP address, login method, and login result information; based on this view, it can be effective from the data successfully connected to the system Analyze the usage habits of statisticians, analyze the reasons (external cracks, attacks, etc.) from the data of login failures, effectively compare abnormal behaviors, and carry out targeted protection.
  • Figure 4 is a statistical information diagram of malicious spam received by insiders, including dimensions such as date, malicious spam characteristics, source IP, number of occurrences, and classification. Based on this view, it can help analyze and judge the degree of external intrusion, and can also pick out key personnel for security defense education and enhancement of the underlying technical defense language.
  • the security visualization method based on the analysis of the organization's internal mail log further includes:
  • the overall statistical information of the internal mail log of the organization includes: internal personnel mail sending and receiving association relationship information, spam malicious mail statistics information according to the filled quantity, spam malicious identification classification information, and account statistics information of the hardest-hit areas of security threats.
  • the internal staff’s mail receiving and sending association relationship information is displayed in the form of a relationship network oriented graph, please refer to Figure 5.
  • Figure 5 shows the internal staff’s mail receiving and sending association relationship network oriented diagram; where each node represents one person, and the line represents two Communication between people. In addition, the higher the frequency, the color of the line becomes darker and thicker. Nodes with more sending and receiving times usually indicate that they are important personnel within the organization, and the size of their nodes is also larger. At the same time, there are teams or departments focusing on different businesses within the organization, so they will There is a clustering effect; based on this view, it is convenient to analyze and observe the overall mail communication status within the organization, and to discover possible abnormal behaviors through the change trend of the communication status.
  • Hadoop is used as the big data analysis platform
  • Hadoop's HDFS is used as the distributed system
  • Sqoop is used as the data migration tool
  • ElasticSearch is used as the distributed search analysis engine.
  • MySQL as the relational database
  • the visual presentation components include Echarts, Highcharts, inMap, D3 and AntV.
  • ElasticSearch is a search and analysis engine for massive data, which mainly performs full-text search and analysis on what kind of data is stored.
  • MySQL is one of the dimensions of data imported into the Hadoop big data analysis platform.
  • the present invention does not limit the big data analysis platform to only Hadoop, the distributed system only to HDFS, the data migration tool only to Sqoop, the distributed search analysis engine to only ElasticSearch, and the
  • the relational database is only MySQL, and the visual presentation components only include Echarts, Highcharts, inMap, D, and AntV.
  • the above-mentioned embodiment is only a preferred embodiment of the present invention.
  • the embodiment of the present invention also provides a security visualization system based on the analysis of an organization's internal mail log, including:
  • Data cleaning module data transmission module, data storage module, data processing module and data visualization module
  • the data cleaning module is used to store the mail log data generated within the organization into the distributed system of the big data analysis platform on a daily basis, according to the set security threats mining analysis requirements, through the Spark data processing module Performing a cleaning operation on the mail log data, and storing the cleaned mail log data in a distributed file system; wherein, the cleaning operation includes: splitting, deduplicating, and filling default values of the mail log data;
  • an organization refers to a collective or group that people cooperate with each other to achieve a certain goal, such as a party group organization, a trade union organization, an enterprise, a military organization, a school, and so on.
  • the narrow organization refers specifically to the crowd, and is used in social management.
  • organizations are social groups organized by people according to certain goals, tasks and forms.
  • the data transmission module is used to use a data migration tool to transmit relevant preprocessed data from the distributed file system to a relational database; wherein, relevant data tables and fields need to be defined in advance;
  • Data storage module used to store all kinds of security logs related to mail logs, use distributed search analysis engine to realize full-text search and analysis of stored data, and use relational database for association aggregation analysis and provision of mail log data Back-end data interface for front-end data visualization;
  • the data processing module is used to analyze and count the time information involved in the mail log, IP information sent and received, the communication force of the sender and receiver, login information, subject word cloud, received and sent spam malicious mail information, and attachment information, and the processed information
  • the data is stored in a relational database to facilitate the call of visual presentation;
  • Data visualization module used to visualize icons based on email subject, sender and receiver relationship, IP address, domain name information, login system equipment, and time through the use of front-end visual presentation components to visualize icon presentations, and output internal staff portraits after in-depth analysis of email logs .
  • a word cloud information graph drawn based on the subject of an internal staff’s emails over a period of time a time-based mail system access information graph of internal staff, and statistical information about spam and malicious mail received by internal staff Figure.
  • Figure 2 is a schematic diagram of word cloud information drawn by an insider's email subject over a period of time. The principle is that the most frequent topic is centered in the word cloud graph and the font is larger; based on this view, it can be effectively analyzed The degree of attention of insiders to daily things reflected in email communications over a period of time.
  • Figure 3 shows an information diagram of internal staff access to the mail system based on the time dimension, including login time, IP address, login method, and login result information; based on this view, it can be effective from the data successfully connected to the system Analyze the usage habits of statisticians, analyze the reasons (external cracks, attacks, etc.) from the data of login failures, effectively compare abnormal behaviors, and carry out targeted protection.
  • Figure 4 is a statistical information diagram of malicious spam received by insiders, including dimensions such as date, malicious spam characteristics, source IP, number of occurrences, and classification. Based on this view, it can help analyze and judge the degree of external intrusion, and can also pick out key personnel for security defense education and enhancement of the underlying technical defense language.
  • the data processing module is also used to perform overall statistics on the internal mail log of the organization to obtain the overall statistical information of the internal mail log of the organization, In order to enable the data visualization module to display the overall statistical information of the internal log of the organization.
  • the internal staff’s mail receiving and sending association relationship information is displayed in the form of a relationship network oriented graph, please refer to Figure 5.
  • Figure 5 shows the internal staff’s mail receiving and sending association relationship network oriented diagram; where each node represents one person, and the line represents two Communication between people. In addition, the higher the frequency, the color of the line becomes darker and thicker. Nodes with more sending and receiving times usually indicate that they are important personnel within the organization, and the size of their nodes is also larger. At the same time, there are teams or departments focusing on different businesses within the organization, so they will There is the effect of clustering and clustering; based on this view, it is convenient to analyze and observe the overall mail communication status within the organization, and discover possible abnormal behaviors through the change trend of the communication status.
  • Hadoop is used as the big data analysis platform
  • Hadoop's HDFS is used as the distributed system
  • Sqoop is used as the data migration tool
  • ElasticSearch is used as the distributed search analysis engine.
  • MySQL as the relational database
  • the visual presentation components include Echarts, Highcharts, inMap, D3 and AntV.
  • ElasticSearch is a search and analysis engine for massive data, which mainly performs full-text search and analysis on what kind of data is stored.
  • MySQL is one of the dimensions of data imported into the Hadoop big data analysis platform.
  • the present invention does not limit the big data analysis platform to only Hadoop, the distributed system only to HDFS, the data migration tool only to Sqoop, the distributed search analysis engine to only ElasticSearch, and the
  • the relational database is only MySQL, and the visual presentation components are only Echarts, Highcharts, inMap, D3 and AntV.
  • the above-mentioned embodiment is only a preferred embodiment of the present invention.
  • the embodiment of the present invention analyzes the multi-dimensional data of the mail log by mining and judging, and visually presents the behavior of the internal personnel of the organization, and effectively realizes the investigation of the hidden network security threat behavior of the internal personnel.
  • the embodiment of the present invention only focuses on analysis and mining of mail log data, and does not need to analyze log data other than mail log data, which reduces the difficulty and time-consuming analysis of multi-dimensional heterogeneous data, and improves work efficiency.
  • the mail data analyzed in the embodiment of the present invention is diverse, so that the effective integration analysis and visualization of the whole and the individual can be realized.
  • the target object of the embodiment of the present invention has universal applicability.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Data Mining & Analysis (AREA)
  • Computational Linguistics (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computer Security & Cryptography (AREA)
  • Fuzzy Systems (AREA)
  • Mathematical Physics (AREA)
  • Probability & Statistics with Applications (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

一种基于组织内部邮件日志分析的安全可视化方法及统，方法包括：数据清洗（S1）、数据传输（S2）、数据存储（S3）、数据处理（S4）以及数据可视化（S5）。通过挖掘研判分析邮件日志的多维数据，并以可视化方式呈现组织内部人员的行为，有效实现内部人员网络安全威胁隐患行为的排查。采用仅聚焦邮件日志数据分析挖掘的方式，无需分析除邮件日志数据以外的日志数据，减少了多维异构数据的分析难度耗时，提升工作效率。由于分析的邮件数据具备多样性，从而能够实现整体与个体的有效融合分析可视化，且几乎每个组织都会使用邮件沟通，因而上述方法的目标对象具备普遍性。

Description

一种基于组织内部邮件日志分析的安全可视化方法及*** 技术领域
本发明属于网络安全技术领域，尤其涉及一种基于组织内部邮件日志分析的安全可视化方法及***。
背景技术
随着互联网的飞速发展，通过网络所承载的各类生产、生活等活动已成为日常不可缺少的环节。随着不断演进的网络攻击手段和传统网络安全边界的逐渐模糊，导致了日益严峻的网络安全形势。针对当下网络所面临的各类内外部安全威胁隐患，我们迫切需要对网络中的安全威胁行为进行识别和应对。
邮件作为最基础的应用，各组织单位基本上都会有所配置，因此造成邮件一直都是网络安全威胁的重灾区。通过邮件导致的数据泄密、网络攻击、木马病毒入侵、内部间谍攻击等事件不胜枚举。
针对邮件安全的传统的防御分析手段都是侧重对外攻击的防御，比如过滤检测垃圾恶意邮件行为，但对于组织内部人员通过邮件渠道遭到的安全威胁以及内部违规越界行为却无法进行有效的监测。
发明内容
本发明的目的在于提供一种基于组织内部邮件日志分析的安全可视化***，通过挖掘研判分析邮件日志的多维数据，并以可视化方式呈现组织内部人员的行为，能够有效地对内部人员的安全威胁隐患行为进行排查。
第一方面，本发明实施例提供一种基于组织内部邮件日志分析的安全可视化方法，包括：
S1、数据清洗，所述数据清洗包括：
将组织内部产生的邮件日志数据以天为单位向大数据分析平台的分布式***中存入；
根据设定的安全威胁隐患挖掘分析需求，通过Spark数据处理模块对所述邮件日志数据进行清洗操作，并将清洗后的邮件日志数据存储在分布式文件***中；其中，所述清洗操作包括：对邮件日志数据进行拆分、去重和缺省值填充；
S2、数据传输，所述数据传输包括：
采用数据迁移工具从分布式文件***中将相关的经预处理后的数据传输到关系型数据库；其中，相关的数据表和字段需提前进行定义；
S3、数据存储，所述数据存储包括：
存储邮件日志关联到的各类安全日志；
采用分布式搜索分析引擎实现对存储的数据进行全文搜索和分析，以及采用关系型数据库用于邮件日志数据的关联聚合分析和作为提供前端数据可视化的后端数据接口；
S4、数据处理，所述数据处理包括：
对邮件日志涉及到的时间信息、收发IP信息、收发人通信力导向图、登录信息、主题词云、接收发送垃圾恶意邮件信息以及附件信息进行分析统计，并把处理后数据存入关系型数据库，以便于可视化呈现的调用；
S5、数据可视化，所述数据可视化包括：
基于邮件主题、收发件人关联关系、IP地址、域名信息、登录***设备以及时间通过使用前端可视化呈现组件进行可视化的图标呈现，输出围绕邮件日志深度分析后的内部人员画像。
进一步地，所述内部人员画像包括：根据某内部人员一段时间内邮件主题所绘制的词云信息图、内部人员的基于时间维度的邮件***接入信息图和内部人员接收到垃圾恶意邮件统计信息图。
进一步地，所述基于组织内部邮件日志分析的安全可视化方法，还包括：
对组织内部邮件日志进行整体统计，获取组织内部邮件日志的整体统计信息，并以可视化的形式展示，包括：内部人员邮件收发关联关系信息图，垃圾恶意邮件按填的数量统计信息图、垃圾恶意识别分类信息图和安全威胁重灾区的账户统计信息图。
进一步地，将Hadoop作为所述大数据分析平台，将Hadoop的HDFS作为所述分布式***，将Sqoop作为所述数据迁移工具，将ElasticSearch作为所述分布式搜索分析引擎，将MySQL作为所述关系型数据库；所述可视化呈现组件包括Echarts、Highcharts、inMap、D3和AntV。第二方面，本发明实施例提供一种基于组织内部邮件日志分析的安全可视化***，包括：
数据清洗模块，数据传输模块、数据存储模块、数据处理模块以及数据可视化模块
所述数据清洗模块，用于将组织内部产生的邮件日志数据以天为单位向大数据分析平台的分布式***中存入，根据设定的安全威胁隐患挖掘分析需求，通过Spark数据处理模块对所述邮件日志数据进行清洗操作，将清洗后的邮件日志数据存储在分布式文件***中；其中，所述清洗操作包括：对邮件日志数据进行拆分、去重和缺省值填充；
所述数据传输模块，用于采用数据迁移工具从分布式文件系中将相关的经预处理后的数据传输到关系型数据库；其中，相关的数据表和字段需提前进行定义；
数据存储模块，用于存储邮件日志关联到的各类安全日志、采用分布式搜索分析引擎实现对存储的数据进行全文搜索和分析以及采用关系型数据库用于邮件日志数据的关联聚合分析和作为提供前端数据可视化的后端数据接口；
数据处理模块，用于对邮件日志涉及到的时间信息、收发IP信息、收发人通信力导向图、登录信息、主题词云、接收发送垃圾恶意邮件信息以及附件信息进行分析统计，并把处理后数据存入关系型数据库，以便于可视化呈现的调用；
数据可视化模块，用于基于邮件主题、收发件人关联关系、IP地址、域名信息、登录***设备以及时间通过使用前端可视化呈现组件进行可视化的图标呈现，输出围绕邮件日志深度分析后的内部人员画像。
进一步地，所述内部人员画像包括：根据某内部人员一段时间内邮件主题所绘制的词云信息图、内部人员的基于时间维度的邮件***接入信息图和内部人员接收到垃圾恶意邮件统计信息图。
进一步地，所述基于组织内部邮件日志分析的安全可视化***，还包括：
所述数据处理模块还用于对组织内部邮件日志进行整体统计，获取组织内部邮件日志的整体统计信息，以使所述数据可视化模块对所述组织内部日志的整体统计信息进行展示。
进一步地，将Hadoop作为所述大数据分析平台，将Hadoop的HDFS作为所述分布式***，将Sqoop作为所述数据迁移工具，将ElasticSearch作为所述分布式搜索分析引擎，将MySQL作为所述关系型数据库；所述可视化呈现组件包括Echarts、Highcharts、inMap、D3和AntV。
相对于现有技术，本发明实施例具备以下有益效果：
(1)本发明实施例通过挖掘研判分析邮件日志的多维数据，并以可视化方式呈现组织内部人员的行为，有效实现内部人员网络安全威胁隐患行为的排查。
(2)本发明实施例仅聚焦邮件日志数据分析挖掘，无需分析除邮件日志数据以外的日志数据，减少了多维异构数据的分析难度耗时，提升工作效率。
(3)本发明实施例分析的邮件数据具备多样性，从而能够实现整体与个体的有效融合分析可视化。
(4)由于几乎每个组织都会使用邮件沟通，本发明实施例的目标对象具备普适性。
附图说明
图1为本发明实施例提供的一种基于组织内部邮件日志分析的安全可视化方法的流程示意图；
图2为本发明一个优选实施例提供的根据某内部人员一段时间内邮件主题所绘制的词云信息示意图；
图3为本发明一个优选实施例提供的内部人员基于时间维度的邮件***接入信息图；
图4为本发明一个优选实施例提供的内部人员接收到垃圾恶意邮件统计信息图；
图5为本发明一个优选实施例提供的内部人员邮件收发关联关系网络导向图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
术语“包括”和“包含”指示所描述特征、整体、步骤、操作、元素和/或组件的存在，但并不排除一个或多个其它特征、整体、步骤、操作、元素、组件和/或其集合的存在或添加。
术语“和/或”是指相关联列出的项中的一个或多个的任何组合以及所有可能组合，并且包括这些组合。
需要说明的是，文中所使用的步骤编号仅是为了方便描述，不对作为对步骤执行先后顺序的限定。
请参阅图1，本发明实施例提供一种基于组织内部邮件日志分析的安全可视化方法，包括：
S1、数据清洗，所述数据清洗包括：
将组织内部产生的邮件日志数据以天为单位向大数据分析平台的分布式***中存入；
根据设定的安全威胁隐患挖掘分析需求，通过Spark数据处理模块对所述邮件日志数据进行清洗操作，并将清洗后的邮件日志数据存储在分布式文件***中；其中，所述清洗操作包括：对邮件日志数据进行拆分、去重和缺省值填充；
在本发明实施例中，组织是指人们为实现一定的目标，互相协作结合而成的集体或团体，如党团组织、工会组织、企业、军事组织、学校等等。狭义的组织专门指人群而言，运用于社会管理之中。在现代社会生活中.组织是人们按照一定的目的、任务和形式编制起来的社会集团。
S2、数据传输，所述数据传输包括：
采用数据迁移工具从分布式文件系中将相关的经预处理后的数据传输到关系型数据库；其中，相关的数据表和字段需提前进行定义；
S3、数据存储，所述数据存储包括：
存储邮件日志关联到的各类安全日志；
采用分布式搜索分析引擎实现对存储的数据进行全文搜索和分析，以及采用关系型数据库用于邮件日志数据的关联聚合分析和作为提供前端数据可视化的后端数据接口；
S4、数据处理，所述数据处理包括：
对邮件日志涉及到的时间信息、收发IP信息、收发人通信力导向图、登录信息、主题词云、接收发送垃圾恶意邮件信息以及附件信息进行分析统计，并把处理后数据存入关系型数据库，以便于可视化呈现的调用。
S5、数据可视化，所述数据可视化包括：
基于邮件主题、收发件人关联关系、IP地址、域名信息、登录***设备以及时间通过使用前端可视化呈现组件进行可视化的图标呈现，输出围绕邮件日志深度分析后的内部人员画像。
对于内部人员画像，具体的，可包括：根据某内部人员一段时间内邮件主题所绘制的词云信息图、内部人员的基于时间维度的邮件***接入信息图和内部人员接收到垃圾恶意邮件统计信息图。
请参阅图2，图2为表示某内部人员一段时间内邮件主题所绘制的词云信息示意图，其原理是频次高的主题在词云图中位置居中且字体越大；基于该视图，可以有效分析内部人员在一段时间内的通过邮件通信所反映出来的日常事物关注度。
请参阅图3，图3展示内部人员基于时间维度的邮件***接入信息图，包含登录的时间、IP地址、登录方式以及登录结果信息；基于该视图，可从成功接入***的数据中有效分析统计人员的使用习惯，从登录失败的数据中分析原因(外部破解、攻击等)，有效对比异常行为，开展有针对性的防护。
请参阅图4，图4为内部人员接收到垃圾恶意邮件统计信息图，包括日期、垃圾恶意特征、来源IP、出现次数以及研判分类等维度。基于该视图能够帮助分析和判断受外部侵扰的程度，还能够挑出重点关注的人员进行安全防御教育以及底层技术防御措辞的增强。
在其中一种优选的实施例中，所述基于组织内部邮件日志分析的安全可视化方法，还包括；
对组织内部邮件日志进行整体统计，获取组织内部邮件日志的整体统计信息，并以可视化的形式展示。
所述组织内部邮件日志的整体统计信息包括：内部人员邮件收发关联关系信息，垃圾恶意邮件按填的数量统计信息、垃圾恶意识别分类信息和安全威胁重灾区的账户统计信息。
其中，内部人员邮件收发关联关系信息通过以关系网络导向图的形式进行展示，请参阅图5，图5展示内部人员邮件收发关联关系网络导向图；其中每个节点代表一个人员，线代表两个人员彼此间的通信。此外，频次越高线条的颜色加深并***，收发次数较多的节点通常表明是组织内部重要的人员，其节点的大小也越大；同时组织内部有聚焦不同业务的团队或者部门，因此会存在分簇聚类的效果；基于该视图便于分析观察组织内部整体的邮件通信状态，并通过通信状态的改变趋势挖掘可能存在的异常行为。
在其中一种优选的实施例中，将Hadoop作为所述大数据分析平台，将Hadoop的HDFS作为所述分布式***，将Sqoop作为所述数据迁移工具，将ElasticSearch作为所述分布式搜索分析引擎，将MySQL作为所述关系型数据库；所述可视化呈现组件包括Echarts、Highcharts、inMap、D3和AntV。
在本发明实施例中，ElasticSearch是一个针对海量数据的一个搜索分析引擎，主要是对于存储的何种数据进行全文搜索和分析。MySQL作为导入到Hadoop大数据分析平台的其中一个维度的数据。
需要说明的是，本发明并不限制所述大数据分析平台仅为Hadoop、所述分布式***仅为HDFS、所述数据迁移工具仅为Sqoop、所述分布式搜索分析引擎仅为ElasticSearch、所述关系型数据库仅为MySQL，所述可视化呈现组件仅包括Echarts、Highcharts、inMap、D和AntV。上述实施例只是本发明一个优选的实施例。
本发明实施例还提供一基于组织内部邮件日志分析的安全可视化***，包括：
数据清洗模块，数据传输模块、数据存储模块、数据处理模块以及数据可视化模块
所述数据清洗模块，用于将组织内部产生的邮件日志数据以天为单位向大数据分析平台的分布式***中存入，根据设定的安全威胁隐患挖掘分析需求，通过Spark数据处理模块对所述邮件日志数据进行清洗操作，将清洗后的邮件日志数据存储在分布式文件***中；其中，所述清洗操作包括：对邮件日志数据进行拆分、去重和缺省值填充；
在本发明实施例中，组织是指人们为实现一定的目标，互相协作结合而成的集体或团体，如党团组织、工会组织、企业、军事组织、学校等等。狭义的组织专门指人群而言，运用于社会管理之中。在现代社会生活中.组织是人们按照一定的目的、任务和形式编制起来的社会集团。
所述数据传输模块，用于采用数据迁移工具从分布式文件系中将相关的经预处理后的数据传输到关系型数据库；其中，相关的数据表和字段需提前进行定义；
数据存储模块，用于存储邮件日志关联到的各类安全日志、采用分布式搜索分析引擎实现对存储的数据进行全文搜索和分析以及采用关系型数据库用于邮件日志数据的关联聚合分析和作为提供前端数据可视化的后端数据接口；
数据处理模块，用于对邮件日志涉及到的时间信息、收发IP信息、收发人通信力导向图、登录信息、主题词云、接收发送垃圾恶意邮件信息以及附件信息进行分析统计，并把处理后数据存入关系型数据库，以便于可视化呈现的调用；
数据可视化模块，用于基于邮件主题、收发件人关联关系、IP地址、域名信息、登录***设备以及时间通过使用前端可视化呈现组件进行可视化的图标呈现，输出围绕邮件日志深度分析后的内部人员画像。
对于内部人员画像，具体的，包括：根据某内部人员一段时间内邮件主题所绘制的词云信息图、内部人员的基于时间维度的邮件***接入信息图和内部人员接收到垃圾恶意邮件统计信息图。
请参阅图2，图2为表示某内部人员一段时间内邮件主题所绘制的词云信息示意图，其原理是频次高的主题在词云图中位置居中且字体越大；基于该视图，可以有效分析内部人员一段时间内的通过邮件通信所反映出来的日常事物关注度。
请参阅图3，图3展示内部人员基于时间维度的邮件***接入信息图，包含登录的时间、IP地址、登录方式以及登录结果信息；基于该视图，可从成功接入***的数据中有效分析统计人员的使用习惯，从登录失败的数据中分析原因(外部破解、攻击等)，有效对比异常行为，开展有针对性的防护。
请参阅图4，图4为内部人员接收到垃圾恶意邮件统计信息图，包括日期、垃圾恶意特征、来源IP、出现次数以及研判分类等维度。基于该视图能够帮助分析和判断受外部侵扰的程度，还能够挑出重点关注的人员进行安全防御教育以及底层技术防御措辞的增强。
在其中一种优选的实施例中，所述基于组织内部邮件日志分析的安全可视化***，所述数据处理模块还用于对组织内部邮件日志进行整体统计，获取组织内部邮件日志的整体统计信息，以使所述数据可视化模块对所述组织内部日志的整体统计信息进行展示。
其中，内部人员邮件收发关联关系信息通过以关系网络导向图的形式进行展示，请参阅图5，图5展示内部人员邮件收发关联关系网络导向图；其中每个节点代表一个人员，线代表两个人员彼此间的通信。此外，频次越高线条的颜色加深并***，收发次数较多的节点通常表明是组织内部重要的人员，其节点的大小也越大；同时组织内部有聚焦不同业务的团队或者部门，因此会存在分簇聚类的效果；基于该视图便于分析观察组织内部整体的邮件通信状态，并通过通信状态的改变趋势挖掘可能存在的异常行为。
在其中一种优选的实施例中，将Hadoop作为所述大数据分析平台，将Hadoop的HDFS作为所述分布式***，将Sqoop作为所述数据迁移工具，将ElasticSearch作为所述分布式搜索分析引擎，将MySQL作为所述关系型数据库；所述可视化呈现组件包括Echarts、Highcharts、inMap、D3和AntV。
在本发明实施例中，ElasticSearch是一个针对海量数据的一个搜索分析引擎，主要是对于存储的何种数据进行全文搜索和分析。MySQL作为导入到Hadoop大数据分析平台的其中一个维度的数据。
需要说明的是，本发明并不限制所述大数据分析平台仅为Hadoop、所述分布式***仅为HDFS、所述数据迁移工具仅为Sqoop、所述分布式搜索分析引擎仅为ElasticSearch、所述关系型数据库仅为MySQL，所述可视化呈现组件仅为Echarts、Highcharts、inMap、D3和AntV。上述实施例只是本发明一个优选的实施例。
相对于现有技术，本发明实施例具备以下有益效果：
(1)本发明实施例通过挖掘研判分析邮件日志的多维数据，并以可视化方式呈现组织内部人员的行为，有效实现内部人员网络安全威胁隐患行为的排查。
(2)本发明实施例仅聚焦邮件日志数据分析挖掘，无需分析除邮件日志数据以外的日志数据，减少了多维异构数据的分析难度耗时，提升工作效率。
(3)本发明实施例分析的邮件数据具备多样性，从而能够实现整体与个体的有效 融合分析可视化。
(4)由于几乎每个组织都会使用邮件沟通，本发明实施例的目标对象具备普适性。
本领域技术人对于本技术领域的普通技术人员来说，在不脱离本发明原理的前提下，还可以做出若干改进和润饰，这些改进和润饰也视为本发明的保护范围。

Claims (8)

  1. 一种基于组织内部邮件日志分析的安全可视化方法，包括：
    S1、数据清洗，所述数据清洗包括：
    将组织内部产生的邮件日志数据以天为单位向大数据分析平台的分布式***中存入；
    根据设定的安全威胁隐患挖掘分析需求，通过Spark数据处理模块对所述邮件日志数据进行清洗操作，并将清洗后的邮件日志数据存储在分布式文件***中；其中，所述清洗操作包括：对邮件日志数据进行拆分、去重和缺省值填充；
    S2、数据传输，所述数据传输包括：
    采用数据迁移工具从分布式文件***中将相关的经预处理后的数据传输到关系型数据库；其中，相关的数据表和字段需提前进行定义；
    S3、数据存储，所述数据存储包括：
    存储邮件日志关联到的各类安全日志；
    采用分布式搜索分析引擎实现对存储的数据进行全文搜索和分析，以及采用关系型数据库用于邮件日志数据的关联聚合分析和作为提供前端数据可视化的后端数据接口；
    S4、数据处理，所述数据处理包括：
    对邮件日志涉及到的时间信息、收发IP信息、收发人通信力导向图、登录信息、主题词云、接收发送垃圾恶意邮件信息以及附件信息进行分析统计，并把处理后数据存入关系型数据库，以便于可视化呈现的调用；
    S5、数据可视化，所述数据可视化包括：
    基于邮件主题、收发件人关联关系、IP地址、域名信息、登录***设备以及时间通过使用前端可视化呈现组件进行可视化的图标呈现，输出围绕邮件日志深度分析后的内部人员画像。
  2. 根据权利要求1所述的基于组织内部邮件日志分析的安全可视化方法，其特征在于，所述内部人员画像包括：根据某内部人员一段时间内邮件主题所绘制的词云信息图、内部人员的基于时间维度的邮件***接入信息图和内部人员接收到垃圾恶意邮件统计信息图。
  3. 根据权利要求1或2所述的基于组织内部邮件日志分析的安全可视化方法，其特征在于，还包括；
    对组织内部邮件日志进行整体统计，获取组织内部邮件日志的整体统计信息，并以可视化的形式展示，包括：内部人员邮件收发关联关系信息图，垃圾 恶意邮件按填的数量统计信息图、垃圾恶意识别分类信息图和安全威胁重灾区的账户统计信息图。
  4. 根据权利要求3所述的基于组织内部邮件日志分析的安全可视化方法，其特征在于，将Hadoop作为所述大数据分析平台，将Hadoop的HDFS作为所述分布式***，将Sqoop作为所述数据迁移工具，将ElasticSearch作为所述分布式搜索分析引擎，将MySQL作为所述关系型数据库；所述可视化呈现组件包括Echarts、Highcharts、inMap、D3和AntV。
  5. 一种基于组织内部邮件日志分析的安全可视化***，包括：
    数据清洗模块，数据传输模块、数据存储模块、数据处理模块以及数据可视化模块
    所述数据清洗模块，用于将组织内部产生的邮件日志数据以天为单位向大数据分析平台的分布式***中存入，根据设定的安全威胁隐患挖掘分析需求，通过Spark数据处理模块对所述邮件日志数据进行清洗操作，将清洗后的邮件日志数据存储在分布式文件***中；其中，所述清洗操作包括：对邮件日志数据进行拆分、去重和缺省值填充；
    所述数据传输模块，用于采用数据迁移工具从分布式文件系中将相关的经预处理后的数据传输到关系型数据库；其中，相关的数据表和字段需提前进行定义；
    数据存储模块，用于存储邮件日志关联到的各类安全日志、采用分布式搜索分析引擎实现对存储的数据进行全文搜索和分析以及采用关系型数据库用于邮件日志数据的关联聚合分析和作为提供前端数据可视化的后端数据接口；
    数据处理模块，用于对邮件日志涉及到的时间信息、收发IP信息、收发人通信力导向图、登录信息、主题词云、接收发送垃圾恶意邮件信息以及附件信息进行分析统计，并把处理后数据存入关系型数据库，以便于可视化呈现的调用；
    数据可视化模块，用于基于邮件主题、收发件人关联关系、IP地址、域名信息、登录***设备以及时间通过使用前端可视化呈现组件进行可视化的图标呈现，输出围绕邮件日志深度分析后的内部人员画像。
  6. 根据权利要求5所述的基于组织内部邮件日志分析的安全可视化***，其特征在于，所述内部人员画像包括：根据某内部人员一段时间内邮件主题所绘制的词云信息图、内部人员的基于时间维度的邮件***接入信息图和内部人员接收到垃圾恶意邮件统计信息图。
  7. 根据权利要求5或6所述的基于组织内部邮件日志分析的安全可视化***，其特征在于，所述数据处理模块还用于对组织内部邮件日志进行整体统计，获取组织内部邮件日志的整体统计信息，以使所述数据可视化模块对所述组织内部日志的整体统计信息进行展示。
  8. 根据权利要求7所述的基于组织内部邮件日志分析的安全可视化***，其特征在于，将Hadoop作为所述大数据分析平台，将Hadoop的HDFS作为所述分布式***，将Sqoop作为所述数据迁移工具，将ElasticSearch作为所述分布式搜索分析引擎，将MySQL作为所述关系型数据库；所述可视化呈现组件包括Echarts、Highcharts、inMap、D3和AntV。
PCT/CN2020/141128 2019-12-30 2020-12-29 一种基于组织内部邮件日志分析的安全可视化方法及*** WO2021136317A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201911422763.4 2019-12-30
CN201911422763.4A CN111177108A (zh) 2019-12-30 2019-12-30 一种基于组织内部邮件日志分析的安全可视化方法及***

Publications (1)

Publication Number Publication Date
WO2021136317A1 true WO2021136317A1 (zh) 2021-07-08

Family

ID=70654325

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/141128 WO2021136317A1 (zh) 2019-12-30 2020-12-29 一种基于组织内部邮件日志分析的安全可视化方法及***

Country Status (2)

Country Link
CN (1) CN111177108A (zh)
WO (1) WO2021136317A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114281911A (zh) * 2021-12-10 2022-04-05 北芯导航技术(南京)有限公司 一种地理信息与大数据的信息交换平台

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111177108A (zh) * 2019-12-30 2020-05-19 论客科技（广州）有限公司 一种基于组织内部邮件日志分析的安全可视化方法及***

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070239587A1 (en) * 2006-04-07 2007-10-11 Axiom Software Laboratories, Inc. System and Method For Dynamically Utilizing and Managing Financial, Operational, and Compliance Data
CN101325520A (zh) * 2008-06-17 2008-12-17 南京邮电大学 基于日志的智能自适应网络故障定位和分析方法
US20090106843A1 (en) * 2007-10-18 2009-04-23 Pil-Yong Kang Security risk evaluation method for effective threat management
CN108769048A (zh) * 2018-06-08 2018-11-06 武汉思普崚技术有限公司 一种安全可视化与态势感知平台***
CN108833397A (zh) * 2018-06-08 2018-11-16 武汉思普崚技术有限公司 一种基于网络安全的大数据安全分析平台***
CN109299044A (zh) * 2018-07-20 2019-02-01 浙江工业大学 一种基于公司内部日志的安全可视化分析***
CN109885562A (zh) * 2019-01-17 2019-06-14 安徽谛听信息科技有限公司 一种基于网络空间安全的大数据智能分析***
CN111177108A (zh) * 2019-12-30 2020-05-19 论客科技（广州）有限公司 一种基于组织内部邮件日志分析的安全可视化方法及***

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070239587A1 (en) * 2006-04-07 2007-10-11 Axiom Software Laboratories, Inc. System and Method For Dynamically Utilizing and Managing Financial, Operational, and Compliance Data
US20090106843A1 (en) * 2007-10-18 2009-04-23 Pil-Yong Kang Security risk evaluation method for effective threat management
CN101325520A (zh) * 2008-06-17 2008-12-17 南京邮电大学 基于日志的智能自适应网络故障定位和分析方法
CN108769048A (zh) * 2018-06-08 2018-11-06 武汉思普崚技术有限公司 一种安全可视化与态势感知平台***
CN108833397A (zh) * 2018-06-08 2018-11-16 武汉思普崚技术有限公司 一种基于网络安全的大数据安全分析平台***
CN109299044A (zh) * 2018-07-20 2019-02-01 浙江工业大学 一种基于公司内部日志的安全可视化分析***
CN109885562A (zh) * 2019-01-17 2019-06-14 安徽谛听信息科技有限公司 一种基于网络空间安全的大数据智能分析***
CN111177108A (zh) * 2019-12-30 2020-05-19 论客科技（广州）有限公司 一种基于组织内部邮件日志分析的安全可视化方法及***

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114281911A (zh) * 2021-12-10 2022-04-05 北芯导航技术(南京)有限公司 一种地理信息与大数据的信息交换平台

Also Published As

Publication number Publication date
CN111177108A (zh) 2020-05-19

Similar Documents

Publication Publication Date Title
US10798116B2 (en) External malware data item clustering and analysis
US9965937B2 (en) External malware data item clustering and analysis
US7996374B1 (en) Method and apparatus for automatically correlating related incidents of policy violations
US20190361843A1 (en) System and Method for Performing Similarity Search Queries in a Network
US8271597B2 (en) Intelligent derivation of email addresses
US8341232B2 (en) Relationship identification based on email traffic
WO2021136317A1 (zh) 一种基于组织内部邮件日志分析的安全可视化方法及***
US20120011245A1 (en) Monitoring communications
US20060282303A1 (en) Distributed organizational analyzer
US20050154601A1 (en) Information security threat identification, analysis, and management
US20130081065A1 (en) Dynamic Multidimensional Schemas for Event Monitoring
US9344390B1 (en) Systems and methods for electronic document review
US8856135B2 (en) Intelligent sorting and correlation of email traffic
Purohit et al. Data leakage analysis on cloud computing
EP3926503A1 (en) Dynamically providing cybersecurity training based on user-specific threat information
Elyashar et al. Guided socialbots: Infiltrating the social networks of specific organizations’ employees
US8854372B2 (en) Consolidation and visualization of a set of raw data corresponding to a communication between a person of interest and a correspondent across a plurality of mediums of communication
Li et al. Email archive analysis through graphical visualization
Brown et al. SANS 2022 cyber threat intelligence survey
US20110078175A1 (en) Auditing Search Requests in a Relationship Analysis System
US11227112B2 (en) Contributions collection based on parsed electronic communications by a QA system which generates a reply indicating a contributor, their contribution and a confidence level
US8832049B2 (en) Monitoring communications
Barnhill Cloud Computing and Stored Communications: Another Look at Quon v. Arch Wireless
Fuchs et al. Sans 2019 threat hunting survey: The differing needs of new and experienced hunters
Zehnalova et al. Email conversation network analysis: Work groups and teams in organizations

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20911082

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20911082

Country of ref document: EP

Kind code of ref document: A1