CN115883223A - Method and device for generating user risk profile, electronic device, storage medium - Google Patents

Abstract

The invention discloses a method and a device for generating a user risk portrait, electronic equipment and a storage medium. Wherein, the method comprises the following steps: receiving a network event data set, wherein the data type in the network event data set comprises at least one of the following: flow data, risk events and vulnerability information, wherein each piece of data in the network event data set is associated with a I P address; associating each piece of data with user information in an online user list based on the I P address, and determining network risk data associated with each user object; and generating a user risk portrait corresponding to the user object based on the risk behavior label corresponding to the network risk data. The invention solves the technical problem that correlation analysis of network attack behaviors cannot be accurately performed in the scene of user authentication internet surfing and dynamic I P allocation when network risk assessment is performed in the related technology.

Description

Method and device for generating user risk profile, electronic device, storage medium

technical field

The present invention relates to the field of network security, in particular to a method and device for generating a user risk profile, electronic equipment, and a storage medium.

Background technique

With the rapid development of network technology, the importance of network security has gradually become prominent, and situational awareness has begun to show its prominence in the field of network security. The threat situation of assets, and the risk status of network assets), so that network security managers can timely discover the information of lost and high-risk assets according to the assessment results of the security status of network assets, and carry out targeted protection and processing.

In related technologies, when evaluating network risks for situational awareness products, the basic process is: collect data such as traffic, network threats, and vulnerability scanning information sent by security devices and user terminals in the network, standardize the data, and then Correlation analysis is performed on the effective information in order to discover attack activities, and on this basis to identify the source and type of the attack activities. The above-mentioned network risk assessment method is to associate each risk event in the network according to the IP address, and count the threats for a single IP. Risk information such as incidents and vulnerabilities collects together the behaviors of launching or being attacked by network threats on the same IP address, and evaluates and analyzes the health status of network assets.

However, the above-mentioned network risk assessment method has the following disadvantages: In the scenario of remote user billing and authentication, such as campus network and enterprise network, end users access the network through personal accounts, and then dynamically assign IP addresses through DHCP or other services. The same IP address is often allocated to different devices used by different users in different time periods, which makes network security managers unable to discover the correlation between risk events in time, locate the actual responsible person of risk assets, and maintain risk assets in a timely manner manage.

For the above problems, no effective solution has been proposed yet.

Contents of the invention

Embodiments of the present invention provide a user risk profile generation method and device, electronic equipment, and storage media to at least solve the problem of inaccurate identification of user authentication and dynamic IP allocation in the context of network risk assessment in related technologies. Technical issues related to network attack behavior analysis.

According to an aspect of an embodiment of the present invention, a method for generating a user risk profile is provided, which is applied to a situation awareness platform in a network security system, including: receiving a network event data set, wherein the data in the network event data set The type includes at least one of the following: traffic data, risk events and vulnerability information, and each piece of data in the network event data set is associated with an IP address; based on the IP address, each piece of data is associated with the user in the online user list Information is associated to determine the network risk data associated with each user object, wherein the network risk data of different dimensions corresponds to a risk behavior label; based on the risk behavior label corresponding to the network risk data, a corresponding user object is generated A user risk profile, wherein the user risk profile is used to evaluate the health status of the network assets of the user object.

Optionally, the online user list is generated by the following method: receiving N authentication and accounting messages, wherein the authentication and accounting messages are traffic reports generated by different user objects through the remote network in the charging and authentication Internet access scenario text, N is a positive integer greater than or equal to 1; the IP address, user ID, physical address, user status and time stamp obtained by parsing the authentication and accounting message, wherein the user status includes: online, offline and Billing update; based on the IP address, the user identifier, the physical address, the user status and the timestamp, construct the online user list; associate different IP addresses in the online user list The user identification and user status of the user are maintained to update the user information in the online user list.

Optionally, after receiving the network event data set, it also includes: extracting the data features of each piece of data in the network event data set; filtering out the data whose data features indicate conforming to the network risk feature set, to obtain the network risk data set ; storing the network risk data set and the online user list in a distributed database.

Optionally, the method for generating a user risk profile further includes: using an attack chain detection engine to match network attack behavior patterns according to user information of multiple network event data, determine complex threat events, and extract events of the complex threat events characteristics; using a traffic detection engine to perform traffic analysis and abnormal behavior analysis on the network traffic of each user object, and determine the traffic risk characteristics and abnormal behavior characteristics; the event characteristics of the complex threat event, the traffic risk characteristics and all The set of abnormal behavior features is the set of network risk features.

Optionally, after associating each piece of data with user information in the online user list based on the IP address and determining the network risk data associated with each user object, it includes: indicating the data feature as a complex threat event The data of the threat event is assigned an attack type label, and the event level of the complex threat event is determined; the data characteristic indicated as vulnerability information is assigned a vulnerability information level; the data characteristic indicates that the number of passwords is lower than the preset number threshold The data is assigned a weak password identifier; based on the threat event attack type label, the event level, the vulnerability information level and the weak password identifier, determine the network behavior risk level of the user object.

Optionally, after associating each piece of data with the user information in the online user list based on the IP address and determining the network risk data associated with each user object, it includes: using the user object generated by the terminal device Each type of threat event and the scanned vulnerability information establish an event correlation relationship; when the event correlation relationship indicates that a threat event targeting a target vulnerability occurs on the terminal device, the user object is marked as a compromised user, and all The above terminal devices are marked as risky terminal devices.

Optionally, after generating the user risk profile corresponding to the user object based on the risk behavior label corresponding to the network risk data, including: displaying the list of risk users with the network risk data and the list of risk users in the list of risk users The user risk profile of each user object; and/or, display the network access status of each user object, the number of risky terminal devices held, the number of network attacks and the type of network attack.

According to another aspect of the embodiments of the present invention, there is also provided a device for generating a user risk profile, which is applied to a situation awareness platform in a network security system, including: a receiving unit, configured to receive a network event data set, wherein the The data types in the network event data set include at least one of the following: traffic data, risk events, and vulnerability information, and each piece of data in the network event data set is associated with an IP address; a determination unit is configured to The address associates each piece of data with the user information in the online user list, and determines the network risk data associated with each user object, wherein the network risk data of different dimensions corresponds to a risky behavior label; the generation unit is used to base on The risk behavior tag corresponding to the network risk data generates a user risk profile corresponding to the user object, wherein the user risk profile is used to evaluate the health status of the user object's network assets.

Optionally, the determining unit includes: a first receiving module, configured to receive N authentication and accounting messages, wherein the authentication and accounting messages are generated by different user objects through a remote network in the scenario of charging and authenticating Internet access traffic packets, N is a positive integer greater than or equal to 1; the first parsing module is used to parse the authentication and accounting packets to obtain IP addresses, user identifiers, physical addresses, user statuses, and timestamps, wherein the The user state includes: online, offline, and billing update; a first building module, configured to build the Online user list; a first maintenance module, configured to maintain user IDs and user states associated with different IP addresses in the online user list, so as to update user information in the online user list.

Optionally, the device for generating a user risk profile further includes: a first extraction module, configured to extract data features of each piece of data in the network event data set; a first screening module, configured to filter out the data features Indicating the data conforming to the network risk feature set to obtain a network risk data set; a first storage module, configured to store the network risk data set and the online user list in a distributed database.

Optionally, the device for generating a user risk profile further includes: a first determining module, configured to use an attack chain detection engine to match network attack behavior patterns according to user information of multiple network event data, determine complex threat events, and extract all Describe the event characteristics of the complex threat event; the second determination module is used to use the traffic detection engine to perform traffic analysis and abnormal behavior analysis on the network traffic of each user object, and determine the traffic risk characteristics and abnormal behavior characteristics; the first integration module , configured to integrate the event feature of the complex threat event, the traffic risk feature, and the abnormal behavior feature into the network risk feature set.

Optionally, the device for generating a user risk profile further includes: a third determining module, configured to assign a threat event attack type label to the data whose data feature indicates a complex threat event, and determine an event of the complex threat event Level; the first indication module is used to assign the data whose data characteristics indicate vulnerability information to the vulnerability information level; the first identification module is used to assign the data whose data characteristics indicate that the number of passwords is lower than the preset number threshold to weak Password identification; a fourth determination module, configured to determine the network behavior risk level of the user object based on the threat event attack type label, the event level, the vulnerability information level and the weak password identification.

Optionally, the device for generating a user risk profile further includes: a first establishment module, configured to establish an event correlation relationship between various types of threat events generated by the user object using terminal equipment and the scanned vulnerability information; A module configured to mark the user object as a compromised user and mark the terminal device as a risky terminal device when the event correlation indicates that a threat event targeting a target vulnerability occurs on the terminal device.

Optionally, the device for generating a user risk profile further includes: a first display module, configured to display a list of risky users with the network risk data and a user risk profile of each user object in the list of risky users; And/or, the second display module is used to display the network access status of each user object, the number of risk terminal devices held, the number of network attacks suffered, and the types of network attacks.

According to another aspect of the embodiments of the present invention, there is also provided an electronic device, including: a processor; and a memory for storing executable instructions of the processor; wherein, the processor is configured to execute the Instructions can be executed to execute any one of the methods for generating user risk profiles.

According to another aspect of the embodiments of the present invention, there is also provided a computer-readable storage medium, the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the computer-readable storage medium is controlled The device executes any one of the methods for generating a user risk profile.

In this disclosure, the following steps are adopted: receiving a network event data set, wherein the data types in the network event data set include at least one of the following: traffic data, risk events, and vulnerability information, and each piece of data in the network event data set is Associated with an IP address, each piece of data is associated with the user information in the online user list based on the IP address, and the network risk data associated with each user object is determined. Among them, network risk data of different dimensions correspond to risky behavior labels, based on The risk behavior label corresponding to the network risk data generates a user risk profile corresponding to the user object, wherein the user risk profile is used to evaluate the health status of the user object's network assets.

In this disclosure, when the situational awareness platform collects risk events, vulnerability information, and traffic data, the above risk data is associated with user information according to user authentication and billing message information, and then stored, and then risk behavior labels are established based on data of different dimensions , create a user risk profile, and accurately correlate network attack behaviors through the user risk profile to directly locate specific users and notify users in time to maintain network security, thereby solving the problem of network risk assessment in related technologies. In the scenario of user authentication to access the Internet and dynamic IP allocation, there is a technical problem that it is impossible to accurately correlate and analyze network attack behaviors.

In this disclosure, the online user information table is maintained by receiving and analyzing the original RADI US message, enriching the original flow data of the situation awareness platform and the detected threat vulnerability information, and under this condition, correlation analysis is performed through the user and host dimensions to detect network risk events.

In this disclosure, in the scenario of user authentication and dynamic IP allocation, multi-stage network attack activities can be prevented, the correlation between risk events can be found in time, the actual responsible person of risk assets can be located, and risk assets can be timely Perform maintenance management.

Description of drawings

The accompanying drawings described here are used to provide a further understanding of the present invention and constitute a part of the application. The schematic embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations to the present invention. In the attached picture:

FIG. 1 is a flowchart of an optional method for generating a user risk profile according to an embodiment of the present invention;

FIG. 2 is a schematic diagram of an optional user risk profile generation system architecture according to an embodiment of the present invention;

Fig. 3 is a schematic diagram of an optional device for generating a user risk profile according to an embodiment of the present invention;

Fig. 4 is a hardware structural block diagram of an electronic device (or mobile device) according to a method for generating a user risk profile according to an embodiment of the present invention.

Detailed ways

In order to enable those skilled in the art to better understand the solutions of the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only It is an embodiment of a part of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts shall fall within the protection scope of the present invention.

It should be noted that the terms "first" and "second" in the description and claims of the present invention and the above drawings are used to distinguish similar objects, but not necessarily used to describe a specific sequence or sequence. It is to be understood that the data so used are interchangeable under appropriate circumstances such that the embodiments of the invention described herein can be practiced in sequences other than those illustrated or described herein. Furthermore, the terms "comprising" and "having", as well as any variations thereof, are intended to cover a non-exclusive inclusion, for example, a process, method, system, product or device comprising a sequence of steps or elements is not necessarily limited to the expressly listed instead, may include other steps or elements not explicitly listed or inherent to the process, method, product or apparatus.

In order to facilitate those skilled in the art to understand the present invention, some terms or nouns involved in the various embodiments of the present invention are explained below:

RADI US, a distributed, client/server (Client/Server) structured information interaction protocol, specifies the process and message format for transferring user information and billing information between the client and the server, and its purpose is to complete user Authentication, authorization, and accounting functions.

Kafka, a high-throughput distributed publish-subscribe messaging system, can handle all action stream data of consumers in the website.

DGA domain name, the full name is Domain Generation Aigor itm, a domain name with high randomness generated by DGA algorithm.

C&C server, the abbreviation of control l&command server, command and control server, used to control the host, responsible for processing information, the central machine of issuing tasks.

SMB protocol, where the full name of SMB is Server Message Block, the network protocol name, can be used for Web connection and information communication between client and server, in session layer (sess ion layer) and presentation layer (presentation layer) and A small part of the application layer (app li cation layer) communication protocol.

It should be noted that the relevant information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this disclosure are authorized by the user. Or information and data fully authorized by the parties. For example, there is an interface between this system and relevant users or institutions. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or institution through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or institution. information.

The present invention can be applied to various situation awareness systems/products/devices, and provides a user risk behavior portrait method in the remote user billing and authentication online scenario. When the situation awareness platform collects or detects risk events, vulnerability information, and traffic data, According to user authentication and billing message information, these risk data are associated with user information and stored, and then risk behavior labels are established based on data of different dimensions, user risk portraits are created, and the overall health status of each user's network asset security risk is evaluated and displayed , in the scenario of user authentication and dynamic IP allocation, it can accurately correlate network attack behaviors and obtain specific users, so as to remind users to prevent network attacks in time.

New types of advanced threats will adopt different network attack behaviors at different stages. During the attack implementation process, network security products use multi-dimensional detection technologies such as intrusion detection, virus filtering, unknown threat detection, anti-spam, and correlation analysis. Behavior detection and discovery, so that a series of mitigation and protection measures can be taken in real time. Once advanced threats have penetrated through certain technologies and entered the post-attack stage, risk asset location and abnormal behavior can be located through network traffic analysis, abnormal behavior analysis and other technologies. Judgment, traceability and evidence collection, etc. In the scenario of remote user authentication and billing to access the Internet (such as a campus network, users may use the same mobile terminal or different terminal devices to access the campus network through a wired or wireless network in the dormitory area or laboratory area), due to the existence of dynamic IP allocation scenarios and Due to the different allocation of IP segments in different venues, it is difficult to completely and effectively correlate network events only through the IP information of the original network traffic.

Based on the generated user risk profile, the present invention can more comprehensively detect and discover risk events in the network, assist network security managers to trace the source of threat events in the user dimension, and timely discover users with high network behavior risk levels, and locate corresponding staff.

The present invention will be described in detail below in conjunction with various embodiments.

Embodiment one

According to an embodiment of the present invention, an embodiment of a method for generating a user risk profile is provided. It should be noted that the steps shown in the flow chart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, Also, although a logical order is shown in the flowcharts, in some cases the steps shown or described may be performed in an order different from that shown or described herein.

Fig. 1 is a flow chart of an optional method for generating a user risk profile according to an embodiment of the present invention. As shown in Fig. 1, the method includes the following steps:

Step S102, receiving a network event data set, wherein the data types in the network event data set include at least one of the following: traffic data, risk events, and vulnerability information, and each piece of data in the network event data set is associated with an IP address;

Step S104, associate each piece of data with the user information in the online user list based on the IP address, and determine the network risk data associated with each user object, wherein the network risk data of different dimensions correspond to risky behavior labels;

Step S106, based on the risk behavior tags corresponding to the network risk data, generate a user risk profile corresponding to the user object, wherein the user risk profile is used to evaluate the health status of the user object's network assets.

Through the above steps, the network event data set is first received, wherein the data types in the network event data set include at least one of the following: traffic data, risk events, and vulnerability information, and each piece of data in the network event data set is associated with an IP address, and then associate each piece of data with the user information in the online user list based on the IP address to determine the network risk data associated with each user object. Among them, network risk data of different dimensions correspond to risky behavior labels, and finally based on The risk behavior label corresponding to the risk data generates a user risk profile corresponding to the user object, wherein the user risk profile is used to evaluate the health status of the user object's network assets. In this embodiment, when the situational awareness platform collects risk events, vulnerability information, and traffic data, it associates the above risk data with user information according to user authentication and billing message information and stores them, and then establishes risk behaviors based on data of different dimensions Tags, create user risk profiles, and accurately correlate network attack behaviors through the user risk profiles to directly locate specific users and notify users in time to maintain network security, thereby solving the problem of network risk assessment in related technologies. In the scenario of user authentication to access the Internet and dynamic IP allocation, there is a technical problem that it is impossible to accurately correlate network attack behaviors.

This embodiment will be described in detail below in conjunction with the above implementation steps.

It should be noted that the implementation subject of the embodiment of the present invention is the situational awareness platform, and the generation system of the user risk profile is deployed on the situational awareness platform. The situational awareness platform can be connected with various servers (for example, RADI US authentication server). Relevant information can be transmitted to the situational awareness platform through the server, and the user risk profile generation system receives valid information to generate a user risk profile.

In many local area network environments, the IP addresses of user terminals are dynamically assigned, and users may use different terminals to access the network, or carry the same mobile terminal device to access the network in different venues, use VPN channels to access the internal network, etc. The corresponding relationship between IP addresses, terminal devices, and users is constantly changing, which interferes with the judgment of network attack activities of the situational awareness platform and the assessment of the risk status of network assets. User authentication to access the Internet is a wide range of scenarios where a terminal accesses a local area network, such as a campus network or an enterprise internal network. When a terminal user enters an account and password, RADIUS protocol packets are exchanged between the access device and the RADIUS server. After the user's identity is authenticated to access the network, the corresponding relationship between the IP address, terminal equipment and users in the network can be obtained through the RADIUS server.

It should be noted that before receiving the network event data set, an online user list needs to be created first, and the online user list is stored in the cache with IP as a key to provide efficient query performance.

In the embodiment of the present invention, the online user list is generated by the following method: receiving N authentication and accounting messages, wherein the authentication and accounting messages are traffic messages generated by different user objects through the remote network in the charging and authentication online scenario, N is a positive integer greater than or equal to 1; the IP address, user ID, physical address, user status and time stamp obtained by parsing the authentication and accounting message, among which, the user status includes: online, offline and accounting update; based on IP Address, user ID, physical address, user status and time stamp, construct an online user list; maintain user IDs and user status associated with different IP addresses in the online user list, to update user information in the online user list.

Optionally, the server forwards the authentication and accounting message to the designated port of the situation awareness platform, and the situation awareness platform receives the original message information, stores it in the kafka message component, and reads the received original message component through the stream processing component. According to the message information, the IP address, user name (corresponding to the above user ID), Mac address (corresponding to the above physical address), user status, time stamp and other data are analyzed according to the RADIUS protocol, and an online user list is created based on the above data, The user status includes, but is not limited to: online, offline, and billing update. The online user status in Table 1 schematically illustrates the content contained in the online user list.

Table 1 List of online users

IP address username Mac address time online 10.0.0.1 aaa 00-00-00-00-00-01 2022-09-28 23:00 10.0.0.2 bbb 00-00-00-00-00-02 2022-09-28 22:00 ······ ······ ······ ······

After the online user list is created, the online user list is maintained according to the parsed message fields. The specific maintenance rules are as follows: when the user goes online, the corresponding record is added to the online user list; when the user goes offline, the corresponding record in the online user list is deleted; and through IP, Mac conflicts and manual marking, timeout detection reduce the impact of message loss and disorder; if there is no target IP in the online user list, or the user name corresponding to the target IP is inconsistent with the message, change its status to online , otherwise ignore the data; after the user goes online, according to the online Mac address, the user device with the Mac address that may exist in the user table is offline; the administrator is allowed to mark the specified user as offline through the interface operation, and mark the timeout online at regular intervals of users go offline.

After the online user list is generated, it can be stored in the cache with IP as the key value KEY to provide efficient query performance. The situational awareness platform receives the network event data set and parses it.

Step S102, receiving a network event data set, wherein the data type in the network event data set includes at least one of the following: traffic data, risk events and vulnerability information, and each piece of data in the network event data set is associated with an IP address.

In the embodiment of the present invention, after receiving the network event data set, it also includes: extracting the data characteristics of each piece of data in the network event data set; screening out the data whose data characteristics indicate that it conforms to the network risk characteristic set, and obtaining the network risk data set; The network risk data collection and online user list are stored in the distributed database.

It should be noted that the situational awareness platform collects the original data in the network (corresponding to the above-mentioned network event data) and performs feature extraction and behavior analysis to obtain information such as threat events, traffic data, host vulnerabilities, etc., and then in the data flow processing module According to the IP address of these event data, the corresponding user information and host information are queried, and the user and host information are completed in the event data and stored in the distributed database.

In the embodiment of the present invention, the attack chain detection engine is used to match the network attack behavior pattern according to the user information of multiple network event data, to determine the complex threat event, and to extract the event characteristics of the complex threat event; Perform traffic analysis and abnormal behavior analysis on network traffic to determine traffic risk characteristics and abnormal behavior characteristics; integrate event characteristics, traffic risk characteristics and abnormal behavior characteristics of complex threat events into a network risk characteristic set.

It should be noted that after obtaining multiple network event data, the situational awareness platform conducts risk detection by associating network events with user information, and uses the attack chain detection engine to match network attack behavior patterns based on user information of multiple network events to discover complex threats Events, if the user device has the behavior of querying the DGA domain name, and then establishes a connection with one or more file servers through the SMB protocol and reads and writes files, it may be that the host is infected with ransomware and queries the domain name generated by the domain name generation algorithm. If a valid C&C server is found, the query will be stopped and the file server will be connected through the SMB protocol, sensitive data will be encrypted, and traffic analysis and abnormal behavior analysis will be performed on the network traffic of a single user through the traffic detection engine, including traffic threshold detection, traffic mutation analysis, etc.

Step S104, associate each piece of data with the user information in the online user list based on the IP address, and determine the network risk data associated with each user object, wherein network risk data of different dimensions correspond to risk behavior labels.

Optionally, the situational awareness platform aggregates risk events through the user information dimension, generates user risk behavior tags, and scores the user's network behavior risk level.

In the embodiment of the present invention, after associating each piece of data with the user information in the online user list based on the IP address and determining the network risk data associated with each user object, it includes: data that indicates the data feature as a complex threat event Assign threat event attack type labels, and determine the event level of complex threat events; assign vulnerability information level to data whose data characteristics indicate that the number of passwords is lower than the preset number threshold; Threat event attack type label, event level, vulnerability information level, and weak password identification determine the network behavior risk level of the user object.

In the embodiment of the present invention, after associating each piece of data with the user information in the online user list based on the IP address, and determining the network risk data associated with each user object, it includes: associating various types of information generated by the user object using the terminal device; An event correlation relationship is established between the threat event and the scanned vulnerability information; when the event correlation relationship indicates that a threat event targeting the target vulnerability occurs on the terminal device, the user object is marked as a compromised user, and the terminal device is marked as a risk terminal device.

It should be noted that the situational awareness platform processes risk data through scheduled tasks, and collects statistics on the threat event attack type label, threat event level, vulnerability information level, and number of weak passwords generated on the user device, and uses these data to analyze user network information. The risk level of the behavior is scored, and the information is stored in the database.

Associating the threat events of the user with the scanned vulnerability information, if there is a threat event for a certain vulnerability, the user object is marked as a compromised user.

Step S106, based on the risk behavior tags corresponding to the network risk data, generate a user risk profile corresponding to the user object, wherein the user risk profile is used to evaluate the health status of the user object's network assets.

In the embodiment of the present invention, after generating the user risk profile corresponding to the user object based on the risk behavior label corresponding to the network risk data, it includes: displaying the risk user list with network risk data and each user object in the risk user list User risk profile; and/or, display the network access status of each user object, the number of risky terminal devices held, the number of network attacks suffered and the types of network attacks.

It should be noted that after the user risk profile corresponding to the user object is generated, the list of risk users in the intranet can be displayed through the visualization page, and the user's fall status, the number of risk devices held, The number and types of network attacks suffered by users, etc., and timely send warning information to relevant users to notify users to prevent network attacks.

Through the above embodiments, in the scenario of user authentication and dynamic IP allocation, network attack behaviors can be more accurately correlated and analyzed through user and host information, and multi-stage network attack activities can be prevented. It also aggregates threat events and vulnerability information through the user dimension to display the risk level and loss status of user assets. Network security managers can directly locate specific users through the risk user list on the situation awareness platform, and notify users to perform terminal maintenance. and upgrades.

The present invention will be described below in conjunction with a more specific embodiment.

Fig. 2 is a schematic diagram of an optional user risk profile generation system architecture according to an embodiment of the present invention, as shown in Fig. message, store the original message information in the message queue, then parse the message (shown as Radius message analysis in Figure 2), and standardize the data to obtain the user's online and offline information, and the user's online and offline information Transfer to the user list maintenance module, update the list information, and transfer it to the cache component for storage. Online user information can be queried through the user list and displayed to the visual interface. The association query module can query user information through the cache component. Based on threat events, vulnerability information scanning events (referred to as missing scan events in Figure 2) and traffic information, perform associated queries (through the associated detection engine to perform associated queries), store risk information, and provide risk information aggregation assessment at the same time to generate risk portrait tables , and display it through a visual interface.

When conducting network asset security risk assessment, specific steps may include the following:

Step 1, the RADI US authentication server forwards the authentication and accounting message to the designated port of the situational awareness platform, and the situational awareness platform receives the original message information and stores it in the kafka message component;

Step 2, read the received original message information through the stream processing component, and parse out IP address, user name, Mac address, user status, time stamp and other data according to the RADIUS protocol;

Step 3, maintaining the online user table according to the parsed message field;

Among them, when maintaining the online user table, the maintenance strategy includes: the user status in the message information includes online, offline, billing update, etc., when the user goes online, the corresponding record is added in the online user table; when the user goes offline, delete the corresponding record in the online user table. Record, and reduce the impact of packet loss and out-of-sequence through IP, Mac conflicts, manual marking, and timeout detection, and update data for billing: If the target IP does not exist in the online user table, or the user name and message corresponding to the target IP If there is an inconsistency, change its status to online, otherwise ignore the data. After the user goes online, the user device with the Mac address that may exist in the user table will be offline according to the online Mac address. Allows administrators to mark specified users as offline through interface operations, and mark users who are online after timeouts to go offline at regular intervals.

Step 4. Online user information is stored in the cache component with IP as the key value KEY to provide efficient query performance. After collecting the original data in the network, the situational awareness platform performs feature extraction and behavior analysis to obtain threat events, traffic data, Host vulnerability and other information, and then in the data flow processing module, query the corresponding user information and host information according to the IP address of the event data, complete the user and host information in the event data, and store it in the distributed database;

Step five, the situational awareness platform conducts risk detection by associating network events with user information;

The attack chain detection engine matches the network attack behavior pattern according to the user information of multiple network events, and discovers complex threat events, such as user equipment querying the DGA domain name, and then establishes a connection with one or more file servers through the SMB protocol and reads If the host is infected with ransomware, it may query the domain name generated by the domain name generation algorithm. Once a valid C&C server is found, the query will be stopped and the file server will be connected to the file server through the SMB protocol to encrypt sensitive data.

Traffic analysis and abnormal behavior analysis are performed on the network traffic of a single user through the traffic detection engine, including traffic threshold detection, traffic mutation analysis, etc.

Step 6: The situational awareness platform processes risk data through scheduled tasks, generates user risk profiles and evaluates user network risk status;

Make statistics on the threat event attack type label, threat event level, vulnerability information level, and number of weak passwords generated on the user's device, and score the risk level of the user's network behavior according to these data, and store the information in the database.

Correlate the threat events of the user with the scanned vulnerability information, and mark the user as a compromised user if there is a threat event for a certain vulnerability.

Step 7: Display the list of risky users in the intranet through the visual page. You can sort by risk level to display the user's compromise status, the number of risky devices held, the number and type of network attacks suffered by the user, etc.

Through the above-mentioned embodiment, the online user information table is maintained by receiving and analyzing the original RADI US message, and the original flow data of the situation awareness platform and the detected threat vulnerability information are enriched. Under this condition, correlation analysis is performed through the user and host dimensions to detect network risk events , and aggregate the risk events through the user information dimension to generate the user's risk behavior label, locate specific users, and score the user's network behavior risk level.

The present invention will be described below in conjunction with another optional embodiment.

Embodiment two

This embodiment provides a device for generating a user risk profile, and each implementation unit contained in the device for generating a user risk profile corresponds to each implementation step in the first embodiment.

FIG. 3 is a schematic diagram of an optional user risk profile generation device according to an embodiment of the present invention. As shown in FIG. 3 , it includes: a receiving unit 30, a determining unit 32, and a generating unit 34, wherein,

The receiving unit 30 is configured to receive a network event data set, wherein the data types in the network event data set include at least one of the following: flow data, risk events, and vulnerability information, and each piece of data in the network event data set is associated with IP address;

The determining unit 32 is used to associate each piece of data with the user information in the online user list based on the IP address, and determine the network risk data associated with each user object, wherein the network risk data of different dimensions correspond to risky behavior labels;

The generation unit 34 is configured to generate a user risk profile corresponding to the user object based on the risk behavior label corresponding to the network risk data, wherein the user risk profile is used to evaluate the health status of the user object's network assets.

The above-mentioned user risk profile generation device receives the network event data set through the receiving unit 30, wherein the data type in the network event data set includes at least one of the following: traffic data, risk events and vulnerability information, and the network event data set. Each piece of data is associated with an IP address; through the determination unit 33, based on the IP address, each piece of data is associated with the user information in the online user list, and the network risk data associated with each user object is determined, wherein the network risks of different dimensions The data corresponds to a risky behavior label; based on the risky behavior label corresponding to the network risk data, the generating unit 34 generates a user risk profile corresponding to the user object, wherein the user risk profile is used to evaluate the health status of the user object's network assets. In this embodiment, when the situational awareness platform collects risk events, vulnerability information, and traffic data, it associates the above risk data with user information according to user authentication and billing message information and stores them, and then establishes risk behaviors based on data of different dimensions Tags, create user risk profiles, and accurately correlate network attack behaviors through the user risk profiles to directly locate specific users and notify users in time to maintain network security, thereby solving the problem of network risk assessment in related technologies. In the scenario of user authentication to access the Internet and dynamic IP allocation, there is a technical problem that it is impossible to accurately correlate network attack behaviors.

It should be noted that the implementation subject of the embodiment of the present invention is the situational awareness platform, and the user risk profile generation system is deployed on the situational awareness platform. The situational awareness platform is connected to the authentication server, and user-related information can be transmitted to the situational awareness platform through the server. , the user risk profile generation system receives valid information to generate a user risk profile.

In many local area network environments, the IP addresses of user terminals are dynamically assigned, and users may use different terminals to access the network, or carry the same mobile terminal device to access the network in different venues, use VPN channels to access the internal network, etc. The corresponding relationship between IP addresses, terminal devices, and users is constantly changing, which interferes with the judgment of network attack activities of the situational awareness platform and the assessment of the risk status of network assets. User authentication to access the Internet is a wide range of scenarios where a terminal accesses a local area network, such as a campus network or an enterprise internal network. When a terminal user enters an account and password, RADIUS protocol packets are exchanged between the access device and the RADIUS server. After the user's identity is authenticated to access the network, the corresponding relationship between the IP address, terminal equipment and users in the network can be obtained through the RADIUS server.

Optionally, the determining unit 32 includes: a first receiving module, configured to receive N authentication and accounting messages, wherein the authentication and accounting messages are traffic reports generated by different user objects through the remote network in the scenario of charging and authenticating Internet access. text, N is a positive integer greater than or equal to 1; the first parsing module is used to parse the authentication and accounting message to obtain the IP address, user ID, physical address, user status and time stamp, wherein the user status includes: online, Offline and billing update; the first building block is used to build an online user list based on IP address, user ID, physical address, user status and time stamp; the first maintenance module is used to associate different IP addresses in the online user list The user ID and user status of the address are maintained to update the user information in the online user list.

Optionally, the RADI US authentication server forwards the authentication and accounting message to the designated port of the situational awareness platform, and the situational awareness platform receives the original message information, stores it in the kafka message component, and reads and receives it through the stream processing component According to the RADIUS protocol, analyze the received original message information, such as IP address, user name (corresponding to the above user ID), Mac address (corresponding to the above physical address), user status, time stamp and other data, and create an online server based on the above data. User list, where user status includes but not limited to: online, offline, billing update.

After the online user list is created, the online user list is maintained according to the parsed message fields. The specific maintenance rules are as follows: when the user goes online, the corresponding record is added to the online user list; when the user goes offline, the corresponding record in the online user list is deleted; and through IP, Mac conflicts and manual marking, timeout detection reduce the impact of message loss and disorder; if there is no target IP in the online user list, or the user name corresponding to the target IP is inconsistent with the message, change its status to online , otherwise ignore the data; after the user goes online, according to the online Mac address, the user device with the Mac address that may exist in the user table is offline; the administrator is allowed to mark the specified user as offline through the interface operation, and mark the timeout online at regular intervals of users go offline.

After generating the list of online users and storing it in the cache with IP as the key to provide efficient query performance, the situational awareness platform receives the network event data set and parses it.

Optionally, the device for generating a user risk profile further includes: a first extraction module, configured to extract the data features of each piece of data in the network event data set; a first screening module, used to filter out data features that indicate conformity to the network risk feature set the data to obtain the network risk data set; the first storage module is used to store the network risk data set and the online user list in the distributed database.

It should be noted that the situational awareness platform collects the original data in the network (corresponding to the above-mentioned network event data) and performs feature extraction and behavior analysis to obtain information such as threat events, traffic data, host vulnerabilities, etc., and then in the data flow processing module According to the IP address of these event data, the corresponding user information and host information are queried, and the user and host information are completed in the event data and stored in the distributed database.

Optionally, the device for generating a user risk profile further includes: a first determination module, configured to use an attack chain detection engine to match network attack behavior patterns according to user information of multiple network event data, determine complex threat events, and extract complex threat events event characteristics; the second determination module is used to use the traffic detection engine to conduct traffic analysis and abnormal behavior analysis on the network traffic of each user object, and determine traffic risk characteristics and abnormal behavior characteristics; the first integration module is used to integrate complex threats The event characteristics, traffic risk characteristics and abnormal behavior characteristics of the event are integrated into a network risk characteristic set.

It should be noted that after obtaining multiple network event data, the situational awareness platform conducts risk detection by associating network events with user information, and uses the attack chain detection engine to match network attack behavior patterns based on user information of multiple network events to discover complex threats Events, if the user device has the behavior of querying the DGA domain name, and then establishes a connection with one or more file servers through the SMB protocol and reads and writes files, it may be that the host is infected with ransomware and queries the domain name generated by the domain name generation algorithm. If a valid C&C server is found, the query will be stopped and the file server will be connected through the SMB protocol to encrypt sensitive data; the traffic detection engine will perform traffic analysis and abnormal behavior analysis on the network traffic of a single user, including traffic threshold detection, traffic mutation analysis, etc.

Optionally, the device for generating a user risk profile further includes: a third determination module, configured to assign a threat event attack type label to the data whose data feature indicates a complex threat event, and determine the event level of the complex threat event; the first indication module , for assigning a vulnerability information level to data whose data characteristics indicate vulnerability information; the first identification module is used to assign weak password identification to data whose data characteristics indicate that the number of passwords is lower than a preset number threshold; the fourth determination module is used for Determine the network behavior risk level of the user object based on the threat event attack type label, event level, vulnerability information level, and weak password identification.

In the embodiment of the present invention, the risk events are aggregated through the user information dimension to generate the user's risk behavior label and score the user's network behavior risk level, thereby notifying the user to perform corresponding operations to prevent network threats.

It should be noted that the situational awareness platform processes risk data through scheduled tasks, and collects statistics on the threat event attack type label, threat event level, vulnerability information level, and number of weak passwords generated on the user device, and uses these data to analyze user network information. The risk level of the behavior is scored, and the information is stored in the database. Correlate the threat events of the user with the scanned vulnerability information, and mark the user as a compromised user if there is a threat event for a certain vulnerability.

Optionally, the device for generating a user risk profile further includes: a first establishment module, configured to associate various types of threat events generated by a user object using a terminal device with the scanned vulnerability information; a first marking module, configured to When the event correlation indicates that a threat event targeting a target vulnerability occurs on the terminal device, the user object is marked as a compromised user, and the terminal device is marked as a risky terminal device.

Optionally, the device for generating a user risk profile further includes: a first display module, configured to display a risk user list with network risk data and a user risk profile of each user object in the risk user list; and/or, a second The display module is used to display the network access status of each user object, the number of risky terminal devices held, the number of network attacks suffered, and the types of network attacks.

It should be noted that after the user risk profile corresponding to the user object is generated, the list of risk users in the intranet can be displayed through the visualization page, and the user's fall status, the number of risk devices held, The number and types of network attacks suffered by users, etc., and timely send warning information to relevant users to notify users to prevent network attacks.

The above-mentioned user risk profile generation device may also include a processor and a memory. The above-mentioned receiving unit 30, determining unit 32, generating unit 34, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory. to achieve the corresponding functions.

The above-mentioned processor includes a kernel, and the kernel retrieves corresponding program units from the memory. One or more kernels can be set to generate user risk profiles by adjusting kernel parameters, and then evaluate the network risks of network assets.

According to another aspect of the embodiments of the present invention, there is also provided an electronic device, including: a processor; and a memory for storing executable instructions of the processor; wherein, the processor is configured to execute the Instructions can be executed to execute any one of the methods for generating user risk profiles.

According to another aspect of the embodiments of the present invention, there is also provided a computer-readable storage medium, the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the computer-readable storage medium is controlled The device executes any one of the methods for generating a user risk profile.

The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program initialized with the following method steps: receiving a network event data set, wherein the data types in the network event data set include the following At least one of: traffic data, risk events and vulnerability information, each piece of data in the network event data set is associated with an IP address; based on the IP address, each piece of data is associated with the user information in the online user list, and each The network risk data associated with the user object; based on the risk behavior label corresponding to the network risk data, a user risk profile corresponding to the user object is generated.

Fig. 4 is a hardware structural block diagram of an electronic device (or mobile device) according to a method for generating a user risk profile according to an embodiment of the present invention. As shown in Figure 4, the electronic device may include one or more (402a, 402b, ..., 402n are used in the figure to show) processor 402 (processor 402 may include but not limited to microprocessor MCU or programmable logic device, FPGA, etc.), memory 404 for storing data. In addition, it can also include: a display, an input/output interface (I/O interface), a universal serial bus (USB) port (which can be included as one of the ports of the I/O interface), a network interface, a keyboard , power supply and/or camera. Those of ordinary skill in the art can understand that the structure shown in FIG. 4 is only a schematic diagram, which does not limit the structure of the above-mentioned electronic device. For example, the electronic device may also include more or fewer components than shown in FIG. 4 , or have a different configuration than that shown in FIG. 4 .

The serial numbers of the above embodiments of the present invention are for description only, and do not represent the advantages and disadvantages of the embodiments.

In the above-mentioned embodiments of the present invention, the descriptions of each embodiment have their own emphases, and for parts not described in detail in a certain embodiment, reference may be made to relevant descriptions of other embodiments.

In the several embodiments provided in this application, it should be understood that the disclosed technical content can be realized in other ways. Wherein, the device embodiments described above are only illustrative. For example, the division of the units may be a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or may be Integrate into another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of units or modules may be in electrical or other forms.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units.

If the integrated unit is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage media include: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk, etc., which can store program codes. medium.

The above is only a preferred embodiment of the present invention, it should be pointed out that, for those of ordinary skill in the art, without departing from the principle of the present invention, some improvements and modifications can also be made, and these improvements and modifications can also be made. It should be regarded as the protection scope of the present invention.

Claims (10)

1. A method for generating a user risk portrait is applied to a situation awareness platform in a network security system, and comprises the following steps:

receiving a network event data set, wherein a data type in the network event data set comprises at least one of: the system comprises flow data, risk events and vulnerability information, wherein each piece of data in a network event data set is associated with an IP address;

associating each piece of data with user information in an online user list based on the IP address, and determining network risk data associated with each user object, wherein the network risk data with different dimensions correspond to risk behavior tags;

and generating a user risk portrait corresponding to a user object based on the risk behavior tag corresponding to the network risk data, wherein the user risk portrait is used for evaluating the health state of the network asset of the user object.

2. The method of generating as claimed in claim 1, wherein the online user list is generated by:

receiving N authentication charging messages, wherein the authentication charging messages are flow messages generated by different user objects under a charging authentication internet scene through a remote network, and N is a positive integer greater than or equal to 1;

analyzing the authentication charging message to obtain an IP address, a user identifier, a physical address, a user state and a timestamp, wherein the user state comprises: online, offline and charging updating;

constructing the online user list based on the IP address, the user identification, the physical address, the user status and the timestamp;

and maintaining the user identification and the user state associated with different IP addresses in the online user list so as to update the user information in the online user list.

3. The method of generating as claimed in claim 1, further comprising, after receiving the set of network event data:

extracting the data characteristics of each piece of data in the network event data set;

screening out data of which the data characteristic indication accords with a network risk characteristic set to obtain a network risk data set;

and storing the network risk data set and the online user list to a distributed database.

4. The generation method according to claim 3, further comprising:

matching a network attack behavior mode by adopting an attack chain detection engine according to user information of a plurality of network event data, determining a complex threat event, and extracting event characteristics of the complex threat event;

adopting a flow detection engine to perform flow analysis and abnormal behavior analysis on the network flow of each user object, and determining flow risk characteristics and abnormal behavior characteristics;

and combining the event characteristics of the complex threat event, the traffic risk characteristics and the abnormal behavior characteristic set into the network risk characteristic set.

5. The method of generating as claimed in claim 3, after determining the cyber risk data associated with each user object by associating each data with user information in an online user list based on the IP address, comprising:

assigning a threat event attack type tag to the data of which the data characteristics are indicated as a complex threat event, and determining an event grade of the complex threat event;

assigning the data with the data characteristic indicated as vulnerability information to a vulnerability information grade;

assigning weak password identification to the data with the data characteristic indicating that the password quantity is lower than a preset quantity threshold;

and determining the network behavior risk level of the user object based on the threat event attack type label, the event level, the vulnerability information level and the weak password identification.

6. The method of generating as claimed in claim 3, after associating each piece of data with user information in an online user list based on the IP address, determining network risk data associated with each user object, comprising:

establishing an event association relation between each type of threat event generated by the user object using the terminal equipment and the scanned vulnerability information;

and under the condition that the event incidence relation indicates that the terminal equipment has a threat event aiming at the target vulnerability, marking the user object as a lost user, and marking the terminal equipment as risk terminal equipment.

7. The method of generating as claimed in claim 1, after generating a user risk representation corresponding to the user object based on a risk behavior tag corresponding to the cyber risk data, comprising:

displaying a risk user list with the network risk data and a user risk portrait of each user object in the risk user list; and/or the presence of a gas in the gas,

and displaying the network access state, the number of held risk terminal devices, the number of network attacks and the network attack category of each user object.

8. A user risk portrait generation device is applied to a situation awareness platform in a network security system, and comprises:

a receiving unit, configured to receive a network event data set, where a data type in the network event data set includes at least one of: the system comprises flow data, risk events and vulnerability information, wherein each piece of data in a network event data set is associated with an IP address;

the determining unit is used for associating each piece of data with user information in an online user list based on the IP address and determining network risk data associated with each user object, wherein the network risk data with different dimensions correspond to risk behavior tags;

and the generating unit is used for generating a user risk portrait corresponding to a user object based on the risk behavior tag corresponding to the network risk data, wherein the user risk portrait is used for evaluating the health state of the network asset of the user object.

9. An electronic device, comprising:

a processor; and

a memory for storing executable instructions of the processor;

wherein the processor is configured to execute the method of generating a user risk representation of any of claims 1-7 via execution of the executable instructions.

10. A computer-readable storage medium, comprising a stored computer program, wherein when the computer program runs, the computer-readable storage medium controls a device to execute the method for generating a user risk representation according to any one of claims 1 to 7.

Images