TWI855845B - User networking protection system, method, and computer-readable medium based on network threat information - Google Patents

Abstract

The invention discloses a user networking protection system, method, and computer-readable medium based on network threat information. A traffic diversion and filtering module filters network traffic related to a connection request of a user device to prevent the connection to an external malicious website, and updates latest network threat information of a threat information module. When the user device wants to make a malicious connection to a malicious website, the threat information module will block or protect the malicious connection based on the latest network threat information. In addition, a recording analysis module can record the network traffic passing through the traffic diversion and filtering module, and a threat information module can analyze network threat information of the network traffic. When there is a threat risk, the recording analysis module performs a connection backtracking of the network threat information, and then feeds back a connection backtracking result of the network threat information to the threat information module.

Description

User Internet protection system, method and computer-readable medium based on network threat intelligence

The present invention relates to a user online protection technology, and in particular to a user online protection system, method and computer-readable medium based on network threat intelligence.

In recent years, the Internet has developed rapidly, and the Internet has the characteristics of complexity (such as complex sources) and rapidity (rapid attacks), which makes users, enterprises or organizations face severe network threat challenges, and also allows hackers (such as cyber criminals) to carry out network attacks on specific users, enterprises or organizations (such as governments/agencies/groups).

Furthermore, major information security (information security) incidents are frequently reported internationally. Hacker organizations use carefully planned advanced or persistent threats to specifically invade various electronic devices or information systems of users, enterprises or organizations to steal personal privacy, business secrets, important intelligence of users, enterprises or organizations and make huge illegal profits.

Information security (ISE) offense and defense has become a competition of asymmetric combat power. It is increasingly difficult for a single user, enterprise or organization to fight against organized and professional hacker groups. In the new cyber battlefield, cyber threats come from all over the world. Users, enterprises or organizations should realize that in order to face new cyber threats, they need to have strong threat intelligence collection capabilities and use cyber threat intelligence to make corresponding defenses that are in line with current external threat trends.

However, the existing technology cannot pass all network traffic (such as network traffic) associated with the connection request (such as Internet access request) made by the user device through the traffic diversion and filtering module to prevent the user device from connecting to external malicious websites/malicious IP addresses/malicious domain names, nor can it quickly block the user device from malicious connections or malicious connection behaviors to external malicious websites/malicious IP addresses/malicious domain names, nor can it profile, analyze or save all network traffic (such as network traffic) passing through the traffic diversion and filtering module, and it is even more impossible to feed back the traceback results of the network threat intelligence connection to the threat intelligence module to add the content of the network threat intelligence of the threat intelligence module.

Therefore, how to provide an innovative user Internet protection technology to solve any of the above problems and provide related systems/methods has become a major research topic for technical personnel in this field.

The user Internet protection system based on network threat intelligence described in the present invention includes: a traffic diversion and filtering module, which filters the network traffic related to the connection request of the user device through the traffic diversion and filtering module when the user device makes a connection request to prevent the user device from connecting to any of the external malicious websites, malicious IP (Internet Protocol) addresses and malicious domain names; a threat intelligence module, which provides the latest network threat intelligence, so that when the user device intends to conduct malicious connection or malicious connection behavior to any of the external malicious websites, malicious IP addresses and malicious domain names, the user device is blocked from connecting to the external malicious websites, malicious IP addresses and malicious domain names according to the content of the latest network threat intelligence. a side-recording analysis module that side-records, copies or saves network traffic that passes through the traffic diversion and filtering module, wherein the threat intelligence module performs network analysis on the network traffic that passes through the traffic diversion and filtering module. Analysis of threat intelligence: When the analysis result of network threat intelligence indicates that the network threat intelligence has threat risk, the sidetrack analysis module will backtrack the connection of the network threat intelligence, so that the sidetrack analysis module can feed back the backtracking result of the connection of the network threat intelligence to the threat intelligence module to add the content of the network threat intelligence of the threat intelligence module.

The user Internet protection method based on network threat intelligence described in the present invention includes: when a user device makes a connection request, a traffic diversion and filtering module filters the network traffic related to the connection request of the user device to prevent the user device from connecting to any of external malicious websites, malicious IP (Internet Protocol) addresses and malicious domain names; a threat intelligence module provides the latest network threat intelligence, so that when the user device intends to conduct malicious connection or malicious connection behavior to any of external malicious websites, malicious IP addresses and malicious domain names, the content of the latest network threat intelligence will be used to block the user device from connecting to external malicious websites, malicious IP addresses and malicious domain names. Block or protect malicious connections or malicious connection behaviors of any of malicious IP addresses and malicious domain names; and have a sidetrack analysis module sidetrack, copy or save network traffic passing through the traffic diversion and filtering module, and have the threat intelligence module analyze the network traffic passing through the traffic diversion and filtering module for network threat intelligence, so that when the analysis result of the network threat intelligence is that the network threat intelligence has a threat risk, the sidetrack analysis module backtracks the connection of the network threat intelligence, so that the sidetrack analysis module feeds back the backtracking result of the connection of the network threat intelligence to the threat intelligence module to add the content of the network threat intelligence of the threat intelligence module.

The computer-readable medium of the present invention is applied to a computing device or a computer, and stores instructions to execute the above-mentioned user Internet protection method based on network threat information.

Therefore, the present invention provides an innovative user Internet protection system, method and computer-readable medium based on network threat intelligence. When a user device makes a connection request (such as an Internet request), all network traffic (such as network traffic) associated with the connection request (such as an Internet request) is automatically diverted and filtered through a traffic diversion and filtering module to prevent the user device from connecting to external malicious websites/malicious IP addresses/malicious domain names. It can also monitor the connection requests of internal user devices against external malicious websites/malicious IP addresses/malicious domain names to prevent malicious connections or malicious connection behaviors (such as network scanning, etc.).

Alternatively, the user online protection system based on network threat intelligence described in the present invention is an innovative network threat intelligence online protection system that can quickly block malicious connections or malicious connection behaviors of user devices to any external malicious websites, malicious IP addresses and malicious domain names.

Alternatively, the profile analysis module of the present invention can automatically or effectively profile, analyze or save all network traffic (such as network traffic) that passes through the traffic diversion and filtering module, and can also automatically feed back the traceback results of the network threat intelligence connection to the threat intelligence module to add the content of the network threat intelligence of the threat intelligence module.

In order to make the above features and advantages of the present invention more clearly understandable, the following examples are given and detailed descriptions are provided in conjunction with the attached drawings. The following description will partially explain the additional features and advantages of the present invention, and these features and advantages will be partially known from the description or can be learned through the practice of the present invention. It should be understood that both the general description above and the detailed description below are exemplary and explanatory, and are not intended to limit the scope of the present invention.

1: User Internet protection system

10: Flow diversion and filtration module

11: Flow diversion unit

12: Flow filter unit

20: Threat Intelligence Module

21: Threat Intelligence Database

22: Threat intelligence analysis and backtracking unit

30: Profile analysis module

31: Traffic profiling unit

32: Retrospective analysis unit

A: User device

B: Internet

C: Cyber threat intelligence

D: Network traffic

S01 to S13: Steps

Figure 1 is a schematic diagram of the architecture of the user online protection system based on network threat intelligence described in the present invention.

Figure 2 is a schematic diagram of an embodiment of the user online protection system based on network threat information described in the present invention.

Figure 3 is a flowchart of an implementation example of the user Internet protection method based on network threat information described in the present invention.

The following describes the implementation of the present invention through a specific concrete implementation form. People familiar with this technology can understand other advantages and effects of the present invention from the content disclosed in this manual, and can also implement or use it through other different specific equivalent implementation forms.

FIG1 and FIG2 are respectively a schematic diagram of the structure of the user online protection system 1 based on network threat intelligence and a schematic diagram of an embodiment of the present invention. As shown in FIG1 and FIG2, the user online protection system 1 based on network threat intelligence can respectively communicate with the user device A and the network B, and includes a traffic diversion and filtering module 10, a threat intelligence module 20, and a profile analysis module 30, etc., which are mutually communicated. In addition, the traffic diversion and filtering module 10 can have a traffic diversion unit 11 and a traffic filtering unit 12, etc., the threat intelligence module 20 can have a threat intelligence database 21 and a threat intelligence analysis and backtracking unit 22, etc., and the profile analysis module 30 can have a traffic profile unit 31 and a backtracking analysis unit 32, etc.

In one embodiment, user device A may be a user and/or a user device used, and the user device or device may be a smart phone, a smart watch, a tablet computer, a personal computer, a laptop computer, a desktop computer, etc. Network B may be the Internet, a wired network, a wireless network, a wide area network (WAN), a local area network (LAN), a metropolitan area network (MAN), etc.

In one embodiment, the flow diversion and filtering module 10 can be a flow diversion and filter (chip/circuit), flow diversion and filtering software (program), etc., the flow diversion unit 11 can be a flow diverter (chip/circuit), flow diversion software (program), etc., and the flow filtering unit 12 can be a flow filter (chip/circuit), flow filtering software (program), etc. The threat intelligence database 21 may be a threat intelligence data storage device, a threat intelligence data server, or a memory, a memory card, a hard disk (such as a cloud/network/external hard disk), a CD, a flash drive, etc. for storing network threat intelligence C. The threat intelligence analysis and backtracking unit 22 may be a threat intelligence analysis and backtracking device, a threat intelligence analysis and backtracking software (program), etc. The profile analysis module 30 may be a profile analyzer (chip/circuit), profile analysis software (program), etc., the flow profile unit 31 may be a flow profiler (chip/circuit), flow profile software (program), etc., and the traceback analysis unit 32 may be a traceback analyzer (chip/circuit), traceback analysis software (program), etc.

In one embodiment, the "at least one" mentioned in the present invention represents more than one (such as one, two or three), "plurality" represents more than two (such as two, three, four, ten or one hundred), and "communication link" represents mutual communication link in wired mode (such as wired network) or wireless mode (such as wireless network). Network traffic D can be network traffic, etc., "internal" can be internal user device A, equipment (such as network equipment), system (such as information system), website, etc., and "external" may or may not be malicious website, malicious IP (Internet Protocol) address, malicious domain name, etc. However, the present invention is not limited to those mentioned in each embodiment.

In detail, the user online protection system 1 based on network threat intelligence mainly includes a traffic diversion and filtering module 10, a threat intelligence module 20 and a sidetracking analysis module 30. The traffic diversion unit 11 of the traffic diversion and filtering module 10 can control the direction of network traffic D (such as network traffic), and the traffic filtering unit 12 of the traffic diversion and filtering module 10 can determine whether there is network threat intelligence C (such as malicious threat intelligence) of a malicious IP address or a malicious domain name in the network traffic D (such as network traffic). The threat intelligence database 21 of the threat intelligence module 20 can store network threat intelligence C, and the threat intelligence analysis and backtracking unit 22 of the threat intelligence module 20 can analyze whether the newly added network threat intelligence C is malicious threat intelligence (high-risk malicious intelligence). The traffic profiler unit 31 of the profiler analysis module 30 can profile and save all network traffic D (such as network traffic), and the backtracking analysis unit 32 of the profiler analysis module 30 can analyze network threat intelligence C and query historical (past) network traffic D (such as network traffic).

When user device A makes a connection request (such as an Internet access request), all network traffic D (such as network traffic) related to the connection request (such as an Internet access request) of user device A is filtered by the traffic diversion and filtering module 10 to prevent user device A from connecting to any external malicious website, malicious IP address, and malicious domain name. In one embodiment, the traffic diversion and filtering module 10 is used to filter all network traffic D (such as network traffic) related to the connection request (such as an Internet access request) of user device A. The filtering module 10 may periodically or irregularly inquire whether the threat intelligence module 20 has the latest content of the network threat intelligence C. If so, the latest network threat intelligence C is transmitted to the traffic diversion and filtering module 10. In another embodiment, when the threat intelligence module 20 has the latest content of the network threat intelligence C, the latest network threat intelligence C is transmitted to the traffic diversion and filtering module 10. When the internal user device A intends to conduct a malicious connection or malicious connection behavior to any of the external malicious websites, malicious IP addresses and malicious domain names (i.e., internal to external), the threat intelligence module 20 can block or protect the malicious connection or malicious connection behavior of the user device A to any of the external malicious websites, malicious IP addresses and malicious domain names according to the content of the latest network threat intelligence C.

The traffic diversion and filtering module 10 will monitor the behavior of external to internal connection requests to prevent malicious connections or malicious connection behaviors (such as network scanning, etc.). All network traffic D (such as network traffic) passing through the traffic diversion and filtering module 10 will be profiled or copied to the traffic profiling unit 31 of the profiling analysis module 30 for storage. The connections in the network traffic D (such as network traffic) that are not detected by the traffic diversion and filtering module 10 will be transmitted to the threat intelligence module 20 for analysis of network threat intelligence C. When the threat intelligence module 20 analyzes the network threat intelligence C and finds that the network threat intelligence C has a threat risk (such as high risk or potential risk), the sidetrack analysis module 30 performs a backtracking of the connection of the network threat intelligence C, and then the sidetrack analysis module 30 feeds back the backtracking result of the connection of the network threat intelligence C to the threat intelligence module 20 to add the content of the network threat intelligence C of the threat intelligence module 20 (such as the latest network threat intelligence), thereby improving the richness and breadth of the network threat intelligence C of the threat intelligence module 20.

1. Traffic diversion and filtering module 10: It may have a traffic diversion unit 11 and a traffic filtering unit 12. During the initialization phase of the traffic diversion and filtering module 10, the traffic filtering unit 12 of the traffic diversion and filtering module 10 will receive the latest network threat intelligence C provided by the threat intelligence module 20.

目的端之IP位址、

DNS(網域名稱服務；Domain Name Service)查詢請求、

回應之IP位 址紀錄進行解析及萃取，以由流量導流單元11將目的端之IP位址/網域名稱傳送至流量導流與過濾模組10之流量過濾單元12，再由流量過濾單元12將目的端之IP位址/網域名稱與已更新之最新網路威脅情資C(如IP位址/網域名稱)兩者進行比對。若流量過濾單元12之比對結果為目的端之IP位址/網域名稱與已更新之最新網路威脅情資C(如IP位址/網域名稱)兩者相符(命中)，則代表本次內部之使用者裝置A對外部之連線請求為有威脅風險(如高風險或潛在風險)之連線行為，故流量過濾單元12可將有威脅風險之連線行為(結果)回應至流量導流單元11，俾由流量導流單元11拒絕本次內部之使用者裝置A對外部之連線請求。 [1] Internal to external connection behavior: When the internal user device A wishes to make a connection request to the outside (i.e., internal to external), the traffic diversion unit 11 of the traffic diversion and filtering module 10 may include the user device A's external connection request

The IP address of the destination,

DNS (Domain Name Service) query requests,

The IP address record of the response is parsed and extracted, and the IP address/domain name of the destination is transmitted by the traffic diversion unit 11 to the traffic filtering unit 12 of the traffic diversion and filtering module 10, and then the traffic filtering unit 12 compares the IP address/domain name of the destination with the latest updated network threat information C (such as IP address/domain name). If the comparison result of the traffic filtering unit 12 is that the IP address/domain name of the destination and the updated latest network threat information C (such as IP address/domain name) are consistent (hit), it means that the connection request from the internal user device A to the outside is a connection behavior with a threat risk (such as high risk or potential risk). Therefore, the traffic filtering unit 12 can respond to the connection behavior (result) with a threat risk to the traffic diversion unit 11, so that the traffic diversion unit 11 rejects the connection request from the internal user device A to the outside.

[2] External-to-internal connection behavior: If the source end (such as the initiator) of the connection request is an external-to-internal connection behavior, the traffic diversion unit 11 of the traffic diversion and filtering module 10 can parse and extract the IP address of the source end included in the external-to-internal connection behavior, and transmit the IP address of the source end to the traffic filtering unit 12 of the traffic diversion and filtering module 10 by the traffic diversion unit 11. The traffic filtering unit 12 then compares the IP address of the source end with the latest updated network threat information C (such as the IP address). If the comparison result of the traffic filtering unit 12 is that the IP address of the source end and the updated latest network threat information C (such as IP address) are consistent (hit), it means that this external to internal connection request is a connection behavior with threat risk (such as high risk or potential risk). Therefore, the traffic filtering unit 12 of the traffic diversion and filtering module 10 can respond to the connection behavior (result) with threat risk to the traffic diversion unit 11, so that the traffic diversion unit 11 rejects this external to internal connection request.

[3] If the above-mentioned [1] internal to external connection behavior and [2] external to internal connection behavior do not correspond to any network threat information C (such as malicious threat information), then the traffic diversion unit 11 of the traffic diversion and filtering module 10 will respectively approve the connection request of the user device A and the external connection request.

In order to increase the depth and breadth of network threat intelligence C, the traffic filtering unit 12 of the traffic diversion and filtering module 10 will transmit the connection resolution results of the query request record of the domain name service (DNS) that does not match (miss) to the threat intelligence module 20 during the monitoring process of the internal to external connection, so as to analyze and feedback the network threat intelligence C, and the traffic diversion unit 11 of the traffic diversion and filtering module 10 will profile or copy the network traffic D (such as network traffic) of the internal to external connection and the external to internal connection to the traffic profile unit 31 of the profile analysis module 30 for complete storage.

2. Threat intelligence module 20: It may have a threat intelligence database 21 and a threat intelligence analysis and backtracking unit 22, and the threat intelligence database 21 stores two types of network threat intelligence C, namely IP addresses and domain names, so that the threat intelligence module 20 regularly pushes the latest network threat intelligence C in the threat intelligence database 21 to the traffic diversion and filtering module 10, and then the traffic diversion and filtering module 10 filters the network traffic D (such as network traffic) according to the latest network threat intelligence C to see if there are malicious connections or malicious connection behaviors.

[1] Internal to external connection behavior: When an internal user device A makes a connection request (direct connection) using an "IP address", the traffic diversion and filtering module 10 can compare the IP address of the user device A with the pre-updated network threat intelligence C to determine whether it is a malicious connection or malicious connection behavior. If the comparison result of the traffic diversion and filtering module 10 is that the IP address of the user device A matches the pre-updated network threat intelligence C, the traffic diversion and filtering module 10 blocks the connection request of the internal user device A and transmits the IP address of the user device A to the threat intelligence analysis and tracing unit 22 of the threat intelligence module 20, so that the threat intelligence analysis and tracing unit 22 traces back the history of the IP address of the user device A to find the domain name associated with the IP address of the user device A, and then the threat intelligence analysis and tracing unit 22 feeds the found domain name back to the threat intelligence database 21. On the contrary, if the comparison result of the traffic diversion and filtering module 10 is that the IP address of the user device A does not match the pre-updated network threat information C (miss), the traffic diversion and filtering module 10 allows the internal user device A to connect to the outside.

Furthermore, when the internal user device A makes a connection request using a "domain name", the traffic diversion and filtering module 10 compares the domain name of the user device A with the pre-updated network threat intelligence C to determine whether it is a malicious connection or malicious connection behavior. If the comparison result of the traffic diversion and filtering module 10 is that the domain name of the user device A and the pre-updated network threat intelligence C match (hit), the traffic diversion and filtering module 10 blocks the connection request of the internal user device A this time. On the contrary, if the comparison result of the traffic diversion and filtering module 10 is that the domain name of the user device A and the pre-updated network threat intelligence C do not match (miss), the traffic diversion and filtering module 10 allows the internal user device A to query the external DNS (Domain Name Service), so that the traffic diversion and filtering module 10 will once again compare the network threat intelligence C based on the IP address responded after the external DNS (Domain Name Service) query to confirm whether it is a malicious connection or malicious connection behavior, thereby performing real-time protection. When the responded IP address is a malicious connection or malicious connection behavior, the traffic diversion and filtering module 10 will immediately block and protect the responded IP address, and then the threat intelligence analysis and backtracking unit 22 of the threat intelligence module 20 will backtrack the history of the responded IP address to find the domain name associated with the responded IP address, and then the threat intelligence analysis and backtracking unit 22 will feed back the found domain name to the threat intelligence database 21. After the above-mentioned real-time protection or blocking protection process, if the traffic diversion and filtering module 10 finds that the found domain names have no malicious behavior, the traffic diversion and filtering module 10 can transmit the found domain names to the threat intelligence analysis and backtracking unit 22 for further analysis.

[2] External to internal connection behavior: When an external user connects to an internal device in the form of an "IP address" (i.e., an external to internal connection request), the traffic diversion and filtering module 10 can compare the external user's IP address with the pre-updated network threat intelligence C to determine whether it is a malicious connection or malicious connection behavior. If the comparison result of the traffic diversion and filtering module 10 is that the IP address of the external user matches (hit) the pre-updated network threat intelligence C, it means that this external-to-internal connection request is a malicious connection or malicious connection behavior with a threat risk (such as high risk or potential risk). Therefore, the traffic diversion and filtering module 10 can block this external-to-internal connection request and transmit the IP address of the external user to the threat intelligence analysis and backtracking unit 22 of the threat intelligence module 20, so that the threat intelligence analysis and backtracking unit 22 can backtrack the history of the external user's IP address to find the domain name associated with the external user's IP address, and feed the associated domain name back to the threat intelligence database 21. On the contrary, if the comparison result of the traffic diversion and filtering module 10 is that the IP address of the external user does not match the pre-updated network threat information C (miss), it means that this external to internal connection request is a connection behavior with no threat risk (such as high risk or potential risk), so the traffic diversion and filtering module 10 can allow this external to internal connection request.

，其中，Verdict(σ)代表威脅情資 信譽分數，P代表已預先定義之分佈模型，Q代表欲分析之網域名稱，i代表1至n，且n代表等於或大於2之正整數。 When the threat intelligence analysis and tracing unit 22 of the threat intelligence module 20 receives the domain name to be analyzed sent by the traffic filtering unit 12 of the traffic diversion and filtering module 10, the threat intelligence analysis and tracing unit 22 can use the following threat intelligence reputation calculation method to calculate the predefined distribution model P and the domain name Q to be analyzed to obtain the threat intelligence reputation score Verdict (σ) of the domain name Q to be analyzed. For example, the threat intelligence reputation calculation method is

, where Verdict(σ) represents the threat information reputation score, P represents a predefined distribution model, Q represents the domain name to be analyzed, i represents 1 to n, and n represents a positive integer equal to or greater than 2.

When the threat intelligence reputation score Verdict(σ) of the domain name Q to be analyzed exceeds a certain threshold value, the threat intelligence module 20 may define the domain name Q to be analyzed as a malicious domain name, so that the threat intelligence analysis and backtracking unit 22 of the threat intelligence module 20 performs a certain time period of backtracking on the malicious domain name to the sidetracking analysis module 30 to find out the malicious IP addresses associated with the malicious domain name, including the malicious IP addresses associated with the malicious domain name D _i (such as IP ₁ , IP ₂ , ..., IP _n ), for example, D _i ={IP ₁ , IP ₂ , ..., IP _n }, and then the threat intelligence analysis and backtracking unit 22 will be associated with the malicious domain name D The malicious IP address associated with the malicious domain name _{D i} is regarded as the newly added network threat intelligence C, so that the threat intelligence analysis and tracing unit 22 feeds back the malicious IP address associated with the malicious domain name D _i to the threat intelligence database 21.

When the data received by the threat intelligence analysis and backtracking unit 22 is an IP address, it will directly trace back a certain period of time to the sidetracking analysis module 30 to find the domain names associated with the IP address, including the malicious domain names associated with the malicious IP address IP _i (such as D ₁ , D ₂ , ..., D _n ), for example, IP _i = {D ₁ , D ₂ , ..., D _n }, and then the threat intelligence analysis and backtracking unit 22 will regard the malicious domain names associated with the malicious IP address IP _i as newly added network threat intelligence C, so that the threat intelligence analysis and backtracking unit 22 will feed back the malicious domain names associated with the malicious IP address IP _i to the threat intelligence database 21.

3. Profile analysis module 30: It may have a traffic profile unit 31 and a backtracking analysis unit 32. The traffic profile unit 31 may profile and store the traffic diversion and the traffic transmitted by the filtering module 10, and the backtracking analysis unit 32 may backtrack the associated process according to the associated parameters required by the threat intelligence module 20 (for example: the domain name, IP address and a certain time period to be queried for threat risk, etc.), so that the backtracking analysis unit 32 may backtrack the corresponding results of the associated malicious IP address or malicious domain name to the threat intelligence database 21 according to the process.

FIG3 is a flowchart of an implementation example of the use scenario of the user online protection method based on network threat intelligence described in the present invention, and is also described together with the user online protection system 1 based on network threat intelligence shown in FIG1 and FIG2.

As shown in FIG3 , when the user online protection system 1 based on network threat intelligence receives a connection request (see step S01), it will first enter the traffic diversion unit 11 of the traffic diversion and filtering module 10 (see step S02). In addition to transmitting the network traffic D (such as network traffic) to the traffic filtering unit 12 to detect the network threat intelligence C (see step S03), the traffic diversion unit 11 will also profile or copy a copy of the network traffic D (such as network traffic) to the traffic profile unit 31 of the profile analysis module 30 to store the complete content of the network traffic D (see step S04).

The traffic filtering unit 12 of the traffic diversion and filtering module 10 performs a real-time comparison of the current connection request with the network threat intelligence C (such as malicious threat intelligence) in the threat intelligence database 21 of the threat intelligence module 20. [1] If the traffic filtering unit 12 matches the current connection request with a malicious IP address or malicious domain name of the network threat intelligence C, the traffic filtering unit 12 rejects the current connection request (see step S05) and transmits the current connection request to the threat intelligence analysis and backtracking unit 22 (see step S09). [2] If the traffic filtering unit 12 does not match the malicious IP address of the network threat intelligence C for the current connection request, the traffic filtering unit 12 determines that the IP address of the current connection request is a non-malicious IP address and approves the current connection request (see step S06). [3] If the traffic filtering unit 12 does not match the domain name of the network threat intelligence C for the current connection request, the traffic filtering unit 12 determines that the domain name of the current connection request is an unknown domain name, and the traffic filtering unit 12 queries all corresponding IP addresses (e.g., IP={IP ₁ , IP ₂ ,..., IP _n }; see step S07) for the unknown domain name through a domain name service server (DNS server), and then transmits all corresponding IP addresses one by one to the traffic filtering unit 12 through a domain name service server (not shown) for comparison or detection (see step S08).

When the traffic filtering unit 12 matches or detects that any of the corresponding IP addresses is a malicious corresponding IP address, the traffic filtering unit 12 rejects the current connection request (see step S05) and transmits the malicious corresponding IP address to the threat intelligence analysis and tracing unit 22. On the contrary, when the traffic filtering unit 12 does not match or detect a malicious corresponding IP address for all the corresponding IP addresses, the traffic filtering unit 12 transmits the unknown domain name to the threat intelligence analysis and tracing unit 22 (see step S09).

，以由威脅情資分析與回溯單 元22依據未知網域名稱之威脅情資信譽分數Verdict(σ)判斷未知網域名稱是否有威脅風險(見步驟S12)。 The threat intelligence analysis and backtracking unit 22 of the threat intelligence module 20 can perform different backtracking or analysis according to different malicious requests or unknown requests in the network threat intelligence C (such as malicious threat intelligence). [1] If the malicious request in the network threat intelligence C (such as malicious threat intelligence) is a "malicious IP address or a malicious corresponding IP address", the threat intelligence analysis and tracing unit 22 can trace back the associated domain name (such as { _D1 , _D2 , ..., _Dn }; see step S10) through the data of the network traffic D (such as network traffic) sidetracked by the traffic sidetracking unit 31 of the sidetracking analysis module 30, and then the threat intelligence analysis and tracing unit 22 adds the associated domain name (such as { _D1 , _D2 , ..., _Dn }) to the threat intelligence database 21 (see step S13). [2] If the malicious request in the network threat intelligence C (such as malicious threat intelligence) is a "malicious domain name", the threat intelligence analysis and tracing unit 22 can trace back the associated IP address (such as IP {IP ₁ , IP ₂ , ..., IP _n }; see step S11), and then the threat intelligence analysis and tracing unit 22 will add the associated IP address (such as IP {IP ₁ , IP ₂ , ..., IP _n }) to the threat intelligence database 21 (see step S13). [3] If the unknown request in the network threat intelligence C (such as malicious threat intelligence) is an unknown domain name, the threat intelligence analysis and backtracking unit 22 can calculate the threat intelligence reputation score Verdict (σ) of the unknown domain name through the threat intelligence reputation calculation method. For example, the threat intelligence reputation calculation method is

The threat information analysis and backtracking unit 22 determines whether the unknown domain name has a threat risk according to the threat information reputation score Verdict (σ) of the unknown domain name (see step S12).

For example, when the threat intelligence reputation score Verdict(σ) of the unknown domain name exceeds a certain threshold value, the threat intelligence analysis and backtracking unit 22 determines that the unknown domain name has a threat risk (such as a high risk or a potential risk); conversely, when the threat intelligence reputation score Verdict(σ) does not exceed the certain threshold value, the threat intelligence analysis and backtracking unit 22 determines that the unknown domain name has no threat risk (such as no risk and no potential risk). If the unknown domain name is a threat risk (such as high risk or potential risk), the unknown domain name with threat risk (such as high risk or potential risk) is transmitted to the threat intelligence analysis and tracing unit 22 to trace back all related IP addresses (such as IP {IP ₁ , IP ₂ , ..., IP _n }; see step S11), and then the threat intelligence analysis and tracing unit 22 adds all related IP addresses to the threat intelligence database 21 (see step S13). In contrast, if the unknown domain name is considered to have no threat risk (such as no risk and no potential risk), the traffic filtering unit 12 of the traffic diversion and filtering module 10 agrees to the connection request (see step S06).

In other words, the user Internet protection method based on network threat intelligence described in the present invention may include: [1] a traffic diversion method, [2] a traffic filtering method, [3] a threat intelligence database 21, [4] a threat intelligence analysis and backtracking method, [5] a traffic sidetracking method, and [6] a backtracking analysis method.

來源端之IP位址、

目的端之IP位址、

網域名稱服務DNS之查詢請求、

回應之IP位址紀錄)進行解析及萃取。若連線請求中存在惡意連線或惡意連線行為，則由流量導流與過濾模組10進行即時阻擋本次之連線請求之惡意連線或惡意連線行為；反之，若連線請求中不存在惡意連線或惡意連線行為，則由流量導流與過濾模組10允許網路透通而不阻擋本次之連線請求或連線行為。 [1] Traffic diversion method: The diversion of network traffic D (such as network traffic) by the traffic diversion unit 11 can be transparent to the internal to external connection behavior and the external to internal connection behavior. These network traffic D (such as network traffic) are profiled or copied to other ports through port control and output to the traffic profile unit 31 of the profile analysis module 30. In the process of transparency, the connection index (for example:

The IP address of the source,

The IP address of the destination,

DNS query request,

If there is a malicious connection or malicious connection behavior in the connection request, the traffic diversion and filtering module 10 will immediately block the malicious connection or malicious connection behavior of this connection request; on the contrary, if there is no malicious connection or malicious connection behavior in the connection request, the traffic diversion and filtering module 10 will allow the network to pass through without blocking the connection request or connection behavior.

來源端之IP位址、

目的端之IP位址、

網域名稱服務DNS之查詢請求、

回應之IP位址紀錄)進行比對，當指標連線中包括惡意連線或惡意連線行為時，由流量導流與過濾模組10之流量導流單元11進行控制，以拒絕本次之連線請求，且將IP位址或網域名稱傳送至威脅情資模組20之威脅情資分析與回溯單元22，以進行網路威脅情資C之回溯及搜尋。 [2] Traffic filtering method: Based on the latest network threat intelligence C from threat intelligence module 20 and internal-to-external and external-to-internal connection indicators (for example:

The IP address of the source,

The IP address of the destination,

DNS query request,

When the index connection includes malicious connection or malicious connection behavior, the traffic diversion unit 11 of the traffic diversion and filtering module 10 controls to reject the connection request and transmits the IP address or domain name to the threat intelligence analysis and backtracking unit 22 of the threat intelligence module 20 to backtrack and search for network threat intelligence C.

[3] Threat intelligence database 21: can store two types of network threat intelligence C (such as malicious threat intelligence), such as IP addresses and domain names. Threat intelligence database 21 can also provide the latest network threat intelligence C to the traffic filtering unit 12 of the traffic diversion and filtering module 10, and the threat intelligence analysis and backtracking unit 22 of the threat intelligence module 20 can add new network threat intelligence C to the threat intelligence database 21.

[4] Method for threat intelligence analysis and backtracking: The traffic filtering unit 12 of the traffic diversion and filtering module 10 can determine whether the network threat intelligence C is malicious threat intelligence such as malicious IP addresses and malicious domain names, and the backtracking analysis unit 32 of the sidetracking analysis module 30 can backtrack the associated corresponding IP addresses or domain names to add them to the threat intelligence database 21.

[5] Traffic profiling method: The traffic profiling unit 31 of the profiling analysis module 30 can perform full-time (e.g., 24-hour) profiling and storage of network traffic D (e.g., network traffic), and the backtracking analysis unit 32 of the profiling analysis module 30 can perform inquiries on network traffic D (e.g., network traffic).

[6] Backtracking analysis method: When the threat intelligence analysis and backtracking unit 22 queries an IP address, the threat intelligence analysis and backtracking unit 22 performs a backtracking of a certain period of time to the sidetracking analysis module 30 to find out the domain name associated with the IP address (e.g., IP _i ={D ₁ ,D ₂ ,...,D _n }). When the threat intelligence analysis and backtracking unit 22 queries a domain name, the threat intelligence analysis and backtracking unit 22 performs a backtracking of a certain period of time to the sidetracking analysis module 30 to find out the IP address associated with the domain name (e.g., D _i ={IP ₁ ,IP ₂ ,...,IP _n }). Then, the threat intelligence analysis and tracing unit 22 may regard the associated domain name or IP address as newly added network threat intelligence C and feed it back to the threat intelligence database 21.

In addition, the present invention also provides a computer-readable medium for a user Internet protection method based on network threat intelligence, which is applied to a computing device or computer having a processor and/or memory, and the computer-readable medium stores instructions, and the computing device or computer can execute the computer-readable medium through the processor and/or memory to execute the above content when executing the computer-readable medium.

In one embodiment, the processor may be a processing circuit, a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MPU), a microcontroller (MCU), etc., the memory may be a random access memory (RAM), a read-only memory (ROM), a flash memory, a memory card, a hard disk (such as a cloud/network/external hard disk), an optical disk, a flash drive, a database, etc., and the computing device or computer may be a computer, a smart phone, a tablet computer, a personal computer, a laptop, a desktop computer, a server (such as a cloud/remote/network server), etc.

In summary, the user online protection system and method based on network threat intelligence described in the present invention have at least the following features, advantages or technical effects.

1. When a user device makes a connection request (such as an Internet access request), the present invention can automatically route all network traffic (such as network communications) associated with the connection request (such as an Internet access request) through a traffic diversion and filtering module to prevent the user device from connecting to external malicious websites/malicious IP addresses/malicious domain names. It can also monitor the connection requests of internal user devices against external malicious websites/malicious IP addresses/malicious domain names to prevent malicious connections or malicious connection behaviors (such as network scanning, etc.).

2. The user online protection system based on network threat intelligence described in the present invention is an innovative network threat intelligence online protection system that can quickly block malicious connections or malicious connection behaviors of user devices to any external malicious websites, malicious IP addresses and malicious domain names.

3. The present invention can effectively utilize the big data such as network threat intelligence (such as IP addresses and domain names) stored in the threat intelligence database of the threat intelligence module to protect the Internet security of user devices and reduce the risks of Internet access of user devices.

4. The threat intelligence analysis and backtracking unit of the threat intelligence module of the present invention can provide a threat intelligence reputation calculation method to effectively calculate the threat intelligence reputation score based on the pre-defined distribution model and the domain name to be analyzed, thereby quickly finding possible or potential domain threat intelligence, and can also judge whether an unknown domain name has a threat risk based on the threat intelligence reputation score.

5. The threat intelligence module of the present invention can analyze unknown domain names (such as domain names that have not been detected). When the analysis result of the threat intelligence module is that the unknown domain name has a threat risk (such as a high risk or potential risk), the threat intelligence module automatically traces back the connection of the threat risk intelligence and adds new network threat intelligence, so as to effectively improve the richness and breadth of network threat intelligence.

6. The traffic profiling unit of the profiling analysis module of the present invention can automatically or effectively profile, analyze or save all network traffic (such as network traffic) passing through the traffic diversion and filtering module.

7. The retrospective analysis unit of the sidetrack analysis module of the present invention can automatically feed back the retrospective results of the connection of the network threat intelligence to the threat intelligence module to add the content of the network threat intelligence of the threat intelligence module. It can also query and associate network threat intelligence in real time through services (such as domain name services) to effectively achieve the purpose of retrospection and real-time protection of network threat intelligence.

8. The present invention can increase or strengthen the timeliness, accuracy and completeness of the content of network threat intelligence through the positive cycle of network threat intelligence, and can also comprehensively improve the early warning and response capabilities of network security incidents (such as network information security incidents), and can also reduce the network security risks of user devices (such as network information security risks).

The above implementation forms are only illustrative of the principles, features and effects of the present invention, and are not intended to limit the scope of implementation of the present invention. Anyone familiar with this technology can modify and change the above implementation forms without violating the spirit and scope of the present invention. Any equivalent changes and modifications completed using the content disclosed by the present invention should still be covered by the scope of the patent application. Therefore, the scope of protection of the present invention should be as listed in the scope of the patent application.

1: User Internet protection system

10: Flow diversion and filtration module

11: Flow diversion unit

12: Flow filter unit

20: Threat Intelligence Module

21: Threat Intelligence Database

22: Threat intelligence analysis and backtracking unit

30: Profile analysis module

31: Traffic recording unit

32: Retrospective analysis unit

A: User device

B: Internet

Claims (14)

A user Internet protection system based on network threat intelligence includes: a traffic diversion and filtering module, which filters the network traffic related to the connection request of the user device through the traffic diversion and filtering module when the user device makes a connection request to prevent the user device from connecting to any of the external malicious websites, malicious IP (Internet Protocol) addresses and malicious domain names; a threat intelligence module, which provides the latest network threat intelligence so that the user device can When any of the external malicious website, malicious IP address and malicious domain name conducts malicious connection or malicious connection behavior, the threat intelligence module blocks or protects the user device from the malicious connection or malicious connection behavior of any of the external malicious website, malicious IP address and malicious domain name according to the content of the latest network threat intelligence; and a side-recording analysis module, which side-records, copies or saves the network traffic passing through the traffic diversion and filtering module, wherein the threat The intelligence module analyzes the network traffic passing through the traffic diversion and filtering module for network threat intelligence. When the analysis result of the network threat intelligence is that the network threat intelligence has a threat risk, the sidetrack analysis module backtracks the connection of the network threat intelligence, so that the sidetrack analysis module feeds back the backtracking result of the connection of the network threat intelligence to the threat intelligence module to add the content of the network threat intelligence of the threat intelligence module. Traffic filtering unit, and the threat intelligence module has a threat intelligence analysis and tracing unit, so that when the threat intelligence analysis and tracing unit of the threat intelligence module receives the domain name to be analyzed sent by the traffic filtering unit of the traffic diversion and filtering module, the threat intelligence analysis and tracing unit uses the threat intelligence reputation calculation method to calculate the pre-defined distribution model and the domain name to be analyzed to obtain the threat intelligence reputation score of the domain name to be analyzed. As described in claim 1, the user online protection system, wherein the traffic diversion and filtering module further has a traffic diversion unit, so that the traffic diversion unit of the traffic diversion and filtering module controls the direction of the network traffic, and the traffic filtering unit of the traffic diversion and filtering module determines whether the network traffic contains the network threat information of the malicious IP address or the malicious domain name. The user Internet protection system as described in claim 1, wherein the traffic diversion and filtering module further comprises a traffic diversion unit, so that when the user device intends to make the connection request to the outside, the traffic diversion unit parses and extracts the destination IP address, DNS (Domain Name Service) query request, and the response IP address record included in the user device's connection request to the outside, and the traffic diversion unit transmits the destination IP address/domain name to the traffic filtering unit, and then the traffic filtering unit The flow filtering unit compares the destination IP address/domain name with the latest updated network threat information. If the comparison result of the traffic filtering unit is that the destination IP address/domain name matches the latest updated network threat information, it means that the user device has a threatening connection behavior to the external connection request, and the traffic filtering unit responds to the threatening connection behavior to the traffic diversion unit so that the traffic diversion unit rejects the user device's external connection request. The user Internet protection system as described in claim 1, wherein the traffic diversion and filtering module further comprises a traffic diversion unit, which parses and extracts the IP address of the source end included in the external to internal connection behavior, and transmits the IP address of the source end to the traffic filtering unit by the traffic diversion unit, and then compares the IP address of the source end with the latest updated The two are compared with the network threat intelligence. If the comparison result of the traffic filtering unit is that the IP address of the source end matches the updated latest network threat intelligence, it means that the external to internal connection request is a threatening connection behavior, and the traffic filtering unit responds to the threatening connection behavior to the traffic diversion unit so that the traffic diversion unit rejects the external to internal connection request. As described in claim 1, the user online protection system, wherein the threat information module further has a threat information database, so that the threat information database of the threat information module stores the network threat information, and the threat information analysis and backtracking unit of the threat information module analyzes whether the network threat information to be added is malicious threat information. As described in claim 1, the user online protection system, wherein the threat intelligence module further has a threat intelligence database, so that the threat intelligence database of the threat intelligence module stores the network threat intelligence of IP addresses and domain names, and the threat intelligence module regularly pushes the latest network threat intelligence in the threat intelligence database to the traffic diversion and filtering module, and then the traffic diversion and filtering module filters whether there is the malicious connection or malicious connection behavior in the network traffic according to the latest network threat intelligence. The user online protection system as described in claim 1, wherein the sidetracking analysis module has a traffic sidetracking unit and a backtracking analysis unit, so that the traffic sidetracking unit of the sidetracking analysis module sidetracks and saves all network traffic, and the backtracking analysis unit of the sidetracking analysis module analyzes the network threat information and queries the historical network traffic. The user Internet protection system as described in claim 1, wherein the traffic diversion and filtering module further has a traffic diversion unit, and the profile analysis module has a traffic profile unit, so that the traffic filtering unit of the traffic diversion and filtering module transmits the connection analysis result of the query request record of the unmatched domain name service to the threat intelligence module to analyze the network threat intelligence during the monitoring process of the internal to external connection, and the traffic diversion unit of the traffic diversion and filtering module profiles the network traffic of the internal to external connection or copies a copy to the traffic profile unit of the profile analysis module for storage. A method for protecting users from Internet access based on network threat intelligence includes: when a user device makes a connection request, a traffic diversion and filtering module filters the network traffic related to the connection request of the user device to prevent the user device from connecting to any of external malicious websites, malicious IP (Internet Protocol) addresses and malicious domain names; a threat intelligence module provides the latest network threat intelligence so that the user device can When any of the malicious websites, malicious IP addresses and malicious domain names conduct malicious connections or malicious connection behaviors, the latest network threat intelligence content will block or protect the user device from the malicious connections or malicious connection behaviors of any of the external malicious websites, malicious IP addresses and malicious domain names; a sidetracking analysis module sidetracks, copies or saves the network traffic passing through the traffic diversion and filtering module, and the threat intelligence module will The network traffic of the traffic diversion and filtering module is used to analyze the network threat intelligence. When the analysis result of the network threat intelligence is that the network threat intelligence has a threat risk, the sidetracking analysis module performs a backtracking of the connection of the network threat intelligence, so that the sidetracking analysis module feeds back the backtracking result of the connection of the network threat intelligence to the threat intelligence module to add the content of the network threat intelligence of the threat intelligence module; and the threat intelligence of the threat intelligence module The analysis and tracing back unit performs tracing back or analysis based on the unknown request in the network threat information. If the unknown request in the network threat information is an unknown domain name, the threat information analysis and tracing back unit calculates the threat information reputation score of the unknown domain name through the threat information reputation calculation method, so that the threat information analysis and tracing back unit determines whether the unknown domain name has a threat risk based on the threat information reputation score of the unknown domain name. The user Internet protection method as described in claim 9 further includes the traffic filtering unit of the traffic diversion and filtering module performing a real-time comparison of the current connection request with the network threat intelligence in the threat intelligence database of the threat intelligence module, wherein if the traffic filtering unit matches the current connection request to the malicious IP address or malicious domain name of the network threat intelligence, the traffic filtering unit rejects the current connection request, and if the traffic filtering unit does not match the current connection request to the malicious IP address of the network threat intelligence, the traffic filtering unit determines that the IP address of the current connection request is a non-malicious IP address and approves the current connection request. The user Internet protection method as described in claim 10 further includes: if the traffic filtering unit does not match the domain name of the network threat intelligence for the current connection request, the traffic filtering unit determines that the domain name of the current connection request is an unknown domain name, and the traffic filtering unit queries all corresponding IP addresses of the unknown domain name through the domain name service server, and then transmits all corresponding IP addresses one by one to the traffic filtering unit through the domain name service server for comparison or detection. The user Internet protection method as described in claim 9 further includes the threat intelligence analysis and tracing unit of the threat intelligence module tracing back or analyzing the malicious request in the network threat intelligence, wherein if the malicious request in the network threat intelligence is the malicious IP address or the malicious corresponding IP address, the threat intelligence analysis and tracing unit traces back the associated domain name through the network traffic data sidetracked by the traffic sidetracking unit of the sidetracking analysis module, and then the threat intelligence analysis and tracing unit adds the associated domain name to the threat intelligence database. The user online protection method as described in claim 9 further includes that when the threat intelligence analysis and tracing unit queries the IP address, the threat intelligence analysis and tracing unit performs a certain time period of history backtracking to the sidetrack analysis module to find the domain name associated with the IP address, and when the threat intelligence analysis and tracing unit queries the domain name, the threat intelligence analysis and tracing unit performs a certain time period of history backtracking to the sidetrack analysis module to find the IP address associated with the domain name. A computer-readable medium, used in a computing device or a computer, stores instructions for executing a user Internet protection method based on network threat intelligence as described in any one of claims 9 to 13.

Images