CN114329451A - A security analysis method, apparatus, device and readable storage medium - Google Patents

Abstract

The application discloses a security analysis method, a security analysis device, a security analysis equipment and a readable storage medium. According to the method and the device, based on the target log information of which the damage degree is higher than the damage degree threshold value and the alarm certainty factor is higher than the certainty factor threshold value in the alarm log, after the attacked state of the equipment is determined, the alarm log is analyzed by using the analysis strategy corresponding to the attacked state, and the alarm log can be analyzed in a targeted manner according to different analysis strategies. Such as: when the equipment is in an attacked state, performing key analysis on an alarm log generated at the current moment; when the equipment is in a controlled state, the alarm information at the current moment, before the current moment and after the current moment is subjected to key analysis, so that the current attack event is accurately analyzed based on the alarm log, and the analysis efficiency and the accuracy rate can be improved. Accordingly, the safety analysis device, the equipment and the readable storage medium provided by the application also have the technical effects.

Description

A security analysis method, apparatus, device and readable storage medium

technical field

The present application relates to the field of computer technology, and in particular, to a security analysis method, apparatus, device, and readable storage medium.

Background technique

At present, the alarm log can be analyzed with the correlation analysis rule. For example, to formulate an association rule such as A-B-C, when events A, B, and C occur in sequence within a period of time, it is considered an accurate attack event, and A, B, and C are accurate alarms. Hackers attack The process is A-B-C.

However, correlation analysis rules need to be built in a large number of correlation rules in the device in advance, so security analysts need to analyze the attack events that have occurred to determine the correlation rules. However, the attack methods are complex and changeable. Therefore, the association rules determined based on historical attack events may not be suitable for new attack events, and a large number of false positives will be introduced due to the existence of low-confidence logs in the logs to be associated.

Therefore, how to accurately analyze the attack event based on the alarm log is a problem to be solved by those skilled in the art.

SUMMARY OF THE INVENTION

In view of this, the purpose of the present application is to provide a security analysis method, apparatus, device and readable storage medium to more accurately analyze attack events based on alarm logs. Its specific plan is as follows:

In a first aspect, the present application provides a security analysis method, including:

Get the alarm log in the target device;

Determine, in the alarm log, target log information whose hazard degree is higher than the hazard degree threshold and whose alarm certainty is higher than the certainty threshold, and determine the attacked state of the target device based on the target log information;

The alarm log is analyzed by using an analysis policy corresponding to the attacked state.

Preferably, the target log information determined in the alarm log that the hazard degree is higher than the hazard degree threshold and the alarm confidence degree is higher than the alarm confidence degree threshold includes:

The hazard degree and the alarm certainty of each piece of log information in the alarm log are determined, so as to select the target log information from the pieces of log information according to the hazard degree threshold and the certainty threshold.

Preferably, it also includes:

Select log information to be evaluated whose alarm certainty is lower than the certainty threshold from various pieces of log information according to the hazard degree threshold and the certainty threshold;

If it is determined that the log information to be evaluated is a false alarm, the log information to be evaluated is deleted from the alarm log.

Preferably, if the alarm frequency of the log information to be evaluated is higher than a frequency threshold, and/or the common degree of the log information to be evaluated is higher than the common degree threshold, it is determined that the log information to be evaluated is a false alarm; otherwise, It is determined that the log information to be evaluated does not belong to false alarms.

Preferably, if it is determined that the log information to be evaluated does not belong to false alarms, the log information to be evaluated is retained.

Preferably, the determining the attacked state of the target device based on the target log information includes:

The attacked state is determined based on the access direction, attack attribute and attack result of the target log information.

Preferably, analyzing the alarm log by using an analysis policy corresponding to the attacked state includes:

If the attacked state is the attacking state, display the log information in the alarm log with a hazard level higher than the hazard level threshold according to the timeline;

and / or

If the attacked state is the successful attack state, the log information in the alarm log with the degree of harm higher than the threshold of the degree of harm is displayed according to the timeline, and the attack time point and the corresponding attack IP are marked in the timeline. address, using the security management and control strategy to process the log information newly generated after the current moment and whose hazard degree is higher than the hazard degree threshold, and monitor the log information newly generated after the current moment and whose hazard degree is lower than the hazard degree threshold;

and / or

If the attacked state is the controlled state, the alarm log is displayed according to the timeline, and the attack time point and the corresponding attack IP address, the controlled time point and the corresponding controlled state are marked in the timeline. behavior, and use the security management and control policies to process all log information newly generated after the current moment.

In a second aspect, the present application provides a safety analysis device, comprising:

The acquisition module is used to acquire the alarm log in the target device;

A determining module, configured to determine, in the alarm log, target log information whose hazard degree is higher than the hazard degree threshold and whose alarm certainty is higher than the certainty threshold, and determine the attacked state of the target device based on the target log information ;

An analysis module, configured to analyze the alarm log by using an analysis policy corresponding to the attacked state.

In a third aspect, the present application provides an electronic device, comprising:

memory for storing computer programs;

A processor for executing the computer program to implement the security analysis method disclosed above.

In a fourth aspect, the present application provides a readable storage medium for storing a computer program, wherein when the computer program is executed by a processor, the security analysis method disclosed above is implemented.

It can be seen from the above solutions that the present application provides a security analysis method, which includes: obtaining an alarm log in a target device; determining in the alarm log that the degree of hazard is higher than the threshold of the degree of hazard, and the alarm certainty is higher than the certainty threshold target log information, and determine the attacked state of the target device based on the target log information; analyze the alarm log by using an analysis strategy corresponding to the attacked state.

It can be seen that this application first determines the attacked state of the device based on the target log information in the alarm log where the hazard degree is higher than the hazard degree threshold and the alarm confidence is higher than the confidence threshold, and then uses the analysis strategy corresponding to the attacked state to analyze. Alarm logs, so that alarm logs can be analyzed according to different analysis strategies. For example: when the device is under attack, focus on analyzing the alarm log generated at the current moment; or, when the device is under control, focus on the alarm information at the current moment, before the current moment, and after the current moment Analysis, so as to accurately analyze the current attack events based on the alarm log without correlating historical attack events, and also improve the analysis efficiency and accuracy.

Correspondingly, a security analysis device, device and readable storage medium provided by the present application also have the above technical effects.

Description of drawings

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the accompanying drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are only It is an embodiment of the present application. For those of ordinary skill in the art, other drawings can also be obtained according to the provided drawings without any creative effort.

1 is a flowchart of a security analysis method disclosed in the application;

2 is a flowchart of another security analysis method disclosed in the application;

3 is a schematic diagram of a safety analysis device disclosed in the application;

4 is a schematic diagram of an electronic device disclosed in the application;

FIG. 5 is a schematic diagram of another electronic device disclosed in this application.

Detailed ways

The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

Currently, a large number of association rules need to be built into the device in advance for association analysis rules. Therefore, security analysts need to analyze the attack events that have occurred to determine the association rules. However, the attack methods are complex and changeable. Therefore, the association rules determined based on historical attack events may not be suitable for new attack events, and a large number of false positives will be introduced due to the existence of low-confidence logs in the logs to be associated. To this end, the present application provides a security analysis solution that can more accurately analyze attack events based on alarm logs.

Referring to FIG. 1 , an embodiment of the present application discloses a security analysis method, including:

S101. Obtain an alarm log in a target device.

In this embodiment, the target device may be a server, a terminal, a gateway, or the like. Each log message in the alarm log can be marked with a hazard degree and a certainty degree, and this mark is automatically generated based on the preset marking rules when the log information is generated. For example, if the preset marking rule is that the exploit behavior is of high hazard and has a high degree of certainty, then the log information about the exploit behavior of the vulnerability can be marked with a high hazard and a high degree of certainty. Of course, the degree of harm and the degree of certainty can be expressed in points. Such as: take a value from 0 to 1.

S102. Determine target log information in the alarm log with a hazard degree higher than a hazard degree threshold and an alarm certainty degree higher than the certainty degree threshold, and determine the attacked state of the target device based on the target log information.

Among them, the hazard degree threshold and the certainty threshold can be set flexibly. Assuming that both the degree of hazard and the degree of certainty are obtained from 0 to 1, the threshold of degree of hazard and the threshold of certainty can be 0.6. Then the target log information whose hazard degree is higher than the hazard degree threshold and the alarm confidence degree is higher than the confidence threshold value is the log information whose hazard degree is higher than 0.6 and the alarm confidence degree is higher than 0.6.

Since the hazard degree of the target log information is higher than the hazard degree threshold, and the alarm confidence is higher than the confidence threshold, it means that the target log information is very likely to record an attack event, then the attacked device can be determined based on the target log information. state. The attacked state is: being attacked, successfully attacked, controlled, etc.

Generally, based on the access direction, the attack attribute and the attack result, it can be determined whether the device is being attacked, or has been successfully attacked, or has been controlled. Therefore, in a specific implementation manner, determining the attacked state of the target device based on the target log information includes: determining the attacked state based on the access direction, attack attribute and attack result of the target log information.

The access direction can be determined through directional access information such as source IP and destination IP. It can be seen from the access direction: whether the current device actively initiates the access or passively accepts the access, according to the difference between the internal network and the external network, it can be divided into: from the inside to the outside, from the outside to the inside, and from the inside to the inside.

Attack attributes can be divided into attack classes and control classes. The attack class is: other devices attack the current device. The control class is: other devices control the current device to attack the third device.

The attack result is: being attacked, successfully attacked, and/or controlled, etc. After a device is attacked, another attack event may occur, so the attacked state of the device may not be unique.

S103: Analyze the alarm log by using an analysis strategy corresponding to the attacked state.

In this embodiment, after determining the attacked state of the device based on the target log information in the alarm log where the hazard degree is higher than the hazard degree threshold and the alarm certainty is higher than the certainty threshold, an analysis strategy corresponding to the attacked state is used to Analyze the alarm log, so that the alarm log can be analyzed according to different analysis strategies.

For example: when the device is under attack, focus on analyzing the alarm log generated at the current moment; or, when the device is under control, focus on the alarm information at the current moment, before the current moment, and after the current moment Analysis, so as to accurately analyze the current attack events based on the alarm log without correlating historical attack events, and also improve the analysis efficiency and accuracy.

Based on the above embodiment, it should be noted that, in a specific implementation manner, determining in the alarm log the target log information whose hazard degree is higher than the hazard degree threshold and the alarm confidence degree is higher than the alarm confidence degree threshold includes: determining the alarm The hazard degree and alarm confidence degree of each log information in the log, to select the target log information from each log information according to the hazard degree threshold and the confidence threshold, that is, select the hazard degree higher than the hazard degree threshold, and the alarm confidence degree is high Log information about the alarm confidence threshold.

Since each log information is marked with a hazard degree and a certainty degree, the log information to be evaluated whose alarm certainty degree is lower than the certainty degree threshold value can also be selected from the various log information according to the hazard degree threshold value and the certainty degree threshold value.

If it is determined that the log information to be evaluated is a false alarm, the log information to be evaluated is deleted from the alarm log to remove error information in the alarm log, reduce the data volume of the alarm log, and provide favorable conditions for subsequent analysis.

If it is determined that the log information to be evaluated is not a false alarm, the log information to be evaluated is retained to maintain the comprehensiveness of the alarm information and improve the accuracy of the alarm log. At the same time, the log information to be evaluated that is not a false alarm can also indicate that the device is being attacked, has been controlled, etc. This status is recorded together with the status determined based on the target log information.

Wherein, if the alarm frequency of the log information to be evaluated is higher than the frequency threshold, and/or the common degree of the log information to be evaluated is higher than the common degree threshold, it is determined that the log information to be evaluated is a false alarm; otherwise, it is determined that the log information to be evaluated does not belong to false alarm. It can be seen that, based on the alarm frequency of the log information to be evaluated is higher than the frequency threshold, it can be determined whether it is a false alarm. Because attack events are generally incidental events, and normal services running in the device continue and occur in a large area, if the alarm frequency is higher than the frequency threshold, and/or the prevalence is higher than the prevalence threshold, it means that the log information is very likely to belong to The service is falsely reported, so it can be determined to be a false alarm.

Based on the above-mentioned embodiment, it should be noted that, in a specific implementation, analyzing the alarm log by using the analysis strategy corresponding to the attacked state includes: if the attacked state is the attacking state, classifying the alarm log with a high degree of harm The log information below the hazard level threshold is displayed according to the timeline; and/or if the attacked state is the attack success state, the log information in the alarm log with the hazard level higher than the hazard level threshold will be displayed according to the timeline, and in the timeline Mark the attack time point and the corresponding attack IP address in the middle, use the security control strategy to process the log information newly generated after the current moment and whose damage degree is higher than the threshold Monitor the log information of the damage degree threshold; and/or if the attacked state is the controlled state, display the alarm log according to the timeline, and mark the attack time point and the corresponding attack IP address and control time in the timeline. point and the corresponding controlled behavior, and use the security control policy to process all log information newly generated after the current moment.

Since the attacked state of the device is determined based on the log information in the alarm log with a high degree of harm and high alarm certainty, after the attacked state of the device is determined, it means that an attack event has been recorded in the alarm log.

It can be seen that if the device is being attacked, it means that information about the attack has been recorded in the alarm log, and the high-hazard alarms in the alarm log are very dangerous. Therefore, log information in the alarm log with a degree of damage higher than the threshold of the degree of damage in the alarm log is sorted according to the time line. It is displayed so that technicians can view important information such as the time when the attack event was initiated.

If the device has been successfully attacked, it means that the alarm log has recorded important information such as the time when the attack event was initiated and the current time when the device was breached, and the device is likely to perform other high-risk operations in the future. The log information with a degree higher than the threshold of the degree of damage is displayed according to the timeline, and the attack time point and the corresponding attack IP address are marked in the timeline, and then the security control strategy is used to deal with the newly generated after the current moment, the degree of damage is higher than the degree of damage The log information of the threshold value is monitored, and the log information newly generated after the current moment and the degree of damage is lower than the threshold value of the degree of damage is monitored, and the harmful operation performed by the device is timely responded. Such as: preventing the installation of unknown software, deletion of important files, etc. Because the device has been successfully attacked at this time, you need to pay attention to various new alarms.

If the device is already under control, it means that the alarm log has recorded important information such as the time when the attack event was initiated, the time when the current device was breached, the behavior and time when the current device attacked other devices, and it is very likely that the device will follow up. Continue to perform other high-risk operations, so display the alarm log according to the timeline, and mark the attack time point and the corresponding attack IP address, the controlled time point and the corresponding controlled behavior in the timeline, and use the security control strategy to deal with the current situation. All log information newly generated after the time, timely respond to any dangerous operation made by the device. Because the device has been maliciously controlled at this time, all kinds of newly generated alarms may pose a great threat.

For the successfully attacked state and the controlled state, the thresholds of various alarms can be adjusted, so that the device is more sensitive to various alarms and has a lower alarm tolerance, so that the device can pay attention to various alarms.

The following embodiment applies the method provided by the present application to a network security detection device (such as a gateway), see FIG. 2 , and the specific implementation process includes:

1. The network security detection equipment divides the security alarm log of a host in the intranet into four levels according to the hazard level and the confidence level:

Class A log: high hazard, high confidence;

Type B logs: high hazard, low confidence;

Type C logs: low hazard, high confidence;

Class D logs: low hazard, low confidence.

2. When the detection time point is reached, the B and D logs are detected.

Due to the low certainty of B and D logs, there may be a large number of false positives. Analyze the frequency or access relationship of Type B and D logs to determine whether such logs are alarms triggered by hacker attacks or false positives triggered by business access.

1) Use the time series identification algorithm to determine whether these logs are occasional or continuous. Because hacker attacks have strong sporadic characteristics, while business access has strong continuous characteristics. Therefore, if the log is occasional, it is considered to be an alarm caused by a hacker attack event, which is not a false positive; if the log occurs continuously, it is considered to be a false positive triggered by business access.

2) Use the access relationship identification algorithm to determine whether these logs generally occur on a large number of devices or only on a small number of devices. Since a large number of hosts access a server for business access, there will be many-to-one attacks, so the probability of false alarms for this type of alarm is high. Hacking incidents have strong sporadic characteristics, so only a small number of devices are involved in such alarms. It can be determined that the alarms are caused by hacking incidents. At this time, it is necessary to use the access relationship to determine whether access is from the inside to the outside or from the outside to the inside. , or from the inside to the inside.

If it is a false alarm log, delete the related log. If it is determined to be a real attack, keep relevant logs.

3. For Type A logs, determine the security status of the host (attacked, attacked successfully) based on the access direction (external-to-internal attack, internal-to-internal access, internal-external access), attack attributes (attack type, remote control type), and attack result. , has been controlled).

4. According to the security status of the host, determine the alarm log analysis strategy of the host.

(1) If the host is under attack, it means that the host is not currently controlled by hackers, but there is an attack event. At this time, the A and B logs before the current time point can be aggregated according to the attack attribute and the attacker's IP, and an alarm will be issued. The timeline sequence of occurrences is shown.

(2) If the host is successfully attacked, it means that the host is about to be controlled by hackers. At this time, it is necessary to focus on the alarm log at the time of the successful attack, and the type A and B logs before the time should be processed according to the attack attribute and the attacker's IP. Aggregate, and display the alarms in the order of the time line of the alarm occurrence. At the same time, it is necessary to focus on identifying the alarm logs corresponding to the IPs that have successfully attacked. The A and B alarm logs after this time should be responded to and disposed of in time. For example: prevent relevant dangerous operations in time. Monitor and analyze the C and D attack logs of the intranet after this moment.

(3) If the host is already in the state of being controlled (lost), the A, B, C, and D logs before the time need to be aggregated according to the attack attribute and the attacker's IP, and the time line of the alarm occurrence Display, identify in detail the time point when the host was attacked, the time point when it was controlled, and its behavior. At the same time, it is necessary to focus on monitoring and analysis of all alarm logs sent by the controlled host subsequently.

5. Perform steps 2, 3, and 4 every 5 minutes to detect the host in real time.

It can be seen that this embodiment can calculate the security state of the host in real time, automatically analyze the log based on the security state of the host, and automatically mark each process of the hacker attack according to the timeline.

The following describes a safety analysis device provided by an embodiment of the present application. The safety analysis device described below and the safety analysis method described above can be referred to each other.

Referring to FIG. 3 , an embodiment of the present application discloses a security analysis device, including:

an obtaining module 301, configured to obtain an alarm log in the target device;

A determination module 302, configured to determine, in the alarm log, target log information whose hazard degree is higher than the hazard degree threshold and whose alarm certainty is higher than the certainty threshold, and determine the attacked state of the target device based on the target log information;

The analysis module 303 is configured to analyze the alarm log by using the analysis strategy corresponding to the attacked state.

In a specific implementation, the determining module includes:

The first selection unit is configured to determine the hazard degree and alarm certainty of each piece of log information in the alarm log, so as to select target log information from the pieces of log information according to the hazard degree threshold and the certainty threshold.

In a specific embodiment, the determining module further includes:

a second selection unit, configured to select log information to be evaluated whose alarm certainty is lower than the certainty threshold from various pieces of log information according to the hazard degree threshold and the certainty threshold;

The deletion unit is configured to delete the log information to be evaluated from the alarm log if it is determined that the log information to be evaluated belongs to false alarms.

In a specific embodiment, the deletion unit is specifically used for:

If the alarm frequency of the log information to be evaluated is higher than the frequency threshold, and/or the prevalence of the log information to be evaluated is higher than the prevalence threshold, it is determined that the log information to be evaluated is a false alarm; otherwise, it is determined that the log information to be evaluated is not a false alarm .

In a specific embodiment, the determining module further includes:

The retention unit is used to retain the log information to be evaluated if it is determined that the log information to be evaluated does not belong to false alarms.

In a specific embodiment, the determining module is specifically used for:

Determine the attacked state based on the access direction, attack attribute and attack result of the target log information.

In a specific embodiment, the analysis module is specifically used for:

If the attacked state is the attacking state, the log information in the alarm log whose damage degree is higher than the threshold of the damage degree will be displayed according to the timeline;

and / or

If the attacked state is the successful attack state, the log information in the alarm log with the damage degree higher than the damage degree threshold is displayed according to the timeline, and the attack time point and the corresponding attack IP address are marked in the timeline, and the security control strategy is used. Process the log information newly generated after the current moment and whose hazard degree is higher than the hazard degree threshold, and monitor the log information newly generated after the current moment and whose hazard degree is lower than the hazard degree threshold;

and / or

If the attacked state is the controlled state, the alarm log will be displayed according to the timeline, and the attack time point and the corresponding attack IP address, the controlled time point and the corresponding controlled behavior will be marked in the timeline, and the security control strategy will be used. Process all newly generated log information after the current moment.

For the more specific working process of each module and unit in this embodiment, reference may be made to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.

It can be seen that this embodiment provides a security analysis device, which can automatically analyze the log based on the security state of the host, and automatically mark each process of the hacker attack according to the timeline.

The following describes an electronic device provided by an embodiment of the present application. An electronic device described below and a security analysis method and apparatus described above can be referred to each other.

Referring to FIG. 4 , an embodiment of the present application discloses an electronic device, including:

memory 401, used to save computer programs;

The processor 402 is configured to execute the computer program to implement the method disclosed in any of the foregoing embodiments.

Please refer to FIG. 5. FIG. 5 is a schematic diagram of another electronic device provided in this embodiment. The electronic device may vary greatly due to different configurations or performances, and may include one or more processors (central processing units, CPU) 322 (eg, one or more processors) and memory 332, one or more storage media 330 (eg, one or more mass storage devices) storing applications 342 or data 344. Among them, the memory 332 and the storage medium 330 may be short-term storage or persistent storage. The program stored in the storage medium 330 may include one or more modules (not shown in the figure), and each module may include a series of instructions to operate on the data processing device. Furthermore, the central processing unit 322 may be configured to communicate with the storage medium 330 to execute a series of instruction operations in the storage medium 330 on the electronic device 301 .

Electronic device 301 may also include one or more power supplies 326 , one or more wired or wireless network interfaces 350 , one or more input output interfaces 358 , and/or, one or more operating systems 341 . For example, Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, etc.

In FIG. 5, the application 342 may be a program that executes the security analysis method, and the data 344 may be data required or generated to execute the security analysis method.

The steps in the security analysis method described above can be implemented by the structure of the electronic device.

A readable storage medium provided by an embodiment of the present application is introduced below. A readable storage medium described below and a security analysis method, apparatus, and device described above may be referred to each other.

A readable storage medium for storing a computer program, wherein when the computer program is executed by a processor, the security analysis method disclosed in the foregoing embodiments is implemented. For the specific steps of the method, reference may be made to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.

References in this application to "first", "second", "third", "fourth", etc. (if any) are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It is to be understood that data so used may be interchanged under appropriate circumstances so that the embodiments described herein can be practiced in sequences other than those illustrated or described herein. Furthermore, the terms "comprising" and "having", and any variations thereof, are intended to cover non-exclusive inclusion, for example, a process, method or apparatus comprising a series of steps or elements is not necessarily limited to those steps or elements expressly listed , but may include other steps or elements not expressly listed or inherent to these processes, methods or apparatus.

It should be noted that the descriptions involving "first", "second", etc. in this application are only for the purpose of description, and should not be construed as indicating or implying their relative importance or implying the number of indicated technical features . Thus, a feature delimited with "first", "second" may expressly or implicitly include at least one of that feature. In addition, the technical solutions between the various embodiments can be combined with each other, but must be based on the realization by those of ordinary skill in the art. When the combination of technical solutions is contradictory or cannot be realized, it should be considered that the combination of such technical solutions does not exist. , is not within the scope of protection claimed in this application.

The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments may be referred to each other.

The steps of a method or algorithm described in connection with the embodiments disclosed herein may be directly implemented in hardware, a software module executed by a processor, or a combination of the two. The software module can be placed in random access memory (RAM), internal memory, read only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other in the technical field. in any other form of readable storage medium that is well known.

The principles and implementations of the present application are described herein by using specific examples. The descriptions of the above embodiments are only used to help understand the methods and core ideas of the present application. There will be changes in the specific implementation and application scope. To sum up, the content of this specification should not be construed as a limitation on the application.

Claims (10)

1. A security analysis method, comprising:

acquiring an alarm log in target equipment;

determining target log information with the harm degree higher than a harm degree threshold value and the alarm certainty factor higher than a certainty factor threshold value in the alarm log, and determining the attacked state of the target equipment based on the target log information;

and analyzing the alarm log by utilizing an analysis strategy corresponding to the attacked state.

2. The security analysis method according to claim 1, wherein the determining, in the alarm log, target log information with a degree of harm higher than a degree of harm threshold and an alarm certainty degree higher than an alarm certainty degree threshold includes:

and determining the hazard degree and the alarm certainty factor of each piece of log information in the alarm log, and selecting the target log information from each piece of log information according to the hazard degree threshold and the certainty factor threshold.

3. The security analysis method of claim 2, further comprising:

selecting log information to be evaluated with alarm certainty factor lower than the certainty factor threshold from all the log information according to the harm degree threshold and the certainty factor threshold;

and if the log information to be evaluated is determined to belong to the false alarm, deleting the log information to be evaluated from the alarm log.

4. The security analysis method of claim 3,

if the alarm frequency of the log information to be evaluated is higher than a frequency threshold value and/or the popularity of the log information to be evaluated is higher than a popularity threshold value, determining that the log information to be evaluated belongs to false alarm; otherwise, determining that the log information to be evaluated does not belong to the false alarm.

5. The security analysis method of claim 3,

and if the log information to be evaluated does not belong to the false alarm, keeping the log information to be evaluated.

6. The security analysis method of claim 1, wherein the determining the attacked state of the target device based on the target log information comprises:

and determining the attacked state based on the access direction, the attack attribute and the attack result of the target log information.

7. The security analysis method according to any one of claims 1 to 6, wherein the analyzing the alarm log by using the analysis policy corresponding to the attacked state includes:

if the attacked state is the attacking state, displaying the log information of which the harm degree is higher than the harm degree threshold value in the alarm log according to a time line;

and/or

If the attacked state is an attack success state, displaying the log information of which the harm degree is higher than the harm degree threshold value in the alarm log according to a time line, marking an attack time point and a corresponding attack IP address in the time line, processing the log information which is newly generated after the current time and of which the harm degree is higher than the harm degree threshold value by using a safety control strategy, and monitoring the log information which is newly generated after the current time and of which the harm degree is lower than the harm degree threshold value;

and/or

And if the attacked state is the controlled state, displaying the alarm log according to a time line, marking an attack time point, a corresponding attack IP address, a controlled time point and a corresponding controlled behavior in the time line, and processing all log information newly generated after the current time by using a security management and control strategy.

8. A security analysis apparatus, comprising:

the acquisition module is used for acquiring an alarm log in the target equipment;

the determining module is used for determining target log information of which the harm degree is higher than a harm degree threshold value and the alarm certainty factor is higher than a certainty factor threshold value in the alarm log, and determining the attacked state of the target equipment based on the target log information;

and the analysis module is used for analyzing the alarm log by utilizing an analysis strategy corresponding to the attacked state.

9. An electronic device, comprising:

a memory for storing a computer program;

a processor for executing the computer program to implement the security analysis method of any one of claims 1 to 7.

10. A readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the security analysis method of any one of claims 1 to 7.

Images