CN115834219A - Network asset evaluation processing method, device, server and medium - Google Patents

Abstract

The application provides a network asset evaluation processing method, a device, a server and a medium, comprising the following steps: the method comprises the steps of obtaining an open source port, a non-open source port and corresponding risk index values according to IP data flow information of the to-be-detected network device, obtaining a first attack characteristic and a first threat coefficient corresponding to the open source port and a second attack characteristic and a second threat coefficient corresponding to the non-open source port according to an illegal attack library, obtaining index values corresponding to illegal behaviors according to the type and the number of times of the illegal behaviors corresponding to a source IP address of the to-be-detected network device, obtaining an asset dynamic basic value and an asset dynamic value according to the index values corresponding to the illegal behaviors and a dynamic mean value corresponding to each index value, and obtaining an asset comprehensive evaluation result corresponding to the source IP address according to an asset evaluation value, an asset dynamic basic value and an asset dynamic value corresponding to the source IP address. The problem that in the prior art, only the asset health degree of an enterprise intranet can be evaluated is solved.

Description

Method, device, server and medium for evaluating and processing network assets

technical field

The present application relates to the technical field of network security, and in particular to a network asset assessment processing method, device, server and medium.

Background technique

With the continuous development of Internet technology, network security risks are increasing rapidly. Knowing the health of network asset addresses in a timely manner and evaluating the health of network asset addresses can grasp the situation of servers facing network security risks.

In the existing technology, large enterprises deploy probes at the network boundary between the enterprise intranet and the public network to obtain the security log of the interaction between the enterprise intranet and the public network, monitor the security log, and obtain the network asset address of the enterprise intranet Health status, and evaluate the health status of network asset addresses in the enterprise intranet.

However, the existing technology can only evaluate the health of the network asset address of the enterprise intranet, and cannot evaluate the threat of the public network, which has certain limitations.

Contents of the invention

The present application provides a network asset evaluation processing method, device, server and medium to solve the problem in the prior art that only the health of the asset address of the intranet can be evaluated.

In the first aspect, the present application provides a network asset evaluation processing method, including:

According to the source IP address, source port, destination IP address and destination port in the IP data flow information of the network equipment to be detected, determine the open source port and the non-open source port from the source port, and obtain the open source port The risk indicator value corresponding to the source port.

From the destination IP address and destination port, respectively determine the first connection IP information corresponding to the open source port and the second IP connection information corresponding to the non-open source port.

Querying the pre-configured illegal attack library, respectively obtaining the first attack feature and the first threat factor corresponding to the first connection IP information, and the second attack feature and the second threat factor corresponding to the second IP connection information .

Identifying the type of illegal behavior and the number of times of illegal behavior corresponding to the source IP address obtained through monitoring, and according to the type of illegal behavior and the number of times of illegal behavior, and the first attack corresponding to the first connected IP information The feature and the first threat factor, and/or the second attack feature and the second threat factor corresponding to the second connection IP information, acquire the index value corresponding to the illegal behavior.

According to the risk index value corresponding to the open source port, the index value corresponding to the illegal behavior, and the dynamic mean value corresponding to each index value, the asset dynamic basic value and the asset dynamic value are obtained.

According to the obtained asset type, level and historical vulnerability information corresponding to the source IP address, the asset evaluation value corresponding to the source IP address is obtained.

According to the asset dynamic basic value, the asset dynamic value, and the asset evaluation value, obtain the asset comprehensive evaluation result corresponding to the source IP address of the network device to be detected, so as to perform the asset comprehensive evaluation result according to the asset comprehensive evaluation result Manage the network corresponding to the network device.

In a specific embodiment, it also includes:

Obtaining network-wide asset information, where the network-wide asset information includes: an IP address and parameter information corresponding to the IP address.

For each IP address, according to the parameter information corresponding to the IP address and the preset attack threshold, when it is determined that the IP address is an illegal attack address, the attack characteristics and threat coefficient corresponding to the IP address are obtained, and the The IP address, and the attack feature and threat coefficient corresponding to the IP address are stored in the pre-configured illegal attack database.

In a specific implementation manner, according to the parameter information corresponding to the IP address and the preset attack threshold, when it is determined that the IP address is an illegal attack address, the attack characteristics and threats corresponding to the IP address are obtained. Coefficients, including:

It is determined that the ICMP ratio in the parameter information corresponding to the IP address is greater than the first asset detection threshold, the number of detected IP and C segment is greater than or equal to the second asset detection threshold, and the detected IP and B segment number is greater than or equal to the third asset detection When the threshold is reached, it is determined that the IP address is an illegal attack address, and the attack feature corresponding to the IP address is acquired as an asset detection feature, and the threat factor is a first preset threat factor.

or,

When it is determined that the port number ratio in the parameter information corresponding to the IP address is greater than the first full port scan threshold, or the number of ports is greater than the second full port scan threshold, determine that the IP address is an illegal attack address, and obtain the IP The attack feature corresponding to the address is a full port scan feature, and the threat factor is a second preset threat factor.

or,

When determining that the WEB port ratio in the parameter information corresponding to the IP address is greater than the first WEB scan and crawler threshold, and the average number of packets is greater than the second WEB scan and crawler threshold, determine that the IP address is an illegal attack address, and The attack feature corresponding to the acquired IP address is a WEB scanning and crawler feature, and the threat factor is a third preset threat factor.

In a specific implementation manner, the first Connect IP information includes: the first Connect IP address and the corresponding first Connect port; the second Connect IP information includes: the second Connect IP address and The corresponding second communication port.

Wherein, the first connection IP address is the destination IP address corresponding to the open source port, and the first connection port is the destination port corresponding to the open source port.

The second connection IP address is the destination IP address corresponding to the non-open source port, and the second connection port is the destination port corresponding to the non-open source port.

In a specific implementation manner, the type of illegal behavior and the number of times of illegal behavior corresponding to the source IP address acquired by the identification monitoring, and according to the type of illegal behavior and the number of times of illegal behavior, and the first A first attack feature and a first threat coefficient corresponding to the connected IP information, and/or a second attack feature and a second threat coefficient corresponding to the second connected IP information, and obtaining an index value corresponding to the illegal behavior, include:

When identifying the type of illegal behavior corresponding to the source IP address acquired through monitoring as an attack type, according to the first attack feature corresponding to the first connected IP information and the second attack feature corresponding to the second connected IP information , determining the communication IP information matching the attack type, and obtaining an attack index according to the number of times of the illegal actions and the threat coefficient corresponding to the communication IP information matching the attack type.

and / or,

When it is identified that the type of illegal behavior corresponding to the source IP address obtained through monitoring is an illegal outreach type, according to the first attack feature corresponding to the first communication IP information and the second attack characteristic corresponding to the second communication IP information, The attack feature determines the communication IP information matching the illegal outreach type, and obtains the illegal outreach indicator according to the number of times of the illegal actions and the threat coefficient corresponding to the communication IP information matching the attack type.

Wherein, the attack type matches the asset detection feature in the attack feature; the illegal outreach type matches the WEB scanning and crawler feature in the attack feature.

In a specific implementation manner, according to the risk indicator value corresponding to the open source port, the indicator value corresponding to the illegal behavior, and the dynamic mean value corresponding to each indicator value, the asset dynamic basic value and asset dynamic value are obtained ,include:

The risk index value corresponding to the open source port and the index value corresponding to the illegal behavior are summed to obtain the dynamic basic value of the asset.

For each index value, it is judged whether the index value is greater than the dynamic mean value corresponding to the index value, and if greater, the index value is corrected to obtain the corrected index value.

The asset dynamic value is obtained according to the index value that does not need to be corrected and the corrected index value.

In a second aspect, the present application provides a network asset evaluation processing device, including:

The obtaining module is used to obtain the source IP address, source port, destination IP address and destination port in the IP data flow information of the network device to be detected, determine the open source port and the non-open source port from the source port, and Obtain the risk indicator value corresponding to the open source port.

A processing module, configured to respectively determine first connection IP information corresponding to the open source port and second IP connection information corresponding to the non-open source port from the destination IP address and destination port.

The acquiring module is further configured to query a pre-configured illegal attack library, respectively acquire the first attack feature and the first threat coefficient corresponding to the first connection IP information, and the first attack characteristic and the first threat coefficient corresponding to the second IP connection information. Two attack characteristics and a second threat factor.

The processing module is further configured to identify the type of illegal behavior and the number of times of illegal behavior corresponding to the source IP address acquired by monitoring, and according to the type of illegal behavior and the number of times of illegal behavior, and the first communication Connect the first attack feature and the first threat factor corresponding to the IP information, and/or the second attack feature and the second threat factor corresponding to the second link IP information, and acquire the index value corresponding to the illegal behavior.

The processing module is further configured to obtain an asset dynamic basic value and an asset dynamic value according to the risk indicator value corresponding to the open source port, the indicator value corresponding to the illegal behavior, and the dynamic mean value corresponding to each indicator value.

The processing module is further configured to acquire an asset evaluation value corresponding to the source IP address according to the acquired asset type, level, and historical vulnerability information corresponding to the source IP address.

The processing module is further configured to obtain the asset comprehensive assessment result corresponding to the source IP address of the network device to be detected according to the asset dynamic basic value, the asset dynamic value, and the asset evaluation value, so as to obtain the asset comprehensive assessment result corresponding to the asset comprehensive As a result of the evaluation, corresponding management is performed on the network corresponding to the network device to be detected.

In a specific implementation manner, the acquisition module is also used for:

Obtaining network-wide asset information, where the network-wide asset information includes: an IP address and parameter information corresponding to the IP address.

For each IP address, according to the parameter information corresponding to the IP address and the preset attack threshold, when it is determined that the IP address is an illegal attack address, the attack characteristics and threat coefficient corresponding to the IP address are obtained, and the The IP address, and the attack feature and threat coefficient corresponding to the IP address are stored in the pre-configured illegal attack database.

In a specific implementation manner, the acquisition module is specifically used for:

It is determined that the ICMP ratio in the parameter information corresponding to the IP address is greater than the first asset detection threshold, the number of detected IP and C segment is greater than or equal to the second asset detection threshold, and the detected IP and B segment number is greater than or equal to the third asset detection When the threshold is reached, it is determined that the IP address is an illegal attack address, and the attack feature corresponding to the IP address is acquired as an asset detection feature, and the threat factor is a first preset threat factor.

or,

When it is determined that the port number ratio in the parameter information corresponding to the IP address is greater than the first full port scan threshold, or the number of ports is greater than the second full port scan threshold, determine that the IP address is an illegal attack address, and obtain the IP The attack feature corresponding to the address is a full port scan feature, and the threat factor is a second preset threat factor.

or,

When determining that the WEB port ratio in the parameter information corresponding to the IP address is greater than the first WEB scan and crawler threshold, and the average number of packets is greater than the second WEB scan and crawler threshold, determine that the IP address is an illegal attack address, and The attack feature corresponding to the acquired IP address is a WEB scanning and crawler feature, and the threat factor is a third preset threat factor.

In a specific implementation manner, the first Connect IP information includes: the first Connect IP address and the corresponding first Connect port; the second Connect IP information includes: the second Connect IP address and The corresponding second communication port.

Wherein, the first connection IP address is the destination IP address corresponding to the open source port, and the first connection port is the destination port corresponding to the open source port.

The second connection IP address is the destination IP address corresponding to the non-open source port, and the second connection port is the destination port corresponding to the non-open source port.

In a specific implementation manner, the processing module is specifically used for:

When identifying the type of illegal behavior corresponding to the source IP address acquired through monitoring as an attack type, according to the first attack feature corresponding to the first connected IP information and the second attack feature corresponding to the second connected IP information , determining the communication IP information matching the attack type, and obtaining an attack index according to the number of times of the illegal actions and the threat coefficient corresponding to the communication IP information matching the attack type.

and / or,

When it is identified that the type of illegal behavior corresponding to the source IP address obtained through monitoring is an illegal outreach type, according to the first attack feature corresponding to the first communication IP information and the second attack characteristic corresponding to the second communication IP information, The attack feature determines the communication IP information matching the illegal outreach type, and obtains the illegal outreach indicator according to the number of times of the illegal actions and the threat coefficient corresponding to the communication IP information matching the attack type.

Wherein, the attack type matches the asset detection feature in the attack feature; the illegal outreach type matches the WEB scanning and crawler feature in the attack feature.

In a specific implementation manner, the processing module is specifically used for:

The risk index value corresponding to the open source port and the index value corresponding to the illegal behavior are summed to obtain the dynamic basic value of the asset.

For each index value, it is judged whether the index value is greater than the dynamic mean value corresponding to the index value, and if greater, the index value is corrected to obtain the corrected index value.

The asset dynamic value is obtained according to the index value that does not need to be corrected and the corrected index value.

In a third aspect, the present application provides a server, including:

processor, memory, communication interface.

The memory is used for storing executable instructions executable by the processor.

Wherein, the processor is configured to execute the network asset evaluation processing method according to the first aspect by executing the executable instructions.

In a fourth aspect, the present application provides a readable storage medium on which a computer program is stored, wherein, when the computer program is executed by a processor, the network asset evaluation processing method described in the first aspect is implemented.

The present application provides a network asset evaluation processing method, device, server and medium, according to the source IP address, source port, destination IP address and destination port in the acquired IP data flow information of the network equipment to be detected, from the source Determine the open source port and the non-open source port in the port, and obtain the risk index value corresponding to the open source port; from the destination IP address and the destination port, respectively determine the first connection IP corresponding to the open source port information, and the second IP connection information corresponding to the non-open source port; query the pre-configured illegal attack library, and obtain the first attack characteristic and the first threat coefficient corresponding to the first connection IP information, and the The second attack feature and the second threat coefficient corresponding to the second IP connection information; identify the type of illegal behavior and the number of times of illegal behavior corresponding to the source IP address acquired by monitoring, and according to the type of illegal behavior and the number of times of illegal behavior The number of illegal acts, and the first attack feature and first threat factor corresponding to the first connected IP information, and/or the second attack feature and second threat factor corresponding to the second connected IP information, obtained The index value corresponding to the illegal behavior; according to the risk index value corresponding to the open source port, the index value corresponding to the illegal behavior, and the dynamic mean value corresponding to each index value, obtain the asset dynamic basic value and asset dynamic value; According to the obtained asset type, level and historical vulnerability information corresponding to the source IP address, obtain the asset evaluation value corresponding to the source IP address; according to the asset dynamic basic value, asset dynamic value, and asset evaluation value, obtain the asset evaluation value Describe the asset comprehensive assessment result corresponding to the source IP address of the network device to be detected, so as to perform corresponding management on the network corresponding to the network device to be detected according to the comprehensive asset assessment result. Compared with the existing technology, which deploys probes at the network boundary between the internal network and the public network, obtains the security log of the interaction between the internal network and the public network, and evaluates the health of the network asset address of the internal network. Index values corresponding to illegal behaviors of open source ports and non-open source ports of detected network devices, risk index values corresponding to open source ports, dynamic average values corresponding to each index value, and assets corresponding to source IP addresses of network devices to be detected Evaluation value, to obtain the comprehensive asset evaluation result corresponding to the source IP address of the network device to be detected, which is applicable to the evaluation of the health of the asset address of the entire network, has universal applicability, and at the same time reduces the network threat risk of the asset corresponding to the source IP address of the network device , to improve security.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are For some embodiments of the present application, those skilled in the art can also obtain other drawings based on these drawings without any creative work.

FIG. 1 is a schematic flowchart of Embodiment 1 of a network asset evaluation processing method provided by the present application;

FIG. 2 is a schematic flowchart of Embodiment 2 of a network asset evaluation processing method provided by the present application;

FIG. 3 is a schematic structural diagram of an embodiment of a network asset evaluation processing device provided by the present application;

FIG. 4 is a schematic structural diagram of a server provided by the present application.

By means of the above drawings, specific embodiments of the present application have been shown, which will be described in more detail hereinafter. These drawings and text descriptions are not intended to limit the scope of the concept of the application in any way, but to illustrate the concept of the application for those skilled in the art by referring to specific embodiments.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments It is a part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments made by persons of ordinary skill in the art under the inspiration of this embodiment fall within the protection scope of this application.

The terms "first", "second", "third", "fourth", etc. (if any) in the description and claims of this application and the above drawings are used to distinguish similar objects and not necessarily Describe a specific order or sequence. It is to be understood that the data so used are interchangeable under appropriate circumstances such that the embodiments of the application described herein can be practiced in sequences other than those illustrated or described herein. Furthermore, the terms "comprising" and "having", as well as any variations thereof, are intended to cover a non-exclusive inclusion, for example, a process, method, system, product or server comprising a series of steps or elements is not necessarily limited to the expressly listed instead, may include other steps or elements not explicitly listed or inherent to the process, method, product or server.

Explanation of technical terms:

Assets: mainly various devices used in computer (or communication) networks. It mainly includes hosts, network devices (routers, switches, etc.) and security devices (firewalls, etc.). In this application, an asset refers to the IP address of a network device.

In the existing technology, large enterprises deploy probes at the network boundary between the enterprise intranet and the public network to obtain the security log of the interaction between the enterprise intranet and the public network, monitor the security log, and obtain the network asset address of the enterprise intranet Health status, and evaluate the health status of network asset addresses in the enterprise intranet. However, the existing technology can only evaluate the health of the network asset address of the enterprise intranet, and cannot evaluate the threat of the public network, which has certain limitations. Based on this, the technical idea of this application lies in how to evaluate the health of asset addresses in the entire network.

Below, the technical solution of the present application will be described in detail through specific embodiments. It should be noted that the following specific embodiments may be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

Fig. 1 is a schematic flowchart of Embodiment 1 of a network asset evaluation processing method provided by the present application. As shown in Fig. 1, the network asset evaluation processing method specifically includes the following steps:

Step S101: According to the source IP address, source port, destination IP address and destination port in the IP data flow information of the network device to be detected, determine the open source port and the non-open source port from the source port, and obtain the open source port The risk indicator value corresponding to the port.

In this embodiment, different open source ports may correspond to different risk index values. Specifically, the risk index values corresponding to the open source ports are set according to actual requirements.

Step S102: From the destination IP address and the destination port, respectively determine the first connection IP information corresponding to the open source port and the second IP connection information corresponding to the non-open source port.

Step S103: Query the pre-configured illegal attack database, obtain the first attack signature and the first threat coefficient corresponding to the first IP connection information, and the second attack signature and second threat coefficient corresponding to the second IP connection information.

In this embodiment, different attack features may correspond to different threat coefficients. Specifically, the threat coefficients are set according to actual requirements.

Step S104: Identify the type of illegal behavior and the number of times of illegal behavior corresponding to the source IP address obtained by monitoring, and according to the type of illegal behavior and the number of times of illegal behavior, and the first attack feature and the first attack characteristic corresponding to the first connected IP information A threat factor, and/or a second attack feature and a second threat factor corresponding to the second connection IP information, to obtain an index value corresponding to the illegal behavior.

In this embodiment, for example, the indicator value corresponding to the illegal behavior includes at least an attack indicator and an illegal outreach indicator.

Step S105: According to the risk index value corresponding to the open source port, the index value corresponding to the illegal behavior, and the dynamic mean value corresponding to each index value, obtain the asset dynamic basic value and the asset dynamic value.

Step S106: According to the obtained asset type, level and historical vulnerability information corresponding to the source IP address, obtain the asset evaluation value corresponding to the source IP address.

Step S107: According to the asset dynamic basic value, asset dynamic value, and asset evaluation value, obtain the asset comprehensive evaluation result corresponding to the source IP address of the network device to be detected, so that according to the asset comprehensive evaluation result, the network device corresponding to the network device to be detected Manage accordingly.

In this embodiment, by obtaining the index value corresponding to the illegal behavior of the open source port and the non-open source port of the network device to be detected, the risk index value corresponding to the open source port, the dynamic mean value corresponding to each index value, and the The asset evaluation value corresponding to the source IP address of the network device can obtain the comprehensive asset evaluation result corresponding to the source IP address of the network device to be detected. To obtain the security log of the interaction between the enterprise intranet and the public network, monitor the security log, obtain the health status of the network asset address of the enterprise intranet, and evaluate the health status of the network asset address of the enterprise intranet. It is universal to evaluate the health of network asset addresses, and at the same time reduces the risk of network threats to assets corresponding to the source IP addresses of network devices and improves security.

Fig. 2 is a schematic flow diagram of Embodiment 2 of a network asset evaluation processing method provided by the present application. As shown in Fig. 2, the network asset evaluation processing method specifically includes the following steps:

Step 201: Obtain asset information of the entire network.

In this embodiment, the asset information of the entire network includes: an IP address and parameter information corresponding to the IP address.

Step 202: For each IP address, according to the parameter information corresponding to the IP address and the preset attack threshold, when the IP address is determined to be an illegal attack address, obtain the attack characteristics and threat coefficient corresponding to the IP address, and compare the IP address, And the attack characteristics and threat factors corresponding to the IP address are stored in the pre-configured illegal attack library.

In this embodiment, the reference information is shown in Table 1 Reference Information.

Table 1 Reference information

In this embodiment, the ICMP ratio in the parameter information corresponding to the determined IP address is greater than the first asset detection threshold, the number of detected IP and C segments is greater than or equal to the second asset detection threshold, and the detected IP and B segment numbers are greater than or equal to When the third asset detection threshold is reached, the IP address is determined to be an illegal attack address, and the attack feature corresponding to the IP address is acquired as the asset detection feature, and the threat factor is the first preset threat factor.

Specifically, the first asset detection threshold may be 0.6, the second asset detection threshold may be 1, the third asset detection threshold may be 3, and the first preset threat coefficient is 0.1, wherein the threat coefficient is obtained based on expert experience.

Or, when it is determined that the port number ratio in the parameter information corresponding to the IP address is greater than the first full port scan threshold, or the number of ports is greater than the second full port scan threshold, determine that the IP address is an illegal attack address, and obtain the corresponding attack address of the IP address. The feature is a full port scanning feature, and the threat factor is a second preset threat factor.

Specifically, the first full port scan threshold may be 0.2, the second full port scan threshold may be 10, and the second preset threat factor is 0.2, wherein the threat factor is obtained based on expert experience.

Or, when it is determined that the proportion of WEB ports in the parameter information corresponding to the IP address is greater than the first WEB scan and crawler threshold, and the average number of packets is greater than the second WEB scan and crawler threshold, determine that the IP address is an illegal attack address, and obtain the IP address. The attack feature corresponding to the address is a WEB scanning and crawler feature, and the threat factor is a third preset threat factor.

Specifically, the first WEB scan and crawler threshold may be 0.8, the second WEB scan and crawler threshold may be 5, and the third preset threat factor is 0.3, wherein the threat factor is obtained based on expert experience.

Specifically, the illegal attack library is shown in the example of the illegal attack library in Table 2.

Table 2 Example of illegal attack library

illegal attack address attack signature Threat factor 1.1.1.10 asset detection 0.1 1.1.1.2 full port scan 0.2 1.1.1.20 WEB scanning and crawler 0.3

Step 203: Determine the open source port and the non-open source port from the source port according to the source IP address, source port, destination IP address and destination port in the IP data flow information of the network device to be detected, and obtain the open source port. The risk indicator value corresponding to the port.

For example, Table 3 shows the real-time netflow information of the IP of the network device to be detected is 123.123.125.10.

Table 3 Real-time netflow information of the network device IP to be detected is 123.123.125.10

It can be seen from the table that the open source ports are 80 and 443 ports, and the non-open source ports are 23241, 24521, and 3425 ports. Among them, each open source port corresponds to a unique risk index value, and the risk index value corresponding to the open source port is obtained from expert experience. Specifically, the risk index value corresponding to port 80 is 2, and the risk index value corresponding to port 443 is 1.

Step S204: From the destination IP address and the destination port, respectively determine the first connection IP information corresponding to the open source port and the second IP connection information corresponding to the non-open source port.

In this embodiment, the first communication IP information includes: the first communication IP address and the corresponding first communication port; the second communication IP information includes: the second communication IP address and the corresponding second communication port; port.

Wherein, the first connection IP address is the destination IP address corresponding to the open source port, and the first connection port is the destination port corresponding to the open source port.

The second connection IP address is the destination IP address corresponding to the non-open source port, and the second connection port is the destination port corresponding to the non-open source port.

From the above example, the destination IP address and destination port corresponding to the open source port and the destination IP address and destination port corresponding to the non-open source port are shown in Table 4 Destination IP address and destination port.

Table 4 Destination IP address and destination port

Destination IP destination port 1.1.1.10 12312, 12316, 12245, 23453 1.1.1.20 80

Step S205: Query the pre-configured illegal attack database, obtain the first attack signature and the first threat coefficient corresponding to the first IP connection information, and the second attack signature and second threat coefficient corresponding to the second IP connection information.

In this embodiment, it is assumed that the first attack feature corresponding to the first connection IP information is asset detection, and the first threat coefficient is 0.1, that is, the attack feature of the destination IP address 1.1.1.10 corresponding to the open source port is asset detection, and the threat The coefficient is 0.1; the second attack feature corresponding to the second IP connection information is WEB scanning and crawler, and the second threat factor is 0.3, that is, the attack feature of the destination IP address 1.1.1.20 corresponding to the non-open source port is WEB scanning and crawler , the threat factor is 0.3.

Step S206: Identify the type of illegal behavior and the number of times of illegal behavior corresponding to the source IP address obtained by monitoring, and according to the type of illegal behavior and the number of times of illegal behavior, as well as the first attack feature and the first attack characteristic corresponding to the first connected IP information A threat factor, and/or a second attack feature and a second threat factor corresponding to the second connection IP information, to obtain an index value corresponding to the illegal behavior.

In this embodiment, when identifying the type of illegal behavior corresponding to the source IP address obtained through monitoring as an attack type, according to the first attack feature corresponding to the first communication IP information and the second attack feature corresponding to the second communication IP information, Attack characteristics, determine the connected IP information that matches the attack type, and obtain attack indicators based on the number of illegal actions and the threat factor corresponding to the connected IP information that matches the attack type.

For example, according to the above example, assuming that the IP of the network device to be detected is 123.123.125.10, and the communication IP information matching the attack type shows that the communication IP address, that is, the destination IP is 1.1.1.10, and the communication port, that is, the destination port is 12312, Ports 12316, 12245, and 23453, the associated IP address, that is, the destination IP is 1.1.1.10, and the corresponding threat factor is 0.1. Assume that the IP of the network device to be detected is 123.123.125.10 and the number of attacks is 20, and the attack index is obtained according to the first formula.

where the first formula is expressed as:

Attack index = number of illegal actions × threat factor

Specifically, the attack index of the network device IP to be detected is 123.123.125.10 as shown in Table 5, the number of times of illegal activities and the attack index.

Table 5 Number of Illegal Behaviors and Attack Indicators

The IP of the network device to be detected Number of illegal acts attack indicators 123.123.125.10 20 2

And/or, when identifying the type of illegal behavior corresponding to the source IP address obtained through monitoring as an illegal outreach type, according to the first attack feature corresponding to the first communication IP information and the second attack feature corresponding to the second communication IP information Attack characteristics, determine the linking IP information that matches the type of illegal outreach, and obtain illegal outreach indicators based on the number of illegal actions and the threat coefficient corresponding to the linking IP information that matches the attack type.

For example, according to the above example, assuming that the IP of the network device to be detected is 123.123.125.10, the communication IP information matching the illegal outreach type shows that the communication IP address, that is, the destination IP, is 1.1.1.20, and the communication port, that is, the destination port is Port 80, the communication IP address, that is, the destination IP is 1.1.1.20, the corresponding threat coefficient is 0.3, assuming that the IP of the network device to be detected is 123.123.125.10 and the number of attacks is 20, and the illegal outreach index is obtained according to the first formula.

Specifically, the attack index of the network device IP to be detected is 123.123.125.10, as shown in Table 6, the number of times of illegal activities and the index of illegal outreach.

Table 6 Number of Illegal Behaviors and Illegal Outreach Indicators

The IP of the network device to be detected Number of illegal acts Illegal Outreach Indicators 123.123.125.10 20 6

In this embodiment, the attack type matches the asset detection feature in the attack feature; the illegal outreach type matches the WEB scan and crawler feature in the attack feature.

Step S207: According to the risk index value corresponding to the open source port, the index value corresponding to the illegal behavior, and the dynamic mean value corresponding to each index value, obtain the asset dynamic basic value and the asset dynamic value.

In this embodiment, the risk index value corresponding to the open source port and the index value corresponding to the illegal behavior are summed to obtain the dynamic basic value of the asset.

According to the above example, the open source ports are 80 and 443 ports. Specifically, the risk index value corresponding to port 80 is 2, and the risk index value corresponding to port 443 is 1. The index values corresponding to illegal behavior include attack indicators and illegal outreach indicators. , where the attack index is 2, and the illegal outreach index is 6, then the asset dynamic base value=2+1+2+6=11.

Among them, the sum of the risk indicator values corresponding to the open source ports is the threat value of the open source ports.

For each index value, it is judged whether the index value is greater than the dynamic mean value corresponding to the index value, and if greater, the index value is corrected to obtain the corrected index value.

Specifically, assuming that the dynamic mean value of the open source port threat value is 3, the dynamic mean value of the attack indicator is 2, and the dynamic mean value of the illegal outreach indicator is 2, and the illegal outreach indicator value is greater than the dynamic mean value, the illegal outreach The index value is corrected according to the second formula.

Among them, the second formula is expressed as:

Correction value = dynamic mean value + overflow value/(overflow value + dynamic mean value) × dynamic mean value, then the correction value of the illegal outreach index value = 2+6/(6+2)×2=3.5.

According to the indicator value that does not need to be corrected and the corrected indicator value, the dynamic value of the asset is obtained.

Then according to the above example, asset dynamic value=2+1+2+3.5=8.5.

Step S208: According to the obtained asset type, grade and historical vulnerability information corresponding to the source IP address, obtain the asset evaluation value corresponding to the source IP address.

Specifically, the asset evaluation value can be known from the evaluation indicators and scores in Table 7.

Table 7 Evaluation Indicators and Scores

Assume that the network to be detected with the device IP 123.123.125.10 has an asset type score of 35 due to open WEB services, and a score of 30 for the security level 3. It once had medium and low risk vulnerabilities of 15, then its asset evaluation value = 35 + 30 + 15 = 80 .

Step S209: According to the asset dynamic basic value, asset dynamic value, and asset evaluation value, obtain the asset comprehensive evaluation result corresponding to the source IP address of the network device to be detected, so that according to the asset comprehensive evaluation result, the network device corresponding to the network device to be detected Manage accordingly.

In this embodiment, the asset comprehensive assessment result is obtained by the third formula, where the third formula is expressed as:

Asset comprehensive evaluation = asset evaluation value × asset dynamic coefficient

Among them, the asset dynamic coefficient is obtained by the fourth formula, which is expressed as:

Asset dynamic coefficient = dynamic mean sum / asset dynamic value

According to the above example, the asset dynamic coefficient of the IP of the network device to be detected is 123.123.125.10=(3+2+2)/8.5≈0.94.

Its asset comprehensive assessment = 80 × 0.94 = 75.

In this embodiment, by obtaining the index value corresponding to the illegal behavior of the open source port and the non-open source port of the network device to be detected, the risk index value corresponding to the open source port, the dynamic mean value corresponding to each index value, and the According to the asset evaluation value corresponding to the source IP address of the network device, the index value exceeding the dynamic average value is corrected according to the dynamic mean value corresponding to the index value, so as to obtain the asset comprehensive evaluation result corresponding to the source IP address of the network device to be detected. Compared with In the existing technology, by deploying probes at the network boundary between the enterprise intranet and the public network, the security log of the interaction between the enterprise intranet and the public network is obtained, the security log is monitored, and the health status of the network asset address of the enterprise intranet is obtained, and To evaluate the health status of network asset addresses in the enterprise intranet, this application can evaluate the health of asset addresses in the entire network, which is universal, and at the same time reduces the risk of network threats to assets corresponding to the source IP addresses of network devices and improves security .

FIG. 3 is a schematic structural diagram of an embodiment of a network asset evaluation processing device provided by the present application. As shown in FIG. 3 , the network asset evaluation processing device 30 includes: an acquisition module 31 and a processing module 32 . Wherein, the obtaining module 31 is used to obtain the source IP address, source port, destination IP address and destination port in the IP data flow information of the network device to be detected, and determine the open source port and the non-open source port from the source port, And obtain the risk indicator value corresponding to the open source port; the processing module 32 is used to determine the first communication IP information corresponding to the open source port and the second IP corresponding to the non-open source port from the destination IP address and the destination port respectively. Connection information; the acquisition module 31 is also used to inquire about the pre-configured illegal attack library, respectively obtain the first attack feature and the first threat coefficient corresponding to the first connection IP information, and the second IP connection information corresponding to the second Attack characteristics and the second threat factor; processing module 32 is also used to identify the type of illegal behavior and the number of times of illegal behavior corresponding to the source IP address obtained by monitoring, and according to the type of illegal behavior and the number of times of illegal behavior, and the first Connecting the first attack feature and the first threat factor corresponding to the IP information, and/or the second attack feature and the second threat factor corresponding to the second linking IP information, to obtain the index value corresponding to the illegal behavior; the processing module 32, also It is used to obtain the asset dynamic basic value and the asset dynamic value according to the risk indicator value corresponding to the open source port, the indicator value corresponding to the illegal behavior, and the dynamic mean value corresponding to each indicator value; the processing module 32 is also used to obtain the asset dynamic value according to the obtained source The asset type, level, and historical vulnerability information corresponding to the IP address obtain the asset evaluation value corresponding to the source IP address; the processing module 32 is also used to obtain the network to be detected according to the dynamic basic value of the asset, the dynamic asset value, and the asset evaluation value The asset comprehensive assessment result corresponding to the source IP address of the device, so that the network corresponding to the network device to be detected can be managed accordingly according to the asset comprehensive assessment result.

The apparatus for evaluating and processing network assets in this embodiment can execute the method example shown in FIG. 1 above, and its implementation principles and technical effects are similar, and will not be repeated here.

In a possible implementation, the acquiring module 31 is also used for:

Obtain the asset information of the whole network. The asset information of the whole network includes: IP address and parameter information corresponding to the IP address.

For each IP address, according to the parameter information corresponding to the IP address and the preset attack threshold, when the IP address is determined to be an illegal attack address, the attack characteristics and threat coefficient corresponding to the IP address are obtained, and the IP address, and the IP address The corresponding attack characteristics and threat coefficients are stored in the pre-configured illegal attack library.

In a possible implementation, the acquisition module 31 is specifically configured to:

When it is determined that the ICMP ratio in the parameter information corresponding to the IP address is greater than the first asset detection threshold, the number of detected IP and C segment is greater than or equal to the second asset detection threshold, and the detected IP and B segment number is greater than or equal to the third asset detection threshold , determine that the IP address is an illegal attack address, and obtain the attack feature corresponding to the IP address as an asset detection feature, and the threat factor is a first preset threat factor.

Or, when it is determined that the port number ratio in the parameter information corresponding to the IP address is greater than the first full port scan threshold, or the number of ports is greater than the second full port scan threshold, determine that the IP address is an illegal attack address, and obtain the corresponding attack address of the IP address. The feature is a full port scanning feature, and the threat factor is a second preset threat factor.

Or, when it is determined that the proportion of WEB ports in the parameter information corresponding to the IP address is greater than the first WEB scan and crawler threshold, and the average number of packets is greater than the second WEB scan and crawler threshold, determine that the IP address is an illegal attack address, and obtain the IP address. The attack feature corresponding to the address is a WEB scanning and crawler feature, and the threat factor is a third preset threat factor.

In a possible implementation, the first link IP information includes: the first link IP address and the corresponding first link port; the second link IP information includes: the second link IP address and the corresponding first link port; Two-way connection port.

Wherein, the first connection IP address is the destination IP address corresponding to the open source port, and the first connection port is the destination port corresponding to the open source port.

The second connection IP address is the destination IP address corresponding to the non-open source port, and the second connection port is the destination port corresponding to the non-open source port.

In a possible implementation, the processing module 32 is specifically used for:

When identifying the type of illegal behavior corresponding to the source IP address acquired by monitoring as the attack type, according to the first attack characteristic corresponding to the first connected IP information and the second attack characteristic corresponding to the second connected IP information, determine the According to the number of illegal actions and the threat factor corresponding to the connected IP information matching the attack type, the attack indicators are obtained.

And/or, when identifying the type of illegal behavior corresponding to the source IP address obtained through monitoring as an illegal outreach type, according to the first attack feature corresponding to the first communication IP information and the second attack feature corresponding to the second communication IP information Attack characteristics, determine the linking IP information that matches the type of illegal outreach, and obtain illegal outreach indicators based on the number of illegal actions and the threat coefficient corresponding to the linking IP information that matches the attack type.

Among them, the attack type matches the asset detection feature in the attack feature; the illegal outreach type matches the WEB scan and crawler feature in the attack feature.

In a possible implementation, the processing module 32 is specifically used for:

The risk index value corresponding to the open source port and the index value corresponding to illegal behavior are summed to obtain the dynamic basic value of the asset.

For each index value, it is judged whether the index value is greater than the dynamic mean value corresponding to the index value, and if greater, the index value is corrected to obtain the corrected index value.

According to the indicator value that does not need to be corrected and the corrected indicator value, the dynamic value of the asset is obtained.

FIG. 4 is a schematic structural diagram of a server provided by the present application. As shown in FIG. 4, the server 40 includes: a processor 41, a memory 42, and a communication interface 43; Executable instructions; the processor 41 is configured to implement the technical solutions in any of the foregoing method embodiments by executing executable instructions.

Optionally, the memory 42 can be independent or integrated with the processor 41 .

Optionally, when the memory 42 is a device independent of the processor 41, the server 40 may further include: a bus for connecting the above devices.

The server is used to implement the technical solutions in any of the foregoing method embodiments, and its implementation principles and technical effects are similar, and will not be repeated here.

The embodiment of the present application also provides a readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the technical solution provided by any one of the foregoing embodiments is implemented.

Those of ordinary skill in the art can understand that all or part of the steps for implementing the above method embodiments can be completed by program instructions and related hardware. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps including the above-mentioned method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other various media that can store program codes.

It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all It is information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose authorization or reject.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and are not intended to limit it; although the application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: It is still possible to modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the technical solutions of the various embodiments of the present application. scope.

Claims (10)

1. A network asset evaluation processing method, characterized in that, comprising: According to the source IP address, source port, destination IP address and destination port in the IP data flow information of the network equipment to be detected, determine the open source port and the non-open source port from the source port, and obtain the open source port The risk indicator value corresponding to the source port; From the destination IP address and destination port, respectively determine the first connection IP information corresponding to the open source port, and the second IP connection information corresponding to the non-open source port; Querying the pre-configured illegal attack library, respectively obtaining the first attack feature and the first threat factor corresponding to the first connection IP information, and the second attack feature and the second threat factor corresponding to the second IP connection information ; Identifying the type of illegal behavior and the number of times of illegal behavior corresponding to the source IP address obtained through monitoring, and according to the type of illegal behavior and the number of times of illegal behavior, and the first attack corresponding to the first connected IP information The characteristic and the first threat coefficient, and/or the second attack characteristic and the second threat coefficient corresponding to the second connected IP information, and obtaining the index value corresponding to the illegal behavior; According to the risk index value corresponding to the open source port, the index value corresponding to the illegal behavior, and the dynamic mean value corresponding to each index value, obtain the asset dynamic basic value and the asset dynamic value; According to the obtained asset type, level and historical vulnerability information corresponding to the source IP address, obtain the asset evaluation value corresponding to the source IP address; According to the asset dynamic basic value, the asset dynamic value, and the asset evaluation value, obtain the asset comprehensive evaluation result corresponding to the source IP address of the network device to be detected, so as to perform the asset comprehensive evaluation result according to the asset comprehensive evaluation result Manage the network corresponding to the network device. 2. The method according to claim 1, further comprising: Obtaining network-wide asset information, where the network-wide asset information includes: an IP address and parameter information corresponding to the IP address; For each IP address, according to the parameter information corresponding to the IP address and the preset attack threshold, when it is determined that the IP address is an illegal attack address, the attack characteristics and threat coefficient corresponding to the IP address are obtained, and the The IP address, and the attack feature and threat coefficient corresponding to the IP address are stored in the pre-configured illegal attack database. 3. The method according to claim 2, wherein, according to the parameter information corresponding to the IP address and the preset attack threshold, when it is determined that the IP address is an illegal attack address, the IP address is obtained. The attack characteristics and threat factors corresponding to the address, including: It is determined that the ICMP ratio in the parameter information corresponding to the IP address is greater than the first asset detection threshold, the number of detected IP and C segment is greater than or equal to the second asset detection threshold, and the detected IP and B segment number is greater than or equal to the third asset detection When the threshold is reached, it is determined that the IP address is an illegal attack address, and the attack feature corresponding to the acquired IP address is an asset detection feature, and the threat factor is the first preset threat factor; or, When it is determined that the port number ratio in the parameter information corresponding to the IP address is greater than the first full port scan threshold, or the number of ports is greater than the second full port scan threshold, determine that the IP address is an illegal attack address, and obtain the IP The attack feature corresponding to the address is a full port scan feature, and the threat factor is a second preset threat factor; or, When determining that the WEB port ratio in the parameter information corresponding to the IP address is greater than the first WEB scan and crawler threshold, and the average number of packets is greater than the second WEB scan and crawler threshold, determine that the IP address is an illegal attack address, and The attack feature corresponding to the acquired IP address is a WEB scanning and crawler feature, and the threat factor is a third preset threat factor. 4. The method according to any one of claims 1 to 3, wherein the first communication IP information includes: the first communication IP address and the corresponding first communication port; The IP information includes: the second communication IP address and the corresponding second communication port; Wherein, the first connection IP address is the destination IP address corresponding to the open source port, and the first connection port is the destination port corresponding to the open source port; The second connection IP address is the destination IP address corresponding to the non-open source port, and the second connection port is the destination port corresponding to the non-open source port. 5. The method according to claim 4, characterized in that, the type of illegal behavior and the number of times of illegal behavior corresponding to the source IP address acquired by the identification monitoring, and according to the type of illegal behavior and the number of times of illegal behavior The number of times, and the first attack feature and first threat coefficient corresponding to the first connection IP information, and/or the second attack feature and second threat coefficient corresponding to the second connection IP information, to obtain the Index values corresponding to illegal behaviors, including: When identifying the type of illegal behavior corresponding to the source IP address acquired through monitoring as an attack type, according to the first attack feature corresponding to the first connected IP information and the second attack feature corresponding to the second connected IP information , determining the connected IP information matching the attack type, and obtaining an attack index according to the number of illegal acts and the threat coefficient corresponding to the connected IP information matching the attack type; and / or, When it is identified that the type of illegal behavior corresponding to the source IP address obtained through monitoring is an illegal outreach type, according to the first attack feature corresponding to the first communication IP information and the second attack characteristic corresponding to the second communication IP information, Attack characteristics, determining the communication IP information matching the illegal outreach type, and obtaining the illegal outreach index according to the number of illegal acts and the threat coefficient corresponding to the communication IP information matching the attack type; Wherein, the attack type matches the asset detection feature in the attack feature; the illegal outreach type matches the WEB scanning and crawler feature in the attack feature. 6. The method according to claim 5, wherein the asset is acquired according to the risk index value corresponding to the open source port, the index value corresponding to the illegal behavior, and the dynamic mean value corresponding to each index value Dynamic base value and asset dynamic value, including: summing the risk index value corresponding to the open source port and the index value corresponding to the illegal behavior to obtain the dynamic basic value of the asset; For each index value, it is judged whether the index value is greater than the dynamic mean value corresponding to the index value, and if greater, the index value is corrected to obtain the corrected index value; The asset dynamic value is obtained according to the index value that does not need to be corrected and the corrected index value. 7. A network asset evaluation processing device, characterized in that it comprises: The obtaining module is used to obtain the source IP address, source port, destination IP address and destination port in the IP data flow information of the network device to be detected, determine the open source port and the non-open source port from the source port, and Obtaining the risk indicator value corresponding to the open source port; A processing module, configured to respectively determine the first connection IP information corresponding to the open source port and the second IP connection information corresponding to the non-open source port from the destination IP address and the destination port; The acquiring module is further configured to query a pre-configured illegal attack library, respectively acquire the first attack feature and the first threat coefficient corresponding to the first connection IP information, and the first attack characteristic and the first threat coefficient corresponding to the second IP connection information. Two attack characteristics and a second threat factor; The processing module is further configured to identify the type of illegal behavior and the number of times of illegal behavior corresponding to the source IP address acquired by monitoring, and according to the type of illegal behavior and the number of times of illegal behavior, and the first communication Connect the first attack feature and the first threat factor corresponding to the IP information, and/or the second attack feature and the second threat factor corresponding to the second link IP information, and obtain the index value corresponding to the illegal behavior; The processing module is further configured to obtain the asset dynamic basic value and the asset dynamic value according to the risk indicator value corresponding to the open source port, the indicator value corresponding to the illegal behavior, and the dynamic mean value corresponding to each indicator value; The processing module is further configured to obtain the asset evaluation value corresponding to the source IP address according to the obtained asset type, level and historical vulnerability information corresponding to the source IP address; The processing module is further configured to obtain the asset comprehensive assessment result corresponding to the source IP address of the network device to be detected according to the asset dynamic basic value, the asset dynamic value, and the asset evaluation value, so as to obtain the asset comprehensive assessment result corresponding to the asset comprehensive As a result of the evaluation, corresponding management is performed on the network corresponding to the network device to be detected. 8. The device according to claim 7, wherein the acquisition module is also used for: Obtaining network-wide asset information, where the network-wide asset information includes: an IP address and parameter information corresponding to the IP address; For each IP address, according to the parameter information corresponding to the IP address and the preset attack threshold, when it is determined that the IP address is an illegal attack address, the attack characteristics and threat coefficient corresponding to the IP address are obtained, and the The IP address, and the attack features and threat coefficients corresponding to the IP address are stored in the pre-configured illegal attack library. 9. A server, characterized in that, comprising: Processor, memory, communication interface; the memory is used to store executable instructions executable by the processor; Wherein, the processor is configured to execute the network asset evaluation processing method according to any one of claims 1 to 6 by executing the executable instructions. 10. A readable storage medium, on which a computer program is stored, wherein, when the computer program is executed by a processor, the network asset evaluation processing method according to any one of claims 1 to 6 is implemented.

Images