WO2017032287A1

WO2017032287A1 - Information acquisition method and device

Info

Publication number: WO2017032287A1
Application number: PCT/CN2016/096188
Authority: WO
Inventors: 蒋璐峥; 滕志猛; 周娜; 霍玉臻
Original assignee: 中兴通讯股份有限公司
Priority date: 2015-08-21
Filing date: 2016-08-22
Publication date: 2017-03-02
Also published as: CN106470203A; CN106470203B

Abstract

Provided are an information acquisition method and device. The method comprises: when it is determined that a terminal has enabled a designated port, sending a query request for querying log content information to a log server, wherein the log server is a server which stores the log content information; and acquiring, from the log content information, terminal information about the terminal served by the designated port. By means of the technical solution provided in the present invention, the problem in the related art that related information about a malicious user (a terminal served by a high-risk port) of a high-risk port cannot be acquired is solved, and accordingly, by disabling the high-risk port, the high-risk port with an extremely high security level can be prevented from being utilized by the malicious user.

Description

Information acquisition method and device

Technical field

The present invention relates to the field of information security, and in particular to an information acquisition method and apparatus.

Background technique

On the Internet, each host sends and receives datagrams through the Transmission Control Protocol/Internet Protocol (TCP/IP) protocol. Each datagram is interconnected according to the IP address of its destination host. Routing in . When the destination host receives the datagram, it will send the data to the corresponding port according to the destination port number of the packet header, and the process corresponding to the port will receive the data and wait for the next set of data to arrive.

If an attacker uses software to scan a target computer and get the port that the target computer opens, it also knows which services the target computer provides, and then guesses possible vulnerabilities and invades those vulnerable ports, especially high-risk ports. If the computer's port is open too much, and the administrator does not know, there are two situations: one is to provide the service and the administrator does not pay attention, for example, when installing IIS, the software will automatically add a lot of services, and the administrator It may not be noticed; one is that the server is installed by the attacker to connect the Trojan through a special port. Both situations are dangerous, which requires administrators to fully understand the services provided by the server and take the first step in security precautions to improve the system security factor.

The existing security service products only have scan identification for high-risk ports, and there is no record tracking for possible high-risk port malicious users.

In the related art, an issue in which information related to maliciously using a high-risk port user (a terminal of a high-risk port service) cannot be obtained has not been proposed, and an effective technical solution has not been proposed.

Summary of the invention

In order to solve the above technical problem, an embodiment of the present invention provides a method and an apparatus for acquiring information.

According to an embodiment of the present invention, an information obtaining method is provided, including: when determining that a terminal opens a designated port, sending a query request for querying log content information to a log server, wherein the log server is configured to store a server that records log content information; and obtains terminal information of the terminal served by the designated port from the log content information.

Preferably, the terminal information of the terminal served by the designated port is obtained from the log content information, including:

Obtaining Internet Protocol IP address information of the terminal served by the designated port by querying a key field of the log content information.

Preferably, after acquiring the IP address information, the method further includes: acquiring a frequency of using the designated port by the IP address; recording and counting the IP address and the frequency.

Preferably, after the terminal information of the terminal served by the designated port is obtained from the log content information, performing at least one of the following operations: determining, according to the terminal information, whether the service terminal of the designated port is located in a blacklist; Determining whether the frequency of use of the designated port exceeds a threshold; determining whether a time for using the designated port is within a predetermined time period.

Preferably, when one of the following situations occurs, the alarm information is sent to the terminal served by the designated port: the service terminal of the designated port is located in a blacklist; the frequency of use exceeds a threshold; and the time of using the designated port is not Within the predetermined time period.

Advantageously, the method further comprises transmitting to the terminal a close command to close the designated port.

According to another embodiment of the present invention, there is further provided an information obtaining apparatus, comprising: a sending module, configured to send a query request for querying log content information to a log server when determining that the terminal has opened the designated port, wherein The log server is a server that stores the log content information. The first obtaining module is configured to obtain terminal information of the terminal served by the designated port from the log content information.

Preferably, the first obtaining module is configured to obtain Internet Protocol IP address information of the terminal served by the designated port by querying a key field of the log content information.

Preferably, the device further includes: a second obtaining module, configured to acquire a frequency of using the designated port by the IP address; and a recording module configured to record and count the IP address and the frequency.

Preferably, the device further includes: a determining module, configured to determine, according to the terminal information, whether the terminal served by the designated port is located in a blacklist; or, further, determining whether the frequency of use of the designated port exceeds The threshold; or, is also set to determine whether the time at which the designated port is used is within a predetermined period of time.

In an embodiment of the present invention, a computer storage medium is further provided, and the computer storage medium may store an execution instruction for performing the implementation of the information acquisition method in the foregoing embodiment.

According to the embodiment of the present invention, if the designated port is opened by the terminal (which can be understood as some high-risk ports), the log information is obtained from the log server, and the related information of the terminal using the specified port is obtained, and the related technology cannot be obtained. The problem of using information about users of high-risk ports (terminals for high-risk port services) can protect high-risk ports and prevent malicious users from using high-risk ports with very high security levels.

DRAWINGS

The drawings described herein are intended to provide a further understanding of the invention, and are intended to be a part of the invention. In the drawing:

1 is a flowchart of an information acquisition method according to an embodiment of the present invention;

2 is a structural block diagram of an information acquiring apparatus according to an embodiment of the present invention;

FIG. 3 is a block diagram showing another structure of an information acquiring apparatus according to an embodiment of the present invention; FIG.

4 is a schematic structural view of a preferred embodiment of the present invention;

Figure 5 is a schematic structural view of a preferred embodiment 2 according to the present invention;

Figure 6 is a schematic structural view of a preferred embodiment 3 according to the present invention;

Figure 7 is a schematic structural view of a preferred embodiment 4 according to the present invention;

Figure 8 is a schematic view showing the structure of a preferred embodiment 5 according to the present invention.

detailed description

The invention will be described in detail below with reference to the drawings in conjunction with the embodiments. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict.

Other features and advantages of the invention will be set forth in the description which follows, The objectives and other advantages of the invention may be realized and obtained by means of the structure particularly pointed in the appended claims.

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is an embodiment of the invention, but not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts shall fall within the scope of the present invention.

In the embodiment of the present invention, an information acquisition method is also provided. FIG. 1 is a flowchart of an information acquisition method according to an embodiment of the present invention. As shown in FIG. 1, the method includes the following steps:

Step S102, when it is determined that the terminal has opened the designated port, sending a query request for querying the log content information to the log server, where the log server is a server storing the log content information;

Step S104: Acquire, from the log content information, terminal information of the terminal served by the designated port.

Through the above steps, if the terminal opens the designated port (which can be understood as some high-risk ports), the log information is obtained from the log server, and the related information of the terminal using the specified port is obtained, thereby solving the related art, and the malicious use cannot be obtained. The problem of information about users of high-risk ports (terminals for high-risk port services) can protect high-risk ports and legally pursue the behavior of malicious users using high-risk ports.

The foregoing step S104 may be implemented in multiple manners. In the embodiment of the present invention, the method may be implemented by: querying the key field of the log content information to obtain the Internet Protocol IP address information of the terminal served by the specified port, that is, The terminal information in the embodiment of the present invention may include the IP address information, and may include other related information of the terminal, which is not limited in this embodiment of the present invention.

In an optional embodiment, after obtaining the foregoing IP address information, the following steps may be performed: obtaining the frequency of using the specified port by using the IP address; recording and counting the IP address and the frequency, which are obtained according to the obtained IP address information, and then count the frequency of use.

After the terminal information of the terminal served by the designated port is obtained from the foregoing log content information, performing at least one of the following operations: determining, according to the terminal information, whether the terminal served by the designated port is in the blacklist; Whether the frequency of use of the specified port exceeds a threshold; whether the time for using the designated port is within a predetermined time period.

Based on the foregoing implementation, when one of the following situations occurs, the alarm information is sent to the terminal served by the designated port: the service terminal of the designated port is located in the blacklist; the frequency of use exceeds the threshold; and the time of using the specified port is not scheduled. Within the time period.

Preferably, the method further includes: sending a shutdown command for closing the designated port to the terminal, or actually sending a configuration file to the terminal to update configuration information of the current terminal for the designated port.

It should be noted that, for the foregoing method embodiments, for the sake of simple description, they are all expressed as a series of action combinations, but those skilled in the art should understand that the present invention is not limited by the described action sequence. Because certain steps may be performed in other sequences or concurrently in accordance with the present invention. Secondly, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

In the embodiment, an information acquisition device is provided to implement the above-mentioned embodiments and preferred embodiments. The descriptions of the modules involved in the device are described below. As used below, the term "module" may implement a combination of software and/or hardware of a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated. FIG. 2 is a block diagram showing the structure of an information acquiring apparatus according to an embodiment of the present invention. As shown in Figure 2, the device comprises:

The sending module 20 is configured to send a query request for querying log content information to the log server when the terminal is determined to have the specified port, wherein the log server is a server that stores the log content information;

The first obtaining module 22 is connected to the sending module 20, and is configured to obtain terminal information of the terminal served by the designated port from the log content information.

Through the comprehensive function of the above modules, if the terminal opens the designated port (which can be understood as some high-risk ports), the log information is obtained from the log server, and the related information of the terminal using the designated port is obtained, thereby solving the related technology. Obtaining information about maliciously using users of high-risk ports (terminals of high-risk port services), thereby protecting high-risk ports and preventing malicious users from using high-risk ports with very high security levels.

It should be noted that the first obtaining module 22 is further configured to obtain the Internet Protocol IP address information of the terminal served by the specified port by querying the key field of the log content information.

FIG. 3 is a block diagram of another structure of an information acquiring apparatus according to an embodiment of the present invention. As shown in FIG. 3, the apparatus further includes: a second acquiring module 24, connected to the first obtaining module 22, configured to acquire the IP address. Use the specified end The frequency of the port; the recording module 26 is connected to the second obtaining module 24, and is configured to record and count the above IP address and the above frequency.

As shown in FIG. 3, the apparatus further includes: a determining module 28, configured to determine, according to the terminal information, whether the terminal served by the designated port is located in a blacklist; or, further, determining whether the frequency of use of the designated port exceeds The threshold; or, is also set to determine whether the time at which the designated port is used is within a predetermined period of time.

In order to better understand the technical solution of the foregoing message, the following description is made in conjunction with the technical solutions of the preferred embodiments, but is not intended to limit the scope of protection of the embodiments of the present invention.

The risk items in Figures 4-8 can be either predefined high-risk risk items or custom high-risk risk items. Here, for example, a high-risk port means that certain port numbers may be opened on the terminal, system, or device, and may be exploited by hackers. The security policy control device presets some industry-standard high-risk ports, for example, TCP. 135, 139, 445, 593, 1025 ports, User Datagram Protocol (UDP) 135, 137, 138, 445 ports, some popular virus backdoor ports (such as TCP 2745, 3127, 6129 ports), And remote service access port 3389 and so on.

Embodiment 1

4 is a schematic structural view of a preferred embodiment of the present invention, based on FIG. 4, for risk assessment of a high-risk port. For example, the security policy management device checks and evaluates the configuration information according to the risk check items related to the high-risk port in the risk database, determines whether there is configuration information matching the high-risk port risk item, and generates a high-risk risk check result.

Query system log information (equivalent to obtaining log information from the log server in the above embodiment). The system log here can be either the log information obtained from the device or the log information obtained from the Syslog log server. If the configuration of the high-risk risk is found according to the result of the risk assessment in the previous step, for example, the TCP high-risk port 2745 and 3127 are enabled, the security policy management device is triggered to automatically send a request for querying the system log information, and the device or the log server receives the request. In response, the log information is sent to the security policy management device.

Obtain information records and statistics of users of high risk risk items. For example, the security policy management device performs log tracking based on the opened TCP high-risk port numbers 2745 and 3127. By querying the key fields in the log content, all IP address records using these port numbers are obtained, and the high-risk ports are used to count these IP addresses. Frequency and generate statistical results.

Embodiment 2

In this preferred embodiment, the policy management device supports analysis of high risk risk records. FIG. 5 is a schematic diagram of a preferred embodiment 2 according to the present invention. Based on FIG. 3, information records of users of high risk risk items are obtained and counted. For example, the security policy management device performs log tracking based on the opened TCP high-risk port numbers 2745 and 3127. By querying the key fields in the log content, all IP address records using these port numbers are obtained, and the high-risk ports are used to count these IP addresses. Frequency and generate statistical results.

Optionally, support for in-depth analysis of statistical results. For example, if the user who analyzes the high-risk port is a legitimate user or an illegal user, the IP address in the statistics result is used to find the specific entry of the whitelist. If the IP address exists in the whitelist. The address is a valid user. If it matches the blacklist, it is an illegal user. For example, if the usage of the high-risk port is normal or abnormal, it can be judged whether the frequency of the high-risk port exceeds the threshold or whether the usage time is Abnormal working hours to analyze whether there is an abnormality in usage.

Embodiment 3

In this preferred embodiment, the policy management device supports a statistical display method for high-risk risks. FIG. 6 is a schematic diagram of a preferred embodiment 3 according to the present invention. Based on FIG. 6, the information record of the user of the high-risk risk item is obtained and counted. For example, the security policy management device performs log tracking based on the opened TCP high-risk port numbers 2745 and 3127. By querying the key fields in the log content, all IP address records using these port numbers are obtained, and the high-risk ports are used to count these IP addresses. Frequency and generate statistical results.

Support in-depth analysis of statistical results. For example, if the user who is a high-risk port is a legitimate user or an illegal user, the IP address in the statistics is used to find the specific entry of the whitelist. If the IP address exists in the whitelist, it is a valid user. If the blacklist is matched, It is an illegal user; for example, it is used to analyze whether the use of high-risk ports is normal or abnormal. You can analyze whether the usage of the high-risk port exceeds the threshold or whether the usage time is abnormal. .

Optionally, the policy management device supports statistical display of high risk risks. For example, according to the results of the above-mentioned in-depth analysis, it can be displayed in the dashboard according to the severity, high, medium and low risk levels of the high-risk ports. The above-mentioned TCP high-risk port numbers 2745 and 3127 are high-level high-risk ports, which are in the dashboard. The fan map display of the high port; it can also display the multi-dimensional display of legal and illegal users, normal use and abnormal use. For example, the user IP address of the above-mentioned high-risk port is 192.168.101.154, which is not in the white list, and statistics When the usage time is from 23 o'clock to 2 o'clock in the morning, it will be displayed as an illegal user abnormal use column.

Embodiment 4

In this embodiment, the policy management device can support the method for providing an alarm for the high-risk risk record. FIG. 7 is a schematic diagram of the fourth embodiment of the present invention. Based on FIG. 7, the information record of the user of the high-risk risk item is obtained and counted. For example, the security policy management device performs log tracking based on the opened TCP high-risk port numbers 2745 and 3127. By querying the key fields in the log content, all IP address records using these port numbers are obtained, and the high-risk ports are used to count these IP addresses. Frequency and generate statistical results.

Optionally, support for alerting high-risk risks. According to the results of the above in-depth analysis, for example, the opened TCP high-risk port number 2745, 3127 triggers a high-level risk, and the result of the above risk assessment is given an alarm by email, and the TCP high-risk port number 2745, 3127 in the result. The user and the time and frequency of use give a highlighting alert display.

Embodiment 5

In this embodiment, the policy management device can support the method for changing the risky configuration item. FIG. 8 is a schematic diagram of the fifth embodiment of the present invention. Based on FIG. 8, the information record of the user of the high risk risk item is obtained and counted. For example, the security policy management device performs log tracking based on the opened TCP high-risk port numbers 2745 and 3127. By querying the key fields in the log content, all IP address records using these port numbers are obtained, and the high-risk ports are used to count these IP addresses. Frequency and generate statistical results.

Optionally, support for high-risk risk configuration item changes. For example, according to the result of the above-mentioned in-depth analysis, the corresponding configuration of the high-risk port number 2745 and 3127 is enabled, and the command to close the high-risk port or the configuration file is delivered. The security management device can be used to change the configuration of the high-risk risk item. For example, to change the configuration, you can use SSH to send the changed configuration commands, such as unset service-port 2745|unset service-port 3127, or modify the configuration file. Send the configuration file to the device or system.

In summary, the embodiments of the present invention achieve the following technical effects: the related information cannot be obtained in the related art, and the related information of the user who uses the high-risk port (the terminal of the high-risk port service) cannot be obtained, thereby protecting the high-risk port and avoiding Malicious users use high-risk ports with very high security levels.

In another embodiment, software is also provided for performing the technical solutions described in the above embodiments and preferred embodiments.

In another embodiment, a storage medium is further provided, wherein the software includes the above-mentioned software, including but not limited to: an optical disk, a floppy disk, a hard disk, an erasable memory, and the like.

It is to be understood that the terms "first", "second" and the like in the specification and claims of the present invention are used to distinguish similar objects, and are not necessarily used to describe a particular order or order. It is to be understood that the objects so used are interchangeable, where appropriate, so that the embodiments of the invention described herein can be carried out in a sequence other than those illustrated or described herein. In addition, the terms "comprises" and "comprising" and any variants thereof are intended to cover a non-exclusive inclusion, for example, a process, method, system, product, or device that comprises a series of steps or units is not necessarily limited to Those steps or units may include other steps or units not explicitly listed or inherent to such processes, methods, products or devices.

It will be apparent to those skilled in the art that the various modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein. Perform the steps shown or described Alternatively, each of them may be fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof may be fabricated into a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software.

The above description is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Industrial applicability

The foregoing technical solution provided by the embodiment of the present invention can be applied to the information acquisition process. If the terminal opens a designated port (which can be understood as some high-risk ports), the log information is obtained from the log server, and then the terminal using the designated port is obtained. The related information solves the problem that the relevant information of the malicious user (high-risk port service terminal) of the high-risk port cannot be obtained in the related art, and the high-risk port can be closed, so that the high-risk port with a very high security level is avoided by the malicious user.

Claims

An information acquisition method includes:

When it is determined that the terminal has opened the designated port, the query server sends a query request for querying the log content information, where the log server is a server that stores the log content information;

Obtaining terminal information of the terminal served by the designated port from the log content information.
The method of claim 1, wherein the obtaining the terminal information of the terminal served by the designated port from the log content information comprises:

Obtaining Internet Protocol IP address information of the terminal served by the designated port by querying a key field of the log content information.
The method of claim 2, wherein after obtaining the IP address information, the method further comprises:

Obtaining a frequency at which the IP address uses the designated port;

The IP address and the frequency are recorded and counted.
The method according to claim 1, wherein after acquiring the terminal information of the terminal served by the designated port from the log content information, performing at least one of the following operations:

Determining, according to the terminal information, whether the terminal served by the designated port is in a blacklist;

Determining whether the frequency of use of the designated port exceeds a threshold;

It is judged whether the time at which the designated port is used is within a predetermined period of time.
The method according to claim 4, wherein when one of the following occurs, the alarm information is sent to the terminal served by the designated port: the terminal served by the designated port is in a blacklist; the frequency of use exceeds a threshold The use of the specified port time is not within the predetermined time period.
The method of any of claims 1-5, wherein the method further comprises:

A close command for closing the designated port is sent to the terminal.
An information acquiring device includes:

a sending module, configured to send a query request for querying log content information to the log server, where the log server is a server storing the log content information;

The first obtaining module is configured to obtain, from the log content information, terminal information of the terminal served by the designated port.
The apparatus according to claim 7, wherein the first obtaining module is configured to acquire Internet Protocol IP address information of the terminal served by the designated port by querying a key field of the log content information.
The device according to claim 8, wherein the device further comprises:

a second obtaining module, configured to acquire a frequency of using the designated port by the IP address;

A recording module configured to record and count the IP address and the frequency.
The device according to claim 7, wherein the device further comprises:

The determining module is configured to determine, according to the terminal information, whether the terminal served by the designated port is in a blacklist, or to determine whether the frequency of use of the designated port exceeds a threshold; or Indicates whether the time of the specified port is within the predetermined time period.