WO2017032288A1 - 一种安全配置变更检测方法和装置 - Google Patents

一种安全配置变更检测方法和装置 Download PDF

Info

Publication number
WO2017032288A1
WO2017032288A1 PCT/CN2016/096189 CN2016096189W WO2017032288A1 WO 2017032288 A1 WO2017032288 A1 WO 2017032288A1 CN 2016096189 W CN2016096189 W CN 2016096189W WO 2017032288 A1 WO2017032288 A1 WO 2017032288A1
Authority
WO
WIPO (PCT)
Prior art keywords
log
content
change
configuration
log content
Prior art date
Application number
PCT/CN2016/096189
Other languages
English (en)
French (fr)
Inventor
蒋璐峥
滕志猛
周娜
霍玉臻
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2017032288A1 publication Critical patent/WO2017032288A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general

Definitions

  • the present invention relates to the field of network security, and in particular, to a security configuration change detection method and apparatus.
  • the Skybox Security survey found that 58% of companies deployed more than 100 rules on their NGFW (Next Generation Firewall), while 35% of companies performed more than 100 changes per month. Frequent changes can lead to configuration errors. According to Gartner, 99% of firewall security incidents are caused by firewall configuration errors. Enterprises need a way to automatically detect security device configuration changes, combine technology and management organically, and manage and control network security to improve overall security.
  • NGFW Next Generation Firewall
  • the current configuration change technology only provides a verification method for the feasibility of the change, and lacks real-time detection of the change behavior.
  • Embodiments of the present invention provide a security configuration change detection method and apparatus, which can at least implement automatic detection of security configuration changes.
  • a security configuration change detection method includes:
  • the configuration check result is determined based on the compliance check of the configuration check entry to detect the changed configuration.
  • filtering the obtained log content includes:
  • the log content is filtered according to a log rank classification; or the log content is filtered according to a time sorting classification.
  • filtering the log content according to the log level classification includes:
  • the log content corresponding to the log level to which the configuration change content belongs is filtered according to the log level to which the configuration change content belongs.
  • filtering the log content according to the time sorting classification includes:
  • extracting the second log content of the configuration change for the first log content that meets the change scope includes:
  • Matching the description content in the first log content or the first log content with a keyword list or a keyword segment list, where the description content in the first log content or the first log content has a key The word list or the elements in the key field list determine that there is a configuration change in the first log content.
  • the embodiment of the present invention further provides a security configuration change detecting apparatus, including:
  • the log filtering module is configured to filter the obtained log content to obtain the first log content that meets the scope of the change;
  • the change module is set to extract configuration changes for the first log content that matches the change scope. Second log content;
  • the security policy management module is configured to change the content of the second log content of the configuration change, and determine the configuration verification result according to the configuration verification entry to detect the compliance degree of the changed configuration.
  • the log screening module includes:
  • a level screening unit configured to filter the log content according to a log level classification
  • a time screening unit configured to filter the log content according to a time sorting classification.
  • the filtering by the level screening unit according to the log level classification refers to:
  • the log content corresponding to the log level to which the configuration change content belongs is filtered according to the log level to which the configuration change content belongs.
  • the time screening unit filters the log content according to the time sorting classification, that is:
  • the second module content that the change module extracts the configuration change from the first log content that meets the change scope is:
  • Matching the description content in the first log content or the first log content with a keyword list or a keyword segment list, where the description content in the first log content or the first log content has a key The word list or the elements in the key field list determine that there is a configuration change in the first log content.
  • a storage medium is also provided.
  • the storage medium is arranged to store program code for performing the following steps:
  • the configuration check result is determined based on the compliance check of the configuration check entry to detect the changed configuration.
  • the embodiment of the present invention has the following beneficial effects:
  • the security configuration change detection method and device provided by the embodiment of the present invention determine whether there is a change behavior by performing detailed analysis on the log record on the device, and does not affect the enterprise security when the security configuration is frequently changed.
  • FIG. 1 is a flowchart of a method for detecting a security configuration change according to an embodiment of the present invention
  • FIG. 2 is a schematic structural diagram of a security configuration change detecting apparatus according to an embodiment of the present invention.
  • FIG. 3 is a flowchart of a method for automatically detecting change of a Syslog log server according to an embodiment of the present invention
  • FIG. 4 is a flowchart of a method for automatically detecting change of a direct receiving log according to an embodiment of the present invention
  • FIG. 5 is a flowchart of a method for automatically detecting an automatic change providing support suggestion according to an embodiment of the present invention.
  • an embodiment of the present invention provides a security configuration change detection method, including:
  • the content of the change in the second log content of the configuration change is determined according to the degree of compliance of the configuration after the configuration check entry is changed, and the configuration check result is determined.
  • the log content may be the log information obtained directly from the device, the device, or the system, or may be the log information obtained indirectly through the Syslog log server connected to the device, device, or system.
  • the filtering of the obtained log content in step S101 may filter the log types that do not conform to the change category according to methods such as time sorting, log rank, etc., so as to further change the content identification:
  • Filtering the log content according to the log level classification includes:
  • the log content corresponding to the log level to which the configuration change content belongs is filtered according to the log level to which the configuration change content belongs.
  • Filtering the log content according to the time sorting classification includes:
  • Filter the log according to the log level classification Take the Juniper firewall as an example. You can see the level of the log level of the log information list obtained from the firewall device. The levels are classified into Emergency, Alert, Critical, Error, Warning, Notification, Information. There are eight levels of Debugging, in which the configuration change content belongs to the Notification level. When performing log filtering, only the log with the Level level Notification is extracted for further screening.
  • Filter the logs according to the time sorting method Take the Juniper firewall as an example. According to the log information list obtained from the firewall device, you can further filter the information after the log level classification and filtering, according to the Date/Time column in the log. Sort the data in reverse order by time, extract all the logs within 30 seconds (can be determined according to the needs or actual conditions), and the log information except 30 seconds is discarded, so that all the log information with newer time is obtained.
  • the second log content of extracting the configuration change to the first log content that meets the change scope in step S102 includes:
  • Descriptive content and keyword column in the first log content or the first log content The table or the key field list is matched, and when the description content in the first log content or the first log content has an element in a keyword list or a key field list, determining that the first log content exists change.
  • the log filtered by the previous step is further identified, and the log content related to the configuration change is extracted.
  • the log can be filtered according to the keyword used in the configuration change to achieve accurate positioning of the change.
  • the Juniper firewall Take the Juniper firewall as an example.
  • the contents of the Description column in the log information will be modified, added, changed, etc. All keywords related to the change need to be analyzed in advance, and these keywords are stored in the key. In the word list.
  • the element in the keyword list is used to find out whether the description exists, and if it exists, it is considered that the change is recognized.
  • an embodiment of the present invention further provides a security configuration change detecting apparatus, including:
  • the log screening module 210 is configured to filter the obtained log content to obtain a first log content that meets the scope of the change;
  • the change module 220 is configured to extract a second log content of the configuration change for the first log content that meets the change scope;
  • the security policy management module 230 is configured to determine, according to the configuration verification entry, the change of the configuration in the second log content of the configuration change, and determine the configuration verification result according to the configuration verification entry.
  • the log screening module 210 includes:
  • a level screening unit configured to filter the log content according to a log level classification
  • a time screening unit configured to filter the log content according to a time sorting classification.
  • the filtering by the level screening unit according to the log level classification refers to:
  • the log content corresponding to the log level to which the configuration change content belongs is filtered according to the log level to which the configuration change content belongs.
  • the time screening unit filters the log content according to a time sorting classification, which means:
  • the change module 220 extracts the second log content of the configuration change for the first log content that meets the change scope, which means:
  • Matching the description content in the first log content or the first log content with a keyword list or a keyword segment list, where the description content in the first log content or the first log content has a key The word list or the elements in the key field list determine that there is a configuration change in the first log content.
  • the change verification request is automatically sent with the specific content of the change, and the security policy management module 230 responds to the change check request and performs configuration check.
  • the security policy management module 230 performs configuration check on the changed configuration information, and the change configuration information may be newly collected or collected in advance, and the configuration check library is selected, and the configuration is checked according to the configuration check item. The compliance check result is generated.
  • the log information sent by the Syslog log server is received and the change identification detection is performed, as shown in FIG. 3 .
  • the Syslog Log Server processes the flow of log information from the device. For example, you need to configure the associated Syslog log server address and port number in advance, and enable the log to be sent to the Syslog log server. Similarly, the Syslog log server needs to be configured with the sending attribute to encapsulate the log stream of the device. Send to the log screening module 210.
  • the received log content is sent to the log filtering module 210, and the log type that does not conform to the change category may be filtered according to methods such as time sorting, log level, and the like, so as to further change the content identification.
  • methods such as time sorting, log level, and the like, so as to further change the content identification.
  • the log filtered by the previous step is further identified, and the log content of the configuration change is extracted.
  • the log can be filtered according to the keywords used in the configuration change to achieve accurate positioning of the change.
  • the Juniper firewall Take the Juniper firewall as an example.
  • the contents of the Description column in the log information will be modified, added, changed, etc. All keywords related to the change need to be analyzed in advance, and these keywords are stored in the key. In the word list.
  • the element in the keyword list is used to find out whether the description exists, and if it exists, it is considered that the change is recognized.
  • the security policy management module 230 responds to the change check request and performs configuration check. For example, the security policy management module 230 performs configuration check on the changed configuration information, and the change configuration information may be newly collected or collected in advance, and the configuration check library is selected, and the configuration is checked according to the configuration check item. The compliance check result is generated.
  • an automatic change detection method for directly receiving logs is supported, as shown in FIG.
  • Process log traffic from the device For example, the device needs to configure the log shipping address and the port number as the management device in advance, and enable the log to be sent to the control device.
  • the control device parses the log information stream of the device and sends it to the log filtering module 210.
  • the received log content is sent to the log filtering module 210, and the log type that does not conform to the change category may be filtered according to methods such as time sorting, log level, and the like, so as to further change the content identification.
  • methods such as time sorting, log level, and the like, so as to further change the content identification.
  • the log filtered by the previous step is further identified, and the log content of the configuration change is extracted.
  • the log can be filtered according to the keywords used in the configuration change to achieve accurate positioning of the change.
  • the Juniper firewall Take the Juniper firewall as an example.
  • the contents of the Description column in the log information will be modified, added, changed, etc. All keywords related to the change need to be analyzed in advance, and these keywords are stored in the key. In the word list.
  • the element in the keyword list is used to find out whether the description exists, and if it exists, it is considered that the change is recognized.
  • the security policy management module 230 responds to the change check request and performs configuration check. For example, the security policy management module 230 performs configuration check on the changed configuration information, and the change configuration information may be newly collected or collected in advance, and the configuration check library is selected, and the configuration is checked according to the configuration check item. The compliance check result is generated.
  • an automatic change detection method for providing a suggestion manner for automatic configuration verification can be supported, as shown in FIG. 5.
  • the received log content is sent to the log filtering module 210, and the log type that does not conform to the change category may be filtered according to methods such as time sorting, log level, and the like, so as to further change the content identification.
  • methods such as time sorting, log level, and the like, so as to further change the content identification.
  • the log filtered by the previous step is further identified, and the log content of the configuration change is extracted.
  • the log can be filtered according to the keywords used in the configuration change to achieve accurate positioning of the change.
  • the Juniper firewall Take the Juniper firewall as an example.
  • the contents of the Description column in the log information will be modified, added, changed, etc. All keywords related to the change need to be analyzed in advance, and these keywords are stored in the key. In the word list.
  • the element in the keyword list is used to find out whether the description exists, and if it exists, it is considered that the change is recognized.
  • the security policy management module 230 responds to the change check request and performs configuration check. For example, the security policy management module 230 performs configuration check on the changed configuration information, and the change configuration information may be newly collected or collected in advance. Then, select the configuration check library, and generate the configuration check result according to the configuration check entry to detect the compliance degree of the configuration after the change.
  • support for providing users with change configuration verification suggestions For example, after performing the automatic configuration check according to the result of the change behavior detection, what are the contents of the configuration compliance item after the change, what are the non-conformities, and the configuration method that is modified to meet the requirements for the non-conformity item, And the combined results above suggest that the user choose whether to comply with the change configuration.
  • Embodiments of the present invention also provide a storage medium.
  • the foregoing storage medium may be configured to store program code for performing the following steps:
  • the content of the change in the second log content of the configuration change is determined according to the degree of compliance of the configuration after the configuration check entry is changed, and the configuration check result is determined.
  • the foregoing storage medium may include, but not limited to, a USB flash drive, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, and a magnetic memory.
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • a mobile hard disk e.g., a hard disk
  • magnetic memory e.g., a hard disk
  • modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein.
  • the steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module.
  • the invention is not limited to any specific combination of hardware and software.
  • the security configuration change detection method and apparatus have the following beneficial effects: determining whether there is a change behavior by performing detailed analysis on the log records on the device, in the case where the security configuration is frequently changed. Do not affect the safety of the enterprise.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Debugging And Monitoring (AREA)
  • Computer And Data Communications (AREA)
  • Alarm Systems (AREA)

Abstract

本发明实施例提出一种安全配置变更检测方法和装置，所述方法包括：对获取的日志内容进行筛选，获得符合变更范畴的第一日志内容；对符合变更范畴的第一日志内容提取配置变更的第二日志内容；针对配置变更的第二日志内容中的变更内容，依据配置核查条目检测变更后的配置的遵从程度，确定配置核查结果。通过对设备上的日志记录进行详细分析来判断是否有变更行为，在安全配置频繁变更的情况下做到不影响企业安全。

Description

一种安全配置变更检测方法和装置 技术领域
本发明涉及网络安全领域，具体涉及一种安全配置变更检测方法和装置。
背景技术
随着网络的开放性、互联性、共享程度的扩大，企业越来越依赖信息和网络技术，随着网络安全威胁越来越大而单一的安全技术或安全设备无法满足网络对安全的要求，企业对网络安全的部署变得日趋复杂，而安全设备产品种类繁多，搭建环境具有多样性，而设备上的策略配置愈趋繁琐，这对技术人员的水平要求很高，而往往很多企业的技术人员没有足够的安全领域相关知识，导致在安全设备上进行的配置存在诸多隐患。
Skybox Security调查发现，58％企业在他们的NGFW(Next Generation Firewall，下一代防火墙)上部署了100条以上的规则，而35％的公司每月执行100次以上变更，频繁变更易导致配置错误。据Gartner统计，99％的防火墙安全事件均是由防火墙的配置错误而引起。企业需要一种自动检测安全设备配置变更的方法，将技术和管理有机的结合起来，对网络安全进行统一管理和控制，提高整体安全水平。
目前的配置变更技术只有针对变更的可行性给出核查方法，缺少对该变更行为的实时检测。
发明内容
本发明实施例提供了一种安全配置变更检测方法和装置，至少能够实现安全配置变更的自动化检测。
为了至少实现上述发明目的，本发明实施例采取的技术方案如下：
一种安全配置变更检测方法，包括：
对获取的日志内容进行筛选，获得符合变更范畴的第一日志内容；
对符合变更范畴的第一日志内容提取配置变更的第二日志内容；
针对配置变更的第二日志内容中的变更内容，依据配置核查条目检测变更后的配置的遵从程度，确定配置核查结果。
可选地，对获取的日志内容进行筛选包括：
根据日志等级分类筛选所述日志内容；或者，根据时间排序分类筛选所述日志内容。
可选地，根据日志等级分类筛选所述日志内容包括：
获取所述日志内容对应的日志信息列表中日志等级；
根据配置变更内容所属的日志等级筛选出配置变更内容所属的日志等级对应的日志内容。
可选地，根据时间排序分类筛选所述日志内容包括：
获取所述日志内容对应的日志信息列表中日志记录的时间；
筛选出日志记录的时间在预设变更时间范围内的日志内容。
可选地，对符合变更范畴的第一日志内容提取配置变更的第二日志内容包括：
将所述第一日志内容或所述第一日志内容中的描述内容与关键字列表或者关键字段列表进行匹配，当所述第一日志内容或所述第一日志内容中的描述内容存在关键字列表或者关键字段列表中的元素，则确定所述第一日志内容存在配置变更。
为至少解决上述技术问题，本发明实施例还提供一种安全配置变更检测装置，包括：
日志筛选模块，设置为对获取的日志内容进行筛选，获得符合变更范畴的第一日志内容；
变更模块，设置为对符合变更范畴的第一日志内容提取配置变更的第 二日志内容；
安全策略管控模块，设置为针对配置变更的第二日志内容中的变更内容，依据配置核查条目检测变更后的配置的遵从程度，确定配置核查结果
可选地，所述日志筛选模块包括：
等级筛选单元，设置为根据日志等级分类筛选所述日志内容；或者，
时间筛选单元，设置为根据时间排序分类筛选所述日志内容。
可选地，所述等级筛选单元根据日志等级分类筛选所述日志内容是指：
获取所述日志内容对应的日志信息列表中日志等级；
根据配置变更内容所属的日志等级筛选出配置变更内容所属的日志等级对应的日志内容。
可选地，所述时间筛选单元根据时间排序分类筛选所述日志内容是指：
获取所述日志内容对应的日志信息列表中日志记录的时间；
筛选出日志记录时间在预设变更时间范围内的日志内容。
可选地，所述变更模块对符合变更范畴的第一日志内容提取配置变更的第二日志内容是指：
将所述第一日志内容或所述第一日志内容中的描述内容与关键字列表或者关键字段列表进行匹配，当所述第一日志内容或所述第一日志内容中的描述内容存在关键字列表或者关键字段列表中的元素，则确定所述第一日志内容存在配置变更。
根据本发明的又一个实施例，还提供了一种存储介质。该存储介质设置为存储用于执行以下步骤的程序代码：
对获取的日志内容进行筛选，获得符合变更范畴的第一日志内容；
对符合变更范畴的第一日志内容提取配置变更的第二日志内容；
针对配置变更的第二日志内容中的变更内容，依据配置核查条目检测变更后的配置的遵从程度，确定配置核查结果。
本发明实施例和相关技术相比，具有如下有益效果：
本发明实施例提供的安全配置变更检测方法和装置，通过对设备上的日志记录进行详细分析来判断是否有变更行为，在安全配置频繁变更的情况下做到不影响企业安全。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1是本发明实施例的一种安全配置变更检测方法的流程图；
图2是本发明实施例的一种安全配置变更检测装置的结构示意图；
图3是本发明实施例的支持Syslog日志服务器的变更自动检测方法的流程图；
图4是本发明实施例的支持直接接收日志的变更自动检测方法的流程图；
图5是本发明实施例的支持提供建议的变更自动检测方法的流程图。
具体实施方式
为使本发明的发明目的、技术方案和有益效果更加清楚明了，下面结合附图对本发明的实施例进行说明，需要说明的是，在不冲突的情况下，本申请中的实施例和实施例中的特征可以相互任意组合。
如图1所示，本发明实施例提供一种安全配置变更检测方法，包括：
S101、对获取的日志内容进行筛选，获得符合变更范畴的第一日志内容；
S102、对符合变更范畴的第一日志内容提取配置变更的第二日志内容；
S103、针对配置变更的第二日志内容中的变更内容，依据配置核查条目检测变更后的配置的遵从程度，确定配置核查结果。
其中，日志内容既可以是直接从设备、装置或系统上获取到的日志信息，也可以是通过连接设备、装置或系统的Syslog日志服务器间接获取到的日志信息。
步骤S101中对获取的日志内容进行筛选可以根据诸如时间排序、日志等级等方法过滤掉不符合变更范畴的日志类型，以便进一步的变更内容识别：
根据日志等级分类筛选所述日志内容包括：
获取所述日志内容对应的日志信息列表中日志等级；
根据配置变更内容所属的日志等级筛选出配置变更内容所属的日志等级对应的日志内容。
根据时间排序分类筛选所述日志内容包括：
获取所述日志内容对应的日志信息列表中日志记录时间；
筛选出日志记录时间在预设变更时间范围内的日志内容。
根据日志等级分类筛选日志：以Juniper的防火墙为例，能够看到从防火墙设备上获取的日志信息列表的Level一列日志等级内容，等级分为Emergency、Alert、Critical、Error、Warning、Notification、Information、Debugging八个等级，其中配置变更内容属于Notification等级，进行日志筛选的时候只需提取出Level等级为Notification的日志以供进一步筛选。
根据时间排序方式筛选日志：同样以Juniper的防火墙为例，根据从防火墙设备上获取的日志信息列表，这里可以将进行日志等级分类筛选后的信息进行进一步筛选，根据日志中的Date/Time一列内容，按时间进行逆序排序，提取30秒内的(可以根据需求或者实际情况而决定)所有日志，30秒之外的日志信息都丢弃，从而得到时间较新的所有日志信息。
步骤S102中对符合变更范畴的第一日志内容提取配置变更的第二日志内容包括：
将所述第一日志内容或所述第一日志内容中的描述内容与关键字列 表或者关键字段列表进行匹配，当所述第一日志内容或所述第一日志内容中的描述内容存在关键字列表或者关键字段列表中的元素，则确定所述第一日志内容存在配置变更。
具体地，对上一步筛选完的日志进行进一步的识别，提取有关配置变更的日志内容，例如，可以根据配置变更中用到的关键字筛选日志，实现变更的精确定位。以Juniper防火墙为例，当发生配置变更时，日志信息中Description一列的内容里会有modified、added、changed等字段，需要提前分析出与变更相关的所有关键字，并将这些关键字存入关键字列表中。当得到筛选后的日志信息时，根据关键字列表中的元素去查找Description中是否存在，如果存在则认为识别到变更。
如图2所示，本发明实施例还提供一种安全配置变更检测装置，包括：
日志筛选模块210，设置为对获取的日志内容进行筛选，获得符合变更范畴的第一日志内容；
变更模块220，设置为对符合变更范畴的第一日志内容提取配置变更的第二日志内容；
安全策略管控模块230，设置为针对配置变更的第二日志内容中的变更内容，依据配置核查条目检测变更后的配置的遵从程度，确定配置核查结果
所述日志筛选模块210包括：
等级筛选单元，设置为根据日志等级分类筛选所述日志内容；或者，
时间筛选单元，设置为根据时间排序分类筛选所述日志内容。
所述等级筛选单元根据日志等级分类筛选所述日志内容是指：
获取所述日志内容对应的日志信息列表中日志等级；
根据配置变更内容所属的日志等级筛选出配置变更内容所属的日志等级对应的日志内容。
所述时间筛选单元根据时间排序分类筛选所述日志内容是指：
获取所述日志内容对应的日志信息列表中日志记录时间；
筛选出日志记录时间在预设变更时间范围内的日志内容。
所述变更模块220对符合变更范畴的第一日志内容提取配置变更的第二日志内容是指：
将所述第一日志内容或所述第一日志内容中的描述内容与关键字列表或者关键字段列表进行匹配，当所述第一日志内容或所述第一日志内容中的描述内容存在关键字列表或者关键字段列表中的元素，则确定所述第一日志内容存在配置变更。
如果发现日志中存在配置变更行为，便自动发送变更核查请求并附带变更的具体内容，安全策略管控模块230响应该变更核查请求并进行配置核查。例如，安全策略管控模块230会将变更后的配置信息进行配置核查，该变更配置信息可以是新采集得来也可以是提前采集得来，选择配置核查库，依据配置核查条目检测变更后配置的遵从程度，生成配置核查结果。
实施例一
此实施例中，支持接收Syslog日志服务器发来的日志信息并进行变更识别检测，如图3所示。
Syslog日志服务器处理来自设备的日志信息流。例如，设备上需要提前配置好关联的Syslog日志服务器地址和端口号，启用并将日志吐给Syslog日志服务器；同样，Syslog日志服务器上也需要配置发送属性，将接收到设备的日志信息流封装并发送给日志筛选模块210。
日志内容的筛选。将接收到的日志内容发送给日志筛选模块210，可以根据诸如时间排序、日志等级等方法过滤掉不符合变更范畴的日志类型，以便进一步的变更内容识别。例如：
1)根据日志等级分类筛选日志。以Juniper的防火墙为例，能够看到从防火墙设备上获取的日志信息列表的Level一列日志等级内容，等级分 为Emergency、Alert、Critical、Error、Warning、Notification、Information、Debugging八个等级，其中配置变更内容属于Notification等级，进行日志筛选的时候只需提取出Level等级为Notification的日志以供进一步筛选。
2)根据时间排序方式筛选日志。同样以Juniper的防火墙为例，根据从防火墙设备上获取的日志信息列表，这里可以将进行日志等级分类筛选后的信息进行进一步筛选，根据日志中的Date/Time一列内容，按时间进行逆序排序，提取30秒内的(可以根据需求或者实际情况而决定)所有日志，30秒之外的日志信息都丢弃，从而得到时间较新的所有日志信息。
变更内容识别。对上一步筛选完的日志进行进一步的识别，提取有关配置变更的日志内容，例如，可以根据配置变更中用到的关键字筛选日志，实现变更的精确定位。以Juniper防火墙为例，当发生配置变更时，日志信息中Description一列的内容里会有modified、added、changed等字段，需要提前分析出与变更相关的所有关键字，并将这些关键字存入关键字列表中。当得到筛选后的日志信息时，根据关键字列表中的元素去查找Description中是否存在，如果存在则认为识别到变更。
自动配置核查。如果发现日志中存在配置变更行为，便自动发送变更核查请求并附带变更的具体内容，安全策略管控模块230响应该变更核查请求并进行配置核查。例如，安全策略管控模块230会将变更后的配置信息进行配置核查，该变更配置信息可以是新采集得来也可以是提前采集得来，选择配置核查库，依据配置核查条目检测变更后配置的遵从程度，生成配置核查结果。
实施例二
此实施例中，支持直接接收日志的变更自动检测方法，如图4所示。
处理来自设备的日志信息流。例如，设备上需要提前配置好日志传输地址和端口号为管控设备，启用并将日志吐给管控设备，管控设备将接收到设备的日志信息流解析并发送给日志筛选模块210。
日志内容的筛选。将接收到的日志内容发送给日志筛选模块210，可以根据诸如时间排序、日志等级等方法过滤掉不符合变更范畴的日志类型，以便进一步的变更内容识别。例如：
1)根据日志等级分类筛选日志。以Juniper的防火墙为例，能够看到从防火墙设备上获取的日志信息列表的Level一列日志等级内容，等级分为Emergency、Alert、Critical、Error、Warning、Notification、Information、Debugging八个等级，其中配置变更内容属于Notification等级，进行日志筛选的时候只需提取出Level等级为Notification的日志以供进一步筛选。
2)根据时间排序方式筛选日志。同样以Juniper的防火墙为例，根据从防火墙设备上获取的日志信息列表，这里可以将进行日志等级分类筛选后的信息进行进一步筛选，根据日志中的Date/Time一列内容，按时间进行逆序排序，提取30秒内的(可以根据需求或者实际情况而决定)所有日志，30秒之外的日志信息都丢弃，从而得到时间较新的所有日志信息。
变更内容识别。对上一步筛选完的日志进行进一步的识别，提取有关配置变更的日志内容，例如，可以根据配置变更中用到的关键字筛选日志，实现变更的精确定位。以Juniper防火墙为例，当发生配置变更时，日志信息中Description一列的内容里会有modified、added、changed等字段，需要提前分析出与变更相关的所有关键字，并将这些关键字存入关键字列表中。当得到筛选后的日志信息时，根据关键字列表中的元素去查找Description中是否存在，如果存在则认为识别到变更。
自动配置核查。如果发现日志中存在配置变更行为，便自动发送变更核查请求并附带变更的具体内容，安全策略管控模块230响应该变更核查请求并进行配置核查。例如，安全策略管控模块230会将变更后的配置信息进行配置核查，该变更配置信息可以是新采集得来也可以是提前采集得来，选择配置核查库，依据配置核查条目检测变更后配置的遵从程度，生成配置核查结果。
实施例三
此实施例中，可以支持对自动配置核查提供建议方式的变更自动检测方法，如图5所示。
日志内容的筛选。将接收到的日志内容发送给日志筛选模块210，可以根据诸如时间排序、日志等级等方法过滤掉不符合变更范畴的日志类型，以便进一步的变更内容识别。例如：
1)根据日志等级分类筛选日志。以Juniper的防火墙为例，能够看到从防火墙设备上获取的日志信息列表的Level一列日志等级内容，等级分为Emergency、Alert、Critical、Error、Warning、Notification、Information、Debugging八个等级，其中配置变更内容属于Notification等级，进行日志筛选的时候只需提取出Level等级为Notification的日志以供进一步筛选。
2)根据时间排序方式筛选日志。同样以Juniper的防火墙为例，根据从防火墙设备上获取的日志信息列表，这里可以将进行日志等级分类筛选后的信息进行进一步筛选，根据日志中的Date/Time一列内容，按时间进行逆序排序，提取30秒内的(可以根据需求或者实际情况而决定)所有日志，30秒之外的日志信息都丢弃，从而得到时间较新的所有日志信息。
变更内容识别。对上一步筛选完的日志进行进一步的识别，提取有关配置变更的日志内容，例如，可以根据配置变更中用到的关键字筛选日志，实现变更的精确定位。以Juniper防火墙为例，当发生配置变更时，日志信息中Description一列的内容里会有modified、added、changed等字段，需要提前分析出与变更相关的所有关键字，并将这些关键字存入关键字列表中。当得到筛选后的日志信息时，根据关键字列表中的元素去查找Description中是否存在，如果存在则认为识别到变更。
自动配置核查。如果发现日志中存在配置变更行为，便自动发送变更核查请求并附带变更的具体内容，安全策略管控模块230响应该变更核查请求并进行配置核查。例如，安全策略管控模块230会将变更后的配置信息进行配置核查，该变更配置信息可以是新采集得来也可以是提前采集得 来，选择配置核查库，依据配置核查条目检测变更后配置的遵从程度，生成配置核查结果。
可选地，支持为用户提供变更配置核查建议。例如，根据变更行为检测后的结果进行自动化配置核查后，查看变更后配置合规项为符合的内容有哪些，不符合的内容有哪些，针对不符合条目给出修改成符合要求的配置方法，以及综合以上结果建议用户选择是否遵从该变更配置。
本发明的实施例还提供了一种存储介质。可选地，在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的程序代码：
S101、对获取的日志内容进行筛选，获得符合变更范畴的第一日志内容；
S102、对符合变更范畴的第一日志内容提取配置变更的第二日志内容；
S103、针对配置变更的第二日志内容中的变更内容，依据配置核查条目检测变更后的配置的遵从程度，确定配置核查结果。
可选地，在本实施例中，上述存储介质可以包括但不限于：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
可选地，本实施例中的具体示例可以参考上述实施例及可选实施方式中所描述的示例，本实施例在此不再赘述。
显然，本领域的技术人员应该明白，上述的本发明的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。
工业实用性
如上所述，本发明实施例提供的一种安全配置变更检测方法和装置，具有以下有益效果：通过对设备上的日志记录进行详细分析来判断是否有变更行为，在安全配置频繁变更的情况下做到不影响企业安全。

Claims (10)

  1. 一种安全配置变更检测方法，包括：
    对获取的日志内容进行筛选，获得符合变更范畴的第一日志内容；
    对符合变更范畴的第一日志内容提取配置变更的第二日志内容；
    针对配置变更的第二日志内容中的变更内容，依据配置核查条目检测变更后的配置的遵从程度，确定配置核查结果。
  2. 如权利要求1所述的方法，其中，对获取的日志内容进行筛选包括：
    根据日志等级分类筛选所述日志内容；或者，根据时间排序分类筛选所述日志内容。
  3. 如权利要求2所述的方法，其中，根据日志等级分类筛选所述日志内容包括：
    获取所述日志内容对应的日志信息列表中日志等级；
    根据配置变更内容所属的日志等级筛选出配置变更内容所属的日志等级对应的日志内容。
  4. 如权利要求2所述的方法，其中，根据时间排序分类筛选所述日志内容包括：
    获取所述日志内容对应的日志信息列表中日志记录的时间；
    筛选出日志记录的时间在预设变更时间范围内的日志内容。
  5. 如权利要求1所述的方法，其中，对符合变更范畴的第一日志内容提取配置变更的第二日志内容包括：
    将所述第一日志内容或所述第一日志内容中的描述内容与关键 字列表或者关键字段列表进行匹配，当所述第一日志内容或所述第一日志内容中的描述内容存在关键字列表或者关键字段列表中的元素，则确定所述第一日志内容存在配置变更。
  6. 一种安全配置变更检测装置，包括：
    日志筛选模块，设置为对获取的日志内容进行筛选，获得符合变更范畴的第一日志内容；
    变更模块，设置为对符合变更范畴的第一日志内容提取配置变更的第二日志内容；
    安全策略管控模块，设置为针对配置变更的第二日志内容中的变更内容，依据配置核查条目检测变更后的配置的遵从程度，确定配置核查结果。
  7. 如权利要求6所述的装置，其中，所述日志筛选模块包括：
    等级筛选单元，设置为根据日志等级分类筛选所述日志内容；或者，
    时间筛选单元，设置为根据时间排序分类筛选所述日志内容。
  8. 如权利要求7所述的装置，其中，所述等级筛选单元根据日志等级分类筛选所述日志内容是指：
    获取所述日志内容对应的日志信息列表中日志等级；
    根据配置变更内容所属的日志等级筛选出配置变更内容所属的日志等级对应的日志内容。
  9. 如权利要求7所述的装置，其中，所述时间筛选单元根据时间排序分类筛选所述日志内容是指：
    获取所述日志内容对应的日志信息列表中日志记录的时间；
    筛选出日志记录时间在预设变更时间范围内的日志内容。
  10. 如权利要求6所述的装置，其中，所述变更模块对符合变更范畴的第一日志内容提取配置变更的第二日志内容是指：
    将所述第一日志内容或所述第一日志内容中的描述内容与关键字列表或者关键字段列表进行匹配，当所述第一日志内容或所述第一日志内容中的描述内容存在关键字列表或者关键字段列表中的元素，则确定所述第一日志内容存在配置变更。
PCT/CN2016/096189 2015-08-21 2016-08-22 一种安全配置变更检测方法和装置 WO2017032288A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510520959.2 2015-08-21
CN201510520959.2A CN106470205B (zh) 2015-08-21 2015-08-21 一种安全配置变更检测方法和装置

Publications (1)

Publication Number Publication Date
WO2017032288A1 true WO2017032288A1 (zh) 2017-03-02

Family

ID=58099536

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/096189 WO2017032288A1 (zh) 2015-08-21 2016-08-22 一种安全配置变更检测方法和装置

Country Status (2)

Country Link
CN (1) CN106470205B (zh)
WO (1) WO2017032288A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101018121A (zh) * 2007-03-15 2007-08-15 杭州华为三康技术有限公司 日志的聚合处理方法及聚合处理装置
CN101610264A (zh) * 2009-07-24 2009-12-23 深圳市永达电子股份有限公司 一种防火墙系统、安全服务平台及防火墙系统的管理方法
US20130055399A1 (en) * 2011-08-29 2013-02-28 Kaspersky Lab Zao Automatic analysis of security related incidents in computer networks
CN104065521A (zh) * 2014-07-18 2014-09-24 国家电网公司 一种电力网络设备日志和配置文件的采集、分析和发布系统及其方法

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7475424B2 (en) * 2004-09-02 2009-01-06 International Business Machines Corporation System and method for on-demand dynamic control of security policies/rules by a client computing device
CN101753369B (zh) * 2008-12-03 2012-03-28 北京天融信网络安全技术有限公司 一种检测防火墙规则冲突的方法及装置
CN103138926B (zh) * 2011-11-30 2016-01-13 中国电信股份有限公司 水印签名方法与装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101018121A (zh) * 2007-03-15 2007-08-15 杭州华为三康技术有限公司 日志的聚合处理方法及聚合处理装置
CN101610264A (zh) * 2009-07-24 2009-12-23 深圳市永达电子股份有限公司 一种防火墙系统、安全服务平台及防火墙系统的管理方法
US20130055399A1 (en) * 2011-08-29 2013-02-28 Kaspersky Lab Zao Automatic analysis of security related incidents in computer networks
CN104065521A (zh) * 2014-07-18 2014-09-24 国家电网公司 一种电力网络设备日志和配置文件的采集、分析和发布系统及其方法

Also Published As

Publication number Publication date
CN106470205A (zh) 2017-03-01
CN106470205B (zh) 2021-03-05

Similar Documents

Publication Publication Date Title
US10691795B2 (en) Quantitative unified analytic neural networks
US20180075240A1 (en) Method and device for detecting a suspicious process by analyzing data flow characteristics of a computing device
US9990501B2 (en) Diagnosing and tracking product vulnerabilities for telecommunication devices via a database
CN107798047B (zh) 重复工单检测方法、装置、服务器和介质
CN109766719B (zh) 一种敏感信息检测方法、装置及电子设备
US10097569B2 (en) System and method for tracking malware route and behavior for defending against cyberattacks
US11153144B2 (en) System and method of automated fault correction in a network environment
WO2017101301A1 (zh) 数据信息处理方法及装置
US11803461B2 (en) Validation of log files using blockchain system
CN107016298B (zh) 一种网页篡改监测方法及装置
CN109040110B (zh) 一种外发行为检测方法及装置
CN113132311A (zh) 异常访问检测方法、装置和设备
CN107609179B (zh) 一种数据处理方法及设备
RU148692U1 (ru) Система мониторинга событий компьютерной безопасности
JP7207009B2 (ja) 異常検知装置、異常検知方法および異常検知プログラム
RU180789U1 (ru) Устройство аудита информационной безопасности в автоматизированных системах
CN107766737B (zh) 一种数据库审计方法
CN112799722A (zh) 命令识别方法、装置、设备和存储介质
WO2017032288A1 (zh) 一种安全配置变更检测方法和装置
EP3361405B1 (en) Enhancement of intrusion detection systems
CN115481299A (zh) 产品曝光异常检测方法、系统、设备及计算机存储介质
CN115186001A (zh) 一种补丁处理方法和装置
US11232202B2 (en) System and method for identifying activity in a computer system
WO2016180134A1 (zh) 管理信息安全规范库的方法和装置
US20230011129A1 (en) Log analyzer for fault detection

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16838547

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16838547

Country of ref document: EP

Kind code of ref document: A1