WO2022156293A1 - Procédé et appareil de traitement de journal d'alerte et support de stockage - Google Patents

Procédé et appareil de traitement de journal d'alerte et support de stockage Download PDF

Info

Publication number
WO2022156293A1
WO2022156293A1 PCT/CN2021/126200 CN2021126200W WO2022156293A1 WO 2022156293 A1 WO2022156293 A1 WO 2022156293A1 CN 2021126200 W CN2021126200 W CN 2021126200W WO 2022156293 A1 WO2022156293 A1 WO 2022156293A1
Authority
WO
WIPO (PCT)
Prior art keywords
alarm
address
domain name
log
content
Prior art date
Application number
PCT/CN2021/126200
Other languages
English (en)
Chinese (zh)
Inventor
杨利东
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2022156293A1 publication Critical patent/WO2022156293A1/fr

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/3065—Monitoring arrangements determined by the means or processing involved in reporting the monitored data
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
    • G06F11/3006—Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/561—Virus type analysis

Definitions

  • the present application relates to the field of network security, and in particular, to a method, device and storage medium for processing alarm logs.
  • the communication network is an important tool for people to obtain and/or transmit information, but at the same time, the communication network is also a fertile ground for criminals to commit crimes.
  • the current technology deploys a sandbox alarm device and a collection device in the communication network.
  • the collection device collects the session in the communication network, obtains the session information of the session and the content transmitted on the session, and sends an alarm to the sandbox.
  • the device sends the session information and the content.
  • the sandbox alarm device analyzes the session information and the content and outputs a sandbox alarm log.
  • the sandbox alarm log includes alarm categories, so that based on the alarm category of the sandbox alarm log, it can be determined whether the session is attacked by a criminal or whether the session is infected by a virus or the like.
  • the sandbox alarm device uses the session information and the content as a sample, and analyzes the sample by simulating the executable environment to obtain an alarm log. Therefore, the accuracy of the analysis of the sample by the sandbox alarm device depends on the executable simulated by the sandbox alarm device. Authenticity of the environment.
  • the authenticity of the executable environment simulated by the sandbox alarm device is often low, resulting in low precision of the alarm category of the output alarm log.
  • the present application provides a method, a device and a storage medium for processing an alarm log, so as to improve the accuracy of acquiring the alarm category of the alarm log.
  • the technical solution is as follows.
  • the present application provides a method for processing an alarm log.
  • a cloud device obtains a first alarm log output by a virtual detection environment, and the first alarm log is sent by the virtual detection environment to a first collection device.
  • the first alarm log includes at least one log content.
  • the cloud device analyzes the at least one item of log content to obtain abnormal information corresponding to the first alarm log.
  • the cloud device matches the abnormal information with a plurality of classification conditions to obtain a first classification condition from the plurality of classification conditions, where the first classification condition is a classification condition satisfied by the abnormal information.
  • the cloud device determines the alarm type corresponding to the first classification condition based on the corresponding relationship between the classification condition and the alarm type.
  • the cloud device determines the alarm type corresponding to the first classification condition as the alarm type of the first alarm log.
  • the cloud device further analyzes at least one log content output by the virtual detection environment, abnormal information corresponding to the first alarm log is obtained, and the abnormal information is used to reflect the security of the at least one log content.
  • the abnormal information is then matched with a plurality of classification conditions to obtain a first classification condition satisfied by the abnormal information, and the alarm category corresponding to the first classification condition is used as the alarm category of the first alarm log, thereby improving the acquisition of the first alarm log.
  • the accuracy of the alarm category is set, so that the administrator can quickly and efficiently take the treatment plan according to the more accurate alarm category.
  • the at least one item of log content includes a first address, a first uniform resource locator URL, a content name of the data content, a hash value of the data content, or a device of the first collection device
  • the first address includes the source address and/or the destination address of the session
  • the first URL is used to identify the network source of the data content.
  • the exception information includes one or more of the following information: address risk information of the first address, the number of alarms of the first address, and the first address.
  • An intrusion prevention system IPS alarm indication of an address wherein the IPS alarm indication is used to indicate whether the first collection device generates an IPS alarm log including the first address.
  • the address risk information, the number of alarms, and the IPS alarm indication reflect the security of the first address from different dimensions. Therefore, the cloud device uses rich and multi-dimensional information to improve the accuracy of obtaining the alarm category of the first alarm log.
  • the cloud device obtains the address risk information from the address intelligence database based on the first address, and the address intelligence database includes the first address and the address risk information. Correspondence. Since the address risk information of the first address is obtained from the address intelligence database, the address risk information can be quickly obtained, and the efficiency of obtaining the alarm category of the first alarm log is improved.
  • the cloud device selects a first alarm log set including the first address from a plurality of alarm logs acquired within a first predetermined time range , collect statistics on the alarm logs in the first alarm log set to obtain a first number, where the number of alarms of the first address is equal to the first number. In this way, by counting the alarm logs including the first address, the number of alarms of the first address can be accurately obtained.
  • the cloud device queries whether there is an IPS alarm log including the first address in the IPS alarm log generated by the first collection device, and obtains the IPS based on the query result. Warning indication. In this way, by querying the IPS alarm log generated by the first collection device, the IPS alarm indication can be accurately obtained.
  • the abnormal information includes a content alarm type corresponding to the content name; wherein, the content alarm type includes an advertiser alarm type, a virus alarm type, a download alarm type or grayware alarm type.
  • the content alarm type is a dimension that reflects the security of the data content, so the cloud device uses the content alarm type to improve the accuracy of acquiring the alarm type of the first alarm log.
  • the cloud device obtains the content alarm type from the corresponding relationship between the content name and the content alarm type based on the content name. Since the content alarm type is acquired from the corresponding relationship between the content name and the content alarm type, the content alarm type can be quickly acquired, and the efficiency of acquiring the alarm type of the first alarm log is improved.
  • the abnormal information includes the collection of the data content. number of devices.
  • the content name, the first URL, and the hash value are used to identify the data content. The larger the number of collection devices that collect the data content, the more collection devices collect the data content, indicating that the data content is used by the user. more visits.
  • the number of collection devices that collect the data content is a dimension that reflects the security of the data content.
  • the cloud device uses the number of collection devices that collect the data content to improve the accuracy of obtaining the alarm category of the first alarm log.
  • the cloud device selects a second alarm log set including the first URL, the hash value and the content name from a plurality of alarm logs acquired within a second predetermined time range.
  • the cloud device counts different device identifiers included in each alarm log in the second alarm log set to obtain a fourth number, and the number of collection devices in the abnormal information corresponding to the first alarm log is the fourth number. In this way, the cloud device can accurately obtain the number of acquisition devices that acquire the data content.
  • the at least one item of log content includes a first URL
  • the first URL includes a first path
  • the exception information includes one or more pieces of the following information: the number of alarms or the first path of the first path.
  • the path type of a path includes an advertisement download path, a virus download path, a downloader download path, or a grayware download path.
  • the alarm times and the path type reflect the security of the first path from different dimensions, and the cloud device can use the alarm times and/or the path category to improve the accuracy of acquiring the alarm category of the first alarm log.
  • the cloud device selects a third alarm log set including the first path from the alarm logs acquired within a third predetermined time range, and corrects the The alarm logs in the third alarm log set are counted to obtain a third number, where the number of alarms of the first path is equal to the third number.
  • the cloud device can accurately obtain the number of alarms of the first path.
  • the cloud device obtains the path type from the corresponding relationship between the path and the path type based on the first path.
  • the cloud device can quickly acquire the path type of the first path, thereby improving the efficiency of acquiring the alarm category of the first alarm log.
  • the first URL further includes a first domain name
  • the exception information further includes one or more of the following information: domain name risk information of the first domain name, alarm times of the first domain name, or the first domain name activity of the domain name.
  • the domain name risk information, the number of alarms, and the activity of the domain name reflect the security of the first address from different dimensions.
  • the cloud device uses these multi-dimensional information to improve the accuracy of obtaining the alarm category of the first alarm log.
  • the cloud device obtains domain name risk information from a domain name intelligence database based on the first domain name, and the domain name intelligence database includes the first domain name and the domain name risk information. Correspondence. By obtaining the domain name risk information of the first domain name from the domain name intelligence database, the cloud device can quickly obtain the domain name risk information, thereby improving the efficiency of obtaining the alarm category of the first alarm log.
  • the cloud device selects a fourth alarm log set including the first domain name from the first alarm logs acquired within a fourth predetermined time range , a fourth number is obtained by performing statistics on the alarm logs included in the fourth alarm log set, wherein the number of alarms of the first domain name is equal to the fourth number. In this way, by counting the alarm logs including the first domain name, the number of alarms of the first domain name can be accurately obtained.
  • the cloud device obtains the activity of the domain name from the corresponding relationship between the domain name and the activity of the domain name based on the first domain name. Obtaining the activity of the domain name from the corresponding relationship between the domain name and the activity of the domain name, the cloud device can quickly obtain the activity of the domain name of the first domain name, improving the efficiency of obtaining the alarm type of the first alarm log.
  • the alarm category of the first alarm log includes an advertiser alarm, a downloader alarm, a malicious virus alarm or a grayware alarm. In this way, since these alarm categories can directly reflect the alarm cause, the alarm cause for generating the first alarm log can be determined based on the alarm category of the first alarm log.
  • the classification conditions corresponding to the advertiser alarm include at least one of the following: the address risk information of the first address is the address risk information of the advertisement type, and the domain name risk information of the first domain name in the first URL is the domain name risk information of the advertisement type, the path type of the first path in the first URL is the advertisement download path, the domain activity of the first domain name exceeds the first threshold, the number of collection devices that collect the data content exceeds the second threshold, or
  • the content alarm type corresponding to the content name is the advertiser alarm type.
  • the classification conditions corresponding to the downloader alarm include at least one of the following: the address risk information of the first address is the address risk information of the downloader type, and the domain name risk information of the first domain name in the first URL The information is the domain name risk information of the downloader type, the path type of the first path in the first URL is the downloader download path, the domain name activity of the first domain name exceeds the third threshold, and the number of collection devices that collect the data content exceeds the fourth The threshold, or the content alarm type corresponding to the content name is the downloader alarm type.
  • the classification conditions corresponding to the malicious virus alarm include at least one of the following: the address risk information of the first address is address risk information of a virus type, and the domain name risk information of the first domain name in the first URL It is the domain name risk information of the virus type, the IPS alarm indication of the first address is used to instruct the first collection device to generate an IPS alarm log including the first address, the domain name activity of the first domain name exceeds the fifth threshold, or the content name corresponds to The content alert type is a virus alert type.
  • the classification conditions corresponding to the grayware alarm include at least one of the following: the address risk information of the first address is address risk information of grayware type, and the domain name risk information of the first domain name in the first URL
  • the information is domain name risk information of the grayware type, the number of alerts for the first address exceeds the sixth threshold, the number of alerts for the first domain name exceeds the seventh threshold, the number of alerts for the first path in the first URL exceeds the eighth threshold, or the
  • the content alarm type corresponding to the content name is the grayware alarm type.
  • the present application provides an apparatus for processing an alarm log, which is used to execute the method in the first aspect or any possible implementation manner of the first aspect.
  • the apparatus includes means for performing the method in the first aspect or any possible implementation manner of the first aspect.
  • the present application provides a device for processing an alarm log, where the device includes a processor and a memory.
  • the processor and the memory may be connected through an internal connection.
  • the memory is used for storing a program
  • the processor is used for executing the program in the memory, so that the apparatus performs the method in the first aspect or any possible implementation manner of the first aspect.
  • the present application provides a computer program product, the computer program product includes a computer program stored in a computer-readable storage medium, and the computer program is loaded by a processor to implement the above-mentioned first aspect or the first aspect.
  • the computer program product includes a computer program stored in a computer-readable storage medium, and the computer program is loaded by a processor to implement the above-mentioned first aspect or the first aspect.
  • the present application provides a computer-readable storage medium for storing a computer program, where the computer program is loaded by a processor to execute the method of the first aspect or any possible implementation manner of the first aspect.
  • the present application provides a chip, including a memory and a processor, where the memory is used to store computer instructions, and the processor is used to call and run the computer instructions from the memory to execute the above-mentioned first aspect and any of the first aspects. methods in possible implementations.
  • FIG. 1 is a schematic diagram of a network architecture provided by an embodiment of the present application.
  • FIG. 2 is a flowchart of a method for processing an alarm log provided by an embodiment of the present application
  • FIG. 3 is a flowchart of a method for generating a first alarm log provided by an embodiment of the present application
  • FIG. 4 is a schematic structural diagram of an apparatus for processing an alarm log provided by an embodiment of the present application.
  • FIG. 5 is a schematic structural diagram of another apparatus for processing an alarm log provided by an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of a collection device provided by an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of an alarm device provided by an embodiment of the present application.
  • an embodiment of the present application provides a network architecture 100 , including: a cloud device 101 , at least one alarm device 102 , and at least one collection device 103 .
  • the collection device communicates with one or more alarm devices 102
  • each alarm device 102 communicates with the cloud device 101
  • each alarm device 102 is used for running virtual detection surroundings.
  • Each collection device 103 performs security detection on the traffic transmitted through the collection device, and generates an intrusion prevention system (intrusion prevention system, IPS) alarm log according to the result of the security detection.
  • the collection device 103 supports detection based on session (or "flow") status in the process of performing security detection on traffic.
  • the collection device 103 acquires the session information of the session and the data content transmitted on the session from the session, and sends the session information and the data content to the alarm device 102 in communication with the collection device 103 .
  • the alarm device 102 For the alarm device 102 that communicates with the collection device 103, the alarm device 102 receives the session information and the data content, and the virtual detection environment running on the alarm device 102 analyzes the session information and the data content to obtain an alarm log .
  • the cloud device 101 acquires the alarm log output by the virtual detection environment, and processes the alarm log to obtain the first alarm category of the alarm log.
  • the session between the first terminal and the first server passes through the collection device 1031
  • the session between the second terminal and the second server passes through the collection device 1032 .
  • the collection device 1031 receives the message in the session 1 sent by the first terminal, and forwards the message in the session 1 to the first server; or, the collection device 1031 receives the message in the first server Send the packets in session 1, and forward the packets in session 1 to the first terminal.
  • the collection device 1031 acquires the session information of the session and the data content transmitted on the session from the session 1, and sends the session information and the data content to the alarm device 102.
  • the virtual detection environment running on the alarm device 102 analyzes the session information and the data content to obtain an alarm log.
  • the cloud device 101 acquires the alarm log output by the virtual detection environment, and processes the alarm log to obtain the first alarm category of the alarm log.
  • the session information includes the address of the session and a uniform resource locator (URL) of the data content.
  • the address of the session includes the source address and/or the destination address of the session.
  • the URL is used to identify the network source of the data content.
  • the session information of the session further includes the port number of the session and/or the protocol type of the session.
  • the port number of the session includes the source port number and/or the destination port number of the session.
  • the first alarm category obtained by processing the alarm log by the cloud device 101 includes an advertiser alarm, a downloader alarm, a malicious virus alarm, a grayware alarm, and the like.
  • the alarm log includes at least one item of log content, for example, the at least one item of log content includes the address of the session, the URL of the data content, the content name of the data content, the hash value of the data content, or the data of the collection device 103 .
  • the at least one item of log content includes the address of the session, the URL of the data content, the content name of the data content, the hash value of the data content, or the data of the collection device 103 .
  • One or more of the device IDs One or more of the device IDs.
  • the alarm log includes other log contents in addition to the above at least one log content.
  • it also includes one or more of the port number of the session, the protocol type of the session, the content type of the data content, the data volume of the data content, the virus family information of the data content, or the second alarm category.
  • the second alarm category in the alarm log is the alarm category generated by the virtual detection environment, including four categories of high risk, medium risk, low risk or safe, and the second alarm category is a vague category that cannot accurately reflect the generation of the alarm. Therefore, the precision of the second alarm category is relatively low.
  • the cloud device 101 obtains the alarm log output by the virtual detection environment, processes the alarm log to obtain a first alarm type of the alarm log with higher accuracy, and determines the cause of the alarm based on the first alarm type. For example, assuming that the first alarm category is a malicious virus alarm, it can be determined that the cause of the alarm is a malicious virus.
  • the alarm log when the URL includes a domain name, the alarm log also includes the domain name.
  • the 14 log contents are shown in Table 1. That is to say, the alarm log includes part or all of the log contents among the 14 log contents shown in Table 1 below.
  • the cloud device 101 is a separate network device, that is, the cloud device 101 and each alarm device 102 are different devices.
  • the cloud device 101 and one alarm device in the at least one alarm device 102 are the same device, that is, the cloud device 101 and the alarm device are integrated into one device, and the alarm device communicates with every other alarm device in this scenario.
  • the above-mentioned virtual detection environment includes sandboxes, etc., and the alarm logs output by the virtual detection environment include sandbox alarm logs and the like.
  • the virtual detection environment (or sandbox) is a security mechanism and a kind of virtualization.
  • Sandboxes provide an isolated environment for running programs, usually for experiments with untrusted sources, undetermined program intent, or destructive programs.
  • At least one acquisition device 103 in FIG. 1 includes a firewall and/or a probe or the like.
  • the collection device 103 also communicates with the cloud device 101, when the collection device 103 receives the session, analyzes the session to obtain an IPS alarm log, and sends the IPS alarm to the cloud device 101. log.
  • the IPS alarm log includes content such as the address of the session, that is, the IPS alarm log includes content such as the source address and/or destination address of the session.
  • the cloud device 101 includes an address intelligence library, and the address intelligence library is used to store the correspondence between addresses and address risk information.
  • the record For each record in the address intelligence base, the record includes an address and address risk information corresponding to the address, where the address risk information is used to describe the risk of the address.
  • the address risk information includes an address risk value corresponding to the address or a risk type corresponding to the address, and the like.
  • the address risk value corresponding to the address is used to reflect the risk intensity corresponding to the address. For example, the larger the address risk value corresponding to the address, the higher the risk intensity corresponding to the address.
  • the risk type corresponding to the address includes the virus family type, advertiser type, downloader type or grayware type, etc. corresponding to the address.
  • the records in the address intelligence database are configured by technicians and/or obtained by the cloud device 101 .
  • the cloud device 101 acquires records including addresses and address risk information configured by technicians, and saves the acquired records in the address intelligence database; and/or, the cloud device 101 generates records including addresses and address risk information , and save the generated records in the address intelligence database; and/or, the cloud device 101 receives records including addresses and address risk information sent by other devices, and saves the received records in the address intelligence database, and other devices Including threat intelligence devices and/or honeypot devices, etc.
  • Table 2 is the address intelligence database included in the cloud device 101.
  • the first record includes the address "IP1” and the address risk information "Adware/AD.Qjwmonkey", "Adware/AD.Qjwmonkey” is an advertiser type.
  • the second record in the corresponding relationship includes the address "IP2" and the address risk information "80", and "80" is the address risk value.
  • the cloud device 101 includes a domain name intelligence database, and the domain name intelligence database is used to store the correspondence between domain names and domain name risk information.
  • the record For each record in the domain name intelligence database, the record includes the domain name and the domain name risk information corresponding to the domain name, and the domain name risk information is used to describe the risk of the domain name.
  • the domain name risk information includes a domain name risk value corresponding to the domain name or a risk type corresponding to the domain name, and the like.
  • the domain name risk value corresponding to the domain name is used to reflect the risk intensity corresponding to the domain name. For example, the larger the domain name risk value corresponding to the domain name is, the higher the risk intensity corresponding to the domain name is.
  • the risk type corresponding to the domain name includes the virus family type, advertiser type, downloader type or grayware type corresponding to the domain name.
  • the records in the address intelligence database are configured by technicians and/or obtained by the cloud device 101 .
  • the cloud device 101 acquires records including domain names and domain name risk information configured by technicians, and saves the acquired records in the domain name intelligence database; and/or, the cloud device 101 generates records including domain names and domain name risk information , and save the generated records in the domain name intelligence database; and/or, the cloud device 101 receives records including domain name and domain name risk information sent by other devices, and saves the received records in the address intelligence database, and other devices Including threat intelligence devices and/or honeypot devices, etc.
  • Table 3 is the domain name intelligence database included in the cloud device 101.
  • the first record includes the domain name "Domain1" and the domain name risk information "Globelmposte".
  • “Globelmposte” is A type of virus family.
  • the second record in the corresponding relationship includes the domain name "Domain2" and the domain name risk information "90", and "90" is the domain name risk value.
  • the cloud device 101 includes a correspondence between content names and content alarm types, and each record in the correspondence between content names and content alarm types includes the content name of the data content and the content alarm type corresponding to the data content.
  • the content alarm type corresponding to the data content includes an advertiser alarm type, a virus alarm type, a downloader alarm type, or a grayware alarm type, and the like.
  • the data content is a file or a web page
  • the content name of the data content is a file name or a web page name, or the like.
  • the records in the correspondence between the content name and the content alarm type are configured by a technician and/or obtained by the cloud device 101 .
  • the cloud device 101 acquires the records including the content name and the content alarm type configured by the technician, and saves the acquired record in the corresponding relationship between the content name and the content alarm type; and/or, the cloud device 101 generates a record including the content record of name and content alarm type, and save the generated record in the corresponding relationship between content name and content alarm type; and/or, the cloud device 101 receives records including content name and content alarm type sent by other devices, and sends The received records are stored in the corresponding relationship between the content name and the content alarm type.
  • Other devices include cloud sandbox devices.
  • Table 4 shows the correspondence between content names and content alarm types.
  • the first record includes content alarms corresponding to the content names "Filename1" and “Filename1" Type, the content alarm type is the virus alarm type.
  • “Filename1” is a file name, and the first record indicates that the file corresponding to "Filename1" is a virus file.
  • the second record includes content alarm types corresponding to the content names "Filename2" and “Filename2", and the content alarm type is an advertiser alarm type.
  • “Filename2” is a file name
  • the second record indicates that the file corresponding to "Filename2" is an advertisement file.
  • the cloud device 101 includes a correspondence between paths and path types, and each record in the correspondence between paths and path types includes a path corresponding to the data content and a path type corresponding to the path.
  • the path type corresponding to the path includes an advertisement download path, a virus download path, a downloader download path, or a grayware download path.
  • the path is a path included in the URL corresponding to the data content, where the URL is used to identify the network source of the data content.
  • the URL includes information such as protocol, address, and path, or the URL includes information such as protocol, domain name, and path, that is, the URL can be expressed as: protocol+address/domain name+path.
  • the protocol includes protocols such as "http”.
  • http://www.baidu.com/aaaa/sss/qq.exe the URL includes information such as protocol, domain name and path, the protocol is "http" protocol, and the domain name is "www.baidu.com” , the path is "aaaa/sss/qq”.
  • the URL includes information such as protocol, address and path, the protocol is "http" protocol, the address is "192.168.1.1”, and the path is "admin” /test”.
  • the records in the correspondence between paths and path types are configured by technicians and/or obtained by the cloud device 101 .
  • the cloud device 101 acquires records including paths and path types configured by technicians, and saves the acquired records in the corresponding relationship between paths and path types; and/or, the cloud device 101 generates a record including paths and path types and/or, the cloud device 101 receives records including paths and path types sent by other devices, and saves the received records in the path and path type In the corresponding relationship, other devices include cloud sandbox devices, etc.
  • Table 5 shows the correspondence between paths and path types.
  • the first record includes paths "Path1" and "Path1".
  • the corresponding path types are virus downloads path.
  • the second record in the corresponding relationship shown in Table 5 the second record includes paths "Path2" and the path types corresponding to "Path2" are advertiser download paths.
  • the cloud device 101 includes a corresponding relationship between the domain name and the domain name activity, and each record in the corresponding relationship between the domain name and the domain name activity includes the domain name and the domain name activity corresponding to the domain name.
  • the activity degree of the domain name corresponding to the domain name is used to reflect the situation that the domain name is accessed by the user, that is, the higher the activity degree of the domain name corresponding to the domain name is, the higher the number of times the domain name is accessed by the user.
  • the activity of the domain name corresponding to the domain name includes the access times of the domain name accessed by users.
  • the cloud device 101 can obtain the URL accessed by the user. Whenever the cloud device 101 obtains a URL accessed by the user, if the URL includes a domain name, the domain name activity corresponding to the domain name is added to the corresponding relationship between the domain name and the domain name activity.
  • Table 6 is the corresponding relationship between domain names and domain name activity.
  • the first record includes the domain name activity corresponding to the domain names "Domain1" and “Domain1”” 105", indicating that the domain name "Domain1” has been accessed 105 times by users.
  • the second record in the corresponding relationship shown in Table 6 the second record includes the domain names "Domain2” and the domain name activity "100” corresponding to "Domain2”, indicating that the domain name "Domain2" is accessed 100 times by the user.
  • an embodiment of the present application provides a method 200 for processing an alarm log.
  • the method is applied to the network architecture 100 shown in FIG. 1 , and the method includes:
  • Step 201 the cloud device obtains a first alarm log output by the virtual detection environment, where the first alarm log is obtained by the virtual detection environment by analyzing the session information sent by the first collection device and the data content transmitted in the session described by the session information,
  • the first alarm log includes at least one item of log content.
  • Step 202 The cloud device analyzes the at least one log content to obtain abnormal information corresponding to the first alarm log.
  • Step 203 The cloud device matches the abnormal information with a plurality of classification conditions to obtain a first classification condition from the plurality of classification conditions, where the first classification condition is a classification condition satisfied by the abnormal information.
  • Step 204 The cloud device determines an alarm type corresponding to the first classification condition based on the corresponding relationship between the classification condition and the alarm type.
  • Step 205 The cloud device determines the alarm category corresponding to the first classification condition as the first alarm category of the first alarm log.
  • the cloud device analyzes at least one log content included in the first alarm log to obtain abnormal information corresponding to the first alarm log.
  • the abnormal information is matched with a plurality of classification conditions to obtain a first classification condition satisfied by the abnormal information, and an alarm type corresponding to the first classification condition is determined as the alarm type of the first alarm log. Since the exception information corresponding to the first alarm log is used to reflect the security level of the first alarm log, the alarm category corresponding to the first classification condition satisfied by the exception information is used as the first alarm category of the first alarm log, and the acquisition of The precision of the first alarm category of the first alarm log.
  • each step in the method 200 is described next in this embodiment of the present application in conjunction with the network architecture 100 shown in FIG. 1 .
  • the virtual detection environment runs in the alarm device.
  • the alarm device receives session information of the session sent by the first collection device and data content transmitted on the session.
  • the virtual detection environment running on the alarm device takes the session information and data content as a sample, that is, the sample includes the session information and data content, analyzes the sample to obtain a first alarm log, and outputs the first alarm log.
  • the cloud device and the alarm device are two different devices, the alarm device sends the first alarm log output by the virtual detection environment to the cloud device, and the cloud device receives the first alarm log.
  • the cloud device and the alarm device are integrated in the same device, the cloud device directly obtains the first alarm log output by the virtual detection environment.
  • the above-mentioned process of generating and outputting the first alarm log in the virtual detection environment includes steps 2011 to 2015 .
  • the first collection device receives the session, and acquires session information of the session and data content transmitted on the session.
  • the first collection device is any collection device located in the communication network.
  • the session usually includes at least one packet, each packet includes a packet header and a payload, the packet header and/or the payload includes session information of the session, and the payload includes part of the data content.
  • the essence of receiving the session by the first collection device is to receive the at least one packet, extract the session information of the session from the received packet, and obtain the payload of each packet from each received packet. , and restore the data content based on the payload of each packet.
  • the session information includes a first address and a first URL.
  • the first address is the address of the session, including the source address and/or the destination address of the session.
  • the first URL is the URL of the data content and is used to identify the network source of the data content.
  • the session information of the session further includes the port number of the session and/or the protocol type of the session.
  • the port number of the session includes the source port number and/or the destination port number of the session.
  • the first collection device is the collection device 1031 in the network architecture shown in FIG. 1 , and it is assumed that the first terminal needs to download files from the first server.
  • the first terminal sends a request message for acquiring the file.
  • the first collection device ie, the collection device 1031
  • receives the request message and sends the request message to the first server.
  • the server receives the request message, obtains the file based on the request message, and encapsulates the fragment of the file into multiple packets according to the Maximum Transmission Unit (MTU) value information negotiated with the client during the session establishment process.
  • MTU Maximum Transmission Unit
  • message 1, message 2, and message 3 message 1, message 2, and message 3 are sent.
  • the first collection device receives packet 1, packet 2, and packet 3 sent by the first server, and forwards the received packet 1, packet 2, and packet 3 to the first terminal, thereby implementing data forwarding.
  • MTU Maximum Transmission Unit
  • the first collection device acquires the session information of the session from the received messages.
  • the session information includes a first address and a first URL
  • the first address includes the source address "34.68.24.12" and/or the destination address "10.184.221.65" of the session
  • the first URL is the URL of the file, assuming the first URL For "http://www.baidu.com/aaaa/ssss/qq.exe", the first URL includes the domain name "www.baidu.com” and the path "aaaa/ssss/qq.exe”.
  • the session information further includes one or more of the source port number "5006", the destination port number "80” and the protocol type "file transfer protocol (FTP)" of the session.
  • the first collection device restores the file based on the payload of the message 1, the payload of the message 2, and the payload of the message 3, and the file is the data content transmitted on the session.
  • the file is an executable file
  • the type of the file includes Portable Executable (PE), Office, Portable Document Format (Portable Document Format, PDF) or ZIP and other types.
  • PE Portable Executable
  • Office is a type of office software
  • ZIP is a file format for data compression and document storage
  • files of types such as PE, Office, PDF, and ZIP are executable files.
  • the first collection device when forwarding the packets in the session, the first collection device performs security detection on the packets in the session to obtain an IPS alarm log, where the IPS alarm log includes the first address and other contents, and is sent to the cloud device Send the IPS alarm log.
  • the cloud device receives the IPS alarm log, and stores the device identification of the first collection device and the IPS alarm log in a corresponding relationship between the device identification and the IPS alarm log.
  • IPS alarm logs generated by different collection devices are stored.
  • the first collection device sends the session information of the session and the data content transmitted on the session to the alarm device.
  • the first collection device sends the session information of the session and the data content transmitted on the session to the alarm device that communicates with itself.
  • the first collection device takes the collection device 1031 in the network architecture shown in FIG. 1 as an example, and the first collection device sends the session information and the data content (the above-mentioned file) to the alarm device in communication with the first collection device.
  • the virtual detection environment running on the alarm device receives the session information and the data content, analyzes the session information and the data content, obtains a first alarm log, and outputs the first alarm log.
  • the virtual detection environment running on the alarm device is a sandbox
  • the first alarm log output by the virtual detection environment is a sandbox alarm log.
  • the virtual detection environment simulates an executable environment, and analyzes a sample based on the simulated executable environment to obtain a first alarm log, where the sample includes the session information and the session content.
  • the first alarm log includes at least one item of log content, and the at least one item of log content includes a first address, a first URL, a content name of the data content, a hash value of the data content, or a device identifier of the first collection device.
  • One or more of the first address includes the source address and/or the destination address of the session.
  • the first alarm log further includes the port number of the session, the protocol type of the session, the content type of the data content, the data volume of the data content, the virus family information of the data content, the second alarm category or the first alarm type.
  • the port number includes the source port number and/or the destination port number of the session.
  • the first domain name is the domain name included in the first URL. It should be noted that: the first URL includes a first domain name and a path, or the first URL includes an address and a path; only when the first URL includes the first domain name can the first alarm log include the first domain name.
  • the first collection device takes the collection device 1031 in the network architecture shown in FIG. 1 as an example.
  • the virtual detection environment running on the alarm device receives session information and data content, which is a file.
  • the virtual detection environment analyzes the session information and the data content to obtain a first alarm log, which includes the first address, the first URL, the content name of the data content, the hash value of the data content, or One or more of the device identifiers of the first collection device.
  • the first address is the source address "34.68.24.12" of the session
  • the first URL includes the domain name "www.baidu.com” and the path "aaaa/ssss/qq.exe”
  • the content name is the file of the file
  • the name is "qq.exe”
  • the hash value is the hash value of the file "93b609fc9c8517911328b3fde5d2907e”
  • the device identifier of the first collection device is the address "192.168.4.12" of the first collection device.
  • the first alarm log further includes the destination address "10.184.221.65", the source port number "5006", the destination port number "80", the protocol type "FTP" of the session, the content type of the data content, the One or more of the data volume of the data content, the virus family information of the data content, the second alarm category or the first domain name, etc.
  • the content type of the data content is the file type of the file, assuming the file type is "PE"; the data volume of the data content is the data volume in the file, assuming the data volume is "1138120kb", the virus of the data content
  • the family information is the virus family information included in the file, it is assumed that the virus family information is the type of the virus family "Globelmposte", the first domain name is the domain name "www.baidu.com” included in the first URL, and the second alarm is assumed Category is high risk. Referring to Table 7 below, the first alarm log includes one or more log contents in Table 7 below.
  • the cloud device directly acquires the first alarm log output by the virtual detection environment running on the cloud device.
  • the cloud device and the alarm device are two different devices, the following operations 2014-2015 are also continued.
  • the alarm device sends the first alarm log to the cloud device.
  • the alarm device sends the first alarm log shown in Table 7 to the cloud device.
  • the cloud device receives the first alarm log.
  • the cloud device receives the first alarm log shown in Table 7.
  • the cloud device saves the first alarm log.
  • the cloud device adds the domain name activity corresponding to the first domain name in the corresponding relationship between the domain name and the domain name activity.
  • alarm devices in the communication network also generate alarm logs, and send the generated alarm logs to the cloud device.
  • the cloud device receives and saves alarm logs sent by different alarm devices.
  • the exception information includes one or more items of information, and for each item of information in the exception information, the item of information is the cloud device's response to an item or item in the first alarm log. A number of log contents were analyzed.
  • At least one item of log content in the first alarm log includes one or more of a first address, a first URL, a content name of the data content, a hash value of the data content, or a device identifier of the first collection device.
  • the exception information includes one or more of the following information: address risk information of the first address, alarm times of the first address, and IPS alarm indication of the first address; wherein, The IPS alarm indication is used to indicate whether the first collection device generates an IPS alarm log including the first address.
  • the address risk information of the first address, the number of alarms of the first address, and the IPS alarm indication of the first address reflect the security of the first address from different dimensions.
  • the address risk information of the first address is used to reflect the risk intensity of the first address, so that the security level of the first address can be expressed. The greater the number of alarms of the first address, the lower the security of the first address, and the smaller the number of alarms of the first address, the higher the security of the first address, so the number of alarms of the first address can reflect the security of the first address. Sexuality.
  • the IPS alarm indication is used to instruct the first collection device to generate an IPS alarm log including the first address, indicating that the security of the first address is lower, and the IPS alarm indication is used to indicate that the first collection device does not generate an IPS alarm log including the first address. IPS alarm log, indicating that the security of the first address is higher.
  • the cloud device obtains the address risk information of the first address as follows:
  • the cloud device obtains address risk information of the first address based on the first address and the address intelligence database.
  • the cloud device searches the address intelligence database based on the first address. If the corresponding address risk information is found, the found address risk information is used as the address risk information of the first address; if the corresponding address risk information is not found, Stop acquiring the address risk information of the first address. In this case, the abnormal information does not include the address risk information of the first address.
  • the first address included in the first alarm log is "IP1". If the abnormal information includes the address risk information of "IP1”, the cloud device based on “IP1”, Look up the address intelligence database shown in Table 2, find out the corresponding address risk information as "Adware/AD.Qjwmonkey”, and use "Adware/AD.Qjwmonkey" as the address risk information of "IP1".
  • the cloud device obtains the alarm times of the first address as follows:
  • the cloud device selects a first alarm log set including the first address from multiple alarm logs acquired within a first predetermined time range, and collects statistics on the alarm logs in the first alarm log set to obtain a first number, where the first The number of alarms for the address is equal to the first number.
  • the time length of the first predetermined time range is the first designated time length, and the end time of the first predetermined time range is the current time.
  • the cloud device obtains alarm logs output by different virtual detection environments, and saves the obtained alarm logs each time, so that the cloud device determines the first predetermined time range based on the first specified duration and the current time, and selects from the saved alarm logs.
  • Alarm logs that have been acquired within the first predetermined time range.
  • the time length of each alarm log saved by the cloud device does not exceed the first specified time period, that is, the cloud device will delete the alarm logs that have been saved for longer than the first specified time period. Therefore, the alarm log saved in the cloud device is the first predetermined time period.
  • the alarm logs obtained within the scope the cloud device obtains the saved alarm logs, and obtains the alarm logs obtained within the first predetermined time range.
  • the first address included in the first alarm log is "IP1”
  • the cloud device selects from multiple alarm logs acquired within the first predetermined time range, including "IP1”.
  • the first number of alarm logs in the first alarm log set is counted to obtain the first number, assuming that the first number is 80, wherein the number of alarms of "IP1" is equal to 80.
  • the cloud device obtains the IPS alarm indication of the first address as follows:
  • the cloud device queries whether there is an IPS alarm log including the first address in the IPS alarm log generated by the first collection device, and obtains an IPS alarm indication of the first address based on the query result.
  • the first collection device communicates with the cloud device. Whenever the first collection device receives a session, it analyzes the session, obtains an IPS alarm log, and sends the IPS alarm log to the cloud device.
  • the cloud device receives the IPS alarm log, and stores the device identifier of the first collection device and the IPS alarm log in a corresponding relationship between the device identifier and the IPS alarm log.
  • the operation for the cloud device to obtain the IPS alarm indication of the first address is specifically: based on the device identifier of the first collection device, the cloud device acquires the IPS generated by the first collection device from the correspondence between the device identifier and the IPS alarm log.
  • Alarm log ; query whether there is an IPS alarm log including the first address in the IPS alarm log that has been generated by the first collection device, and if the result of the query is that there is an IPS alarm log including the first address, determine that the IPS alarm indication is used to indicate the first address.
  • a collection device generates an IPS alarm log including the first address. If the result of the query is that there is no IPS alarm log including the first address, it is determined that the IPS alarm indication is used to indicate that the first collection device does not generate an IPS alarm including the first address. log.
  • the exception information includes a content alarm type corresponding to the content name; wherein the content alarm type includes an advertiser alarm type, a virus alarm type, a downloader alarm type, or grayscale Software alarm type, etc.
  • the content alarm type is a dimension that reflects the security of the data content.
  • the content alarm type includes an advertiser alarm type, a virus alarm type, a downloader alarm type or a grayware alarm type, it indicates that the security of the data content is low. .
  • the operation for the cloud device to obtain the content alarm type corresponding to the content name is:
  • the cloud device acquires the content alarm type corresponding to the content name based on the corresponding relationship between the content name and the content alarm type and the content name.
  • the cloud device searches for the corresponding relationship between the content name and the content alarm type based on the content name. If the corresponding content alarm type is found, the searched content alarm type is used as the content alarm type corresponding to the content name; The corresponding content alarm type is displayed, and the acquisition of the content alarm type corresponding to the content name is stopped. In this case, the exception information does not include the content alarm type corresponding to the content name.
  • the first alarm log includes the content name "Filename1”
  • the cloud device searches for the correspondence between the content name and the content alarm type shown in Table 4 based on "Filename1" relationship, find out that the corresponding content alarm type is the virus alarm type, and use the virus alarm type as the content alarm type corresponding to "Filename1".
  • the exception information includes the number of collection devices that collect the data content. It should be noted that the first URL, the content name and the hash value of the data content are used to uniquely identify the data content.
  • the number of collection devices is also a dimension that reflects the security of the data content.
  • the operation for the cloud device to obtain the number of collection devices that collect the data content is as follows:
  • the cloud device selects a second alarm log set including the first URL, the hash value of the data content and the content name from a plurality of alarm logs acquired within the second predetermined time range; for each alarm in the second alarm log set The different device identifiers included in the log are counted to obtain the second number, and the number of the collection devices in the abnormal information corresponding to the first alarm log is the second number.
  • the time length of the second predetermined time range is the second designated time length, and the end time of the second predetermined time range is the current time.
  • the cloud device determines the second predetermined time range based on the second specified duration and the current time.
  • the at least one item of log content includes a first URL
  • the first URL includes a first path
  • the exception information includes one or more of the following information: the number of alarms of the first path or the path type of the first path.
  • the path type of the first path includes an advertisement download path, a virus download path, a downloader download path, or a grayware download path, and the like.
  • the number of alarms of the first path and the path type of the first path reflect the security of the first path from different dimensions.
  • Security level When the path type includes an advertisement download path, a virus download path, a downloader download path or a grayware download path, it indicates that the security of the first path is low.
  • the cloud device obtains the alarm times of the first path as follows:
  • the cloud device selects a third alarm log set including the first path from the alarm logs acquired within the third predetermined time range, and collects statistics on the alarm logs included in the third alarm log set to obtain a third number, where the number of alarm logs of the first path is The number of alarms is equal to the third number.
  • the time length of the third predetermined time range is the third designated time length, and the end time of the third predetermined time range is the current time.
  • the cloud device determines a third predetermined time range based on the third specified duration and the current time.
  • the cloud device obtains the path type of the first path as follows:
  • the cloud device acquires the path type of the first path based on the corresponding relationship between the path and the path type and the first path.
  • the cloud device searches for the correspondence between the path and the path type based on the first path. If the corresponding path type is found, the searched path type is used as the path type of the first path; if the corresponding path type is not found, Stop acquiring the path type of the first path. In this case, the exception information does not include the content alarm type of the first path.
  • the first URL in the first alarm log includes the first domain name "Domain1" and the first path "Path1", and the cloud device is based on "Path1".
  • the first URL further includes the first domain name
  • the abnormality information further includes one or more of the following information: domain name risk information of the first domain name, alarm times of the first domain name, or domain name activity of the first domain name.
  • the number of alarms of the first domain name, the domain name risk information of the first path, and the domain name activity of the first domain name reflect the security of the first domain name from different dimensions.
  • the domain name risk information of the first domain name is used to reflect the risk intensity of the first domain name, so that the security level of the first domain name can be expressed.
  • the cloud device obtains the domain name risk information of the first domain name as follows:
  • the cloud device obtains the domain name risk information of the first domain name based on the first domain name and the domain name intelligence database.
  • the cloud device searches the domain name intelligence database based on the first domain name. If the corresponding domain name risk information is found, the searched domain name risk information is used as the domain name risk information of the first domain name; if the corresponding domain name risk information is not found, the Stop acquiring the domain name risk information of the first domain name. In this case, the abnormal information does not include the domain name risk information of the first domain name.
  • the first URL in the first alarm log includes the first domain name "Domain1”
  • the cloud device searches the domain name intelligence database shown in Table 3 based on "Domain1” , and find out the corresponding domain name risk information.
  • the domain name risk information is the virus family information "Globelmposte”
  • the virus family information "Globelmposte” is used as the domain name risk information of "Domain1".
  • the operation of the cloud device to obtain the alarm times of the first domain name is as follows:
  • the cloud device selects a fourth alarm log set including the first domain name from the alarm logs that have been acquired within the fourth predetermined time range, and collects statistics on the alarm logs included in the fourth alarm log set to obtain a fourth number.
  • the number of alarms is equal to the fourth number.
  • the time length of the fourth predetermined time range is the fourth designated time length, and the end time of the fourth predetermined time range is the current time.
  • the cloud device determines a fourth predetermined time range based on the fourth specified duration and the current time.
  • the cloud device obtains the domain name activity of the first domain name as follows:
  • the cloud device Based on the first domain name, the cloud device obtains the domain name activity of the first domain name from the corresponding relationship between the domain name and the domain name activity.
  • the first URL in the first alarm log includes the first domain name "Domain1”, and the cloud device is based on "Domain1", from the domain name and domain name shown in Table 7
  • the activity degree of the domain name corresponding to "Domain1” is obtained from the corresponding relationship of activity degree, and the activity degree of this domain name is 105.
  • the cloud device includes a correspondence between classification conditions and alarm categories, the correspondence includes a plurality of classification conditions, and each classification condition includes at least one item and sub-condition.
  • the cloud device obtains a classification condition from the correspondence between the classification condition and the alarm category, and the classification condition includes at least one sub-condition.
  • the classification condition includes at least one sub-condition.
  • information corresponding to each sub-condition is selected from the information included in the exception information.
  • Match the information corresponding to each sub-condition with each sub-condition respectively if the information corresponding to each sub-condition matches each sub-condition respectively, determine that the abnormal information satisfies the classification condition, and use the classification condition as the exception
  • the first classification condition that the information satisfies. If the information corresponding to the sub-condition does not match the sub-condition, it is determined that the abnormal information does not meet the classification condition, other classification conditions are obtained from the correspondence between the classification conditions and alarm categories, and the other classification conditions are combined with the Exception information to match.
  • a preset operation is performed on the first alarm log.
  • the preset operation is an operation of prompting the technician, and the cloud device matches the abnormal information that does not satisfy each classification condition, and prompts the technician, so that the technician can analyze the alarm category of the first alarm log.
  • the multiple classification conditions include one or more of classification conditions corresponding to advertiser alarms, classification conditions corresponding to downloader alarms, classification conditions corresponding to malicious virus alarms, or classification conditions corresponding to grayware alarms.
  • the classification condition corresponding to the advertiser alarm includes at least one of the following sub-conditions: the address risk information of the first address is the address risk information of the advertisement type, the domain name risk information of the first domain name is the domain name risk information of the advertisement type, the path of the first path The type is an advertisement download path, the domain activity of the first domain name exceeds the first threshold, the number of collection devices collecting the data content exceeds the second threshold, or the content alarm type corresponding to the content name is an advertiser alarm type.
  • the cloud device acquires the classification condition corresponding to the alarm of the advertiser from the correspondence between the classification condition and the alarm type. For each sub-condition included in the classification condition, information corresponding to each sub-condition is selected from the information included in the exception information. If the information corresponding to each sub-condition matches each sub-condition respectively, the classification condition corresponding to the advertiser alarm is taken as the first classification condition satisfied by the abnormal information.
  • the classification conditions corresponding to the advertiser alarm include sub-condition 11, sub-condition 12, and sub-condition 13.
  • Sub-condition 11, sub-condition 12, and sub-condition 13 are respectively the address risk information of the first address and the address risk information of the advertisement type.
  • the domain name risk information of the first domain name is domain name risk information of an advertisement type
  • the path type of the first path is an advertisement download path.
  • the cloud device selects from the abnormal information that the information corresponding to sub-condition 11 is the address risk information of the first address, the information corresponding to sub-condition 12 is the domain name risk information of the first domain name, and the information corresponding to sub-condition 13 is the route of the first path type.
  • the address risk information of the first address, the domain name risk information of the first domain name, and the routing type of the first path are matched with sub-condition 11, sub-condition 12, and sub-condition 13 respectively.
  • the address risk information of the first address is the address risk information of the advertisement type
  • the domain name risk information of the first domain name is the domain name risk information of the advertisement type
  • the path type of the first path is the advertisement download path
  • the cloud device includes a first address risk information set and/or a first domain name risk information set, the first address risk information set includes each address risk information belonging to an advertisement type, and the first domain name risk information set includes each domain name risk information belonging to an advertisement type .
  • the first address risk information set includes the address risk information of the first address. If the address risk information of the first address is included, it is determined that the address risk information of the first address is advertisement type address risk information. If the address risk information of the first address is not included, it is determined that the address risk information of the first address is not the advertisement type address risk information. and / or,
  • the domain name risk information of the first domain name included in the abnormal information query whether the first domain name risk information set includes the domain name risk information of the first domain name. If the domain name risk information of the first domain name is included, it is determined that the domain name risk information of the first domain name is advertisement type domain name risk information. If the domain name risk information of the first domain name is not included, it is determined that the domain name risk information of the first domain name is not advertisement type domain name risk information.
  • the first address risk information set includes a first address risk value range.
  • the cloud device queries whether the first address risk value range includes the address risk value of the first address. If the address risk value of the first address is included, it is determined that the address risk value of the first address is the address risk information of the advertisement type. If the address risk value of the first address is not included, it is determined that the address risk value of the first address is not advertisement type address risk information. and / or,
  • the first domain name risk information set includes a first domain name risk value range.
  • the cloud device queries whether the first domain name risk value range includes the domain name risk value of the first domain name. If the domain name risk value of the first domain name is included, it is determined that the domain name risk value of the first domain name is the domain name risk information of the advertisement type. If the domain name risk value of the first domain name is not included, it is determined that the domain name risk value of the first domain name is not the domain name risk information of the advertisement type.
  • the classification condition corresponding to the downloader alarm includes at least one of the following sub-conditions: the address risk information of the first address is the address risk information of the downloader type, and the domain name risk information of the first domain name is the domain name risk information of the downloader type.
  • the path type of the first path in the first URL is the downloader download path
  • the domain name activity of the first domain name exceeds the third threshold
  • the number of collection devices that collect the data content exceeds the fourth threshold
  • the alert type is the downloader alert type.
  • the cloud device acquires the classification condition corresponding to the alarm of the downloader from the correspondence between the classification condition and the alarm type. For each sub-condition included in the classification condition, information corresponding to each sub-condition is selected from the information included in the exception information. If the information corresponding to each sub-condition matches each sub-condition respectively, the classification condition corresponding to the alarm of the downloader is used as the first classification condition satisfied by the abnormal information.
  • the classification conditions corresponding to the downloader alarm include sub-condition 21, sub-condition 22, and sub-condition 23.
  • Sub-condition 21, sub-condition 22, and sub-condition 23 are the address risk information of the first address, respectively, which is the address risk information of the downloader type.
  • the domain name risk information of the first domain name is the domain name risk information of the downloader type
  • the path type of the first path is the downloader download path.
  • the cloud device selects from the abnormal information that the information corresponding to sub-condition 21 is the address risk information of the first address, the information corresponding to sub-condition 22 is the domain name risk information of the first domain name, and the information corresponding to sub-condition 23 is the route of the first path type.
  • the address risk information of the first address, the domain name risk information of the first domain name, and the routing type of the first path are matched with sub-condition 21, sub-condition 22, and sub-condition 23, respectively.
  • the address risk information of the first address is the address risk information of the downloader type
  • the domain name risk information of the first domain name is the domain name risk information of the downloader type
  • the path type of the first path is the downloader download path
  • the cloud device includes a second address risk information set and/or a second domain name risk information set, the second address risk information set includes each address risk information belonging to the downloader type, and the second domain name risk information set includes each domain name belonging to the downloader type Risk Information.
  • the second address risk information set includes the address risk information of the first address. If the address risk information of the first address is included, it is determined that the address risk information of the first address is the address risk information of the downloader type. If the address risk information of the first address is not included, it is determined that the address risk information of the first address is not the address risk information of the downloader type. and / or,
  • the second domain name risk information set includes the domain name risk information of the first domain name. If the domain name risk information of the first domain name is included, it is determined that the domain name risk information of the first domain name is the domain name risk information of the downloader type. If the domain name risk information of the first domain name is not included, it is determined that the domain name risk information of the first domain name is not the domain name risk information of the downloader type.
  • the second address risk information set includes a second address risk value range.
  • the cloud device queries whether the second address risk value range includes the address risk value of the first address. If the address risk value of the first address is included, it is determined that the address risk value of the first address is the address risk information of the downloader type. If the address risk value of the first address is not included, it is determined that the address risk value of the first address is not the address risk information of the downloader type. and / or,
  • the second domain name risk information set includes a second domain name risk value range.
  • the cloud device queries whether the second domain name risk value range includes the domain name risk value of the first domain name. If the domain name risk value of the first domain name is included, it is determined that the domain name risk value of the first domain name is the domain name risk information of the downloader type. If the domain name risk value of the first domain name is not included, it is determined that the domain name risk value of the first domain name is not the domain name risk information of the downloader type.
  • the classification condition corresponding to the malicious virus alarm includes at least one of the following sub-conditions: the address risk information of the first address is address risk information of a virus type, and the domain name risk information of the first domain name in the first URL is a virus type Domain name risk information, the IPS alarm indication of the first address is used to instruct the first collection device to generate an IPS alarm log including the first address, the domain name activity of the first domain name exceeds the fifth threshold, or the content alarm type corresponding to the content name is Virus alert type.
  • Malicious viruses include hacking tools, mining viruses and/or ransomware, etc.
  • the cloud device obtains the classification condition corresponding to the malicious virus alarm from the correspondence between the classification condition and the alarm category. For each sub-condition included in the classification condition, information corresponding to each sub-condition is selected from the information included in the exception information. If the information corresponding to each sub-condition matches each sub-condition respectively, the classification condition corresponding to the malicious virus alarm is taken as the first classification condition satisfied by the abnormal information.
  • the classification conditions corresponding to the malicious virus alarm include sub-condition 31, sub-condition 32, and sub-condition 33.
  • Sub-condition 31, sub-condition 32, and sub-condition 33 are respectively the address risk information of the first address and the address risk information of the virus type.
  • the domain name risk information of the first domain name is virus type domain name risk information, and the domain name activity of the first domain name exceeds the fifth threshold.
  • the cloud device selects from the abnormal information that the information corresponding to sub-condition 31 is the address risk information of the first address, the information corresponding to sub-condition 32 is the domain name risk information of the first domain name, and the information corresponding to sub-condition 33 is the domain name of the first domain name Activity.
  • the address risk information of the first address, the domain name risk information of the first domain name, and the domain name activity of the first domain name are respectively matched with sub-condition 31, sub-condition 32, and sub-condition 33.
  • the address risk information of the first address is virus-type address risk information
  • the domain name risk information of the first domain name is virus-type domain name risk information
  • the domain name activity of the first domain name exceeds the fifth threshold
  • the cloud device includes a third address risk information set and/or a third domain name risk information set, the third address risk information set includes each address risk information belonging to the virus type, and the third domain name risk information set includes each domain name risk information belonging to the virus type .
  • the third address risk information set includes the address risk information of the first address. If the address risk information of the first address is included, it is determined that the address risk information of the first address is virus type address risk information. If the address risk information of the first address is not included, it is determined that the address risk information of the first address is not virus type address risk information. and / or,
  • the third domain name risk information set includes the domain name risk information of the first domain name. If the domain name risk information of the first domain name is included, it is determined that the domain name risk information of the first domain name is virus type domain name risk information. If the domain name risk information of the first domain name is not included, it is determined that the domain name risk information of the first domain name is not virus type domain name risk information.
  • the third address risk information set includes a third address risk value range.
  • the cloud device queries whether the third address risk value range includes the address risk value of the first address. If the address risk value of the first address is included, it is determined that the address risk value of the first address is virus-type address risk information. If the address risk value of the first address is not included, it is determined that the address risk value of the first address is not virus-type address risk information. and / or,
  • the third domain name risk information set includes a third domain name risk value range.
  • the cloud device queries whether the third domain name risk value range includes the domain name risk value of the first domain name. If the domain name risk value of the first domain name is included, it is determined that the domain name risk value of the first domain name is the domain name risk information of the virus type. If the domain name risk value of the first domain name is not included, it is determined that the domain name risk value of the first domain name is not virus-type domain name risk information.
  • the classification condition corresponding to the grayware alarm includes at least one of the following sub-conditions: the address risk information of the first address is the address risk information of the grayware type, and the domain name risk information of the first domain name is the domain name risk information of the grayware type. , the alarm times of the first address exceeds the sixth threshold, the alarm times of the first domain name exceeds the seventh threshold, the alarm times of the first path exceeds the eighth threshold, or the content alarm type corresponding to the content name is a grayware alarm type.
  • the cloud device obtains the classification condition corresponding to the grayware alarm from the correspondence between the classification condition and the alarm type. For each sub-condition included in the classification condition, information corresponding to each sub-condition is selected from the information included in the exception information. If the information corresponding to each sub-condition respectively matches each sub-condition, the classification condition corresponding to the grayware alarm is taken as the first classification condition satisfied by the abnormal information.
  • the classification condition corresponding to the grayware alarm includes sub-condition 41, sub-condition 42, and sub-condition 43.
  • Sub-condition 41, sub-condition 42, and sub-condition 43 are respectively the address risk information of the first address and the address risk information of the virus type.
  • the domain name risk information of the first domain name is virus-type domain name risk information, and the number of alarms of the first domain name exceeds the seventh threshold.
  • the cloud device selects the information corresponding to sub-condition 41 from the abnormal information to be the address risk information of the first address, the information corresponding to sub-condition 42 is the domain name risk information of the first domain name, and the information corresponding to sub-condition 43 is the alarm of the first domain name frequency.
  • the address risk information of the first address, the domain name risk information of the first domain name, and the alarm times of the first domain name are respectively matched with the sub-condition 41 , the sub-condition 42 , and the sub-condition 43 .
  • the address risk information of the first address is the address risk information of the grayware type
  • the domain name risk information of the first domain name is the domain name risk information of the grayware type
  • the number of alarms of the first domain name exceeds the seventh threshold
  • the cloud device includes a fourth address risk information set and/or a fourth domain name risk information set, the fourth address risk information set includes each address risk information belonging to the grayware type, and the fourth domain name risk information set includes each domain name belonging to the grayware type Risk Information.
  • the fourth address risk information set includes the address risk information of the first address. If the address risk information of the first address is included, it is determined that the address risk information of the first address is grayware type address risk information. If the address risk information of the first address is not included, it is determined that the address risk information of the first address is not grayware type address risk information. and / or,
  • the fourth domain name risk information set includes the domain name risk information of the first domain name. If the domain name risk information of the first domain name is included, it is determined that the domain name risk information of the first domain name is grayware type domain name risk information. If the domain name risk information of the first domain name is not included, it is determined that the domain name risk information of the first domain name is not the domain name risk information of the grayware type.
  • the fourth address risk information set includes a fourth address risk value range.
  • the cloud device queries whether the fourth address risk value range includes the address risk value of the first address. If the address risk value of the first address is included, it is determined that the address risk value of the first address is grayware type address risk information. If the address risk value of the first address is not included, it is determined that the address risk value of the first address is not grayware type address risk information. and / or,
  • the fourth domain name risk information set includes a fourth domain name risk value range.
  • the cloud device queries whether the fourth domain name risk value range includes the domain name risk value of the first domain name. If the domain name risk value of the first domain name is included, it is determined that the domain name risk value of the first domain name is grayware type domain name risk information. If the domain name risk value of the first domain name is not included, it is determined that the domain name risk value of the first domain name is not grayware type domain name risk information.
  • the cloud device After obtaining the first alarm category of the first alarm log, the cloud device obtains the session information of the session corresponding to the first alarm log, and sends the session information and the first alarm to the first collection device category, and/or, the session information and the first alarm category are displayed to the administrator of the first collection device.
  • the first collection device After receiving the session information and the first alarm type, the first collection device intercepts the session based on the first alarm type when receiving the session corresponding to the session information again.
  • the first alarm log includes the session information
  • the cloud device obtains the session information from the first alarm log.
  • the cloud device analyzes at least one item of log content included in the first alarm log to obtain abnormality information corresponding to the first alarm log, where the abnormality information includes at least one item of information.
  • each item of the exception information is obtained by the cloud device based on analysis of one or more log contents, and each item of the exception information reflects the security level of the log contents in the first alarm log in different dimensions. Therefore, the abnormal information is matched with a plurality of classification conditions to obtain the first classification condition satisfied by the abnormal information, and the alarm category corresponding to the first classification condition is determined as the first alarm category of the first alarm log, thereby increasing the number of obtaining the first classification condition. The precision of the first alarm category of an alarm log.
  • the cloud device can automatically analyze at least one log content of the first alarm log, the first alarm category of the first alarm log can be quickly acquired, and the efficiency of acquiring the first alarm category is improved.
  • the alarm log is obtained by performing alarm analysis on the session information of the session and the data content transmitted in the session in the virtual detection environment.
  • the cloud device performs a secondary alarm analysis on the alarm log to analyze the advertiser category, downloader category, and malicious virus category.
  • the alarm log of the grayware category that is, the high-value alarms are analyzed, which is convenient for prompting the administrator or the collection device.
  • an embodiment of the present application provides an apparatus 400 for processing an alarm log.
  • the apparatus 400 is deployed on a cloud device provided in any of the foregoing embodiments, for example, a cloud device 101 deployed in the network architecture 100 shown in FIG. 1 .
  • the cloud device in the method 200 shown in FIG. 2 including:
  • the acquiring unit 401 is configured to acquire a first alarm log output by the virtual detection environment, where the first alarm log is obtained by the virtual detection environment by analyzing the session information sent by the first collection device and the data content transmitted in the session described by the session information , the first alarm log includes at least one log content;
  • a processing unit 402 configured to analyze the at least one item of log content to obtain abnormal information corresponding to the first alarm log;
  • a matching unit 403 configured to match the abnormal information with a plurality of classification conditions to obtain a first classification condition from the plurality of classification conditions, where the first classification condition is a classification condition satisfied by the abnormal information;
  • the determining unit 404 is configured to determine an alarm type corresponding to the first classification condition based on the correspondence between the classification condition and the alarm type; and determine the alarm type corresponding to the first classification condition as the alarm type of the first alarm log.
  • the at least one item of log content includes one of a first address, a first Uniform Resource Locator URL, a content name of the data content, a hash value of the data content, or a device identifier of the first collection device or
  • the first address includes the source address and/or the destination address of the session, and the first URL is used to identify the network source of the data content.
  • the exception information includes one or more of the following information: address risk information of the first address, alarm times of the first address, and intrusion prevention system of the first address.
  • IPS alarm indication wherein, the IPS alarm indication is used to indicate whether the first collection device generates an IPS alarm log including the first address.
  • step 202 for a detailed description of the at least one log content, refer to the relevant content in step 202 in the above-mentioned embodiment shown in FIG. 2 , which will not be described in detail here.
  • processing unit 402 is configured to:
  • the abnormal information includes the address risk information
  • the abnormal information includes the number of alarms of the first address
  • the abnormal information includes the IPS alarm indication
  • the exception information includes the number of collection devices that collect the data content.
  • processing unit 402 is configured to:
  • the different device identifiers included in each alarm log in the second alarm log set are counted to obtain a second number, and the number of collection devices in the abnormal information corresponding to the first alarm log is the second number.
  • the at least one item of log content includes a first URL
  • the first URL includes a first path
  • the exception information includes one or more of the following information: the number of alarms of the first path or the path type of the first path.
  • the path type includes an advertisement download path, a virus download path, a downloader download path, or a grayware download path.
  • the processing unit 402 is configured to, if the abnormal information includes the alarm times of the first path, select a third alarm log set including the first path from the alarm logs that have been acquired within the third predetermined time range, and select a third alarm log set including the first path.
  • the alarm logs in the alarm log set are counted to obtain a third number, where the number of alarms of the first path is equal to the third number.
  • the processing unit 402 is configured to, if the exception information includes the path type, obtain the path type from the corresponding relationship between the path and the path type based on the first path.
  • the first URL further includes the first domain name
  • the abnormality information further includes one or more of the following information: domain name risk information of the first domain name, alarm times of the first domain name, or domain name activity of the first domain name.
  • the processing unit 402 is configured to, if the abnormal information includes domain name risk information, obtain domain name risk information from a domain name intelligence database based on the first domain name, and the domain name intelligence database includes the corresponding relationship between the first domain name and the domain name risk information. .
  • the processing unit 402 is configured to, if the abnormal information includes the number of alarms of the first domain name, the cloud device selects a fourth alarm log set including the first domain name from the first alarm logs acquired within a fourth predetermined time range , a fourth number is obtained by performing statistics on the alarm logs included in the fourth alarm log set, wherein the number of alarms of the first domain name is equal to the fourth number.
  • the processing unit 402 is configured to, if the abnormal information includes the activity of the domain name, obtain the activity of the domain name from the corresponding relationship between the domain name and the activity of the domain name based on the first domain name.
  • the alarm category of the first alarm log includes an advertiser alarm, a downloader alarm, a malicious virus alarm or a grayware alarm.
  • step 203 for a detailed description of the alarm category of the first alarm log, refer to the relevant content in step 203 in the embodiment shown in FIG. 2 , which will not be described in detail here.
  • the classification conditions corresponding to the advertiser alarm include at least one of the following: the address risk information of the first address is the address risk information of the advertisement type, and the domain name risk information of the first domain name in the first URL is the domain name risk information of the advertisement type.
  • the path type of the first path in the first URL is an advertisement download path, the domain activity of the first domain name exceeds the first threshold, the number of collection devices collecting the data content exceeds the second threshold, or the content corresponding to the content name
  • the alert type is the advertiser alert type.
  • the classification conditions corresponding to the downloader alarm include at least one of the following: the address risk information of the first address is the address risk information of the downloader type, and the domain name risk information of the first domain name in the first URL is the downloader type. Domain name risk information, the path type of the first path in the first URL is the downloader download path, the domain activity of the first domain name exceeds the third threshold, the number of collection devices that collect the data content exceeds the fourth threshold, or the content name The corresponding content alarm type is the downloader alarm type.
  • the classification conditions corresponding to the malicious virus alarm include at least one of the following: the address risk information of the first address is the address risk information of a virus type, and the domain name risk information of the first domain name in the first URL is the domain name risk information of a virus type.
  • the IPS alarm indication of the first address is used to instruct the first collection device to generate an IPS alarm log including the first address, the domain activity of the first domain name exceeds the fifth threshold, or the content alarm type corresponding to the content name is a virus alarm type.
  • the classification conditions corresponding to the grayware alarm include at least one of the following: the address risk information of the first address is address risk information of a grayware type, and the domain name risk information of the first domain name in the first URL is of a grayware type. Domain name risk information, the number of alarms for the first address exceeds the sixth threshold, the number of alarms for the first domain name exceeds the seventh threshold, the number of alarms for the first path in the first URL exceeds the eighth threshold, or the content alarm corresponding to the content name Type is a grayware alert type.
  • the above-mentioned virtual detection environment includes a sandbox and the like.
  • the above-mentioned first collection device includes a firewall, a probe, or the like.
  • the processing unit analyzes at least one item of log content included in the first alarm log to obtain abnormal information corresponding to the first alarm log.
  • the matching unit matches the abnormal information with a plurality of classification conditions to obtain a first classification condition satisfied by the abnormal information, and the determining unit determines the alarm category corresponding to the first classification condition as the alarm category of the first alarm log. Since the exception information corresponding to the first alarm log is used to reflect the security level of the first alarm log, the determining unit takes the alarm category corresponding to the first classification condition satisfied by the exception information as the first alarm category of the first alarm log, and adds In order to obtain the accuracy of the first alarm category of the first alarm log.
  • an embodiment of the present application provides an apparatus 500 for processing an alarm log.
  • the apparatus 500 may be a cloud device provided in any of the foregoing embodiments, for example, the cloud device 101 in the network architecture 100 shown in FIG. 1 or The cloud device in the method 200 shown in FIG. 2 includes:
  • the apparatus 500 is an apparatus with a hardware structure, and can be used to implement the functional modules in the apparatus 400 described in FIG. 4 .
  • the acquiring unit 401, the processing unit 402, the matching unit 403 and the determining unit 4047 in the apparatus 400 shown in FIG. 4 can read the program code from the memory 502 through the at least one processor 501, This is accomplished by running program code in the operating system.
  • the apparatus 500 further includes a network interface 504 , and the network interface 504 is connected to the processor 501 and the memory 502 through an internal connection 503 .
  • the network interface 504 is capable of communicating with the alarm device 102 and/or the collection device 103 in the network architecture 100 shown in FIG. 1 .
  • the processor 501 can obtain the first alarm log from the virtual detection environment in which the alarm device 102 runs through the network interface 504 , and/or obtain the IPS alarm log from the collection device 103 .
  • the apparatus 500 further includes an input device 505 , and the input device 505 is connected to the internal connection 503 .
  • the processor 501 can receive input commands or data, etc. through the input device 505 .
  • the apparatus 500 further includes a display device 506, and the display device 506 can be configured to display an intermediate result and/or a final result, etc. generated by the processor 501 executing the above method for processing an alarm log.
  • the processor 501 may be a general-purpose central processing unit (CPU), a network processor (NP), a microprocessor, or an application-specific integrated circuit (ASIC) , or one or more integrated circuits used to control the execution of the program of this application.
  • CPU general-purpose central processing unit
  • NP network processor
  • ASIC application-specific integrated circuit
  • the aforementioned internal connection 504 includes a path for transferring information between the aforementioned components.
  • the internal connection 504 may be a single board or a bus or the like.
  • the above-mentioned memory 502 may be read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (random access memory, RAM) or other types of storage devices that can store information and instructions.
  • ROM read-only memory
  • RAM random access memory
  • dynamic storage devices which may also be electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM), or other optical disk storage, optical disks storage (including compact discs, laser discs, compact discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or capable of carrying or storing desired program code in the form of instructions or data structures and capable of being accessed by Any other medium accessed by the computer, but not limited to this.
  • the memory may exist independently and be connected to the processor through a bus. Memory may also be integrated with the processor.
  • the processor 501 may include one or more CPUs, such as CPU0 and CPU1 in FIG. 5 .
  • the apparatus 500 may include multiple processors, such as the processor 501 and the processor 507 in FIG. 5 .
  • processors may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor.
  • a processor herein may refer to one or more devices, circuits, and/or processing cores for processing data (eg, computer program instructions).
  • the method for processing an alarm log may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • software it can be implemented in whole or in part in the form of a computer program product, for example, the computer product is a software for processing alarm logs, which is installed in the cloud device 101 shown in FIG. 1 .
  • the computer program product includes one or more computer instructions.
  • the computer may be a general purpose computer, special purpose computer, computer network, or other programmable device.
  • the computer instructions may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a magnetic disk or an optical disk, and the like.
  • the computer instructions may be transmitted or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instructions may be transmitted over wire (eg, coaxial cable, optical fiber, Digital Subscriber Line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) means to transmit to another website site, computer, server or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that includes an integration of one or more available media.
  • the usable media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, DVDs), or semiconductor media (eg, solid state disks (SSDs)), and the like.
  • an embodiment of the present application provides a collection device 600 .
  • the collection device 600 may be the collection device provided in any of the foregoing embodiments, for example, the collection device 103 in the network architecture 100 shown in FIG. 1 or the collection device 100 shown in FIG. 2
  • the first acquisition device in the shown method 200 includes:
  • the acquisition device 600 is a device with a hardware structure, the at least one processor 601 reads the operating system from the memory 602 and runs the operating system, the forwarding chip 604 reads the program code from the memory, and runs the operating system on the operating system.
  • the program code implements at least one function, for example, the forwarding chip 604 receives the message included in the session through the network port 606 , stores the message in the content addressable memory 605 , and forwards the message through the network port 606 .
  • the processor 601 After receiving the message included in the session, the processor 601 acquires the session information of the session and the data content transmitted on the session from the message included in the session stored in the content addressable memory 605, and sends the message to the session via the network port 606.
  • the alarm device sends the session information of the session and the data content.
  • processor 601 may be a general-purpose central processing unit (central processing unit, CPU), network processor (network processor, NP), microprocessor, application-specific integrated circuit (application-specific integrated circuit, ASIC) , or one or more integrated circuits used to control the execution of the program of this application.
  • CPU central processing unit
  • NP network processor
  • ASIC application-specific integrated circuit
  • the aforementioned internal connection 603 includes a path for transferring information between the aforementioned components.
  • the internal connection 603 may be a single board or a bus or the like.
  • the above-mentioned memory 602 may be read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (random access memory, RAM) or other types of storage devices that can store information and instructions.
  • ROM read-only memory
  • RAM random access memory
  • dynamic storage devices which may also be electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM), or other optical disk storage, optical disks storage (including compact discs, laser discs, compact discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or capable of carrying or storing desired program code in the form of instructions or data structures and capable of being accessed by Any other medium accessed by the computer, but not limited to this.
  • the memory may exist independently and be connected to the processor through a bus. Memory may also be integrated with the processor.
  • the process of acquiring session information and data content may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • software it can be implemented in whole or in part in the form of a computer program product, for example, the computer product is a software for acquiring session information and data content, which is installed in the acquisition device 103 shown in FIG. 1 .
  • the computer program product includes one or more computer instructions.
  • the computer may be a general purpose computer, special purpose computer, computer network, or other programmable device.
  • the computer instructions may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a magnetic disk or an optical disk, and the like.
  • the computer instructions may be transmitted or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instructions may be transmitted over wire (eg, coaxial cable, optical fiber, Digital Subscriber Line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) means to transmit to another website site, computer, server or data center.
  • the computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, a data center, or the like that includes an integration of one or more available media.
  • the usable media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, DVDs), or semiconductor media (eg, solid state disks (SSDs)), and the like.
  • an embodiment of the present application provides an alarm device 700 , and the alarm device 700 may be the alarm device provided in any of the foregoing embodiments, for example, the alarm device 102 in the network architecture 100 shown in FIG. 1 or the alarm device 102 in FIG. 2
  • the alarm device in the shown method 200 includes:
  • the processor 701, the memory 702 and the internal connection 703, the processor 701 and the memory 702 are connected through the internal connection 703, the memory 702 stores the operating system and the program code, the at least one processor 701 reads the operating system from the memory 702 and runs The operating system and the program code are used to implement a virtual detection environment.
  • the alarm device 700 is a device with a hardware structure, the at least one processor 701 reads program codes from the memory 702, runs the virtual detection environment by running the program codes in the operating system, and uses the virtual detection environment to monitor the session. The session information and the data content transmitted on the session are analyzed to generate a first alarm log.
  • the alarm device 700 further includes a network interface 704 , and the network interface 704 is connected to the processor 701 and the memory 702 through an internal connection 703 .
  • the network interface 704 can communicate with the cloud device 101 and/or the collection device 103 in the network architecture 100 shown in FIG. 1 .
  • the processor 701 receives the session information of the session and the data content transmitted on the session from the collection device 103 through the network interface 704 , and/or sends the first alarm log to the cloud device 101 .
  • the alarm device 700 further includes an input device 705 , and the input device 705 is connected to the internal connection 703 .
  • the processor 701 can receive input commands or data, etc. through the input device 705 .
  • the alarm device 700 further includes a display device 706, and the display device 706 can be configured to display an intermediate result and/or a final result of the process of generating the first alarm log performed by the processor 701, and the like.
  • the processor 701 may be a general-purpose central processing unit (CPU), a network processor (NP), a microprocessor, or an application-specific integrated circuit (ASIC) , or one or more integrated circuits used to control the execution of the program of this application.
  • CPU general-purpose central processing unit
  • NP network processor
  • ASIC application-specific integrated circuit
  • the aforementioned internal connection 704 includes a path for transferring information between the aforementioned components.
  • the internal connection 704 may be a single board or a bus or the like.
  • the above-mentioned memory 702 may be read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (random access memory, RAM) or other types of static storage devices that can store information and instructions.
  • ROM read-only memory
  • RAM random access memory
  • dynamic storage devices which may also be electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM), or other optical disk storage, optical disks storage (including compact discs, laser discs, compact discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or capable of carrying or storing desired program code in the form of instructions or data structures and capable of being accessed by Any other medium accessed by the computer, but not limited to this.
  • the memory may exist independently and be connected to the processor through a bus. Memory may also be integrated with the processor.
  • the processor 701 may include one or more CPUs, such as CPU0 and CPU1 in FIG. 7 .
  • the alarm device 700 may include multiple processors, such as the processor 701 and the processor 707 in FIG. 7 .
  • processors may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor.
  • a processor herein may refer to one or more devices, circuits, and/or processing cores for processing data (eg, computer program instructions).
  • the process of generating the first alarm log may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • software it can be implemented in whole or in part in the form of a computer program product, for example, the computer product is a software for generating a first alarm log, which is installed in the alarm device 102 shown in FIG. 1 .
  • the computer program product includes one or more computer instructions.
  • the computer may be a general purpose computer, special purpose computer, computer network, or other programmable device.
  • the computer instructions may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a magnetic disk or an optical disk, and the like.
  • the computer instructions may be transmitted or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instructions may be transmitted over wire (eg, coaxial cable, optical fiber, Digital Subscriber Line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) means to transmit to another website site, computer, server or data center.
  • the computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, a data center, or the like that includes an integration of one or more available media.
  • the usable media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, DVDs), or semiconductor media (eg, solid state disks (SSDs)), and the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Quality & Reliability (AREA)
  • General Health & Medical Sciences (AREA)
  • Computing Systems (AREA)
  • Mathematical Physics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Debugging And Monitoring (AREA)

Abstract

La présente demande se rapporte au domaine de la sécurité des réseaux. Sont divulgués, un procédé et un appareil de traitement d'un journal d'alerte, ainsi qu'un support de stockage. Le procédé consiste : à acquérir, par un dispositif en nuage, un premier journal d'alerte délivré par un environnement de test virtuel, le premier journal d'alerte comprenant au moins un élément de contenu de journal ; à analyser ledit élément de contenu de journal pour produire des informations d'anomalie correspondant au premier journal d'alerte ; à mettre en correspondance les informations d'anomalie avec de multiples conditions de classification pour obtenir une première condition de classification à partir des multiples conditions de classification, la première condition de classification étant une condition de classification à laquelle satisfont les informations d'anomalie ; à déterminer, sur la base de corrélations entre les conditions de classification et des classifications d'alerte, une classification d'alerte correspondant à la première condition de classification ; et à déterminer la classification d'alerte correspondant à la première condition de classification en tant que classification d'alerte du premier journal d'alerte. La présente demande augmente la précision d'acquisition de la classification d'alerte d'un journal d'alerte.
PCT/CN2021/126200 2021-01-22 2021-10-25 Procédé et appareil de traitement de journal d'alerte et support de stockage WO2022156293A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110089215.5 2021-01-22
CN202110089215.5A CN114816895A (zh) 2021-01-22 2021-01-22 处理告警日志的方法、装置及存储介质

Publications (1)

Publication Number Publication Date
WO2022156293A1 true WO2022156293A1 (fr) 2022-07-28

Family

ID=82523805

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/126200 WO2022156293A1 (fr) 2021-01-22 2021-10-25 Procédé et appareil de traitement de journal d'alerte et support de stockage

Country Status (2)

Country Link
CN (1) CN114816895A (fr)
WO (1) WO2022156293A1 (fr)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116471123A (zh) * 2023-06-14 2023-07-21 杭州海康威视数字技术股份有限公司 针对智能设备安全威胁的智能分析方法、装置及设备

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106992876A (zh) * 2017-03-04 2017-07-28 郑州云海信息技术有限公司 云平台日志管理方法及系统
CN108092962A (zh) * 2017-12-08 2018-05-29 北京奇安信科技有限公司 一种恶意url检测方法及装置
US20190095440A1 (en) * 2017-09-26 2019-03-28 International Business Machines Corporation Prioritizing log tags and alerts
WO2020012579A1 (fr) * 2018-07-11 2020-01-16 日本電気株式会社 Dispositif d'analyse de journal, procédé d'analyse de journal et programme
CN111475643A (zh) * 2020-03-08 2020-07-31 苏州浪潮智能科技有限公司 数据中心交换机异常日志的处理方法、装置及存储介质
CN111953541A (zh) * 2020-08-10 2020-11-17 腾讯科技（深圳）有限公司 告警信息处理方法、装置、计算机设备及存储介质

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106992876A (zh) * 2017-03-04 2017-07-28 郑州云海信息技术有限公司 云平台日志管理方法及系统
US20190095440A1 (en) * 2017-09-26 2019-03-28 International Business Machines Corporation Prioritizing log tags and alerts
CN108092962A (zh) * 2017-12-08 2018-05-29 北京奇安信科技有限公司 一种恶意url检测方法及装置
WO2020012579A1 (fr) * 2018-07-11 2020-01-16 日本電気株式会社 Dispositif d'analyse de journal, procédé d'analyse de journal et programme
CN111475643A (zh) * 2020-03-08 2020-07-31 苏州浪潮智能科技有限公司 数据中心交换机异常日志的处理方法、装置及存储介质
CN111953541A (zh) * 2020-08-10 2020-11-17 腾讯科技（深圳）有限公司 告警信息处理方法、装置、计算机设备及存储介质

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116471123A (zh) * 2023-06-14 2023-07-21 杭州海康威视数字技术股份有限公司 针对智能设备安全威胁的智能分析方法、装置及设备
CN116471123B (zh) * 2023-06-14 2023-08-25 杭州海康威视数字技术股份有限公司 针对智能设备安全威胁的智能分析方法、装置及设备

Also Published As

Publication number Publication date
CN114816895A (zh) 2022-07-29

Similar Documents

Publication Publication Date Title
CN109992989B (zh) 使用抽象语法树的用于查询注入检测的系统
US10176321B2 (en) Leveraging behavior-based rules for malware family classification
US10255432B2 (en) Detecting malicious instructions on a virtual machine using profiling
CN106384048B (zh) 一种威胁信息处理方法与装置
CN108763031A (zh) 一种基于日志的威胁情报检测方法及装置
CN107395650B (zh) 基于沙箱检测文件识别木马回连方法及装置
WO2007062086A2 (fr) Reseau de securite pour systeme de noms de domaine
US10127382B2 (en) Malware detection method
CN110149319B (zh) Apt组织的追踪方法及装置、存储介质、电子装置
CN110035062A (zh) 一种网络验伤方法及设备
US10963562B2 (en) Malicious event detection device, malicious event detection method, and malicious event detection program
WO2022156293A1 (fr) Procédé et appareil de traitement de journal d'alerte et support de stockage
US9239907B1 (en) Techniques for identifying misleading applications
CN113037689A (zh) 基于日志的病毒发现方法、装置、计算设备及存储介质
EP3361405B1 (fr) Amélioration d'un système de détection d'intrusion
JP4050253B2 (ja) コンピュータウィルス情報収集装置、コンピュータウィルス情報収集方法、及びプログラム
US11770388B1 (en) Network infrastructure detection
US11296868B1 (en) Methods and system for combating cyber threats using a related object sequence hash
KR101695461B1 (ko) 보안 위험 감지 장치 및 방법
CN114697057B (zh) 获取编排剧本信息的方法、装置及存储介质
CN114531307B (zh) 主动防御网关的api模型构建与防御方法及系统
WO2017091399A1 (fr) Extraction d'instructions malveillantes sur une machine virtuelle dans un environnement réseau

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21920671

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21920671

Country of ref document: EP

Kind code of ref document: A1