CN115001867B - Network asset data threat hunting method and device, electronic equipment and storage medium - Google Patents

Abstract

The present application provides a network asset data threat hunting method, device, electronic device and storage medium, wherein the network asset data threat hunting method includes: acquiring intelligence data within a preset period; identifying preset based on the intelligence data within the preset period New domain names and new IPs in the cycle; analyze the new domain names and new IPs, and obtain the attribute information of the new domain names and the new IPs; based on the asset rule base, the attribute information of the new domain names is The first matching field and the second matching field in the attribute information of the newly added IP are matched and calculated, and the first calculation result is obtained; based on the first calculation result and the asset rule base, the same origin of the newly added IP and the newly added domain name is determined Analyzing the results, etc. The present application is used to realize downward compatibility under the condition of increasing the data type, without adjusting the system itself, but only need to directly access the data type, thereby reducing the development cost.

Description

Network asset data threat hunting method, device, electronic equipment and storage medium

technical field

The present application relates to the field of computer technology, in particular, to a network asset data threat hunting method, device, electronic equipment and storage medium.

Background technique

At present, the existing homology analysis mainly analyzes the malicious code manually, and then analyzes the homology relationship of the samples based on the experience of professional analysts, extracts the common features in the samples, forms static rules, and collects new samples. Finally, static rules are matched to achieve the purpose of homologous sample hunting, that is, homologous analysis is completed.

Contents of the invention

The purpose of the embodiment of the present application is to provide a network asset data threat hunting method, device, electronic equipment, and storage medium, which are used to achieve backward compatibility in the case of increasing data types, without adjusting the system itself, but only need to directly access data types, thereby reducing development costs.

In a first aspect, the present application provides a network asset data threat hunting method, the method comprising:

Obtain intelligence data within a preset period;

identifying new domain names and new IPs within the preset period based on intelligence data within the preset period;

Analyzing the newly added domain name and the newly added IP, and obtaining attribute information of the newly added domain name and attribute information of the newly added IP, wherein, when the newly added domain name is a general domain name, by supporting The API of the website queried by historical Whois obtains the historical registration information of the newly added domain name, obtains the MX, SOA and TXT records of the newly added domain name through the DNS protocol, obtains the subdomain name appearing in the newly added domain name, and calculates the The domain name length of the newly added domain name, the MX, SOA and TXT records of the newly added domain name, the subdomain names appearing in the newly added domain name, the domain name length of the newly added domain name, and the historical registration information of the newly added domain name As attribute information of the newly added domain name;

Obtain custom matching configuration information for the newly added domain name and the newly added IP;

Obtain custom matching configuration information for the newly added domain name and the newly added IP;

Based on the custom matching configuration information, determine a first matching field for performing homology analysis on the newly added domain name, and a second matching field for performing homology analysis on the newly added IP;

performing matching calculation on the first matching field in the attribute information of the newly added domain name and the second matching field in the attribute information of the newly added IP based on the asset rule base, and obtaining the first calculation result ;

Based on the first calculation result and the asset rule base, determine a homology analysis result of the newly added IP and the newly added domain name.

In the first aspect of the present application, by acquiring intelligence data within a preset period, it is possible to identify newly added domain names and newly added IPs within the preset period based on the intelligence data within the preset period, and then to identify all Analyze the newly added domain name and the newly added IP, and obtain the attribute information of the newly added domain name and the attribute information of the newly added IP. matching configuration information, and then based on the custom matching configuration information, it is possible to determine the first matching field for performing homology analysis on the newly added domain name, and the second matching field for performing homology analysis on the newly added IP, and then to be able to performing matching calculation on the first matching field in the attribute information of the newly added domain name and the second matching field in the attribute information of the newly added IP based on the asset rule base, and obtaining the first calculation result , and furthermore, based on the first calculation result and the asset rule base, the homology analysis result of the newly added IP and the newly added domain name can be determined.

Compared with the prior art, the present application can obtain the custom matching configuration information for the newly added domain name and the newly added IP, and then determine the same-origin matching for the newly added domain name based on the custom matching configuration information. The first matching field analyzed, and the second matching field for the same-origin analysis of the newly added IP, so that the first matching field can be flexibly adjusted based on the custom matching configuration information during the same-origin analysis process And the second matching field, so that it can be backward compatible with the addition of data types, without adjusting the system itself, but only needs to directly access the data types, thereby reducing development costs.

In an optional implementation manner, the asset-based rule base matches the first matching field in the attribute information of the newly added domain name with the second matching field in the attribute information of the newly added IP Calculate, and obtain the first calculation result, including:

Determine the matching expression of the asset rule base;

Matching the first matching field in the attribute information of the newly added domain name and the second matching field in the attribute information of the newly added IP with the fields in the asset rule base based on the matching expression The matching calculation is performed to obtain the first calculation result.

In this optional implementation manner, by determining the matching expression of the asset rule base, based on the matching expression, the first matching field in the attribute information of the newly added domain name and the new Perform matching calculation on the second matching field in the attribute information of the added IP and the field in the asset rule base to obtain a first calculation result.

In an optional embodiment, the method also includes:

Judging whether there is an operation expression in the asset rule base;

When the operation expression exists in the asset rule library, based on the operation expression, the first matching field in the attribute information of the newly added domain name and the first matching field in the attribute information of the newly added IP Perform logical calculation on the second matching field, and obtain the second calculation result;

and performing matching calculation on the second calculation result with fields in the asset rule base based on the matching expression to obtain the first calculation result.

Compared with the existing technology, the existing homology analysis method can only be limited to the matching of data and cannot perform homology analysis on the calculation process of the algorithm. However, this optional implementation can be based on assets before matching. The operation expressions of the rule base operate on relevant fields, so that this optional implementation can match some fields that cannot be directly matched based on fields, thereby expanding the dimension of rule description and improving homology analysis. Accuracy.

In an optional implementation manner, the matching expression includes at least one of an equality expression, an inequality expression, an inclusion expression, an exclusion expression, and a regular expression;

And, the operation expression includes at least one of four arithmetic operations and logic operations.

In this optional implementation manner, the matching of the first field and the second field according to multiple matching methods can be realized by using the equality expression, the inequality expression, the inclusion expression, the exclusion expression, and the regular expression, thereby improving the first The matching dimension of the field and the second field, thereby improving the accuracy of homology analysis based on the first field and the second field.

In an optional implementation manner, the determining the homology analysis result of the newly added IP and the newly added domain name based on the first calculation result and the asset rule base includes:

determining a rule description based on the asset rule library;

judging whether the first calculation result conforms to the rule description;

When the first calculation result conforms to the rule description, determine a homology analysis result of the newly added IP and the newly added domain name.

In this optional implementation manner, the rule description is determined based on the asset rule library, and then it can be judged whether the first calculation result conforms to the rule description, and then when the first calculation result conforms to the rule description, A homology analysis result of the newly added IP and the newly added domain name can be determined.

In an optional embodiment, the first matching field includes at least one of: domain name provider, domain name length, subdomain name, Whois of the domain name, associated URL of the domain name, resolution IP provider of the domain name, and top-level domain;

In an optional embodiment, the second matching field includes: port opening status, cyberspace assets surveying and mapping result data, IP server provider matching, Whois of IP domain name reverse lookup, IP associated URL, and JARM of associated certificate.

In a second aspect, the present application provides a network asset data threat hunting device, which includes:

The first acquisition module is used to acquire intelligence data within a preset period;

An identification module, configured to identify newly added domain names and newly added IPs within the preset period based on the intelligence data within the preset period;

An analysis module, configured to analyze the newly added domain name and the newly added IP, and obtain attribute information of the newly added domain name and attribute information of the newly added IP;

The second obtaining module is used to obtain custom matching configuration information for the newly added domain name and the newly added IP, wherein, when the newly added domain name is a general domain name, it is obtained through an API of a website that supports historical Whois queries The historical registration information of the newly-increased domain name, obtain the MX, SOA and TXT records of the newly-increased domain name through the DNS protocol, obtain the sub-domain names appearing in the newly-increased domain name, calculate the domain name length of the newly-increased domain name, and The MX, SOA, and TXT records of the newly added domain name, the subdomain names appearing in the newly added domain name, the domain name length of the newly added domain name, and the historical registration information of the newly added domain name are taken as the attributes of the newly added domain name information;

Obtain custom matching configuration information for the newly added domain name and the newly added IP;

A determining module, configured to determine, based on the custom matching configuration information, a first matching field for performing homology analysis on the newly added domain name, and a second matching field for performing homology analysis on the newly added IP;

A calculation module, configured to perform matching calculation on the first matching field in the attribute information of the newly added domain name and the second matching field in the attribute information of the newly added IP based on the asset rule base, and obtain the the first calculation result;

A judging module, configured to determine a homology analysis result of the newly added IP and the newly added domain name based on the first calculation result and the asset rule base.

In the second aspect of the present application, by acquiring the intelligence data within the preset period, the newly added domain names and newly added IPs within the preset period can be identified based on the intelligence data within the preset period, and the Analyze the newly added domain name and the newly added IP, and obtain the attribute information of the newly added domain name and the attribute information of the newly added IP. matching configuration information, and then based on the custom matching configuration information, it is possible to determine the first matching field for performing homology analysis on the newly added domain name, and the second matching field for performing homology analysis on the newly added IP, and then to be able to performing matching calculation on the first matching field in the attribute information of the newly added domain name and the second matching field in the attribute information of the newly added IP based on the asset rule base, and obtaining the first calculation result , and furthermore, based on the first calculation result and the asset rule base, the homology analysis result of the newly added IP and the newly added domain name can be determined.

Compared with the prior art, the present application can obtain the custom matching configuration information for the newly added domain name and the newly added IP, and then determine the same-origin matching for the newly added domain name based on the custom matching configuration information. The first matching field analyzed, and the second matching field for the same-origin analysis of the newly added IP, so that the first matching field can be flexibly adjusted based on the custom matching configuration information during the same-origin analysis process And the second matching field, so that it can be backward compatible with the addition of data types, without adjusting the system itself, but only needs to directly access the data types, thereby reducing development costs.

In a third aspect, the present application provides an electronic device, including:

processor; and

The memory is configured to store machine-readable instructions, and when the instructions are executed by the processor, execute the network asset data threat hunting method according to any one of the foregoing implementation manners.

In the third aspect of the present application, by acquiring the intelligence data within the preset period, the newly added domain names and newly added IPs within the preset period can be identified based on the intelligence data within the preset period, and the Analyze the newly added domain name and the newly added IP, and obtain the attribute information of the newly added domain name and the attribute information of the newly added IP. matching configuration information, and then based on the custom matching configuration information, it is possible to determine the first matching field for performing homology analysis on the newly added domain name, and the second matching field for performing homology analysis on the newly added IP, and then to be able to performing matching calculation on the first matching field in the attribute information of the newly added domain name and the second matching field in the attribute information of the newly added IP based on the asset rule base, and obtaining the first calculation result , and furthermore, based on the first calculation result and the asset rule base, the homology analysis result of the newly added IP and the newly added domain name can be determined.

Compared with the prior art, the present application can obtain the custom matching configuration information for the newly added domain name and the newly added IP, and then determine the same-origin matching for the newly added domain name based on the custom matching configuration information. The first matching field analyzed, and the second matching field for the same-origin analysis of the newly added IP, so that the first matching field can be flexibly adjusted based on the custom matching configuration information during the same-origin analysis process And the second matching field, so that it can be backward compatible with the addition of data types, without adjusting the system itself, but only needs to directly access the data types, thereby reducing development costs.

In a fourth aspect, the present application provides a storage medium, the storage medium stores a computer program, and the computer program is executed by a processor according to the network asset data threat hunting method described in any one of the foregoing implementation manners.

In the fourth aspect of the present application, by acquiring the intelligence data within the preset period, the newly added domain names and newly added IPs within the preset period can be identified based on the intelligence data within the preset period, and the Analyze the newly added domain name and the newly added IP, and obtain the attribute information of the newly added domain name and the attribute information of the newly added IP. matching configuration information, and then based on the custom matching configuration information, it is possible to determine the first matching field for performing homology analysis on the newly added domain name, and the second matching field for performing homology analysis on the newly added IP, and then to be able to performing matching calculation on the first matching field in the attribute information of the newly added domain name and the second matching field in the attribute information of the newly added IP based on the asset rule base, and obtaining the first calculation result , and furthermore, based on the first calculation result and the asset rule base, the homology analysis result of the newly added IP and the newly added domain name can be determined.

Compared with the prior art, the present application can obtain the custom matching configuration information for the newly added domain name and the newly added IP, and then determine the same-origin matching for the newly added domain name based on the custom matching configuration information. The first matching field analyzed, and the second matching field for the same-origin analysis of the newly added IP, so that the first matching field can be flexibly adjusted based on the custom matching configuration information during the same-origin analysis process And the second matching field, so that it can be backward compatible with the addition of data types, without adjusting the system itself, but only needs to directly access the data types, thereby reducing development costs.

Description of drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the accompanying drawings that need to be used in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present application, so It should not be regarded as a limitation on the scope, and those skilled in the art can also obtain other related drawings according to these drawings without creative work.

FIG. 1 is a schematic flow diagram of a method for hunting threats to network asset data disclosed in an embodiment of the present application;

FIG. 2 is a schematic structural diagram of a network asset data threat hunting device disclosed in an embodiment of the present application;

Fig. 3 is a schematic structural diagram of an electronic device disclosed in an embodiment of the present application.

Detailed ways

The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application.

Embodiment one

Please refer to FIG. 1. FIG. 1 is a schematic flow diagram of a network asset data threat hunting method disclosed in the embodiment of the present application. As shown in FIG. 1, the method in the embodiment of the present application includes the following steps:

101. Obtain intelligence data within a preset period;

102. Identify new domain names and new IPs within a preset period based on intelligence data within a preset period;

103. Analyze the newly added domain name and newly added IP, and obtain the attribute information of the newly added domain name and the attribute information of the newly added IP. Wherein, when the newly added domain name is a general domain name, it is acquired through the API of a website that supports historical Whois query The historical registration information of the newly added domain name, the MX, SOA and TXT records of the newly added domain name are obtained through the DNS protocol, the subdomain names appearing in the newly added domain name are obtained, the domain name length of the newly added domain name is calculated, and the MX, SOA and TXT records of the newly added domain name are calculated. TXT records, the subdomain names appearing in the newly added domain name, the domain name length of the newly added domain name, and the historical registration information of the newly added domain name are used as the attribute information of the newly added domain name;

104. Obtain custom matching configuration information for newly added domain names and newly added IPs;

105. Based on the custom matching configuration information, determine the first matching field for performing homology analysis on the newly added domain name, and the second matching field for performing homology analysis on the newly added IP;

106. Perform matching calculation on the first matching field in the attribute information of the newly added domain name and the second matching field in the attribute information of the newly added IP based on the asset rule base, and obtain the first calculation result;

107. Based on the first calculation result and the asset rule base, determine a homology analysis result of the newly added IP and the newly added domain name.

In the embodiment of the present application, by acquiring the intelligence data within the preset period, the newly added domain names and newly added IPs within the preset period can be identified based on the intelligence data within the preset period, and then the newly added domain names and newly added The IP is analyzed, and the attribute information of the newly added domain name and the attribute information of the newly added IP are obtained. By obtaining the custom matching configuration information for the new domain name and the new IP, it is possible to determine the new domain name based on the custom matching configuration information. The first matching field for homology analysis, and the second matching field for homology analysis for newly added IPs, and then the first matching field in the attribute information of newly added domain names and the attributes of newly added IPs can be analyzed based on the asset rule base The second matching field in the information performs matching calculation and obtains the first calculation result, and then based on the first calculation result and the asset rule base, the homology analysis result of the newly added IP and the newly added domain name can be determined.

Compared with the prior art, the embodiment of the present application can obtain the custom matching configuration information for the newly added domain name and the newly added IP, and then determine the first matching field for homology analysis for the newly added domain name based on the custom matching configuration information , and the second matching field for the same-origin analysis of the newly added IP. In this way, the first matching field and the second matching field can be flexibly adjusted based on the custom matching configuration information during the same-origin analysis process, and then the In the case of adding data types, it is backward compatible, and there is no need to adjust the system itself, but only needs to directly access the data types, thereby reducing development costs.

In the embodiment of this application, as an example, assume that for scenario S1, field A and field B need to be used as the first field to perform homologous analysis on the target message, while in scenario S2, field A and field B need to be used as the first field B. Field C is used as the first field to perform homologous analysis on the target message. At this time, the embodiment of the present application can add field C through custom matching configuration information on the basis of scenario S1, so as to combine fields A, Field B and field C are used as the first field to perform homology analysis on the target message. In this process, the homology analysis of the target message in the embodiment of the present application is not based on the fixed field. Instead, it can By customizing the matching configuration information to customize the fields required for homology analysis in different scenarios, and adjusting the fields required for homology analysis in different scenarios based on the custom matching configuration information, there is no need to adjust the system code for homology analysis. Thereby, the development cost can be reduced.

In the embodiment of the present application, for step 101, the preset period may be one day or one month, which is not limited in the embodiment of the present application.

In this embodiment of the application, for step 102, the newly added domain names and newly added IPs in the preset period refer to the newly appearing domain names and IPs relative to the historical period, for example, in the S1 historical period, the domain name A, domain name B, and in the S2 period after the S1 period, domain name A, domain name B, and domain name C appear, then domain name C is a newly added domain name.

In this embodiment of the application, for step 103, if the newly added domain name is a general domain name, the analysis process for the newly added domain name is as follows:

Obtain the historical registration information of the newly added domain name through the API of the website that supports historical Whois query (such as https://x.threatbook.cn/), obtain the MX, SOA, TXT and other records of the newly added domain name through the DNS protocol, and obtain the newly added domain name. The subdomain name appearing in the domain name, calculate the domain name length of the newly added domain name.

Correspondingly, the MX, SOA, TXT records of the newly added domain name, the subdomain names appearing in the newly added domain name, the length of the domain name calculated for the newly added domain name, and the historical registration information of the newly added domain name are used as the attribute information of the newly added domain name.

In the embodiment of the present application, for step 103, if the newly added IP is the IP of a general IP server, then the analysis process for the newly added IP is:

Use the cyberspace asset surveying and mapping system (for example: https://www.zoomeye.org/, you can purchase the data produced by the commercial cyberspace surveying and mapping system, or the data produced by the private self-developed system) to detect the IP server and get the IP The port and service type (such as HTTP, Apache) opened by the server to the outside world.

Correspondingly, the port and service type are used as attribute information of the newly added IP.

In the embodiment of this application, for step 103, the sandbox (https://s.threatbook.cn/), open source data platform, and charging data platform (VirusToal) can also be used to collect new IP and new domain names. URL and corresponding URL response data (such as HTTP response body, response code), and add the new IP and new domain name URL and corresponding URL response data to the attribute information of the new IP and the attribute information of the new domain name middle.

Correspondingly, for step 105, the first matching field includes at least one of: domain name provider, domain name length, subdomain name, Whois of domain name, associated URL of domain name, resolution IP provider of domain name, top-level domain, and the second Matching fields include: port opening status, cyberspace assets surveying and mapping result data, IP server provider matching, IP reverse domain name Whois, IP associated URL, and associated certificate JARM.

In the embodiment of the present application, for step 104, the custom matching configuration information may be stored in a configuration file, wherein the embodiment of the present application can obtain the custom matching configuration information by reading the configuration file and traversing the contents of the configuration file.

In the embodiment of the present application, for step 107, the homology analysis result may refer to the APT organization to which the newly added IP and the newly added domain name belong.

In an optional embodiment, the step: perform matching calculation on the first matching field in the attribute information of the newly added domain name and the second matching field in the attribute information of the newly added IP based on the asset rule base, and obtain the first calculation result , including the following substeps:

Determine the matching expression of the asset rule base;

Based on the matching expression, the first matching field in the attribute information of the newly added domain name and the second matching field in the attribute information of the newly added IP are matched and calculated with the fields in the asset rule base to obtain a first calculation result.

In this optional implementation, by determining the matching expression of the asset rule base, the first matching field in the attribute information of the newly added domain name can be matched with the second matching field in the attribute information of the newly added IP based on the matching expression. Fields are matched and calculated with fields in the asset rule base to obtain the first calculation result.

In an optional embodiment, the matching expression includes at least one of an equality expression, an inequality expression, an inclusion expression, an exclusion expression, and a regular expression. For example, the matching expression includes an inequality expression, an inclusion expression, The calculation formula, correspondingly, based on the inequality calculation formula and the inclusion calculation formula, it can be judged whether the value of the first field is equal to a certain field of the asset rule base, and based on the inclusion calculation formula, it can be judged whether the asset rule base contains the first field.

In an optional implementation manner, the method of the embodiment of the present application further includes the following steps:

Determine whether there is an operation expression in the asset rule base;

When there is an operation expression in the asset rule base, perform logical calculations on the first matching field in the attribute information of the newly added domain name and the second matching field in the attribute information of the newly added IP based on the operation expression, and obtain the second calculation result ;

Based on the matching expression, the second calculation result is matched and calculated with the fields in the asset rule base to obtain the first calculation result.

Compared with the existing technology, the existing homology analysis method can only be limited to the matching of data and cannot perform homology analysis on the calculation process of the algorithm. However, this optional implementation can be based on assets before matching. The operation expressions of the rule base operate on relevant fields. In this way, this optional implementation can match some fields that cannot be directly matched based on fields, thereby expanding the dimension of rule description and improving the accuracy of homology analysis.

In this optional implementation manner, as an example, in some scenarios, if the first field is directly matched with the fields in the asset rule base, the obtained first calculation result cannot determine the newly added domain name APT organization, but It is necessary to combine multiple fields in the first field to determine the APT organization of the newly added domain name. For example, the APT organization of the newly added domain name cannot be determined based on the value of field A of the newly added domain name, but the value of field A of the newly added domain name After the value is added to the value of field B of the newly added domain name, it can be successfully matched with the value of a field in the asset rule base, and then the APT organization to which the newly added domain name belongs can be determined.

Correspondingly, in this optional implementation manner, the operation expression includes at least one of the four arithmetic operations and logic operations. expression. Further, the logical operation formula includes logical operations such as OR operation and XOR operation.

In this optional implementation manner, the matching of the first field and the second field according to multiple matching methods can be realized by using the equality expression, the inequality expression, the inclusion expression, the exclusion expression, and the regular expression, thereby improving the first The matching dimension of the field and the second field, thereby improving the accuracy of homology analysis based on the first field and the second field.

In an optional embodiment, the step: based on the first calculation result and the asset rule base, determine the homology analysis result of the newly added IP and the newly added domain name, including the following sub-steps:

Determine the rule description based on the asset rule base;

Judging whether the first calculation result conforms to the rule description;

When the first calculation result conforms to the rule description, determine the homology analysis result of the newly added IP and the newly added domain name.

In this optional implementation, the rule description is determined based on the asset rule base, and then it can be judged whether the first calculation result conforms to the rule description, and then when the first calculation result conforms to the rule description, it is possible to determine the new IP and the new domain name. Homology analysis results.

In an optional implementation, the rule description expresses what conditions the first calculation result should meet in order to determine the APT organization to which the newly added domain name and the newly added IP belong. For example, the rule description can be "both field A and field B are When included in the field of the rule base, the APT organization is G".

Embodiment two

Please refer to FIG. 2. FIG. 2 is a schematic structural diagram of a network asset data threat hunting method disclosed in the embodiment of the present application. As shown in FIG. 2, the device in the embodiment of the present application includes the following functional modules:

The first acquisition module 201 is configured to acquire intelligence data within a preset period;

An identification module 202, configured to identify newly added domain names and newly added IPs within a preset period based on intelligence data within a preset period;

The analysis module 203 is used to analyze the newly-added domain name and the newly-added IP, and obtain the attribute information of the newly-added domain name and the attribute information of the newly-added IP. The API of the website obtains the historical registration information of the newly added domain name, obtains the MX, SOA and TXT records of the newly added domain name through the DNS protocol, obtains the subdomain name appearing in the newly added domain name, calculates the domain name length of the newly added domain name, and converts the newly added domain name MX, SOA and TXT records, the subdomain name appearing in the newly added domain name, the domain name length of the newly added domain name, and the historical registration information of the newly added domain name are used as the attribute information of the newly added domain name;

The second obtaining module 204 is used to obtain custom matching configuration information for newly added domain names and newly added IPs;

A determining module 205, configured to determine a first matching field for performing homology analysis on the newly added domain name and a second matching field for performing homology analysis on the newly added IP based on the custom matching configuration information;

The calculation module 206 is used to perform matching calculation on the first matching field in the attribute information of the newly added domain name and the second matching field in the attribute information of the newly added IP based on the asset rule base, and obtain the first calculation result;

The judging module 207 is configured to determine the homologous analysis results of the newly added IP and the newly added domain name based on the first calculation result and the asset rule base.

In the embodiment of the present application, by acquiring the intelligence data within the preset period, the newly added domain names and newly added IPs within the preset period can be identified based on the intelligence data within the preset period, and then the newly added domain names and newly added The IP is analyzed, and the attribute information of the newly added domain name and the attribute information of the newly added IP are obtained. By obtaining the custom matching configuration information for the new domain name and the new IP, it is possible to determine the new domain name based on the custom matching configuration information. The first matching field for homology analysis, and the second matching field for homology analysis for newly added IPs, and then the first matching field in the attribute information of newly added domain names and the attributes of newly added IPs can be analyzed based on the asset rule base The second matching field in the information performs matching calculation and obtains the first calculation result, and then based on the first calculation result and the asset rule base, the homology analysis result of the newly added IP and the newly added domain name can be determined.

Compared with the prior art, the embodiment of the present application can obtain the custom matching configuration information for the newly added domain name and the newly added IP, and then determine the first matching field for homology analysis for the newly added domain name based on the custom matching configuration information , and the second matching field for the same-origin analysis of the newly added IP. In this way, the first matching field and the second matching field can be flexibly adjusted based on the custom matching configuration information during the same-origin analysis process, and then the In the case of adding data types, it is backward compatible, and there is no need to adjust the system itself, but only needs to directly access the data types, thereby reducing development costs.

It should be noted that, for other descriptions of the embodiments of the present application, please refer to relevant descriptions of the embodiments of the present application, which will not be repeated in the embodiments of the present application.

Embodiment three

Please refer to FIG. 3. FIG. 3 is a schematic structural diagram of an electronic device disclosed in the embodiment of the present application. As shown in FIG. 3, the electronic device in the embodiment of the present application includes:

processor 301; and

The memory 302 is configured to store machine-readable instructions, and when the instructions are executed by the processor 301, execute the network asset data threat hunting method according to any one of the foregoing embodiments.

In the embodiment of the present application, by acquiring the intelligence data within the preset period, the newly added domain names and newly added IPs within the preset period can be identified based on the intelligence data within the preset period, and then the newly added domain names and newly added The IP is analyzed, and the attribute information of the newly added domain name and the attribute information of the newly added IP are obtained. By obtaining the custom matching configuration information for the new domain name and the new IP, it is possible to determine the new domain name based on the custom matching configuration information. The first matching field for homology analysis, and the second matching field for homology analysis for newly added IPs, and then the first matching field in the attribute information of newly added domain names and the attributes of newly added IPs can be analyzed based on the asset rule base The second matching field in the information performs matching calculation and obtains the first calculation result, and then based on the first calculation result and the asset rule base, the homology analysis result of the newly added IP and the newly added domain name can be determined.

Compared with the prior art, the embodiment of the present application can obtain the custom matching configuration information for the newly added domain name and the newly added IP, and then determine the first matching field for homology analysis for the newly added domain name based on the custom matching configuration information , and the second matching field for the same-origin analysis of the newly added IP. In this way, the first matching field and the second matching field can be flexibly adjusted based on the custom matching configuration information during the same-origin analysis process, and then the In the case of adding data types, it is backward compatible, and there is no need to adjust the system itself, but only needs to directly access the data types, thereby reducing development costs.

Embodiment four

An embodiment of the present application provides a storage medium, where a computer program is stored in the storage medium, and the computer program is executed by a processor according to the network asset data threat hunting method in any one of the foregoing implementation manners.

In the embodiment of the present application, by acquiring the intelligence data within the preset period, the newly added domain names and newly added IPs within the preset period can be identified based on the intelligence data within the preset period, and then the newly added domain names and newly added The IP is analyzed, and the attribute information of the newly added domain name and the attribute information of the newly added IP are obtained. By obtaining the custom matching configuration information for the new domain name and the new IP, it is possible to determine the new domain name based on the custom matching configuration information. The first matching field for homology analysis, and the second matching field for homology analysis for newly added IPs, and then the first matching field in the attribute information of newly added domain names and the attributes of newly added IPs can be analyzed based on the asset rule base The second matching field in the information performs matching calculation and obtains the first calculation result, and then based on the first calculation result and the asset rule base, the homology analysis result of the newly added IP and the newly added domain name can be determined.

Compared with the prior art, the embodiment of the present application can obtain the custom matching configuration information for the newly added domain name and the newly added IP, and then determine the first matching field for homology analysis for the newly added domain name based on the custom matching configuration information , and the second matching field for the same-origin analysis of the newly added IP. In this way, the first matching field and the second matching field can be flexibly adjusted based on the custom matching configuration information during the same-origin analysis process, and then the In the case of adding data types, it is backward compatible, and there is no need to adjust the system itself, but only needs to directly access the data types, thereby reducing development costs.

In the embodiments provided in this application, it should be understood that the disclosed devices and methods may be implemented in other ways. The device embodiments described above are only illustrative. For example, the division of units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or integrated. to another system, or some features may be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some communication interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

In addition, a unit described as a separate component may or may not be physically separated, and a component displayed as a unit may or may not be a physical unit, that is, it may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

Furthermore, each functional module in each embodiment of the present application may be integrated to form an independent part, each module may exist independently, or two or more modules may be integrated to form an independent part.

It should be noted that, if the functions are realized in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk, and various media capable of storing program codes.

In this document, relational terms such as first and second etc. are used only to distinguish one entity or operation from another without necessarily requiring or implying any such relationship between these entities or operations. Actual relationship or sequence.

The above descriptions are only examples of the present application, and are not intended to limit the scope of protection of the present application. For those skilled in the art, various modifications and changes may be made to the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of this application shall be included within the protection scope of this application.

Claims (10)

1. A method for hunting network asset data threats, the method comprising:

acquiring intelligence data in a preset period;

identifying a newly added domain name and a newly added IP in the preset period based on the intelligence data in the preset period;

analyzing the newly added domain name and the newly added IP, and obtaining attribute information of the newly added domain name and attribute information of the newly added IP, wherein when the newly added domain name is a common domain name, acquiring historical registration information of the newly added domain name through an API (application programming interface) of a website supporting historical Whois inquiry, acquiring MX (executable instruction queue), SOA (service oriented architecture) and TXT (context extensible) records of the newly added domain name through a DNS (domain name system) protocol, acquiring a sub-domain name appearing in the newly added domain name, calculating the domain name length of the newly added domain name, and taking the MX, SOA and TXT records of the newly added domain name, the sub-domain name appearing in the newly added domain name, the domain name length of the newly added domain name and the historical registration information of the newly added domain name as the attribute information of the newly added domain name;

acquiring custom matching configuration information aiming at the newly added domain name and the newly added IP;

determining a first matching field for performing homology analysis on the newly added domain name and a second matching field for performing the homology analysis on the newly added IP based on the custom matching configuration information;

matching calculation is carried out on the first matching field in the attribute information of the newly added domain name and the second matching field in the attribute information of the newly added IP based on an asset rule base, and a first calculation result is obtained;

and determining the homologous analysis result of the newly added IP and the newly added domain name based on the first calculation result and the asset rule base.

2. The method as claimed in claim 1, wherein the performing a matching calculation on the first matching field in the attribute information of the newly added domain name and the second matching field in the attribute information of the newly added IP based on the asset rule base to obtain a first calculation result includes:

determining a matching expression of the asset rule base;

and matching and calculating the first matching field in the attribute information of the newly added domain name, the second matching field in the attribute information of the newly added IP and the fields in the asset rule base based on the matching expression to obtain a first calculation result.

3. The method of claim 2, wherein the method further comprises:

judging whether the asset rule base has an operational expression or not;

when the asset rule is stored in the operational expression, performing logic calculation on the first matching field in the attribute information of the newly added domain name and the second matching field in the attribute information of the newly added IP based on the operational expression to obtain a second calculation result;

and performing matching calculation on the second calculation result and the fields in the asset rule base based on the matching expression to obtain the first calculation result.

4. The method of claim 3, wherein the matching expressions comprise at least one of equality, inequality, inclusion, exclusion, and regular expressions;

and the operational expression comprises at least one of a four-rule operational expression and a logic operational expression.

5. The method of claim 3, wherein the determining the results of the homology analysis for the newly added IP and the newly added domain name based on the first calculation result and the asset rule base comprises:

determining a rule description based on the asset rule base;

judging whether the first calculation result meets the rule description;

and when the first calculation result accords with the rule description, determining the homologous analysis result of the newly added IP and the newly added domain name.

6. The method of claim 5, wherein the second match field comprises: port open status, cyberspace asset mapping result data, IP server provider matching, whois of IP back-check domain name, associated URL of IP, or JARM of associated certificate.

7. The method of claim 5, wherein the first match field comprises: at least one of a domain name provider, a domain name length, a sub-domain name, whois of a domain name, an associated URL of a domain name, a resolved IP provider of a domain name, a top-level domain.

8. A cyber asset data threat hunting apparatus, the apparatus comprising:

the first acquisition module is used for acquiring intelligence data in a preset period;

the identification module is used for identifying the newly added domain name and the newly added IP in the preset period based on the intelligence data in the preset period;

the analysis module is used for analyzing the newly added domain name and the newly added IP and obtaining attribute information of the newly added domain name and attribute information of the newly added IP, wherein when the newly added domain name is a general domain name, historical registration information of the newly added domain name is obtained through an API of a website supporting historical Whois inquiry, MX, SOA and TXT records of the newly added domain name are obtained through a DNS protocol, sub-domain names appearing in the newly added domain name are obtained, the domain name length of the newly added domain name is calculated, and the MX, SOA and TXT records of the newly added domain name, the sub-domain name appearing in the newly added domain name, the domain name length of the newly added domain name and the historical registration information of the newly added domain name are used as the attribute information of the newly added domain name;

the second acquisition module is used for acquiring custom matching configuration information aiming at the newly added domain name and the newly added IP;

the determining module is used for determining a first matching field for performing homologous analysis on the newly added domain name and a second matching field for performing homologous analysis on the newly added IP based on the custom matching configuration information;

the computing module is used for performing matching computation on the first matching field in the attribute information of the newly added domain name and the second matching field in the attribute information of the newly added IP based on an asset rule base, and obtaining a first computation result;

and the judging module is used for determining the homologous analysis result of the newly added IP and the newly added domain name based on the first calculation result and the asset rule base.

9. An electronic device, comprising:

a processor; and

a memory configured to store machine readable instructions that, when executed by the processor, perform the network asset data threat hunting method of any one of claims 1-7.

10. A storage medium storing a computer program for execution by a processor of the network asset data threat hunting method as recited in any one of claims 1-7.

Images