CN111935074A - Integrated network security detection method and device - Google Patents

Abstract

The invention discloses an integrated network security detection method and device. The method includes: using virtual technology to establish a security application virtual container; collecting detected network traffic, analyzing, restoring and separating network traffic of different types of protocols, and then Distribute to the specified security application virtual container; the security application virtual container analyzes and detects traffic to generate threat analysis logs; correlates and analyzes the threat analysis logs sent by different security application virtual containers, and generates abnormal alarms or threat alarms based on decision rules; The predefined response rule sends the alarm source IP of abnormal alarm or threat alarm to the corresponding firewall or terminal detection and response system for linkage defense; the present invention integrally completes the complete flow-based security detection and response process, improving the performance of the system. It improves the accuracy of network security detection, reduces the time of automatic response, and improves the level of network security protection in an all-round way.

Description

An integrated network security detection method and device

technical field

The invention relates to the technical field of information security, in particular to an integrated network security detection method and device.

Background technique

With the rapid development of China's economy and the continuous innovation of information technology, government agencies, military enterprises, key universities and other national key units have invested more and more in informatization, which has prompted the above institutions to rely more and more on the Internet and information technology. The information supervision of these units has become an important means to ensure information security and national interests. With this demand, network security monitoring equipment emerges in an endless stream. However, in the actual operation process, it is found that there are problems such as stacking of security devices, lack of network traffic mirroring resources, excessive network traffic mirroring data, poor linkage effect between devices, and low degree of automation.

To sum up, the traditional project construction method is relatively rigid, which is prone to waste of resources and a large number of false negatives and false positives, and the defense response method is relatively single and lag, which is not conducive to the comprehensive detection and timely processing of security incidents.

SUMMARY OF THE INVENTION

In order to solve the above problems, the present invention provides an integrated network security detection method and device, firstly, the network security equipment is engineized and containerized, and then the network traffic is parsed and restored, and then distributed to the corresponding security application container according to the requirements. The container detects attack threats based on network traffic, then compares and correlates the threat analysis logs generated by different security application containers, generates alarms according to alarm rules, and finally generates a linkage defense strategy based on the alarm data and sends it to the designated response component. Or the attack source IP is blocked or blocked. The method can reduce the false alarm rate, the false alarm rate and the response time, and realize the whole process of automatic security detection and response.

The technical scheme adopted in the present invention is as follows:

On the one hand, the present invention provides an integrated network security detection method, comprising:

The security detection function of the network security device is split and placed in each independent virtual container to form a security application virtual container;

Distribute the collected real-time network traffic to the corresponding security application virtual container to generate threat analysis logs;

Generate alerts based on threat analysis logs;

The alarm source IP that sends the alarm.

Further, the security detection function of the network security device is split and placed in each independent virtual container to form a security application virtual container, including:

Apply and interface the security detection functions provided by the network security equipment of various manufacturers, and package them into applications based on different installation detection functions; and use virtual technology to create the same number of virtual containers as the packaged applications;

The applications with different installation detection functions are placed in each independent virtual container to form a security application virtual container; the security application virtual container provides a calling interface to the outside.

Further, distributing the collected real-time network traffic to the corresponding security application virtual container includes:

Receive real-time network mirroring traffic;

Analyze, restore and reassemble the received network mirroring traffic, and identify the protocol type;

Distribute the network mirror traffic after fragmentation and reorganization based on the protocol type, and distribute the traffic of different protocol types to the corresponding security application virtual container;

Perform security analysis and threat detection on the received network mirroring traffic based on preset rules, and generate threat analysis logs.

Further, generating an alarm according to the threat analysis log includes:

Receive threat analysis logs sent by different security application virtual containers;

Normalize and classify threat analysis logs;

Correlate the classified threat analysis logs based on real-time computing and processing rules, and generate abnormal alarms or threat alarms according to the alarm rules.

Further, the normalization and classification of the threat analysis log includes:

Parse and match different types of threat analysis logs, merge them into the same json format, and store them in the Elasticsearch database.

Further, the alarm source IP for sending the alarm includes:

Receive abnormal alarm or threat alarm data, and query the predefined response rules according to the alarm type;

Generate defense policies including response objects and response action parameters based on the queried response rules;

Send defense policies to firewalls or terminal detection and response systems;

The firewall or terminal detection and response system receives and executes the protection policy, and performs coordinated defense against alarms.

On the other hand, the present invention provides an integrated network security detection device, comprising:

The virtualized container engine is used to split the security detection function of the network security device and place it in each independent virtual container to form a security application virtual container;

The network traffic processing engine is used to distribute the collected real-time network traffic to the security application virtual container and generate threat analysis logs;

Real-time event processing engine for generating alarms based on threat analysis logs;

An automatic response engine, used for sending the alarm source IP of the alarm.

Further, the virtualized container engine is specifically used to:

Apply and interface the security detection functions provided by the network security equipment of various manufacturers, and package them into applications based on different installation detection functions; and use virtual technology to create the same number of virtual containers as the packaged applications;

The applications with different installation detection functions are placed in each independent virtual container to form a security application virtual container; the security application virtual container provides a calling interface to the outside.

Further, the network traffic processing engine is specifically used for,

Receive real-time network mirroring traffic;

Analyze, restore and reassemble the received network mirroring traffic, and identify the protocol type;

Distribute the network mirror traffic after fragmentation and reorganization based on the protocol type, and distribute the traffic of different protocol types to the corresponding security application virtual container;

Perform security analysis and threat detection on the received network mirroring traffic based on preset rules, and generate threat analysis logs.

Further, the automatic response engine is specifically used for,

Receive abnormal alarm or threat alarm data, and query the predefined response rules according to the alarm type;

Generate defense policies including response objects and response action parameters based on the queried response rules;

Send defense policies to firewalls or terminal detection and response systems;

The firewall or terminal detection and response system receives and executes the protection policy, and performs coordinated defense against alarms.

The beneficial effects achieved by the present invention are:

By splitting the security detection function of the network security device, the invention analyzes the threats generated by various security applications, decides to generate an abnormal alarm or a threat alarm, and blocks and blocks the abnormal or attack source IP, thereby improving the threat detection. accuracy and level of automation in response disposition.

Description of drawings

FIG. 1 is a flow chart of the integrated network security detection method of the present invention.

Detailed ways

The present invention is further described below. The following examples are only used to illustrate the technical solutions of the present invention more clearly, and cannot be used to limit the protection scope of the present invention.

Referring to FIG. 1, one aspect of the present invention provides an integrated network security detection method, including:

Step 1, using the virtualization technology to split the security detection function of the traditional network security device, and place them in each independent virtual container to form a security application virtual container;

Further, including:

11) Apply and interface the security detection functions provided by the network security equipment of various manufacturers, and package them into applications based on different installation detection functions;

12) Using virtualization technology, create the same number of virtual containers as the packaged application.

13) Place applications with different installation detection functions in separate virtual containers to form virtual containers for security applications;

Further, according to different security detection functions or self-defined detection rules, different security application virtual containers are encapsulated.

14) The security application virtual container provides a calling interface to the outside, which can be called by other functions or applications.

Step 2: Analyze and restore the collected real-time network traffic, identify the protocol type of the traffic, and forward the parsed and identified network traffic to the corresponding security application virtual container for security analysis and detection according to the queried predefined forwarding rules. ;

Further, including:

21) Use the network traffic collection module to receive and send the network mirror traffic;

22) Invoke the traffic processing module to parse and restore the received network mirror traffic, reorganize fragments, and identify the protocol type;

23) The network traffic distribution module queries the forwarding rules, distributes the processed network traffic based on the forwarding rules of different protocol types, and distributes the traffic of different protocol types to the corresponding security application virtual containers.

The predefined forwarding rules in the embodiment of the present invention are that traffic of the specified http protocol type is forwarded to the http detection container, and the ftp protocol traffic is forwarded to the ftp detection container, and the forwarding rules are all configured on demand.

Step 3: After the security application virtual container receives the specified network traffic data, it performs security analysis and threat detection according to preset rules and functions, and generates a threat analysis log;

Step 4: Correlate and analyze the threat analysis logs sent by different security application virtual containers according to the security analysis and rules, and generate abnormal alarms or threat alarms based on the decision rules;

Further, including:

41) Receive the threat analysis log sent by the virtual container of the security application, and load the real-time computing processing rule statement, such as Flink CEP;

42) Normalize and classify threat analysis logs;

Further, normalizing and classifying means that different types of threat analysis logs are parsed, matched, and merged into the same json format and stored in the Elasticsearch database.

43) Based on the real-time calculation processing rules, the classified threat analysis logs are correlated, analyzed and calculated, and abnormal alarms or threat alarms are generated according to the decision rules.

Association refers to the expansion according to the actual access data and the type of detection,

For example: 1. Different devices generate the same high-risk alarms of the same source and the same purpose;

2. Time-sequential high-risk alarms that occur with the same source and the same purpose within a certain time window;

3. After the calculation, the attack behavior and the related salary actions before and after are finally judged.

Further, decision rules refer to the rules that generate alarms. For example, within a certain time window, two or more different devices find high-risk data information of the same source and the same purpose. The program correlates and matches the data according to this rule, and can match Generated alerts for this rule.

Step 5, according to the predefined response rules, deliver the alarm source IP of the abnormal alarm or the threat alarm to the corresponding firewall or terminal detection and response system to ban or block, and complete the linkage defense of the alarm;

Further, including:

51) Receive abnormal alarm or threat alarm data;

52) Query the predefined response rules according to the alarm type;

53) Based on the queried response rules, generate a defense strategy including parameters such as response objects and response actions;

54) Issue the defense strategy to the firewall or terminal detection and response system;

55) The firewall or terminal detection and response system receives the protection policy and executes it to realize the linkage defense of the alarm.

Another aspect of the present invention also provides an integrated network security detection device, comprising:

The virtualized container engine is used to split the security detection function of the network security device and place it in each independent virtual container to form a security application virtual container;

The network traffic processing engine is used to distribute the collected real-time network traffic to the security application virtual container and generate threat analysis logs;

The real-time event processing engine is used to generate abnormal alarms or threat alarms according to the threat analysis log;

The automatic response engine is used to deliver the alarm source IP of abnormal alarm or threat alarm to the corresponding firewall or terminal detection and response system for linkage defense.

Further, the virtualized container engine is specifically used to:

Apply and interface the security detection functions provided by the network security equipment of various manufacturers, and package them into applications based on different installation detection functions; and use virtual technology to create the same number of virtual containers as the packaged applications;

The applications with different installation detection functions are placed in each independent virtual container to form a security application virtual container; the security application virtual container provides a calling interface to the outside.

Further, the network traffic processing engine is specifically used for,

Receive real-time network mirroring traffic;

Analyze, restore and reassemble the received network mirroring traffic, and identify the protocol type;

Distribute the network mirror traffic after fragmentation and reorganization based on the protocol type, and distribute the traffic of different protocol types to the corresponding security application virtual container;

Perform security analysis and threat detection on the received network mirroring traffic based on preset rules, and generate threat analysis logs.

Further, the automatic response engine is specifically used for,

Receive abnormal alarm or threat alarm data, and query the predefined response rules according to the alarm type;

Generate defense policies including response objects and response action parameters based on the queried response rules;

Send defense policies to firewalls or terminal detection and response systems;

The firewall or terminal detection and response system receives and executes the protection policy, and performs coordinated defense against alarms.

The present invention adopts the access mode of bypass deployment to perform security detection on the network without affecting the normal service flow. Once a network security threat attack is detected, corresponding measures are automatically taken. The invention adopts the idea of self-adaptive security architecture, monitors the operation of the network, reduces human intervention, and improves defense efficiency.

It is worth noting that this apparatus embodiment corresponds to the foregoing method embodiment, and the implementation manners of the foregoing method embodiment are all applicable to this apparatus embodiment, and can achieve the same or similar technical effects, so they are not repeated here.

As will be appreciated by those skilled in the art, the embodiments of the present application may be provided as a method, a system, or a computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present application. It will be understood that each flow and/or block in the flowcharts and/or block diagrams, and combinations of flows and/or blocks in the flowcharts and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce Means for implementing the functions specified in one or more of the flowcharts and/or one or more blocks of the block diagrams.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions An apparatus implements the functions specified in a flow or flows of the flowcharts and/or a block or blocks of the block diagrams.

These computer program instructions can also be loaded on a computer or other programmable data processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process such that The instructions provide steps for implementing the functions specified in one or more of the flowcharts and/or one or more blocks of the block diagrams.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to the above embodiments, those of ordinary skill in the art should understand that: the present invention can still be Modifications or equivalent replacements are made to the specific embodiments of the present invention, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention shall be included within the protection scope of the claims of the present invention.

Claims (10)

1. An integrated network security detection method is characterized by comprising the following steps:

splitting a safety detection function of the network safety equipment, and placing the split safety detection function in each independent virtual container to form a safety application virtual container;

distributing the acquired real-time network traffic to corresponding security application virtual containers to generate threat analysis logs;

generating an alarm according to the threat analysis log;

and sending the alarm source IP of the alarm.

2. The integrated network security detection method according to claim 1, wherein the splitting the security detection function of the network security device and placing the split security detection function in each independent virtual container to form a secure application virtual container comprises:

the safety detection function provided by the network safety equipment of each manufacturer is applied and interfaced, and is packaged into application based on different installation detection functions; and establishing the same number of virtual containers as the packaged applications using a virtual technique;

placing the applications with different installation detection functions into each independent virtual container to form a safe application virtual container; the secure application virtual container provides a call interface to the outside.

3. The integrated network security detection method of claim 1, wherein the distributing the collected real-time network traffic to the corresponding security application virtual containers to generate a threat analysis log comprises:

receiving real-time network mirror image flow;

analyzing, restoring and fragmenting and recombining the received network mirror image flow, and identifying the protocol type;

distributing the network mirror image flow after the fragmentation recombination based on the protocol type, and distributing the flow of different protocol types to corresponding safe application virtual containers;

and carrying out security analysis and threat detection on the received network mirror flow based on a preset rule to generate a threat analysis log.

4. The integrated network security detection method of claim 1, wherein the generating an alarm according to the threat analysis log comprises:

receiving threat analysis logs sent by different security application virtual containers;

performing canonicalization processing on the threat analysis log and classifying;

and associating the classified threat analysis logs based on the real-time calculation processing rule, and generating an abnormal alarm or a threat alarm according to the alarm rule.

5. The integrated network security detection method of claim 4, wherein the normalizing the threat analysis log and classifying the threat analysis log comprises:

and analyzing and matching the threat analysis logs of different types, merging the threat analysis logs into the same json format, and storing the json format into an Elasticissearch database.

6. The integrated network security detection method of claim 1, wherein the sending the alert source IP of the alert comprises:

receiving abnormal alarm or threat alarm data, and inquiring a predefined response rule according to the alarm type;

generating a defense strategy containing response objects and response action parameters based on the inquired response rules;

issuing the defense strategy to a firewall or a terminal detection and response system;

and the firewall or the terminal detection and response system receives and executes the protection strategy and performs linkage defense on the alarm.

7. An integrated network security detection device, comprising:

the virtualization container engine is used for splitting the security detection function of the network security equipment and placing the split security detection function into each independent virtual container to form a security application virtual container;

the network flow processing engine is used for distributing the acquired real-time network flow to the security application virtual container to generate a threat analysis log;

the real-time event processing engine is used for generating an alarm according to the threat analysis log;

and the automatic response engine is used for sending the alarm source IP of the alarm.

8. The integrated network security detection apparatus of claim 7, wherein the virtualized container engine is specifically configured to,

the safety detection function provided by the network safety equipment of each manufacturer is applied and interfaced, and is packaged into application based on different installation detection functions; and establishing the same number of virtual containers as the packaged applications using a virtual technique;

placing the applications with different installation detection functions into each independent virtual container to form a safe application virtual container; the secure application virtual container provides a call interface to the outside.

9. The integrated network security detection apparatus of claim 7, wherein the network traffic processing engine is specifically configured to,

receiving real-time network mirror image flow;

analyzing, restoring and fragmenting and recombining the received network mirror image flow, and identifying the protocol type;

distributing the network mirror image flow after the fragmentation recombination based on the protocol type, and distributing the flow of different protocol types to corresponding safe application virtual containers;

and carrying out security analysis and threat detection on the received network mirror flow based on a preset rule to generate a threat analysis log.

10. The integrated network security detection device of claim 7, wherein the automated response engine is specifically configured to,

receiving abnormal alarm or threat alarm data, and inquiring a predefined response rule according to the alarm type;

generating a defense strategy containing response objects and response action parameters based on the inquired response rules;

issuing the defense strategy to a firewall or a terminal detection and response system;

and the firewall or the terminal detection and response system receives and executes the protection strategy and performs linkage defense on the alarm.

Images