CN112350864B - Protection method, device, equipment and computer readable storage medium for domain control terminal - Google Patents

Abstract

The present application relates to a method, apparatus, device and computer-readable storage medium for protecting a domain control terminal. The protection method of the domain control terminal includes: acquiring log information and traffic information of the domain control terminal; determining first vulnerability feature information of the log information and second vulnerability feature information of the traffic information; according to the first preset classification rule, Classify the first vulnerability feature information to obtain a first classification result, and classify the second vulnerability feature information according to a second preset classification rule to obtain a second classification result; and obtain a first classification result corresponding to the first classification result. A processing rule is set to process the log information, and a second preset processing rule corresponding to the second classification result is acquired to process the traffic information. Through the present application, the problem of long time for analyzing related information in the Windows domain in the related art is solved, and the time for analyzing the related information in the Windows domain is reduced.

Description

Domain control terminal protection method, device, device and computer-readable storage medium

technical field

The present application relates to the field of network security, and in particular, to a method, apparatus, device, and computer-readable storage medium for protecting a domain control terminal.

Background technique

With the widespread application of computers in social life, most enterprises will have their own internal network. Due to the widespread use of the Windows operating system, most of the unified management of the internal network is managed by the Windows domain. In a Windows domain, the status of the domain controller terminal is becoming more and more important. It has the authority to manage all machines, users and relationships within the domain controller terminal in the domain. Therefore, in a Windows domain, the security of the domain controller terminal is the security focus and security center of the entire Windows domain. Although the Windows domain brings great convenience to the network administrators for the internal management of the enterprise, it also brings many security problems, because there is too much related information in the Windows domain. It takes a lot of time to manually analyze the log system with the log system.

Currently, no effective solution has been proposed for the problem of long time for analyzing relevant information in the Windows domain in the related art.

SUMMARY OF THE INVENTION

Embodiments of the present application provide a method, apparatus, device, and computer-readable storage medium for protecting a domain control terminal, so as to at least solve the problem of long time for analyzing related information in the Windows domain in the related art.

In a first aspect, an embodiment of the present application provides a method for protecting a domain control terminal, including:

Obtain the log information and traffic information of the domain controller terminal;

determining the first vulnerability feature information of the log information and the second vulnerability feature information of the traffic information;

Classify the first vulnerability feature information according to a first preset classification rule to obtain a first classification result, and classify the second vulnerability feature information according to a second preset classification rule to obtain a second classification result , wherein the first classification result includes one of the following: normal log information, suspicious log information, and malicious log information, and the second classification result includes one of the following: normal traffic information, suspicious traffic information, and malicious traffic information;

A first preset processing rule corresponding to the first classification result is acquired to process the log information, and a second preset processing rule corresponding to the second classification result is acquired to process the traffic information.

In some of the embodiments, after acquiring the log information and traffic information of the domain control terminal, the method further includes:

The log information and the traffic information are respectively cached in the Redis database.

In some of the embodiments, the first vulnerability feature information is classified according to a first preset classification rule to obtain a first classification result, and the second vulnerability feature information is classified according to a second preset classification rule After the second classification result is obtained, the method further includes:

The first classification result and the second classification result are cached.

In some of the embodiments, the first classification result includes: suspicious log information, and the second classification result includes: suspicious traffic information; obtaining a first preset processing rule corresponding to the first classification result Processing the log information, obtaining a second preset processing rule corresponding to the second classification result, and processing the traffic information includes:

The suspicious log information is alerted, and the suspicious traffic information is alerted, wherein both the first preset processing rule and the second preset processing rule include: alarm processing.

In some of these embodiments, the first classification result includes: malicious log information, and the second classification result includes: malicious traffic information; obtaining a first preset processing rule corresponding to the first classification result Processing the log information, obtaining a second preset processing rule corresponding to the second classification result, and processing the traffic information includes:

Obtain the first operation address of the malicious log information and the second operation address of the malicious traffic information;

Banning the first operation address and the second operation address, wherein the first preset processing rule and the second preset processing rule both include: banning processing.

In some of these embodiments, the first classification result includes: malicious log information, and the second classification result includes: malicious traffic information; obtaining a first preset processing rule corresponding to the first classification result Processing the log information, obtaining a second preset processing rule corresponding to the second classification result, and processing the traffic information includes:

Visualizing the malicious log information and the malicious traffic information, wherein the first preset processing rule and the second preset processing rule both include: visualization processing.

In some of the embodiments, the first classification result includes: normal log information, and the second classification result includes: normal traffic information; obtaining a first preset processing rule corresponding to the first classification result Processing the log information, obtaining a second preset processing rule corresponding to the second classification result, and processing the traffic information includes:

Mark the normal log information and the normal traffic information, and release the normal log information and the normal traffic information, wherein both the first preset processing rule and the second preset processing rule are Including: release processing.

In a second aspect, an embodiment of the present application further provides a protection device for a domain control terminal, including:

The acquisition module is used to acquire the log information and traffic information of the domain control terminal;

a determining module, configured to determine the first vulnerability feature information of the log information and the second vulnerability feature information of the traffic information;

a classification module, configured to classify the first vulnerability feature information according to a first preset classification rule to obtain a first classification result, and classify the second vulnerability feature information according to a second preset classification rule, A second classification result is obtained, wherein the first classification result includes one of the following: normal log information, suspicious log information, and malicious log information, and the second classification result includes one of the following: normal traffic information, suspicious traffic information, malicious traffic information;

a processing module, configured to acquire a first preset processing rule corresponding to the first classification result to process the log information, and acquire a second preset processing rule corresponding to the second classification result to process the traffic information is processed.

In a third aspect, an embodiment of the present application provides a protection device for a domain control terminal, including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor executes The computer program implements the method for protecting a domain control terminal according to the first aspect.

In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, implements the method for protecting a domain control terminal as described in the first aspect above.

Compared with the related art, the protection method, device, device, and computer-readable storage medium for a domain control terminal provided in the embodiments of the present application obtain log information and traffic information of the domain control terminal; determine the first vulnerability feature of the log information. information, and the second vulnerability feature information of the traffic information; classify the first vulnerability feature information according to the first preset classification rule to obtain a first classification result, and classify the second vulnerability feature information according to the second preset classification rule Perform classification to obtain a second classification result, where the first classification result includes one of the following: normal log information, suspicious log information, and malicious log information, and the second classification result includes one of the following: normal traffic information, suspicious traffic information, malicious log information Traffic information; the method of acquiring the first preset processing rule corresponding to the first classification result to process the log information, and the method of acquiring the second preset processing rule corresponding to the second classification result to process the traffic information, solving the related art The problem that the analysis time of the relevant information in the Windows domain is long, which reduces the analysis time of the relevant information in the Windows domain.

The details of one or more embodiments of the application are set forth in the accompanying drawings and the description below in order to make other features, objects and advantages of the application more apparent.

Description of drawings

The drawings described herein are used to provide further understanding of the present application and constitute a part of the present application. The schematic embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation of the present application. In the attached image:

1 is a block diagram of a hardware structure of a terminal according to a method for protecting a domain control terminal according to an embodiment of the present application;

2 is a flowchart of a method for protecting a domain control terminal according to an embodiment of the present application;

3 is a flowchart of a method for protecting a domain control terminal according to a preferred embodiment of the present application;

4 is a structural block diagram of a protection device for a domain control terminal according to a preferred embodiment of the present application;

5 is a schematic diagram of an operation flow of a data storage module according to an embodiment of the present application;

FIG. 6 is a structural block diagram of an apparatus for protecting a domain control terminal according to an embodiment of the present application.

Detailed ways

In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be described and illustrated below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, but not to limit the present application. Based on the embodiments provided in this application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of this application.

Obviously, the accompanying drawings in the following description are only some examples or embodiments of the present application. For those of ordinary skill in the art, the present application can also be applied to the present application according to these drawings without any creative effort. other similar situations. In addition, it will also be appreciated that while such development efforts may be complex and lengthy, for those of ordinary skill in the art pertaining to the present disclosure, the Some changes in design, manufacture or production based on the technical content are just conventional technical means, and it should not be understood that the content disclosed in this application is not sufficient.

Reference in this application to an "embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the application. The appearances of the phrase in various places in the specification are not necessarily all referring to the same embodiment, nor a separate or alternative embodiment that is mutually exclusive of other embodiments. It is explicitly and implicitly understood by those of ordinary skill in the art that the embodiments described in this application may be combined with other embodiments without conflict.

Unless otherwise defined, the technical or scientific terms involved in this application shall have the usual meanings understood by those with ordinary skill in the technical field to which this application belongs. Words such as "a", "an", "an", "the" and the like mentioned in this application do not denote a quantitative limitation, and may denote the singular or the plural. The terms "comprising", "comprising", "having" and any of their variants referred to in this application are intended to cover non-exclusive inclusion; for example, a process, method, system, product or process comprising a series of steps or modules (units) The apparatus is not limited to the steps or units listed, but may further include steps or units not listed, or may further include other steps or units inherent to the process, method, product or apparatus. Words like "connected," "connected," "coupled," and the like referred to in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. The "plurality" referred to in this application refers to two or more. "And/or" describes the association relationship between associated objects, indicating that there can be three kinds of relationships. For example, "A and/or B" can mean that A exists alone, A and B exist at the same time, and B exists alone. The character "/" generally indicates that the associated objects are an "or" relationship. The terms "first", "second", "third", etc. involved in this application are only to distinguish similar objects, and do not represent a specific order for the objects.

The method embodiments provided in this embodiment may be executed in a terminal, a computer or a similar computing device. Taking running on a terminal as an example, FIG. 1 is a hardware structural block diagram of a terminal according to a method for protecting a domain control terminal according to an embodiment of the present application. As shown in FIG. 1 , the terminal may include one or more (only one is shown in FIG. 1 ) processor 102 (the processor 102 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA) and The memory 104 for storing data, optionally, the above-mentioned terminal may further include a transmission device 106 and an input and output device 108 for communication functions. Those of ordinary skill in the art can understand that the structure shown in FIG. 1 is only for illustration, which does not limit the structure of the above-mentioned terminal. For example, the terminal may also include more or fewer components than shown in FIG. 1 , or have a different configuration than that shown in FIG. 1 .

The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as a computer program corresponding to the method for protecting a domain control terminal in the embodiment of the present invention, the processor 102 runs the computer program stored in the memory 104, Thereby, various functional applications and data processing are performed, that is, the above-mentioned method is realized. Memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, memory 104 may further include memory located remotely from processor 102, and these remote memories may be connected to the terminal through a network. Examples of such networks include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

Transmission device 106 is used to receive or transmit data via a network. The specific example of the above-mentioned network may include a wireless network provided by a communication provider of the terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC for short), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (Radio Frequency, RF for short) module, which is used to communicate with the Internet in a wireless manner.

This embodiment also provides a method for protecting a domain control terminal. FIG. 2 is a flowchart of a method for protecting a domain control terminal according to an embodiment of the present application. As shown in FIG. 2 , the flowchart includes the following steps:

In step S201, log information and traffic information of the domain control terminal are acquired.

In this step, a log information reporting module and a traffic information reporting module may be pre-configured on the domain control terminal, and then log information is reported by the log information reporting module, and traffic information is reported by the traffic information, so as to realize the log information and traffic information. Obtain. The obtained log information and traffic information may carry their own vulnerability characteristics, attack characteristics, behavior characteristics, and the like.

It should be noted that the log information reporting module of the domain controller terminal can, but is not limited to, collect and analyze logs based on the monitoring program (Sysmon) developed by Microsoft, so as to collect log identifiers ( ID), source address (IP), request time and log details, etc. The traffic information reporting module of the domain control terminal can, but is not limited to, collect and analyze traffic based on Wireshark to filter traffic information of protocols such as Kerberos, LDAP, and SMB.

Step S202, determining the first vulnerability feature information of the log information and the second vulnerability feature information of the traffic information.

In this step, the first vulnerability feature information and the second vulnerability feature information may be determined according to the vulnerability features carried by the log information and the traffic information. For example, the first vulnerability feature information is detected in the log information, and the first vulnerability feature information is detected in the traffic information. The second vulnerability feature information is detected.

Step S203, classifying the first vulnerability feature information according to the first preset classification rule to obtain a first classification result, and classifying the second vulnerability feature information according to the second preset classification rule to obtain a second classification result, The first classification result includes one of the following: normal log information, suspicious log information, and malicious log information, and the second classification result includes one of the following: normal traffic information, suspicious traffic information, and malicious traffic information.

In this step, the user may preconfigure a first preset classification rule for classifying the vulnerability feature information corresponding to the log information, and may also preconfigure a second preset classification rule for classifying the vulnerability feature corresponding to the traffic information .

For example, suspicious traffic information can be obtained by analyzing, but not limited to, the operation log before the IP corresponding to the traffic information, and analyzing high-risk operations that did not exist before (such as logging in to a domain administrator, enumerating LDAP information, enumerating DNS (Domain Name System) ) information, etc.). The malicious traffic information can be obtained by analyzing but not limited to the vulnerability characteristics corresponding to the traffic information. Suspicious log information can be obtained by analyzing, but not limited to, the operation log before the IP corresponding to the log information, and analyzing high-risk operations that did not exist before (such as logging in to a domain administrator, enumerating LDAP information, enumerating DNS information, etc.). The malicious log information can be obtained by analyzing but not limited to the vulnerability characteristics corresponding to the log information. The classification manner in the embodiment of the present application is not limited to the foregoing manner, and the user may also set it according to the actual scene.

It should be noted that the first preset classification rule may be a rule for classifying log information into normal log information, suspicious log information or malicious log information according to vulnerability feature information of the log information; the second preset classification rule may be A rule for classifying traffic information into normal traffic information, suspicious traffic information or malicious traffic information based on the vulnerability characteristic information of the traffic information.

Step S204: Obtain a first preset processing rule corresponding to the first classification result to process the log information, and obtain a second preset processing rule corresponding to the second classification result to process the traffic information.

In this step, the first preset processing rule and the second preset processing rule may be pre-configured, which may be used to process traffic information and log information according to the processing rule corresponding to the classification result.

Based on the above steps S201 to S204, the embodiment of the present application extracts the vulnerability feature information corresponding to the log information and the traffic information, determines the classification of the log information and the traffic information according to the corresponding vulnerability feature information, and finally determines the classification of the log information and the traffic information according to the corresponding classification result. Corresponding processing of log information and traffic information does not need to analyze all relevant information in the Windows domain, but only needs to analyze the vulnerability feature information corresponding to the log information and traffic information, which solves the problem of related information analysis in the Windows domain in related technologies. The problem of long time reduces the analysis time of relevant information in the Windows domain.

At the same time, in the embodiment of the present application, the classification and processing of log information and traffic information are realized by using preset classification rules and preset processing rules, and no manual operation is required for analysis, which reduces the manual operation process and further reduces the relevant information in the Windows domain. Analysis time.

In some embodiments, after acquiring the log information and traffic information of the domain control terminal, the following steps are further implemented to cache the log information and the traffic information in the Redis database respectively.

It should be noted that in practical applications, there may be a large amount of traffic information and log information in the Windows domain. In order not to miss the corresponding information, the log information and traffic information can be kept in the Redis database for caching. In this manner in the example, the log information and the traffic information can be saved and the omission of the log information and the traffic information can be avoided.

In some of the embodiments, the first vulnerability feature information is classified according to the first preset classification rule to obtain a first classification result, and the second vulnerability feature information is classified according to the second preset classification rule to obtain After the second classification result, the following step is further implemented: caching the first classification result and the second classification result.

By caching the first classification result and the second classification result through the above steps, it is convenient for subsequent users to view the first classification result and the second classification result, and it is convenient for subsequent users to view the log information and the second classification corresponding to the first classification result. Perform corresponding operations on the traffic information corresponding to the result.

In some of these embodiments, the first classification result includes: suspicious log information, and the second classification result includes: suspicious traffic information; obtaining a first preset processing rule corresponding to the first classification result to process the log information, and obtaining a first preset processing rule corresponding to the first classification result. The processing of traffic information by the second preset processing rule corresponding to the second classification result includes the following steps: alerting suspicious log information and alerting suspicious traffic information, wherein the first preset processing rule and the second preset processing rule Both include: alarm handling.

Through the above steps, the suspicious log information is alerted, and the suspicious traffic information is alerted, so that the suspicious traffic information or the suspicious log information is alerted.

Meanwhile, in some optional implementation manners, suspicious log information and/or suspicious traffic information may also be sent to a preset user terminal.

In some of the embodiments, the first classification result includes: malicious log information, and the second classification result includes: malicious traffic information; obtaining a first preset processing rule corresponding to the first classification result to process the log information, and obtaining a first preset processing rule corresponding to the first classification result. The processing of the traffic information by the second preset processing rule corresponding to the second classification result includes the following steps: obtaining the first operation address of the malicious log information and the second operation address of the malicious traffic information; Banning, wherein the first preset processing rule and the second preset processing rule both include: banning processing.

Obtain the first operation address of the malicious log information and the second operation address of the malicious traffic information through the above steps; banning the first operation address and the second operation address realizes banning the operation address corresponding to the malicious traffic information or the malicious log information, This avoids the problem that the operation corresponding to the operation address poses a threat to the domain control terminal, thereby leading to leakage of security information, and improves the security of the domain control terminal.

Meanwhile, in some optional implementation manners, malicious log information and/or malicious traffic information may also be sent to a preset user terminal.

In some of the embodiments, the first classification result includes: malicious log information, and the second classification result includes: malicious traffic information; obtaining a first preset processing rule corresponding to the first classification result to process the log information, and obtaining a first preset processing rule corresponding to the first classification result. The processing of the traffic information by the second preset processing rule corresponding to the second classification result includes the following steps: visualizing malicious log information and malicious traffic information, wherein the first preset processing rule and the second preset processing rule both include: visual processing.

The malicious log information and malicious traffic information are visualized through the above steps, so as to realize the visualization of malicious traffic information and malicious log information, so as to realize the user's monitoring of malicious traffic information and malicious log information.

In some of the embodiments, the first classification result includes: normal log information, and the second classification result includes: normal traffic information; obtaining a first preset processing rule corresponding to the first classification result to process the log information, The processing of the traffic information by the second preset processing rule corresponding to the second classification result includes the following steps: marking normal log information and normal traffic information, and releasing the normal log information and normal traffic information, wherein the first preset processing rule and the second preset processing rule both include: release processing.

Through the above steps, the normal log information and the normal traffic information are marked, and the normal log information and the normal traffic information are released, so that the normal log information and the normal traffic information are released.

It should be noted that the release in this embodiment may be to release only the operations corresponding to the normal log information and/or the normal traffic information.

It should be noted that, by alerting suspicious log information and suspicious traffic information, users can be notified to perform corresponding operations; at the same time, by banning the operation address corresponding to malicious log information and malicious traffic information, the operation address can be prohibited from being used again. The domain control terminal performs corresponding operations, which improves the security of the domain control terminal; in addition, the malicious log information and malicious traffic information are visually displayed to facilitate users to monitor the malicious log information and malicious traffic information.

It should be noted that, in this embodiment, malicious traffic information, suspicious traffic information, malicious log information, and suspicious log information may also be marked.

In this embodiment, by uniformly managing and processing the acquired log information and traffic information data, the network administrator's use and requirements for the security management of the domain controller are realized.

The embodiments of the present application will be described and illustrated below through preferred embodiments.

FIG. 3 is a flowchart of a method for protecting a domain control terminal according to a preferred embodiment of the present application. As shown in Figure 3, the method includes:

Step S301, acquiring log information and traffic information of the domain control terminal;

Step S302, cache log information and traffic information to the Redis database;

In this step, by caching the log information and traffic information in the Redis database, the data can be cached to avoid too much log information and traffic information collected by the domain control terminal.

It should be noted that the log information and the traffic information may be stored separately, so that corresponding information is obtained in step S303. For example, sub-database A in a Redis database can store log information, and sub-database B can store traffic information.

Step S303: Obtain log information and traffic information from the Redis database.

Step S304, determining the first vulnerability feature information of the log information and the second vulnerability feature information of the traffic information.

Step S305: Classify the first vulnerability feature information according to the first preset classification rule to obtain a first classification result, and classify the second vulnerability feature information according to the second preset classification rule to obtain a second classification result.

In this step, according to the first preset classification rule, classifying the first vulnerability feature information may include the following steps:

Step A, obtains the ID corresponding to the log information of the Windows domain, and matches the rule according to the ID corresponding to the log information;

Step B, obtain other log information that meets the time point near the account/machine corresponding to the rule in Step A;

Step C, judging whether other log information complies with the corresponding attack rule flow; if so, execute step D, if not, execute step E;

Step D, according to the first preset classification rule, classify and mark the first vulnerability feature information.

Step E, marked as normal log information.

In this step, according to the second preset classification rule, classifying the second vulnerability feature information may include the following steps:

Step F, obtains the ID corresponding to the flow information of the Windows domain, and matches the rule according to the ID corresponding to the flow information;

In step G, the traffic information of other identical protocols at the time point near the account/machine corresponding to the rule in step F is obtained;

Step H, judge whether the flow information of other identical protocols meets the corresponding attack rule flow; if yes, then execute step I, if not, then execute step J;

Step 1: Classify and mark the second vulnerability feature information according to the second preset classification rule.

Step J: Classify the second vulnerability feature information as normal traffic information, and mark it as normal traffic information.

It should be noted that the first classification result may include one of the following: normal log information, suspicious log information, and malicious log information, and the second classification result may include one of the following: normal traffic information, suspicious traffic information, and malicious traffic information.

Step S306: Acquire a preset processing rule corresponding to the first classification result, process the log information, acquire a preset processing rule corresponding to the second classification result, and process the traffic information.

FIG. 4 is a structural block diagram of an apparatus for protecting a domain control terminal according to a preferred embodiment of the present application. As shown in Figure 4, the protection device of the domain control terminal includes:

The domain control terminal 41 includes a log information collection unit and a flow information collection module.

The log information collection unit is used for collecting log information, and the flow information collection unit is used for collecting flow information. The log information collection module can write a Windows driver, then the domain control terminal 41 loads the driver and hooks the Windows Event program, and finally obtains the security log information related to the domain control terminal 41 of the Windows domain. The traffic information collection module can monitor the network traffic of the domain controller terminal in the Windows domain through the npcap driver, and then extract and save the corresponding SMB traffic, LDAP traffic and kerberos traffic.

It should be noted that the relevant security log information and corresponding attack methods can be represented by Table 1, as shown in Table 1:

Table 1. Association table between log information and attack method

The data processing module 42, wherein the data processing module 42 includes a Redis data storage unit, a log information classification unit, a flow information classification unit, a log information matching unit, a flow information matching unit, a log information analysis storage unit, and a flow information analysis storage unit.

The Redis data storage unit is used to store the acquired log information and traffic information in the domain control terminal 41; the log information classification unit is used to determine and classify the vulnerability feature information of the log information in the Redis data storage unit; the traffic information classification unit It is used to determine the vulnerability feature information corresponding to the traffic information in the Redis data storage unit, and classify it; the log information matching unit is used to match the corresponding processing rules according to the classification result of the log information and process it; the traffic information matching unit is used to The traffic information classification result matches the corresponding processing rules and processes them; the log information analysis and storage unit is used to store the operation logs generated in the process of analyzing the log information; the traffic information analysis and storage unit is used to store the operation logs generated in the process of analyzing the traffic information. Operation log.

The data storage module 43 includes a data index unit, a data alarm unit, and a data ban unit. Among them, the data indexing unit can use Elasticsearch as the back-end engine. Elasticsearch supports word segmentation search for attackers who store and index log information or traffic information, and uses the neo4j relational graph database to display and describe the attack path of potential attackers The relationship icon corresponding to the attack can be visualized more directly. The data alarm unit may be configured to perform corresponding alarm operations according to the processing results of the log information classification unit and the traffic information classification unit. The data banning unit may be configured to perform corresponding banning operations according to the processing results of the log information classification unit and the traffic information classification unit.

It should be noted that Elasticsearch is a distributed, highly scalable, high real-time search and data analysis engine. It can easily make large amounts of data have the ability to search, analyze and explore. Taking full advantage of the horizontal scalability of Elasticsearch can make data more valuable in production environments. The implementation principle of Elasticsearch is mainly divided into the following steps. First, the user submits the data to the Elasticsearch database, and then the corresponding sentence is segmented through the word segmentation controller, and its weight and word segmentation results are stored in the data. When the user searches for data At the same time, the results are ranked and scored according to the weight, and then the returned results are presented to the user.

FIG. 5 is a schematic diagram of an operation flow of a data storage module according to an embodiment of the present application. As shown in FIG. 5 , first, the processing result in the data processing unit can be obtained, and the traffic information and log information corresponding to the processing result can be indexed by Elasticsearch, And visualized through the neo4j relational graph database. At the same time, suspicious traffic information and suspicious log information in the data processing unit can also be sent to a preset user terminal, so as to notify the user to perform corresponding operations. The malicious traffic information and malicious log information in data processing can also be sent to the domain control terminal, so that the control terminal can ban the terminal or terminal account corresponding to the malicious traffic information and malicious log information, such as sending ban information; Malicious traffic information and malicious log information in data processing are sent to a preset user terminal to notify the user to perform corresponding operations.

It should be noted that the manner of sending to the preset user terminal may be, but not limited to, through SMS, email, and the like.

Through the above embodiments, the embodiments of the present application implement the method of protecting the domain controller terminal based on log information and traffic information, and effectively solve the problem of multiple loopholes and complex penetration attack methods in the Windows domain environment in the related art.

The embodiment of the present application also proposes a method for judging the correlation between log information and traffic information. Combined with the log information/traffic information related to users/machines in the Windows domain at the moment to analyze and determine whether the operations corresponding to the log information and traffic information are malicious operations, and can also analyze malicious attack behaviors in time and reduce pure rule matching errors. judgement behavior.

The embodiment of the present application also proposes a method for judging and visualizing an attack mode in a Windows domain. The Neo4j relational database can also display the attacker's attack path and related terminals corresponding to log information and traffic information, so that network administrators can intuitively see the attacker's attack path, impact area, attack source, and attack key on their internal network. Time node, compromised machine and other information.

FIG. 6 is a structural block diagram of an apparatus for protecting a domain control terminal according to an embodiment of the present application. As shown in FIG. 6 , the apparatus includes:

an acquisition module 61, configured to acquire log information and traffic information of the domain control terminal;

a determining module 62, coupled to the acquiring module 61, for determining the first vulnerability feature information of the log information and the second vulnerability feature information of the traffic information;

The classification module 63, coupled to the determination module 62, is used for classifying the first vulnerability feature information according to a first preset classification rule to obtain a first classification result, and according to a second preset classification rule, classifying the first vulnerability feature information Classify the vulnerability feature information to obtain a second classification result, wherein the first classification result includes one of the following: normal log information, suspicious log information, and malicious log information, and the second classification result includes one of the following: normal Traffic information, suspicious traffic information, malicious traffic information;

The processing module 64, coupled to the classification module 63, is configured to obtain a first preset processing rule corresponding to the first classification result to process the log information, and obtain a second preset processing rule corresponding to the second classification result. A processing rule is set to process the traffic information.

In some of the embodiments, the apparatus further includes: a first cache module, configured to cache the log information and the traffic information to the Redis database respectively.

In some of the embodiments, the apparatus further includes a second cache module, configured to cache the first classification result and the second classification result.

In some of the embodiments, the processing module 64 includes an alarm unit, configured to alarm suspicious log information and alarm suspicious traffic information, wherein the first preset processing rule and the second preset processing rule both include: Alarm handling.

In some of the embodiments, the processing module 64 includes: an acquisition unit, configured to acquire the first operation address of the malicious log information and the second operation address of the malicious traffic information; a ban unit, used to obtain the first operation address and the second operation address of the malicious traffic information The address is banned, wherein the first preset processing rule and the second preset processing rule both include: ban processing.

In some of the embodiments, the processing module 64 includes: a visualization unit, configured to visualize malicious log information and malicious traffic information, wherein both the first preset processing rule and the second preset processing rule include: visualization processing.

In some of the embodiments, the processing module 64 includes: a marking unit for marking normal log information and normal flow information; a release unit for releasing normal log information and normal flow information, wherein the first preset processing Both the rule and the second preset processing rule include: release processing.

It should be noted that each of the above modules may be functional modules or program modules, and may be implemented by software or hardware. For the modules implemented by hardware, the above-mentioned modules may be located in the same processor; or the above-mentioned modules may also be located in different processors in any combination.

In addition, in combination with the method for protecting a domain control terminal in the foregoing embodiment, the embodiment of the present application may provide a computer-readable storage medium for implementation. Computer program instructions are stored on the computer-readable storage medium; when the computer program instructions are executed by the processor, any method for protecting a domain control terminal in the foregoing embodiments is implemented.

The technical features of the above-described embodiments can be combined arbitrarily. For the sake of brevity, all possible combinations of the technical features in the above-described embodiments are not described. However, as long as there is no contradiction between the combinations of these technical features, All should be regarded as the scope described in this specification.

The above-mentioned embodiments only represent several embodiments of the present application, and the descriptions thereof are relatively specific and detailed, but should not be construed as a limitation on the scope of the patent of the present application. It should be pointed out that for those skilled in the art, without departing from the concept of the present application, several modifications and improvements can be made, which all belong to the protection scope of the present application. Therefore, the scope of protection of the patent of the present application shall be subject to the appended claims.

Claims (10)

1. A protection method of a domain control terminal is characterized by comprising the following steps:

acquiring log information and flow information of a domain control terminal;

determining first vulnerability characteristic information of the log information and second vulnerability characteristic information of the flow information;

classifying the first vulnerability characteristic information according to a first preset classification rule to obtain a first classification result, and classifying the second vulnerability characteristic information according to a second preset classification rule to obtain a second classification result, wherein the first classification result comprises one of the following: normal log information, suspicious log information and malicious log information, wherein the second classification result comprises one of the following items: normal flow information, suspicious flow information and malicious flow information;

and acquiring a first preset processing rule corresponding to the first classification result to process the log information, and acquiring a second preset processing rule corresponding to the second classification result to process the flow information.

2. The method for protecting a domain-controlled terminal according to claim 1, wherein after acquiring the log information and the traffic information of the domain-controlled terminal, the method further comprises:

and caching the log information and the flow information to a Redis database respectively.

3. The method for protecting the domain control terminal according to claim 1, wherein the first vulnerability characteristic information is classified according to a first preset classification rule to obtain a first classification result, and the second vulnerability characteristic information is classified according to a second preset classification rule to obtain a second classification result, and after the method further comprises:

and caching the first classification result and the second classification result.

4. The method for protecting a domain-controlled terminal according to claim 1, wherein the first classification result comprises: suspicious log information, the second classification result comprising: suspicious traffic information; acquiring a first preset processing rule corresponding to the first classification result to process the log information, and acquiring a second preset processing rule corresponding to the second classification result to process the flow information, wherein the step of acquiring the second preset processing rule corresponding to the second classification result comprises the following steps:

and giving an alarm to the suspicious log information and giving an alarm to the suspicious traffic information, wherein the first preset processing rule and the second preset processing rule both comprise: and (5) alarm processing.

5. The method for protecting a domain-controlled terminal according to claim 1, wherein the first classification result comprises: malicious log information, the second classification result comprising: malicious traffic information; acquiring a first preset processing rule corresponding to the first classification result to process the log information, and acquiring a second preset processing rule corresponding to the second classification result to process the flow information, wherein the step of acquiring the second preset processing rule corresponding to the second classification result comprises the following steps:

acquiring a first operation address of the malicious log information and a second operation address of the malicious flow information;

and forbidding the first operation address and the second operation address, wherein the first preset processing rule and the second preset processing rule both comprise: and (6) blocking processing.

6. The method for protecting a domain-controlled terminal according to claim 1, wherein the first classification result comprises: malicious log information, the second classification result comprising: malicious traffic information; acquiring a first preset processing rule corresponding to the first classification result to process the log information, and acquiring a second preset processing rule corresponding to the second classification result to process the flow information, wherein the acquiring of the first preset processing rule corresponding to the first classification result includes:

visualizing the malicious log information and the malicious traffic information, wherein the first preset processing rule and the second preset processing rule both comprise: and (6) visualization processing.

7. The method for protecting a domain-controlled terminal according to claim 1, wherein the first classification result comprises: normal log information, and the second classification result includes: normal traffic information; acquiring a first preset processing rule corresponding to the first classification result to process the log information, and acquiring a second preset processing rule corresponding to the second classification result to process the flow information, wherein the acquiring of the first preset processing rule corresponding to the first classification result includes:

marking the normal log information and the normal traffic information, and releasing the normal log information and the normal traffic information, wherein the first preset processing rule and the second preset processing rule both comprise: and (5) releasing processing.

8. A protection device of a domain control terminal is characterized by comprising:

the acquisition module is used for acquiring the log information and the flow information of the domain control terminal;

the determining module is used for determining first vulnerability characteristic information of the log information and second vulnerability characteristic information of the flow information;

the classification module is used for classifying the first vulnerability characteristic information according to a first preset classification rule to obtain a first classification result, and classifying the second vulnerability characteristic information according to a second preset classification rule to obtain a second classification result, wherein the first classification result comprises one of the following: normal log information, suspicious log information and malicious log information, wherein the second classification result comprises one of the following items: normal traffic information, suspicious traffic information, and malicious traffic information;

and the processing module is used for acquiring a first preset processing rule corresponding to the first classification result to process the log information and acquiring a second preset processing rule corresponding to the second classification result to process the flow information.

9. A protection apparatus of a domain-controlled terminal, comprising a memory, a processor, and a computer program stored on the memory and running on the processor, wherein the processor implements the protection method of the domain-controlled terminal according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium on which a computer program is stored, the program implementing the protection method of a domain-controlled terminal according to any one of claims 1 to 7 when executed by a processor.

Images