TWI871153B - Security managing module and security managing method for endpoint device - Google Patents

Abstract

A security managing module, includes the following elements. A capturing unit, for capturing a plurality of first program features of an application program, and capturing a plurality of first communication features of a data packet. An analyzing unit, for analyzing the first program features to generate a plurality of second program features, filtering the data packet based on a communication operation of the data packet, and analyzing the first communication features of the filtered data packet to generate a plurality of second communication features. A rule establishing unit, for establishing a candidate rule based on the first program features and the first communication features. A rule filtering unit, for filtering the candidate rule based on a trust interval to generate a allow list. A security control unit, for executing a security control based on the allow list.

Description

Security management module and security management method for endpoint devices

This disclosure relates to a data processing module and a processing method thereof, and in particular to a security management module and a security management method for providing information security for an endpoint device.

As the number of distributed applications in data centers increases dramatically, information security of communication networks becomes increasingly important to prevent malicious programs and intrusions. Administrators of communication networks and host devices often manually set up application behavior whitelists and network communication whitelists. However, when the number of server hosts in a data center is large, it will become a heavy burden for administrators to manually set up whitelists.

To address the above issues, an automated security management module is needed that can automatically create and dynamically update whitelists, and automatically perform security controls against malicious programs and illegal access.

According to one aspect of the present disclosure, a security management module is provided, comprising the following elements. An acquisition unit for acquiring a plurality of first program features of an application and a plurality of first communication features of a data packet. An analysis unit for analyzing the first program features to generate a plurality of second program features, filtering the data packet according to a communication operation of the data packet, and analyzing the first communication features of the filtered data packet to generate a plurality of second communication features. A rule establishment unit for establishing candidate rules according to the first program features and the first communication features. A rule screening unit for screening the candidate rules according to the trust interval to generate a whitelist. A security control unit for performing security control according to the whitelist.

According to another aspect of the present disclosure, a security management method is provided, comprising the following steps. Capturing a plurality of first program features of an application. Capturing a plurality of first communication features of a data packet. Analyzing the first program features to generate a plurality of second program features. Filtering the data packet according to a communication operation of the data packet. Analyzing the first communication features of the filtered data packet to generate a plurality of second communication features. Establishing candidate rules according to the first program features and the first communication features. Filtering the candidate rules according to the trust interval to generate a whitelist. Performing security control according to the whitelist.

According to another aspect of the present disclosure, a non-transitory computer-readable medium is provided, and when read by a host device including a processor and a storage device, the host device executes a security management method.

Other aspects and advantages of the present disclosure may be seen by reading the following drawings, detailed descriptions and claims.

1000,1000a,1000b: Security management module

2000: Host device

2000a,2000b:Virtual machines

3000: Communication network

100,100a,100b: Capture unit

110: Program feature extraction unit

120: Communication feature acquisition unit

200,200a,200b:Analysis unit

210: Program feature analysis unit

220: Communication feature analysis unit

300,300a,300b: Rule creation unit

400,400a,400b: Rule filtering unit

500,500a,500b: Safety control unit

600: Firewall mechanism

PF1: First Program Feature

PF2: Second Program Features

CF1: First Communication Feature

CF2: Second communication feature

RL: Candidate rules

WL: Whitelist

P_WL: Program Whitelist

C_WL: Communication whitelist

AP(1):Application

PK(1):Data packet

PK(2),PK(3): Data packets to be tested

E(1): Event

S302~S314: Steps

4010: Medical environment

10: Remote control device

20:Da Vinci Arm

30: Malicious third party

FF_L: Feedback link

FB_L: Feedback link

4020: Industrial Control Systems

41,43: Production machines

42: Control host

44: Peripheral facilities

Figure 1 shows a block diagram of a security management module of an embodiment of the present disclosure and illustrates the operation of the security management module.

FIG. 2 is a schematic diagram of the security management modules 1000a and 1000b of another embodiment of the present disclosure.

Figure 3 shows a flow chart of a security management method according to an embodiment of the present disclosure.

Figure 4 shows a schematic diagram of an implementation example of the safety management module being applied in a medical environment.

Figure 5 shows a schematic diagram of an implementation example of the safety management module being applied to an industrial control system.

The technical terms in this specification refer to the customary terms in this technical field. If this specification explains or defines some terms, the interpretation of these terms shall be based on the explanation or definition in this specification. Each embodiment disclosed in this disclosure has one or more technical features. Under the premise of possible implementation, a person with ordinary knowledge in this technical field can selectively implement some or all of the technical features in any embodiment, or selectively combine some or all of the technical features in these embodiments.

Please refer to FIG. 1, which shows a block diagram of a security management module 1000 according to an embodiment of the present disclosure, and illustrates the operation of the security management module 1000. The security management module 1000 may be a set of software programs installed and executed on a host device 2000. The host device 2000 includes a processor and a storage device (not shown in the figure), and the storage device has a non-transient computer-readable medium, such as a non-volatile memory or a hard disk. The program code of the security management module 1000 is stored in a non-transitory computer-readable medium of the storage device of the host device 2000. When the program code of the security management module 1000 is read by the host device 2000, the host device 2000 executes the program code of the security management module 1000 to implement various operations of the security management module 1000.

In another example, the security management module 1000 may be an independent hardware component (such as a micro-processor or an application-specific integrated circuit (ASIC)) that can be executed in conjunction with the host device 2000.

The security management module 1000 is applied to the host device 2000 and the communication network 3000. The host device 2000 is an endpoint device (i.e., a terminal node), and the communication network 3000 is installed on the host device 2000. The security management module 1000 analyzes the event E(1) between the host device 2000 and the communication network 3000. The event E(1) includes an application AP(1) and a data packet PK(1). The application AP(1) is related to the host device 2000, and the application AP(1) is an operating platform executed on the host device 2000. Furthermore, the data packet PK(1) is related to the communication network 3000, and the data packet PK(1) is transmitted via the communication network 3000 and sent to the host device 2000.

The security management module 1000 includes a capture unit 100, an analysis unit 200, a rule creation unit 300, a rule screening unit 400 and a security control unit 500. The above units are sub-program modules in the security management module 1000. Among them, the capture unit 100 further includes a program feature capture unit 110 and a communication feature capture unit 120. In addition, the analysis unit 200 further includes a program feature analysis unit 210 and a communication feature analysis unit 220.

The application AP(1) and the data packet PK(1) are the targets to be tested monitored by the security management module 1000. The capture unit 100 captures the respective features of the application AP(1) and the data packet PK(1) from the communication network 3000 and the host device 2000. More specifically, the program feature capture unit 110 of the capture unit 100 captures the first program feature PF1 of the application AP(1) from the host device 2000. Furthermore, the communication feature capture unit 120 of the capture unit 100 captures the first communication feature CF1 of the data packet PK(1) from the communication network 3000.

The analysis unit 200 is coupled to the capture unit 100 to receive the first program feature PF1 of the application program AP(1) and the first communication feature CF1 of the data packet PK(1). The program feature analysis unit 210 of the analysis unit 200 is coupled to the program feature capture unit 110 to receive the first program feature PF1, and the program feature analysis unit 210 analyzes the first program feature PF1 to generate the second program feature PF2. Similarly, the communication feature analysis unit 220 of the analysis unit 200 is coupled to the communication feature capture unit 120 to receive the first communication feature CF1, and the communication feature analysis unit 220 analyzes the first communication feature CF1 to generate the second communication feature CF2.

The rule establishment unit 300 is coupled to the capture unit 100 to receive the first program feature PF1 and the first communication feature CF1, and is coupled to the analysis unit 200 to receive the second program feature PF2 and the second communication feature CF2. The rule establishment unit 300 summarizes the program features and communication features under the normal behavior mode according to the first program feature PF1 of the application program AP(1) and the first communication feature CF1 of the data packet PK(1), and establishes the candidate rule RL accordingly. For example, among the communication features under the normal behavior mode, the unit flow change of the communication transmission of the data packet PK(1) is "1GB". Furthermore, optionally, the rule establishment unit 300 may further establish the candidate rule RL according to the second program feature PF2 of the application program AP(1) and the second communication feature CF2 of the data packet PK(1). In other words, when establishing the candidate rule RL, the rule establishment unit 300 must analyze the first program feature PF1 and the first communication feature CF1, but the second program feature PF2 and the second communication feature CF2 are not necessary (only as an auxiliary).

The rule screening unit 400 is coupled to the rule creation unit 300 to receive the candidate rule RL. Furthermore, the rule screening unit 400 screens the candidate rule RL according to the trust interval to generate a whitelist WL. The whitelist WL includes a program whitelist P_WL and a communication whitelist C_WL.

The security control unit 500 is coupled to the rule screening unit 400 to receive the whitelist WL, and performs security control according to the program whitelist P_WL and the communication whitelist C_WL of the whitelist WL. For example, the security control unit 500 applies the program whitelist P_WL and the communication whitelist C_WL to the program firewall mechanism and the communication firewall mechanism of the host device 2000 respectively. In addition, the security control unit 500 monitors the subsequent application programs to be tested and the data packets to be tested according to the program whitelist P_WL and the communication whitelist C_WL to determine whether they comply with the program whitelist P_WL and the communication whitelist C_WL.

The following is a description of the detailed operation of the capture unit 100, the analysis unit 200, the rule establishment unit 300, the rule screening unit 400 and the security control unit 500. The program feature capture unit 110 and the communication feature capture unit 120 of the capture unit 100 automatically capture the first program feature PF1 of the application AP(1) and the first communication feature CF1 of the data packet PK(1). In one example, the program feature capture unit 110 captures the first program feature PF1 according to the program operation of the application AP(1) on the host device 2000 (i.e., the endpoint device). For example, the operating platform of the host device 2000 is "linux", and the program feature capture unit 110 executes the "linux" command "ps-ef" to access the log file (log) of the host device 2000, thereby capturing the first program feature PF1 of the application AP (1). The captured first program feature PF1 includes, for example, the program name (app name) and the program verification code of the application AP (1), and may optionally include: path name, process ID (PID), parent process ID (PPID), CPU usage, program start time, program end time, system call sequence, etc. Table 1 lists part of the first program feature PF1.

The communication feature acquisition unit 120 can operate synchronously or asynchronously with the program feature acquisition unit 110. The communication feature acquisition unit 120 operates according to the communication of the data packet PK(1) in the communication network 3000 to acquire the first communication feature CF1 of the data packet PK(1). For example, the communication feature capture unit 120 executes the open source program "tcpdump" for the data packet PK(1) to capture the first communication feature CF1, such as the source IP address (src IP) and the destination IP address (dst IP), and optionally includes: communication protocol (such as Transmission Control Protocol (TCP)), media access control address (MAC address), source port (src port), destination port (dst port), packet size, etc.

The program feature analysis unit 210 analyzes the first program feature PF1 according to the program operation of the application program AP(1) in the host device 2000 to generate the second program feature PF2. The second program feature PF2 includes, for example, the execution frequency, the total execution time, and the startup interval time of the application program AP(1). For example, the program feature analysis unit 210 calculates the execution frequency and the startup interval time (the second program feature PF2) of the application program AP(1) according to each program start time (the first program feature PF1) of the application program AP(1). Furthermore, the program feature analysis unit 210 calculates the total execution time (second program feature PF2) of the application AP(1) based on the program start time and program end time (first program feature PF1) of the application AP(1).

The communication feature analysis unit 220 can operate synchronously or asynchronously with the program feature analysis unit 210. The communication feature analysis unit 220 analyzes the first communication feature CF1 according to the communication operation of the data packet PK(1) in the communication network 3000 to generate the second communication feature CF2. The second communication feature CF2 includes, for example, the number of connections and unit flow changes of the communication transmission of the data packet PK(1). For example, the communication feature analysis unit 220 analyzes the network protocol source address and the network protocol destination address (first communication feature CF1) of the data packet PK(1) by a statistical method to calculate the number of connections (second communication feature CF2). In one example, the communication feature analysis unit 220 can filter the data packet PK(1) according to the communication operation. When the data packet PK(1) does not belong to the analysis object, the data packet PK(1) is filtered out. For example, the security management module 1000 performs security control on the host device 2000 as an endpoint device. Therefore, the data packet PK(1) that is not related to the role of the endpoint device is not an analysis object and is filtered out. When the communication operation of the data packet PK(1) in the communication network 3000 is "broadcast operation" or "forwarding operation", it is not related to the role of the endpoint device. The communication feature analysis unit 220 filters the data packet PK(1) without analyzing it.

The rule establishment unit 300 automatically establishes the candidate rule RL according to the first program feature PF1 and the first communication feature CF1, without the need for the user to manually establish it. Moreover, when establishing the candidate rule RL, the rule establishment unit 300 can selectively refer to the second program feature PF2 and the second communication feature CF2. In one example, the rule establishment unit 300 can perform statistical analysis on the historical data set HS to establish the candidate rule RL. In another example, the rule establishment unit 300 can use the computational model MDL to perform deep learning to establish the candidate rule RL, and the computational model MDL is, for example, a convolutional neural network (CNN).

In the example of using the computational model MDL to establish the candidate rule RL, the rule establishment unit 300 first generates a training data set TR to train the computational model MDL. The rule establishment unit 300 can summarize the program features and communication features under the normal behavior mode from the first program feature PF1, the second program feature PF2, the first communication feature CF1, and the second communication feature CF2, and perform pre-data processing on them to generate the training data set TR. The pre-data processing of the training data set TR is, for example, encoding processing and classification label processing, so that the data type of the training data set TR after the pre-data processing can conform to the computational model MDL. For example, the TCP protocol and the UDP protocol in the first communication feature CF1 are encoded by "One-Hot encoding" to encode the TCP protocol as "00001" and the UDP protocol as "00010". In addition, the rule "iptables-A INPUT-s 11.22.33/24-j ACCEPT" is classified and labeled as "6". Alternatively, the unit traffic change "1GB" in the normal behavior mode is defined as label "1", and the abnormal unit traffic change "5GB" is defined as label "0".

Furthermore, the rule creation unit 300 can test the computation model MDL according to the test data set TST to evaluate the accuracy of the candidate rule RL generated by the computation model MDL. In addition, the rule creation unit 300 can dynamically update the program whitelist P_WL and the communication whitelist C_WL according to the new program features (i.e., the first program features and/or the second program features) and the new communication features (i.e., the first communication features and/or the second communication features) of subsequent events.

The rule filtering unit 400 sets the trust interval according to the predetermined quantity and the predetermined ratio. For example, the trust interval is set to be less than or equal to 100 items, or set to the ratio of "80/20", or set to three times the standard deviation when a normal distribution is adopted (i.e., the interval of 99.7%). The rule filtering unit 400 filters the white list WL from the candidate rules RL according to the ratio or quantity of the trust interval, which can prevent the white list WL from having too many items, thereby saving the calculation time of the security control unit 500.

The security control unit 500 implements security control based on the program whitelist P_WL and the communication whitelist C_WL in the whitelist WL. The host device 2000 has a firewall mechanism 600, and the firewall mechanism 600 includes a program firewall mechanism and a communication firewall mechanism. The security control unit 500 applies the program whitelist P_WL and the communication whitelist C_WL to the program firewall mechanism and the communication firewall mechanism respectively. The security control unit 500 has a monitoring mode and a blocking mode, and the program firewall mechanism and the communication firewall mechanism can selectively enable the program whitelist P_WL and the communication whitelist C_WL according to different modes. In the monitoring mode, the program firewall mechanism and the communication firewall mechanism do not actually activate the program whitelist P_WL and the communication whitelist C_WL. The security control unit 500 only monitors the application to be tested and the data packet to be tested according to the program whitelist P_WL and the communication whitelist C_WL. When an abnormality is detected, the security control unit 500 only issues a warning. In blocking mode, the program firewall mechanism and the communication firewall mechanism can actually enable the program whitelist P_WL and the communication whitelist C_WL; when an abnormality is detected, the security control unit 500 controls the program firewall mechanism and the communication firewall mechanism to block abnormal applications or data packets.

In the example of Table 2, the program characteristics of the normal behavior mode in the program whitelist P_WL include: the total execution time is "20 minutes". If the total execution time of the application to be tested is "20 minutes" and meets the program whitelist P_WL, the application is judged to be normal and the application can be allowed to run on the host device 2000. On the other hand, if the total execution time of another application to be tested is "120 minutes" and does not meet the program whitelist P_WL, it is judged to have abnormal behavior (possibly a malicious program), and the security control unit 500 blocks or stops the operation of the application (i.e., blocking mode) or only issues a warning (i.e., monitoring mode).

Similarly, the security control unit 500 monitors the data packet to be tested. As shown in Table 3, several communication characteristics of the data packet to be tested include, for example, the communication protocol, source address, source port, destination address and destination port. The security control unit 500 determines whether the data packet to be tested is abnormal based on whether it complies with the communication whitelist C_WL.

In the example of Table 4, the destination port of the normal behavior mode in the communication whitelist C_WL is "600". If the destination port of the data packet to be tested is "600" and meets the communication whitelist C_WL, the data packet is judged to be a legal access. On the other hand, if the destination port of another data packet to be tested is "650" and does not meet the communication whitelist C_WL, it is judged to have abnormal behavior and is an illegal access. The security control unit 500 can block data packets with illegal access (i.e., blocking mode) or just issue a warning (i.e., monitoring mode).

As another example in Table 5, the number of connections in the normal behavior mode in the communication whitelist C_WL is "50". If the number of connections of the data packet to be tested is "50" and meets the communication whitelist C_WL, the data packet is judged to have legal access. On the other hand, if the number of connections of another data packet to be tested is "500" and does not meet the communication whitelist C_WL, the data packet is judged to have illegal access.

The communication firewall mechanism can process (allow or block) data packets of input type, output type and forward type communication connections respectively. Among them, the input type is the communication connection from the external device (such as remote SSH) to the local host device 2000 via the communication network 3000. The output type is the communication connection from the local host device 2000 to the external device via the communication network 3000. The forwarding type is the communication connection from the external device and forwarded to other devices, and its destination is not the host device 2000.

In summary, the security control unit 500 automatically applies the program whitelist P_WL and the communication whitelist C_WL to the program firewall mechanism and the communication firewall mechanism of the host device 2000, and the user does not need to manually change the security management rules, security control policies and parameter settings of the program firewall mechanism and the communication firewall mechanism. In addition, the program firewall mechanism and the communication firewall mechanism can selectively enable the program whitelist P_WL and the communication whitelist C_WL, and the security control unit 500 can automatically block malicious programs or illegal access, or issue warnings to them. The user can also choose to manually intervene and issue commands to block malicious programs or illegal access.

Please refer to Figure 2, which shows a schematic diagram of security management modules 1000a and 1000b of another embodiment of the present disclosure. For the host device 2000 to be protected, the security management modules 1000a and 1000b can be installed in the container or virtual machine associated with the host device 2000 to collect program characteristics or communication characteristics information and establish and update the white list WL to perform security control. For example, the security management module 1000a can be installed in the virtual machine 2000a associated with the host device 2000, and the security management module 1000b can be installed in the virtual machine 2000b associated with the host device 2000.

Similar to the security management module 1000 of the embodiment of FIG. 1, the security management module 1000a of this embodiment includes a capture unit 100a, an analysis unit 200a, a rule establishment unit 300a, a rule screening unit 400a, and a security control unit 500a. The above units are subroutine modules in the security management module 1000a. Similarly, the security management module 1000b also includes a capture unit 100b, an analysis unit 200b, a rule establishment unit 300b, a rule screening unit 400b, and a security control unit 500b.

FIG. 2 only shows an example of processing a data packet (excluding processing applications): the security management modules 1000a and 1000b monitor the test data packets PK(2) and PK(3) from the communication network 3000 to protect the host device 2000 from illegal access and attacks by malicious programs. In operation, the capture unit 100a captures the first communication feature CF1 of the test data packet PK(2) from the communication network 3000. The analysis unit 200a analyzes the first communication feature CF1 to generate the second communication feature CF2 of the data packet PK(2). The rule establishment unit 300a establishes the candidate rule RL based on the first communication feature CF1 (or optionally with reference to the second communication feature CF2). The rule screening unit 400a screens the candidate rules RL according to the trust interval to generate the communication whitelist C_WL. The security control unit 500a performs security control according to the communication whitelist C_WL to protect the host device 2000. Similarly, the capture unit 100b, analysis unit 200b, rule establishment unit 300b, rule screening unit 400b and security control unit 500b of the security management module 1000b have the same operation mode, which will not be repeated here.

Please refer to FIG. 3, which shows a flow chart of a security management method of an embodiment of the present disclosure. The security management method can be implemented by the security management module 1000 of FIG. 1. For example, as described above, when the program code of the security management module 1000 is read by the host device 2000, the host device 2000 executes the program code of the security management module 1000 to implement the security management method accordingly.

First, execute step S302: the program feature capture unit 110 captures the first program feature PF1 according to the program operation of the application AP(1) in the host device 2000. For example, the program feature capture unit 110 executes the "linux" command "ps-ef" to access the log file (log) of the host device 2000, thereby capturing the first program feature PF1 of the application AP(1). Then, execute step S304: the program feature analysis unit 210 analyzes the first program feature PF1 to generate the second program feature PF2.

Furthermore, step S306 and step S308 are executed (which can be executed synchronously or asynchronously with step S302 and step S304). In step S306, the communication feature acquisition unit 120 acquires the first communication feature CF1 according to the communication operation of the data packet PK(1) in the communication network 3000. For example, the communication feature acquisition unit 120 executes the open source program "tcpdump" to acquire the first communication feature CF1. Then, step S308 is executed: the communication feature analysis unit 220 analyzes the first communication feature CF1 to generate the second communication feature CF2.

After step S304 and step S308, step S310 is then executed: the rule establishment unit 300 establishes the candidate rule RL according to the first program feature PF1 and the first communication feature CF1. Optionally, the rule establishment unit 300 may further refer to the second program feature PF2 and the second communication feature CF2 to establish the candidate rule RL (i.e., when establishing the candidate rule RL, the rule establishment unit 300 must be based on the first program feature PF1 and the first communication feature CF1; on the other hand, the second program feature PF2 and the second communication feature CF2 are only optional auxiliary). In one example, the rule establishment unit 300 may establish the candidate rule RL using deep learning of the computational model MDL. In another example, the rule establishment unit 300 may establish the candidate rule RL using the historical data set HS.

Next, execute step S312: the rule screening unit 400 sets the trust interval according to the predetermined quantity and the predetermined ratio, and screens the candidate rules RL according to the trust interval to generate a whitelist WL. The whitelist WL includes the program whitelist P_WL and the communication whitelist C_WL.

Then, step S314 is executed: the security control unit 500 implements security control according to the program whitelist P_WL and the communication whitelist C_WL. The security control unit 500 applies the program whitelist P_WL and the communication whitelist C_WL to the program firewall mechanism and the communication firewall mechanism of the host device 2000 respectively. The security control unit 500 can set the program firewall mechanism and the communication firewall mechanism of the host device 2000 to different modes. In the monitoring mode, the program firewall mechanism and the communication firewall mechanism of the host device 2000 do not actually activate the program whitelist P_WL and the communication whitelist C_WL. The security control unit 500 only monitors the application to be tested and the data packet to be tested based on the program whitelist P_WL and the communication whitelist C_WL; when an abnormality is detected, the security control unit 500 issues an alarm. In the blocking mode, the program firewall mechanism and the communication firewall mechanism of the host device 2000 actually activate the program whitelist P_WL and the communication whitelist C_WL; when an abnormality is detected, the security control unit 500 controls the program firewall mechanism and the communication firewall mechanism to block the abnormal application or data packet.

The security management module 1000 and the security management method of each embodiment of Figures 1 to 3 can be used in different environments and purposes, including industrial control (such as unmanned vehicles), finance (such as automated teller machines ATMs), military (such as drones), and medical (such as Da Vinci arm surgery), etc. Please refer to Figure 4, which shows a schematic diagram of an embodiment of the security management module 1000 applied to a medical environment 4010. In the medical environment 4010, a surgeon operates the Da Vinci arm 20 through a remote control device 10 to perform a surgical operation. The remote control device 10 transmits control commands to the Da Vinci arm 20 via a feed-forward connection FF_L. The Da Vinci arm 20 transmits status signals to the remote control device 10 via a feedback connection FB_L. The security management module 1000 can be installed in the driving host of the Da Vinci arm 20 to prevent malicious programs from invading the remote control device 10 and the Da Vinci arm 20. The operation of the security management module 1000 is shown in Table 6.

In Table 6, the program characteristics of the normal behavior mode in the program whitelist P_WL include: the checksum result is "0xcd". If the checksum result of the application to be tested is "0xcd", which conforms to the program whitelist P_WL, the application is judged to be normal. On the other hand, if the checksum result of another application to be tested is "0xcf", which does not conform to the program whitelist P_WL, the application is judged to have abnormal behavior, which may be a malicious program of a malicious third party 30. Therefore, the security control unit 500 refuses to execute the application on the driving host of the Da Vinci arm 20.

Please refer to Figure 5, which shows a schematic diagram of an implementation example of the security management module 1000 applied to the industrial control system 4020. The industrial control system 4020 is provided with production machines 41 and 43 and a control host 42. In addition, the industrial control system 4020 further includes peripheral facilities 44. The security management module 1000 can be installed in the control host 42 to prevent malicious programs from invading the production machines 41 and 43, the control host 42 and the peripheral facilities 44. The operation of the security management module 1000 is shown in Table 7.

In Table 7, the program features of the normal behavior mode in the program whitelist P_WL include: the checksum result "0xcd" and the program name "platform". If the checksum result "0xca" of the application to be tested does not match "0xcd" of the program whitelist P_WL, and its program name "machine" does not match "platform" of the program whitelist P_WL, it is determined that the application may be a malicious program of a malicious third party 30. Therefore, the security control unit 500 refuses to execute the application in the production machines 41 and 43, the control host 42 or the peripheral equipment 44.

In summary, the security management module 1000 disclosed herein provides an automated cyber security self-hardening mechanism for the host device 2000 (host device 2000 as an endpoint device). In the general security control of application whitelists and network communication whitelists, the system administrators usually set the rules manually and lack a dynamic update mechanism, which makes it easy for errors to occur or the protection is incomplete. In contrast, the security management module 1000 disclosed herein can collect the program log files and network communication logs of the host device 2000 to be protected, and automatically learn, generate, and dynamically update the generated whitelist WL, which can save the time cost of manual intervention by users.

Although the present disclosure has been disclosed in detail with preferred embodiments and examples, it is understood that these examples are intended to be illustrative rather than restrictive. It is expected that a person with ordinary knowledge in the relevant technical field can think of various modifications and combinations, and the various modifications and combinations fall within the spirit of the present disclosure and the scope of the attached patent application.

1000: Security management module

2000: Host device

3000: Communication network

100: Capture unit

110: Program feature extraction unit

120: Communication feature acquisition unit

200:Analysis unit

210: Program feature analysis unit

220: Communication feature analysis unit

300: Rule creation unit

400: Rule filtering unit

500: Safety control unit

600: Firewall mechanism

PF1: First Program Feature

PF2: Second Program Features

CF1: First Communication Feature

CF2: Second communication feature

RL: Candidate rules

WL: Whitelist

P_WL: Program Whitelist

C_WL: Communication whitelist

AP(1):Application

PK(1):Data packet

E(1): Event

Claims (20)

A security management module includes: a capture unit for capturing a plurality of first program features of an application and synchronously capturing a plurality of first communication features of a data packet in synchronization with the capture of the first program features; an analysis unit for analyzing the first program features to generate a plurality of second program features, filtering the data packet according to a communication operation of the data packet, and The first communication features of the filtered data packet are analyzed to generate a plurality of second communication features; a rule establishment unit is used to establish a candidate rule based on the first program features and the first communication features; a rule screening unit is used to screen the candidate rule based on a trust interval to generate a whitelist; and a security control unit is used to perform a security control based on the whitelist. The security management module as described in claim 1, wherein when the communication operation of the data packet is a broadcast operation or a forwarding operation, the analysis unit filters the data packet. The security management module as described in claim 1, wherein the whitelist includes a program whitelist and a communication whitelist, and the rule creation unit selectively creates the candidate rule based on the second program characteristics and the second communication characteristics, and updates the program whitelist based on the first program characteristics and/or the second program characteristics, and updates the communication whitelist based on the first communication characteristics and/or the second communication characteristics. The security management module as described in claim 3, wherein the security control unit applies the program whitelist and the communication whitelist to a program firewall mechanism and a communication firewall mechanism of a host device respectively. The security management module as described in claim 4, wherein the security control unit determines whether a tested application complies with the program whitelist, and determines whether a tested data packet complies with the communication whitelist. The security management module as described in claim 5, wherein in a blocking mode, when the application to be tested does not conform to the program whitelist, the program firewall mechanism stops the application to be tested, and when the data packet to be tested does not conform to the communication whitelist, the communication firewall mechanism blocks the data packet to be tested. The security management module as described in claim 5, wherein in a monitoring mode, when the application to be tested does not comply with the program whitelist, or the data packet to be tested does not comply with the communication whitelist, the security control unit issues a warning. The security management module as described in claim 1, wherein the first program characteristics at least include a program name and a program verification code, and the second program characteristics may be an execution frequency or a startup interval. The security management module as described in claim 1, wherein the first communication characteristics include at least a network protocol source address and a network protocol destination address, and the second communication characteristics can be a number of communication connections or a unit traffic change. The security management module as described in claim 1, wherein the rule establishment unit performs a pre-data processing on the first program features, the second program features, the first communication features, and the second communication features to generate a training data set, and uses the training data set to train an operation model to establish the candidate rule, and the pre-data processing at least includes a coding process or a classification label process. A security management method includes the following steps: capturing a plurality of first program features of an application, and synchronously capturing a plurality of first communication features of a data packet in synchronization with the capturing of the first program features; analyzing the first program features to generate a plurality of second program features; filtering the data packet according to a communication operation of the data packet; analyzing the first communication features of the filtered data packet to generate a plurality of second communication features; establishing a candidate rule according to the first program features and the first communication features; filtering the candidate rule according to a trust interval to generate a whitelist; and executing a security control according to the whitelist. The security management method as described in claim 11, wherein the step of filtering the data packet includes: filtering the data packet when the communication operation of the data packet is a broadcast operation or a forwarding operation. The security management method as described in claim 11, wherein the whitelist includes a program whitelist and a communication whitelist, and the security management method further includes: selectively establishing the candidate rule based on the second program characteristics and the second communication characteristics, updating the program whitelist based on the first program characteristics and/or the second program characteristics; and updating the communication whitelist based on the first communication characteristics and/or the second communication characteristics. The security management method as described in claim 13, wherein the step of executing the security control according to the whitelist further includes: Applying the program whitelist and the communication whitelist to a program firewall mechanism and a communication firewall mechanism of a host device respectively. The security management method as described in claim 14, wherein the step of executing the security control according to the whitelist includes: determining whether a tested application complies with the program whitelist; and determining whether a tested data packet complies with the communication whitelist. The security management method as described in claim 15, wherein in a blocking mode, when the application to be tested does not conform to the program whitelist, or when the data packet to be tested does not conform to the communication whitelist, the step of executing the security control includes: stopping the application to be tested by the program firewall mechanism; or blocking the data packet to be tested by the communication firewall mechanism. As described in claim 15, the security management method, wherein in a monitoring mode, when the application to be tested does not comply with the program whitelist, or when the data packet to be tested does not comply with the communication whitelist, the step of executing the security control includes: issuing a warning. The security management method as described in claim 11, wherein the first program characteristics include at least a program name and a program verification code, and the second program characteristics may be an execution frequency and a startup interval. The security management method as described in claim 11, wherein the first communication characteristics include at least a network protocol source address and a network protocol destination address, and the second communication characteristics can be a communication connection number and a unit traffic change. The security management method as described in claim 11, wherein the step of establishing the candidate rule includes: performing a pre-data processing on the first program features, the second program features, the first communication features, and the second communication features to generate a training data set; and using the training data set to train a computational model to establish the candidate rule, wherein the pre-data processing includes at least a coding process or a classification label process.

Images