WO2024234861A1 - Threat event sourcing method and related device - Google Patents

Abstract

The present application relates to the field of network security, and in particular to a threat event sourcing method and a related device. The method comprises: when determining that there is a security risk in a service packet generated by an SDP client accessing an application server, a data analysis device generates, according to sourcing data of the service packet, a threat event carrying a device identifier of the SDP client; and the data analysis device obtains, according to the device identifier of the SDP client, a user identifier corresponding to the device identifier of the SDP client, wherein the user identifier is used for indicating a user corresponding to the threat event. By using the solution of the present application, the sourcing of a threat event can be achieved, and the sourcing can be done to a specific user.

Description

Threat event tracing method and related equipment

This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of China on May 16, 2023, with application number 202310553333.6 and invention name “Threat Event Tracing Method and Related Equipment”, the entire contents of which are incorporated by reference in this application.

Technical Field

The present application relates to the field of network security, and in particular to a threat event tracing method and related equipment.

Background Art

The security big data analysis platform is centered on information security incidents. It collects, monitors and analyzes network traffic, security equipment logs, threat information and other data information in real time to achieve network risk identification, threat discovery, real-time warning of security incidents and visual display. When a security threat is detected or a notification or warning of a related network security incident is received, the system can quickly report the threat source and conduct closed-loop disposal to avoid major impacts and losses.

After the terminal device is connected to the network, the Internet protocol (IP) address may undergo one or more levels of network address translation (NAT). When the security big data analysis platform discovers a threat event, it can only report the IP address after NAT. This large-scale report cannot be associated with a certain computer or person. If the threat needs to be handled, the firewall or gateway can only directly block it based on the IP address dimension, which will prevent a large number of users from accessing the network.

The current tracing solution for NAT scenarios is to perform final tracing by analyzing the logs of network devices that perform NAT in the network (such as NAT conversion logs of firewalls and routers). Customers collect NAT conversion logs by deploying log servers. The content of NAT conversion logs includes time, source IP, source port, source IP after NAT, source port after NAT, and other information. The log server queries the NAT conversion log for tracing analysis based on the time point and IP address of the reported threat event.

Accurate source tracing based on NAT conversion logs requires complete NAT logs, and requires that the clocks of network devices at all levels that perform NAT conversion be unified, and that the time for security big data analysis of threat events is not delayed. Since multiple levels of NAT may be performed in the existing network environment, ranging from home routers to gateway devices, it is difficult to unify the NAT conversion log format, and some home routers may not be able to store and send NAT conversion logs. Threat event source tracing requires combining the logs of each session access to trace the source to the IP address before the conversion. If the log records are incomplete or the time cannot be unified, it is difficult to trace the source to the specific user.

Summary of the invention

The embodiment of the present application provides a threat event tracing method and related equipment. The embodiment of the present application can realize the tracing of threat events, and the tracing can be carried out to a specific user.

In a first aspect, an embodiment of the present application provides a threat event tracing method. The method is applied to a data analysis device. The data analysis device obtains the tracing data of a business message, and the business message is a message generated when a software defined perimeter (SDP) client accesses an application server. Among them, the tracing data of the business message includes the device identifier of the SDP client. The data analysis device generates a threat event carrying the device identifier of the SDP client according to the tracing data of the business message when there is a security risk in the business message. The data analysis device obtains a user identifier corresponding to the device identifier of the SDP client from the user information table of the SDP controller according to the device identifier of the SDP client, and the user identifier is used to indicate the user corresponding to the threat event. The user information table includes the correspondence between the device identifier of the SDP client and the user identifier.

By carrying the device identifier of the SDP client in the traceability data of the business message, when there is a security risk in the business message, the data analysis device can obtain the user identifier corresponding to the device identifier of the SDP client from the user information table of the SDP controller based on the device identifier of the SDP client. The user identifier indicates the user corresponding to the threat event. In other words, the generation of the threat event is related to the user indicated by the user identifier, thereby realizing the tracing of the threat event to a specific user, thereby improving the accuracy of tracing.

In conjunction with the first aspect, in a possible implementation, the traceability data of the service message is metadata of the service message, the metadata of the service message is generated by the network device based on the service message, and the data analysis device analyzes the metadata of the service message according to the first security detection rule to determine whether the service message has a first security risk. The security risk includes the first security risk.

Optionally, the first security risk is a risk analyzed by the data analysis device based on metadata of the business message, such as a zero-day threat or other security risk. By analyzing metadata from a large number of probes, the data analysis device may be able to discover some new risks that cannot be identified by existing rules based on message features.

In conjunction with the first aspect, in a possible implementation, the traceability data of the service message is threat log data, and the threat log data is generated by the network device when it is determined that the service message has a second security risk. The security risk includes the second security risk.

Optionally, the second security risk is the security risk detected by network devices such as firewalls and security gateways through intrusion prevention systems (IPS), deep packet inspection (DPI), file scanning, etc., for example, business messages carrying virus files or other security risks.

In this implementation, by performing security checks on business messages through network equipment, it is possible to determine whether the business messages pose a second security risk; there is no need for data analysis equipment to perform security checks on business messages to determine whether the business messages pose a second security risk, thereby reducing the workload of the data analysis equipment.

In combination with the first aspect, in a possible implementation, the data analysis device obtains the user identifier corresponding to the device identifier of the SDP client in the following manner:

The data analysis device sends a query request to the SDP controller, which carries the device identifier of the SDP client. The query request is used by the SDP controller to query the user information table to obtain the first user identifier corresponding to the device identifier of the SDP client; the data analysis device receives a response message fed back by the SDP controller in response to the query request, which carries the first user identifier corresponding to the device identifier of the SDP client.

In combination with the first aspect, in a possible implementation method, the user information table also includes a correspondence between the first user identifier and the authentication timestamp, the authentication timestamp being the moment when the user indicated by the first user identifier passes the authentication. When the response message includes multiple first user identifiers, the response message also includes authentication timestamps corresponding to the multiple first user identifiers respectively. The data analysis device also obtains the second user identifier from the multiple first user identifiers based on the sending time period of the business message and the authentication timestamps corresponding to the multiple first user identifiers respectively.

Among them, the second user identifier is the first user identifier whose authentication timestamp belongs to the sending period among the multiple first user identifiers; the sending period is determined according to the moment when the data analysis device receives the traceability data.

By introducing the sending period and the authentication timestamp corresponding to the first user identifier, the data analysis device can select the second user identifier from multiple first user identifiers, narrowing the traceability scope and thus improving the accuracy of the traceability result.

In the second aspect, an embodiment of the present application provides another threat event tracing method. The method is applied to a network device. The network device receives a business message, which is a message generated when an SDP client accesses an application server, and the business message carries a device identifier of the SDP client. The network device performs a security check on the business message according to a second security rule to determine whether the business message has a second security risk. If it is determined that the business message has a second security risk, the network device generates threat log data carrying the device identifier of the SDP client. The network device sends the threat log data to a data analysis device.

The network device sends threat log data to the data analysis device, so that the data analysis device can determine that the service message sent by the SDP client has the second security risk based on the threat log data and generate a threat event including the device identification of the SDP client, and the data analysis device can determine the user information corresponding to the threat event based on the device identification of the SDP client in the threat log data, thereby tracing the threat event. In addition, the data analysis device does not need to perform security detection on the service message to determine whether the service message has the second security risk, which reduces the workload of the data analysis device.

Optionally, the network device is an SDP proxy gateway or a probe device.

In combination with the first aspect, in one possible implementation, the service message is a transmission control protocol (TCP) message or a tunnel message.

In a third aspect, an embodiment of the present application provides a data analysis device, which includes an acquisition unit, a generation unit, and a transceiver unit.

An acquisition unit, used to acquire the traceability data of a service message, where the service message is a message generated when the SDP client accesses the application server, and the traceability data of the service message includes a device identifier of the SDP client;

A generating unit, used for generating a threat event carrying a device identifier of an SDP client according to the traceability data of the service message when there is a security risk in the service message;

The transceiver unit is used to obtain a first user identifier corresponding to the device identifier of the SDP client from a user information table of the SDP controller according to the device identifier of the SDP client, wherein the first user identifier is used to indicate a user corresponding to the threat event, and the user information table includes a correspondence between the device identifier of the SDP client and the first user identifier.

In conjunction with the third aspect, in a possible implementation, the security risk includes a first security risk, the traceability data of the business message is metadata of the business message, the metadata of the business message is generated by the probe device based on the business message, and the data analysis device further includes:

The analyzing unit is used to analyze the metadata of the service message according to the first security detection rule to determine whether the service message has a first security risk.

In combination with the third aspect, in a possible implementation, the security risk includes a second security risk, and the traceability data of the business message is threat log data, which is generated by the network device when it is determined that the business message has a second security risk.

In conjunction with the third aspect, in a possible implementation, the transceiver unit is specifically configured to:

Send a query request to the SDP controller. The query request carries the device identifier of the SDP client. The query request is used to query the SDP controller. A user information table is used to obtain a first user identifier corresponding to the device identifier of the SDP client; and a response message in response to the query request fed back by the SDP controller is received, where the response message carries the first user identifier corresponding to the device identifier of the SDP client.

In conjunction with the third aspect, in a possible implementation manner, the user information table further includes a correspondence between the first user identifier and the authentication timestamp, the authentication timestamp is the moment when the user indicated by the first user identifier passes the authentication, and when the response message includes multiple first user identifiers, the response message further includes the authentication timestamps corresponding to the multiple first user identifiers respectively, and the acquisition unit is further used to:

A second user identifier is obtained from multiple first user identifiers according to the sending time period of the business message and the authentication timestamps corresponding to the multiple first user identifiers; wherein the second user identifier is the first user identifier among the multiple first user identifiers whose authentication timestamp belongs to the sending time period; the sending time period is determined according to the moment when the data analysis device receives the traceability data of the business message.

In a fourth aspect, an embodiment of the present application provides a network device, including a transceiver unit, a detection unit and a generation unit.

The transceiver unit is used to receive a service message. The service message is a message generated when the SDP client accesses the application server. The service message carries the device identifier of the SDP client.

A detection unit, configured to perform a security detection on the service message according to the second security rule to determine whether the service message has a second security risk;

A generating unit, configured to generate threat log data carrying a device identifier of the SDP client if it is determined that the service message has a second security risk;

The transceiver unit is also used to send threat log data to the data analysis device.

Optionally, the network device is an SDP proxy gateway or a probe device.

In combination with the third aspect, in a possible implementation, the service message is a TCP message or a tunnel message.

In a fifth aspect, an embodiment of the present application provides a data analysis device, including a processor and a memory. The memory is used to store program code. The processor is used to call the program code stored in the memory to execute the method provided in the first aspect or any possible implementation of the first aspect.

In a sixth aspect, an embodiment of the present application provides a network device, including a processor and a memory. The memory is used to store program code. The processor is used to call the program code stored in the memory to execute the method provided in the second aspect or any possible implementation of the second aspect.

In the seventh aspect, an embodiment of the present application provides a computer storage medium, including computer instructions. When the computer instructions are executed on an electronic device, the electronic device executes a method provided in any possible implementation of the first aspect, or a method provided in any possible implementation of the second aspect.

In an eighth aspect, an embodiment of the present application provides a computer program product. When the computer program product runs on a computer, it enables the computer to execute a method provided in any possible implementation of the first aspect, or a method provided in any possible implementation of the second aspect.

In a ninth aspect, an embodiment of the present application provides a threat event tracing system, including a data analysis device, a network device, an SDP client, and an SDP controller;

The data analysis device is used to execute the method according to any one of the first aspects;

The network device is used to execute the method as described in any one of the second aspects;

The SDP controller is used to receive a query request sent by a data analysis device, the query request carries the device identifier of the SDP client; query a user information table according to the device identifier of the SDP client to obtain a first user identifier corresponding to the device identifier of the SDP client; send a response message in response to the query request to the data analysis device, the response message carries the first user identifier corresponding to the device identifier of the SDP client; the user information table includes a correspondence between the device identifier of the SDP client and the first user identifier.

By introducing the user information table, the SDP controller determines the user ID corresponding to the device ID of the SDP client based on the device ID of the SDP client, thereby tracing the threat event to a specific user, thereby improving the accuracy of tracing.

In conjunction with the ninth aspect, in a possible implementation manner, the user information table further includes a correspondence between the first user identifier and the authentication timestamp, where the authentication timestamp is the time when the user indicated by the first user identifier passes the authentication; and the SDP controller is further used to:

When there are multiple first user identifiers, the user information table is queried according to the multiple first user identifiers to obtain the authentication timestamps respectively corresponding to the multiple first user identifiers; the response message also includes the authentication timestamps respectively corresponding to the multiple first user identifiers.

By introducing the authentication timestamp corresponding to the first user identifier, the data analysis device can select the second user identifier from the multiple first user identifiers based on the authentication timestamp corresponding to the first user identifier when obtaining multiple first user identifiers, thereby narrowing the traceability scope and improving the accuracy of the traceability results.

It can be understood that the data analysis device described in the third aspect or the fifth aspect provided above is used to execute any of the methods provided in the first aspect, the SDP proxy gateway described in the fourth aspect or the sixth aspect is used to execute any of the methods provided in the second aspect, and the computer storage medium described in the fourth aspect and the computer program product described in the fifth aspect are both used to implement any of the methods provided in the first aspect or any of the methods provided in the second aspect. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods, which will not be repeated here.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a schematic diagram of a system architecture provided in an embodiment of the present application;

FIG2 is a schematic diagram of a flow chart of a threat event tracing method provided in an embodiment of the present application;

FIG3 is a flow chart of another threat event tracing method provided in an embodiment of the present application;

FIG3a is a schematic diagram of the structure of a first TCP message;

FIG4 is a schematic diagram of an interactive process of a threat event tracing method provided in an embodiment of the present application;

FIG5 is a schematic diagram of an interactive process of another threat event tracing method provided in an embodiment of the present application;

FIG6 is a schematic diagram of the structure of a data analysis device provided in an embodiment of the present application;

FIG7 is a schematic diagram of the structure of a network device provided in an embodiment of the present application;

FIG8 is a schematic diagram of the structure of another data analysis device provided in an embodiment of the present application;

FIG. 9 is a schematic diagram of the structure of another network device provided in an embodiment of the present application.

DETAILED DESCRIPTION

The terms "first", "second", "third", "fourth" and the like in the specification, claims and drawings of this application are used to distinguish different objects rather than to describe a specific order.

"Multiple" means two or more. "And/or" describes the association relationship of the associated objects, indicating that there are three relationships. For example, A and/or B means: A exists alone, A and B exist at the same time, and B exists alone. The character "/" generally indicates that the associated objects are in an "or" relationship.

The embodiments of the present application are described below in conjunction with the accompanying drawings.

Referring to Fig. 1 , Fig. 1 is a schematic diagram of a system architecture provided by an embodiment of the present application. As shown in Fig. 1 , the system includes an SDP client 101 , an SDP controller 102 , an SDP proxy gateway 103 , a probe device 104 , a data analysis device 105 and an application server 106 .

Among them, the SDP client 101 is used to implement functions such as access authentication, environment perception and data security isolation. The SDP client 101 is a terminal device, such as a desktop computer, a laptop computer, a tablet computer, a smart phone, etc., or a software client installed on the terminal device. During authentication, the SDP client 101 sends an authentication request to the SDP controller 102, wherein the authentication request includes but is not limited to the device identification of the SDP client and the source IP of the SDP client.

The SDP controller 102 is an SDP authentication server, which is used to authenticate the SDP client 101, control the access of the SDP client 101, and send trusted asset information to the SDP proxy gateway 103. After the authentication is passed, the SDP controller 102 generates trusted asset information, wherein the trusted asset information includes but is not limited to the source IP of the SDP client 101, the device identification of the SDP client 101, and the list of accessible ports.

The SDP proxy gateway 103 performs access authentication for device access to the network and proxy access to business applications based on the trusted asset information sent by the SDP controller 102. Optionally, the SDP proxy gateway 103 includes a switch, a router, a firewall, or an access point (AP) device. Optionally, the SDP proxy gateway 103 can also perform security detection on the business message sent by the SDP client 101; when the SDP proxy gateway 103 determines that there is a security risk in the business message, it generates threat log data and sends the threat log data to the data analysis device 105.

The probe device 104 is a network traffic collection device that collects and processes the traffic that needs to be detected for security threats, and sends the processed data to the data analysis device 105 for security detection.

The data analysis device 105 is a security threat analysis and detection platform, which performs security detection on the data processed by the probe device 104, generates threat events when there are security risks, or generates threat events based on the threat log data sent by the SDP proxy gateway 103, and obtains the user ID from the SDP controller 102 to trace the threat event. The data analysis device 105 displays the threat event and the user ID.

The application server 106 is a device that provides application services. Optionally, the application server 106 is a server, a server cluster, a cloud server, a cloud computing service center, or other forms of devices with computing capabilities.

The SDP client 101 sends an SDP authentication message to the SDP controller 102, and the authentication message is used for the identity authentication of the SDP client 101. The SDP controller 102 performs identity authentication on the SDP client 101. After the authentication is passed, the SDP controller 102 generates a user information table, and the user information table includes the correspondence between the device identifier and the user identifier of the SDP client 101. The user here refers to the user who uses the SDP client 101 to access the application. The SDP client 101 sends a service message to the SDP proxy gateway 103. Optionally, the service message is a TCP message or a tunnel message. The service message carries the device identifier of the SDP client 101.

In one example, the SDP proxy gateway 103 can forward the service message to the application server 106 through the routing device. When the service message passes through the routing device, the routing device can mirror the service message to the probe device 104. The probe device 104 analyzes the obtained service message, generates metadata of the service message carrying the device identifier of the SDP client 101, and transmits the metadata of the service message to the data analysis device 105. The metadata of the service message includes but is not limited to the source IP, destination IP, source port, destination port, protocol, SDP, etc. of the service message. The device identifier of the client. The data analysis device 105 analyzes the metadata of the business message according to the first security detection rule to determine whether the business message has a first security risk. If it is determined that there is a security risk, the data analysis device 105 obtains the device identifier of the SDP client 101 from the metadata, and generates a threat event carrying the device identifier of the SDP client 101; the data analysis device 105 obtains the user identifier corresponding to the device identifier of the SDP client 101 from the user information table of the SDP controller 102 according to the device identifier of the SDP client 101, and the user identifier is used to indicate the user corresponding to the threat event.

In another example, after the network device receives the service message, the network device detects the service message according to the second security detection rule to determine whether the service message has a second security risk. If the service message has a second security risk, the network device generates threat log data carrying the device identifier of the SDP client 101. The network device sends the threat log data to the data analysis device 105. The data analysis device 105 generates a threat event carrying the device identifier of the SDP client 101 according to the threat log data. The data analysis device 105 obtains the user identifier corresponding to the device identifier of the SDP client 101 from the user information table of the SDP controller 102 according to the device identifier of the SDP client 101, and the user identifier is used to indicate the user corresponding to the threat event.

Optionally, the network device is an SDP proxy gateway 103 or a probe device 104. It should be understood that the security detection capabilities of the SDP proxy gateway 103 and the probe device 104 are the same, and the operation of detecting the service message according to the second security detection rule is performed by one of the SDP proxy gateway 103 and the probe device 104, and does not need to be performed by both the SDP proxy gateway 103 and the probe device 104.

In the solution of the embodiment of the present application, the SDP client carries the device identification of the SDP client in the sent business message, so that when the data analysis device determines that the business message has a security risk, it can trace the source based on the device identification of the SDP client, thereby tracing the threat event, and tracing the source to a specific user, improving the accuracy of tracing the source, and solving the problem that security risks cannot be traced in NAT scenarios. The solution of the embodiment of the present application is a combination of a zero-trust solution and a data analysis device solution, which can solve customer pain points without increasing customer budget costs, so as to enhance the competitiveness of the solution and increase the stickiness of the solution.

The implementation process of this application is described in detail below.

See Figure 2, which is a flow chart of a threat event tracing method provided in an embodiment of the present application. The method is applied to the data analysis device 105 in Figure 1. As shown in Figure 2, the method includes:

S201. The data analysis device obtains the traceability data of the business message. The business message is a message generated when the SDP client accesses the application server. The traceability data of the business message includes the device identifier of the SDP client.

Optionally, the traceability data of the business message is metadata or threat log data of the business message. The metadata of the business message is generated by the probe device based on the business message. The threat log data is generated by the network device when it determines that the business message has a security risk. Optionally, the network device is an SDP proxy gateway or a probe device.

In one example, after receiving the service message sent by the SDP client, the SDP proxy gateway forwards the service message to the application server through the routing device; the routing device mirrors the passing service message to the probe device. The probe device analyzes the service message to obtain the device identification of the SDP client, the source IP destination IP, source port, destination port and protocol of the service message; the probe device generates metadata of the service message based on the device identification of the SDP client, the source IP, destination IP, source port, destination port and protocol of the service message, and the metadata of the service message includes the device identification of the SDP client, the source IP, destination IP, source port, destination port and protocol of the service message.

In one example, after receiving the message sent by the SDP client, the SDP proxy gateway performs a security check on the service message according to the second security detection rule. If the service message has the second security risk, the SDP proxy gateway generates threat log data carrying the device identifier of the SDP client. If the service message does not have the second security risk, the SDP proxy gateway does not generate threat log data.

Optionally, the second security detection rule is implemented based on an IPS detection algorithm, a DPI detection algorithm, or an anti-virus (AV) detection algorithm. Of course, the second security detection rule can also be implemented by other algorithms, which are not limited here.

Optionally, the second security risk is a security risk detected by network devices such as firewalls and security gateways through IPS, DPI, file scanning, etc., for example, a business message carries a virus file or other security risk.

S202: If there is a security risk in the service message, the data analysis device generates a threat event carrying the device identifier of the SDP client.

Specifically, when the traceability data of a business message is the metadata of the business message, the data analysis device analyzes the metadata of the business message according to the first security detection rule to determine whether the business message has a first security risk. In one example, the data analysis device analyzes the traffic data received by the data analysis device according to the first security detection rule to determine whether the business message has a first security risk. Among them, the traffic data received by the data analysis device includes the metadata of the business message. When it is determined that the business message has a first security risk, the data analysis device generates a threat event carrying the device identifier of the SDP client.

Optionally, the first security risk is a risk analyzed by the data analysis device based on metadata of the business message, such as a zero-day threat or other security risk. By analyzing metadata from a large number of probes, the data analysis device may be able to discover some new risks that cannot be identified by existing rules based on message features.

When the traceability data of a business message is threat log data, if the data analysis device receives the threat log data, the data analysis device determines that there is a security risk in the business message, and the data analysis device generates a threat event carrying the device identifier of the SDP client; if no threat day data is received, the data analysis device determines that there is no security risk in the business message.

S203: The data analysis device obtains a first user identifier corresponding to the device identifier of the SDP client from the user information table of the SDP controller according to the device identifier of the SDP client.

Among them, the first user identifier indicates a user corresponding to the threat event, and the user information table includes a correspondence between the device identifier of the SDP client and the first user identifier.

In one example, a data analysis device sends a query request to an SDP controller, the query request carries a device identifier of an SDP client, and the query request is used to instruct the SDP controller to query a user information table to obtain a first user identifier corresponding to the device identifier of the SDP client. The SDP controller queries the user information table based on the device identifier of the SDP client to obtain a first user identifier corresponding to the device identifier of the SDP client, and the first user identifier indicates a user corresponding to a threat event. The SDP controller sends a response message for responding to the query request to the data analysis device, the response message carries the first user identifier corresponding to the device identifier of the SDP client. The data analysis device displays the first user identifier and the threat event. By displaying the threat event and the first user identifier, the staff can know which user sent a message that poses a security risk, thereby determining the source of the threat event.

Optionally, the user information table also includes a correspondence between the first user identifier and the authentication timestamp, and the authentication timestamp is the moment when the user indicated by the corresponding first user identifier passes the authentication. When there are multiple first user identifiers carried in the response message, the response message also includes the authentication timestamps corresponding to the multiple first user identifiers. The data analysis device obtains the second user identifier based on the sending time period of the business message and the authentication timestamps corresponding to the multiple first user identifiers. The second user identifier is a user identifier whose corresponding authentication timestamp among the multiple first user identifiers belongs to the sending time period of the business message. The sending time period of the business message is determined by the data analysis device based on the moment when the traceability data of the business message is received. When there are multiple first user identifiers, this method can be used to determine the second user identifier from multiple first user identifiers, narrowing the traceability scope and thereby improving the accuracy of the traceability results.

It should be understood that after the user passes the authentication, the user will send a service message through the SDP client. Therefore, the data analysis device uses the time when the user passes the authentication as the time when the SDP client sends the service message. It takes a period of time for the SDP client to send the service message and for the data analysis device to receive the traceability data of the service message. The data analysis device can obtain the average value of this time by counting the historical data of this time. The data analysis device then obtains the sending period of the service message based on the average value of this time and the time when the data analysis device receives the traceability data of the service message.

In another example, the data analysis device sends a query request to the SDP controller, and the query request carries the device identification of the SDP client and the sending period of the service message. The sending period of the service message is determined by the data analysis device according to the time when the traceability data of the service message is received. The query request is used to instruct the SDP controller to query the user information table to obtain the second user identification corresponding to the device identification of the SDP client. The user information table includes the correspondence between the device identification and the user identification of the SDP client and the correspondence between the user identification and the authentication timestamp. The SDP controller queries the user information table according to the device identification of the SDP client to obtain the first user identification corresponding to the device identification of the SDP client; the SDP controller selects the second user identification from the first user identification according to the authentication timestamp corresponding to the first user identification and the sending period of the service message. The second user identification is a user identification whose corresponding authentication timestamp in the first user identification belongs to the sending period of the service message. The second user identification indicates the user corresponding to the threat event. The SDP controller sends a response message for responding to the query request to the data analysis device, and the response message carries the second user identification. The data analysis device displays the second user identification and the threat event.

By introducing the sending period of the service message and the authentication timestamp corresponding to the user identity, the scope of tracing is narrowed, thereby improving the accuracy of the tracing result. In addition, the SDP controller is used to obtain the second user identity from the first user identity according to the authentication timestamp corresponding to the first user identity and the sending period of the service message, which reduces the workload of the data analysis device.

In the solution of the embodiment of the present application, by carrying the device identification of the SDP client in the business message, the subsequent data analysis device can trace the source based on the device identification of the SDP client after there is a security risk in the business message, thereby tracing the threat event, and tracing the source to a specific user, improving the accuracy of tracing, and solving the problem that security risks cannot be traced in NAT scenarios. When there are multiple users traced, the scope of tracing is narrowed by introducing the sending period of the business message and the authentication timestamp corresponding to the user identification, thereby improving the accuracy of the tracing result. The solution of the embodiment of the present application is a combination of the zero-trust solution and the solution of the security big data analysis platform, which can solve customer pain points without increasing customer budget costs, so as to enhance the competitiveness of the solution and increase the stickiness of the solution.

Referring to Figure 3, Figure 3 is a flow chart of a threat event tracing method provided in an embodiment of the present application. The method is applied to a network device.

Optionally, the network device is the SDP proxy gateway 103 or the probe device 104 in Figure 1. As shown in Figure 3, the method includes:

S301. A network device receives a service message, where the service message is a message generated when an SDP client accesses an application server, and the service message carries a device identifier of the SDP client.

Optionally, the service message is a TCP message or a tunnel message.

Optionally, the tunnel message is an SRv6 message or a multi-protocol label switching (MPLS) message. SRv6 is a segment routing technology under IPv6.

In one example, the SDP client establishes a TCP connection with the SDP proxy gateway, and then sends a first TCP message to the SDP proxy gateway, wherein the device identifier of the SDP client is carried in a newly added option field of the first TCP message.

Fig. 3a shows a schematic diagram of the structure of the first TCP message. As shown in Fig. 3a, the device identifier of the SDP client is carried in the newly added option field of the first TCP message.

In another example, the SDP client encapsulates a new message header based on the second TCP message or user datagram protocol (UDP) message, and the message header carries the device identifier of the SDP client. The new message header and the second TCP message or UDP message constitute a tunnel message. It should be understood that the second TCP message or UDP message here does not carry the device identifier of the SDP client. The second TCP message or UDP message here is used for the SDP client to access the application server.

Optionally, the SDP client encrypts the device identifier of the SDP client and then carries the encrypted result in a newly added option field of the first TCP message or a new message header of the tunnel message.

S302. The network device detects the service message according to the second security detection rule; if the service message has a second security risk, the network device generates threat log data carrying the device identifier of the SDP client.

Specifically, the network device extracts threat features from the service message according to the second security detection rule; if the threat features are extracted, the network device matches the threat features with the threat features in the pre-stored second security risk library; if the match is successful, the network device determines that the service message has the second security risk, and the SDP proxy gateway generates threat log data carrying the device identifier of the SDP client. If the threat features are not extracted or the extracted threat features do not match the threat features in the pre-stored second security risk library, it is determined that the service message does not have the second security risk, and the SDP proxy gateway does not generate threat log data.

Optionally, the second security detection rule is implemented based on an IPS detection algorithm, a DPI detection algorithm, or an AV detection algorithm. Of course, the security detection rule can also be implemented by other algorithms, which are not limited here.

Optionally, the second security risk is a security risk detected by network devices such as firewalls and security gateways through IPS, DPI, file scanning, etc., for example, a business message carries a virus file or other security risk.

S303: The network device sends threat log data to the data analysis device.

In the solution of the embodiment of the present application, by carrying the device identification of the SDP client in the business message, the subsequent data analysis device can trace the source based on the device identification of the SDP client after determining that the business message has a security risk, thereby tracing the source of the threat event, and tracing the source to the specific user, solving the problem that the security risk cannot be traced in the NAT scenario. The network device detects whether the business message has a second security risk, and the data analysis device does not need to detect whether the business message has a second security risk, reducing the workload of the data analysis device. In addition, the solution of the present application is a combination of the zero-trust solution and the solution of the security big data analysis platform, which can solve customer pain points without increasing customer budget costs, so as to enhance the competitiveness of the solution and increase the stickiness of the solution.

See Figure 4, which is an interactive flow diagram of a threat event tracing method provided in an embodiment of the present application. The method is applied to the system architecture shown in Figure 1. As shown in Figure 4, the method includes:

S401. The SDP client sends an authentication message to the SDP controller.

The authentication message carries the device identifier of the SDP client.

In one example, the authentication message carries trusted asset information, which includes but is not limited to the source IP of the SDP client, the device identification of the SDP client, and a list of accessible ports.

In one example, the authentication message is sent through the TCP protocol, and the device identifier of the SDP client is carried in a newly added option field of the TCP SYN message.

S402: After the authentication is successful, the SDP controller generates a user information table.

After receiving the authentication message from the SDP controller, the SDP controller performs identity verification on the authentication system according to the device identification of the SDP client; after the identity verification passes, the SDP controller generates a user information table corresponding to the SDP client.

In one example, the user information table includes the device identifier of the SDP client, the user identifier, the authentication timestamp, the IP address before NAT, and the IP address after NAT. Of course, the user information table can also include other information of the SDP client, which is not limited here. Among them, there is a corresponding relationship between the device identifier and the user identifier of the SDP client in the user information table, and between the user identifier and the authentication timestamp.

The device identifier of the SDP client is a unique identifier of the SDP client. In one example, the device identifier of the SDP client is generated according to a universally unique identifier (UUID) algorithm. Specifically, the device identifier of the SDP client is generated based on the hardware information of the SDP client through the UUID algorithm. The hardware information includes but is not limited to the network card of the SDP client. The physical address of the SDP client, the hard disk information, CPU information, counter information, etc.

The user ID refers to the ID of the user who uses the SDP client to perform SDP authentication.

The authentication timestamp is the time when the SDP client passes the authentication. This timestamp can be used to determine the time when the SDP client authenticates and goes online.

After authentication, the SDP controller sends trusted asset information to the SDP proxy gateway. The trusted asset information includes but is not limited to the source IP of the SDP client, the device identifier of the SDP client, and the list of accessible ports. At the same time, the SDP controller sends a resource list to the SDP client, which includes information about the resources accessible to the SDP client.

S403: The SDP client sends a service message to the SDP proxy gateway.

Among them, the application that the SDP client wants to access through the service message is the resource that the SDP client can access.

Optionally, the service message sent by the SDP client to the SDP proxy gateway is a TCP message or a tunnel message.

In one example, the SDP client establishes a TCP connection with the SDP proxy gateway, and then sends a first TCP message to the SDP proxy gateway, wherein the device identifier of the SDP client is carried in a newly added option field of the first TCP message.

In another example, the SDP client encapsulates a new message header based on the second TCP message or UDP message, and the message header carries the device identifier of the SDP client. The new message header and the second TCP message or UDP message constitute a tunnel message. It should be understood that the second TCP message or UDP message here does not carry the device identifier of the SDP client. The second TCP message or UDP message here is used for the SDP client to access the application server.

Optionally, the tunnel message is an SRv6 message or an MPLS message, wherein SRv6 is a segment routing technology under IPv6.

Optionally, the SDP client first encrypts the device identifier of the SDP client, and then carries the encrypted information in a newly added option field of the first TCP message or in a new message header of the tunnel message.

S404: The SDP proxy gateway forwards the service message to the application server through the routing device.

After receiving the service message, the SDP proxy gateway will verify the legitimacy of the SDP client that sent the service message; if the device identification and/or source IP of the SDP client that sent the service message belongs to the trusted asset information, the SDP proxy gateway will forward the service message to the corresponding application server. The SDP proxy gateway forwards the service message to the application server through the port in the accessible port list.

It should be understood that the SDP proxy gateway transmits the service message to the application server through the router. The SDP proxy gateway transmits the service message to the application server through the router according to the preset routing forwarding strategy. Optionally, the preset routing forwarding strategy is the shortest path priority strategy or the shortest delay strategy. Of course, the SDP proxy gateway forwards the service message to the application server through other forwarding strategies, which are not limited here.

S405. The routing device mirrors the traffic to the probe device.

It should be noted that the traffic here is the traffic generated by the SDP proxy gateway forwarding the service message to the application server. When the traffic passes through the routing device, the routing device copies the traffic passing through, and then transmits the copied traffic to the probe device, thereby achieving the purpose of mirroring the traffic to the probe device. It should be understood that the routing device mirrors the passing traffic to the probe device, which is essentially sending the service message to the probe device.

S406: The probe device generates metadata of the service message carrying the device identifier of the SDP client according to the service message.

In an example, after the probe device obtains the service message, it analyzes the service message to obtain the device identification of the SDP client, the source IP, destination IP, source port, destination port and protocol of the service message; the probe device generates metadata of the service message based on the device identification of the SDP client, the source IP, destination IP, source port, destination port and protocol of the service message, and the metadata of the service message includes the device identification of the SDP client, the source IP, destination IP, source port, destination port and protocol of the service message.

In one example, after the probe device obtains the business message, if the probe device turns on the security detection function, the probe device extracts the threat feature of the business message according to the second security detection rule; if the threat feature is extracted, the probe device matches the threat feature with the threat feature in the pre-stored second security risk library; if the match is successful, the probe device determines that the business message has a second security risk, and the probe device generates threat log data carrying the device identifier of the SDP client, and sends the threat log data to the data analysis device. After receiving the threat log data, the data analysis device generates a threat event including the device identifier of the SDP client. At this time, S406-S408 do not need to be executed, and the data analysis device executes S409 and S410. If the threat feature is not extracted or the extracted threat feature does not match the threat feature in the pre-stored second security risk library, it is determined that the business message does not have the second security risk, and the SDP proxy gateway does not generate threat log data. At this time, it is necessary to further determine whether the business message has the first security risk, and S407-S410 are executed.

S407: The probe device sends metadata of the service message to the data analysis device.

S408: The data analysis device performs security detection on metadata of the service message.

Specifically, the data analysis device performs a security check on the metadata of the business message according to the first security detection rule to determine whether the business message has a first security risk. In one example, the data analysis device analyzes the traffic data received by the data analysis device according to the first security detection rule to determine whether the business message has a first security risk. Among them, the traffic data received by the data analysis device includes the metadata of the business message. If it is determined that the business message has a first security risk, the data analysis device obtains the device identifier of the SDP client from the metadata of the business message, and generates a threat event carrying the device identifier of the SDP controller.

Optionally, the first security risk is a risk analyzed by the data analysis device based on the metadata of the business message, such as a zero-day threat or other security risk. By analyzing the metadata from a large number of probes, the data analysis device may be able to discover some new risks that cannot be identified by existing rules based on message features. It should be understood that the first security risk is different from the second security risk, and the first security detection rule is different from the second security detection rule.

S409: The data analysis device sends a query request to the SDP controller.

S410. The SDP controller sends a response message to the data analysis device.

It should be noted that the specific implementation process of S409 and S410 refers to the relevant description in S203, which will not be described here. The beneficial effects of the solution of the embodiment shown in FIG4 refer to the relevant description in S201-S203.

See Figure 5, which is an interactive flow diagram of another threat event tracing method provided in an embodiment of the present application. The method is applied to the system architecture shown in Figure 1. As shown in Figure 5, the method includes:

S501. The SDP client sends an authentication message to the SDP controller.

S502: After the authentication is successful, the SDP controller generates a user information table.

S503: The SDP client sends a service message to the SDP proxy gateway.

It should be pointed out here that the specific implementation process of S501-S503 can refer to the relevant description of S401-S403, which will not be described here.

S504: The SDP proxy gateway performs a security check on the service message according to the second security check rule.

In one possible implementation, if the SDP proxy gateway turns on the security detection function, the SDP proxy gateway extracts threat features from the business message according to the second security detection rule; if the threat features are extracted, the SDP proxy gateway matches the threat features with the threat features in the pre-stored second security risk library; if the match is successful, the SDP proxy gateway determines that the business message has a second security risk, and the SDP proxy gateway generates threat log data carrying the device identifier of the SDP client. If the threat features are not extracted or the extracted threat features do not match the threat features in the pre-stored second security risk library, it is determined that the business message does not have a second security risk, and the SDP proxy gateway does not generate threat log data. At this time, the business message will be mirrored to the probe device.

Optionally, the second security detection rule is implemented based on an IPS detection algorithm, a DPI detection algorithm, or an AV detection algorithm. Of course, the second security detection rule can also be implemented by other algorithms, which are not limited here.

Optionally, the second security risk is a security risk detected by network devices such as firewalls and security gateways through IPS, DPI, file scanning, etc., for example, a business message carries a virus file or other security risk.

S505. The SDP proxy gateway sends the threat log data to the data analysis device.

S506: The data analysis device generates a threat event based on the threat log data.

After receiving the threat log data, the data analysis device determines that the service message has a second security risk, obtains the device identification of the SDP client from the threat log data, and generates a threat event carrying the device identification of the SDP client.

S507: The data analysis device sends a query request to the SDP controller.

S508. The SDP controller sends a response message to the data analysis device.

It should be noted that the specific implementation process of S507 and S508 refers to the relevant description in S203, which will not be described here. The beneficial effects of the solution of the embodiment shown in FIG5 refer to the relevant description in S201-S203.

6 is a schematic diagram of the structure of a data analysis device provided in an embodiment of the present application. The data analysis device is the data analysis device 105 in FIG1 . As shown in FIG6 , the data analysis device 105 includes an acquisition unit 1051 , a generation unit 1052 and a transceiver unit 1053 .

The acquisition unit 1051 is used to acquire the traceability data of the service message, where the service message is a message generated when the SDP client accesses the application server, and the traceability data of the service message includes the device identifier of the SDP client;

The generating unit 1052 is used to generate a threat event carrying a device identifier of the SDP client according to the traceability data of the service message when there is a security risk in the service message;

The transceiver unit 1053 is used to obtain a first user identifier corresponding to the device identifier of the SDP client from the user information table of the SDP controller according to the device identifier of the SDP client, wherein the first user identifier is used to indicate a user corresponding to the threat event, and the user information table includes a correspondence between the device identifier of the SDP client and the first user identifier.

In a possible implementation, the security risk includes a first security risk, the traceability data of the service message is metadata of the service message, the metadata of the service message is generated by the probe device based on the service message, and the data analysis device 105 further includes:

The analyzing unit 1054 is configured to analyze the metadata of the service message according to the first security detection rule to determine whether the service message has a first security risk.

In a possible implementation, the security risk includes a second security risk, the traceability data of the business message is threat log data, and the threat Log data is generated by the network device when it determines that a service message has a second security risk.

In a possible implementation, the transceiver unit 1053 is specifically configured to:

A query request is sent to the SDP controller, the query request carries the device identifier of the SDP client, and the query request is used by the SDP controller to query the user information table to obtain a first user identifier corresponding to the device identifier of the SDP client; and a response message in response to the query request is received from the SDP controller, the response message carries the first user identifier corresponding to the device identifier of the SDP client.

In a possible implementation, the user information table further includes a correspondence between the first user identifier and the authentication timestamp, the authentication timestamp is the time when the user indicated by the first user identifier passes the authentication, when the response message includes multiple first user identifiers, the response message also includes the authentication timestamps corresponding to the multiple first user identifiers, and the acquisition unit 1051 is further used to:

A second user identifier is selected from multiple first user identifiers according to the sending time period of the business message and the authentication timestamps corresponding to the multiple first user identifiers; wherein the second user identifier is the first user identifier among the multiple first user identifiers whose authentication timestamp belongs to the sending time period; the sending time period is determined according to the moment when the data analysis device receives the traceability data of the business message.

It is worth pointing out that, among them, the specific functional implementation method of the data analysis device 105 refers to the description of the above-mentioned threat event tracing method, such as the acquisition unit 1051, the transceiver unit 1053 and the analysis unit 1054 are used to execute the relevant contents of S201 and S203. Each unit or module in the data analysis device 105 can be separately or completely combined into one or several other units or modules to constitute, or one (some) of the units or modules can be further divided into multiple smaller units or modules to constitute, which can achieve the same operation without affecting the realization of the technical effects of the embodiments of the present invention. The above-mentioned units or modules are divided based on logical functions. In practical applications, the functions of one unit (or module) are implemented by multiple units (or modules), or the functions of multiple units (or modules) are implemented by one unit (or module).

7 is a schematic diagram of a network device according to an embodiment of the present application. The network device is the SDP proxy gateway 103 or the probe device 104 in FIG1 . As shown in FIG7 , the network device 700 includes a transceiver unit 701 , a detection unit 702 and a generation unit 703 .

The transceiver unit 701 is used to receive a service message, where the service message is a message generated when the SDP client accesses the application server, and the service message carries a device identifier of the SDP client;

A detection unit 702, configured to perform a security detection on the service message according to a second security detection rule to determine whether the service message has a second security risk;

The generating unit 703 is configured to generate threat log data carrying a device identifier of the SDP client if it is determined that the service message has a second security risk;

The transceiver unit 701 is also used to send threat log data to the data analysis device 105 .

Optionally, the network device 700 is an SDP proxy gateway 103 or a probe device 104 .

In a possible implementation, the service message is a TCP message or a tunnel message.

It is worth pointing out that, the specific functional implementation of the network device 700 refers to the description of the above-mentioned threat event tracing method, for example, the transceiver unit 701 is used to execute the relevant contents of S301 and S303, and the detection unit 702 and the generation unit 703 are used to execute the relevant contents of S302. Each unit or module in the network device 700 can be separately or completely combined into one or several other units or modules to form, or one (some) of the units or modules can be further divided into multiple smaller units or modules to form, which can achieve the same operation without affecting the realization of the technical effects of the embodiments of the present invention. The above-mentioned units or modules are divided based on logical functions. In practical applications, the functions of one unit (or module) are implemented by multiple units (or modules), or the functions of multiple units (or modules) are implemented by one unit (or module).

Based on the description of the above method embodiment and the related device embodiment, please refer to Figure 8, the embodiment of the present invention also provides a structural schematic diagram of a data analysis device 800. The data analysis device 800 shown in Figure 8 (the data analysis device 800 is specifically a computer device) includes a memory 801, a processor 802, a communication interface 803 and a bus 804. Among them, the memory 801, the processor 802, and the communication interface 803 are connected to each other through the bus 804.

Optionally, memory 801 is a read-only memory (ROM), a static storage device, a dynamic storage device or a random access memory (RAM).

The memory 801 can store programs. When the program stored in the memory 801 is executed by the processor 802, the processor 802 and the communication interface 803 are used to execute each step of the threat event tracing method of the embodiment shown in FIG. 2 .

The processor 802 uses a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), a graphics processing unit (GPU) or one or more integrated circuits to execute relevant programs to implement the functions required to be performed by the units in the data analysis device 105 of the embodiment of the present application. Or execute the threat event tracing method of the method embodiment of the present application.

The processor 802 can also be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the threat event tracing method of the present application can be completed by the hardware integrated logic circuit or software instructions in the processor 802. Optionally, the processor 802 is a general-purpose processor, a digital signal processor (Digital Signal Processing, DSP), an ASIC, a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The processor 802 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor is a microprocessor or the processor is any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor to execute, or a combination of hardware and software modules in the decoding processor to execute. Optionally, the software module is located in a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register or other mature storage media in the art. The storage medium is located in the memory 801, and the processor 802 reads the information in the memory 801, and combines its hardware to complete the functions required to be performed by the units included in the data analysis device 105 of the embodiment of the present application, or executes the threat event tracing method of the embodiment shown in Figure 2.

The communication interface 803 uses a transceiver such as, but not limited to, a transceiver to implement communication between the data analysis device 800 and other devices (such as the SDP controller 102 and the SDP proxy gateway 103 shown in FIG. 1 ) or a communication network. For example, the data analysis device 800 can obtain threat log data from the SDP proxy gateway 103 through the communication interface 803.

The bus 804 may include a path for transmitting information between various components of the data analysis device 800 (eg, the memory 801 , the processor 802 , and the communication interface 803 ).

Optionally, the data analysis device 800 further includes a display 806 and an input device 805 . The display 806 and the input device 805 are connected to other devices in the data analysis device 800 via a bus 804 .

The display 806 is a liquid crystal display (LCD), an organic light-emitting diode (OLED) display or other types of displays. The display 806 displays threat events and user identification.

The input device 805 is a keyboard, a mouse, a voice acquisition device or a video acquisition device. The staff can control the data analysis device 800 through the input device 805.

It should be noted that although the data analysis device 800 shown in FIG8 only shows a memory, a processor, and a communication interface, in the specific implementation process, those skilled in the art should understand that the data analysis device 800 also includes other devices necessary for normal operation. At the same time, according to specific needs, those skilled in the art should understand that the data analysis device 800 may also include hardware devices for implementing other additional functions. In addition, those skilled in the art should understand that the data analysis device 800 may also include only the devices necessary for implementing the embodiments of the present application, without having to include all the devices shown in FIG8.

Based on the description of the above method embodiment and the related device embodiment, please refer to Figure 9, the embodiment of the present invention also provides a schematic diagram of the structure of a network device 900. The network device 900 shown in Figure 9 includes a memory 901, a processor 902, a communication interface 903 and a bus 904. Among them, the memory 901, the processor 902, and the communication interface 903 are connected to each other through the bus 904.

Optionally, the memory 901 is a ROM, a static storage device, a dynamic storage device or a RAM.

The memory 901 can store programs. When the program stored in the memory 901 is executed by the processor 902, the processor 902 and the communication interface 903 are used to execute each step of the threat event tracing method of the embodiment shown in FIG. 3 .

The processor 902 uses a general-purpose CPU, a microprocessor, an application-specific integrated circuit ASIC, a GPU or one or more integrated circuits to execute relevant programs to implement the functions required to be performed by the units in the SDP proxy gateway 103 of the embodiment shown in Figure 1, or to execute the threat event tracing method of the method embodiment of the present application.

The processor 902 can also be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the threat event tracing method of the present application can be completed by the hardware integrated logic circuit or software instructions in the processor 902. Optionally, the processor 902 is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component. The processor can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor is a microprocessor or the processor is any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor to execute, or a combination of hardware and software modules in the decoding processor to execute. The optional software module is located in a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register or other mature storage medium in the art. The storage medium is located in the memory 901, and the processor 902 reads the information in the memory 901, and combines its hardware to complete the functions required to be performed by the units included in the threat event tracing related equipment of the embodiment of the present application, or executes the threat event tracing method of the method embodiment of the present application.

The communication interface 903 uses, for example but not limited to, a transceiver and other transceiver-related devices to implement communication between the network device 900 and other devices (such as the SDP client 101 and the data analysis device 105 in the embodiment shown in FIG. 1 ) or a communication network. The proxy gateway 103 , the SDP proxy gateway 103 can receive the service message sent by the SDP client 101 through the communication interface 903 , and can also send the threat log data of the service message to the data analysis device 105 .

The bus 904 may include a path for transmitting information between various components of the network device 900 (eg, the memory 901 , the processor 902 , and the communication interface 903 ).

Optionally, the network device 900 further includes a display 906 and an input device 905 . The display 906 and the input device 905 are connected to other devices in the network device 900 via the bus 904 .

The display 906 is an LCD, an OLED display, or other types of displays.

The input device 905 is a keyboard, a mouse, a voice acquisition device or a video acquisition device. The staff can control the network device 900 through the input device 905.

It should be noted that although the network device 900 shown in FIG. 9 only shows a memory, a processor, and a communication interface, in the specific implementation process, those skilled in the art should understand that the network device 900 also includes other devices necessary for normal operation. At the same time, according to specific needs, those skilled in the art should understand that the network device 900 may also include hardware devices for implementing other additional functions. In addition, those skilled in the art should understand that the network device 900 may also only include the devices necessary for implementing the embodiments of the present application, and does not necessarily include all the devices shown in FIG. 9.

An embodiment of the present application further provides a chip, which includes a processor and a data interface. The processor reads instructions stored in a memory through the data interface to implement the threat event tracing method of the embodiment of the present application.

Optionally, as an implementation method, the chip also includes a memory, in which instructions are stored, and the processor is used to execute the instructions stored in the memory. When the instructions are executed, the processor is used to execute the threat event tracing method.

An embodiment of the present application also provides a computer-readable storage medium, which stores instructions. When the computer-readable storage medium is executed on a computer or a processor, the computer or the processor executes one or more steps in any of the above methods.

The embodiment of the present application further provides a computer program product including instructions. When the computer program product is executed on a computer or a processor, the computer or the processor executes one or more steps in any of the above methods.

Those skilled in the art will appreciate that the functions described in conjunction with the various illustrative logic blocks, modules, and algorithm steps disclosed herein can be implemented by hardware, software, firmware, or any combination thereof. If implemented in software, the functions described by the various illustrative logic blocks, modules, and steps may be stored or transmitted as one or more instructions or codes on a computer-readable medium and executed by a hardware-based processing unit. Computer-readable media may include computer-readable storage media, which corresponds to tangible media, such as data storage media, or includes any communication media that facilitates the transfer of computer programs from one place to another (e.g., based on a communication protocol). In this manner, computer-readable media may generally correspond to (1) non-temporary tangible computer-readable storage media, or (2) communication media, such as signals or carrier waves. Data storage media may be any available media that can be accessed by one or more computers or one or more processors to retrieve instructions, codes, and/or data structures for implementing the techniques described in this application. A computer program product may include computer-readable media.

As an example and not limitation, such computer-readable storage media include RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage, flash memory, or any other media that can be used to store desired program code in the form of instructions or data structures and can be accessed by a computer. Also, any connection is properly referred to as a computer-readable medium. For example, if instructions are transmitted from a website, server or other remote source using a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio and microwave, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio and microwave are included in the definition of media. However, it should be understood that the computer-readable storage media and data storage media do not include connections, carriers, signals or other temporary media, but are actually directed to non-temporary tangible storage media. As used herein, disk and disc include compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), and Blu-ray disc, where disks usually reproduce data magnetically, while discs reproduce data optically with lasers. Combinations of the above should also be included within the scope of computer-readable media.

Instructions may be executed by one or more processors, such as one or more DSPs, general purpose microprocessors, ASICs, FPGAs, or other equivalent integrated or discrete logic circuits. Thus, the term "processor" as used herein may refer to any of the aforementioned structures or any other structures suitable for implementing the techniques described herein. Additionally, in some aspects, the functions described by the various illustrative logic blocks, modules, and steps described herein are provided within dedicated hardware and/or software modules configured for encoding and decoding, or incorporated in a combined codec. Moreover, the techniques may be fully implemented in one or more circuits or logic elements.

In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the division of the unit is only a logical function division, and there are other division methods in actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Optionally, the mutual coupling, direct coupling, or communication connection shown or discussed is an indirect coupling or communication connection through some interfaces, devices or units, such as electrical sexual, mechanical or other form.

Optionally, the units described as separate components are or are not physically separated, and the components shown as units are or are not physical units, i.e. located in one place, or distributed over multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function according to the embodiment of the present application is generated in whole or in part.

The above is only a specific implementation of the embodiment of the present application, but the protection scope of the embodiment of the present application is not limited thereto, and any changes or replacements within the technical scope disclosed in the embodiment of the present application should be included in the protection scope of the embodiment of the present application. Therefore, the protection scope of the embodiment of the present application should be based on the protection scope of the claims.

Claims (19)

A threat event tracing method, characterized in that it is applied to a data analysis device, and the method comprises: Acquire the traceability data of the service message, where the service message is a message generated when the software-defined boundary SDP client accesses the application server, and the traceability data of the service message includes the device identifier of the SDP client; When there is a security risk in the service message, generating a threat event carrying the device identification of the SDP client according to the traceability data of the service message; According to the device identifier of the SDP client, a first user identifier corresponding to the device identifier of the SDP client is obtained from the user information table of the SDP controller, wherein the first user identifier is used to indicate a user corresponding to the threat event, and the user information table includes a correspondence between the device identifier of the SDP client and the first user identifier. The method according to claim 1 is characterized in that the security risk includes a first security risk, the traceability data of the business message is metadata of the business message, the metadata of the business message is generated by a probe device based on the business message, and the method further includes: The metadata of the business message is analyzed according to the first security detection rule to determine whether the business message has the first security risk. The method according to claim 1 is characterized in that the security risk includes a second security risk, the traceability data of the business message is threat log data, and the threat log data is generated by the network device when it is determined that the business message has the second security risk. The method according to any one of claims 1 to 3 is characterized in that obtaining the first user identifier corresponding to the device identifier of the SDP client from the user information table of the SDP controller according to the device identifier of the SDP client comprises: Sending a query request to the SDP controller, the query request carrying the device identifier of the SDP client, the query request being used by the SDP controller to query the user information table to obtain a first user identifier corresponding to the device identifier of the SDP client; A response message fed back by the SDP controller in response to the query request is received, where the response message carries a first user identifier corresponding to the device identifier of the SDP client. The method according to claim 4 is characterized in that the user information table further includes a correspondence between the first user identifier and an authentication timestamp, the authentication timestamp being the moment when the user indicated by the first user identifier passes the authentication, and when the response message includes multiple first user identifiers, the response message further includes authentication timestamps corresponding to the multiple first user identifiers respectively, and the method further includes: Selecting a second user identifier from the plurality of first user identifiers according to a sending period of the service message and authentication timestamps respectively corresponding to the plurality of first user identifiers; The second user identifier is the first user identifier among the multiple first user identifiers whose authentication timestamp belongs to the sending time period, and the sending time period is determined according to the moment when the data analysis device receives the traceability data. A threat event tracing method, characterized in that the method is applied to a network device, and the method comprises: Receive a service message, where the service message is a message generated when a software defined boundary SDP client accesses an application server, and the service message carries a device identifier of the SDP client; Performing a security check on the service message according to the second security check rule to determine whether the service message has a second security risk; if it is determined that the service message has a second security risk, generating threat log data carrying a device identifier of the SDP client; The threat log data is sent to a data analysis device. The method according to claim 6 is characterized in that the network device is an SDP proxy gateway or a probe device. A data analysis device, characterized in that the data analysis device comprises: An acquisition unit, used to acquire traceability data of a service message, wherein the service message is a message generated when a software-defined boundary SDP client accesses an application server, and the traceability data of the service message includes a device identifier of the SDP client; A generating unit, configured to generate a threat event carrying a device identifier of the SDP client according to the traceability data of the service message when there is a security risk in the service message; A transceiver unit is used to obtain a first user identifier corresponding to the device identifier of the SDP client from a user information table of the SDP controller according to the device identifier of the SDP client, wherein the first user identifier is used to indicate a user corresponding to the threat event, and the user information table includes a correspondence between the device identifier of the SDP client and the first user identifier. The data analysis device according to claim 8, characterized in that the security risk includes a first security risk, the traceability data of the business message is metadata of the business message, the metadata of the business message is generated by a probe device based on the business message, and the data analysis device further includes: An analyzing unit is used to analyze the metadata of the business message according to a first security detection rule to determine whether the business message has the first security risk. The data analysis device according to claim 8 is characterized in that the security risk includes a second security risk, the traceability data of the business message is threat log data, and the threat log data is generated by the network device when it is determined that the business message has the second security risk. The data analysis device according to any one of claims 8 to 10, characterized in that the transceiver unit is specifically used for: Sending a query request to the SDP controller, the query request carrying the device identifier of the SDP client, the query request being used by the SDP controller to query the user information table to obtain a first user identifier corresponding to the device identifier of the SDP client; A response message fed back by the SDP controller in response to the query request is received, where the response message carries a first user identifier corresponding to the device identifier of the SDP client. The data analysis device according to claim 11 is characterized in that the user information table also includes a correspondence between the first user identifier and an authentication timestamp, the authentication timestamp is the time when the user indicated by the first user identifier passes the authentication, when the response message includes multiple first user identifiers, the response message also includes authentication timestamps corresponding to the multiple first user identifiers, and the acquisition unit is specifically used to: Selecting a second user identifier from the plurality of first user identifiers according to a sending period of the service message and authentication timestamps respectively corresponding to the plurality of first user identifiers; The second user identifier is the first user identifier among the multiple first user identifiers whose authentication timestamp belongs to the sending time period, and the sending time period is determined according to the moment when the data analysis device receives the traceability data. A network device, comprising: A transceiver unit, configured to receive a service message, wherein the service message is a message generated when a software defined boundary SDP client accesses an application server, and the service message carries a device identifier of the SDP client; A detection unit, configured to perform a security detection on the service message according to a second security detection rule to determine whether the service message has a second security risk; a generating unit, configured to generate threat log data carrying a device identifier of the SDP client if it is determined that the service message has the second security risk; The transceiver unit is also used to send the threat log data to the data analysis device. The network device according to claim 13 is characterized in that the network device is an SDP proxy gateway or a probe device. A threat event tracing system, characterized in that the system includes a data analysis device, a network device, a software defined boundary SDP client and an SDP controller; The data analysis device is used to perform the method according to any one of claims 1 to 5; The network device is used to perform the method according to claim 6 or 7; The SDP controller is used to receive a query request sent by the data analysis device, the query request carrying the device identifier of the SDP client; query a user information table according to the device identifier of the SDP client to obtain a first user identifier corresponding to the device identifier of the SDP client; send a response message in response to the query request to the data analysis device, the response message carrying the first user identifier corresponding to the device identifier of the SDP client; the user information table includes a correspondence between the device identifier of the SDP client and the first user identifier. The system according to claim 15, characterized in that the user information table further includes a correspondence between the first user identifier and an authentication timestamp, the authentication timestamp being the time when the user indicated by the first user identifier passes the authentication; and the SDP controller is further used to: When there are multiple first user identifiers, query the user information table according to the multiple first user identifiers to obtain authentication timestamps corresponding to the multiple first user identifiers respectively; The response message also includes authentication timestamps corresponding to the multiple first user identifiers respectively. A data analysis device, characterized in that it includes a processor and a memory, wherein the memory is used to store program code, and the processor is used to execute the program code to implement the method described in any one of claims 1 to 5. A network device, characterized in that it includes a processor and a memory, wherein the memory is used to store program code, and the processor is used to execute the program code to implement the method described in any one of claims 6 to 7. A computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described in any one of claims 1 to 7 is implemented.