CN115378793A - HIDS alarm tracing method based on system audit log - Google Patents

Abstract

The invention discloses a HIDS alarm traceability method based on system audit logs, which includes: collecting HIDS original alarm logs and system audit logs from a host and preprocessing; The system entity associates the two logs, and adds alarm marks to the events in the associated system audit log; in the global system audit log, all marked events are traced according to the causal relationship to form an event sequence; The sequence is scored, and the sequence exceeding a certain threshold is converted into the final alarm output. Compared with the original alarm of HIDS, it can provide the context information of the alarm point, realize the traceability of the alarm, and reduce the workload of manual analysis.

Description

A HIDS Alarm Traceability Method Based on System Audit Log

technical field

The invention relates to the field of host intrusion behavior analysis, and more specifically, relates to a HIDS alarm traceability method based on system audit logs.

Background technique

Host Intrusion Detection System (HIDS for short) represented by OSSEC is often used to monitor host behavior. This type of HIDS can perform host log analysis, file integrity detection, and rootkit detection. In essence, HIDS such as OSSEC matches various input logs or detection results regularly executed by HIDS according to predefined rules. If the rules match the corresponding content, corresponding alarm information will be generated. A rule can set a risk level for an alarm, and an alarm with a higher risk level means that the intrusion behavior is more serious, or the intrusion behavior is more likely to occur.

However, the alarms generated in this way often represent isolated events, lack of correlation information between each other, and the value of the alarm information provided to analysts is not high, and because the rules of low-level alarms are relatively loose, they are easier to trigger, so when an intrusion occurs, often A large number of alarms will be generated, which not only takes up system space, but also increases the workload of analysts. Even if there is no intrusion, low trigger conditions may lead to many low-risk false alarms.

In order to alleviate these problems, the existing technologies mainly find the intrusion point by matching and colliding the system audit log with the pre-configured rules, and then trace the source of the intrusion point in the system audit log, and then pass a series of threat assessment methods to reduce false positives. However, the rules configured by many methods are usually limited to the matching collisions of the system audit logs used to build causality, and the alarms based on other log sources or the alarms generated by the detection regularly performed by HIDS lack attention.

Contents of the invention

Technical problem of the present invention: in order to overcome the deficiencies in the prior art, provide a kind of HIDS alarm traceability method based on system audit log, improve the value of host computer intrusion detection alarm (value can be considered as alarm can be provided to security personnel to trigger alarm related events The amount of information, the higher the amount of information provided, the more fully the security personnel can understand the alarm event), so that it has better interpretability (the interpretability meaning is the difficulty that the alarm is understood by the security personnel, and the present invention provides The ins and outs of the alarm information and event information make it easier for security personnel to understand why the alarm is triggered and what consequences may have occurred), accuracy, while effectively reducing the number of alarms, avoiding false positives, which can effectively reduce manual workload.

In order to achieve the above object, the present invention comprises the following steps:

A kind of HIDS alarm traceability method based on the system audit log of the present invention is applied to host intrusion detection alarm analysis, comprising the following steps:

(1) HIDS alarm and system audit log are processed into a data format containing specified content, and the global alarm A and global system audit log E after processing are obtained; the system refers to the operating system, such as Windows, Linux, and this type of log is usually in The kernel layer records the process behavior, and the global system audit log E means all, that is, the system audit log with complete records;

(2) Correlate each alarm a in the global alarm A with the system audit event e in the global system audit log E to obtain an event list matched_list with an alarm flag;

(3) Starting from the events in the event list matched_list, use causality in the global system audit log E to trace forward and trace back to the source, obtain the event sequence associated with the alarm, and save it in the sequence list seq_list;

(4) In combination with the information of the alarm associated with the event in the event sequence, according to the sequence scoring mechanism, score each sequence in the event sequence seq_list to obtain the sequence scoring result; the sequence scoring result exceeds the set threshold Transition to final alarm output;

Wherein, the data format described in the step (1) includes the corresponding system audit event format in the alarm format and the system audit log, wherein:

The alarm format contains {id, timestamp, data, rule}

id is used to index and identify alarms;

timestamp represents the timestamp when the alarm is generated;

data contains the specific content of the alarm, including at least two parts: data.entity and data.description:

data.entity is information about the system entity that triggers the alarm. The system entities include files, network connections, and processes. For the Windows system, the registry is also a type of system entity. The contents of data.entity in alarms triggered by different types of system entities are different. Specifically, for the alarm triggered by the file type system entity, data.entity contains the path information of the file; for the alarm triggered by the network connection type system entity, data.entity contains the domain name or IP and port information of the network connection; For alarms triggered by process-type system entities, data.entity contains process ID and process name information; for alarms generated by registry-type system entities in Windows systems, data.entity contains key and value information of the corresponding registry.

data.description is the description information of the alarm content.

rule represents the rules related to the alarm, that is, the rule triggered by the alarm, which is a pattern predefined by HIDS. When the events in the system match these patterns, the alarm is triggered;

A rule contains at least the following information {rule.id, rule.type, rule.level}, where rule.id represents the unique identifier of the rule, which is used to quickly locate the rule, and rule.type represents the type of rule corresponding to the alarm, that is, real-time matching or Periodic detection, the real-time matching means that the rule is used to match the latest log generated in the system in real time, and the alarm generated based on this type of rule will be generated immediately when an intrusion event occurs in the system, and the alarm time is synchronized with the time of the intrusion behavior. Based on this The alarms generated by such rules are real-time alarms; and the regular detection rules are used to match the detection results of the detection programs that HIDS regularly executes. The alarms generated by such rules will only be generated when HIDS performs periodic detection tasks. The alarm time is not synchronized with the occurrence time of the intrusion behavior, and the alarm generated based on this type of rule is also a regular detection alarm. rule.level represents the level of the event risk that triggers the rule, and the event risk represents the level of the possibility that the event is an intrusion behavior and the severity of the consequences after it occurs.

The id, timestamp, and subfields of data and rule in the alarm belong to the attributes of the alarm;

The collection of all processed HIDS alarms constitutes a global alarm A;

The system audit event format contains {subject, object, timestamp, operation}

subject represents the subject of the event, that is, the system entity of the initiator of the action in the event;

object represents the object of the event, that is, the system entity of the receiver of the action;

timestamp represents the timestamp information of the event;

operation represents the specific operation performed by the subject on the object. Including reading and writing of files by processes, creating sub-processes by processes, sending and receiving information of processes and remote network connections, and reading and writing of registry by processes under Windows. and other recorded operations between system entities.

The collection of all system audit events is the global system audit log E.

Compared with the existing methods, the method designed by the present invention associates general and non-specific HIDS alarms with system audit logs (steps 1 and 2), and when tracing the source of alarms based on system audit logs, the basis is The causal relationship between the system audit events can trace the root cause of the HIDS alarm and the scope affected by the alarm according to the generated event sequence (step 3). Finally, through the scoring mechanism, multiple original HIDS alarms with causal correlation will be aggregated in the same sequence as the final alarm, reducing the number of alarms.

Described step (2) specifically comprises the following steps:

(21) For an alarm a _i in the global alarm A, first judge the rule.type field of a _i , if the alarm is generated by periodic detection, then jump to (23), if it is a real-time alarm, continue (22);

(22) Find the system audit event whose time stamp is closest to a _i .timestamp in the global system audit log E and record it as e _j , if |e _j .timestamp-a _i .timestamp|＞Threshold _TS , it is considered that the matching fails, ie Unable to find the system audit event associated with a _i , then jump to (25), otherwise jump to (24), Threshold _TS is a timestamp association threshold, if the difference between timestamps is not higher than the threshold, it is considered to be the same moment ;

(23) For the alarms generated by regular detection, due to the possible untimely processing, the alarms are triggered multiple times for the same reason, so these repeated alarms need to be merged, that is, the alarms that are repeated with a _i are found in the global alarm A, And keep only one of the alarms as a _i , delete the rest of the repeated alarms; then select each event in the global system audit log E as e _j and execute (24);

(24) Determine whether the system entity involved in e _j .subject or e _j .object and the system entity corresponding to a _i .data.entity are the same system entity? If so, consider that e _j is related to a _i , connect e _j and a _i to get e _j : a _i , and add it to the matched_list, which is equivalent to adding an alarm a _i as a mark for event e _j ; No, think that e _j has nothing to do with a _i .

(25) Repeat steps (21) to (24) until the association attempt of all alarms in the global alarm A is completed, and finally the event list matched_list with alarm flags is obtained.

The matched_list retains all the events associated with the alarm and the associated alarm information, so it contains at least two columns of data, the system audit event events and the alarm alerts. Select the events column of the system audit event as the index column. Since one system audit event may be associated with multiple alarms, when adding an item e _j : a _i to the matched_list, it will first check whether there is already e in the events column _j , if it already exists, you only need to add a _i at the end of the alerts column of the row e _j , so that the row data will change from {e _j , {a _j1 , a _j2 ,...}} to { e _j , {a _j1 , a _j2 ,..., a _i }}, where a _j1 , a _j2 ,... are other alarms that e _j has already matched; and if e _j does not exist, directly set { e _j , {a _i }} is added as a new line.

Compared with the existing methods, the present invention divides HIDS alarms into alarms generated by real-time detection and alarms generated by regular execution of detection programs according to the logic of alarm generation, and according to the time characteristics of the two alarms, the system and system are designed respectively. Method for audit log matching. Therefore, the alarm scope applicable to the method is more comprehensive.

Described step (3) specifically comprises the following steps:

(31) In the global system audit log E, trace the source of a system audit event e in the matched_list backward according to the causal relationship, until the root cause event e _r with no cause event is found, and a source trace sequence {e _r ,... , e _b2 , e _b1 , e}, represents an event sequence that affects the occurrence of event e, and the number of traceable sequences finally found in E is recorded as m;

(32) Track the event e forward in the global system audit log E until the terminal event e _l with no result event is found, and a sequence of tracking sequence {e, e _f1 , e _f2 , ... e _l } is obtained , represents the event sequence affected by the e event, and the number of tracking sequences finally found in E is recorded as n;

(33) Combine and connect the found m traceability sequences and n traceability sequences to obtain m×n sequences about the event e, and save them in the sequence list seq_list;

(34) Select the next event that has not appeared in the sequence list seq_list as e in the matched_list;

(35) Repeat steps (31) to (34) until the traceability of all events involved in the matched_list is completed, and all event sequences that may be associated with the HIDS alarm are stored in the sequence list seq_list;

The causality in the steps (31) and (32) is defined as follows:

Causality: There is a causal relationship between the subject and the object in a single system audit event, but the direction of the causal relationship depends on the type of operation, reflecting the flow of information in the event; if the information in the event arrives from the subject through the operation object, subject is the cause entity, and object is the result entity; conversely, object is the cause entity, and subject is the result entity;

When there is a causal relationship between two system audit events e _c and e _e , if the result entity of e _c and the cause entity of e _e are the same system entity and e _c occurs earlier than e _e , then e _c is A cause event of e _e , e _e is a result event of e _c ;

The forward tracing and backward tracing in the steps mean:

Forward tracking: starting from an event e, looking for the operation of the subsequent result event of e;

Backward tracing: Starting from an event e, the operation of finding the previous cause event of e.

Compared with the original HIDS alarm, this step realizes the association of the alarm with the system audit event in the global system audit log, and solves the problem of the isolation and lack of association of the alarms in the original HIDS alarm.

Described step (4) is specifically as follows:

(41) Calculate the evaluation score of each sequence, the score S(seq) of the sequence seq={e ₁ , e ₂ ,...,e _n }, S(seq) is obtained by summing up the scores of all events in the sequence, namely :

The sequence seq contains n events, e _i represents the i-th event in the sequence, and its score s(e _i ) is calculated as:

Among them, f(a _j ) is the method of calculating the score contribution of alarm a _j to event e _i , that is, the calculation method of the alarm score, which is set according to the contribution of each attribute attr in the alarm to the score; each of a _j in The contribution of attribute attr is linearly combined, and the alarm scoring method is designed:

代表了第k个正贡献属性值，而

则代表了第l个负贡献属性值，M和N分别是告警a_j的正贡献属性和负贡献属性的数量；需要注意的是，对于非数值类型的属性，

和

代表了属性量化后的数值(量化就是把非数值型属性转化为数值，具体量化方法不在本专利考虑的范围内)，不考虑无法量化的属性。不同的实施例中，根据a_j具体属性的不同，f(a_j)有不同具体的计算方法。attr represents the value of the attribute in the alarm, and w represents the weight of the attr attribute,

represents the kth positive contribution attribute value, and

It represents the lth negative contribution attribute value, M and N are the number of positive contribution attributes and negative contribution attributes of alarm a _j respectively; it should be noted that for non-numeric type attributes,

and

Represents the numerical value after attribute quantification (quantization is to convert non-numeric attributes into numerical values, and the specific quantification method is not within the scope of this patent), and attributes that cannot be quantified are not considered. In different embodiments, f(a _j ) has different specific calculation methods according to different specific attributes of a _j .

Set g(e _i ) as:

Among them, c ₁ and c ₂ are constants, and their values should be set according to specific situations. Event e _f and event e _b are the first matching traces traced forward and backward from event e _i in seq to In the event of an alarm, d _f and d _b respectively represent the distance from event e _i to event e _f and event e _b in the sequence seq, that is, the number of events passed from e _i to e _f and e _b ;

(42) According to the score threshold δ, when S(seq)≥δ, convert the sequence seq into a final alarm output, the final alarm will contain the calculated S(seq), the event sequence {e ₁ , e ₂ in seq , ..., e _n }, the computed score {s(e ₁ ), s(e ₂ ), ..., s(e _n )} for each event, and the HIDS alarm conditions included in the sequence.

In the scoring mechanism designed by the present invention, the sequence score represents the probability of the degree of correlation between the event in the sequence and the alarm event, and setting the threshold can filter out which sequences are less correlated with the alarm, and the final selected event sequence is often More original alarms can be covered. This can reduce false alarms caused by accidental factors, and also reduce the number of alarms compared with the original alarm information.

The advantages of the present invention compared with prior art are as follows:

(1) The new alarm generated by the present invention has richer connotations, each alarm no longer only corresponds to an isolated system event, but provides causal event information of the alarm event, and can quickly find the root cause event of the alarm point, and The impact of the alarm event.

(2) The present invention can convert HIDS alarms and system audit logs into a relatively unified data format and then correlate them. Compared with the existing traceability methods, it can make full use of the rule matching ability of HIDS, expand the detection area, and reduce false positives rate to avoid missing traceability of regularly generated alarms.

(3) The present invention can reduce the alarm falsely triggered by accidental events by scoring the sequence of causal events, thereby reducing the false alarm rate, and since each final alarm sequence may contain multiple original alarms, it can also reduce Number of alerts.

Description of drawings

Fig. 1 is the general flowchart of the present invention;

Fig. 2 is the workflow of each module among the present invention;

Figure 3 is the preprocessed data format;

Fig. 4 is the flowchart associated with the alarm log in step 2;

Figure 5 is a schematic diagram of the sequence generated by tracing the cause and effect of an event;

Figure 6 shows the final generated alarm data format.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

The present invention is mainly carried out on the basis of a host intrusion detection system (HIDS). The so-called host intrusion detection system uses pre-defined rules to match various input logs or other information. If the rules match the corresponding content, corresponding alarm information will be generated. Generally speaking, the generated alarm information includes the trigger time of the rule, the data source of the trigger rule, the description of the alarm event, the severity level of the alarm, and other information. Generally, an alarm corresponds to one or several consecutive records in the data source. Therefore, the information contained in the alarm will not be more than that provided by the corresponding record, so the alarm is often as trivial as the original log entry.

The traceability relationship of the present invention is constructed based on system audit log information. The so-called system audit log is a log that records interactive information between various entities in the system in the operating system. System entities include files, network connections, and processes. Registry and other content, while interactive information includes reading, writing, creating, deleting, etc. Representative system audit logs include Windows Event Tracking (Event Tracing for Windows, ETW) and logs generated by Auditd under Linux. The logs generated by other programs with similar functions are also referred to as system audit logs in this application.

It should be noted that the system audit log mentioned in the present invention may also be used as an input for HIDS rule matching, and only the rules for matching the system audit log need to be configured in HIDS. When this happens, due to the alarm and traceability The information is from the same source, so simple matching can be directly performed for association.

As shown in Figure 1, the present invention comprises the following steps:

(1) process the HIDS alarm and the actual log of the system into a data format containing specified content, and obtain the processed global alarm A and the global system audit log E; the system refers to the operating system, such as Windows, Linux, and this type of log is usually in The kernel layer records the process behavior, and the global system audit log E means all, that is, the system audit log with complete records;

(2) Correlate each alarm a in the global alarm A with the event e in the global system audit log E to obtain an event list matched_list with an alarm flag;

(3) Starting from the events in the event list matched_list, use causality in the global system audit log E to trace forward and trace back to the source, obtain the event sequence associated with the alarm, and save it in the sequence list seq_list;

(4) In combination with the alarm information associated with the events in the event sequence, according to the sequence scoring mechanism, score each sequence in the event sequence seq_list to obtain a sequence score; convert the sequence whose sequence score exceeds the set threshold into the final Alarm output;

As shown in Figure 2, in the embodiment of the present invention, the HIDS alarm and the system audit log are used as the original input data. The high-level final alarm is output, and the four modules correspond to the four steps in Figure 1, as follows:

Step 1, HIDS alarm and system audit log preprocessing mainly involves the preprocessing method for HIDS alarm and system audit log:

(11) Preprocessing the collected original alarm logs generated by the rule-based HIDS. As shown in a) in Figure 3, after preprocessing, the global alarm A is composed of individual alarms a _i , where each alarm a _i contains at least these contents {id, timestamp, data, rule}, where:

id is used to index and identify alarms;

timestamp represents the timestamp when the alarm is generated;

data contains the specific content of the alarm, including at least two parts: data.entity and data.description:

data.entity is information about the system entity that triggers the alarm. The system entities include files, network connections, and processes. For the Windows system, the registry is also a type of system entity. The contents of data.entity in alarms triggered by different types of system entities are different. Specifically, for the alarm triggered by the file type system entity, data.entity contains the path information of the file; for the alarm triggered by the network connection type system entity, data.entity contains the domain name or IP and port information of the network connection; For alarms triggered by process-type system entities, data.entity contains process ID and process name information; for alarms generated by registry-type system entities in Windows systems, data.entity contains key and value information of the corresponding registry.

data.description is the description information of the alarm content.

rule represents the rule information related to the alarm, which contains at least these types of information {rule.id, rule.type, rule.level}, where rule.id represents the unique identifier of the rule, which is used to quickly locate the rule, rule .type represents the type of the corresponding rule for the alarm. In this embodiment, the alarm rule is divided into two types, one is used to match the system log in real time, and the other is to match the active detection scan results regularly executed by HIDS The real-time matching means that the rule is used to match the latest log generated in the system in real time, and the alarm generated based on this type of rule will be generated immediately when an intrusion event occurs in the system, and the alarm time is synchronized with the time when the intrusion behavior occurs, based on this The alarms generated by such rules are real-time alarms; and the regular detection rules are used to match the detection results of the detection programs that HIDS regularly executes. The alarms generated by such rules will only be generated when HIDS performs periodic detection tasks. The alarm time is not synchronized with the occurrence time of the intrusion behavior, and the alarm generated based on this type of rule is also a regular detection alarm. The rule.level represents the level of the event risk that triggers the rule, and the event risk represents the possibility of the event being an intrusion behavior and the severity of the consequences after it occurs.

The fields contained in the alarm should include but not limited to the fields described above. In this embodiment, the rule field additionally includes a rule.firedtimes subfield as an attribute of the alarm, as shown in a) in Figure 3, Its meaning is the number of times the rule is triggered to generate an alarm, which can be used as a parameter for subsequent scoring.

The id, timestamp, and subfields of data and rule in an alert are attributes of the alert.

The collection of all processed HIDS alarms constitutes the global alarm A.

(12) Preprocessing The collected system audit logs are used to construct the traceability relationship. The system audit log records the event information between system entities such as files, processes, and network connections in the host, as shown in b) in Figure 3, the preprocessed system audit log E consists of system audit events e _i (1≤ i≤n, n is the total number of system audit events in the system audit log), and each event e _i contains at least these four aspects {subject, object, timestamp, operation}. in:

subject represents the subject of the event, that is, the initiator system entity of the action in the event;

object represents the object where the event occurs, that is, the receiver system entity of the action;

timestamp represents the timestamp information of the event;

Operation represents the specific operation performed by the subject on the object. Including reading and writing of files by processes, creating sub-processes by processes, sending and receiving information of processes and remote network connections, and reading and writing of registry by processes under Windows. and other recorded operations between system entities.

Step 2. Associate each alarm a in the global alarm A with the event e in the global system audit log E to obtain an event list matched_list with an alarm flag. The process is shown in Figure 4, and the details are as follows:

(21) For an alarm a _i in the global alarm A, first judge the rule.type field of a _i , if the alarm is generated by periodic detection, then jump to (23), if it is a real-time alarm, continue (22);

(22) Find the system audit event whose time stamp is closest to a _i .timestamp in the global system audit log E and record it as e _j , if |e _j .timestamp-a _i .timestamp|＞Threshold _TS , it is considered that the matching fails, ie If the system audit event associated with a _i cannot be found, then jump to (25), otherwise jump to (24). Threshold _TS is a timestamp association threshold, if the difference of timestamps is not higher than this threshold, it can be considered as the same moment;

(23) For the alarms generated by regular detection, due to the possible untimely processing that may cause multiple alarms for the same reason, it is necessary to merge these repeated alarms, that is, find the alarm that is repeated with a _i in A, and only Keep one of the alarms as a _i , delete the rest of the repeated alarms; then select each event in the global system audit log E as e _i , and execute (24);

(24) Determine whether the system entity involved in e _j .subject or e _j .object and the system entity corresponding to a _i .data.entity are the same system entity? If so, consider that e _j is related to a _i , connect e _j and a _i to get e _j : a _i , and add it to the matched_list, which is equivalent to adding an alarm a _i as a mark for event e _j ; No, think that e _j has nothing to do with a _i .

(25) Repeat (21) to (24) until the association attempt of all alarms in A is completed. Finally, the event list matched_list with alarm flags is obtained.

The matched_list retains all the events associated with the alarm and the associated alarm information, so it contains at least two columns of data, the system audit event events and the alarm alerts. Select the events column of the system audit event as the index column. Since one system audit event may be associated with multiple alarms, when adding an item e _j : a _i to the matched_list, it will first check whether there is already e in the events column _j , if it already exists, you only need to add a _i at the end of the alerts column of the e _j row, so that the row data will change from {e _j , {a _j1 , a _j2 ,...}} to { e _j , {a _j1 , a _j2 ,..., a _i }}, where a _j1 , a _j2 ,... are other alarms that e _j has already matched; and if e _j does not exist, directly set { e _j , {a _i }} is added as a new line.

Step 3. Starting from the events in the event list matched list, use the causal relationship in the system audit log E to trace forward and trace back to the source, obtain the event sequence associated with the alarm, and save it in the sequence list seq_list, as follows;

(31) In the global system audit log E, trace the source of a system audit event e in a matched_list backward according to the causal relationship, until the root cause event e _r with no cause event is found, and a source trace sequence {e _r ,... , e _b2 , e _b1 , e}, represents an event sequence that affects the occurrence of event e, and the number of traceable sequences finally found in E is recorded as m;

(32) In the global system audit log E, the event e is traced forward according to the causal relationship, until the end event e _l with no result event is found, and a tracking sequence {e, e _f1 , e _f2 , ...e _l is obtained } represents the sequence of events affected by the e event. The number of tracking sequences finally found in E is recorded as n;

而向后溯源则找到了m个路径，分别到达了m个无法继续向后溯源的事件e_root，

需要说明的是，e_leaf，

中可能存在重复的事件，之所以重复是因为从e出发，可能存在不止1个路径到达相同的事件。同理e_root，

中也可能存在重复的事件；(33) Combine and connect the found m traceability sequences and n traceability sequences to obtain m×n sequences about the event e, and save them in the sequence list seq_list. As shown in Figure 5, starting from e to trace forward, n paths are found, and n events that cannot be traced forward are respectively reached.

However, the backward tracing finds m paths, and respectively reaches m events e _root that cannot be traced backward.

It should be noted that, e _leaf ,

There may be repeated events in , because starting from e, there may be more than one path to the same event. In the same way e _root ,

There may also be duplicate events in ;

(34) Select the next event that has not appeared in the sequence list seq_list as e in the matched_list;

(35) Repeat (31) to (34) until the traceability of all events involved in the matched_list is completed, and all event sequences that may be associated with HIDS alarms are stored in the sequence list seq_list;

The causality in the steps (31) and (32) is defined as follows:

Causality: There is a causal relationship between the subject and the object in a single system audit event, but the direction of the causal relationship depends on the type of operation, reflecting the flow of information in the event; if the information in the event arrives from the subject through the operation object, subject is the cause entity, and object is the result entity; conversely, object is the cause entity, and subject is the result entity;

When there is a causal relationship between two system audit events e _c and e _e , if the result entity of e _c and the cause entity of e _e are the same system entity and e _c occurs earlier than e _e , then e _c is A cause event of e _e , e _e is a result event of e _c ;

For the forward tracing in the steps, the backward tracing is:

Forward tracking: starting from an event e, looking for the operation of the subsequent result event of e;

Backward tracing: Starting from an event e, the operation of finding the previous cause event of e.

Step 4. Calculate the score and generate the final alarm. Since seq_list may contain a large number of event sequences, if they are all output as alarms, it may still cause a large number of alarms and a high false alarm rate. Therefore, it is necessary to select these sequences. That is, set the scoring mechanism to score the sequence. details as follows:

(41) Calculate the evaluation score of each sequence, the score S(seq), S(seq) of the sequence seq={e ₁ , e ₂ , . . . , e _n }, namely:

The sequence seq contains n events, e _i represents the i-th event in the sequence, and its score s(e _i ) is calculated as:

Among them, f(a _j ) is the method of calculating the score contribution of alarm a _j to event e _i , that is, the calculation method of the alarm score, which is set according to the contribution of each attribute attr in the alarm to the score; each of a _j in The contribution of the attribute attr is linearly combined, and the design alarm scoring method is:

代表了第k个正贡献属性值，而

则代表了第l个负贡献属性值，M和N分别是告警a_j的正贡献属性和负贡献属性的数量。需要注意的是，对于非数值类型的属性，

和

代表了属性量化后的数值，不考虑无法量化的属性。本实施例中，选取a.rule.firedtimes作为一个负贡献属性，a.rule.level作为一个正贡献属性，因此得到计算方法。attr represents the value of the attribute in the alarm, and w represents the weight of the attr attribute,

represents the kth positive contribution attribute value, and

It represents the lth negative contribution attribute value, and M and N are the numbers of positive contribution attributes and negative contribution attributes of alarm a _j respectively. It should be noted that for attributes of non-numeric types,

and

Represents the quantified value of the attribute, regardless of the attribute that cannot be quantified. In this embodiment, a.rule.firedtimes is selected as a negative contribution attribute, and a.rule.level is selected as a positive contribution attribute, so the calculation method is obtained.

Where w _lv and w _ft are the weights of the contribution of the attributes rule.level and rule.firedtimes in the alarm respectively

Set g(e _i ) as:

Among them, c ₁ and c ₂ are constants, and their values should be set according to specific situations. Event e _f and event e _b are the first events that match the alarm and are traced forward and backward from event e _i in Seq, respectively, and d _f and d _b represent event e _i in sequence seq the distance to event e _f and event e _b ;

(42) According to the score threshold δ, when S(seq)≥δ, convert the sequence seq into a final alarm output. The final alert will contain the calculated S(seq), the event sequence {e ₁ , e ₂ , ..., e _n } in seq, and the calculated score {s(e ₁ ), s(e ₂ ) for each event ,..., s(e _n )}, and the HIDS alarm conditions contained in the sequence.

The format of the final alarm in this embodiment is shown in Figure 6. The final alarm FA consists of many individual alarms {fa ₁ , fa ₂ ,...fa _i ,...}, and each alarm contains four fields {id, seq, score, description}, where:

id is used to uniquely identify the alarm.

seq represents the corresponding event sequence, and the sequence consists of 3 parts:

events records all system audit events in the sequence. As shown in Figure 6, the event sequence corresponding to fa _i starts from e _root , passes through e and finally reaches e _leaf according to the causal relationship, and the record format of each event is consistent with the format of a single event in Figure 3;

The alerts part represents the list of alerts matched by the event. If the event has no matched alerts, leave it blank. As shown in Figure 6, event e matches {a ₁ , a ₂ ,...} these alarms, and the record format of each alarm is consistent with the format of a single alarm in Figure 3;

e_score represents the event score, which is calculated using the s(e _i ) method in (41). For example, s(e _root ), s(e), and s(e _leaf ) in Figure 6 are calculated by respectively substituting e _root , e, and e _leaf into e _i in the calculation formula of s(e _i ) in (41) above Come on, the same is true for the events omitted in the figure.

score represents the score of the entire sequence. The specific value of the score of the corresponding sequence of fa _i in Figure 6 will be obtained according to the calculation method of S(seq) in (41), and the value is s(e _root )+...+s(e)+...+s( e _leaf ).

The description field is the text description information of the alarm.

The present invention proposes a HIDS alarm traceability method based on the system audit log. Starting from the alarm generated by HIDS and the system audit log of the host, by matching different types of HIDS alarms with system audit events, the alarm point is located in the global traceability relationship, Then starting from the alarm point events, through causal traceability, the construction of event sequences including alarm points is realized. By scoring the alarm sequence, a high-level alarm containing sequence information is finally obtained. Compared with the original HIDS alarm, the same root The alarm information of the reason is kept in the same high-level alarm sequence, so the number of alarms can be reduced and the manual workload can be reduced. Compared with other intrusion source tracing methods, it can make full use of the alarms generated by different types of alarm rules in HIDS, thereby improving the detection surface and reducing false positives.

Preferred embodiments of the present invention have been described in detail above, however, the present invention is not limited to the specific details of the above embodiments. Within the scope of the technical concept of the present invention, various equivalent transformations can be made to the technical solutions of the present invention, and these equivalent transformations all belong to the protection scope of the present invention.

Claims (4)

1. A HIDS alarm tracing method based on system audit log is applied to host intrusion detection alarm analysis and is characterized by comprising the following steps:

(1) Processing the HIDS alarm and the system audit log into a data format containing specified contents to obtain a processed global alarm A and a processed global system audit log E;

(2) Associating each alarm a in the global alarm A with a system audit event E in a global system audit log E to obtain an event list matched _ list with an alarm mark;

(3) Proceeding from the event in the event list matched _ list, performing forward tracking and backward tracking in a global system audit log E by using a causal relationship to obtain an event sequence associated with an alarm, and storing the event sequence in a sequence list seq _ list;

(4) Scoring each sequence in the event sequence seq _ list according to a sequence scoring mechanism by combining alarm information associated with the events in the event sequence to obtain a sequence scoring result; converting the sequence with the sequence scoring result exceeding a set threshold value into a final alarm to be output;

wherein, the data format in the step (1) comprises an alarm format and a corresponding system audit event format in a system audit log, wherein:

the alarm format comprises { id, timestamp, data, rule };

id is used to index and identify alarms;

timestamp represents the timestamp of the alarm generation;

the data comprises specific content of the alarm and at least comprises two parts of data.entity and data.description:

the data is related information of a system entity triggering alarm, the system entity comprises files, network connection and processes, and for a Windows system, a registry is also a type of system entity; the data.entity in the alarms triggered by different types of system entities contains different contents, and for the alarms triggered by the file type system entities, the data.entity contains the path information of files; for the alarm triggered by the network connection type system entity, the data comprises the domain name or IP and port information of the network connection; for the alarm triggered by the process type system entity, the data comprises process ID and process name information; the data comprises key and value information of a corresponding registry in the Windows system for alarming generated by a registry type system entity;

the data description is description information of the alarm content;

rule represents the rule related to the alarm;

the rule at least comprises the following information { rule.id, rule.type and rule.level }, wherein the rule.id represents a unique identifier of the rule and is used for quickly positioning the rule; the type represents the type of the rule corresponding to the alarm, namely real-time matching or periodic detection, the real-time matching represents that the rule is used for matching the latest generated log in the system in real time, the alarm generated based on the rule can be generated immediately when an intrusion event occurs in the system, the alarm time is synchronous with the occurrence time of the intrusion behavior, and the alarm generated based on the rule is also real-time alarm; the regular detection rules are used for matching the detection results of the detection program regularly executed by the HIDS, the alarm generated by the regular detection rules is generated when the HIDS executes regular detection tasks, the alarm time is asynchronous with the occurrence time of the intrusion behavior, and the alarm generated based on the regular detection rules is the regular detection alarm; level represents the level of the risk of the event triggering the rule, and the risk represents the possibility of the event being an intrusion behavior and the severity of the consequences after the event occurs.

Subfields of id, timestamp and data and rule in the alarm belong to the attribute of the alarm;

the set of all processed HIDS alarms forms a global alarm A;

the system audit event format comprises { subject, object, timestamp, operation };

a sub represents a main body of an event occurrence, namely a system entity of an initiator of an action in the event;

the object represents an object of an event occurrence, namely a system entity of a receiver of the action;

timestamp represents timestamp information of the occurrence of the event;

the operation represents the specific operation executed by the subject on the object, and comprises the reading and writing of files by the process, the information sending and receiving of the process creation subprocess, the process and the remote network connection, the reading and writing of a registry by the process under Windows, and other recorded operations between system entities;

and a set formed by all the system audit events is a global system audit log E.

2. The HIDS alarm tracing method based on system audit log according to claim 1, wherein the step (2) specifically includes the steps of:

(21) For one alarm a in global alarm A _i First, a is judged _i If the alarm is generated by periodic detection, jumping to (23), if it is a real-time alarm, continuing (22);

(22) Searching a timestamp closest to a in a global system audit log E _i System audit event of timeframe is noted as e _j If | e _j .timestamp-a _i .timestamp|＞Threshold _TS The match is considered to fail, i.e. the match a cannot be found _i The associated system audits the event and then jumps (25), otherwise jumps (24), threshold _TS Is a timestamp association threshold, if the difference value of the timestamps is not higher than the threshold, the timestamps are regarded as the same time;

(23)for the alarms generated by periodic detection, because the possibly existing processing is not timely to cause that the alarms are triggered for the same reason for multiple times, the repeated alarms need to be merged, namely the alarm a and the alarm a are found in the global alarm A _i Repeated alarms and only one of them is reserved as a _i Deleting the rest repeated alarms; then each event in the global system audit log E is respectively selected as E _j Executing (24);

(24) Judgment e _j Subject or e _j System entity and a to which object relates _i Is the system entity corresponding to the data.entity the same system entity? If yes, then consider e _j And a _i Is associated with e _j And a _i Is connected to obtain e _j ：a _i And adds it to the matched _ list, corresponding to event e _j An alarm a is added _i As a marker; if not, consider e _j And a _i Irrelevant;

(25) Repeatedly executing (21) to (24) until the association attempt of all alarms in the global alarm A is completed, and finally obtaining an event list matched _ list with alarm marks;

the matched _ list reserves all events related to alarms and alarm information related to the events, so that the matched _ list at least comprises two columns of data of system audit events and alarm alerts, the system audit event column is selected as an index column, and as the condition that one system audit event is related to a plurality of alarms possibly exists, an item e is added into the matched _ list _j ：a _i When the event is detected, first, whether e exists in the events column is searched _j If already present, only at e _j The end of the alert column of this row adds a _i So that the row of data is formed by { e } _j ，{a _j1 ，a _j2 ,.. } into { e _j ，{a _j1 ，a _j2 ，...，a _i } in which a is _j1 ，a _j2 ,.. Is e _j Other alarms that have been matched; if e _j If not, then { e) is directly added _j ，{a _i } as a new line addition.

3. The HIDS alarm tracing method based on system audit log according to claim 1, wherein the step (3) specifically includes the following steps:

(31) Tracing back one event E in the matched _ list in the global system audit log E according to the cause-effect relationship until finding the root cause event E without cause event _r To obtain a tracing sequence { e _r ，...，e _b2 ，e _b1 E represents an event sequence influencing the occurrence of the event E, and the number of the finally found tracing sequences in E is marked as m;

(32) Tracking the event E forward in the global system audit log E until finding the end event E without a result event _l To obtain a tracking sequence { e, e _f1 ，e _f2 ，...e _l The sequence of E represents the event sequence influenced by the E event, and the number of the tracking sequences finally found in E is recorded as n;

(33) Combining and connecting the found m tracing sequences and n tracing sequences to obtain m multiplied by n sequences related to the event e, and storing the m multiplied by n sequences into a sequence list seq _ list;

(34) Selecting the next event which does not appear in the sequence list seq _ list from the matched _ list as the next e;

(35) Repeatedly executing the steps (31) to (34) until all tracing traces of the matched _ list related to the events are completed, and storing all event sequences possibly associated with HIDS alarms in the sequence list seq _ list;

the causal relationship in steps (31) and (32) is defined as follows:

cause and effect relationship: a causal relationship exists between the object and the object in the single system audit event, but the direction of the causal relationship depends on the type of operation and reflects the flow direction of information in the event; if the information in the event reaches the object after the operation from the object, the object is the reason entity, and the object is the result entity; conversely, object is a cause entity and object is a result entity;

auditing events e at two systems _c And e _e When there is a causal relationship between them, if e _c The result of (a) and (e) _e Is the same system entity and e _c Occurs earlier than e _e Then e is _c Is e _e A causal event of e _e Is e _c A result event of (2);

the forward tracing in the step, backward tracing means:

forward tracking: starting from an event e, searching for a subsequent result event of e;

tracing backwards: starting from an event e, the operation of finding the previous cause event of e.

4. The HIDS alarm tracing method based on system audit log according to claim 1, wherein the step (4) is as follows:

(41) Calculating an evaluation score for each sequence, the sequence seq = { e = { n } ₁ ，e ₂ ，...，e _n The score of S (seq), S (seq) is obtained by adding all the event scores in the sequence:

the sequence seq contains n events, e _i Represents the ith event in the sequence, with a score of s (e) _i ) The calculation method comprises the following steps:

wherein, f (a) _j ) Is to calculate an alarm a _j For event e _i The method for scoring the contribution degree, namely the method for calculating the alarm score, sets the contribution degree of each attribute attr in the alarm to the score, and combines a _j Each attribute in (1)Linearly combining the contributions of attr, and designing an alarm score method:

attr represents the value of an attribute in the alarm, and w represents the weight of the attr attribute,

represents the kth positive contribution attribute value, and

then it represents the ith negative contribution attribute value, and M and N are alarms a _j The number of positive and negative contributing attributes; for an attribute of a non-numeric type,

and

representing the numerical value after attribute quantization, and not considering the attribute which cannot be quantized;

set up g (e) _i ) Comprises the following steps:

wherein, c ₁ And c ₂ Is a constant, the value of which is to be set on a case-by-case basis, event e _f And event e _b Respectively slave event e in seq _i First events traced from forward tracing and backward tracing to match alarms, d _f And d _b Respectively represent an event e _i To event e in sequence seq _f And event e _b From e, i.e. _i Go out to _f And e _b The number of events passed;

(42) According to the fraction threshold value delta, when S (seq) ≧Delta, the sequence seq is converted into a final alarm output, and the final alarm comprises S (seq) obtained by calculation and an event sequence { e ] in the seq ₁ ，e ₂ ，...，e _n Calculated score for each event s (e) ₁ )，s(e ₂ )，...，s(e _n ) And the HIDS alarm condition contained in the sequence.

Images