Method for detecting low-frequency continuous abnormal network attack behavior

Abstract

The invention provides a method for detecting a low-frequency continuous abnormal network attack behavior, and relates to the technical field of big data alarm information. The method comprises the steps that alarms in a network attack are analyzed, the number of IP alarms of the same attacker is larger than or equal to a first number, and if a second number of time intervals are the same, the alarms are triggered; if the alarm data of the same victim IP and the alarm data of the same attacker IP in n days exceed a first number, detection is carried out, alarm generation time of the alarm data is extracted during detection, a possible standard deviation value is calculated, the occurrence frequency of the same standard deviation value is counted, and when the frequency reaches a third number, an alarm is screened and generated; and extracting alarm data meeting a preset condition, combining the alarm data, comparing the alarm data with the existing data, serializing the alarm data, and storing the alarm data into the elasticsearch. According to the method, the low-frequency attack information can be quickly screened out at relatively high speed and efficiency, a great effect is achieved for guaranteeing the network and system security, and meanwhile, the time and the cost are saved.

Description

Technical Field

[0001] The present invention relates to the field of big data alarm information technology, and in particular to a method for detecting low-frequency continuous abnormal network attack behavior. Background Art

[0002] Big data, or massive data, refers to the amount of data involved that is so large that it cannot be captured, managed, processed, and organized into information that helps companies make more proactive business decisions within a reasonable time through mainstream software tools. Big data is divided into two aspects: data collection and data analysis. Alarm notifications are warning messages that are automatically sent when the system detects an abnormality or reaches a preset condition. They are usually divided into email alarms, SMS alarms, phone alarms, etc., and are mainly used to remind users when specific events or status changes occur.

[0003] The data of instrumentation and electrical instruments needs to ensure network and system security, and the alarm data received at a fast pace for a long time needs to be effectively screened. However, there is currently no efficient detection method for low-frequency and continuous attacks on the system. Summary of the invention

[0004] The purpose of the present invention is to provide a method for detecting low-frequency continuous abnormal network attack behaviors in view of the above-mentioned deficiencies in the prior art, so as to solve the problem of detecting low-frequency continuous attacks on the system.

[0005] To achieve the above purpose, the technical solution adopted by the present invention is as follows:

[0006] The present invention provides a method for detecting low-frequency continuous abnormal network attack behavior, the method comprising:

[0007] Analyze the alarms from different sources in the network attack, with a period of n days. When the number of alarms from the same attacker IP is greater than or equal to a first preset number within the past n days, check the time intervals of all alarms from the IP. If a second preset number of time intervals are the same, trigger an alarm, where n is 7 or 30, the first preset number is a natural number greater than or equal to 10, and the second preset number is a natural number greater than or equal to 4;

[0008] Extract the attacker IP and victim IP in the collected data, and check whether the number of alarm data of the same victim IP within n days exceeds the first preset number and whether the number of alarm data of the same attacker IP exceeds the first preset number. If it exceeds the first preset number, perform a detection. During the detection, extract the alarm generation time from the multiple alarm data queried, calculate the difference between each two timestamps in ascending order as a possible standard occurrence difference, and count the number of occurrences of the same standard occurrence difference. When the counted number reaches a third preset number, generate an alarm through screening, and the third preset number is a natural number greater than or equal to 5;

[0009] The collected data is filtered through the filter component to extract the alarm data that meets the preset conditions, merge them, and compare them with the existing data in the database. The final data is serialized and stored in elasticsearch.

[0010] Optionally, the first preset number is 10.

[0011] Optionally, the second preset number is 4.

[0012] Optionally, the third preset number is 5.

[0013] Optionally, when checking the time interval of the alarm, the tolerance of the time interval is 5 minutes.

[0014] Optionally, when searching for the same time interval, a greedy algorithm is used to implement it.

[0015] The beneficial effects of the present invention include:

[0016] The method for detecting low-frequency continuous abnormal network attack behavior provided by the present invention includes: analyzing alarms from different sources in the network attack, taking every n days as a cycle, and when the number of alarms of the same attacker IP in the past n days is greater than or equal to a first preset number, checking the time intervals of all alarms of the IP, and if a second preset number of time intervals are the same, triggering an alarm, n is 7 or 30, the first preset number is a natural number greater than or equal to 10, and the second preset number is a natural number greater than or equal to 4; extracting the attacker IP and the victim IP in the collected data, and respectively checking whether the number of alarm data of the same victim IP in n days exceeds the first preset number and the number of alarm data of the same attacker IP Whether it exceeds the first preset number, if it exceeds the first preset number, then detection is performed, and the alarm generation time in the queried multiple alarm data is extracted during the detection, and the difference between each two timestamps is calculated in ascending order as the possible standard occurrence difference, and the number of occurrences of the same standard occurrence difference is counted. When the number of counted times reaches the third preset number, an alarm is generated by screening, and the third preset number is a natural number greater than or equal to 5; the collected data is screened by the screening component filter, and the alarm data that meets the preset conditions is extracted, and it is merged, and then compared with the existing data in the database, and the data finally obtained is stored in elasticsearch after serialization. The present invention can quickly screen out low-frequency attack information at a higher speed and higher efficiency, which plays a huge role in the protection of network security and system security, while saving time and cost, and contributing to the development of enterprises. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 A schematic flow chart of a method for detecting low-frequency continuous abnormal network attack behaviors provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] Big data, or massive data, refers to the amount of data involved that is so large that it cannot be captured, managed, processed, and organized into information that helps companies make more proactive business decisions within a reasonable time through mainstream software tools. Big data is divided into two aspects: data collection and data analysis. Alarm notifications are warning messages that are automatically sent when the system detects an abnormality or reaches a preset condition. They are usually divided into email alarms, SMS alarms, and phone alarms. They are mainly used to remind users when specific events or status changes occur. Instrument and electrical instrument data needs to ensure network security and system security. Alarm data received at a fast pace for a long time needs to be effectively screened. However, there is currently no efficient detection method for low-frequency and continuous attacks on the system.

[0021] The purpose of the present invention is to provide an algorithm for detecting low-frequency continuous abnormal network attack behavior, which can intercept low-frequency attacks through certain detection methods to make the system safer.

[0022] Figure 1 The flowchart of the method for detecting low-frequency continuous abnormal network attack behavior provided by an embodiment of the present invention is shown. Figure 1 As shown, the present invention provides a method for detecting low-frequency continuous abnormal network attack behavior, the method comprising:

[0023] Step 11: Analyze the alarms from different sources in the network attack, with a period of n days. When the number of alarms from the same attacker IP in the past n days is greater than or equal to the first preset number, check the time intervals of all alarms of the IP. If a second preset number of time intervals are the same, an alarm is triggered.

[0024] Wherein, n is 7 or 30, the first preset number is a natural number greater than or equal to 10, and the second preset number is a natural number greater than or equal to 4. Optionally, the first preset number is 10. The second preset number is 4. Optionally, when looking for the same time interval, a greedy algorithm is used to implement it. A greedy algorithm is an algorithm strategy that takes the best (or most favorable) decision in the current state in each step of selection, in order to achieve the global optimal solution through local optimal decisions. The key to the greedy algorithm is to construct a suitable greedy strategy, and the choice of this strategy must have no aftereffect, that is, the process before a certain state will not affect the subsequent state, and is only related to the current state. The greedy algorithm does not guarantee that the optimal solution will be obtained, but in some problems, the solution of the greedy algorithm is close enough to the optimal solution or is indeed the optimal solution. The greedy algorithm is suitable for problems with optimal substructures, that is, the optimal solution to a problem contains the optimal solution to its subproblems. The characteristic of the greedy algorithm is that it proceeds step by step, often making the best choice based on the current situation according to a certain optimization measure, without considering various possible overall situations, thus saving a lot of time that must be spent to exhaust all possibilities to find the optimal solution. Optionally, when checking the time interval of the alarm, the tolerance of the time interval is 5 minutes.

[0025] Step 12: extract the attacker IP and victim IP in the collected data, and check whether the number of alarm data of the same victim IP within n days exceeds the first preset number and whether the number of alarm data of the same attacker IP exceeds the first preset number. If they exceed the first preset number, perform detection.

[0026] During detection, the alarm generation time is extracted from the multiple alarm data queried, and the difference between each two timestamps is calculated in ascending order as the possible standard occurrence difference. The number of occurrences of the same standard occurrence difference is counted. When the counted number reaches a third preset number, an alarm is generated through screening, and the third preset number is a natural number greater than or equal to 5; optionally, the third preset number is 5.

[0027] For example: 1705468800000 1705555200000 1705641600000 1705649100000 1705728000000 1705810000000 1705814300000

[0035] For the above timestamps, the time difference between the occurrence of the 1st, 2nd, 3rd, 5th, and 7th alarms is 24 hours (with a tolerance of 5 minutes). Then, the difference between 12, 13, 14, 23, 24, and 34 is extracted as the standard value. Then, starting from the first timestamp, the standard deviation is accumulated to see if there is equal data in the current timestamp set (with a tolerance of 5 minutes). If there is, the statistical number (starting from 0) increases by 1. When the statistical number reaches 5, it means that the low frequency is continuous, and an alarm is generated through screening. The analysis process is as follows:

[0036] 1705468800000 is the first item. If there are equal data, add 1 to the statistics. 1705468800000 plus 86400000 will give 1705555200000. If there are equal data, add 1 to the statistics.

[0037] 1705555200000 plus 86400000 gets 1705641600000, add 1, 1705641600000 plus 86400000 gets 1705728000000, add 1, 1705728000000 plus 86400000 gets 1705814400000, which is within 5 minutes of 1705814300000, add 1, and the statistical number is 5, so stop analyzing and generate an alarm through screening. Otherwise, continue counting and repeat the above process.

[0038] Step 13: Filter the collected data through the filter component to extract the alarm data that meets the preset conditions, merge them, and compare them with the existing data in the database. Finally, the obtained data is serialized and stored in elasticsearch.

[0039] In summary, the present invention can quickly screen out low-frequency attack information at a higher speed and higher efficiency, which plays a huge role in ensuring network security and system security, while saving time and costs, and contributing to the development of the enterprise.

[0040] The above embodiments are only for illustrating the technical concept and features of the present invention, and their purpose is to enable ordinary technicians in the field to understand the content of the present invention and implement it. They cannot be used to limit the protection scope of the present invention. Any equivalent changes or modifications made according to the spirit of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for detecting low-frequency and continuous abnormal network attack behavior, characterized in that: The method comprises: Analyze the alarms from different sources in the network attack, with n days as a cycle. When the number of alarms from the same attacker IP in the past n days is greater than or equal to a first preset number, check the time intervals of all alarms from the IP. If a second preset number of time intervals are the same, trigger an alarm, where n is 7 or 30, the first preset number is a natural number greater than or equal to 10, and the second preset number is a natural number greater than or equal to 4; Extract the attacker IP and victim IP in the collected data, and respectively check whether the number of alarm data of the same victim IP within n days exceeds the first preset number and whether the number of alarm data of the same attacker IP exceeds the first preset number. If it exceeds the first preset number, perform a detection, extract the alarm generation time from the multiple alarm data queried during the detection, calculate the difference between every two timestamps in ascending order as a possible standard occurrence difference, count the number of occurrences of the same standard occurrence difference, and generate an alarm through screening when the counted number reaches a third preset number, and the third preset number is a natural number greater than or equal to 5; The collected data is filtered through the filter component to extract the alarm data that meets the preset conditions, merge them, and compare them with the existing data in the database. The final data is serialized and stored in elasticsearch.

2. The method for detecting low-frequency continuous abnormal network attack behavior according to claim 1, characterized in that: The first preset number is 10.

3. The method for detecting low-frequency continuous abnormal network attack behavior according to claim 2, characterized in that: The second preset number is 4.

4. The method for detecting low-frequency continuous abnormal network attack behavior according to claim 3 is characterized in that: The third preset number is 5.

5. The method for detecting low-frequency continuous abnormal network attack behavior according to claim 1, characterized in that: When viewing the alarm time interval, the time interval tolerance is 5 minutes.

6. The method for detecting low-frequency continuous abnormal network attack behavior according to claim 1, characterized in that: When searching for the same time interval, a greedy algorithm is used.

Images