A network attack detection method and device

Abstract

The present invention discloses a network attack detection method and device, which matches the acquired data packet with a preset attack feature library, determines the type of the successfully matched attack feature, and determines whether it matches the type of the target end and / or source end of the data packet; if it matches, an alarm is issued, otherwise it is filtered out and not processed. According to the source and the destination, it is divided into client attack and non-client attack, attack client and non-attack client, respectively. For the data packet with successful feature matching, by determining the type of its source and destination, and comparing it with the feature type, only the attack behavior with the same type is alarmed and processed, and the attack with the wrong type will not pose a threat to the target to be protected by the current detection, and is an invalid attack. Excluding such attacks can effectively reduce false alarms and improve the pertinence of attack detection alarms.

Description

Technical Field

[0001] The invention belongs to the field of network security, and in particular relates to an attack detection method for reducing false alarms and an attack detection device using the method. Background Art

[0002] With the development of the Internet, the number of network users is increasing, and the number of host devices connected to the Internet is also increasing. Attacks on hosts using vulnerabilities are becoming more common. In order to ensure the safe operation of the host to the greatest extent, it is necessary to monitor the occurrence of host attacks in real time and detect the existence of dangers in a timely manner.

[0003] One method of conducting security checks on network data is feature-based identification, that is, if the attack features of a data packet match the feature library, the data packet is judged to be aggressive. However, due to technical limitations, feature-based network attack detection methods can easily lead to misjudgment, where a normal data packet is judged as an attack data packet that meets the features. In practice, remedial measures are often taken after a misjudgment to confirm again, such as manual analysis, analyzing the attack logs one by one, excluding normal data, and then updating the feature library. This method has a lag and cannot handle misjudgment problems in a timely manner, which can easily affect normal business. In severe cases, misjudgment of network attacks can also cause customers to disconnect from the Internet, affecting the use effect.

[0004] The inventor of this application has found in practice that one of the situations where existing feature matching has a high incidence of false positives is that the packets to be matched do not distinguish between the source and the target, and the packets with successful feature matching include both packets sent by the attacker to the attacked and packets sent by the attacked to the attacker. In particular, most interactive messages of the same protocol have fixed features, and these successful feature matchings are prone to cause false positives and alarms. Therefore, it is necessary to optimize the attack detection and alarm in this situation to reduce false positives. Summary of the invention

[0005] In view of this, the present invention aims to improve a method and device for detecting network attack packets with reduced false positives, by judging the successfully matched features and their target end and source segment, eliminating inconsistent alarms, and improving detection effectiveness.

[0006] The specific technical solutions of the present invention include:

[0007] A network attack detection method matches the acquired data packet with a preset attack feature library, determines whether the type of the successfully matched attack feature matches the type of the target end and / or source end of the data packet; if it matches, an alarm is issued, otherwise it is filtered out and not processed.

[0008] As a preferred method, the determination of whether the type of successfully matched attack feature matches the type of the target end of the data packet specifically includes: after the data packet to be detected is matched with the attack feature library, determining whether the successfully matched feature belongs to an attack client or a non-attack client, and determining whether the target is a client or a non-client based on the direction of data packet flow, and issuing an alarm when the type of the attack feature is consistent with the type of the target end.

[0009] As another preferred embodiment, the method of judging whether the type of attack feature that has been successfully matched is consistent with the type of the source end of the data packet specifically includes: after matching the data packet to be detected with the attack feature library, judging whether the successfully matched feature belongs to a client attack or a non-client attack, and judging whether the source is a client or a non-client based on the direction of data packet flow; and issuing an alarm when the type of the attack feature is consistent with the type of the target end and / or the source end.

[0010] According to the above detection method, before judging whether the attack feature type that has been successfully matched matches the type of the target end and / or source end of the data packet, it also includes: dividing the attack features into attack client and non-attack client according to the attack target and storing them in the feature library, and / or dividing the attack features into client attack and non-client attack according to the attack source and storing them in the feature library.

[0011] When the type of attack feature is consistent with the type of the target end and / or source end, the detection rule that is hit is determined based on the attack feature, and the alarm processing strategy preset by the detection rule is executed.

[0012] Furthermore, creating the detection rule includes: selecting attack features from a feature library to establish the detection rule and adding the feature library; executing the detection rule, and when the content of the data packet successfully matches at least one attack feature in the rule, it means that the detection rule is hit.

[0013] As a third preferred implementation, the determination of whether the type of the successfully matched attack feature is consistent with the type of the target end and / or source end of the data packet specifically includes:

[0014] Create detection rules for attacking the client, attacking the non-client, attacking the client, and attacking the non-client. The detection rules include selecting attack features of the corresponding type to be detected from a feature library; dividing the data packets to be detected into those to the client, to the non-client, from the client, and from the non-client according to the message direction; start the detection rules to detect the corresponding types of data packets to be detected. When at least one attack feature in the detection rule successfully matches the corresponding data packet to be detected, it means that the detection rule is hit, and a preset alarm processing strategy is executed.

[0015] In a second aspect, the present invention further provides an attack detection device, comprising:

[0016] A data packet receiving module, used for receiving a data packet to be detected in a session;

[0017] The feature library module is used to store attack features;

[0018] A rule base module, used for storing detection rules including attack features;

[0019] The packet matching module is used to execute the detection rules and match the data packet to be detected with the attack characteristics to determine whether the data packet is a network attack;

[0020] The attack processing module is used to execute the processing strategy preset by the detection rule when the match is successful.

[0021] Preferably, the attack features stored in the feature library module are divided into attacks on the client, attacks on non-clients, client attacks, and non-client attacks; according to the flow direction, the data packets to be detected are divided into those to the client and those to the non-client, and / or those from the client and those from the non-client.

[0022] Furthermore, the data packet matching module executes the detection rules to determine whether the category to which the successfully matched attack feature belongs matches the target end and / or client of the data packet. If so, an alarm is issued and policy processing is performed; otherwise, filtering is performed without processing.

[0023] By adopting the above-mentioned technical scheme, the attack detection method and device of the present invention achieve the following beneficial effects: the attack features of the feature library are classified, that is, they are divided into client attacks and non-client attacks, attack clients and non-attack clients according to the source and destination. For data packets with successful feature matching, the types of their source and destination are judged and compared with the feature types. Only attack behaviors that match the type are alarmed and processed. Attacks that do not match the type will not pose a threat to the target to be protected by the current detection and are invalid attacks. Excluding such attacks can effectively reduce false alarms and improve the pertinence of attack detection alarms. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 It is a schematic diagram of the flow chart of the first embodiment of the network attack detection method of the present invention;

[0025] Figure 2 A schematic diagram of a flow chart of a second embodiment of a network attack detection method of the present invention;

[0026] Figure 3 A schematic diagram of a flow chart of a third embodiment of a network attack detection method of the present invention;

[0027] Figure 4 It is a block diagram of the composition of an embodiment of a network attack detection device of the present invention. DETAILED DESCRIPTION

[0028] The present invention first provides a network attack detection method, which matches the acquired data packet with a preset attack feature library, determines whether the type of the successfully matched attack feature is consistent with the type of the target end and / or source end of the data packet; if it is consistent, an alarm is issued, otherwise it is filtered out and not processed. The implementation of this method is explained below through specific embodiments. It should be noted here that the client described in the present invention is such as a PC host, and the non-client is such as a server.

[0029] Embodiment 1

[0030] like Figure 1 As shown, the attack signatures are divided into attack clients and non-attack clients according to the attack targets and stored in the signature library.

[0031] Select attack features from the feature library to create detection rules and add them to the rule library.

[0032] Execute the detection rules, match the data packet to be detected with the attack feature library, determine whether the matched features belong to the attack client or non-attack client, and determine whether the target is the client or non-client based on the data packet flow direction. When the type of the attack feature is consistent with the target end type, that is, if the attack feature is an attack on the client and the target end of the data packet is the client, if the attack feature is an attack on the non-client and the target end of the data packet is the non-client, an alarm is issued.

[0033] Preferably, when the content of the data packet successfully matches at least one attack feature in the rule, the hit detection rule can be determined based on the attack feature, and the alarm processing strategy preset in the detection rule can be executed.

[0034] Embodiment 2

[0035] like Figure 2 As shown, the attack features are divided into client attacks and non-client attacks according to the attack sources and stored in the feature library.

[0036] Select attack features from the feature library to create detection rules and add them to the rule library.

[0037] Execute the detection rules, match the data packet to be detected with the attack feature library, determine whether the matched features belong to client attacks or non-client attacks, and determine whether the source is client or non-client based on the direction of the data packet flow. When the type of the attack feature is consistent with the type of the target end, that is, if the attack feature is a client attack and the source end of the data packet is the client, if the attack feature is a non-client attack and the source end of the data packet is the non-client, an alarm is issued.

[0038] Preferably, when the content of the data packet successfully matches at least one attack feature in the rule, the hit detection rule can be determined based on the attack feature, and the alarm processing strategy preset in the detection rule can be executed.

[0039] Embodiment 3

[0040] like Figure 3 As shown, as a third preferred implementation, the determination of whether the type of the successfully matched attack feature is consistent with the type of the target end and / or source end of the data packet specifically includes:

[0041] Create detection rules for attacking the client, attacking the non-client, attacking the client, and attacking the non-client. The detection rules include selecting attack features of the corresponding type to be detected from a feature library; dividing the data packets to be detected into those to the client, to the non-client, from the client, and from the non-client according to the message direction; start the detection rules to detect the corresponding types of data packets to be detected. When at least one attack feature in the detection rule successfully matches the corresponding data packet to be detected, it means that the detection rule is hit, and a preset alarm processing strategy is executed.

[0042] Embodiment 4

[0043] like Figure 4 As shown, the present invention also provides an attack detection device, comprising:

[0044] A data packet receiving module, used for receiving a data packet to be detected in a session;

[0045] The feature library module is used to store attack features;

[0046] A rule base module, used for storing detection rules including attack features;

[0047] The packet matching module is used to execute the detection rules and match the data packet to be detected with the attack characteristics to determine whether the data packet is a network attack;

[0048] The attack processing module is used to execute the processing strategy preset by the detection rule when the match is successful.

[0049] Preferably, the attack features stored in the feature library module are divided into attacks on the client, attacks on non-clients, client attacks, and non-client attacks; according to the flow direction, the data packets to be detected are divided into those to the client and those to the non-client, and / or those from the client and those from the non-client.

[0050] Furthermore, the data packet matching module executes the detection rules to determine whether the category to which the successfully matched attack feature belongs matches the target end and / or client of the data packet. If so, an alarm is issued and policy processing is performed; otherwise, filtering is performed without processing.

[0051] The above technical solution classifies the attack features of the feature library, that is, they are divided into client attacks and non-client attacks, attacking clients and non-attacking clients according to the source and destination. For data packets with successful feature matching, the types of their source and destination are judged and compared with the feature type. Only attack behaviors that match the type are alarmed and processed. Attacks that do not match the type will not pose a threat to the target to be protected by the current detection and are invalid attacks. Excluding such attacks can effectively reduce false alarms and improve the pertinence of attack detection alarms.

Claims

1. A network attack detection method, matching the acquired data packet with a preset attack feature library, characterized in that: Determine whether the type of the successfully matched attack signature matches the type of the target end and / or source end of the data packet; if so, issue an alarm; otherwise, filter it out and do not process it; The determination of whether the type of the successfully matched attack feature is consistent with the type of the source of the data packet specifically includes: after the data packet to be detected is matched with the attack feature library, determining whether the successfully matched feature belongs to a client attack or a non-client attack, and determining whether the source is a client or a non-client according to the flow direction of the data packet; when the type of the attack feature is consistent with the type of the source, an alarm is issued; The determining whether the attack feature type that matches successfully matches the target end type of the data packet specifically includes: after the data packet to be detected is matched with the attack feature library, determining whether the matched feature belongs to an attack client or a non-attack client, and determining whether the target is a client or a non-client according to the data packet flow direction; and issuing an alarm when the type of the attack feature matches the target end type; Before determining whether the attack feature type that matches successfully matches the target end and / or source end type of the data packet, the method further includes: dividing the attack features into attack client and non-attack client according to the attack target and storing them in the feature library; dividing the attack features into client attack and non-client attack according to the attack source and storing them in the feature library; When the type of attack feature is consistent with the type of the target end and / or source end, the detection rule that is hit is determined based on the attack feature, and the alarm processing strategy preset in the detection rule is executed; Creating the detection rule includes: selecting attack features from a feature library to establish the detection rule and adding the features to the rule library; executing the detection rule, and when the content of the data packet successfully matches at least one attack feature in the rule, it means that the detection rule is hit.

2. The network attack detection method according to claim 1, characterized in that: The determination of whether the type of the successfully matched attack feature is consistent with the type of the target end and / or source end of the data packet specifically includes: Creating detection rules for attacking a client, attacking a non-client, attacking a client, and attacking a non-client, wherein the detection rules include selecting attack features of corresponding types to be detected from a feature library; According to the message direction, the data packets to be detected are divided into those to the client, those to the non-client, those from the client, and those from the non-client; The detection rule is started to detect the corresponding type of data packet to be detected. When at least one attack feature in the detection rule successfully matches the corresponding data packet to be detected, it means that the detection rule is hit, and the preset alarm processing strategy is executed.

3. A network attack detection device, implementing the network attack detection method according to claim 1 or 2, characterized in that: include: A data packet receiving module, used for receiving a data packet to be detected in a session; The feature library module is used to store attack features, classify attack features into attack client and non-attack client according to the attack target, and classify attack features into client attack and non-client attack according to the attack source, and store them in the feature library; A rule base module is used to store detection rules including attack features, select attack features from the feature base to establish detection rules, and add them to the rule base; The packet matching module is used to execute the detection rules and match the data packet to be detected with the attack characteristics to determine whether the data packet is a network attack; The attack processing module is used to execute the processing strategy preset by the detection rule when the match is successful.

Images