A flexible security protection method and system based on IP value evaluation

Abstract

The present invention relates to a flexible security protection method and system based on IP value evaluation. By judging the IP value demarcation point that matches the IP value of the attacker's IP, the protection execution means corresponding to the matching IP value demarcation point is executed, and a protection strategy based on the customer IP value score is established to solve the problems of high false alarms and high false blocking of IPs, and at the same time, hierarchical security protection is performed on the IP. Different from the prior art that performs security protection based on the characteristics of the attacker, this method is a security protection method from the perspective of user characteristics. When a security service detects an attack, hierarchical security policy protection is performed by querying the IP value score table.

Description

Technical Field

[0001] The present invention relates to the field of network security protection technology, and in particular to a flexible security protection method and system based on IP value evaluation. Background Art

[0002] As more and more services rely on the Internet, the importance of network security protection becomes increasingly prominent.

[0003] Detecting and identifying suspicious access and performing access control on suspicious access is a common network security protection method. In the prior art, access control mainly performs security protection based on the characteristics of suspected attackers, such as attack frequency, attack time period, attack target, etc., calculates the reputation of the corresponding IP, and then performs security control and ban processing based on the IP reputation value, or directly bans the corresponding IP based on the attack characteristics.

[0004] This method of protection based on the attacker's attack characteristics can effectively protect network security from common attacks, but there is a high chance of false positives and incorrectly blocked IPs based on attack characteristics. At the same time, if the blocked IP is the NAT exit or base station gateway address, a large number of users will be temporarily unable to access it, which will not only affect the user experience, but will also cause business losses to related organizations.

[0005] On the other hand, attackers may also use current security protection features to carry out targeted attacks. Even if the attack is unsuccessful, a large number of IP addresses may be blocked due to the activation of network protection. In particular, existing technologies cannot distinguish the value or importance level represented by IP addresses, and will indiscriminately block them, causing significant losses. Summary of the invention

[0006] In order to address the deficiencies of the prior art, the present invention proposes a flexible security protection method and system based on IP value evaluation. By establishing a protection strategy based on the customer's IP value score, the problem of high false alarms and high false blocking of IPs is solved, and at the same time, hierarchical security protection is performed on the IP. Different from the prior art that performs security protection based on the characteristics of the attacker, this method is a security protection method from the perspective of user characteristics. When the security service detects an attack, hierarchical security policy protection is performed by querying the IP value score table.

[0007] To achieve the above objectives, the technical solutions adopted by the present invention include:

[0008] A flexible security protection method based on IP value evaluation, characterized by comprising:

[0009] Set one or more IP value demarcation points and one or more protection enforcement measures corresponding to the IP value demarcation points;

[0010] Record the attacker's IP and attack time for any suspected attack behavior detected;

[0011] Query and obtain the IP value of the attacker's IP;

[0012] Determine the IP value demarcation point that matches the IP value of the attacker's IP, and execute the protection execution means corresponding to the matching IP value demarcation point.

[0013] Furthermore, the query to obtain the IP value of the attacker's IP includes:

[0014] Obtaining evaluation data corresponding to the attacker's IP, the evaluation data including consumption record information, number of visitors, number of visits, and previous attack record information corresponding to the IP;

[0015] The evaluation data is brought into the scoring calculation model to calculate the IP value of the attacker's IP. The scoring calculation model is shown in Formula I:

[0016] V(IP i )=λ i1 C i +λ i2 P i +λ i3 N i -λ i4 A i Formula I

[0017] Among them, V(IP i ) represents the IP value based on the i-th IP, λ ij Represents the jth weight coefficient based on the ith IP, C i represents the consumption amount corresponding to the consumption record information based on the i-th IP, P i Represents the number of visitors based on the i-th IP address, N i Represents the number of visits based on the i-th IP address, A i Represents the past attack record information based on the i-th IP;

[0018] When there is no attack record based on the previous attack record information of the i-th IP, A i The value is 0. When there is an attack record based on the previous attack record information of the i-th IP, A i The value is 1.

[0019] Furthermore, the query to obtain the IP value of the attacker's IP includes:

[0020] According to the business database, obtain all IPs and the evaluation data corresponding to each IP;

[0021] Bring the evaluation data into the scoring calculation model to calculate the IP value of each IP and obtain the IP value table;

[0022] Query the IP value table to obtain the IP value of the attacker's IP.

[0023] Furthermore, the determination of the IP value demarcation point that matches the IP value of the attacker's IP and the execution of the protection execution means corresponding to the matched IP value demarcation point include:

[0024] Use the larger IP value cutoff point that is closest to the IP value of the attacker's IP as the matching IP value cutoff point.

[0025] Furthermore, the protection execution means include adding a graphic verification code operation within a specified time period and banning an IP within a specified time period.

[0026] Furthermore, the determination of the IP value demarcation point that matches the IP value of the attacker's IP and the execution of the protection execution means corresponding to the matched IP value demarcation point also include:

[0027] Determine whether the suspected attack behavior is a Web attack;

[0028] When the suspected attack behavior is determined to be a Web attack, select the protection execution method of adding a graphic verification code operation within a specified time period;

[0029] When it is determined that the suspected attack behavior is not a Web attack, choose to use the protection execution method of banning the IP within a specified time period.

[0030] Furthermore, the determination of the IP value demarcation point that matches the IP value of the attacker's IP and the execution of the protection execution means corresponding to the matched IP value demarcation point also include:

[0031] According to the business database, obtain the access time period data corresponding to the attacker's IP;

[0032] Determine whether the attack time of the suspected attack behavior is within the corresponding access time period;

[0033] When it is determined that the attack time of the suspected attack behavior is within the corresponding access time period, the protection execution method of adding a graphic verification code operation within the specified time period is selected;

[0034] When it is determined that the attack time of the suspected attack behavior is not within the corresponding access time period, choose to use the protection execution method of banning the IP within the specified time period.

[0035] The present invention also relates to a flexible security protection system based on IP value evaluation, which is characterized by comprising:

[0036] Security protection module, used to detect suspected attack behaviors and record the attacker's IP and attack time;

[0037] IP value module, used to query and obtain the IP value of the attacker's IP;

[0038] The protection execution module is used to execute the protection execution means corresponding to the matched IP value demarcation point according to the matching result between the IP value and the IP value demarcation point.

[0039] The present invention also relates to a computer-readable storage medium, characterized in that a computer program is stored on the storage medium, and the computer program implements the above method when executed by a processor.

[0040] The present invention also relates to an electronic device, characterized in that it comprises a processor and a memory;

[0041] The memory is used to store IP value;

[0042] The processor is used to execute the above method by calling the IP value.

[0043] The beneficial effects of the present invention are:

[0044] The flexible security protection method and system based on IP value evaluation described in the present invention is a security protection system that fully considers the value of IP to system operation, and can deal with attack behaviors of IPs with different values ​​in a targeted manner, while ensuring to the greatest extent that the execution of security protection measures has the least impact on system operation and IPs with greater value. Different from the strategy of the prior art that performs security protection entirely from the perspective of the attacking party, the usage experience of normal users is also incorporated into the decision-making process of the execution process of system security protection, so that the security protection measures can be flexibly executed according to the IP value, solving the problem of high false alarms and high error-banned IPs, and effectively improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 The figure is a flow chart of the flexible security protection method based on IP value evaluation of the present invention.

[0046] Figure 2 It is a schematic diagram of the structure of the elastic security protection system based on IP value evaluation of the present invention. DETAILED DESCRIPTION

[0047] In order to more clearly understand the content of the present invention, it will be described in detail with reference to the drawings and embodiments.

[0048] The first aspect of the present invention relates to a flexible security protection method based on IP value evaluation, the process is as follows: Figure 1 As shown, including:

[0049] Set one or more IP value demarcation points and one or more protection enforcement measures corresponding to the IP value demarcation points;

[0050] Record the attacker's IP and attack time for any suspected attack behavior detected;

[0051] Query and obtain the IP value of the attacker's IP;

[0052] Determine the IP value demarcation point that matches the IP value of the attacker's IP, and execute the protection execution means corresponding to the matching IP value demarcation point.

[0053] In the specific implementation process, it is preferred to simplify the implementation of the security protection method by pre-establishing an IP value table for all IPs related to the system business, specifically including:

[0054] According to the business database, obtain all IPs and the evaluation data corresponding to each IP, including the consumption record information, number of visitors, number of visits, and previous attack record information corresponding to the IP;

[0055] The evaluation data is brought into the scoring calculation model to calculate the IP value of each IP and obtain an IP value table. The scoring calculation model is shown in Formula I:

[0056] V(IP i )=λ i1 C i +λ i2 P i +λ i3 N i -λ i4 A i Formula I

[0057] Among them, V(IP i ) represents the IP value based on the i-th IP, λ ij Represents the jth weight coefficient based on the ith IP, C i represents the consumption amount corresponding to the consumption record information based on the i-th IP, P i Represents the number of visitors based on the i-th IP address, N i Represents the number of visits based on the i-th IP address, A i Represents the past attack record information based on the i-th IP;

[0058] When there is no attack record based on the previous attack record information of the i-th IP, A i The value is 0. When there is an attack record based on the previous attack record information of the i-th IP, A i The value is 1;

[0059] Query the IP value table to obtain the IP value of the attacker's IP.

[0060] After obtaining the IP value of the attacker's IP, we can match the set IP value demarcation point according to the IP value to determine the protection execution measures that need to be executed, so that the execution of security protection can reflect the correlation with the IP value.

[0061] Preferably, the protection execution means to be executed can be further refined by whether the IP attack belongs to a Web attack and whether the attack time is in the access time period corresponding to the attacker's IP. For example, when it is determined that the suspected attack behavior belongs to a Web attack, the protection execution means of adding a graphic verification code operation within a specified time period is selected; when it is determined that the suspected attack behavior does not belong to a Web attack, the protection execution means of banning the IP within a specified time period is selected. And, when it is determined that the attack time of the suspected attack behavior is in the corresponding access time period, the protection execution means of adding a graphic verification code operation within the specified time period is selected; when it is determined that the attack time of the suspected attack behavior is not in the corresponding access time period, the protection execution means of banning the IP within the specified time period is selected.

[0062] The optional protection execution means can be configured according to actual needs, for example, it can also include sending warning information to operation and maintenance personnel for manual processing. In a specific embodiment of the method of the present invention, the protection execution means that can be taken include the following parts:

[0063] When the attack time is judged to be outside the access time range and the attack is a Web attack, the protection execution method used is:

[0064] (1) When the IP value is less than the first IP value demarcation point (10), the operation of adding a graphic verification code within the specified time period is used to make the attacker's automatic attack ineffective, and the specified time period for using the graphic verification code is set to the first time period (6 hours);

[0065] (2) When the IP value is greater than the first IP value cutoff point (10 points) and less than the second IP value cutoff point (50 points), the operation of adding a graphic verification code within the specified time period is used to make the attacker's automatic attack invalid, and the specified time period for using the graphic verification code is set to the second time period (30 minutes);

[0066] (3) When the value of the attacked IP is greater than the second IP value demarcation point (50), an early warning message is sent to the information security personnel, who directly intervene in the analysis and conduct a scan that has no impact on the system to determine whether the attack has an impact on the system; for attacks that have an impact, the vulnerability is repaired, or the designated time period for using the graphic verification code is set to the third time period (1 minute or less).

[0067] When it is determined that the attack time is not within the access time range and the attack is not a Web attack, the protection execution method used is:

[0068] (4) When the IP value is less than the first IP value demarcation point (10), the IP is blocked within the specified time period, and the blocking time is the first time period (6 hours);

[0069] (5) When the IP value is greater than the first IP value cutoff point (10) and less than the second IP value cutoff point (50), the IP is blocked within the specified time period, and the blocking time is the second time period (30 minutes);

[0070] (6) When the value of the attacked IP is greater than the second IP value demarcation point (50), an early warning message is sent to the information security personnel, who directly intervene in the analysis and conduct scans that have no impact on the system; for attacks that have an impact, the vulnerability is repaired, or the IP ban time is set to the third time period (1 minute or less).

[0071] Similarly, in the case where it is determined that the attack time is within the access time period, appropriate protection execution means and execution time period may be selected as required.

[0072] Another aspect of the present invention relates to a structure such as Figure 2 The elastic security protection system based on IP value evaluation shown includes:

[0073] Security protection module, used to detect suspected attack behaviors and record the attacker's IP and attack time;

[0074] IP value module, used to query and obtain the IP value of the attacker's IP;

[0075] The protection execution module is used to execute the protection execution means corresponding to the matched IP value demarcation point according to the matching result between the IP value and the IP value demarcation point.

[0076] Preferably, the protection execution module can also be used to collect security protection logs and provide targeted warning information according to the settings. The data storage part in the system preferably stores an IP value table, and further preferably stores access time period data corresponding to each IP, which is used for matching and judgment when flexibly selecting protection execution means.

[0077] The system can be used to implement the above method.

[0078] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A flexible security protection method based on IP value evaluation, characterized in that: include: Set one or more IP value demarcation points and one or more protection enforcement measures corresponding to the IP value demarcation points; Record the attacker's IP and attack time for any suspected attack behavior detected; Query and obtain the IP value of the attacker's IP; Determine the IP value demarcation point that matches the IP value of the attacker's IP, and execute the protection execution means corresponding to the matching IP value demarcation point; The query to obtain the IP value of the attacker's IP includes: Obtaining evaluation data corresponding to the attacker's IP, the evaluation data including consumption record information, number of visitors, number of visits, and previous attack record information corresponding to the IP; The evaluation data is brought into the scoring calculation model to calculate the IP value of the attacker's IP. The scoring calculation model is shown in Formula I: V(IP i ) = λ i1 C i + λ i2 P i + λ i3 N i - λ i4 A i Equation I Among them, V(IP i ) represents the IP value based on the i-th IP, λ ij represents the jth weight coefficient based on the i-th IP, where j represents 1, 2, 3, 4; C i represents the consumption amount corresponding to the consumption record information based on the i-th IP, P i Represents the number of visitors based on the i-th IP address, N i Represents the number of visits based on the i-th IP address, A i Represents the previous attack record information based on the i-th IP; When there is no attack record based on the previous attack record information of the i-th IP, A i The value is 0. When there is an attack record based on the previous attack record information of the i-th IP, A i The value is 1; The determination of the IP value demarcation point that matches the IP value of the attacker's IP and the execution of the protection execution means corresponding to the matching IP value demarcation point include: Use the larger IP value cutoff point that is closest to the IP value of the attacker's IP as the matching IP value cutoff point; The protection execution means include adding graphic verification code operations within a specified time period and banning IP within a specified time period; The determination of the IP value demarcation point that matches the IP value of the attacker's IP and the execution of the protection execution means corresponding to the matching IP value demarcation point also include: According to the business database, obtain the access time period data corresponding to the attacker's IP; Determine whether the attack time of the suspected attack behavior is within the corresponding access time period; When it is determined that the attack time of the suspected attack behavior is within the corresponding access time period, the protection execution method of adding a graphic verification code operation within the specified time period is selected; When it is determined that the attack time of the suspected attack behavior is not within the corresponding access time period, choose to use the protection execution method of banning the IP within the specified time period.

2. The method according to claim 1, characterized in that The query to obtain the IP value of the attacker's IP includes: According to the business database, obtain all IPs and the evaluation data corresponding to each IP; Bring the evaluation data into the scoring calculation model to calculate the IP value of each IP and obtain the IP value table; Query the IP value table to obtain the IP value of the attacker's IP.

3. The method according to claim 1, characterized in that The determination of the IP value demarcation point that matches the IP value of the attacker's IP and the execution of the protection execution means corresponding to the matching IP value demarcation point also include: Determine whether the suspected attack behavior is a Web attack; When the suspected attack behavior is determined to be a Web attack, select the protection execution method of adding a graphic verification code operation within a specified time period; When it is determined that the suspected attack behavior is not a Web attack, choose to use the protection execution method of banning the IP within a specified time period.

4. A flexible security protection system based on IP value evaluation, characterized in that: include: Set one or more IP value demarcation points and one or more protection enforcement measures corresponding to the IP value demarcation points; Security protection module, used to detect suspected attack behaviors and record the attacker's IP and attack time; IP value module, used to query and obtain the IP value of the attacker's IP; A protection execution module, used to execute the protection execution means corresponding to the matched IP value demarcation point according to the matching result between the IP value and the IP value demarcation point; The query to obtain the IP value of the attacker's IP includes: Obtaining evaluation data corresponding to the attacker's IP, the evaluation data including consumption record information, number of visitors, number of visits, and previous attack record information corresponding to the IP; The evaluation data is brought into the scoring calculation model to calculate the IP value of the attacker's IP. The scoring calculation model is shown in Formula I: V(IP i ) = λ i1 C i + λ i2 P i + λ i3 N i - λ i4 A i Formula I Among them, V(IP i ) represents the IP value based on the i-th IP, λ ij represents the jth weight coefficient based on the i-th IP, where j represents 1, 2, 3, 4; C i represents the consumption amount corresponding to the consumption record information based on the i-th IP, P i Represents the number of visitors based on the i-th IP address, N i Represents the number of visits based on the i-th IP address, A i Represents the previous attack record information based on the i-th IP; When there is no attack record based on the previous attack record information of the i-th IP, A i The value is 0. When there is an attack record based on the previous attack record information of the i-th IP, A i The value is 1; The protection execution means for executing the corresponding matched IP value demarcation point according to the matching result of the IP value and the IP value demarcation point includes: Use the larger IP value cutoff point that is closest to the IP value of the attacker's IP as the matching IP value cutoff point; The protection execution means include adding graphic verification code operations within a specified time period and banning IP within a specified time period; The protection execution means for executing the corresponding matched IP value demarcation point according to the matching result of the IP value and the IP value demarcation point also includes: According to the business database, obtain the access time period data corresponding to the attacker's IP; Determine whether the attack time of the suspected attack behavior is within the corresponding access time period; When it is determined that the attack time of the suspected attack behavior is within the corresponding access time period, the protection execution method of adding a graphic verification code operation within the specified time period is selected; When it is determined that the attack time of the suspected attack behavior is not within the corresponding access time period, choose to use the protection execution method of banning the IP within the specified time period.

5. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 3 is implemented.

6. An electronic device, characterized in that: including a processor and a memory; The memory is used to store IP value; The processor is used to execute the method according to any one of claims 1 to 3 by calling the IP value.

Images