A network attack team identification method, device, electronic device and storage medium

Abstract

The present invention discloses a network attack team identification method, device, electronic device and storage medium, which are used to solve the technical problem that network attacks cannot be effectively and accurately identified from massive alarm information. The present invention includes: extracting network attack log data from a preset database; standardizing the network attack log data to obtain a standardized log data set; clustering the data objects in the standardized log data set to obtain multiple network attack teams; generating a team portrait of each network attack team; when receiving network abnormality information, matching the network abnormality information in multiple team portraits to determine the target network attack team corresponding to the network abnormality information.

Description

Technical Field

[0001] The present invention relates to the technical field of network attack identification, and in particular to a network attack team identification method, device, electronic equipment and storage medium. Background Art

[0002] Cyber ​​attacks refer to any type of offensive action against computer information systems, infrastructure, computer networks or personal computer devices. For computers and computer networks, destroying, exposing, modifying, making software or services nonfunctional, stealing or accessing data from any computer without authorization are all considered attacks on computers and computer networks.

[0003] Intrusion detection is a reasonable supplement to firewalls. It helps the system deal with network attacks, expands the security management capabilities of system administrators (including security auditing, monitoring, attack identification and response), and improves the integrity of the information security infrastructure. It collects information from several key points in the computer network system and analyzes the information to see if there are any violations of security policies and signs of attacks in the network. Intrusion detection is considered to be the second security gate after the firewall. It can monitor the network without affecting network performance, thereby providing real-time protection against internal attacks, external attacks and misoperation.

[0004] The current intrusion detection system mainly monitors network traffic, compares the characteristics of the traffic with the rule base, and then issues an alarm for abnormal traffic. Since security vendors and hackers on the Internet scan the Internet all the time, the intrusion detection system will generate a large number of alarm information. Security personnel are tired of dealing with a large number of meaningless alarms, and real attack alarms may be drowned in the massive amount of alarm information. As a result, it is impossible to effectively and accurately defend against network attacks. Summary of the invention

[0005] The present invention provides a network attack team identification method, device, electronic device and storage medium, which are used to solve the technical problem that network attacks cannot be effectively and accurately identified from massive alarm information.

[0006] The present invention provides a network attack team identification method, comprising:

[0007] Extract network attack log data from a preset database;

[0008] Standardizing the network attack log data to obtain a standardized log data set;

[0009] Clustering the data objects in the standardized log data set to obtain multiple network attack teams;

[0010] Generate a team profile of each of the cyber attack teams;

[0011] When network anomaly information is received, the network anomaly information is matched among the multiple team portraits to determine the target network attack team corresponding to the network anomaly information.

[0012] Optionally, the step of clustering the data objects in the standardized log data set to obtain multiple network attack teams includes:

[0013] Calculate the first Euler distance of each of the data objects in the standardized log data set and the average distance of all the data objects;

[0014] Extracting a first sample from the standardized log data set according to the first Euler distance and the average distance to generate a first sample data set;

[0015] Counting the total number of data of the first sample in the first sample data set;

[0016] Calculating a first cluster number according to the total number of data;

[0017] Clustering the first samples in the first sample data set based on the first clustering number to obtain a second sample data set; the second sample data set includes a plurality of first clustering clusters corresponding to the first clustering number; each first clustering cluster corresponds to a second sample;

[0018] Calculating a second cluster number according to the first cluster number;

[0019] Extracting two second samples with the smallest second Euler distance from the second sample data set, generating a second cluster, and adding the second cluster to the preset third sample data set;

[0020] Determine whether the number of the second clusters in the third sample data set is equal to the second number of clusters;

[0021] If yes, respectively calculate the arithmetic mean of the first samples in each of the second clusters;

[0022] Determine whether the difference between the arithmetic means of any two second clusters is greater than a preset threshold;

[0023] If so, each second cluster is determined as a network attack team.

[0024] Optionally, it also includes:

[0025] If the number of the second clusters in the third sample data set is not equal to the second cluster number, return to the step of extracting two second samples with the smallest second Euler distance from the second sample data set, generating a second cluster, and adding the second cluster to the preset third sample data set.

[0026] Optionally, it also includes:

[0027] If the difference between the arithmetic means of two second clustering clusters is not greater than a preset threshold, the second clustering number is set to the first clustering number, the third sample data set is set to the second sample data set, and the step of calculating the second clustering number based on the first clustering number is returned.

[0028] Optionally, the step of extracting a first sample from the standardized log data set according to the first Euler distance and the average distance to generate a first sample data set includes:

[0029] Data objects whose first Euler distance is not greater than the average distance are extracted from the standardized log data set as first samples to generate a first sample data set.

[0030] The present invention also provides a network attack team identification device, comprising:

[0031] An extraction module, used to extract network attack log data from a preset database;

[0032] A standardization processing module, used to perform standardization processing on the network attack log data to obtain a standardized log data set;

[0033] A clustering module, used for clustering the data objects in the standardized log data set to obtain multiple network attack teams;

[0034] A team portrait generation module, used to generate a team portrait of each network attack team;

[0035] The target network attack team determination module is used to match the network anomaly information with multiple team portraits when receiving the network anomaly information, and determine the target network attack team corresponding to the network anomaly information.

[0036] Optionally, the clustering module includes:

[0037] A first Euler distance and average distance calculation submodule, configured to calculate a first Euler distance of each of the data objects in the standardized log data set and an average distance of all the data objects;

[0038] A first sample data set generating submodule, configured to extract a first sample from the standardized log data set according to the first Euler distance and the average distance, to generate a first sample data set;

[0039] A data total generating submodule, used for counting the data total of the first sample in the first sample data set;

[0040] A first cluster number calculation submodule, used for calculating a first cluster number according to the total number of data;

[0041] A second sample data set generating submodule, configured to cluster the first samples in the first sample data set based on the first clustering number to obtain a second sample data set; the second sample data set includes a plurality of first clustering clusters corresponding to the first clustering number; each first clustering cluster corresponds to a second sample;

[0042] A second cluster number calculation submodule, used to calculate a second cluster number according to the first cluster number;

[0043] A second cluster generation submodule, used for extracting two second samples with the smallest second Euler distance from the second sample data set, generating a second cluster, and adding the second cluster to a preset third sample data set;

[0044] A first judgment submodule, used for judging whether the number of the second clusters in the third sample data set is equal to the second cluster number;

[0045] an arithmetic mean calculation submodule, used for, if yes, respectively calculating the arithmetic mean of the first samples in each of the second clusters;

[0046] A second judgment submodule is used to judge whether the difference between the arithmetic means of any two second clusters is greater than a preset threshold;

[0047] The network attack team determination submodule is used to, if yes, determine each second cluster as a network attack team.

[0048] Optionally, it also includes:

[0049] The first return submodule is used to return to the step of extracting two second samples with the smallest second Euler distance from the second sample data set, generating a second cluster, and adding the second cluster to the preset third sample data set if the number of the second cluster clusters in the third sample data set is not equal to the second cluster number.

[0050] The present invention also provides an electronic device, the device comprising a processor and a memory:

[0051] The memory is used to store program code and transmit the program code to the processor;

[0052] The processor is used to execute the network attack team identification method as described in any one of the above items according to the instructions in the program code.

[0053] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store program code, and the program code is used to execute the network attack team identification method as described in any one of the above items.

[0054] It can be seen from the above technical scheme that the present invention has the following advantages: the present invention obtains multiple network attack teams with the same attack behavior by clustering the network attack log data, and then matches the real-time received network anomaly information with the network attack team to quickly determine whether the network anomaly information is a network attack initiated by the network attack team, thereby effectively and accurately identifying the network attack. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0056] Figure 1 A flowchart of a method for identifying a network attack team provided by an embodiment of the present invention;

[0057] Figure 2 A flowchart of a method for identifying a network attack team provided by another embodiment of the present invention;

[0058] Figure 3 A structural block diagram of a network attack team identification device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0059] The embodiments of the present invention provide a network attack team identification method, device, electronic device and storage medium, which are used to solve the technical problem that network attacks cannot be effectively and accurately identified from massive alarm information.

[0060] In order to make the purpose, features and advantages of the present invention more obvious and easy to understand, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described below are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0061] See also Figure 1 , Figure 1 A flowchart of the steps of a network attack team identification method provided by an embodiment of the present invention.

[0062] The present invention provides a network attack team identification method, which may specifically include the following steps:

[0063] Step 101, extracting network attack log data from a preset database;

[0064] In the embodiment of the present invention, a database storing network behavior log data may be connected, and network attack log data to be clustered may be selected from the database.

[0065] Among them, network attack log data mainly includes field information such as source IP, destination IP, generation time, and log summary.

[0066] Step 102, standardizing the network attack log data to obtain a standardized log data set;

[0067] In the embodiment of the present invention, standardization processing refers to determining whether the IP address format of the network attack log data is a standard IP address format. If not, modifying it to a standard IP address format, such as 120.23.44.55, thereby obtaining a standardized log data set.

[0068] Step 103, clustering the data objects in the standardized log data set to obtain multiple network attack teams;

[0069] After obtaining the standardized log data set, the data objects in the standardized log data set may be clustered to obtain multiple abnormal data sets, each of which corresponds to a network attack team.

[0070] It is important to understand that clustering can group attacks with the same behavior, preferred attack methods, and features together. Generally speaking, attacks with the same behavior, preferred attack methods, and features are likely to come from the same network attack team. Therefore, clustering is used to divide the standardized log data set by network attack team.

[0071] In one example, a K-means algorithm may be used to cluster the standardized log data set.

[0072] K-means clustering algorithm is an iterative clustering algorithm. Its steps are: divide the data into K groups in advance, randomly select K objects as the initial cluster centers, and then calculate the distance between each object and each seed cluster center, and assign each object to the cluster center closest to it. The cluster centers and the objects assigned to them represent a cluster.

[0073] Step 104, generating a team portrait of each network attack team;

[0074] After clustering the data objects in the standardized log data set to obtain multiple network attack teams, a team portrait of each network attack team can be generated. The team portrait is used to characterize the behavior, preferences, attack methods and characteristics of each network attack team.

[0075] Step 105, when network anomaly information is received, the network anomaly information is matched in multiple team portraits to determine the target network attack team corresponding to the network anomaly information.

[0076] After forming a team portrait of each network attack team, the network attacks of each network attack team can be accurately located in the massive network anomaly information, thereby effectively and accurately identifying the real network attacks in the massive network anomaly information.

[0077] The present invention obtains multiple network attack teams with the same attack behavior by clustering network attack log data, and then matches the network anomaly information received in real time with the network attack team to quickly determine whether the network anomaly information is a network attack initiated by the network attack team, thereby effectively and accurately identifying network attacks.

[0078] See also Figure 2 , Figure 2 A flowchart of a method for identifying a network attack team provided by another embodiment of the present invention. Specifically, the following steps may be included:

[0079] Step 201, extracting network attack log data from a preset database;

[0080] Step 202, standardizing the network attack log data to obtain a standardized log data set;

[0081] Steps 201-202 are similar to steps 101-102. For details, please refer to the description of steps 101-102, which will not be repeated here.

[0082] Step 203, calculating the first Euler distance of each data object in the standardized log data set and the average distance of all data objects;

[0083] Step 204, extracting a first sample from the standardized log data set according to the first Euler distance and the average distance to generate a first sample data set;

[0084] In the embodiment of the present invention, before clustering is performed, isolated points may be firstly found from the standardized log data set to eliminate the interference of the isolated points on clustering, thereby obtaining a first sample data set without isolated points.

[0085] In a specific implementation, the first Euler distance of each data object and the average distance of all data objects in the standardized log data set may be calculated to filter out isolated points by using the first Euler distance of each data object and the average distance.

[0086] In one example, extracting a first sample from a standardized log data set according to the first Euler distance and the average distance to generate a first sample data set may include:

[0087] Data objects whose first Euler distance is not greater than the average distance are extracted from the standardized log data set as first samples to generate a first sample data set.

[0088] In the embodiment of the present invention, when the first Euler distance of a data object is greater than the average distance, it can be considered that the point is an isolated point in the standardized log data set and should be deleted. The data object whose first Euler distance is not greater than the average distance is used as the first sample to generate a first sample data set.

[0089] Step 205, counting the total number of data of the first sample in the first sample data set;

[0090] Step 206, calculating the first cluster number according to the total number of data;

[0091] After eliminating isolated points, the total number of data n of the first sample in the first sample data set can be calculated, and the first cluster number k can be calculated based on the total number of data n:

[0092] k=n^0.5

[0093] Step 207: clustering the first sample in the first sample data set based on the first cluster number to obtain a second sample data set; the second sample data set includes a plurality of first cluster clusters corresponding to the first cluster number; each first cluster cluster corresponds to a second sample;

[0094] Then, the first sample data set is input into the K-means algorithm, and k first clusters can be obtained through calculation. Each first cluster is used as a second sample for the next clustering.

[0095] Step 208, calculating a second cluster number according to the first cluster number;

[0096] After clustering the first sample data set to obtain k first clusters, the second cluster number K for clustering can be calculated based on the first cluster number:

[0097]

[0098] Step 209, extracting two second samples with the smallest second Euler distance from the second sample data set, generating a second cluster, and adding the second cluster to the preset third sample data set;

[0099] The two second samples with the smallest second Euler distance in the second sample data set are added into the third sample data set as second clusters, and the two second samples are deleted from the second sample data set.

[0100] Step 210, determining whether the number of second clusters in the third sample data set is equal to the second cluster number;

[0101] Step 211, if yes, respectively calculate the arithmetic mean of the first samples in each second cluster;

[0102] Then, it is determined whether the number of the second clusters in the third sample data set is equal to the number of the second clusters. If so, the clustering is completed. At this time, the arithmetic mean of the first samples in each second cluster can be calculated respectively to determine whether to end the clustering according to the arithmetic mean.

[0103] It should be noted that, in an embodiment of the present invention, it also includes: if the number of second clusters in the third sample data set is not equal to the second cluster number, then return to extract the two second samples with the smallest second Euler distance from the second sample data set, generate a second cluster, and add the second cluster to the preset third sample data set.

[0104] Specifically, when the number of the second clustering clusters in the third sample data set is not equal to the second cluster number, it means that the clustering is not completed yet, and step 209 can be repeated until the number of the second clustering clusters in the third sample data set is equal to the second cluster number.

[0105] Step 212, determining whether the difference between the arithmetic means of any two second clusters is greater than a preset threshold;

[0106] Step 213: if yes, determine each second cluster as a network attack team;

[0107] In the embodiment of the present invention, whether to terminate clustering can be determined by determining whether the difference between the arithmetic means of any two second clusters is greater than a preset threshold. If so, it indicates that any two second clusters are not similar at present, and the data in each second cluster can form an abnormal data set, and the data in the abnormal data set is sent by the same network attack team.

[0108] It is worth noting that, in the embodiment of the present invention, it also includes:

[0109] If the difference between the arithmetic means of two second clusters is not greater than the preset threshold, the second cluster number is set to the first cluster number, the third sample data set is set to the second sample data set, and the step of calculating the second cluster number according to the first cluster number is returned.

[0110] Specifically, when the difference between the arithmetic means of two second clusters is not greater than the preset threshold, the two second clusters are similar and can be clustered again. Therefore, the second cluster number can be set to the first cluster number, the third sample data set can be set to the second sample data set, and the process returns to step 208. This process continues until the difference between the arithmetic means of any two second clusters is greater than the preset threshold. It should be noted that the preset threshold can be flexibly set according to the actual application situation, and the embodiment of the present invention does not impose any specific restrictions on this.

[0111] Step 214, generating a team portrait of each network attack team;

[0112] After clustering the data objects in the standardized log data set to obtain multiple network attack teams, a team portrait of each network attack team can be generated. The team portrait is used to characterize the behavior, preferences, attack methods and characteristics of each network attack team.

[0113] Step 215, when network anomaly information is received, the network anomaly information is matched in multiple team portraits to determine the target network attack team corresponding to the network anomaly information.

[0114] After forming a team portrait of each network attack team, the network attacks of each network attack team can be accurately located in the massive network anomaly information, thereby effectively and accurately identifying the real network attacks in the massive network anomaly information.

[0115] The present invention obtains multiple network attack teams with the same attack behavior by clustering network attack log data, and then matches the network anomaly information received in real time with the network attack team to quickly determine whether the network anomaly information is a network attack initiated by the network attack team, thereby effectively and accurately identifying network attacks.

[0116] See also Figure 3 , Figure 3 A structural block diagram of a network attack team identification device provided in an embodiment of the present invention.

[0117] An embodiment of the present invention provides a network attack team identification device, including:

[0118] Extraction module 301, used to extract network attack log data from a preset database;

[0119] The standardization processing module 302 is used to perform standardization processing on the network attack log data to obtain a standardized log data set;

[0120] A clustering module 303 is used to cluster the data objects in the standardized log data set to obtain multiple network attack teams;

[0121] A team portrait generation module 304 is used to generate a team portrait of each network attack team;

[0122] The target network attack team determination module 305 is used to match the network anomaly information in multiple team portraits when receiving the network anomaly information, and determine the target network attack team corresponding to the network anomaly information.

[0123] In the embodiment of the present invention, the clustering module 303 includes:

[0124] A first Euler distance and average distance calculation submodule, used to calculate the first Euler distance of each data object in the standardized log data set and the average distance of all data objects;

[0125] A first sample data set generating submodule is used to extract a first sample from the standardized log data set according to the first Euler distance and the average distance to generate a first sample data set;

[0126] A data total generation submodule is used to count the total data of the first sample in the first sample data set;

[0127] A first cluster number calculation submodule, used to calculate the first cluster number according to the total number of data;

[0128] A second sample data set generation submodule is used to cluster the first sample in the first sample data set based on the first cluster number to obtain a second sample data set; the second sample data set includes a plurality of first cluster clusters corresponding to the first cluster number; each first cluster cluster corresponds to a second sample;

[0129] A second cluster number calculation submodule, used to calculate a second cluster number according to the first cluster number;

[0130] A second cluster generation submodule, used for extracting two second samples with the smallest second Euler distance from the second sample data set, generating a second cluster, and adding the second cluster to the preset third sample data set;

[0131] A first judgment submodule, used to judge whether the number of the second clusters in the third sample data set is equal to the second cluster number;

[0132] an arithmetic mean calculation submodule, for respectively calculating the arithmetic mean of the first samples in each second cluster;

[0133] A second judgment submodule is used to judge whether the difference between the arithmetic means of any two second clusters is greater than a preset threshold;

[0134] The network attack team determination submodule is used to, if yes, determine each second cluster as a network attack team.

[0135] In the embodiment of the present invention, the clustering module 303 further includes:

[0136] The first return submodule is used to return to the step of extracting two second samples with the smallest second Euler distance from the second sample data set, generating a second cluster, and adding the second cluster to the preset third sample data set if the number of second clusters in the third sample data set is not equal to the second cluster number.

[0137] In the embodiment of the present invention, the clustering module 303 further includes:

[0138] The second return submodule is used to set the second cluster number to the first cluster number, set the third sample data set to the second sample data set, and return to the step of calculating the second cluster number based on the first cluster number if the difference between the arithmetic means of two second cluster clusters is not greater than a preset threshold.

[0139] In the embodiment of the present invention, the first sample data set generation submodule includes:

[0140] The first sample data set generating unit is used to extract data objects whose first Euler distance is not greater than the average distance from the standardized log data set as first samples to generate the first sample data set.

[0141] An embodiment of the present invention further provides an electronic device, the device comprising a processor and a memory:

[0142] The memory is used to store the program code and transmit the program code to the processor;

[0143] The processor is used to execute the network attack team identification method of the embodiment of the present invention according to the instructions in the program code.

[0144] An embodiment of the present invention further provides a computer-readable storage medium, which is used to store program code, and the program code is used to execute the network attack team identification method of the embodiment of the present invention.

[0145] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0146] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0147] It will be appreciated by those skilled in the art that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0148] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0149] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0150] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0151] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0152] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0153] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network attack team identification method, characterized in that: include: Extract network attack log data from a preset database; Standardizing the network attack log data to obtain a standardized log data set; Clustering the data objects in the standardized log data set to obtain multiple network attack teams; Generate a team profile of each of the cyber attack teams; When network anomaly information is received, the network anomaly information is matched with the plurality of team portraits to determine a target network attack team corresponding to the network anomaly information; The step of clustering the data objects in the standardized log data set to obtain multiple network attack teams includes: Calculate the first Euler distance of each of the data objects in the standardized log data set and the average distance of all the data objects; Extracting a first sample from the standardized log data set according to the first Euler distance and the average distance to generate a first sample data set; Counting the total number of data of the first sample in the first sample data set; Calculating a first cluster number according to the total number of data; Clustering the first samples in the first sample data set based on the first clustering number to obtain a second sample data set; the second sample data set includes a plurality of first clustering clusters corresponding to the first clustering number; each first clustering cluster corresponds to a second sample; Calculating a second cluster number according to the first cluster number; Extracting two second samples with the smallest second Euler distance from the second sample data set, generating a second cluster, and adding the second cluster to the preset third sample data set; Determine whether the number of the second clusters in the third sample data set is equal to the second number of clusters; If yes, respectively calculate the arithmetic mean of the first samples in each of the second clusters; Determine whether the difference between the arithmetic means of any two second clusters is greater than a preset threshold; If yes, each second cluster is identified as a network attack team; Among them, it also includes: If the number of the second clusters in the third sample data set is not equal to the second cluster number, return to the step of extracting two second samples with the smallest second Euler distance from the second sample data set, generating a second cluster, and adding the second cluster to the preset third sample data set.

2. The network attack team identification method according to claim 1 is characterized in that: Also includes: If the difference between the arithmetic means of two second clustering clusters is not greater than a preset threshold, the second clustering number is set to the first clustering number, the third sample data set is set to the second sample data set, and the step of calculating the second clustering number based on the first clustering number is returned.

3. The network attack team identification method according to claim 1 is characterized in that: The step of extracting a first sample from the standardized log data set according to the first Euler distance and the average distance to generate a first sample data set includes: Data objects whose first Euler distance is not greater than the average distance are extracted from the standardized log data set as first samples to generate a first sample data set.

4. A network attack team identification device, characterized in that: include: An extraction module, used to extract network attack log data from a preset database; A standardization processing module, used to perform standardization processing on the network attack log data to obtain a standardized log data set; A clustering module, used for clustering the data objects in the standardized log data set to obtain multiple network attack teams; A team portrait generation module, used to generate a team portrait of each network attack team; A target network attack team determination module is used to match the network anomaly information with the multiple team portraits when receiving the network anomaly information, and determine the target network attack team corresponding to the network anomaly information; Wherein, the clustering module includes: A first Euler distance and average distance calculation submodule, configured to calculate a first Euler distance of each of the data objects in the standardized log data set and an average distance of all the data objects; A first sample data set generating submodule, configured to extract a first sample from the standardized log data set according to the first Euler distance and the average distance, to generate a first sample data set; A data total generating submodule, used for counting the data total of the first sample in the first sample data set; A first cluster number calculation submodule, used for calculating a first cluster number according to the total number of data; A second sample data set generating submodule, configured to cluster the first samples in the first sample data set based on the first clustering number to obtain a second sample data set; the second sample data set includes a plurality of first clustering clusters corresponding to the first clustering number; each first clustering cluster corresponds to a second sample; A second cluster number calculation submodule, used to calculate a second cluster number according to the first cluster number; A second cluster generation submodule, used for extracting two second samples with the smallest second Euler distance from the second sample data set, generating a second cluster, and adding the second cluster to a preset third sample data set; A first judgment submodule, used for judging whether the number of the second clusters in the third sample data set is equal to the second cluster number; an arithmetic mean calculation submodule, used for, if yes, respectively calculating the arithmetic mean of the first samples in each of the second clusters; A second judgment submodule is used to judge whether the difference between the arithmetic means of any two second clusters is greater than a preset threshold; A network attack team determination submodule, configured to, if yes, determine each second cluster as a network attack team; Among them, it also includes: The first return submodule is used to return to the step of extracting two second samples with the smallest second Euler distance from the second sample data set, generating a second cluster, and adding the second cluster to the preset third sample data set if the number of the second cluster clusters in the third sample data set is not equal to the second cluster number.

5. An electronic device, characterized in that: The device comprises a processor and a memory: The memory is used to store program code and transmit the program code to the processor; The processor is used to execute the network attack team identification method described in any one of claims 1-3 according to the instructions in the program code.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store program code, and the program code is used to execute the network attack team identification method described in any one of claims 1-3.

Images