IP classification method, system, device, electronic device and storage medium

Abstract

The embodiment of the present invention provides an IP classification method, system, device, electronic device and storage medium, the method comprising: receiving information to be classified sent by a log analysis unit, and calculating the diversion score corresponding to the external attack IP based on the attack behavior information of each external attack IP; and, calculating the diversion score corresponding to each target IP based on the attack behavior information of each external attack IP corresponding to the target IP; for each external attack IP, if the diversion score corresponding to the external attack IP is greater than a first preset score threshold, or the diversion score corresponding to the target IP attacked by the external attack IP is greater than a second preset score threshold, the external attack is determined to be an abnormal IP. The method solves the problem that the existing analysis method for network traffic cannot meet the needs of the current advanced security analysis system, and realizes accurate selection and control of the storage of traffic data.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an IP classification method, system, device, electronic equipment and storage medium. Background Art

[0002] In the field of information security, the analysis of network traffic has become an important analysis method in information security analysis. At present, advanced analysis methods such as complex correlation analysis models, AI models, and UEBA (User Entity Behavior Analytics) models are used to directly analyze network traffic and discover network attack events such as APT and 0day.

[0003] However, when analyzing network attack incidents through advanced security analysis methods, on the one hand, the capabilities of traditional security detection equipment are not fully utilized and a large amount of computing resources are consumed. On the other hand, too much positive sample traffic will also lead to a large number of false alarms. At present, the two problems are dealt with by saving the original traffic for retrospective analysis after the detection device generates an alarm. However, this response method will lead to new problems: first, the strategy of saving traffic in this method is too rough, and it is impossible to accurately select and control the storage of traffic data, resulting in excessive or missing data; second, this method cannot be linked to the back-end advanced security analysis system in real time, and it belongs to post-event tracing. These problems make the existing analysis methods for network traffic unable to meet the needs of the current advanced security analysis system. Summary of the invention

[0004] The purpose of the embodiments of the present invention is to provide an IP classification method, system, device, electronic device and storage medium to solve the problem that the existing analysis method for network traffic cannot meet the needs of current advanced security analysis systems.

[0005] In a first aspect, an embodiment of the present invention provides an IP classification method, which is applied to an IP classification unit in an IP classification system, wherein the IP classification system further includes a log analysis unit, and the method includes:

[0006] Receive the information to be classified sent by the log analysis unit, the information to be classified includes: each external attack IP determined by the log analysis unit based on the log information of the security detection device, the attack behavior information of each external attack IP and the target IP attacked by each external attack IP;

[0007] Based on the attack behavior information of each of the external attack IPs, the diversion score corresponding to the external attack IP is calculated; and based on the attack behavior information of each of the external attack IPs corresponding to each of the target IPs, the diversion score corresponding to the target IP is calculated;

[0008] For each of the external attack IPs, if the diversion score corresponding to the external attack IP is greater than the first preset score threshold, or the diversion score corresponding to the target IP attacked by the external attack IP is greater than the second preset score threshold, the external attack is determined to be an abnormal IP.

[0009] Optionally, after determining that the external attack is an abnormal IP, the method further includes:

[0010] The traffic of the abnormal IP address is directed to an advanced security analysis device.

[0011] Optionally, the attack behavior information of each external attack IP and calculating the traffic diversion score corresponding to the external attack IP include:

[0012] Determine each attack behavior corresponding to the attack behavior information of each external attack IP;

[0013] According to the attack type to which each attack behavior belongs, the attack chain stage coefficient corresponding to the attack behavior is determined;

[0014] For each attack behavior, the weight value corresponding to the attack behavior is calculated based on the number of times the attack behavior occurs, the target IP attribute information attacked by the attack behavior, and the attacked information;

[0015] For each of the external attack IPs, the drainage score corresponding to the external attack IP is calculated according to the weight values ​​corresponding to each attack behavior corresponding to the external attack IP and the attack chain stage coefficient.

[0016] Optionally, the calculating the traffic diversion score corresponding to each target IP based on the attack behavior information of each external attack IP corresponding to the target IP includes:

[0017] For each target IP, the drainage score corresponding to the target IP is calculated according to the weight values ​​corresponding to the attack behaviors of each external attack IP attacking the target IP and the attack chain stage coefficient.

[0018] In a second aspect, an embodiment of the present invention provides an IP classification system, including:

[0019] A log analysis unit, used to collect log information of the security detection device, and determine each external attack IP, the attack behavior information of each external attack IP, and the target IP attacked by each external attack IP based on the log information;

[0020] The IP classification unit is used to receive the information to be classified sent by the log analysis unit, and the information to be classified includes: each external attack IP determined by the log analysis unit based on the log information of the security detection device, the attack behavior information of each external attack IP and the target IP attacked by each external attack IP; based on the attack behavior information of each external attack IP, the corresponding diversion score of the external attack IP is calculated; and based on the attack behavior information of each external attack IP corresponding to each target IP, the corresponding diversion score of the target IP is calculated; for each external attack IP, if the corresponding diversion score of the external attack IP is greater than a first preset score threshold, or the corresponding diversion score of the target IP attacked by the external attack IP is greater than a second preset score threshold, the external attack is determined to be an abnormal IP.

[0021] Optionally, a traffic scheduling unit is used to direct the traffic of the abnormal IP to an advanced security analysis device.

[0022] Optionally, the IP classification unit is specifically used to determine each attack behavior corresponding to the attack behavior information of each external attack IP; for the attack type to which each attack behavior belongs, determine the attack chain stage coefficient corresponding to the attack behavior; for each attack behavior, calculate the weight value corresponding to the attack behavior based on the number of times the attack behavior occurs, the target IP attribute information attacked by the attack behavior, and the attacked information; for each external attack IP, calculate the diversion score corresponding to the external attack IP based on the weight values ​​corresponding to each attack behavior corresponding to the external attack IP and the attack chain stage coefficient.

[0023] Optionally, the IP classification unit is specifically used to calculate, for each target IP, a diversion score corresponding to the target IP according to weight values ​​and attack chain stage coefficients corresponding to each attack behavior of each external attack IP attacking the target IP.

[0024] In a third aspect, an embodiment of the present invention provides an IP classification device, which is applied to an IP classification unit in an IP classification system, wherein the IP classification system further includes a log analysis unit, and the device includes:

[0025] An information receiving module, used to receive the information to be classified sent by the log analysis unit, wherein the information to be classified includes: each external attack IP determined by the log analysis unit based on the log information of the security detection device, the attack behavior information of each external attack IP, and the target IP attacked by each external attack IP;

[0026] A traffic diversion score calculation module, used to calculate the traffic diversion score corresponding to each external attack IP based on the attack behavior information of each external attack IP; and to calculate the traffic diversion score corresponding to each target IP based on the attack behavior information of each external attack IP corresponding to each target IP;

[0027] The IP classification module is used to determine that for each of the external attack IPs, if the diversion score corresponding to the external attack IP is greater than the first preset score threshold, or the diversion score corresponding to the target IP attacked by the external attack IP is greater than the second preset score threshold, the external attack is determined to be an abnormal IP.

[0028] Optionally, the device further includes:

[0029] The traffic diversion module is used to divert the traffic of the abnormal IP to the advanced security analysis device.

[0030] Optionally, the diversion score calculation module is specifically used to determine each attack behavior corresponding to the attack behavior information of each external attack IP; for the attack type to which each attack behavior belongs, determine the attack chain stage coefficient corresponding to the attack behavior; for each attack behavior, calculate the weight value corresponding to the attack behavior based on the number of times the attack behavior occurs, the target IP attribute information attacked by the attack behavior, and the attacked information; for each external attack IP, calculate the diversion score corresponding to the external attack IP based on the weight values ​​corresponding to each attack behavior corresponding to the external attack IP and the attack chain stage coefficient.

[0031] Optionally, the diversion score calculation module is specifically used to calculate the diversion score corresponding to each target IP according to the weight values ​​corresponding to each attack behavior of each external attack IP attacking the target IP and the attack chain stage coefficient.

[0032] In a fourth aspect, an embodiment of the present invention provides an electronic device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0033] Memory, used to store computer programs;

[0034] The processor is used to implement any method step described in the first aspect when executing the program stored in the memory.

[0035] In a fifth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any one of the first aspects are implemented.

[0036] Beneficial effects of the embodiments of the present invention:

[0037] The method provided by the embodiment of the present invention is adopted to receive the information to be classified sent by the log analysis unit, and the diversion score corresponding to the external attack IP is calculated based on the attack behavior information of each external attack IP; and the diversion score corresponding to the target IP is calculated based on the attack behavior information of each external attack IP corresponding to each target IP; for each external attack IP, if the diversion score corresponding to the external attack IP is greater than the first preset score threshold, or the diversion score corresponding to the target IP attacked by the external attack IP is greater than the second preset score threshold, the external attack is determined to be an abnormal IP. The method provided by the embodiment of the present invention classifies the external attack IP by calculating the diversion score corresponding to the external attack IP and the diversion score corresponding to the target IP. Then, according to the analysis result, only the traffic of the classified abnormal IP can be diverted to the advanced security analysis device, instead of diverting all the traffic of the external attack IP to the advanced security analysis device, so as to realize the accurate selection and control of the storage of the traffic data, and at the same time, it also avoids the problem of high false alarm rate caused by diverting the normal traffic of a large number of non-abnormal IPs to the advanced security analysis device. Moreover, the method provided by the embodiment of the present invention can classify external attack IPs in real time according to the log information of the security detection device, thereby directing the abnormal IPs to the advanced security analysis device in real time, and realizing real-time tracing. Therefore, the method provided by the embodiment of the present invention solves the problem that the existing analysis method for network traffic cannot meet the needs of the current advanced security analysis system, realizes the accurate selection and control of the preservation of traffic data, avoids the problem of high false alarm rate caused by directing the normal traffic of a large number of non-abnormal IPs to the advanced security analysis device, and realizes the real-time tracing of abnormal IPs.

[0038] Of course, it is not necessary to achieve all of the advantages described above at the same time to implement any product or method of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other embodiments can also be obtained based on these drawings.

[0040] Figure 1 A flow chart of an IP classification method provided by an embodiment of the present invention;

[0041] Figure 2 A flowchart of calculating the diversion score corresponding to the external attack IP provided by an embodiment of the present invention;

[0042] Figure 3A schematic diagram of attack behavior provided by an embodiment of the present invention;

[0043] Figure 4 A schematic diagram of the structure of an IP classification system provided by an embodiment of the present invention;

[0044] Figure 5 Another structural diagram of the IP classification system provided by the embodiment of the present invention;

[0045] Figure 6 A schematic diagram of the structure of an IP classification device provided by an embodiment of the present invention;

[0046] Figure 7 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0047] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field based on this application belong to the scope of protection of the present invention.

[0048] In order to solve the problem that the existing analysis methods for network traffic cannot meet the needs of current advanced security analysis systems and provide more efficient and accurate traffic data for advanced security analysis systems, the embodiments of the present invention provide an IP classification method, system, device, electronic device, computer-readable storage medium and computer program product.

[0049] The IP classification method provided in the embodiment of the present invention can be applied to any electronic device that can perform data analysis, for example, a computer, a server, or a mobile phone, etc., and is not specifically limited here.

[0050] Figure 1 A flow chart of an IP classification method provided by an embodiment of the present invention, the method is applied to an IP classification unit in an IP classification system, the IP classification system also includes a log analysis unit, the method includes:

[0051] Step 101: receiving information to be classified sent by the log analysis unit.

[0052] The information to be classified includes: each external attack IP determined by the log analysis unit based on the log information of the security detection device, the attack behavior information of each external attack IP, and the target IP attacked by each external attack IP.

[0053] In the embodiment of the present invention, the security detection device may include an intrusion detection system and a web application firewall, etc. Among them, the intrusion detection system is a network security device that monitors network transmission in real time and issues an alarm or takes active response measures when suspicious transmission is found.

[0054] In an embodiment of the present invention, the log analysis unit can receive log information sent by the security detection device from the network in real time, and analyze the security alarm information in the log information to obtain each external attack IP, the attack behavior information of each of the external attack IPs, and the target IP attacked by each of the external attack IPs.

[0055] Among them, the external attack IP is the external IP that generates the attack behavior, and the target IP is the IP attacked by the external attack IP. The attack behavior of the external attack IP includes but is not limited to: scanning and detection, vulnerability exploitation, Trojan upload, remote control and abnormal behavior. Among them, "scanning and detection" refers to the external attack IP performing scanning operations or detection operations on the target IP, "vulnerability exploitation" refers to the external attack IP using the system vulnerability of the target IP to perform corresponding operations, "Trojan upload" refers to the external attack IP spreading Trojan viruses to the target IP, "remote control" refers to the external attack IP remotely controlling the target IP, and "abnormal behavior" refers to the external attack IP taking any unauthorized actions against the target IP, such as wantonly attacking the target IP.

[0056] Step 102, based on the attack behavior information of each of the external attack IPs, calculate the diversion score corresponding to the external attack IP; and, based on the attack behavior information of each of the external attack IPs corresponding to each of the target IPs, calculate the diversion score corresponding to the target IP.

[0057] Step 103, for each of the external attack IPs, if the diversion score corresponding to the external attack IP is greater than the first preset score threshold, or the diversion score corresponding to the target IP attacked by the external attack IP is greater than the second preset score threshold, the external attack is determined to be an abnormal IP.

[0058] In the embodiment of the present invention, the diversion score corresponding to the external attack IP reflects the severity of the attack behavior of the external attack IP on each target IP. The higher the diversion score corresponding to the external attack IP, the higher the severity of the attack behavior of the external attack IP on each target IP, and the greater the possibility that the external attack IP is an abnormal IP.

[0059] The diversion score corresponding to the target IP reflects the possibility that all attacking IPs that attack the target IP are abnormal IPs. The higher the diversion score corresponding to the target IP, the greater the possibility that all attacking IPs that attack the target IP are abnormal IPs.

[0060] In the embodiment of the present invention, the first preset score threshold can be set to 2.5 or 3 according to the actual application scenario, which is not specifically limited here. The second preset score threshold can be set to 4 or 5 according to the actual application scenario, which is not specifically limited here.

[0061] In the embodiment of the present invention, after determining that the external attack is an abnormal IP, the traffic of the abnormal IP can also be directed to the advanced security analysis device. The advanced security analysis device can perform a more detailed analysis on the traffic of the abnormal IP, and the specific analysis process is not repeated here.

[0062] The method provided by the embodiment of the present invention is adopted to receive the information to be classified sent by the log analysis unit, and the diversion score corresponding to the external attack IP is calculated based on the attack behavior information of each external attack IP; and the diversion score corresponding to the target IP is calculated based on the attack behavior information of each external attack IP corresponding to each target IP; for each external attack IP, if the diversion score corresponding to the external attack IP is greater than the first preset score threshold, or the diversion score corresponding to the target IP attacked by the external attack IP is greater than the second preset score threshold, the external attack is determined to be an abnormal IP. The method provided by the embodiment of the present invention classifies the external attack IP by calculating the diversion score corresponding to the external attack IP and the diversion score corresponding to the target IP. Then, according to the analysis result, only the traffic of the classified abnormal IP can be diverted to the advanced security analysis device, instead of diverting all the traffic of the external attack IP to the advanced security analysis device, so as to realize the accurate selection and control of the storage of the traffic data, and at the same time, it also avoids the problem of high false alarm rate caused by diverting the normal traffic of a large number of non-abnormal IPs to the advanced security analysis device. Moreover, the method provided by the embodiment of the present invention can classify external attack IPs in real time according to the log information of the security detection device, thereby directing the abnormal IPs to the advanced security analysis device in real time, and realizing real-time tracing. Therefore, the method provided by the embodiment of the present invention solves the problem that the existing analysis method for network traffic cannot meet the needs of the current advanced security analysis system, realizes the accurate selection and control of the preservation of traffic data, avoids the problem of high false alarm rate caused by directing the normal traffic of a large number of non-abnormal IPs to the advanced security analysis device, and realizes the real-time tracing of abnormal IPs.

[0063] In one possible implementation, Figure 2 The flowchart of calculating the diversion score corresponding to the external attack IP provided by the embodiment of the present invention is as follows: Figure 2 As shown, the attack behavior information of each external attack IP and calculating the diversion score corresponding to the external attack IP may include:

[0064] Step 201, determining each attack behavior corresponding to the attack behavior information of each external attack IP.

[0065] In the embodiment of the present invention, different attack behaviors of the attack behavior information can be classified according to the identifiers of different behavior information to obtain various attack behaviors of various external attack IPs.

[0066] For example, when an external attack IP generates a "scanning detection 1" attack behavior, the attack behavior information may carry the identifier "xw01"; when an external attack IP generates a "trojan upload 1" attack behavior, the attack behavior information may carry the identifier "xw02", etc. Then, the "scanning detection 1" attack behavior and the "trojan upload 1" attack behavior in the attack behavior information may be analyzed based on the identifier "xw01" and the identifier "xw02".

[0067] Step 202: for each attack type to which the attack behavior belongs, determine the attack chain stage coefficient corresponding to the attack behavior.

[0068] The attack type to which the attack behavior belongs may include scanning detection, vulnerability exploitation, Trojan horse upload, remote control and abnormal behavior, etc. In the embodiment of the present invention, a corresponding attack chain stage coefficient may be pre-assigned to each attack type according to the severity of the attack behavior.

[0069] For example, the severity of each attack type such as "scanning detection", "vulnerability exploitation", "Trojan upload" and "remote control" increases in sequence, so the corresponding attack chain stage coefficients can be pre-assigned to each attack type such as "scanning detection", "vulnerability exploitation", "Trojan upload" and "remote control": 0.5, 1, 1.5 and 2, while the severity of "abnormal behavior" is lower than that of "Trojan upload", and the corresponding attack chain stage coefficient "1" can be pre-assigned to "abnormal behavior". Then the attack chain stage coefficients corresponding to all attack behaviors belonging to "scanning detection" are 0.5, the attack chain stage coefficients corresponding to all attack behaviors belonging to "vulnerability exploitation" are 1, the attack chain stage coefficients corresponding to all attack behaviors belonging to "Trojan upload" are 1.5, the attack chain stage coefficients corresponding to all attack behaviors belonging to "remote control" are 2, and the attack chain stage coefficients corresponding to all attack behaviors belonging to "abnormal behavior" are 1.

[0070] Step 203, for each attack behavior, a weight value corresponding to the attack behavior is calculated based on the number of times the attack behavior occurs, the attribute information of the target IP attacked by the attack behavior, and the attacked information.

[0071] In the embodiment of the present invention, taking into account automated attack behaviors and false alarm behaviors, etc., multiple identical alarm events will usually be generated for one destination IP. Highly harmful attack behaviors will often not be repeatedly attempted to cause multiple repeated alarms. In most networks, the homogeneity of servers is very strong, and different servers often have the same vulnerabilities and configuration errors. Therefore, the same problem in multiple different servers will cause the same alarm events to be generated on different servers. Based on this, the embodiment of the present invention can use the reverse TF-IDF (Term Frequency-inverse Document Frequency, a statistical analysis method for keywords) algorithm to calculate the weight value corresponding to the attack behavior. Specifically, for each attack behavior, the following formula can be used to calculate the corresponding weight value KPI x :

[0072]

[0073]

[0074] KPI x =TF -1 *IDF

[0075] The total number of assets of the destination IP is the number of devices that belong to the destination IP. For example, if the devices that belong to the destination IP "192.168.0.7" are terminal 1 and terminal 2, the total number of assets of the destination IP "192.168.0.7" is 2.

[0076] Step 204, for each of the external attack IPs, according to the weight values ​​corresponding to the attack behaviors corresponding to the external attack IP and the attack chain stage coefficients, calculate the diversion score corresponding to the external attack IP.

[0077] Specifically, for each of the external attack IPs, the sum of the products of the weight values ​​corresponding to the various attack behaviors corresponding to the external attack IP and the attack chain stage coefficient can be used as the diversion score corresponding to the external attack IP. For example, the attack behaviors corresponding to the external attack IP include: scanning detection 1 on the target IP1, and vulnerability exploitation 1 on the target IP2, wherein the weight value corresponding to scanning detection 1 is 0.2, and the weight value corresponding to vulnerability exploitation 1 is 0.5. Scanning detection 1 is "scanning detection", and the attack chain stage coefficient corresponding to scanning detection 1 is 0.5, and vulnerability exploitation 1 belongs to "vulnerability exploitation", and the attack chain stage coefficient corresponding to vulnerability exploitation 1 is 1. Then the diversion score corresponding to the external attack IP can be calculated as 0.2×0.5+0.5×1=0.6.

[0078] In the embodiment of the present invention, the process of calculating the traffic diversion score corresponding to each target IP based on the attack behavior information of each external attack IP corresponding to the target IP includes the following step A1:

[0079] Step A1, for each target IP, according to the weight value corresponding to each attack behavior of each external attack IP attacking the target IP and the attack chain stage coefficient, calculate the diversion score corresponding to the target IP.

[0080] Specifically, for each target IP, the sum of the products of the weight values ​​corresponding to the attack behaviors of each external attack IP attacking the target IP and the attack chain stage coefficients can be used as the drainage score corresponding to the external attack IP.

[0081] The following is a specific embodiment provided by the embodiments of the present invention. Figure 3 Schematic diagram of attack behaviors provided by an embodiment of the present invention. Table 1 is a corresponding table of attack behaviors, weight values, and attack chain stage coefficients provided by an embodiment of the present invention. As shown in Table 1, the weight values ​​and attack chain stage coefficients corresponding to each attack behavior are predetermined.

[0082] Table 1: Correspondence between attack behaviors, weight values, and attack chain stage coefficients

[0083]

[0084]

[0085] In this embodiment, the first preset score threshold can be set to 3, and the second preset score threshold can be set to 4.5. Figure 3 As shown in the figure, the destination IP is "192.168.0.7", which can be obtained from Table 1 and Figure 3 The traffic diversion score corresponding to the destination IP "192.168.0.7" is calculated as follows: the product of the weight value of "scanning detection 1" and the attack chain stage coefficient + the product of the weight value of "scanning detection 2" and the attack chain stage coefficient + the product of the weight value of "scanning detection 1" and the attack chain stage coefficient + the product of the weight value of "vulnerability exploitation 1" and the attack chain stage coefficient + the product of the weight value of "vulnerability exploitation 2" and the attack chain stage coefficient + the product of the weight value of "trojan upload 1" and the attack chain stage coefficient + the product of the weight value of "abnormal behavior 1" and the attack chain stage coefficient + the product of the weight value of "abnormal behavior 1" and the attack chain stage coefficient = 0.2 × 0.5 + 0.3 × 0.5 + 0.2 × 0.5 + 0.5 × 1.0 + 0.5 × 1.0 + 1.2 × 1.5 + 0.5 × 1.0 + 0.5 × 1.0 = 4.15.

[0086] If the external attack IP in a new log message is IP5, the destination IP is 192.168.0.7, and the external attack IP "IP5" generates abnormal behavior 1 on the destination IP "192.168.0.7", the diversion score corresponding to the destination IP "192.168.0.7" can be recalculated as 4.15+0.5=4.65. At this time, the diversion score corresponding to the destination IP "192.168.0.7" exceeds the second preset score threshold, and all external attack IPs attacking the destination IP "192.168.0.7" can be determined as abnormal IPs, that is, "IP1", "IP2", "IP3", "IP4" and "IP5" can all be determined as abnormal IPs. And the traffic of "IP1", "IP2", "IP3", "IP4" and "IP5" can be diverted to the advanced security analysis device.

[0087] If the second preset score threshold is increased to 5.0, diversion will not be triggered. The proportion of diversion can be reduced by adjusting the second preset score threshold. This also shows that it has a high tolerance from the perspective of the attacked party.

[0088] If we divert traffic from the attacker's perspective, we can calculate the diversion score corresponding to each external attack IP. Figure 3 As shown in the figure, for the external attack IP "IP3", the corresponding diversion score of the attack behavior of "IP3" on the target IP "192.168.0.7" is: the product of the weight value of vulnerability exploitation 1 and the attack chain stage coefficient + the product of the weight value of vulnerability exploitation 2 and the attack chain stage coefficient + the product of the weight value of Trojan upload 1 and the attack chain stage coefficient = 0.5×1.0+0.5×1.0+1.2×15=2.8.

[0089] If the attack behavior of "IP3" on the destination IP "192.168.0.8" is abnormal behavior 1, the total diversion score of the external attack IP "IP3" can be obtained as: 2.8+0.5=3.3. If the total diversion score of the external attack IP "IP3" is greater than the first preset score threshold "3", the external attack IP "IP3" can be determined as an abnormal IP, and "IP3" can be diverted to the advanced security analysis device. Based on the same method, the corresponding diversion scores of "IP1", "IP2", "IP4" and "IP5" can be calculated and compared with the first preset score threshold to determine whether it is an abnormal IP.

[0090] By adopting the method provided by the embodiment of the present invention, the multi-time and multi-target attack behaviors of the external attack IP can be considered. When an external attack IP disperses multiple times and multiple targets to generate attack behaviors, a response that triggers diversion can be generated; at the same time, by calculating the diversion score corresponding to the target IP and the diversion score corresponding to the external attack IP, a complete attack clue chain with all-round contextual scenarios can be constructed from the perspective of the attacker and the attacked, so that the back-end advanced security analysis equipment can judge the behavior nature of each related external attack IP by restoring the entire attack chain. In addition, by the method provided by the embodiment of the present invention, the overall traffic forwarding rate can be reduced by more than 80%, which can effectively reduce the analysis pressure of the back-end advanced security analysis equipment.

[0091] Figure 4 A schematic diagram of the structure of an IP classification system provided by an embodiment of the present invention is shown in FIG. Figure 4 As shown, the system includes a log analysis unit 401 and an IP classification unit 402;

[0092] The log analysis unit 401 is used to collect log information of the security detection device, and determine each external attack IP, the attack behavior information of each external attack IP, and the target IP attacked by each external attack IP based on the log information;

[0093] The IP classification unit 402 is used to receive the information to be classified sent by the log analysis unit, and the information to be classified includes: each external attack IP determined by the log analysis unit based on the log information of the security detection device, the attack behavior information of each external attack IP and the target IP attacked by each external attack IP; based on the attack behavior information of each external attack IP, the diversion score corresponding to the external attack IP is calculated; and based on the attack behavior information of each external attack IP corresponding to each target IP, the diversion score corresponding to the target IP is calculated; for each external attack IP, if the diversion score corresponding to the external attack IP is greater than the first preset score threshold, or the diversion score corresponding to the target IP attacked by the external attack IP is greater than the second preset score threshold, the external attack is determined to be an abnormal IP.

[0094] The system provided by the embodiment of the present invention receives the information to be classified sent by the log analysis unit, and calculates the diversion score corresponding to the external attack IP based on the attack behavior information of each external attack IP; and, calculates the diversion score corresponding to the target IP based on the attack behavior information of each external attack IP corresponding to each target IP; for each external attack IP, if the diversion score corresponding to the external attack IP is greater than the first preset score threshold, or the diversion score corresponding to the target IP attacked by the external attack IP is greater than the second preset score threshold, the external attack is determined to be an abnormal IP. The system provided by the embodiment of the present invention classifies the external attack IP by calculating the diversion score corresponding to the external attack IP and the diversion score corresponding to the target IP. Then, according to the analysis result, only the traffic of the classified abnormal IP can be diverted to the advanced security analysis device, instead of diverting all the traffic of the external attack IP to the advanced security analysis device, so as to achieve accurate selection and control of the storage of traffic data, and at the same time, avoid the problem of high false alarm rate caused by diverting a large number of normal traffic of non-abnormal IPs to the advanced security analysis device. Moreover, the system provided by the embodiment of the present invention can classify external attack IPs in real time according to the log information of the security detection device, thereby directing abnormal IPs to the advanced security analysis device in real time, and realizing real-time tracing. Therefore, the system provided by the embodiment of the present invention solves the problem that the existing analysis method for network traffic cannot meet the needs of the current advanced security analysis system, realizes accurate selection and control of the storage of traffic data, avoids the problem of high false alarm rate caused by directing the normal traffic of a large number of non-abnormal IPs to the advanced security analysis device, and realizes real-time tracing of abnormal IPs.

[0095] In an embodiment of the present invention, the IP classification system may further include a traffic scheduling unit, which is used to direct the traffic of the abnormal IP to the advanced security analysis device.

[0096] In an embodiment of the present invention, the IP classification unit 402 can be specifically used to determine each attack behavior corresponding to the attack behavior information of each external attack IP; for the attack type to which each attack behavior belongs, determine the attack chain stage coefficient corresponding to the attack behavior; for each attack behavior, calculate the weight value corresponding to the attack behavior based on the number of times the attack behavior occurs, the target IP attribute information attacked by the attack behavior, and the attacked information; for each external attack IP, calculate the diversion score corresponding to the external attack IP based on the weight value corresponding to each attack behavior corresponding to the external attack IP and the attack chain stage coefficient.

[0097] In the embodiment of the present invention, the IP classification unit 402 can also be specifically used to calculate the diversion score corresponding to each target IP according to the weight values ​​and attack chain stage coefficients corresponding to each attack behavior of each external attack IP attacking the target IP.

[0098] Figure 5 Another structural diagram of the IP classification system provided by the embodiment of the present invention is as follows Figure 5 As shown in the figure, in the IP classification system, the log transceiver engine is responsible for receiving the security alarm log sent by the security detection device from the network and forwarding the log to the log analysis engine. The log analysis engine is used to parse the received security alarm log, and parse the attack type, source IP, destination IP and log level field of the attack behavior in the security alarm log. The log analysis engine can also send the parsed log information analysis results to the comprehensive analysis module.

[0099] The comprehensive analysis module includes an asset sub-module, an attack scenario KPI analysis sub-module and a diversion strategy management sub-module. Among them, the asset sub-module is used to analyze the external attack IPs, the attack behavior information of each external attack IP and the target IP attacked by each external attack IP according to the received log information analysis results; the attack scenario KPI analysis sub-module is used to calculate the diversion score corresponding to each external attack IP and the diversion score corresponding to each target IP; the diversion strategy management sub-module is used to generate the corresponding IP classification strategy according to the diversion score corresponding to each external attack IP and the diversion score corresponding to each target IP, and send the IP classification strategy to the traffic orchestration scheduling module, so that the traffic orchestration scheduling module forwards traffic according to the strategy.

[0100] The traffic orchestration and scheduling module is responsible for converting the received IP classification strategy into a diversion command that can be recognized by the diversion atom and sending it to the diversion atom.

[0101] The diversion atom is responsible for receiving the full amount of mirrored traffic on the network. According to the internal traffic classification strategy, the traffic in the outbound flow table is directly forwarded according to the diversion purpose, that is, forwarded to the back-end advanced security analysis device. The diversion atom receives the diversion command from the traffic orchestration and scheduling module and generates the diversion flow table entry internally.

[0102] The system provided by the embodiment of the present invention is used to classify the external attack IP by calculating the diversion score corresponding to the external attack IP and the diversion score corresponding to the target IP. Then, according to the analysis result, only the traffic of the classified abnormal IP can be diverted to the advanced security analysis device, instead of diverting all the traffic of the external attack IP to the advanced security analysis device, so as to achieve accurate selection and control of the preservation of traffic data, and at the same time, avoid the problem of high false alarm rate caused by diverting a large number of normal traffic of non-abnormal IP to the advanced security analysis device. In addition, the system provided by the embodiment of the present invention can classify the external attack IP in real time according to the log information of the security detection device, so as to divert the abnormal IP to the advanced security analysis device in real time, and achieve real-time tracing. Therefore, the system provided by the embodiment of the present invention solves the problem that the existing analysis method for network traffic cannot adapt to the needs of the current advanced security analysis system, realizes accurate selection and control of the preservation of traffic data, avoids the problem of high false alarm rate caused by diverting a large number of normal traffic of non-abnormal IP to the advanced security analysis device, and realizes real-time tracing of abnormal IP.

[0103] Corresponding to the above IP classification method, an embodiment of the present invention further provides an IP classification device. The IP classification device provided by the embodiment of the present invention is introduced below. Figure 6 A schematic diagram of the structure of an IP classification device provided by an embodiment of the present invention, such as Figure 6 As shown, the device is applied to an IP classification unit in an IP classification system, and the IP classification system also includes a log analysis unit. The device includes:

[0104] The information receiving module 601 is used to receive the information to be classified sent by the log analysis unit, wherein the information to be classified includes: each external attack IP determined by the log analysis unit based on the log information of the security detection device, the attack behavior information of each external attack IP, and the target IP attacked by each external attack IP;

[0105] The traffic diversion score calculation module 602 is used to calculate the traffic diversion score corresponding to each external attack IP based on the attack behavior information of each external attack IP; and calculate the traffic diversion score corresponding to each target IP based on the attack behavior information of each external attack IP corresponding to each target IP;

[0106] The IP classification module 603 is used to determine that for each of the external attack IPs, if the diversion score corresponding to the external attack IP is greater than the first preset score threshold, or the diversion score corresponding to the target IP attacked by the external attack IP is greater than the second preset score threshold, the external attack is determined to be an abnormal IP.

[0107] The device provided by the embodiment of the present invention is used to receive the information to be classified sent by the log analysis unit, and the diversion score corresponding to the external attack IP is calculated based on the attack behavior information of each external attack IP; and the diversion score corresponding to the target IP is calculated based on the attack behavior information of each external attack IP corresponding to each target IP; for each external attack IP, if the diversion score corresponding to the external attack IP is greater than the first preset score threshold, or the diversion score corresponding to the target IP attacked by the external attack IP is greater than the second preset score threshold, the external attack is determined to be an abnormal IP. The device provided by the embodiment of the present invention classifies the external attack IP by calculating the diversion score corresponding to the external attack IP and the diversion score corresponding to the target IP. Then, according to the analysis result, only the traffic of the classified abnormal IP can be diverted to the advanced security analysis device, instead of diverting all the traffic of the external attack IP to the advanced security analysis device, so as to achieve accurate selection and control of the storage of traffic data, and at the same time, avoid the problem of high false alarm rate caused by diverting a large number of normal traffic of non-abnormal IPs to the advanced security analysis device. Moreover, the device provided by the embodiment of the present invention can classify external attack IPs in real time according to the log information of the security detection device, thereby directing the abnormal IPs to the advanced security analysis device in real time, and realizing real-time tracing. Therefore, the device provided by the embodiment of the present invention solves the problem that the existing analysis method for network traffic cannot meet the needs of the current advanced security analysis system, realizes the accurate selection and control of the preservation of traffic data, avoids the problem of high false alarm rate caused by directing the normal traffic of a large number of non-abnormal IPs to the advanced security analysis device, and realizes the real-time tracing of abnormal IPs.

[0108] Optionally, the device further includes:

[0109] The traffic diversion module (not shown in the figure) is used to divert the traffic of the abnormal IP to the advanced security analysis device.

[0110] Optionally, the diversion score calculation module 602 is specifically used to determine each attack behavior corresponding to the attack behavior information of each external attack IP; for the attack type to which each attack behavior belongs, determine the attack chain stage coefficient corresponding to the attack behavior; for each attack behavior, calculate the weight value corresponding to the attack behavior based on the number of times the attack behavior occurs, the target IP attribute information attacked by the attack behavior, and the attacked information; for each external attack IP, calculate the diversion score corresponding to the external attack IP based on the weight value corresponding to each attack behavior corresponding to the external attack IP and the attack chain stage coefficient.

[0111] Optionally, the diversion score calculation module 602 is specifically used to calculate the diversion score corresponding to each target IP according to the weight values ​​corresponding to each attack behavior of each external attack IP attacking the target IP and the attack chain stage coefficient.

[0112] The embodiment of the present invention further provides an electronic device, such as Figure 7 As shown, it includes a processor 701, a communication interface 702, a memory 703 and a communication bus 704, wherein the processor 701, the communication interface 702, and the memory 703 communicate with each other through the communication bus 704.

[0113] Memory 703, used for storing computer programs;

[0114] The processor 701 is used to implement the steps of any of the IP classification methods when executing the program stored in the memory 703.

[0115] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0116] The communication interface is used for communication between the above electronic device and other devices.

[0117] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0118] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0119] In another embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned IP classification methods are implemented.

[0120] In another embodiment of the present invention, a computer program product including instructions is provided, which, when executed on a computer, enables the computer to execute any one of the IP classification methods in the above embodiments.

[0121] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk Solid State Disk (SSD)), etc.

[0122] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0123] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system, device, electronic device, computer-readable storage medium, and computer program product embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0124] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. An IP classification method, characterized in that: An IP classification unit applied to an IP classification system, wherein the IP classification system further comprises a log analysis unit, and the method comprises: Receive the information to be classified sent by the log analysis unit, the information to be classified includes: each external attack IP determined by the log analysis unit based on the log information of the security detection device, the attack behavior information of each external attack IP and the target IP attacked by each external attack IP; Based on the attack behavior information of each of the external attack IPs, the drainage score corresponding to the external attack IP is calculated, including: determining each attack behavior corresponding to the attack behavior information of each external attack IP; for the attack type to which each attack behavior belongs, determining the attack chain stage coefficient corresponding to the attack behavior; for each attack behavior, based on the number of occurrences of the attack behavior, the attribute information of the target IP attacked by the attack behavior, and the attacked information, calculating the weight value corresponding to the attack behavior; for each of the external attack IPs, according to the weight value corresponding to each of the attack behaviors corresponding to the external attack IP and the attack chain stage coefficient, calculating the drainage score corresponding to the external attack IP; and, based on the attack behavior information of each of the external attack IPs corresponding to each of the target IPs, calculating the drainage score corresponding to the target IP; For each of the external attack IPs, if the diversion score corresponding to the external attack IP is greater than the first preset score threshold, or the diversion score corresponding to the target IP attacked by the external attack IP is greater than the second preset score threshold, the external attack IP is determined to be an abnormal IP.

2. The method according to claim 1, characterized in that After determining that the external attack is an abnormal IP, the method further includes: The traffic of the abnormal IP address is directed to an advanced security analysis device.

3. The method according to claim 1, characterized in that The calculating the traffic diversion score corresponding to the target IP based on the attack behavior information of each external attack IP corresponding to each target IP includes: For each target IP, the drainage score corresponding to the target IP is calculated according to the weight values ​​corresponding to the attack behaviors of each external attack IP attacking the target IP and the attack chain stage coefficient.

4. An IP classification system, characterized in that: include: A log analysis unit, used to collect log information of the security detection device, and determine each external attack IP, the attack behavior information of each external attack IP, and the target IP attacked by each external attack IP based on the log information; The IP classification unit is used to receive the information to be classified sent by the log analysis unit, and the information to be classified includes: each external attack determined by the log analysis unit based on the log information of the security detection device IP, attack behavior information of each external attack IP, and the target attacked by each external attack IP IP; based on the attack behavior information of each of the external attack IPs, calculate the diversion score corresponding to the external attack IP; and, based on the attack behavior information of each of the external attack IPs corresponding to each of the target IPs, calculate the diversion score corresponding to the target IP; for each of the external attack IPs, if the diversion score corresponding to the external attack IP is greater than a first preset score threshold, or the diversion score corresponding to the target IP attacked by the external attack IP is greater than a second preset score threshold, determine that the external attack IP is an abnormal IP; The IP classification unit is specifically used to determine each attack behavior corresponding to the attack behavior information of each external attack IP; for the attack type to which each attack behavior belongs, determine the attack chain stage coefficient corresponding to the attack behavior; for each attack behavior, calculate the weight value corresponding to the attack behavior based on the number of times the attack behavior occurs, the target IP attribute information attacked by the attack behavior, and the attacked information; for each external attack IP, calculate the drainage score corresponding to the external attack IP based on the weight value corresponding to each attack behavior corresponding to the external attack IP and the attack chain stage coefficient.

5. The system according to claim 4, characterized in that Also includes: The traffic scheduling unit is used to direct the traffic of the abnormal IP to the advanced security analysis device.

6. The system according to claim 4, characterized in that The IP classification unit is specifically used to calculate the diversion score corresponding to each target IP according to the weight values ​​corresponding to each attack behavior of each external attack IP attacking the target IP and the attack chain stage coefficient.

7. An IP classification device, characterized in that: An IP classification unit applied to an IP classification system, wherein the IP classification system further comprises a log analysis unit, and the device comprises: An information receiving module, used to receive the information to be classified sent by the log analysis unit, wherein the information to be classified includes: each external attack IP determined by the log analysis unit based on the log information of the security detection device, the attack behavior information of each external attack IP, and the target IP attacked by each external attack IP; The drainage score calculation module is used to calculate the drainage score corresponding to the external attack IP based on the attack behavior information of each external attack IP, including: determining each attack behavior corresponding to the attack behavior information of each external attack IP; determining the attack chain stage coefficient corresponding to the attack behavior for the attack type to which each attack behavior belongs; for each attack behavior, calculating the weight value corresponding to the attack behavior based on the number of times the attack behavior occurs, the attribute information of the target IP attacked by the attack behavior, and the attacked information; for each external attack IP, calculating the drainage score corresponding to the external attack IP according to the weight value corresponding to each attack behavior corresponding to the external attack IP and the attack chain stage coefficient; and calculating the drainage score corresponding to the target IP based on the attack behavior information of each external attack IP corresponding to each target IP; The IP classification module is used to determine that for each of the external attack IPs, if the diversion score corresponding to the external attack IP is greater than the first preset score threshold, or the diversion score corresponding to the target IP attacked by the external attack IP is greater than the second preset score threshold, the external attack IP is determined to be an abnormal IP.

8. The device according to claim 7, characterized in that Also includes: The traffic diversion module is used to divert the traffic of the abnormal IP to the advanced security analysis device.

9. The device according to claim 7, characterized in that The drainage score calculation module is specifically used to calculate the drainage score corresponding to each target IP according to the weight values ​​corresponding to each attack behavior of each external attack IP attacking the target IP and the attack chain stage coefficient.

10. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, for implementing the method steps described in any one of claims 1 to 3 when executing a program stored in a memory.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any one of claims 1 to 3 are implemented.

Images