Network attack monitoring method, device, electronic device and storage medium

Abstract

The present disclosure provides a method for monitoring network attacks, which can be applied to the field of information security technology. The method for monitoring network attacks includes: obtaining a suspicious network attack log; determining the network protocol corresponding to the suspicious network attack log according to the suspicious network attack log; extracting the attribute content corresponding to the preset attribute from the suspicious network attack log according to the preset attribute corresponding to the network protocol and the message format of the network protocol; analyzing the attribute content according to the preset monitoring strategy corresponding to the network protocol to obtain an analysis result; and generating an alarm message when the analysis result indicates that the suspicious network attack log indicates a network attack. The present disclosure also provides a monitoring device, equipment, and storage medium for network attacks.

Description

Technical Field

[0001] The present disclosure relates to the field of information security, and more specifically to a network attack monitoring method, device, equipment, medium and program product. Background Art

[0002] With the development of network applications, more and more businesses are transferred from offline to online, and business systems also bear more access requirements. At the same time, network attacks are also emerging in an endless stream, especially in some important network nodes, which are facing various threats of network attacks. At present, network attack protection equipment is generally used for protection. Network attacks are monitored by regularly analyzing the network attack logs generated by network protection equipment, thereby generating alarm information to remind managers to improve network prevention.

[0003] In the process of realizing the inventive concept of the present disclosure, the inventors found that there are at least the following problems in the related technology: the existing monitoring methods of network attacks have the technical problem of difficulty in accurately identifying real network attacks, resulting in low accuracy of alarm information. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a method, apparatus, device, medium and program product for monitoring network attacks.

[0005] According to one aspect of the present disclosure, a method for monitoring a network attack is provided, comprising:

[0006] Obtain suspicious network attack logs;

[0007] Determine the network protocol corresponding to the suspicious network attack log according to the suspicious network attack log;

[0008] According to the preset attributes corresponding to the network protocol and the message format of the network protocol, extracting the attribute content corresponding to the preset attributes from the suspicious network attack log;

[0009] Analyze the above attribute content according to the preset monitoring strategy corresponding to the above network protocol to obtain the analysis result; and

[0010] When the above analysis results indicate that the above suspicious network attack log indicates a network attack, an alarm message is generated.

[0011] According to an embodiment of the present disclosure, the above network protocol includes n above preset attributes, where n≥1;

[0012] The above-mentioned attribute content is analyzed according to the preset monitoring strategy corresponding to the above-mentioned network protocol, and the analysis results obtained include:

[0013] According to the preset arrangement order of the n preset attributes, the attribute contents corresponding to the preset attributes are analyzed in sequence to obtain sub-analysis results corresponding to the preset attributes;

[0014] The above analysis results are determined based on the above sub-analysis results.

[0015] According to an embodiment of the present disclosure, each of the above-mentioned preset attributes has a corresponding preset condition;

[0016] According to the preset arrangement order of the n preset attributes, the attribute contents corresponding to the preset attributes are analyzed in sequence, and the sub-analysis results corresponding to the preset attributes include:

[0017] S1, for an i-th preset attribute among the n preset attributes, analyzing an i-th attribute content corresponding to the i-th preset attribute according to an i-th preset condition corresponding to the i-th preset attribute, to obtain an i-th sub-analysis result corresponding to the i-th preset attribute;

[0018] S2, when the i-th sub-analysis result indicates that the i-th attribute content does not satisfy the i-th preset condition, stop analyzing subsequent preset attributes to obtain i sub-analysis results, wherein the subsequent preset attributes include preset attributes that are after the i-th preset attribute in the preset arrangement order, wherein i≥1;

[0019] S3, if the i-th sub-analysis result shows that the i-th attribute content satisfies the i-th preset condition, analyzing the i+1-th attribute content corresponding to the i+1-th preset attribute;

[0020] Steps S1 to S3 are performed on the n preset attributes in sequence, and finally m sub-analysis results are obtained, where 1≤m≤n.

[0021] According to an embodiment of the present disclosure, determining the analysis result according to the sub-analysis result includes:

[0022] In the case of m<n, determining, according to the m sub-analysis results, that the analysis result includes that the suspicious network attack log has a network attack;

[0023] In the case of m=n, determining whether the m sub-analysis results include a sub-analysis result whose attribute content does not satisfy the corresponding preset condition;

[0024] In the case where the m sub-analysis results include a sub-analysis result whose attribute content does not satisfy the corresponding preset condition, determining that the analysis result includes that the suspicious network attack log has a network attack;

[0025] In a case where the m sub-analysis results do not include a sub-analysis result whose attribute content does not satisfy the corresponding preset condition, it is determined that the analysis result includes that the suspicious network attack log does not have a network attack.

[0026] According to an embodiment of the present disclosure, the above-mentioned network protocol includes one of the following: a network layer protocol, a transport layer protocol, and an application layer protocol.

[0027] According to an embodiment of the present disclosure, the preset attributes corresponding to the above network layer protocol include: message length, message identification information and message survival time;

[0028] The preset attributes corresponding to the above transport layer protocol include: a message sequence number, a message confirmation number, a message checksum, a message synchronization flag, a message confirmation flag, and a message reset flag;

[0029] The preset attributes corresponding to the above-mentioned application layer protocol include: a request method and a user agent, wherein the above-mentioned request method includes a communication method actually used by the message, and the above-mentioned user agent includes user information contained in the message.

[0030] According to an embodiment of the present disclosure, the preset monitoring strategy corresponding to the above network layer protocol includes: whether the above message length meets the preset value, whether the above message identification information in the same communication session is the same, and judging whether the message is a valid message according to the survival time of the above message;

[0031] The preset monitoring strategy corresponding to the above transport layer protocol includes: whether the above message confirmation number is the same as the above message sequence number, whether the value obtained by using the preset calculation method is the same as the above message checksum, and whether the synchronization flag bit of the above message, the confirmation flag bit of the message, and the reset flag bit of the message are all 1;

[0032] The preset monitoring strategy corresponding to the above application layer protocol includes: whether the preset communication method includes the communication method actually used by the above message, and whether the above preset user information database includes the user information included in the above message.

[0033] Another aspect of the present disclosure provides a network attack monitoring device, comprising:

[0034] The acquisition module is used to obtain suspicious network attack logs;

[0035] A determination module, used to determine the network protocol corresponding to the suspicious network attack log according to the suspicious network attack log;

[0036] An extraction module, configured to extract attribute content corresponding to the preset attribute from the suspicious network attack log according to the preset attribute corresponding to the network protocol and the message format of the network protocol;

[0037] An analysis module, used to analyze the above attribute content according to a preset monitoring strategy corresponding to the above network protocol to obtain an analysis result; and

[0038] The generating module is used to generate alarm information when the above analysis result shows that the above suspicious network attack log indicates that there is a network attack.

[0039] Another aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above-mentioned network attack monitoring method.

[0040] Another aspect of the present disclosure further provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the above-mentioned network attack monitoring method.

[0041] Another aspect of the present disclosure further provides a computer program product, including a computer program, which implements the above-mentioned network attack monitoring method when executed by a processor.

[0042] According to the embodiments of the present disclosure, a technical means is adopted for determining the network protocol corresponding to the suspicious network attack log based on the suspicious network attack log, and then extracting the attribute content corresponding to the preset attribute from the suspicious network attack log based on the preset attribute corresponding to the network protocol and the message format of the network protocol, and then analyzing the attribute content according to the preset monitoring strategy, and generating alarm information based on the analysis result. Therefore, the technical problem that the existing network attack monitoring method is difficult to accurately identify the real network attack, resulting in low accuracy of the alarm information is at least partially overcome, and the technical effect of accurately identifying the real network attack through accurate and precise attack recognition, thereby improving the accuracy of the alarm information is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0044] Figure 1 The application scenario diagram of the network attack monitoring method, apparatus, device, medium and program product according to the embodiment of the present disclosure is schematically shown;

[0045] Figure 2 A flowchart of a method for monitoring network attacks according to an embodiment of the present disclosure is schematically shown;

[0046] Figure 3A flowchart of the attribute content analysis method according to an embodiment of the present disclosure is schematically shown;

[0047] Figure 4 A flowchart of a method for monitoring network attacks according to another embodiment of the present disclosure is schematically shown;

[0048] Figure 5 A structural block diagram of a network attack monitoring device according to an embodiment of the present disclosure is schematically shown; and

[0049] Figure 6 A block diagram of an electronic device suitable for implementing a method for monitoring network attacks according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0050] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0051] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0052] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0053] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0054] With the development of network applications, more and more businesses are transferred from offline to online, and business systems also bear more access requirements. At the same time, network attacks are also emerging in an endless stream, especially in some important network nodes, which are facing various threats of network attacks. At present, network attacks are generally protected by network attack protection devices. Network attacks are monitored by regularly analyzing the network attack logs generated by network protection devices, thereby generating alarm information to remind managers to improve network prevention.

[0055] In the process of realizing the inventive concept of the present disclosure, the inventors found that there are at least the following problems in the related technology: the existing monitoring methods of network attacks are generally judged based on conventional features, such as attack source address, attack destination address, source port, target port and other features, which make it difficult to accurately identify real network attacks, resulting in low accuracy of alarm information.

[0056] In view of this, the present disclosure aims at the above technical problems, formulates corresponding preset attributes and monitoring strategies according to network protocols, extracts attribute contents corresponding to preset attributes from suspicious network attack logs based on the message format of network protocols, and uses monitoring strategies to analyze attribute contents, thereby obtaining analysis results. This method can provide more accurate and precise attack recognition, so as to accurately identify real network attacks, thereby improving the accuracy of alarm information.

[0057] Specifically, an embodiment of the present disclosure provides a method for monitoring network attacks, including: obtaining a suspicious network attack log; determining a network protocol corresponding to the suspicious network attack log based on the suspicious network attack log; extracting attribute content corresponding to the preset attribute from the suspicious network attack log based on the preset attribute corresponding to the network protocol and the message format of the network protocol; analyzing the attribute content according to a preset monitoring strategy corresponding to the network protocol to obtain an analysis result; and generating an alarm message when the analysis result indicates that the suspicious network attack log indicates a network attack.

[0058] It should be noted that the network attack monitoring method and device provided in the embodiments of the present disclosure can be used in the field of information security. The network attack monitoring method and device provided in the embodiments of the present disclosure can also be used in any field other than the field of information security, such as the financial field. The application field of the network attack monitoring method and device provided in the embodiments of the present disclosure is not limited.

[0059] In the technical solution of the present disclosure, the user's authorization or consent is obtained before obtaining or collecting the user's personal information.

[0060] In the technical solution disclosed in the present invention, the acquisition, collection, storage, use, processing, transmission, provision, disclosure and application of data are in compliance with the provisions of relevant laws and regulations, necessary confidentiality measures are taken, and do not violate public order and good morals.

[0061] Figure 1 The application scenario diagram of the network attack monitoring method, apparatus, device, medium and program product according to the embodiment of the present disclosure is schematically shown.

[0062] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a network, a network attack protection device and a server. The network 102 is used to provide a medium for a communication link between the network attack protection device 101 and the server 103. The network 102 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0063] The network attack protection device 101 can be an intrusion defense device, a network application protection wall, or a network traffic capture device. The network attack protection device 101 will generate a large number of network attack logs. The network attack protection device 101 can interact with the server 103 through the network 102 to send the generated network attack logs to the server 103.

[0064] The server 103 may be a server that provides various services, such as storing the network attack logs sent by the network attack protection device 101, analyzing the network attack logs sent by the network attack protection device 101 according to a preset monitoring strategy, and generating alarm information to notify front-line monitoring personnel.

[0065] It should be noted that the network attack monitoring method provided in the embodiment of the present disclosure can generally be executed by the server 103. Accordingly, the network attack monitoring device provided in the embodiment of the present disclosure can generally be set in the server 103. The network attack monitoring method provided in the embodiment of the present disclosure can also be performed by a server or server cluster that is different from the server 103 and can communicate with the network attack protection device 101 and / or the server 103. Correspondingly, the network attack monitoring device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 103 and can communicate with the network attack protection device 101 and / or the server 105. Alternatively, the network attack monitoring method provided in the embodiment of the present disclosure can also be executed by the network attack protection device 101, or it can also be executed by other network protection devices different from the network attack protection device 101. Correspondingly, the network attack monitoring device provided in the embodiment of the present disclosure can also be set in the network attack protection device 101, or it can be set in other network protection devices different from the network attack protection device 101.

[0066] For example, a monitoring policy tool may be deployed on the network attack protection device 101, and a monitoring policy may be predefined using the monitoring policy tool. Then, the monitoring policy tool may execute the network attack monitoring method provided by the embodiment of the present disclosure on the network attack protection device 101.

[0067] It should be understood that Figure 1 The number of network attack protection devices, networks and servers in the embodiment is only for illustration. Any number of network attack protection devices, networks and servers may be provided according to implementation requirements.

[0068] The following will be based on Figure 1 The scene described by Figure 2 to Figure 4 The network attack monitoring method of the disclosed embodiment is described in detail.

[0069] Figure 2 The flowchart of the network attack monitoring method according to the embodiment of the present disclosure is schematically shown.

[0070] like Figure 2 As shown, the network attack monitoring method of this embodiment includes operations S210 to S250, and the network attack monitoring method can be executed by a server.

[0071] In operation S210, a suspicious network attack log is obtained.

[0072] According to an embodiment of the present disclosure, the suspicious network attack log may include, for example, a network attack log generated by a network attack protection device. The network attack protection device may include, for example, an intrusion prevention device, a network application firewall, a network traffic capture device, etc., which may generate a large number of network attack logs.

[0073] According to an embodiment of the present disclosure, a network attack log storage server for storing various network attack logs can be built, and the network attack logs generated by the network attack protection device can be transmitted to the network attack log storage server to facilitate analysis of the network attack logs.

[0074] In operation S220, a network protocol corresponding to the suspicious network attack log is determined according to the suspicious network attack log.

[0075] According to an embodiment of the present disclosure, in a network application, when a network device transmits a message through a network attack protection device, the network attack device adds the network source to which the message belongs to the network attack log, so that the network attack log includes characteristic information of the network source, and the characteristic information may include a network protocol address. Therefore, the network protocol contained in the suspicious network attack log can be determined based on the suspicious network attack log.

[0076] According to an embodiment of the present disclosure, the above-mentioned network protocol includes one of the following: a network layer protocol, a transport layer protocol, and an application layer protocol.

[0077] According to an embodiment of the present disclosure, the network layer protocol may include, for example, the IP protocol (Internet Protocol), the ICMP protocol (Internet Control Message Protocol), etc. The transport layer protocol may include, for example, the TCP protocol (Transmission Control Protocol / Internet Protocol). The application layer protocol may include, for example, the HTTP protocol (HyperText TransferProtocol).

[0078] In operation S230, based on the preset attribute corresponding to the network protocol and the message format of the network protocol, attribute content corresponding to the preset attribute is extracted from the suspicious network attack log.

[0079] According to an embodiment of the present disclosure, the preset attributes corresponding to the network protocol may include any attributes that can be used as attack identification features. For example, if the network protocol is the IP protocol, the preset attributes corresponding to the IP protocol may include message length, message ID, message survival time, etc.

[0080] According to an embodiment of the present disclosure, the preset attributes corresponding to the above-mentioned network layer protocol include: message length, message identification information and message survival time; the preset attributes corresponding to the above-mentioned transport layer protocol include: message sequence number, message confirmation number, message checksum, message synchronization flag, message confirmation flag and message reset flag; the preset attributes corresponding to the above-mentioned application layer protocol include: request method, user agent, wherein the above-mentioned request method includes the communication method actually used by the message, and the above-mentioned user agent includes the user information contained in the message.

[0081] According to an embodiment of the present disclosure, the attribute description of the preset attribute is shown in Table 1:

[0082] Table 1

[0083]

[0084]

[0085] According to an embodiment of the present disclosure, the suspicious network attack log is split according to the message format of the network message, and then the attribute content corresponding to the preset attribute in the suspicious network attack log is extracted according to the preset attribute, and the attribute content is analyzed as an attack identification feature.

[0086] In operation S240, the attribute content is analyzed according to a preset monitoring strategy corresponding to the network protocol to obtain an analysis result.

[0087] According to an embodiment of the present disclosure, the preset monitoring strategy can be predefined using a monitoring strategy tool, for example. Different network protocols use different monitoring strategies.

[0088] According to an embodiment of the present disclosure, the preset monitoring strategy corresponding to the above-mentioned network layer protocol includes: whether the above-mentioned message length meets the preset value, whether the above-mentioned message identification information in the same communication session is the same, and whether the message is a valid message based on the above-mentioned message survival time; the preset monitoring strategy corresponding to the above-mentioned transport layer protocol includes: whether the above-mentioned message confirmation number is the same as the above-mentioned message sequence number, whether the value obtained by using the preset calculation method is the same as the above-mentioned message checksum, and whether the synchronization flag bit of the above-mentioned message, the confirmation flag bit of the message and the reset flag bit of the message are all 1; the preset monitoring strategy corresponding to the above-mentioned application layer protocol includes: whether the preset communication method includes the communication method actually used by the above-mentioned message, and whether the above-mentioned preset user information database includes the user information contained in the above-mentioned message.

[0089] For example, if the network protocol is the IP protocol, the monitoring strategy corresponding to the IP protocol may include whether the message length meets the preset value, whether the message identification information in the same communication session is the same, and whether the message is a valid message based on the message survival time. For another example, if the network protocol is the TCP protocol, the monitoring strategy corresponding to the TCP protocol may include whether the message confirmation number is the same as the message sequence number, whether the value obtained by using the preset calculation method is the same as the message checksum, and whether the synchronization flag bit of the message, the confirmation flag bit of the message, and the reset flag bit of the message are all 1.

[0090] In operation S250, when the analysis result indicates that the suspicious network attack log indicates a network attack, an alarm message is generated.

[0091] According to an embodiment of the present disclosure, when the analysis result shows that the suspicious network attack log contains a network attack, an alarm message is generated to notify the front-line monitoring personnel to handle it.

[0092] According to the embodiments of the present disclosure, a technical means is adopted for determining the network protocol corresponding to the suspicious network attack log based on the suspicious network attack log, and then extracting the attribute content corresponding to the preset attribute from the suspicious network attack log based on the preset attribute corresponding to the network protocol and the message format of the network protocol, and then analyzing the attribute content according to the preset monitoring strategy, and generating alarm information based on the analysis result. Therefore, the technical problem that the existing network attack monitoring method is difficult to accurately identify the real network attack, resulting in low accuracy of the alarm information is at least partially overcome, and the technical effect of accurately identifying the real network attack through accurate and precise attack recognition, thereby improving the accuracy of the alarm information is achieved.

[0093] According to an embodiment of the present disclosure, the above-mentioned network protocol includes n above-mentioned preset attributes, wherein n≥1; the above-mentioned attribute content is analyzed according to the preset monitoring strategy corresponding to the above-mentioned network protocol, and the analysis result obtained includes: according to the preset arrangement order of the n above-mentioned preset attributes, the attribute content corresponding to the above-mentioned preset attributes is analyzed in turn to obtain the sub-analysis result corresponding to the above-mentioned preset attributes; the above-mentioned analysis result is determined according to the above-mentioned sub-analysis result.

[0094] According to an embodiment of the present disclosure, each of the above-mentioned preset attributes has a corresponding preset condition; the above-mentioned analysis of the attribute contents corresponding to the above-mentioned preset attributes in sequence according to the preset arrangement order of the n above-mentioned preset attributes to obtain the sub-analysis results corresponding to the above-mentioned preset attributes includes: S1, for the i-th preset attribute among the n above-mentioned preset attributes, analyzing the i-th attribute content corresponding to the above-mentioned i-th preset attribute according to the i-th preset condition corresponding to the above-mentioned i-th preset attribute to obtain the i-th sub-analysis result corresponding to the above-mentioned i-th preset attribute; S2, when the above-mentioned i-th sub-analysis result shows that the above-mentioned i-th attribute When the content does not satisfy the i-th preset condition, stop analyzing subsequent preset attributes and obtain i sub-analysis results, wherein the subsequent preset attributes include preset attributes that are after the i-th preset attribute in the preset arrangement order, wherein i≥1; S3, when the i-th sub-analysis result indicates that the i-th attribute content satisfies the i-th preset condition, analyze the i+1th attribute content corresponding to the i+1th preset attribute; execute steps S1 to S3 for n of the above preset attributes in sequence, and finally obtain m sub-analysis results, wherein 1≤m≤n.

[0095] According to the embodiment of the present disclosure, n preset attributes are analyzed in a preset arrangement order. If the analysis result of the preset attribute currently analyzed does not meet the preset condition, it is determined that the suspicious network attack log contains a network attack, and there is no need to analyze the subsequent preset attributes. This method can reduce the workload of analyzing the network attack log and improve the analysis efficiency.

[0096] According to an embodiment of the present disclosure, determining the above-mentioned analysis result based on the above-mentioned sub-analysis results includes: in the case of m<n, determining the above-mentioned analysis result includes that the above-mentioned suspicious network attack log has a network attack based on the above-mentioned m sub-analysis results; in the case of m=n, judging whether the above-mentioned m sub-analysis results include the sub-analysis result whose attribute content does not satisfy the corresponding above-mentioned preset conditions; in the case that the above-mentioned m sub-analysis results include the sub-analysis result whose attribute content does not satisfy the corresponding above-mentioned preset conditions, determining that the above-mentioned analysis result includes that the above-mentioned suspicious network attack log has a network attack; in the case that the above-mentioned m sub-analysis results do not include the sub-analysis result whose attribute content does not satisfy the corresponding above-mentioned preset conditions, determining that the above-mentioned analysis result includes that the above-mentioned suspicious network attack log does not have a network attack.

[0097] Figure 3 The flowchart of the attribute content analysis method according to the embodiment of the present disclosure is schematically shown.

[0098] like Figure 3 As shown, this embodiment includes three preset attributes, which are arranged in a preset manner as a first preset attribute, a second preset attribute and a third preset attribute. The attribute content analysis method of this embodiment includes operations S301 to S308.

[0099] In operation S301, first attribute content corresponding to the first preset attribute is analyzed according to a first preset condition corresponding to the first preset attribute to obtain a first sub-analysis result corresponding to the first preset attribute.

[0100] In operation S302, it is determined whether the first attribute content in the first sub-analysis result satisfies the first preset condition. If the first sub-analysis result indicates that the first attribute content does not satisfy the first preset condition, operation S308 is performed. If the first sub-analysis result indicates that the first attribute content satisfies the first preset condition, operation S303 is performed.

[0101] In operation S303, the second attribute content corresponding to the second preset attribute is analyzed according to the second preset condition corresponding to the second preset attribute to obtain a second sub-analysis result corresponding to the second preset attribute.

[0102] In operation S304, it is determined whether the second attribute content in the second sub-analysis result satisfies the second preset condition. If the second sub-analysis result indicates that the second attribute content does not satisfy the second preset condition, operation S308 is performed. If the second sub-analysis result indicates that the second attribute content satisfies the second preset condition, operation S305 is performed.

[0103] In operation S305, the third attribute content corresponding to the third preset attribute is analyzed according to the third preset condition corresponding to the third preset attribute to obtain a third sub-analysis result corresponding to the third preset attribute.

[0104] In operation S306, it is determined whether the third attribute content in the third sub-analysis result satisfies the third preset condition. If the third sub-analysis result indicates that the third attribute content does not satisfy the third preset condition, operation S308 is performed. If the third sub-analysis result indicates that the third attribute content satisfies the third preset condition, operation S307 is performed.

[0105] In operation S307, it is determined that the suspicious network attack log has no network attack.

[0106] In operation S308, the analysis is stopped, and it is determined that the suspicious network attack log has a network attack.

[0107] Figure 4 The flowchart of a method for monitoring network attacks according to another embodiment of the present disclosure is schematically shown.

[0108] like Figure 4 As shown, the flowchart of the network attack monitoring method in this embodiment includes operations S401 to S409.

[0109] In operation S401, the network attack protection device sends a network attack log to a network attack log storage server.

[0110] In operation S402, the network attack log storage server receives and stores the network attack log.

[0111] In operation S403, different monitoring policies are predefined according to different network protocols using a monitoring policy tool deployed on the network attack log storage server.

[0112] In operation S404, a network protocol corresponding to the network attack log is determined according to the network attack log.

[0113] In operation S405, according to the preset attribute corresponding to the network protocol and the message format of the network protocol, attribute content corresponding to the preset attribute is extracted from the network attack log.

[0114] In operation S406, the attribute content is analyzed according to the monitoring policy corresponding to the network protocol to obtain an analysis result.

[0115] In operation S407, it is determined whether the network attack log contains a network attack based on the analysis result. If the analysis result shows that the network attack log contains a network attack, operation S408 is performed; if the analysis result shows that the network attack log does not contain a network attack, operation S409 is performed.

[0116] In operation S408, alarm information is generated so that monitoring personnel can perform relevant processing according to the alarm information.

[0117] In operation S409, end.

[0118] According to the embodiments of the present disclosure, users can formulate corresponding preset attributes and monitoring strategies based on network protocols, split network attack logs based on the message format of network protocols, extract attribute content corresponding to preset attributes, use the extracted attribute content as attack identification features and analyze them using monitoring strategies to obtain analysis results. This method can provide more accurate and precise attack identification, so as to accurately identify real network attacks, thereby improving the accuracy of alarm information.

[0119] It should be noted that, unless it is explicitly stated that there is a sequence of execution between different operations shown in the flowchart in the embodiments of the present disclosure, or there is a sequence of execution between different operations in technical implementation, otherwise, the execution order of multiple operations may not be prioritized, and multiple operations may also be executed simultaneously.

[0120] Based on the above network attack monitoring method, the present disclosure also provides a network attack monitoring device. Figure 5 The device is described in detail.

[0121] Figure 5 The structural block diagram of the network attack monitoring device according to the embodiment of the present disclosure is schematically shown.

[0122] like Figure 5 As shown, the network attack monitoring device 500 of this embodiment includes an acquisition module 510, a determination module 520, an extraction module 530, an analysis module 540 and a generation module 550.

[0123] The acquisition module 510 is used to acquire suspicious network attack logs. In one embodiment, the acquisition module 510 can be used to perform the operation S210 described above, which will not be described in detail here.

[0124] The determination module 520 is used to determine the network protocol corresponding to the suspicious network attack log according to the suspicious network attack log. In one embodiment, the determination module 520 can be used to perform the operation S220 described above, which will not be repeated here.

[0125] The extraction module 530 is used to extract the attribute content corresponding to the preset attribute from the suspicious network attack log according to the preset attribute corresponding to the network protocol and the message format of the network protocol. In one embodiment, the extraction module 530 can be used to perform the operation S230 described above, which will not be repeated here.

[0126] The analysis module 540 is used to analyze the above attribute content according to the preset monitoring strategy corresponding to the above network protection proposal to obtain the analysis result. In one embodiment, the analysis module 540 can be used to perform the operation S240 described above, which will not be repeated here.

[0127] The generating module 550 is used to generate alarm information when the analysis result indicates that the suspicious network attack log indicates a network attack. In one embodiment, the generating module 550 can be used to perform the operation S250 described above, which will not be described in detail here.

[0128] According to an embodiment of the present disclosure, the above network protocol includes n above preset attributes, where n≥1.

[0129] According to an embodiment of the present disclosure, the analysis module includes: an analysis submodule and a determination submodule.

[0130] The analysis submodule is used to analyze the attribute contents corresponding to the above-mentioned preset attributes in sequence according to the preset arrangement order of the n above-mentioned preset attributes, so as to obtain sub-analysis results corresponding to the above-mentioned preset attributes.

[0131] The determination submodule is used to determine the above analysis result according to the above sub-analysis result.

[0132] According to an embodiment of the present disclosure, each of the above preset attributes has a corresponding preset condition.

[0133] According to an embodiment of the present disclosure, the analysis submodule includes: a first analysis unit, a stop unit, a second analysis unit and an execution unit.

[0134] The first analysis unit is used to analyze the i-th attribute content corresponding to the i-th preset attribute among the n preset attributes according to the i-th preset condition corresponding to the i-th preset attribute, so as to obtain the i-th sub-analysis result corresponding to the i-th preset attribute.

[0135] A stopping unit is used to stop analyzing subsequent preset attributes when the i-th sub-analysis result indicates that the i-th attribute content does not satisfy the i-th preset condition, and obtain i sub-analysis results, wherein the subsequent preset attributes include preset attributes that are after the i-th preset attribute in the preset arrangement order, wherein i≥1.

[0136] The second analyzing unit is configured to analyze the (i+1)th attribute content corresponding to the (i+1)th preset attribute when the (i)th sub-analysis result indicates that the (i)th attribute content satisfies the (i)th preset condition.

[0137] The execution unit is used to sequentially execute the operations of the first analysis unit, the stop unit and the second analysis unit on the n preset attributes, and finally obtain m sub-analysis results, wherein 1≤m≤n.

[0138] According to an embodiment of the present disclosure, the above-mentioned determination submodule includes: a first determination unit, a judgment unit, a second determination unit and a third determination unit.

[0139] The first determining unit is configured to determine, when m<n, based on the m sub-analysis results, that the analysis result includes that the suspicious network attack log has a network attack.

[0140] The judging unit is used to judge, when m=n, whether the m sub-analysis results include a sub-analysis result whose attribute content does not satisfy the corresponding preset condition.

[0141] The second determining unit is configured to determine that the analysis result includes that the suspicious network attack log has a network attack when the m sub-analysis results include a sub-analysis result whose attribute content does not satisfy the corresponding preset condition.

[0142] The third determining unit is configured to determine that the analysis result includes that the suspicious network attack log does not contain a network attack when the m sub-analysis results do not contain a sub-analysis result whose attribute content does not satisfy the corresponding preset condition.

[0143] According to an embodiment of the present disclosure, the above-mentioned network protocol includes one of the following: a network layer protocol, a transport layer protocol, and an application layer protocol.

[0144] According to an embodiment of the present disclosure, the preset attributes corresponding to the above-mentioned network layer protocol include: message length, message identification information and message survival time; the preset attributes corresponding to the above-mentioned transport layer protocol include: message sequence number, message confirmation number, message checksum, message synchronization flag, message confirmation flag and message reset flag; the preset attributes corresponding to the above-mentioned application layer protocol include: request method, user agent, wherein the above-mentioned request method includes the communication method actually used by the message, and the above-mentioned user agent includes the user information contained in the message.

[0145] According to an embodiment of the present disclosure, the preset monitoring strategy corresponding to the above-mentioned network layer protocol includes: whether the above-mentioned message length meets the preset value, whether the above-mentioned message identification information in the same communication session is the same, and whether the message is a valid message based on the above-mentioned message survival time; the preset monitoring strategy corresponding to the above-mentioned transport layer protocol includes: whether the above-mentioned message confirmation number is the same as the above-mentioned message sequence number, whether the value obtained by using the preset calculation method is the same as the above-mentioned message checksum, and whether the synchronization flag bit of the above-mentioned message, the confirmation flag bit of the message and the reset flag bit of the message are all 1; the preset monitoring strategy corresponding to the above-mentioned application layer protocol includes: whether the preset communication method includes the communication method actually used by the above-mentioned message, and whether the above-mentioned preset user information database includes the user information contained in the above-mentioned message.

[0146] According to the embodiments of the present invention, any one or more of the modules, submodules, and units, or at least part of the functions of any one of them can be implemented in one module. According to the embodiments of the present invention, any one or more of the modules, submodules, and units can be split into multiple modules for implementation. According to the embodiments of the present invention, any one or more of the modules, submodules, and units can be at least partially implemented as hardware circuits, such as field programmable gate arrays (FPGAs), programmable logic arrays (PLAs), systems on chips, systems on substrates, systems on packages, application specific integrated circuits (ASICs), or can be implemented by hardware or firmware in any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in any appropriate combination of any of them. Alternatively, according to the embodiments of the present invention, one or more of the modules, submodules, and units can be at least partially implemented as computer program modules, and when the computer program modules are run, the corresponding functions can be performed.

[0147] According to an embodiment of the present disclosure, any multiple modules among the acquisition module 510, the determination module 520, the extraction module 530, the analysis module 540 and the generation module 550 can be combined in one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the acquisition module 510, the determination module 520, the extraction module 530, the analysis module 540 and the generation module 550 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in a suitable combination of any of them. Alternatively, at least one of the acquisition module 510 , the determination module 520 , the extraction module 530 , the analysis module 540 , and the generation module 550 may be at least partially implemented as a computer program module, and when the computer program module is executed, a corresponding function may be performed.

[0148] It should be noted that the monitoring device for network attacks in the embodiments of the present disclosure corresponds to the monitoring method for network attacks in the embodiments of the present disclosure. The description of the monitoring device for network attacks refers to the monitoring method for network attacks, which will not be repeated here.

[0149] Figure 6 A block diagram of an electronic device suitable for implementing a method for monitoring network attacks according to an embodiment of the present disclosure is schematically shown.

[0150] like Figure 6 As shown, the electronic device 600 according to an embodiment of the present disclosure includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 into a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include an onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0151] In RAM 603, various programs and data required for the operation of electronic device 600 are stored. Processor 601, ROM 602 and RAM 603 are connected to each other via bus 604. Processor 601 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 602 and / or RAM 603. It should be noted that the program can also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0152] According to an embodiment of the present disclosure, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to the bus 604. The electronic device 600 may further include one or more of the following components connected to the I / O interface 605: an input portion 606 including a keyboard, a mouse, etc.; an output portion 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 608 including a hard disk, etc.; and a communication portion 609 including a network interface card such as a LAN card, a modem, etc. The communication portion 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage portion 608 as needed.

[0153] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0154] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 602 and / or RAM 603 described above and / or one or more memories other than ROM 602 and RAM 603.

[0155] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the network attack monitoring method provided by the embodiment of the present disclosure.

[0156] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 601. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0157] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 609, and / or installed from a removable medium 611. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0158] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, apparatus, module, unit, etc. described above can be implemented by a computer program module.

[0159] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0160] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0161] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0162] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A method for monitoring network attacks, comprising: Obtain suspicious network attack logs; Determining a network protocol corresponding to the suspicious network attack log according to the suspicious network attack log, wherein the network protocol includes one of the following: a network layer protocol, a transport layer protocol, and an application layer protocol; According to the preset attribute corresponding to the network protocol and the message format of the network protocol, extracting attribute content corresponding to the preset attribute from the suspicious network attack log; Analyzing the attribute content according to a preset monitoring strategy corresponding to the network protocol to obtain an analysis result; and If the analysis result indicates that the suspicious network attack log indicates a network attack, generating an alarm message; Among them, the preset monitoring strategy corresponding to the network layer protocol includes: whether the message length meets the preset value, whether the message identification information in the same communication session is the same, and judging whether the message is a valid message according to the message survival time; The preset monitoring strategy corresponding to the transport layer protocol includes: whether the message confirmation number is the same as the message sequence number, whether the value obtained by the preset calculation method is the same as the message checksum, and whether the synchronization flag bit of the message, the confirmation flag bit of the message, and the reset flag bit of the message are all 1; The preset monitoring strategy corresponding to the application layer protocol includes: whether the preset communication method includes the communication method actually used by the message, and whether the preset user information database includes the user information included in the message; Wherein, the network protocol includes n preset attributes, where n≥1; The analyzing the attribute content according to the preset monitoring strategy corresponding to the network protocol to obtain the analysis result includes: According to the preset arrangement order of the n preset attributes, the attribute contents corresponding to the preset attributes are analyzed in sequence to obtain sub-analysis results corresponding to the preset attributes; When the sub-analysis result of the preset attribute currently being analyzed does not satisfy the preset condition corresponding to the preset attribute, the analysis result of the suspicious network attack log is determined to contain a network attack, and the subsequent analysis of the preset attributes is canceled.

2. The method according to claim 1, wherein: Each of the preset attributes has a corresponding preset condition; The analyzing the attribute contents corresponding to the preset attributes in sequence according to the preset arrangement order of the n preset attributes to obtain the sub-analysis results corresponding to the preset attributes includes: S1, for an i-th preset attribute among the n preset attributes, analyzing an i-th attribute content corresponding to the i-th preset attribute according to an i-th preset condition corresponding to the i-th preset attribute, to obtain an i-th sub-analysis result corresponding to the i-th preset attribute; S2, when the i-th sub-analysis result indicates that the i-th attribute content does not satisfy the i-th preset condition, stop analyzing subsequent preset attributes to obtain i sub-analysis results, wherein the subsequent preset attributes include preset attributes that are after the i-th preset attribute in the preset arrangement order, wherein i≥1; S3, when the i-th sub-analysis result indicates that the i-th attribute content satisfies the i-th preset condition, analyzing the i+1-th attribute content corresponding to the i+1-th preset attribute; Steps S1 to S3 are performed on the n preset attributes in sequence, and finally m sub-analysis results are obtained, wherein 1≤m≤n.

3. The method according to claim 2, wherein: Determining the analysis result according to the sub-analysis result comprises: In the case of m<n, determining, according to the m sub-analysis results, that the analysis result includes that the suspicious network attack log has a network attack; In the case of m=n, determining whether the m sub-analysis results include a sub-analysis result whose attribute content does not satisfy the corresponding preset condition; In a case where the m sub-analysis results include a sub-analysis result whose attribute content does not satisfy the corresponding preset condition, determining that the analysis result includes that the suspicious network attack log has a network attack; In a case where the m sub-analysis results do not include a sub-analysis result whose attribute content does not satisfy the corresponding preset condition, it is determined that the analysis result includes that the suspicious network attack log does not have a network attack.

4. The method according to claim 1, wherein: The preset attributes corresponding to the network layer protocol include: message length, message identification information and message survival time; The preset attributes corresponding to the transport layer protocol include: a message sequence number, a message confirmation number, a message checksum, a message synchronization flag, a message confirmation flag, and a message reset flag; The preset attributes corresponding to the application layer protocol include: a request method and a user agent, wherein the request method includes a communication method actually used by the message, and the user agent includes user information contained in the message.

5. A network attack monitoring device, comprising: The acquisition module is used to obtain suspicious network attack logs; A determination module, configured to determine a network protocol corresponding to the suspicious network attack log according to the suspicious network attack log, wherein the network protocol includes one of the following: a network layer protocol, a transport layer protocol, and an application layer protocol; An extraction module, configured to extract attribute content corresponding to the preset attribute from the suspicious network attack log according to the preset attribute corresponding to the network protocol and the message format of the network protocol; an analysis module, configured to analyze the attribute content according to a preset monitoring strategy corresponding to the network protocol to obtain an analysis result; and A generating module, configured to generate alarm information when the analysis result indicates that the suspicious network attack log indicates a network attack; Among them, the preset monitoring strategy corresponding to the network layer protocol includes: whether the message length meets the preset value, whether the message identification information in the same communication session is the same, and judging whether the message is a valid message according to the message survival time; The preset monitoring strategy corresponding to the transport layer protocol includes: whether the message confirmation number is the same as the message sequence number, whether the value obtained by the preset calculation method is the same as the message checksum, and whether the synchronization flag bit of the message, the confirmation flag bit of the message, and the reset flag bit of the message are all 1; The preset monitoring strategy corresponding to the application layer protocol includes: whether the preset communication method includes the communication method actually used by the message, and whether the preset user information database includes the user information included in the message; Wherein, the network protocol includes n preset attributes, where n≥1; The analyzing the attribute content according to the preset monitoring strategy corresponding to the network protocol to obtain the analysis result includes: According to the preset arrangement order of the n preset attributes, the attribute contents corresponding to the preset attributes are analyzed in sequence to obtain sub-analysis results corresponding to the preset attributes; When the sub-analysis result of the preset attribute currently being analyzed does not satisfy the preset condition corresponding to the preset attribute, the analysis result of the suspicious network attack log is determined to contain a network attack, and the subsequent analysis of the preset attributes is canceled.

6. An electronic device comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors are enabled to execute the method according to any one of claims 1 to 4.

7. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the method according to any one of claims 1 to 4.

8. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images