Method, device, equipment and storage medium for determining network attack results

Abstract

The present disclosure relates to a method, apparatus, device, and storage medium for determining network attack results, wherein the method comprises: obtaining network attack traffic and determining a target attack event in the network attack traffic that requires terminal behavior to determine the attack result; extracting attack feature information of the target attack event and sending the attack feature information to a terminal probe corresponding to the attacked IP; continuously monitoring and recording abnormal behavior, normal behavior, and terminal response determination rule behavior in the terminal through the terminal probe, and matching the attack feature information with the information monitored and recorded by the terminal probe, and determining the attack result of the target attack event based on the matching result. According to the technical solution of the present disclosure, the technical problems of no response to some attacks and the inability to determine the attack result based on the response traffic are solved, thereby improving the accuracy of network attack result detection.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and in particular to a method, apparatus, device, and storage medium for determining network attack results. Background Art

[0002] A cyberattack is an offensive action targeting computer information systems, infrastructure, computer networks, or personal computer devices. Any attempt to destroy, expose, modify, or disable software or services, or to steal or access data from any computer without authorization, is considered an attack on computers and computer networks. Cyberattack detection involves detecting both cyberattack behavior and the results of the attack.

[0003] Related technologies use machine learning or traffic characterization techniques to detect attack response data, examining whether the response messages meet the characteristics of a failed or successful attack, thereby detecting the attack results. However, this type of detection fails to cover attacks that do not respond, or attacks where the response messages are random and lack features to exploit, or where no success / failure models can be trained. Therefore, the scope of attack result detection needs to be improved. Summary of the Invention

[0004] In order to solve the above technical problems or at least partially solve the above technical problems, the present disclosure provides a method, apparatus, device and storage medium for determining network attack results.

[0005] In a first aspect, an embodiment of the present disclosure provides a method for determining a network attack result, comprising:

[0006] Obtain network attack traffic and determine target attack events in the network attack traffic for which attack results need to be determined through terminal behavior;

[0007] Extract attack feature information of the target attack event and send the attack feature information to the terminal probe corresponding to the attacked IP;

[0008] The terminal probe continuously monitors and records abnormal behavior, normal behavior and terminal response judgment rule behavior in the terminal, matches the attack feature information with the information monitored and recorded by the terminal probe, and determines the attack result of the target attack event based on the matching result.

[0009] Optionally, determining a target attack event in the network attack traffic for which an attack result needs to be determined based on terminal behavior includes:

[0010] According to the preset attack rules, the attack result judgment events required by the terminal probe in the network attack traffic are sorted out to determine the candidate attack events;

[0011] When the attack type and terminal connectivity status of the candidate attack event meet specified conditions, the candidate attack event is determined to be a target attack event.

[0012] Optionally, the attack feature information includes time, attack identifier, attack type, and payload, and matching the attack feature information with information recorded by a terminal probe monitoring system and determining the attack result of the target attack event based on the matching result includes:

[0013] Matching the attack feature information with first information of abnormal behavior recorded by the terminal probe monitoring, and matching the attack feature information with second information of normal behavior recorded by the terminal probe monitoring;

[0014] If the first information that is consistent with the attack feature information is matched, or if the second information that is consistent with the attack feature information is matched, then the attack result of the target attack event is determined to be a successful attack.

[0015] Optionally, the attack feature information further includes a rule identifier, and before matching the attack feature information with the first information of abnormal behavior recorded by the terminal probe monitoring, and matching the attack feature information with the second information of normal behavior recorded by the terminal probe monitoring, further includes:

[0016] Querying a preset relationship to match the rule identifier with a preset terminal response success rule identifier and a preset terminal response failure rule identifier;

[0017] When the rule identifier matches the terminal response success rule identifier, determining the attack result of the target attack event as an attack success;

[0018] When the rule identifier matches a terminal response failure rule identifier, it is determined that the attack result of the target attack event is an attack failure.

[0019] Optionally, the method further includes:

[0020] If neither the first information nor the second information is matched, extracting key features of each set of information from the first and second information, performing fuzzy matching on the attack signature information and the key features, and generating weights corresponding to each set of information;

[0021] A maximum value among the multiple groups of weights is determined, and if the maximum value is greater than a preset threshold, the attack result of the target attack event is determined to be a suspected successful attack.

[0022] Optionally, matching the attack feature information with first information of abnormal behavior recorded by a terminal probe monitoring, and matching the attack feature information with second information of normal behavior recorded by a terminal probe monitoring, includes:

[0023] Determining whether the attack feature information carries a delayed response identifier;

[0024] If the delayed response identifier is not detected, immediately matching the attack feature information with the first information and the second information;

[0025] If the delayed response identifier is detected, the attack feature information is matched with the first information and the second information after a delay corresponding to the delayed response identifier.

[0026] Optionally, the method further includes:

[0027] Receive the terminal probe serial number, device IP, terminal system information, and terminal description information sent by the terminal probe to register the terminal probe with the detection device;

[0028] The terminal probe feeds back status information through the heartbeat connection with the detection device.

[0029] In a second aspect, an embodiment of the present disclosure provides a device for determining a network attack result, comprising:

[0030] An acquisition module is used to acquire network attack traffic and determine target attack events in the network attack traffic for which the attack results need to be determined through terminal behavior;

[0031] An extraction module is used to extract attack feature information of the target attack event and send the attack feature information to the terminal probe corresponding to the attacked IP;

[0032] The determination module is used to continuously monitor and record abnormal behavior, normal behavior and terminal response judgment rule behavior in the terminal through the terminal probe, and match the attack feature information with the information monitored and recorded by the terminal probe, and determine the attack result of the target attack event based on the matching result.

[0033] In a third aspect, an embodiment of the present disclosure provides an electronic device, comprising: a processor; a memory for storing instructions executable by the processor; the processor for reading the executable instructions from the memory and executing the instructions to implement the method for determining the results of a network attack as described in the first aspect above.

[0034] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium, wherein the storage medium stores a computer program, and when the computer program is executed by a processor, the method for determining the network attack result described in the first aspect above is implemented.

[0035] Compared with the prior art, the technical solution provided by the embodiments of the present disclosure has the following advantages: the attack feature information of the target attack event is obtained through the detection device, and the attack feature information is sent to the terminal probe, the abnormal behavior and normal behavior in the terminal are continuously monitored and recorded by the terminal probe, and the attack feature information is matched with the information monitored and recorded by the terminal probe, and the attack result of the target attack event is determined according to the matching result. Therefore, the detection device is linked to the terminal probe, and the target attack event is sent to the terminal probe for analysis and judgment, and the attack event judgment result is responded to. For some attack events that have no response and the attack result cannot be judged by the response traffic, the attack result can be determined, thereby expanding the attack result detection range and improving the accuracy of network attack result detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0037] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0038] Figure 1 A flowchart of a method for determining network attack results provided by an embodiment of the present disclosure;

[0039] Figure 2 A schematic diagram of the structure of a detection device and a terminal probe provided in an embodiment of the present disclosure;

[0040] Figure 3 A schematic diagram of a terminal probe side process provided by an embodiment of the present disclosure;

[0041] Figure 4 A schematic diagram of the structure of a device for determining network attack results provided by an embodiment of the present disclosure;

[0042] Figure 5 A schematic structural diagram of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0043] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features therein can be combined with each other in the absence of conflict.

[0044] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0045] Figure 1 This is a flow chart of a method for determining network attack results provided by an embodiment of the present disclosure. The method provided by an embodiment of the present disclosure can be executed by a device for determining network attack results. The device can be implemented using software and / or hardware and can be integrated into any electronic device with computing capabilities, such as user terminals such as smartphones and tablets.

[0046] like Figure 1 As shown, the method for determining the network attack result provided by the embodiment of the present disclosure may include:

[0047] Step 101: obtain network attack traffic and determine target attack events in the network attack traffic that require terminal behavior to determine attack results.

[0048] The method of the embodiment of the present disclosure can be applied to detection equipment.

[0049] In the embodiment of the present disclosure, the detection device obtains the network traffic to be detected and identifies whether the network traffic to be detected is network attack traffic. For example, network attack detection can be performed through existing network attack identification methods or attack feature rules to identify attack behavior, thereby determining the network attack traffic in the network traffic to be detected.

[0050] In this embodiment, it is applied to determine the attack result corresponding to the network attack traffic, for example, to determine whether the attack is successful. In related technologies, after determining the network attack traffic, the attack result can be determined based on the response message, while the present disclosure is applied to the attack result determination in cases such as no-response attacks or attack response data that cannot determine the attack result, that is, to determine the attack result of the target attack event, wherein the target attack event includes no-response attack events, attack result events that cannot be determined by response traffic, and attack events with unstable response traffic content that cannot be characterized. Among them, no-response attack events include: some industrial control attacks, some ICMP attacks, and some denial of service attacks. Attack result events that cannot be determined by response traffic include: downloading virus command execution operations, overflow attacks, and attack events with unstable response traffic include: unauthorized access, arbitrary file reading, partial information leakage, partial command execution attacks, and partial code execution attacks. The execution commands vary greatly and it is impossible to summarize the characteristics of all execution command results.

[0051] In one embodiment of the present disclosure, determining a target attack event in the network attack traffic includes: sorting out attack result judgment events in the network attack traffic that require terminal probes according to preset attack rules, determining candidate attack events, and determining the candidate attack event as a target attack event when the attack type and terminal connectivity of the candidate attack event meet specified conditions.

[0052] Among them, the screening method uses local judgment methods such as no response judgment rules and no machine learning response judgment model to identify candidate attack events. The selected events are divided into two categories: 1. Attack events where the success or failure of the attack is clear at the terminal, and corresponding terminal response judgment rules can be preset, such as fixed command execution and fixed payload overflow attacks; 2. Attack events where the success or failure of the attack is uncertain at the terminal, and terminal response judgment rules cannot be preset, such as non-fixed command execution, arbitrary file reading, and directory traversal. The preset terminal response judgment rules are based on the attack rules of the detection device and have a corresponding correlation. The preset response judgment rules and machine learning response judgment models can determine the success or failure of the attack when the response traffic has obvious characteristics. For example, network attack traffic can be filtered, the attack results can be determined for traffic that can be directly judged by the detection device, and candidate attack events can be determined based on traffic that cannot be directly judged. Furthermore, when the attack type of the candidate attack event is a specified type, and / or the detection device is connected to the terminal, the candidate attack event is determined to be a target attack event, wherein the attack type of the candidate attack event can be determined in the network attack detection stage, and the specified types include buffer overflow attacks, command execution attacks, code execution attacks, some UDP (User Datagram Protocol) type attacks, etc. For the target attack event, subsequent steps are used to determine the attack results.

[0053] Step 102: extract attack feature information of the target attack event, and send the attack feature information to the terminal probe corresponding to the attacked IP.

[0054] In this embodiment, the detection device obtains attack signature information for a target attack event and sends it to the terminal probe corresponding to the attacked IP (Internet Protocol). The attack signature information is extracted from the attack event type and the attack event traffic. The attack signature information includes time, rule identifier, attack type, and payload (payload includes execution commands, malicious IP / URL / domain name, and other payloads).

[0055] As an example, the structure of the detection device and the terminal probe is as follows Figure 2 As shown, the detection device obtains the network traffic to be detected through diversion or serial connection, and connects to each terminal probe network through a network connection device. The terminal probe corresponds to the terminal. The detection device determines the target terminal to send attack signature information from multiple terminals based on information such as the attacked IP address of the target attack event.

[0056] Step 103: continuously monitor and record abnormal behavior, normal behavior, and terminal response judgment rule behavior in the terminal through the terminal probe, match the attack feature information with the information monitored and recorded by the terminal probe, and determine the attack result of the target attack event based on the matching result.

[0057] In this embodiment, the terminal probe is configured to monitor and record abnormal and normal behavior in the terminal. That is, while the detection device identifies attack behavior, the terminal probe monitors the behavior in the terminal in real time. Furthermore, the terminal probe monitors and records the behavior of the terminal in response to the judgment rule.

[0058] The following describes the terminal probe side. The execution steps on the terminal probe side refer to Figure 3 Step 1: The terminal probe registers / manages and maintains heartbeat with the detection device. Step 21: The detection device sends attack signature information to the terminal probe. Step 22: The terminal probe records abnormal and normal behavior. Step 3: The terminal probe matches the attack signature information with the behavior recorded by the terminal probe. Step 4: The terminal probe responds to the detection device, including the judgment result and abnormal behavior information.

[0059] The terminal probe registers by sending its serial number, device IP address, terminal system information, and terminal description to the detection device. The detection device then receives the serial number, device IP address, terminal system information, and terminal description information to register the probe with the detection device. After registration, the probe can be managed and configured, and a rule base, including an attack response association rule base and an abnormal behavior rule base, can be distributed. The terminal probe maintains a heartbeat connection with the detection device, providing feedback on probe status and terminal system status, as well as responses to the detection device.

[0060] While the detection device is detecting attack behavior, the terminal probe is detecting behavior in the terminal in real time, including monitoring of abnormal behavior rules, recording of normal behavior monitoring, and monitoring of terminal response judgment rule behavior. The terminal response judgment rule library is associated with the attack library in the detection device through rule identifiers, including terminal response success rule identifiers and terminal response failure rule identifiers. The abnormal behavior rule library is used to identify abnormal behavior and monitor and record abnormal behavior of the terminal, such as malicious network resources, virus intelligence information, and other customized abnormal behavior rules. When the terminal probe detects that the behavior in the terminal meets the abnormal behavior rule library, it is determined to be abnormal behavior and recorded. The information recorded for the abnormal behavior includes time, rule identifier, attack classification, and specific information about the abnormal behavior.

[0061] Optionally, the terminal probe can also enable normal behavior recording configuration to record normal behavior or classify behavior that does not meet the abnormal behavior rule base as normal behavior. Examples include network connections, process information, user modification, command execution, file reading and writing, startup item changes, scheduled tasks, service startup, DNS (Domain Name System) resolution records, and system error messages. The recorded normal behavior information includes time, rule identifier, attack classification, and specific information about normal behavior. Information recording can be configured, such as automatic rollback and deletion, and information recording time. By default, rule-related behavior information is recorded for 6 months, and normal behavior information is recorded for 24 hours.

[0062] The matching process is described below.

[0063] In one embodiment of the present disclosure, the attack feature information is matched with the information recorded by the terminal probe monitoring, and the attack result of the target attack event is determined based on the matching result, including: matching the attack feature information with the first information of the abnormal behavior recorded by the terminal probe monitoring, and matching the attack feature information with the second information of the normal behavior recorded by the terminal probe monitoring; if the first information consistent with the attack feature information is matched, or if the second information consistent with the attack feature information is matched, then the attack result of the target attack event is determined to be a successful attack.

[0064] In this embodiment, the attack signature information issued by the detection device is precisely matched with key feature information of abnormal and normal behaviors. If the attack signature information matches a certain abnormal or normal behavior, for example, by comparing the payload (malicious IP / domain name, etc.) in the attack signature information with the IP / domain name and other information of each recorded behavior, if they are consistent, it is determined that the information is consistent with the attack signature information, the match is successful, and the attack result of the target attack event is determined to be a successful attack. Then, the response detection device returns the judgment result (attack success), rule identification, and terminal recorded behavior information, such as recording time and specific behavior information.

[0065] In one embodiment of the present disclosure, the attack feature information is matched with the information recorded by the terminal probe monitoring, and the attack result of the target attack event is determined based on the matching result, including: querying a preset relationship to match the rule identifier with a preset terminal response success rule identifier and a terminal response failure rule identifier; when the rule identifier matches the terminal response success rule identifier, determining that the attack result of the target attack event is an attack success; when the rule identifier matches the terminal response failure rule identifier, determining that the attack result of the target attack event is an attack failure.

[0066] In this embodiment, the rule identifier is identification information associated with the attack event. The preset relationship, such as the aforementioned terminal response determination rule library, can be set by security personnel based on the network security monitoring scenario. After receiving the attack signature information sent by the detection device, the terminal probe matches the attack signature information with the stored terminal response determination rules. Specifically, it matches the rule record behavior by associating the rule identifier and description information. If a rule is matched, the terminal probe responds to the detection device and returns information such as the attack response result (attack success, attack failure), behavior record information, and behavior identifier description. Rule matching can be performed before the precise matching step. If a rule is matched, subsequent matching steps can be stopped.

[0067] In one embodiment of the present disclosure, attack feature information is matched with information recorded by terminal probe monitoring, and the attack result of the target attack event is determined based on the matching result, including: if the first information consistent with the attack feature information is not matched, and the second information consistent with the attack feature information is not matched, then the key features of each group of information in the first information and the second information are extracted, the attack feature information is fuzzy matched with the key features, and a weight corresponding to each group of information is generated; the maximum value among multiple groups of weights is determined, and if the maximum value is greater than a preset threshold, the attack result of the target attack event is determined to be a suspected successful attack.

[0068] In this embodiment, if the rule is not matched and a behavior record is not accurately matched, the attack feature information is fuzzy matched with the key features in the abnormal behavior and normal behavior information recorded by the terminal probe monitoring record. For example, the payload in the attack feature information is fuzzy matched with the key features, and the behavior with the largest matching weight is fed back to the detection device as a response, responding with a suspected successful attack label. If the fuzzy match does not match anything, the attempted attack label is returned and the attack result behavior is empty.

[0069] Optionally, during the matching process, a delayed response or an immediate response may be used depending on the settings. Taking the exact matching step as an example, a determination is made as to whether the attack signature information carries a delayed response identifier. If the delayed response identifier is not detected, the attack signature information is immediately matched with the first and second information. If the delayed response identifier is detected, the attack signature information is matched with the first and second information after a delay corresponding to the delayed response identifier.

[0070] The delayed response flag can be set manually or in response to an attack event. In the case of a delayed response, the terminal probe will continue matching the response information of the target attack event until a match is found or the delay time is reached, and then return a response. If no match is found after the delay time, the feedback is determined to be non-anomalous. As an example, an exact match can be used for the first N matches, and a fuzzy match can be performed for the final match when the response time is reached.

[0071] The detection device then receives attack results from the endpoint probes, including the following: a match to a rule, resulting in a response of attack success / failure and corresponding behavior information; a match to abnormal / normal endpoint behavior records, resulting in a response of attack success and endpoint behavior information; a fuzzy match to abnormal / normal endpoint records, resulting in a response of suspected success and endpoint behavior information; and a match to no endpoint information, resulting in a response of an attempted attack with no abnormal behavior information. For suspected success, manual analysis can be performed on the detection device, and endpoint probes can be issued using behavioral blacklists and whitelists. Attack assessment can be continuously optimized, for example, by updating the rule matching process.

[0072] According to the technical solution of the embodiment of the present disclosure, the attack feature information of the target attack event is obtained through the detection device, and the attack feature information is sent to the terminal probe. The terminal probe continuously monitors and records abnormal behavior and normal behavior in the terminal, and matches the attack feature information with the recorded information. The attack result of the target attack event is determined based on the matching result. Therefore, the detection device sends the target attack event to the terminal probe for analysis and judgment by registering, managing, and linking the terminal probe, and responds to the attack event judgment result and terminal behavior information. This solves the technical problems of some attacks being unresponsive and the response traffic being unable to judge the attack result, expands the scope of network attack result detection, and improves the accuracy of network attack result detection. In addition, compared with the method in which all monitoring, recording, and analysis processes are implemented in the terminal, the linkage between the detection device and the terminal probe reduces terminal resource usage and improves terminal performance.

[0073] Figure 4 A schematic diagram of a device for determining network attack results provided by an embodiment of the present disclosure is shown in FIG. Figure 4 As shown, the network attack result determination device includes: an acquisition module 41 , an extraction module 42 , and a determination module 43 .

[0074] The acquisition module 41 is configured to acquire network attack traffic and determine target attack events in the network attack traffic for which attack results need to be determined through terminal behavior.

[0075] The extraction module 42 is configured to extract attack feature information of the target attack event and send the attack feature information to a terminal probe corresponding to the attacked IP.

[0076] The determination module 43 is used to continuously monitor and record abnormal behavior, normal behavior and terminal response judgment rule behavior in the terminal through the terminal probe, and match the attack feature information with the information monitored and recorded by the terminal probe, and determine the attack result of the target attack event based on the matching result.

[0077] Optionally, the acquisition module 41 is specifically used to: sort out the attack result judgment events in the network attack traffic that require terminal probes to perform according to preset attack rules, and determine candidate attack events; when the attack type and terminal connectivity of the candidate attack event meet specified conditions, determine the candidate attack event as a target attack event.

[0078] Optionally, the attack feature information includes time, attack identifier, attack type, and payload, and the determination module 43 includes: a precise matching unit, used to match the attack feature information with the first information of abnormal behavior monitored and recorded by the terminal probe, and to match the attack feature information with the second information of normal behavior monitored and recorded by the terminal probe; if the first information consistent with the attack feature information is matched, or if the second information consistent with the attack feature information is matched, the attack result of the target attack event is determined to be a successful attack.

[0079] Optionally, the attack feature information also includes a rule identifier, and the determination module 43 also includes: a rule matching unit, used to query a preset relationship to match the rule identifier with a preset terminal response success rule identifier and a terminal response failure rule identifier; when the rule identifier matches the terminal response success rule identifier, the attack result of the target attack event is determined to be an attack success; when the rule identifier matches the terminal response failure rule identifier, the attack result of the target attack event is determined to be an attack failure.

[0080] Optionally, the determination module 43 also includes: a fuzzy matching unit, which is used to extract the key features of each group of information in the first information and the second information if the first information consistent with the attack feature information is not matched, and the second information consistent with the attack feature information is not matched, and fuzzy match the attack feature information with the key features to generate a weight corresponding to each group of information; determine the maximum value among multiple groups of weights, and if the maximum value is greater than a preset threshold, determine that the attack result of the target attack event is a suspected successful attack.

[0081] Optionally, the precise matching unit is specifically used to: determine whether the attack feature information carries a delayed response identifier; if the delayed response identifier is not detected, immediately match the attack feature information with the first information and the second information; if the delayed response identifier is detected, delay the attack feature information with the first information and the second information after a time corresponding to the delayed response identifier.

[0082] Optionally, the device also includes: a registration module for receiving the terminal probe serial number, device IP, terminal system information, and terminal description information sent by the terminal probe to register the terminal probe to the detection device; wherein the terminal probe feeds back status information through a heartbeat connection with the detection device.

[0083] The network attack result determination device provided in the embodiments of the present disclosure can execute any network attack result determination method provided in the embodiments of the present disclosure, and has the corresponding functional modules and beneficial effects of the execution method. For any content not fully described in the embodiments of the present disclosure, reference can be made to the description of any method embodiment of the present disclosure.

[0084] Figure 5 This is a schematic diagram of the structure of an electronic device provided by an embodiment of the present disclosure. Figure 5 As shown, electronic device 600 includes one or more processors 601 and memory 602 .

[0085] The processor 601 may be a central processing unit (CPU) or other forms of processing units having data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device 600 to perform desired functions.

[0086] The memory 602 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and / or cache memory. Non-volatile memory may include, for example, read-only memory (ROM), a hard disk, flash memory, etc. One or more computer program instructions may be stored on a computer-readable storage medium, and the processor 601 may execute the program instructions to implement the methods of the embodiments of the present disclosure described above and / or other desired functions. Various contents such as input signals, signal components, noise components, etc. may also be stored in the computer-readable storage medium.

[0087] In one example, the electronic device 600 may further include an input device 603 and an output device 604, which are interconnected via a bus system and / or other forms of connection mechanisms (not shown). Furthermore, the input device 603 may include, for example, a keyboard, a mouse, and the like. The output device 604 may output various information to the outside, including determined distance information, direction information, and the like. The output device 604 may include, for example, a display, a speaker, a printer, a communication network, and remote output devices connected thereto.

[0088] Of course, to simplify, Figure 5 Only some of the components related to the present disclosure in the electronic device 600 are shown, and components such as buses, input / output interfaces, etc. are omitted. In addition, the electronic device 600 may further include any other appropriate components according to specific application scenarios.

[0089] In addition to the above methods and devices, the embodiments of the present disclosure may also be a computer program product, which includes computer program instructions. When the computer program instructions are executed by a processor, the processor executes any method provided by the embodiments of the present disclosure.

[0090] The computer program product may be written in any combination of one or more programming languages ​​to implement the operations of the disclosed embodiments, including object-oriented programming languages ​​such as Java, C++, and conventional procedural programming languages ​​such as C or similar programming languages. The program code may be executed entirely on the user's computing device, partially on the user's computing device, as a stand-alone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0091] In addition, the embodiments of the present disclosure may also be a computer-readable storage medium having computer program instructions stored thereon. When the computer program instructions are executed by a processor, the processor is enabled to perform any method provided by the embodiments of the present disclosure.

[0092] Computer readable storage media can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can, for example, include but is not limited to a system, device or component of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0093] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

[0094] The foregoing description is intended only to provide specific embodiments of the present disclosure, intended to enable those skilled in the art to understand and implement the present disclosure. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the embodiments described herein, but rather to be construed in the broadest manner consistent with the principles and novel features disclosed herein.

Claims

1. A method for determining the result of a network attack, characterized in that: Applied to a detection device, the detection device is connected to each terminal probe network through a network connection device, and the terminal probe corresponds to the terminal. The method includes: Obtain network attack traffic and determine target attack events in the network attack traffic for which attack results need to be determined through terminal behavior; the target attack events include unresponsive attack events, which include industrial control attacks, ICMP attacks, and denial of service attacks; Extract attack feature information of the target attack event and send the attack feature information to the terminal probe corresponding to the attacked IP; Continuously monitoring and recording abnormal behavior, normal behavior, and terminal response judgment rule behavior in the terminal through the terminal probe, and matching the attack feature information with the information monitored and recorded by the terminal probe, and determining the attack result of the target attack event based on the matching result; The terminal probe responds to the detection device, and the response content includes the attack result; The attack feature information includes time, attack identifier, attack type, and payload. Matching the attack feature information with information recorded by a terminal probe monitoring system and determining the attack result of the target attack event based on the matching result includes: Match the attack feature information with the first information of abnormal behavior monitored and recorded by the terminal probe, and match the attack feature information with the second information of normal behavior monitored and recorded by the terminal probe; the abnormal behavior includes malicious network resources, virus intelligence information, and customized abnormal behavior; the first information includes time, rule identification, attack classification, and specific information of abnormal behavior; the normal behavior includes network connection, process information, user modification, startup item change, scheduled task, service startup, DNS resolution record, and system error information; the second information includes time, rule identification, attack classification, and specific information of normal behavior; If the first information that is consistent with the attack feature information is matched, or if the second information that is consistent with the attack feature information is matched, then determining that the attack result of the target attack event is a successful attack; If neither the first information nor the second information is matched, extracting key features of each set of information from the first and second information, performing fuzzy matching on the attack signature information and the key features, and generating weights corresponding to each set of information; A maximum value among the multiple groups of weights is determined, and if the maximum value is greater than a preset threshold, the attack result of the target attack event is determined to be a suspected successful attack.

2. The method according to claim 1, wherein Determining a target attack event in the network attack traffic that requires determining an attack result through terminal behavior includes: According to the preset attack rules, the attack result judgment events required by the terminal probe in the network attack traffic are sorted out to determine the candidate attack events; When the attack type and terminal connectivity status of the candidate attack event meet specified conditions, the candidate attack event is determined to be a target attack event.

3. The method according to claim 1, wherein The attack feature information further includes a rule identifier, and before matching the attack feature information with first information of abnormal behavior recorded by the terminal probe monitoring, and matching the attack feature information with second information of normal behavior recorded by the terminal probe monitoring, further includes: Querying a preset relationship to match the rule identifier with a preset terminal response success rule identifier and a preset terminal response failure rule identifier; When the rule identifier matches the terminal response success rule identifier, determining the attack result of the target attack event as an attack success; When the rule identifier matches a terminal response failure rule identifier, it is determined that the attack result of the target attack event is an attack failure.

4. The method according to claim 1, wherein The matching of the attack feature information with first information of abnormal behavior recorded by the terminal probe monitoring, and the matching of the attack feature information with second information of normal behavior recorded by the terminal probe monitoring, includes: Determining whether the attack feature information carries a delayed response identifier; If the delayed response identifier is not detected, immediately matching the attack feature information with the first information and the second information; If the delayed response identifier is detected, the attack feature information is matched with the first information and the second information after a delay corresponding to the delayed response identifier.

5. The method according to claim 1, wherein Also includes: Receive the terminal probe serial number, device IP, terminal system information, and terminal description information sent by the terminal probe to register the terminal probe with the detection device; The terminal probe feeds back status information through the heartbeat connection with the detection device.

6. A device for determining the result of a network attack, characterized in that: Applied to a detection device, the detection device is connected to each terminal probe network through a network connection device, and the terminal probe corresponds to the terminal. The device includes: An acquisition module is used to acquire network attack traffic and determine target attack events in the network attack traffic for which the attack results need to be determined through terminal behavior; the target attack events include unresponsive attack events, which include industrial control attacks, ICMP attacks, and denial of service attacks; An extraction module is used to extract attack feature information of the target attack event and send the attack feature information to the terminal probe corresponding to the attacked IP; a determination module, configured to continuously monitor and record abnormal behavior, normal behavior, and terminal response determination rule behavior in the terminal through the terminal probe, and match the attack feature information with the information monitored and recorded by the terminal probe, and determine the attack result of the target attack event based on the matching result; The terminal probe responds to the detection device, and the response content includes the attack result; The attack feature information includes time, attack identifier, attack type, and payload. Matching the attack feature information with information recorded by a terminal probe monitoring system and determining the attack result of the target attack event based on the matching result includes: Match the attack feature information with the first information of abnormal behavior monitored and recorded by the terminal probe, and match the attack feature information with the second information of normal behavior monitored and recorded by the terminal probe; the abnormal behavior includes malicious network resources, virus intelligence information, and customized abnormal behavior; the first information includes time, rule identification, attack classification, and specific information of abnormal behavior; the normal behavior includes network connection, process information, user modification, startup item change, scheduled task, service startup, DNS resolution record, and system error information; the second information includes time, rule identification, attack classification, and specific information of normal behavior; If the first information that is consistent with the attack feature information is matched, or if the second information that is consistent with the attack feature information is matched, then determining that the attack result of the target attack event is a successful attack; The determination module further includes: a fuzzy matching unit configured to, if no first information consistent with the attack signature information is matched and no second information consistent with the attack signature information is matched, extract key features of each set of information from the first information and the second information, perform fuzzy matching on the attack signature information with the key features, and generate a weight corresponding to each set of information; A maximum value among the multiple groups of weights is determined, and if the maximum value is greater than a preset threshold, the attack result of the target attack event is determined to be a suspected successful attack.

7. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to read the executable instructions from the memory and execute the instructions to implement the method for determining the network attack result as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that The storage medium stores a computer program, and when the computer program is executed by a processor, the method for determining the network attack result according to any one of claims 1 to 5 is implemented.

Images