Attack identification method, device, electronic device and storage medium

Abstract

The present invention discloses an attack identification method, device, electronic device and storage medium, the method comprising: obtaining the attack sequence suffered by the host; screening the attack sequence based on the attack attribute, determining the target attack sequence corresponding to each attack attribute; determining the attack success rate according to the success rate of each attack step of the target attack sequence; determining the threat value according to the loss value caused by the target attack sequence to the host; calculating the threat degree of the target attack sequence based on the attack success rate and the threat value; determining the attack identification result of the host according to the threat degree of the target attack sequence. The method improves the accuracy of attack identification, and can perform risk identification and assessment based on the identification of the attack.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to an attack identification method, device, electronic equipment and storage medium. Background Art

[0002] A network attack event consists of multiple attack states. Before launching an attack, the attacker will first initiate some detection activities to the target. Usually, the threat level of these detection activities is relatively low and will not attract the attention of network security personnel. After detecting the host information, the attacker will use the detected information to launch further attacks on the host and gradually increase the intensity of the attack until the target is finally attacked. A complete attack process includes multiple attack states, and there is a certain time and space connection between each attack state. However, when there are multiple complex and isolated attack events, it is difficult to identify the attack, and the evaluation of the host and network environment may be inaccurate, and the efficiency is low. Summary of the invention

[0003] In view of this, embodiments of the present invention provide an attack identification method, device, electronic device, and storage medium to solve the problem of low attack identification efficiency.

[0004] According to a first aspect, an embodiment of the present invention provides an attack identification method, including:

[0005] Get the attack sequence of the host;

[0006] Screen the attack sequence based on the attack attributes and determine the target attack sequence corresponding to each attack attribute;

[0007] Determining an attack success rate according to a success rate of each attack step of the target attack sequence;

[0008] Determine a threat value according to a loss value caused by the target attack sequence to the host;

[0009] Calculating the threat level of the target attack sequence based on the attack success rate and the threat value;

[0010] An attack identification result of the host is determined according to the threat level of the target attack sequence.

[0011] The attack identification method provided by the present invention screens the attack sequence suffered by the host, and classifies the attack sequence based on the attack attributes contained in the attack sequence, so as to obtain the target attack sequence corresponding to each attack attribute. The attack success rate and threat value of the target attack sequence are obtained, and the threat level of the target attack sequence is calculated based on the attack success rate and the threat value. The host is evaluated based on the threat level of the target attack sequence to obtain the attack identification result of the host, that is, the risk situation of the host. Based on the risk situation of the host, the risk assessment of the network where the host is located can be performed to judge the risk situation of the network. This method improves the accuracy of attack identification, and can perform risk identification and assessment based on the identification of attacks.

[0012] In combination with the first aspect, in one implementation, screening the attack sequence based on the attack attribute to determine the target attack sequence corresponding to each attack attribute includes:

[0013] Get attack attributes;

[0014] Classifying the attack sequence based on the attack attribute, and determining the attack attribute to which the attack sequence belongs;

[0015] For attack sequences with the same attack attribute, the number of categories of the attack attribute in the attack sequence is compared, and the attack sequence with the largest number of categories is determined as the target attack sequence corresponding to the attack attribute.

[0016] In combination with the first aspect, in one implementation, the classifying the attack sequence based on the attack attribute to determine the attack attribute to which the attack sequence belongs includes:

[0017] Obtaining the attack attributes included in the attack sequence, and determining the weight of each attack attribute;

[0018] Based on the weight of the attack attribute, the attack attribute to which the attack sequence belongs is determined.

[0019] In combination with the first aspect, in one implementation, determining the attack success rate according to the success rate of each attack step of the target attack sequence includes:

[0020] Obtaining the success rate of each attack step of the target attack sequence;

[0021] The attack success rate is determined based on the difference between the product of the success rate of each attack step and a preset threshold.

[0022] In combination with the first aspect, in one implementation, determining the threat value according to the loss value caused by the target attack sequence to the host includes:

[0023] Obtaining a loss value of each attack step of the target attack sequence on the host;

[0024] An average of the maximum loss values ​​of the hosts is calculated, and the threat value is determined based on the average.

[0025] In combination with the first aspect, in one implementation, the attack identification result of the host is calculated according to the following formula:

[0026]

[0027] Among them, M(D) i Indicates the attack identification result of the host, m i (A i ) represents the threat level of the target attack sequence described in the ith item.

[0028] In combination with the first aspect, in one implementation, the method further includes:

[0029] Based on the attack identification result of the host, determining the attack identification result of the network where the host is located;

[0030] A risk assessment is performed on the network based on the attack identification result of the network and a preset risk threshold.

[0031] According to a second aspect, an embodiment of the present invention provides an attack identification device, including:

[0032] A sequence acquisition module is used to obtain the attack sequence of the host;

[0033] A target determination module is used to screen the attack sequence based on the attack attribute and determine the target attack sequence corresponding to each attack attribute;

[0034] A first calculation module, used to determine the attack success rate according to the success rate of each attack step of the target attack sequence;

[0035] A second calculation module, used to determine a threat value according to a loss value caused by the target attack sequence to the host;

[0036] A third calculation module, configured to calculate the threat level of the target attack sequence based on the attack success rate and the threat value;

[0037] The attack identification module is used to determine the attack identification result of the host according to the threat level of the target attack sequence.

[0038] In one embodiment, the target determination module includes:

[0039] The attribute acquisition submodule is used to obtain attack attributes;

[0040] A classification submodule, used to classify the attack sequence based on the attack attribute, and determine the attack attribute to which the attack sequence belongs;

[0041] The quantity comparison submodule is used to compare the number of categories of the attack attributes in the attack sequences with the same attack attribute, and determine the attack sequence with the largest number of categories as the target attack sequence corresponding to the attack attribute.

[0042] In one embodiment, the classification submodule is further used to obtain the attack attributes included in the attack sequence and determine the weight of each attack attribute;

[0043] Based on the weight of the attack attribute, the attack attribute to which the attack sequence belongs is determined.

[0044] In one embodiment, the first calculation module includes:

[0045] A success rate determination submodule, used to obtain the success rate of each attack step of the target attack sequence;

[0046] The attack success rate determination submodule is used to determine the attack success rate based on the difference between the product of the success rate of each attack step and a preset threshold.

[0047] In one embodiment, the second calculation module includes:

[0048] A loss value acquisition submodule, used to obtain the loss value of each attack step of the target attack sequence to the host;

[0049] The threat value determination submodule is used to calculate the average of the maximum loss values ​​of the host and determine the threat value based on the average.

[0050] In one implementation, the attack identification result of the host is calculated according to the following formula:

[0051]

[0052] Among them, M(D) i represents the attack identification result of the host, and m1(A1) represents the threat level of the target attack sequence of the i-th item.

[0053] In one embodiment, the device further comprises:

[0054] An identification module, used to determine an attack identification result of a network where the host is located based on the attack identification result of the host;

[0055] The risk assessment module is used to perform risk assessment on the network according to the attack identification result of the network and a preset risk threshold.

[0056] According to a third aspect, an embodiment of the present invention provides an electronic device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the attack identification method described in the first aspect or any one of the embodiments of the first aspect by executing the computer instructions.

[0057] According to a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the attack identification method described in the first aspect or any one of the embodiments of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0059] Figure 1 is a flow chart of an attack identification method according to an embodiment of the present invention;

[0060] Figure 2 is a flow chart of a method for determining a target attack sequence according to an embodiment of the present invention;

[0061] Figure 3 is a flow chart of a method for determining an attack success rate according to an embodiment of the present invention;

[0062] Figure 4 is a flow chart of a method for determining a threat value according to an embodiment of the present invention;

[0063] Figure 5 is a flow chart of an attack identification method according to an embodiment of the present invention;

[0064] Figure 6 is a structural block diagram of an attack identification device according to an embodiment of the present invention;

[0065] Figure 7 It is a schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0066] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0067] According to an embodiment of the present invention, an attack identification method embodiment is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0068] In this embodiment, an attack identification method is provided, which can be used in terminals such as mobile phones, tablet computers, and computers. Figure 1 is a flow chart of an attack identification method according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0069] S11, obtain the attack sequence suffered by the host.

[0070] A network attack event usually consists of multiple attack steps. Before launching an attack, the attacker will initiate some detection activities on the target. After detecting the information of the target, the attacker will launch further attacks on the target and gradually increase the intensity of the attack, and finally achieve the attack on the target. Each attack step has a corresponding attack attribute. The target will issue an alarm message after being attacked. According to the alarm information, the attack containing multiple attack attributes is used as an attack sequence. The target of the attack can be a host.

[0071] S12, screening the attack sequence based on the attack attribute, and determining a target attack sequence corresponding to each attack attribute.

[0072] The attack attributes contained in all alarm information of the host are combined to form an alarm information database. The alarm information database contains all attack attributes. The attack attributes may include the alarm source IP address, destination IP address, source port, destination port, alarm attack category, alarm occurrence time, attack duration, etc. The specific attack attributes are determined based on the actual attack suffered by the host.

[0073] Each attack sequence contains at least one attack attribute. If the attack sequence contains only one attack attribute, the category of the attack sequence can be determined to be the attack attribute. If the attack sequence contains more than one attack attribute, it is necessary to analyze the attack attributes contained in the attack sequence, determine the attack attribute with the largest proportion or the highest weight, and classify the attack sequence into the attack attribute. Classify all attack sequences and determine the attack attribute category to which each attack sequence belongs. Then filter the attack sequences under the same attack attribute category, filter out the target attack sequence with the highest discrimination from the attack sequence, and remove redundant and less important attack sequences. The screening method can filter the same type of attack sequences through a hash filter to obtain a target attack sequence. Each attack attribute corresponds to a target attack sequence.

[0074] S13, determining the attack success rate according to the success rate of each attack step of the target attack sequence.

[0075] The target attack sequence may contain multiple attack steps. The success rate of each attack step is different. The success rate of each attack step should be determined according to the actual situation of the host being evaluated and the requirements of security management. The attack success rate of the target attack sequence is calculated based on the attack success rate of each attack step.

[0076] S14, determining a threat value according to the loss value caused to the host by the target attack sequence.

[0077] Each attack step in the target attack sequence causes different loss values ​​to the host in actual situations. The loss values ​​caused to the host can include integrity loss, availability loss, and confidentiality loss of the host assets. The size of the loss value needs to be determined in combination with the actual status of the host being evaluated and the requirements of security management. The greater the loss value, the greater the damage to the host assets. The attack steps that cause the greatest loss to the host are screened out, and the threat value of the target attack sequence to the host can be obtained by calculating the mean of the maximum loss values ​​caused by the attack steps.

[0078] S15, calculating the threat level of the target attack sequence based on the attack success rate and the threat value.

[0079] According to the obtained attack success rate and threat value of the target attack sequence, the threat degree of the target attack sequence to the host is calculated. Specifically, the threat degree can be obtained by calculating the product of the attack success rate and the threat value.

[0080] S16, determining the attack identification result of the host according to the threat level of the target attack sequence.

[0081] The attack identification result of the host can be the calculated threat level of the host. Combined with the threat levels of all target attack sequences corresponding to the host, the threat levels of all target attack sequences can be logically operated to obtain the attack identification result of the host, that is, the risk situation of the host. Based on the risk situation of the host, the risk assessment of the network where the host is located can be performed to determine the risk situation of the network.

[0082] The attack identification method provided in this embodiment screens the attack sequence suffered by the host, and classifies the attack sequence based on the attack attributes contained in the attack sequence, so as to obtain the target attack sequence corresponding to each attack attribute. The attack success rate and threat value of the target attack sequence are obtained, and the threat level of the target attack sequence is calculated based on the attack success rate and the threat value. The host is evaluated based on the threat level of the target attack sequence to obtain the attack identification result of the host, that is, the risk situation of the host. Based on the risk situation of the host, the risk assessment of the network where the host is located can be performed to determine the risk situation of the network. This method improves the accuracy of attack identification, and can perform risk identification and assessment based on the identification of attacks.

[0083] In this embodiment, a method for determining a target attack sequence is provided, corresponding to Figure 1 The S12 can be used in terminals such as mobile phones, tablets, and computers. Figure 2 is a flow chart of a method for determining a target attack sequence according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0084] S21, obtain attack attributes.

[0085] A network attack event usually consists of multiple attack steps. Before launching an attack, the attacker will first conduct some detection activities on the target. After detecting the information of the target, the attacker will launch further attacks on the target and gradually increase the intensity of the attack, and finally achieve the attack on the target. Each attack step has a corresponding attack attribute. The host will issue an alarm message after being attacked. According to the alarm message, the attack containing multiple attack attributes is regarded as an attack sequence.

[0086] Combine the attack attributes contained in all alarm information of the host. The attack attributes may include the source IP address, destination IP address, source port, destination port, alarm attack category, alarm occurrence time, attack duration, etc. The specific attack attributes are determined based on the actual attack suffered by the host, and an attack attribute set containing all attack attributes is established.

[0087] S22, classifying the attack sequence based on the attack attribute, and determining the attack attribute to which the attack sequence belongs.

[0088] Each attack sequence may contain one or more attack attributes. Before classifying the attack sequence, in order to reduce the data dimension, reduce the computational cost and improve the computational efficiency, the attack sequence can be symbolized, that is, the attack attributes contained in the attack sequence can be converted into character expressions.

[0089] Classifying attack sequences includes the following steps:

[0090] (1) Obtain the attack attributes contained in the attack sequence and determine the weight of each attack attribute.

[0091] (2) Based on the weight of the attack attribute, determine the attack attribute to which the attack sequence belongs.

[0092] The attack attributes contained in the attack sequence are obtained, and the attack sequences without obvious distinction are removed. After analyzing the attack sequence, the weights of the attack attributes of the attack sequence are obtained, and the attack attributes to which the attack sequence belongs are determined according to the weights of the attack attributes contained in the attack sequence.

[0093] For example, in an application scenario, a certain attack sequence includes three attack attributes: destination IP address, source IP address, and attack duration. They are symbolized to obtain {A, B, C}, that is, A corresponds to the destination IP address, B corresponds to the source IP address, and C corresponds to the attack duration. According to the analysis, A has the largest weight, followed by B, and C has the smallest weight. It can be determined that the attack type to which the attack sequence belongs is A, that is, the destination IP address. When filtering attack sequences belonging to type A, if there is an attack sequence that does not contain the attack attribute A, it means that the attack sequence does not have a clear distinction and can be filtered out.

[0094] S23, for attack sequences with the same attack attribute, compare the number of categories of the attack attribute in the attack sequence, and determine the attack sequence with the largest number of categories as the target attack sequence corresponding to the attack attribute.

[0095] The attack sequences are screened for redundancy and importance, and then the number of attack attributes contained in the attack sequences is compared, and the attack sequence with the largest number is determined as the target attack sequence corresponding to the attack attribute.

[0096] Specifically, the target attack sequence can be obtained by filtering the same type of attack sequences one by one using a hash filter. First, the attribute distance of a single attack sequence is defined:

[0097]

[0098] in, It is the attack sequence The number of attributes of .

[0099] Compare the attack sequences with the same attack attribute in pairs, and select the attack sequence with the most attack attributes. The matching degree calculation formula is as follows:

[0100]

[0101] in, represents the i-th attack sequence, represents the jth attack sequence.

[0102] For each attack sequence, a grid map of the corresponding attack attributes is initialized with all 0s. When the attack sequence is covered by the corresponding position of the attack attribute, the corresponding position of the attack sequence is changed to 1. For example, the attack attribute set is set to {A, B, C}. In order to calculate the number of attack attributes contained in the attack sequence, 0 and 1 are used to represent it. If the attack sequence has attack attribute A, the position is marked as 1. If the attack attribute B does not exist, the position is marked as 0. If the attack sequence obtained by the above method is {1, 1, 1}, and the other attack sequence is {1, 1, 0}, it can be seen that the first attack sequence contains more attack attributes, and the first attack sequence can be selected as the target attack sequence.

[0103] In this embodiment, a method for determining the attack success rate is provided, corresponding to Figure 1 The S13 in the system can be used in terminals such as mobile phones, tablet computers, and computers. Figure 3 is a flow chart of a method for determining an attack success rate according to an embodiment of the present invention. Figure 3 As shown, the process includes the following steps:

[0104] S31, obtaining the success rate of each attack step of the target attack sequence.

[0105] The target attack sequence may include multiple attack steps, and the attack success rate of each attack step is different. The success rate of each attack step should be determined based on the actual status of the host being evaluated and the requirements of security management.

[0106] S32, determining the attack success rate based on the difference between the product of the success rate of each attack step and the preset threshold. Specifically, the attack success rate can be calculated according to the following formula:

[0107] SA i =1-∏sa j ,(1≤j)

[0108] Among them, SA i Indicates the attack success rate, sa j It represents the success rate of the jth attack step in the target attack sequence, and 1 is the preset threshold.

[0109] In this embodiment, a method for determining a threat value is provided, corresponding to Figure 1The S14 can be used in terminals such as mobile phones, tablets, and computers. Figure 4 is a flow chart of a method for determining a threat value according to an embodiment of the present invention. Figure 4 As shown, the process includes the following steps:

[0110] S41, obtaining the loss value of each attack step of the target attack sequence to the host.

[0111] Each attack step in the target attack sequence causes different loss values ​​to the host in actual situations. The loss values ​​caused to the host may include integrity loss, availability loss, and confidentiality loss of the host assets. The size of the loss value needs to be determined in combination with the actual situation of the host being evaluated and the requirements of security management. The larger the loss value, the greater the damage to the host assets.

[0112] S42, calculating the average of the maximum loss values ​​of the hosts, and determining the threat value based on the average.

[0113] Specifically, the threat value is calculated according to the following formula:

[0114]

[0115] Among them, TA i Indicates the threat value, C max It represents the maximum value of the loss of host confidentiality caused by each attack step in the target attack sequence, I max A represents the maximum value of the loss caused to the host integrity by each attack step in the target attack sequence. max It represents the maximum loss value of host availability caused by each attack step in the target attack sequence.

[0116] In one implementation, the attack identification result of the host is calculated according to the following formula:

[0117]

[0118] Among them, M(D) i Indicates the attack identification result of the host, m i (A i ) represents the threat level of the i-th target attack sequence. The threat level of the target attack sequence can be obtained by calculating the product of the attack success rate of the target attack sequence and the threat value. The attack identification result of the host can represent the risk value of the host. i (A i ) indicates the importance of the host assets. The higher the importance of the host assets, the greater the damage caused by an attack on the host.

[0119] In one embodiment, Figure 5As shown, the attack identification method provided by this application also includes:

[0120] S51, based on the attack identification result of the host, determining the attack identification result of the network where the host is located.

[0121] There may be n hosts in the network, and the attack identification result DW of the network can be calculated according to the following formula:

[0122]

[0123] Among them, W i Represents the weight of each host, M(D) i Represents the attack identification result of the i-th host.

[0124] S52: Perform risk assessment on the network according to the attack identification result of the network and the preset risk threshold.

[0125] The risk of the network can be evaluated based on the attack identification results of the network. The higher the DW value, the higher the risk level in the network. The risk of the entire network is divided into three types: safe, generally dangerous, and very dangerous. The risk thresholds t1 and t2 are set as the dividing values ​​of these three states, so as to evaluate the risk of the network more clearly and directly. When DW is less than t1, the network is safe; when DW is between t1 and t2, the network is generally dangerous; when DW is greater than t2, the network is very dangerous. The size of the risk threshold should be determined according to the actual situation of the network being evaluated and the requirements of security management.

[0126] The attack identification method provided by the present application records the attack behavior through the alarm log generated by the IDS (Intrusion Detection System), thereby performing correlation analysis on the massive and isolated alarm data generated by the devices in the network, mining out the frequent item sets therein, and helping to discover multi-state complex network attack patterns with unclear causal relationships, and can better identify the attack behavior. By mining out the target attack sequence, the attack success rate of the attack steps of the target attack sequence and the loss value caused are analyzed, the threat level of the target attack sequence is determined, and the risk situation of the host is determined according to the threat level of each target attack sequence in the host, and then the risk situation of the network is analyzed, thereby improving the efficiency of attack identification.

[0127] In this embodiment, an attack identification device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0128] This embodiment provides an attack identification device, such as Figure 6 As shown, including:

[0129] A sequence acquisition module is used to obtain the attack sequence of the host;

[0130] A target determination module is used to screen the attack sequence based on the attack attribute and determine the target attack sequence corresponding to each attack attribute;

[0131] A first calculation module, used to determine the attack success rate according to the success rate of each attack step of the target attack sequence;

[0132] A second calculation module, used to determine a threat value according to a loss value caused by the target attack sequence to the host;

[0133] A third calculation module, configured to calculate the threat level of the target attack sequence based on the attack success rate and the threat value;

[0134] The attack identification module is used to determine the attack identification result of the host according to the threat level of the target attack sequence.

[0135] In one embodiment, the target determination module includes:

[0136] The attribute acquisition submodule is used to obtain attack attributes;

[0137] A classification submodule, used to classify the attack sequence based on the attack attribute, and determine the attack attribute to which the attack sequence belongs;

[0138] The quantity comparison submodule is used to compare the number of categories of the attack attributes in the attack sequences with the same attack attribute, and determine the attack sequence with the largest number of categories as the target attack sequence corresponding to the attack attribute.

[0139] In one embodiment, the classification submodule is further used to obtain the attack attributes included in the attack sequence and determine the weight of each attack attribute;

[0140] Based on the weight of the attack attribute, the attack attribute to which the attack sequence belongs is determined.

[0141] In one embodiment, the first calculation module includes:

[0142] A success rate determination submodule, used to obtain the success rate of each attack step of the target attack sequence;

[0143] The attack success rate determination submodule is used to determine the attack success rate based on the difference between the product of the success rate of each attack step and a preset threshold.

[0144] In one embodiment, the second calculation module includes:

[0145] A loss value acquisition submodule, used to obtain the loss value of each attack step of the target attack sequence to the host;

[0146] The threat value determination submodule is used to calculate the average of the maximum loss values ​​of the host and determine the threat value based on the average.

[0147] In one implementation, the attack identification result of the host is calculated according to the following formula:

[0148]

[0149] Among them, M(D) i represents the attack identification result of the host, and m1(A1) represents the threat level of the target attack sequence of the i-th item.

[0150] In one embodiment, the device further comprises:

[0151] An identification module, used to determine an attack identification result of a network where the host is located based on the attack identification result of the host;

[0152] The risk assessment module is used to perform risk assessment on the network according to the attack identification result of the network and a preset risk threshold.

[0153] The attack identification device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC circuit, a processor and a memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0154] The further functional description of each of the above modules is the same as that of the above corresponding embodiments and will not be repeated here.

[0155] The embodiment of the present invention also provides an electronic device having the above Figure 7 The attack identification device shown.

[0156] See also Figure 7 , Figure 7 is a schematic diagram of the structure of an electronic device provided by an optional embodiment of the present invention, such as Figure 7As shown, the electronic device may include: at least one processor 601, such as a CPU (Central Processing Unit), at least one communication interface 603, a memory 604, and at least one communication bus 602. The communication bus 602 is used to realize the connection and communication between these components. The communication interface 603 may include a display screen (Display), a keyboard (Keyboard), and the optional communication interface 603 may also include a standard wired interface and a wireless interface. The memory 604 may be a high-speed RAM memory (Random Access Memory) or a non-volatile memory (non-volatile memory), such as at least one disk storage. The memory 604 may optionally be at least one storage device located away from the aforementioned processor 601. The processor 601 may be combined with Figure 6 In the described device, the memory 604 stores an application program, and the processor 601 calls the program code stored in the memory 604 to execute any of the above method steps.

[0157] The communication bus 602 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The communication bus 602 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 7 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0158] Among them, the memory 604 may include a volatile memory (English: volatile memory), such as a random access memory (English: random-access memory, abbreviated: RAM); the memory may also include a non-volatile memory (English: non-volatile memory), such as a flash memory (English: flash memory), a hard disk drive (English: hard disk drive, abbreviated: HDD) or a solid-state drive (English: solid-state drive, abbreviated: SSD); the memory 604 may also include a combination of the above types of memory.

[0159] The processor 601 may be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and a NP.

[0160] The processor 601 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0161] Optionally, the memory 604 is also used to store program instructions. The processor 601 can call the program instructions to implement the attack identification method shown in the embodiment of the present application.

[0162] The embodiment of the present invention further provides a computer-readable storage medium, wherein the computer storage medium stores computer-executable instructions, and the computer-executable instructions can execute the attack identification method in any of the above method embodiments. The storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk (HDD) or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above types of memories.

[0163] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. An attack identification method, characterized in that: The method comprises: Get the attack sequence of the host; The attack sequence is screened based on the attack attribute to determine a target attack sequence corresponding to each attack attribute; the attack sequence is screened based on the attack attribute to determine a target attack sequence corresponding to each attack attribute, including: Get attack attributes; Classifying the attack sequence based on the attack attribute, and determining the attack attribute to which the attack sequence belongs; For attack sequences with the same attack attribute, comparing the number of categories of the attack attribute in the attack sequence, and determining the attack sequence with the largest number of categories as the target attack sequence corresponding to the attack attribute; Determining the attack success rate according to the success rate of each attack step of the target attack sequence; determining the attack success rate according to the success rate of each attack step of the target attack sequence includes: Obtaining the success rate of each attack step of the target attack sequence; Determine the attack success rate based on the difference between the product of the success rate of each attack step and a preset threshold; Determining the threat value according to the loss value caused by the target attack sequence to the host; determining the threat value according to the loss value caused by the target attack sequence to the host includes: Obtaining a loss value of each attack step of the target attack sequence on the host; Calculating an average of the maximum loss values ​​of the host, and determining the threat value based on the average; Calculating the threat level of the target attack sequence based on the attack success rate and the threat value; According to the threat level of the target attack sequence, the attack identification result of the host is determined; the attack identification result of the host is calculated according to the following formula: Among them, M(D) i Indicates the attack identification result of the host, m i (A i ) represents the threat level of the target attack sequence described in the ith item.

2. The method according to claim 1, characterized in that The classifying the attack sequence based on the attack attribute to determine the attack attribute to which the attack sequence belongs includes: Obtaining the attack attributes included in the attack sequence, and determining the weight of each attack attribute; Based on the weight of the attack attribute, the attack attribute to which the attack sequence belongs is determined.

3. The method according to claim 1, characterized in that: The method further comprises: Based on the attack identification result of the host, determining the attack identification result of the network where the host is located; A risk assessment is performed on the network based on the attack identification result of the network and a preset risk threshold.

4. An attack identification device, characterized in that: include: A sequence acquisition module is used to obtain the attack sequence of the host; A target determination module is used to screen the attack sequence based on the attack attribute and determine the target attack sequence corresponding to each attack attribute; The target determination module comprises: The attribute acquisition submodule is used to obtain attack attributes; A classification submodule, used to classify the attack sequence based on the attack attribute, and determine the attack attribute to which the attack sequence belongs; A quantity comparison submodule, for comparing the number of categories of the attack attribute in the attack sequence for the same attack attribute, and determining the attack sequence with the largest number of categories as the target attack sequence corresponding to the attack attribute; The first calculation module is used to determine the attack success rate according to the success rate of each attack step of the target attack sequence; the first calculation module includes: A success rate determination submodule, used to obtain the success rate of each attack step of the target attack sequence; An attack success rate determination submodule, used to determine the attack success rate based on the difference between the product of the success rate of each attack step and a preset threshold; The second calculation module is used to determine the threat value according to the loss value caused by the target attack sequence to the host; the second calculation module includes: A loss value acquisition submodule, used to obtain the loss value of each attack step of the target attack sequence to the host; a threat value determination submodule, configured to calculate a mean of the maximum loss values ​​of the host and determine the threat value based on the mean; A third calculation module, configured to calculate the threat level of the target attack sequence based on the attack success rate and the threat value; The attack identification module is used to determine the attack identification result of the host according to the threat level of the target attack sequence; the attack identification result of the host is calculated according to the following formula: Among them, M(D) i Indicates the attack identification result of the host, m i (A i ) represents the threat level of the target attack sequence described in the ith item.

5. The device according to claim 4, characterized in that The classification submodule is also used for: Obtaining the attack attributes included in the attack sequence, and determining the weight of each attack attribute; Based on the weight of the attack attribute, the attack attribute to which the attack sequence belongs is determined.

6. The device according to claim 4, characterized in that The attack identification result of the host is calculated according to the following formula: Among them, M(D) i Indicates the attack identification result of the host, m i (A i ) represents the threat level of the target attack sequence described in the ith item.

7. The device according to claim 4, characterized in that The device also includes: An identification module, used to determine an attack identification result of a network where the host is located based on the attack identification result of the host; The risk assessment module is used to perform risk assessment on the network according to the attack identification result of the network and a preset risk threshold.

8. An electronic device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the attack identification method according to any one of claims 1 to 3 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the attack identification method according to any one of claims 1 to 3.

Images