Network attack detection method and device, equipment and storage medium

Abstract

The present application discloses a network attack detection method and device, equipment and storage medium, and relates to the field of network security technology. The method obtains the log file of the target network device, matches the target key field set including the target network address and network protocol type of each log with the set key field set contained in the preset detection strategy, and associates the two if the match is successful. According to the traffic statistical period corresponding to the preset detection strategy after association, the total traffic of the logs associated with it in the current statistical period is determined. When the total traffic is greater than the traffic threshold of the preset detection strategy, it is determined that the target network device is subjected to a network attack of the corresponding type of the preset detection strategy. The present application combines the network address and the network protocol type as the attack detection dimension, and more accurately and timely detects the defects of Dos / DDos traffic attacks using a specific network protocol as the attack subject, thereby improving network security.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and specifically to a network attack detection method and apparatus, equipment and storage medium. Background Art

[0002] With the rapid development of the Internet, the network has brought convenience, but also brought many security issues. There are more and more forms of network attacks, and their frequency and harm are getting higher and higher. Among them, Denial of Service (DoS) attacks and Distributed Denial of Service (DDoS) attacks that consume network bandwidth as attack means are the most common network attack methods. As a valuable network resource, network bandwidth can directly affect the quality of access to the network.

[0003] Therefore, in order to ensure network security and normal network access, accurate and timely network attack detection is an urgent problem to be solved. Summary of the invention

[0004] The embodiments of the present application provide a network attack detection method and apparatus, a device and a storage medium to improve the accuracy and timeliness of network attacks.

[0005] On the one hand, a network attack detection method is provided, the method comprising:

[0006] Acquire a log file of a target network device to be detected, wherein the log file includes data flow information received by the target network device;

[0007] For each preset detection strategy in the preset detection strategy set, perform the following operations respectively:

[0008] For a preset detection strategy, if the target key field set contained in each log in the log file successfully matches the set key field set contained in the preset detection strategy, the log is associated with the corresponding preset detection strategy; wherein the target key field set includes the target network address and the network protocol type;

[0009] Determine, according to the traffic statistics period corresponding to the preset detection strategy, the total traffic of the logs associated with the preset detection strategy in the current statistics period;

[0010] When the traffic sum is greater than a traffic threshold of the preset detection strategy, it is determined that the target network device is subjected to a network attack of a type corresponding to the preset detection strategy.

[0011] On the one hand, a network attack detection device is provided, comprising:

[0012] An acquisition unit, configured to acquire a log file of a target network device to be detected, wherein the log file includes data flow information received by the target network device;

[0013] The association unit is used to perform the following operations for each preset detection strategy in the preset detection strategy set: for a preset detection strategy, if the target key field set contained in each log in the log file successfully matches the set key field set contained in the preset detection strategy, associate the log with the corresponding preset detection strategy; wherein the target key field set includes the target network address and the network protocol type;

[0014] A determination unit, configured to determine, according to a traffic statistics period corresponding to the one preset detection strategy, a traffic sum of logs associated with the one preset detection strategy in a current statistics period;

[0015] An alarm unit is used to determine that the target network device is subjected to a network attack of a type corresponding to the preset detection strategy when the total traffic is greater than the traffic threshold of the preset detection strategy.

[0016] Optionally, the acquisition unit is specifically used to:

[0017] Receiving a policy configuration request, wherein the policy configuration request includes at least one preset detection policy;

[0018] Based on the at least one preset detection strategy, the preset detection strategy set is updated.

[0019] Optionally, the acquisition unit is specifically used to:

[0020] Based on the at least one preset detection strategy, updating the preset detection strategy set includes:

[0021] Synchronizing the at least one preset detection strategy to the strategy message queue;

[0022] Based on each preset detection strategy included in the strategy message queue, the preset detection strategy set is updated.

[0023] Optionally, the association unit is specifically used to:

[0024] For a log, matching the target key field set contained in the log with the set key field set;

[0025] When the target key field set is the same as the set key field set, determining that the preset detection strategy matches the log successfully;

[0026] The log is associated with the preset detection strategy.

[0027] Optionally, the acquisition unit is specifically used to:

[0028] According to a preset log format rule, the log file is formatted to obtain a converted log file;

[0029] The target key field sets corresponding to the respective logs are extracted from the respective logs included in the converted log file.

[0030] Then the association unit is specifically used for:

[0031] For each log, the policy identification field of the preset detection policy that successfully matches it is added to the corresponding target key field set.

[0032] Optionally, the acquisition unit is specifically used to:

[0033] Storing each of the logs in the first message queue in sequence;

[0034] Logs are read from the first message queue in sequence, and a target key field set extracted from the read logs is stored in the second message queue.

[0035] Then the association unit is specifically used for:

[0036] The target key field set is read from the second message queue in sequence, and the corresponding policy identification field is added to the read target key field set.

[0037] Optionally, the determining unit is specifically configured to:

[0038] Obtaining, from the second log message queue, a flow value field corresponding to each log in the current statistical period;

[0039] The total flow rate in the current statistical period is determined according to the obtained multiple flow value fields.

[0040] Optionally, the alarm unit is specifically used to:

[0041] Determining the type of network attack to which the target network device is subjected according to the network protocol type of the preset detection strategy;

[0042] According to the network attack type, a corresponding attack warning is generated, and the attack warning is sent to an associated terminal device.

[0043] On the one hand, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of any one of the above methods when executing the computer program.

[0044] In one aspect, a computer storage medium is provided, on which computer program instructions are stored, and when the computer program instructions are executed by a processor, the steps of any of the above methods are implemented.

[0045] In one aspect, a computer program product or a computer program is provided, the computer program product or the computer program comprising computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the steps of any of the above methods.

[0046] The beneficial effects of the embodiments of the present application are as follows:

[0047] In the embodiment of the present application, the data flow information received by the target network device is determined by obtaining the log file of the target network device, and then for each preset detection strategy in the preset detection strategy set, the target key field set including the target network address and the network protocol type of each log in the log file is matched with the set key field set contained in a preset detection strategy, and the log is associated with the corresponding preset detection strategy if the match is successful. According to the traffic statistics period corresponding to the preset detection strategy after association, the traffic sum of the logs associated with it in the current statistical period is determined, and when the traffic sum is greater than the traffic threshold of the preset detection strategy, it is determined that the target network device is subjected to a network attack of the corresponding type of the preset detection strategy. The present application combines the target network address and the network protocol type as the attack detection dimension, and more accurately and timely detects the defects of using a specific network protocol as the attack subject to carry out Dos / DDos traffic attacks, thereby improving network security.

[0048] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0050] Figure 1 A schematic diagram of an application scenario provided for an embodiment of the present application;

[0051] Figure 2 A system architecture diagram of a network attack detection device provided in an embodiment of the present application;

[0052] Figure 3 A flowchart of a network attack detection method provided in an embodiment of the present application;

[0053] Figure 4 An interactive diagram of the log collection process provided in an embodiment of the present application;

[0054] Figure 5 An interactive schematic diagram of the preset detection strategy configuration process provided in an embodiment of the present application;

[0055] Figure 6 A schematic diagram of the interaction between the log and the preset detection strategy matching and association process provided in the embodiment of the present application;

[0056] Figure 7 A schematic diagram of the overall process of network attack detection provided by an embodiment of the present application;

[0057] Figure 8 A schematic diagram of the structure of a network attack detection device provided in an embodiment of the present application;

[0058] Fig. 9 A schematic diagram of the composition structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other arbitrarily. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0060] To facilitate understanding of the technical solutions provided in the embodiments of the present application, some key terms used in the embodiments of the present application are explained here:

[0061] Dos / DDos traffic attack: A network attack method that uses a large number of legitimate distributed servers to send requests to the target, thereby preventing normal legitimate users from obtaining services. It mainly uses a large number of attack packets with forged source addresses to continuously send to the network service port, causing the half-open connection queue in the target server to be full, maliciously occupying the bandwidth and host resources of the target server, thereby causing the network or system to be overloaded and paralyzed and stop providing normal network services. DDoS attacks can mutate like viruses, including common CC attacks, TCP / UDP / DNS / SYN / ICMP / NTP / SSDP / ACK / HTTP Flood and its variants Land / Teardrop / Smurf / Ping of Death, etc.

[0062] The following is a brief introduction to the design concept of the embodiment of the present application:

[0063] In recent years, the frequency of DDoS attacks has continued to rise worldwide. The increasing severity of DDoS attacks is closely related to the attack principle of occupying resources by sending requests through a large number of legitimate distributed servers. The common method for detecting DDoS attacks is to compare and analyze the current traffic value of the target network address with the historical traffic value. It can only detect a small part of the traffic-type DDoS attack scenarios. In addition, this method only uses the network address as the analysis dimension of the traffic log, ignoring the differences in network protocols. The attacker can determine the specific network protocol used by the target by analyzing the business scenario of the attacked target, and use different attack methods to avoid network attack detection using the network address as the detection dimension of the traffic log, resulting in a decrease in the accuracy and timeliness of network attack detection. For example, common DDos attack methods that cannot be accurately detected include: service consumption DDos attack methods that do not require too much traffic to attack, mainly targeting the characteristics of different business services such as Web CC, data service retrieval, file service download, etc. This type of attack is not to congest the traffic channel or protocol processing channel, but to make the server always busy with high-consumption services and unable to respond to normal services; reflection attack, this type of attack method generally requests the response traffic much larger than the size of the request itself, and the attacker can use the characteristics of traffic amplification to create a large-scale traffic source with a smaller traffic bandwidth to attack the target; hybrid attack, combining the characteristics of multiple attack methods and detecting and selecting the best attack method during the attack process. Therefore, the existing DDOS attack detection method has the defect of not being able to accurately and timely detect DDos attacks, and has become increasingly unable to meet today's network attack detection needs.

[0064] In view of the above problems, the embodiment of the present application provides a network attack detection method, which determines the data flow information received by the target network device by obtaining the log file of the target network device, and then matches the target key field set including the target network address and the network protocol type of each log in the log file with the set key field set contained in a preset detection strategy for each preset detection strategy set, and associates the log with the corresponding preset detection strategy if the match is successful. According to the traffic statistical period corresponding to the preset detection strategy after association, the traffic sum of the logs associated with it in the current statistical period is determined, and when the traffic sum is greater than the traffic threshold of the preset detection strategy, it is determined that the target network device is subjected to a network attack of the corresponding type of the preset detection strategy. The present application combines the target network address and the network protocol type as the attack detection dimension, and more accurately and timely detects the defects of using a specific network protocol as the attack subject to carry out Dos / DDos traffic attacks, thereby improving network security.

[0065] Compared with the commonly used DDos attack detection method that cannot dynamically modify detection parameters and needs to count historical traffic as the basis for detection, the embodiment of the present application can also update the preset detection strategy set through the preset detection strategy included in the received policy configuration request, complete the dynamic adjustment of the detection strategy, and configure the corresponding detection strategy for the business characteristics of different network devices and the changed business characteristics of the same network device, thereby improving the accuracy of network attack detection. Moreover, the embodiment of the present application is based on the detection strategy after personalized configuration for the network device, and its traffic log file is analyzed in real time, without the need for historical traffic as the basis for detection, which solves the limitations of the existing technology.

[0066] The following briefly introduces the application scenarios to which the technical solutions of the embodiments of the present application can be applied. It should be noted that the application scenarios introduced below are only used to illustrate the embodiments of the present application and are not limited. In the specific implementation process, the technical solutions provided by the embodiments of the present application can be flexibly applied according to actual needs.

[0067] The technical solution provided in the embodiment of the present application can be applied to network attack detection scenarios of various network devices, such as Figure 1 As shown, it is a schematic diagram of an application scenario provided by an embodiment of the present application. In this scenario, a network attack detection device 100 and a device to be detected 110 may be included.

[0068] In a possible implementation, the network attack detection device 100 can be a computer device with a certain processing capability, such as a mobile phone, a personal computer (PC), a server, etc., which can be configured to execute any of the method devices provided in the embodiment of the present application, and no further examples are given here. For ease of description, the following takes the execution subject of the method as an example of a server that can execute the method to introduce the implementation of the method. It can be understood that the execution subject of the method as a server is only an exemplary description and should not be understood as a limitation on the method. The server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and basic cloud computing services such as big data and artificial intelligence platforms, but is not limited to this.

[0069] The device to be detected 110 is a computer device to be detected by the network attack detection method provided in the embodiment of the present application, such as a server, a router, a gateway device, etc. The server can be an independent physical server, or a server cluster or a distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, as well as big data and artificial intelligence platforms, but is not limited to these.

[0070] The network attack detection device 100 can obtain traffic log data from the device to be detected 110, and based on the network attack detection method provided in the embodiment of the present application, implement a network attack detection function for the device to be detected 110.

[0071] The network attack detection device 100 and the device to be detected 110 can be connected through a network 120. The network 120 can be a wired network or a wireless network. For example, the wireless network can be a mobile cellular network, such as a fourth generation mobile communication (4generation, 4G) network, a fifth generation mobile communication (5generation, 5G) network or a new wireless (New Radio, NR) network, or it can be a wireless fidelity (Wireless-Fidelity, WIFI) network. Of course, it can also be other possible networks, and the embodiments of the present invention are not limited to this.

[0072] It should be noted that Figure 1 The figure is only an example. In fact, the number of network attack detection devices and devices to be detected is not limited, and is not specifically limited in the embodiments of the present application.

[0073] like Figure 2 , which is a system architecture diagram of a network attack detection device provided in an embodiment of the present application, wherein the network attack detection device specifically includes the following modules:

[0074] (1) A log collection module is used to obtain and parse log files from the device to be detected, convert the format of the log files according to the preset log format rules, and then extract the target key field set corresponding to each log from the converted log files and send it to the log processing module.

[0075] (1) A policy configuration module is used to receive a policy configuration request, parse and obtain the preset detection policy information contained in the request, and send it to the policy synchronization module.

[0076] (2) A policy synchronization module, which is used to configure and update a preset detection policy set according to the preset detection policy information received from the policy configuration module and synchronously load it into the cache.

[0077] (3) A log processing module is used to receive the target key field set corresponding to each log from the log collection module and read the latest preset detection strategy set from the cache. The target key field set contained in each log is matched with the set key field set contained in each preset detection strategy, and the two that are successfully matched are associated, and the associated preset detection strategy and log file are sent to the log analysis module.

[0078] (4) A log analysis module, which is used to receive the associated preset detection strategy and log file from the log processing module, determine the total traffic volume of the logs associated with the preset detection strategy in the current statistical period according to the traffic statistical period corresponding to the preset detection strategy, and send it to the attack detection module.

[0079] (5) An attack detection module is used to receive the total traffic statistics from the log analysis module, and determine whether the device to be detected is subjected to a network attack of a type corresponding to the preset detection strategy by judging whether the total traffic is greater than a traffic threshold of the corresponding preset detection strategy.

[0080] It should be noted that Figure 2 The components and structures of the functional module architecture diagram shown are merely exemplary and non-restrictive. In actual scenarios, other components and structures may be provided as needed.

[0081] The following describes the network attack detection method provided by the exemplary embodiment of the present application in combination with the application scenarios described above and with reference to the accompanying drawings. It should be noted that the above application scenarios are only shown to facilitate understanding of the spirit and principles of the present application, and the implementation methods of the present application are not limited in this regard.

[0082] See also Figure 3As shown, it is a flow chart of the network attack detection method provided in the embodiment of the present application. Here, a network attack detection device is used as an example for illustration. The specific implementation process of the method is as follows:

[0083] Step 301: Obtain the log file of the target network device to be detected.

[0084] In an embodiment of the present application, the log file contains network data flow information received by the device to be detected in real time. The network attack detection device obtains and parses the log file of the device to be detected through the log collection module, and then sends it to the log processing module for subsequent processing.

[0085] Specifically, taking the device to be detected as a router as an example, after the router turns on the netflow setting, the generated netflow traffic log data will be pushed to the relevant port. The network attack detection device can read the netflow traffic log data, that is, the log file, generated in real time by the device to be detected from the port.

[0086] In a possible implementation, the original log file is generated by the device to be detected, and the formats of the original log files generated by different devices to be detected may be different, such as netflow data that records each TCP / IP transaction information of the device to be detected, tcpdump data that provides complete network traffic records, etc. Therefore, after the log collection module of the network attack detection device obtains the original log file of the device to be detected, it can convert the original log files of different formats into a unified format according to the preset log format rules, and then extract the required target key field set from each converted log, and then send it to the log processing module through the message queue.

[0087] Specifically, each converted log file may contain field information such as source network address, target network address, network protocol type, traffic value, timestamp, etc., from which the two field information of target network address and target network protocol type are extracted to form the target key field set required by the log processing module.

[0088] Among them, the source network address represents the IP address of the source network device that sends the data flow information to the device to be detected, which can be used by the attack detection module to generate attack warning information; the flow value represents the flow size of the data flow information; the timestamp represents the sending time corresponding to the data flow information; the target network address is the IP address of the device to be detected.

[0089] The network protocol type characterizes the type of network communication protocol used by the device to be tested. The device to be tested can choose to use a network communication protocol that is compatible with the business characteristics according to different usage scenarios and business types. For example, the device to be tested that mainly provides high-consumption services such as data retrieval, file transfer services, web browsing, and remote login usually uses the TCP / IP protocol to provide reliable end-to-end communication to ensure that the data received by the receiver is consistent with the data sent by the device to be tested, and that the data is not lost or error-free. The device to be tested that uses the UDP protocol has lower requirements for data reliability, but higher requirements for data transmission efficiency, and is mainly based on providing real-time services, such as transmitting audio and video services. Since the device to be tested needs to provide a user access interface through the network communication protocol to provide business services to users, Dos / DDos traffic attacks can use the characteristics of the network communication protocol to adopt corresponding more accurate and difficult-to-detect attack methods to avoid common network attack detection based on IP as the detection dimension. For example, the handshake defects of the TCP / IP protocol are used to consume the link resources of the server, and the stateless mechanism of the UDP protocol is used to forge a large number of UDP data packets to block the communication channel.

[0090] In a possible implementation, a message queue can be used as a container for storing data information in the process of transmitting data in the network attack detection device of the embodiment of the present application, and the message queue provides routing and ensures the delivery of messages. Among them, the message queue can make the data stored therein process more quickly through a unique cache layer, and the cache layer also helps to control and improve the speed of data flow through the system. In addition, the message queue can also store the data stream persistently until it is processed, avoiding the risk of data loss. While ensuring the consistency of data reception and processing order, the message queue also provides data monitoring and asynchronous processing mechanisms. The message queue manager acts as an intermediary to relay data from its source to the recipient. When the recipient is unavailable, the message queue will retain the data until the data can be successfully transmitted, allowing the data stored in the message queue to be processed only when it is needed.

[0091] Specifically, taking the log file as an example, refer to Figure 4 In the interactive diagram of the log collection process shown in the figure, the log collection module can first store the original log file obtained from the port of the device to be detected in the first message queue. When it is necessary to perform subsequent format conversion and extract key fields on the original log file, the logs are read from the first message queue in sequence, and the required field information is extracted from each log information read to generate the corresponding target key field set, which is stored in the second message queue, so that the log processing module can extract the target key field set from the second message queue at any time when it needs it.

[0092] Step 302: For each preset detection strategy, if the target key field set contained in each log in the log file successfully matches the set key field set contained in the preset detection strategy, the log is associated with the corresponding preset detection strategy.

[0093] In an embodiment of the present application, multiple preset detection strategies are set in a preset detection strategy set for detecting log files. Since the processing process for each preset detection strategy is similar, one preset detection strategy is taken as an example for introduction here.

[0094] Specifically, the log processing module receives the target key field set corresponding to each log, including the target network address and network protocol type, from the log collection module, and reads the preset detection strategy set at the current moment from the cache. Then, the set key field set of each preset detection strategy is matched one by one with the target key field set contained in each log, and the two that are successfully matched are associated, and the associated preset detection strategy set and log file are sent to the log analysis module for subsequent processing.

[0095] In a possible implementation, before the log processing module reads the preset detection policy set, the policy configuration module may obtain the preset detection policy information from the received policy configuration request, and then send it to the policy synchronization module, which updates the preset detection policy set and synchronously loads it into the cache.

[0096] Specifically, the relevant operation and maintenance personnel can manually trigger the policy configuration process by clicking the policy configuration button on the display interface of the network attack detection device, and manually type or select the setting key fields and other relevant information of the detection policy according to the preset policy configuration rules. The policy configuration module generates the corresponding preset detection policy and sends it to the policy synchronization module for synchronous loading.

[0097] In a possible implementation, the preset detection strategy may include the following field information:

[0098] (1) a strategy identifier, which is an identifier uniquely corresponding to each preset detection strategy and is used to indicate the corresponding preset detection strategy information;

[0099] (2) Target network address, used to indicate the IP address of the device to be detected;

[0100] (3) a traffic statistics period, which is used to count the total traffic of the device to be detected using the preset detection strategy within the time period;

[0101] (4) Traffic threshold, which is used to compare with the total traffic volume in the traffic statistics period and determine whether the device to be detected is under network attack based on the comparison result;

[0102] (5) Network protocol type, which is used to indicate the network communication protocol type corresponding to the log file of the device to be detected, including TCP protocol, UDP protocol, ICMP protocol, IGMP protocol, etc.

[0103] The attack detection dimension of the embodiment of the present application is a combination of the target network address and the network protocol type. Therefore, the target network address and the network protocol type are used as the key fields to be set. Only when the above two key fields are all met, the preset detection strategy is determined to be adopted. Specifically, the network protocol type can also be set as a non-mandatory field. When the detection strategy does not include the network protocol type, only the target network address is used as the key field to be set, that is, the detection strategy uses the IP address as a single detection dimension.

[0104] In one possible implementation, reference Figure 5 As shown, after the multiple preset detection policies generated by the policy configuration module are synchronized and stored in the policy message queue, the policy synchronization module completes the synchronization and loading of the preset detection policies through the real-time pull mechanism of the message queue, updates the preset detection policies included in the current policy message queue to the preset detection policy set, and sends it to the cache. Therefore, the relevant operation and maintenance personnel can dynamically adjust the preset detection policy set according to the latest business characteristics of the device to be detected at the current moment, including adding or deleting preset detection policies and dynamically adjusting the flow statistics cycle, flow threshold and other field information of the existing preset detection policies in the policy message queue.

[0105] In a possible implementation, the log processing module can match the target key field set contained in each log with the set key field set contained in each preset detection strategy in the cache by traversing, and when the target key field set is the same as the set key field set, it is determined that the preset detection strategy matches the log successfully. Taking the detection dimension combining the target network address and the network protocol type as an example, when the preset detection strategy and the target network protocol and the network protocol type contained in the log are the same, it is determined that the two match successfully.

[0106] In a possible implementation, after the log processing module determines the matching preset detection policy and log, it can associate the two by adding the policy identification field of the preset detection policy to the target key field set of the matching successful log. Figure 6 The log processing module reads each log data from the second message queue in turn, traverses and matches each log data with each preset detection strategy in the preset detection strategy set in the cache, and fills the policy identification field of the corresponding preset detection strategy in the target key field set of the successfully matched log, obtains the associated log data and updates the second message queue.

[0107] Step 303: According to the traffic statistics period corresponding to the preset detection policy, determine the total traffic volume of the logs associated with the preset detection policy in the current statistics period.

[0108] In an embodiment of the present application, the log analysis module receives the associated preset detection strategy set and log file from the log processing module, and determines the total traffic of the logs associated with it in the current statistical period based on the corresponding traffic statistical period in the preset detection strategy and sends it to the attack detection module.

[0109] In one possible implementation, the log analysis module obtains the traffic value fields corresponding to each of the logs associated with it in the current statistical period from the updated second message queue according to the traffic statistical period corresponding to the preset detection strategy, and then determines the total traffic in the current statistical period based on the obtained multiple traffic value fields.

[0110] Specifically, the log analysis module can summarize and calculate the traffic values ​​within the current statistical period through stream computing. Stream computing is an ongoing real-time analysis process of dynamic data, which captures useful information in the ever-changing data stream information and sends the results to the next computing node. Different from traditional traffic analysis and processing, it is necessary to pre-collect and store static historical traffic data for a certain period of time before it can be summarized and processed through queries when calculations are required. The final result can only reflect the historical traffic conditions in the past. This application uses stream computing to realize real-time traffic data analysis of the equipment to be detected, and statistical results can be pushed in real time without issuing query requests.

[0111] Step 304: Determine whether the total traffic volume is greater than the traffic threshold of the preset detection strategy. If so, jump to step 305; if not, jump to step 302.

[0112] Step 305: Determine whether the target network device is subject to a network attack of a type corresponding to the preset detection strategy.

[0113] In an embodiment of the present application, the attack detection module receives the total traffic counted by the log analysis module, and determines whether the device to be detected is subjected to a network attack of the type corresponding to the preset detection strategy by judging whether the total traffic is greater than the traffic threshold of the corresponding preset detection strategy.

[0114] In a possible implementation, the attack detection module may determine the type of network attack suffered by the device to be detected according to the network protocol type of the preset detection strategy, and then generate a corresponding attack warning according to the network attack type and send it to the associated device to be detected.

[0115] Specifically, resource consumption attacks are relatively common DDoS attacks, mainly including: Syn Flood, UDP Flood, etc. This type of attack consumes normal bandwidth and the ability of the protocol stack to process resources through a large number of requests, thereby achieving the purpose of the server failing to work normally. Among them, the SYN Flood attack uses a half-open TCP protocol connection to attack a target IP address through multiple forged source IP addresses to occupy the resources of the device to be detected, so that legitimate users are excluded and cannot establish a normal TCP connection. The network protocol type corresponding to this attack method is the TCP protocol. Therefore, when the network protocol type indicated by the preset detection strategy is the TCP protocol, the attack detection module can determine that the device to be detected is attacked by the SYN Flood. When the network protocol type indicated by the preset detection strategy is the UDP protocol, it can be determined that the device to be detected is attacked by the UDP Flood.

[0116] refer to Figure 7 The figure shows the overall process of network attack detection provided by the embodiment of the present application. The relevant operation and maintenance personnel trigger the policy configuration process according to the business situation of the device to be detected. The policy configuration module generates corresponding preset detection policy data according to their request. For example, the policy identifier is N, the target network address is xxx.xxx.xx, the traffic statistics period is D, the traffic threshold is R, and the network protocol type is the preset detection policy N of the TCP protocol.

[0117] The policy synchronization module then uses the message queue mechanism to load the preset detection policy data into the preset detection policy set in the cache, and realizes functions such as adding, modifying, and deleting detection policies. The log collection module obtains the log file data of the network device in real time, and after completing the format conversion, extracting key fields and other processing, each log data of the network device is stored in the message queue. The log processing module then reads each log data from the message queue in turn, and traverses and matches each log data with each preset detection policy in the preset detection policy set in the cache. Taking the preset detection policy N as an example, when the target network address field of a log data is also xxx.xxx.xx and the network protocol type field is also TCP protocol, it means that the log M successfully matches the preset detection policy N, and the log processing module fills the policy identifier N of the preset detection policy N into the target key field set of the log M, completes the association between the two and updates the log data in the message queue.

[0118] The log analysis module determines the total traffic S of the log M within the period D through flow calculation according to the traffic statistics period D corresponding to the preset detection strategy N, and sends it to the attack detection module, which determines the relationship between the total traffic S and the traffic threshold R. If S≥R, it is determined that the device to be detected is under a network attack corresponding to the preset detection strategy N, and a corresponding attack alarm is generated. If S<R, it is determined that the device to be detected is not under a network attack, and the detection process ends.

[0119] See also Figure 8 Based on the same inventive concept, the embodiment of the present application further provides a network attack detection device 80, which includes:

[0120] An acquisition unit 801 is used to acquire a log file of a target network device to be detected, where the log file includes data flow information received by the target network device;

[0121] The association unit 802 is used to perform the following operations for each preset detection strategy in the preset detection strategy set: for a preset detection strategy, if the target key field set contained in each log in the log file successfully matches the set key field set contained in a preset detection strategy, associate the log with the corresponding preset detection strategy; wherein the target key field set includes the target network address and the network protocol type;

[0122] The determination unit 803 is used to determine the total flow of logs associated with a preset detection strategy in a current statistical period according to the flow statistical period corresponding to the preset detection strategy;

[0123] The alarm unit 804 is used to determine that the target network device is subjected to a network attack of a type corresponding to a preset detection policy when the total traffic is greater than a traffic threshold of a preset detection policy.

[0124] Optionally, the acquiring unit 801 is specifically configured to:

[0125] Receiving a policy configuration request, the policy configuration request including at least one preset detection policy;

[0126] Based on at least one preset detection strategy, a preset detection strategy set is updated.

[0127] Optionally, the acquiring unit 801 is specifically configured to:

[0128] Based on at least one preset detection strategy, updating the preset detection strategy set includes:

[0129] Synchronize at least one preset detection strategy to the strategy message queue;

[0130] Based on each preset detection strategy included in the strategy message queue, the preset detection strategy set is updated.

[0131] Optionally, the association unit 802 is specifically configured to:

[0132] For a log, match the target key field set contained in the log with the set key field set;

[0133] When the target key field set is the same as the set key field set, it is determined that the preset detection strategy matches the log successfully;

[0134] Associate logs with preset detection policies.

[0135] Optionally, the acquiring unit 801 is specifically configured to:

[0136] According to the preset log format rules, the log file is formatted and the converted log file is obtained;

[0137] A target key field set corresponding to each log is extracted from each log included in the converted log file.

[0138] Then the association unit 802 is specifically used for:

[0139] For each log, the policy identification field of the preset detection policy that successfully matches it is added to the corresponding target key field set.

[0140] Optionally, the acquiring unit 801 is specifically configured to:

[0141] Store each log in the first message queue in sequence;

[0142] Logs are read from the first message queue in sequence, and a target key field set extracted from the read logs is stored in the second message queue.

[0143] Then the association unit 802 is specifically used for:

[0144] The target key field set is read from the second message queue in sequence, and the corresponding policy identification field is added to the read target key field set.

[0145] Optionally, the determining unit 803 is specifically configured to:

[0146] Obtain the flow value field corresponding to each log in the current statistical period from the second log message queue;

[0147] The total flow in the current statistical period is determined based on the obtained multiple flow value fields.

[0148] Optionally, the alarm unit 804 is specifically used for:

[0149] Determine the type of network attack suffered by the target network device according to the network protocol type of a preset detection strategy;

[0150] According to the type of network attack, a corresponding attack warning is generated and sent to the associated network device.

[0151] Through the above-mentioned device, the data flow information received by the target network device is determined by obtaining the log file of the target network device, and then for each preset detection strategy in the preset detection strategy set, the target key field set including the target network address and the network protocol type of each log in the log file is matched with the set key field set contained in a preset detection strategy, and the log is associated with the corresponding preset detection strategy if the match is successful. According to the traffic statistical period corresponding to the preset detection strategy after association, the traffic sum of the logs associated with it in the current statistical period is determined, and when the traffic sum is greater than the traffic threshold of the preset detection strategy, it is determined that the target network device is subjected to a network attack of the corresponding type of the preset detection strategy. The present application combines the target network address and the network protocol type as the attack detection dimension, and more accurately and timely detects the defects of Dos / DDos traffic attacks using a specific network protocol as the attack subject, thereby improving network security.

[0152] See also Fig. 9 Based on the same technical concept, the embodiment of the present application also provides a computer device. In one embodiment, the computer device may include a memory 901, a communication module 903 and one or more processors 902 as shown in the figure.

[0153] The memory 901 is used to store computer programs executed by the processor 902. The memory 901 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system; and the data storage area may store various operation instruction sets.

[0154] The memory 901 may be a volatile memory, such as a random-access memory (RAM); the memory 901 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); or the memory 901 may be any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 901 may be a combination of the above memories.

[0155] The processor 902 may include one or more central processing units (CPU) or a digital processing unit, etc. The processor 902 is used to implement the above network attack detection method when calling the computer program stored in the memory 901.

[0156] The communication module 903 is used to communicate with a message processing device or other network devices.

[0157] The specific connection medium between the memory 901, the communication module 903 and the processor 902 is not limited in the embodiment of the present application. Fig. 9 In the embodiment, the memory 901 and the processor 902 are connected via a bus 904. The bus 904 is connected to the processor 902 via a bus 904. Fig. 9 The connections between the other components are only for illustration and are not intended to be limiting. The bus 904 can be divided into an address bus, a data bus, a control bus, etc. For ease of description, Fig. 9 The diagram shows that only one thick line is used, but this does not mean that there is only one bus or one type of bus.

[0158] The memory 901 stores a computer storage medium, which stores computer executable instructions, and the computer executable instructions are used to implement the network attack detection method of the embodiment of the present application. The processor 902 is used to execute the network attack detection method of each of the above embodiments.

[0159] Based on the same inventive concept, an embodiment of the present application also provides a storage medium on which a computer program is stored. When the computer program instructions are executed on a computer, the computer processor executes the steps of the network attack detection method according to various embodiments of the present application described above in this specification.

[0160] In some possible implementations, various aspects of the network attack detection method provided by the present application may also be implemented in the form of a program product, which includes program code. When the program product is run on a computer device, the program code is used to enable the computer device to execute the steps of the network attack detection method according to various exemplary embodiments of the present application described above in this specification. For example, the computer device may execute the steps of each embodiment.

[0161] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0162] The program product of the embodiment of the present application may adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a computing device. However, the program product of the present application is not limited thereto. In the present application, the readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with a command execution system, device or device.

[0163] The readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein the readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with a command execution system, apparatus, or device.

[0164] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0165] Program code for performing the operations of the present application may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" language or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user equipment, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device via any type of network including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0166] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0167] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0168] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0169] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0170] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A network attack detection method, characterized in that: The method comprises: Acquire a log file of a target network device to be detected, wherein the log file includes data flow information received by the target network device; For each preset detection strategy in the preset detection strategy set, perform the following operations respectively: For a preset detection strategy, if the target key field set contained in each log in the log file successfully matches the set key field set contained in the preset detection strategy, the log is associated with the preset detection strategy; wherein the target key field set includes the target network address and the network protocol type; Determine, according to the traffic statistics period corresponding to the preset detection strategy, the total traffic of the logs associated with the preset detection strategy in the current statistics period; When the traffic sum is greater than a traffic threshold of the preset detection strategy, it is determined that the target network device is subjected to a network attack of a type corresponding to the preset detection strategy.

2. The method according to claim 1, characterized in that Before performing operations on each preset detection strategy in the preset detection strategy set, the method further includes: Receiving a policy configuration request, wherein the policy configuration request includes at least one preset detection policy; Based on the at least one preset detection strategy, the preset detection strategy set is updated.

3. The method according to claim 2, characterized in that The preset detection strategy set is stored via a strategy message queue; Based on the at least one preset detection strategy, updating the preset detection strategy set includes: Synchronizing the at least one preset detection strategy to the strategy message queue; Based on each preset detection strategy included in the strategy message queue, the preset detection strategy set is updated.

4. The method according to claim 1, characterized in that For a preset detection strategy, if the target key field set contained in each log in the log file successfully matches the set key field set contained in the preset detection strategy, associating the log with the preset detection strategy includes: For each log in the log file, perform the following operations respectively: For a log, matching the target key field set contained in the log with the set key field set; When the target key field set is the same as the set key field set, determining that the preset detection strategy matches the log successfully; The log is associated with the one preset detection strategy.

5. The method according to claim 1 or 4, characterized in that After obtaining the log file of the target network device to be detected, the method further includes: According to a preset log format rule, the log file is formatted to obtain a converted log file; Extracting the target key field set corresponding to each log item from each log item included in the converted log file; Then associating the log with the preset detection strategy includes: For each log, the policy identification field of the preset detection policy that successfully matches it is added to the corresponding target key field set.

6. The method according to claim 5, characterized in that After obtaining the log file of the target network device to be detected, the method further includes: Storing each of the logs in the first message queue in sequence; Then, from each log included in the converted log file, the target key field set corresponding to each log is extracted, including: Reading logs from the first message queue in sequence, and storing a target key field set extracted from the read logs in a second message queue; Then, for each log, the policy identification field of the preset detection policy that successfully matches it is added to the corresponding target key field set, including: The target key field set is read from the second message queue in sequence, and the corresponding policy identification field is added to the read target key field set.

7. The method according to claim 6, characterized in that The determining, according to the traffic statistical period corresponding to the preset detection strategy, the traffic sum of the logs associated with the preset detection strategy in the current statistical period includes: Obtaining, from the second message queue, the flow value field corresponding to each log in the current statistical period; The total flow rate in the current statistical period is determined according to the obtained multiple flow value fields.

8. The method according to any one of claims 1 to 4 or 6 to 7, characterized in that: When the traffic sum is greater than the traffic threshold of the preset detection strategy, determining that the target network device is subjected to a network attack of a type corresponding to the preset detection strategy includes: Determining the type of network attack to which the target network device is subjected according to the network protocol type of the preset detection strategy; According to the network attack type, a corresponding attack warning is generated, and the attack warning is sent to an associated terminal device.

9. A network attack detection device, characterized in that: include: An acquisition unit, configured to acquire a log file of a target network device to be detected, wherein the log file includes data flow information received by the target network device; The association unit is used to perform the following operations for each preset detection strategy in the preset detection strategy set: for a preset detection strategy, if the target key field set contained in each log in the log file successfully matches the set key field set contained in the preset detection strategy, associate the log with the preset detection strategy; wherein the target key field set includes a target network address and a network protocol type; A determination unit, configured to determine, according to a traffic statistics period corresponding to the one preset detection strategy, a traffic sum of logs associated with the one preset detection strategy in a current statistics period; An alarm unit is used to determine that the target network device is subjected to a network attack of a type corresponding to the preset detection strategy when the total traffic is greater than the traffic threshold of the preset detection strategy.

10. A computer device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the method according to any one of claims 1 to 8 when executing the computer program.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images