Attack detection method, device and related equipment

Abstract

The present disclosure provides an attack detection method, which relates to the field of communication technology. The method includes: obtaining flow data to be tested; performing differential and prediction processing on the flow data to be tested, and obtaining an abnormal time window according to the predicted data; extracting flow data within the abnormal time window, and counting the flow frequency values ​​of each network protocol address in the flow data; and determining the abnormal network protocol address according to the flow frequency value of each network protocol address. The method can accurately avoid the attacker sending a large number of false requests to the target server in a short period of time, causing the target server to be exhausted in resources, thereby being unable to provide normal services to legitimate users, that is, a denial of service network attack problem, and further improve the response speed to network attacks.

Description

Background Art

[0002] Hyper Text Transfer Protocol Flood (HTTP Flood) refers to an attacker sending a large number of HTTP messages to the target server through a proxy or zombie host, requesting Uniform Resource Identifiers (URIs) involving database operations or other URIs that consume system resources, causing the server resources to be exhausted and unable to respond to normal requests. The attack source IP is real and scattered, simulating a normal client sending a normal request behavior data packet, so the existing mature method of detecting abnormal attacks through data packets is difficult to detect HTTP Flood attacks.

[0003] The existing methods for HTTP Flood attacks are generally to set up whitelists by manually counting IP addresses. If the threshold is not set properly, it is easy to block or miss blocks. There are also detection methods based on machine learning, which require the accumulation of a large amount of normal access request data to train the algorithm model. Therefore, the existing methods have certain limitations in accuracy and response speed.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The purpose of the present disclosure is to provide an attack detection method, device, computer-readable storage medium and electronic device to at least solve the technical problem of insufficient accuracy and response speed of network attack detection in the related art.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] The technical solution of the present disclosure is as follows:

[0008] According to one aspect of the present disclosure, there is provided an attack detection method, which includes: obtaining flow data to be tested; performing differential and predictive processing on the flow data to be tested, and obtaining an abnormal time window according to the predicted data; extracting the flow data within the abnormal time window, and counting the flow frequency values ​​of each network protocol address in the flow data; and determining the abnormal network protocol address according to the flow frequency value of each network protocol address.

[0009] In some embodiments of the present disclosure, differential and predictive processing is performed on the flow data to be measured, and the step of obtaining an abnormal time window based on the predicted data includes: obtaining a flow data sample; customizing a time window to construct a flow time series of the flow data sample; training a differential prediction model based on the flow time series; using the differential prediction model to perform flow prediction on the flow data to be measured to obtain a flow prediction value; and obtaining the abnormal time window based on a comparison result between the flow prediction value and the actual flow value in each custom time window of the flow data to be measured.

[0010] In some embodiments of the present disclosure, the step of determining an abnormal network protocol address based on the traffic frequency value of each network protocol address includes: counting the traffic frequency value corresponding to the traffic data of each network protocol address based on the network protocol address; determining the abnormal threshold of the traffic frequency value based on the statistical measurement; determining a first difference value characterizing the degree of abnormality of the traffic frequency value based on the traffic frequency value and the abnormal threshold; and determining the abnormal network protocol address based on the comparison result of the first difference value and the abnormal threshold.

[0011] In some embodiments of the present disclosure, after the step of determining the abnormal network protocol address based on the comparison result of the traffic abnormality degree and the abnormal threshold, the method also includes: determining a second difference value characterizing the change trend of the current traffic frequency value of the abnormal network protocol address relative to the historical traffic frequency value; determining a third difference value characterizing the change rate of the traffic frequency value of the abnormal network protocol address relative to the change rate of the traffic frequency value of other network protocol addresses within the abnormal time window; and verifying the abnormal network protocol address based on the first difference value, the second difference value and the third difference value.

[0012] In some embodiments of the present disclosure, the first difference value is expressed as:

[0013]

[0014] in, represents the first difference value corresponding to the jth group of network protocol addresses, t is the abnormal threshold, and p i is the traffic frequency value of the i-th group of IP addresses.

[0015] In some embodiments of the present disclosure, the second difference value is expressed as:

[0016]

[0017] in, represents the second difference value corresponding to the jth group of network protocol addresses, p j is the current traffic frequency value of the jth group of IP addresses, p k It is the average value of the historical traffic frequency value of the jth group of IP addresses in the previous n days.

[0018] In some embodiments of the present disclosure, the third difference value is expressed as:

[0019]

[0020] in, represents the third difference value corresponding to the j-th group of network protocol addresses, Indicates the difference in change rate between abnormal IP and other IP on day n+1.

[0021] In some embodiments of the present disclosure, the step of verifying an abnormal network protocol address based on a first difference value, a second difference value, and a third difference value includes: weighting the first difference value, the second difference value, and the third difference value to obtain a weighted result; and deciding whether to intercept the abnormal network protocol address based on the weighted result.

[0022] According to another aspect of the present disclosure, an attack detection device is provided, which includes: a traffic acquisition module, used to acquire traffic data to be tested; a differential module, used to perform differential processing on the traffic data to be tested, and obtain an abnormal time window according to the traffic data after differential processing; a first statistical module, used to extract the traffic data within the abnormal time window, and count the traffic frequency values ​​of each network protocol address in the traffic data; and an abnormal address determination module, used to determine the abnormal network protocol address according to the traffic frequency value of each network protocol address.

[0023] According to another aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the above-mentioned attack detection method by executing the executable instructions.

[0024] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned attack detection method is implemented.

[0025] The disclosed embodiment converts non-stationary traffic data into stable data through differential calculation, thereby achieving accurate prediction of website traffic, thereby avoiding the problem of network attack where attackers send a large number of false requests to the target server in a short period of time, causing exhaustion of target server resources and thus being unable to provide normal services to legitimate users, i.e., a denial of service network attack.

[0026] Furthermore, by comparing actual traffic with predicted traffic, it is possible to accurately confirm the possibility of network attacks within the time window, screen abnormal traffic, reduce detection costs, and improve detection efficiency.

[0027] Furthermore, while realizing the network traffic detection function, the disclosed method does not need to change the user's network environment at all. It can be used in emergency response during enterprise security construction, and can also be embedded as an atomic capability of a cloud firewall to achieve dynamic defense and tracing of network attacks.

[0028] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0030] Figure 1 An application scenario diagram of an attack detection method according to an embodiment of the present disclosure is shown.

[0031] Figure 2 A flow chart of an attack detection method in an embodiment of the present disclosure is shown.

[0032] Figure 3 A flow chart of a method for performing differential prediction on traffic data to be tested in an attack detection method in an embodiment of the present disclosure is shown.

[0033] Figure 4 A flow chart of a method for detecting abnormal network protocol addresses based on statistical measurement in an attack detection method in an embodiment of the present disclosure is shown.

[0034] Figure 5 A flow chart of a method for verifying a detection result in an attack detection method in an embodiment of the present disclosure is shown.

[0035] Figure 6 A flowchart of another attack detection method in an embodiment of the present disclosure is shown.

[0036] Figure 7 A schematic diagram of an attack detection device in an embodiment of the present disclosure is shown.

[0037] Figure 8 A schematic block diagram of an electronic device showing an attack detection method in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0038] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0039] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0040] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the present disclosure, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0041] In view of the technical problems existing in the above-mentioned related technologies, the embodiments of the present disclosure provide an encrypted traffic detection method to solve at least one or all of the above-mentioned technical problems.

[0042] It should be pointed out that the nouns or terms involved in the embodiments of the present application can refer to each other and will not be repeated here.

[0043] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0044] Figure 1 An application scenario diagram of an attack detection method according to an embodiment of the present disclosure is shown.

[0045] like Figure 1 As shown, the application scenario includes: a user terminal 110 and a server 120 .

[0046] Among them, the user terminal 110 can be a mobile terminal such as a mobile phone, a game console, a tablet computer, an e-book reader, smart glasses, an MP4 (Moving Picture Experts Group Audio Layer IV) player, a smart home device, an AR (Augmented Reality) device, a VR (Virtual Reality) device, or the user terminal 120 can also be a personal computer (Personal Computer, PC), such as a laptop computer and a desktop computer.

[0047] The server 120 may be a single server, or may be composed of several servers, or may be a virtualization platform, or may be a cloud computing service center. The server 120 is used to provide background services for attack detection. Specifically, the server obtains the flow data to be tested from the user terminal, performs differential and prediction processing on the flow data to be tested, obtains the abnormal time window according to the prediction data, extracts the flow data within the abnormal time window, and counts the flow frequency values ​​of each network protocol address in the flow data; and determines the user terminal of the abnormal network protocol address according to the flow frequency value of each network protocol address.

[0048] Those skilled in the art will appreciate that the number of the user terminals 110 may be more or less. For example, there may be only one terminal, or there may be dozens or hundreds of terminals, or a greater number. The embodiment of the present application does not limit the number and device type of the terminals.

[0049] Optionally, the system may also include a management device ( Figure 1 (not shown), the management device is connected to the server 120 via a communication network. Optionally, the communication network is a wired network or a wireless network.

[0050] Optionally, the wireless network or wired network between the user terminal 110 and the server 120 uses standard communication technology and / or protocol. The network is usually the Internet, but it can also be any network, including but not limited to a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a mobile, wired or wireless network, a dedicated network or any combination of a virtual private network). In some embodiments, the data exchanged through the network is represented by technologies and / or formats including Hyper Text Mark-up Language (HTML), Extensible Markup Language (XML), etc. In addition, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN), Internet Protocol Security (IPsec), etc. can also be used to encrypt all or some links. In other embodiments, customized and / or dedicated data communication technologies can also be used to replace or supplement the above data communication technologies.

[0051] The following will describe in more detail the steps of the attack detection method in this example implementation with reference to the accompanying drawings and embodiments.

[0052] Figure 2 A flowchart of an attack detection method in an embodiment of the present disclosure is shown. The method provided in the embodiment of the present disclosure can be applied to Figure 1 Server 120 is shown.

[0053] like Figure 2 As shown, the method 200 may include the following steps:

[0054] In step S210, the flow data to be measured is obtained.

[0055] The traffic to be detected may be traffic session data parsed from Hypertext Transfer Protocol (HTTP) traffic, logs, and other data. The traffic session data may include: source network protocol address, destination network protocol address, host information, timestamp, user agent, and other fields extracted from the traffic to be detected. In some embodiments, the traffic to be detected may be obtained by deploying a traffic detection device at the access network.

[0056] In step S220, the measured flow data is subjected to differential and prediction processing, and an abnormal time window is obtained according to the predicted data.

[0057] Among them, the flow data to be detected is a non-stationary data sequence, which can be converted into a stationary data sequence by performing differential processing on the flow data to be detected.

[0058] The prediction processing of the traffic data to be detected refers to the prediction and analysis of the actual traffic corresponding to a specific resource (for example, a unique website uniform resource identifier) ​​within a specific time window. If the actual traffic far exceeds the predicted traffic, the traffic in the time window is determined to be abnormal, and the time window is an abnormal time window. The time window can be a sliding time window of a custom size.

[0059] In step S230, the flow data within the abnormal time window is extracted, and the flow frequency value of each network protocol address in the flow data is counted.

[0060] The traffic in the abnormal time window is grouped according to specific resources (eg, uniform resource identifier URI), and the access frequency of each network protocol address under each specific resource is counted.

[0061] In step S240, an abnormal network protocol address is determined according to the traffic frequency value of each network protocol address.

[0062] In some embodiments of the present disclosure, a preset threshold value may be set, and by comparing the traffic frequency value with the preset traffic threshold, a network protocol address having a traffic frequency value higher than the preset traffic threshold may be determined as an abnormal network protocol address.

[0063] The disclosed embodiment converts non-stationary traffic data into stable data through differential calculation, thereby achieving accurate prediction of website traffic, thereby avoiding the problem of network attack where attackers send a large number of false requests to the target server in a short period of time, causing exhaustion of target server resources and thus being unable to provide normal services to legitimate users, i.e., a denial of service network attack.

[0064] Furthermore, by comparing actual traffic with predicted traffic, it is possible to accurately confirm that a network attack may occur within the time window, screen abnormal traffic, reduce detection costs, and improve detection efficiency.

[0065] Furthermore, while realizing the network traffic detection function, the disclosed method does not need to change the user's network environment at all. It can be used in emergency response during enterprise security construction, and can also be embedded as an atomic capability of a cloud firewall to achieve dynamic defense and tracing of network attacks.

[0066] In some embodiments of the present disclosure, step S220 may also include: Figure 3 The method 300 shown, as Figure 3 As shown, the method 300 may include the following steps:

[0067] In step S310, a flow data sample is obtained.

[0068] The traffic data sample may be historical traffic session data parsed from historical HTTP traffic, logs, etc. The historical traffic session data may include: source network protocol address, destination network protocol address, host information, timestamp, user agent, etc. extracted from the traffic data sample.

[0069] In step S320, a time window is customized to construct a traffic time series of traffic data samples.

[0070] The custom time window is a sliding time window of custom size. For example, if the size of the predefined time window is a timestamp t, then the traffic time series constructed at timestamp t can be expressed as {r t}.

[0071] In step S330, a differential prediction model is trained based on the traffic time series.

[0072] Among them, the differential prediction model includes the function of converting non-stationary data sequences into stationary data sequences, the function of predicting the characteristics of the current stationary data sequence through the characteristics of the historical stationary data sequence, and the function of reducing errors.

[0073] In some embodiments of the present disclosure, the algorithm for establishing the differential prediction model includes the following basic steps: determining the differential (I) order of the time series; determining the autoregressive order p of the time series; and determining the sliding average order q of the time series. In summary, the predicted flow value of the time window can be expressed as formula (1):

[0074] x t =α1x t-1 +α2x t-2 +…+α p x t-p +ε t +β1ε t-1 +…+β q ε t-p (1) Where {x t} represents the predicted flow value at time stamp t; {ε t} represents white noise, which obeys N(0-σ 2 ) distribution; α=(α1,…,α p ) T is the autoregressive coefficient; β=(β1,…,β p ) T is the sliding mean coefficient.

[0075] In step S340, a differential prediction model is used to perform flow prediction on the flow data to be measured to obtain a flow prediction value.

[0076] For example, the traffic prediction value {x t}.

[0077] In step S350, an abnormal time window is obtained according to a comparison result between the flow prediction value and the actual flow value in each custom time window of the flow data to be measured.

[0078] For example, by comparing the traffic prediction value {x t} and the actual flow value {r t}, if the actual flow value far exceeds the predicted flow value, it is determined that the flow is abnormal at timestamp t, and the abnormal time window is timestamp t.

[0079] The differential prediction model can not only accurately describe the relationship between historical data and current data, accurately describe traffic characteristics and reduce false alarms, but also transform traffic data into a stable time series through the differential processing function of the model to improve model performance.

[0080] In some embodiments of the present disclosure, step S240 may also include: Figure 4 The method 400 shown is as follows Figure 4 As shown, method 400 may include the following steps:

[0081] In step S410, the traffic frequency value corresponding to the traffic data of each network protocol address is counted based on the network protocol address.

[0082] For example, the traffic in the time window is grouped by network protocol address to count the traffic data, or the traffic data can be grouped by network protocol address and user agent to calculate the access frequency P of each IP. i n (i=1,2,3……n, n is the number of IP packets).

[0083] In step S420, an abnormal threshold of the flow frequency value is determined based on a statistical measure.

[0084] For example, the statistical measure may include the variance, interquartile range, mean, median, etc. of the traffic frequency value. Taking the interquartile range (IQR) as an example, the abnormal threshold is the traffic frequency value t = {P1, P2, ..., P n The sum of the upper quartile and 1.5 times the interquartile range.

[0085] In step S430, a first difference value representing the degree of abnormality of the flow frequency value is determined based on the flow frequency value and the abnormal threshold.

[0086] In step S440, the abnormal network protocol address is determined according to the comparison result between the first difference value and the abnormal threshold.

[0087] The embodiments of the present disclosure can improve the accuracy of detecting abnormal network protocol addresses through a statistical measurement method, which is beneficial to the normal operation of website services.

[0088] In some embodiments of the present disclosure, the first difference value can be expressed as formula (2):

[0089]

[0090] In formula (2), represents the first difference value corresponding to the jth group of network protocol addresses, t is the abnormal threshold, and p i is the traffic frequency value of the i-th group of IP addresses.

[0091] Then, according to the first difference value The value of the IP address is compared with the abnormal threshold value t to determine whether the IP address is an abnormal network protocol address (IP).

[0092] In some embodiments of the present disclosure, after executing step S440, a method for verifying the abnormal network protocol address may be further included, for example Figure 5 A flow chart of a method for verifying a test result is shown in FIG. Figure 5 As shown, method 500 may include the following steps:

[0093] In step S510, a second difference value representing a change trend of a current traffic frequency value of an abnormal network protocol address relative to a historical traffic frequency value is determined.

[0094] In step S520, a third difference value representing the change rate of the traffic frequency value of the abnormal network protocol address relative to the change rates of the traffic frequency values ​​of other network protocol addresses within the abnormal time window is determined.

[0095] In step S530 , the abnormal network protocol address is verified based on the first difference value, the second difference value, and the third difference value.

[0096] The method of this embodiment performs horizontal statistics on the traffic generated by abnormal network protocol addresses and historical traffic, and performs vertical statistical analysis on other network protocol addresses, and calculates the difference values ​​of frequency, trend and change rate respectively, so as to identify abnormal traffic data. Compared with the prior art which only analyzes the traffic frequency and rate and ignores the changes in the overall traffic trend, this method solves the problem of low response speed and accuracy of the prior art in the scenario of business traffic changes.

[0097] In some embodiments of the present disclosure, the second difference value in step S510 can be expressed as formula (3):

[0098]

[0099] in, represents the second difference value corresponding to the jth group of network protocol addresses, p j is the current traffic frequency value of the jth group of IP addresses, p k It is the average value of the historical traffic frequency value of the jth group of IP addresses in the previous n days.

[0100] In some embodiments of the present disclosure, the change rate of the traffic frequency value of the jth IP address in step S520 can be expressed as formula (4):

[0101]

[0102] In formula (4), n represents the access frequency of the current window, and m represents the access frequency of the same time window on the previous day.

[0103] Taking the calculation of the traffic change rate on day n+1 as an example, the calculation process of determining the traffic frequency value change rate of the abnormal IP (j) and other IPs among the i IPs can be as follows:

[0104] The change rate of IP on the second day is determined based on the traffic frequency on the first day: The change rate of the traffic frequency value of the jth abnormal IP on the second day can be expressed as formula (5):

[0105]

[0106] The change rate of IP on the third day is determined based on the traffic frequency on the second day: Then the traffic frequency value change rate of the jth abnormal IP on the third day can be expressed as formula (6):

[0107]

[0108] The change rate of IP on day n+1 is determined based on the traffic frequency on day 1: Then the frequency value change rate of the j-th abnormal IP on the n+1th day can be expressed as formula (7):

[0109]

[0110] In formulas (5) to (7), Indicates the difference in the change rate between abnormal IP and other IP on day n.

[0111] Further, based on the above-mentioned difference in the change rate of n+1 days, a third difference value representing the change rate of the traffic frequency value of the abnormal network protocol address relative to the change rate of the traffic frequency value of other network protocol addresses within the abnormal time window can be obtained.

[0112] In some embodiments, the third difference value According to formula (8), we can get:

[0113]

[0114] in, represents the third difference value corresponding to the j-th group of network protocol addresses, Indicates the difference in change rate between abnormal IP and other IP on day n+1. The larger the value, the more abnormal the IP change is, and the less likely it is to be affected by website business adjustments.

[0115] In some embodiments of the present disclosure, step S530 may further include weighting the first difference value, the second difference value, and the third difference value to obtain a weighted result; and determining whether to intercept the abnormal network protocol address according to the verification value.

[0116] The disclosed embodiment performs weighted statistics on various evaluation indicators by a weighted statistical method, and uses the result of comparing the verification value with the threshold value as the final determination result of the network protocol address, thereby ensuring the accuracy of the obtained result.

[0117] In some embodiments of the present disclosure, the weighted result W can be expressed as formula (9):

[0118]

[0119] Among them, a, b, c are the first difference values Second difference value and the third difference The weight of .

[0120] Figure 6 FIG. 2 is a flowchart of another attack detection method in an embodiment of the present disclosure. Figure 6 As shown, method 600 may include:

[0121] In step S602, the flow data to be measured is obtained.

[0122] For example, the traffic data to be tested may be HTTP traffic data.

[0123] In step S604, the flow characteristics to be measured are analyzed;

[0124] For example, extract fields such as source IP, destination IP, host information, timestamp, user agent, etc. from HTTP traffic data.

[0125] In step S606, the measured flow data is subjected to differential and prediction processing, and an abnormal time window is obtained according to the predicted data.

[0126] For example, you can use a custom sliding time window to count traffic, build a traffic time series, train a traffic prediction model, and predict the real-time traffic corresponding to specific resources on the website (e.g., URI).

[0127] In step S608, if the actual traffic is less than the predicted traffic, the network IP is released.

[0128] In step S610, if the actual traffic is greater than the predicted traffic, the traffic frequency value corresponding to the traffic data of each network protocol address is counted based on the network protocol address; the abnormal threshold of the traffic frequency value is determined based on the statistical measurement; the first difference value characterizing the degree of abnormality of the traffic frequency value is determined based on the traffic frequency value and the abnormal threshold; and the abnormal network protocol address is determined based on the comparison result of the first difference value and the abnormal threshold.

[0129] In step S612, a first abnormal value of the abnormal network protocol address is determined.

[0130] In step S614, a second difference value representing the change trend of the current traffic frequency value of the abnormal network protocol address relative to the historical traffic frequency value is determined.

[0131] In step S616, a third difference value representing the change rate of the traffic frequency value of the abnormal network protocol address relative to the change rates of the traffic frequency values ​​of other network protocol addresses within the abnormal time window is determined.

[0132] In step S618, the first difference value, the second difference value and the third difference value are weighted to obtain a weighted result.

[0133] In step S620, it is determined whether to intercept the abnormal network protocol address according to the weighted result.

[0134] The method of the disclosed embodiment does not need to change the user's network environment at all while realizing the network traffic detection function. It can be used during emergency response in enterprise security construction, and can also be embedded and used as an atomic capability of a cloud firewall. It is plug-and-play and can realize dynamic defense and tracing of network attacks.

[0135] Figure 7 FIG. 2 is a schematic diagram of an attack detection device according to an embodiment of the present disclosure. Figure 7 As shown, the device 700 includes:

[0136] The flow acquisition module 710 is used to obtain the flow data to be measured; the differential module 720 is used to perform differential processing on the flow data to be measured, and obtain the abnormal time window according to the flow data after differential processing; the first statistical module 730 is used to extract the flow data within the abnormal time window, and count the flow frequency values ​​of each network protocol address in the flow data; the abnormal IP determination module 740 is used to determine the abnormal network protocol address according to the flow frequency value of each network protocol address.

[0137] In some embodiments of the present disclosure, the differential module 720 can also be used to obtain flow data samples; customize time windows to construct flow time series of the flow data samples; train a differential prediction model based on the flow time series; use the differential prediction model to perform flow prediction on the flow data to be measured to obtain a flow prediction value; and obtain the abnormal time window based on the comparison result between the flow prediction value and the actual flow value in each customized time window of the flow data to be measured.

[0138] In some embodiments of the present disclosure, the abnormal address determination module 740 can also be used to count the traffic frequency value corresponding to the traffic data of each network protocol address based on the network protocol address; determine the abnormal threshold of the traffic frequency value based on the statistical measurement; determine a first difference value characterizing the degree of abnormality of the traffic frequency value based on the traffic frequency value and the abnormal threshold; and determine the abnormal network protocol address based on the comparison result of the first difference value and the abnormal threshold.

[0139] In some embodiments of the present disclosure, the device 700 may also include: a second difference value determination module, used to determine a second difference value representing the current traffic frequency value of the abnormal network protocol address relative to the change trend of the historical traffic frequency value; a third difference value determination module, used to determine a third difference value representing the change rate of the traffic frequency value of the abnormal network protocol address relative to the change rate of the traffic frequency values ​​of other network protocol addresses within the abnormal time window; and a weighting module, used to verify the abnormal network protocol address based on the first difference value, the second difference value and the third difference value.

[0140] In some embodiments of the present disclosure, the first difference value is expressed as formula (2), where: represents the first difference value corresponding to the jth group of network protocol addresses, t is the abnormal threshold, and p i is the traffic frequency value of the i-th group of IP addresses.

[0141] In some embodiments of the present disclosure, the second difference value is expressed as formula (3), where: represents the second difference value corresponding to the jth group of network protocol addresses, p j is the current traffic frequency value of the jth group of IP addresses, p kIt is the average value of the historical traffic frequency value of the jth group of IP addresses in the previous n days.

[0142] In some embodiments of the present disclosure, the third difference value is expressed as formula (8), where: represents the third difference value corresponding to the j-th group of network protocol addresses, Indicates the difference in change rate between abnormal IP and other IP on day n+1.

[0143] In some embodiments of the present disclosure, the weighting module may also be used to weight the first difference value, the second difference value and the third difference value to obtain a weighted result; and decide whether to intercept the abnormal network protocol address according to the weighted result.

[0144] Regarding the attack detection device 700 in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0145] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods or program products. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: complete hardware implementation, complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as "circuits", "modules" or "systems".

[0146] Refer to the following Figure 8 The electronic device 800 according to this embodiment of the present disclosure is described. Figure 8 The electronic device 800 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0147] like Figure 8 As shown, the electronic device 800 is in the form of a general computing device. The components of the electronic device 800 may include but are not limited to: at least one processing unit 810, at least one storage unit 820, and a bus 830 connecting different system components (including the storage unit 820 and the processing unit 810).

[0148] The storage unit stores program codes, which can be executed by the processing unit 810, so that the processing unit 810 performs the steps according to various exemplary embodiments of the present disclosure described in the above “Exemplary Method” section of this specification. For example, the processing unit 810 can perform the following steps: Figure 2In step S210 shown in the figure, the flow data to be detected is obtained; in step S220, the flow data to be detected is differentiated and predicted, and an abnormal time window is obtained according to the predicted data; in step S230, the flow data within the abnormal time window is extracted, and the flow frequency value of each network protocol address in the flow data is counted; and in step S240, the abnormal network protocol address is determined according to the flow frequency value of each network protocol address.

[0149] The storage unit 820 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 8201 and / or a cache memory unit 8202 , and may further include a read-only memory unit (ROM) 8203 .

[0150] The storage unit 820 may also include a program / utility 824 having a set (at least one) of program modules 8205, such program modules 8205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0151] Bus 830 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0152] The electronic device 800 may also communicate with one or more external devices (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 800, and / or communicate with any device that enables the electronic device 800 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 850. Furthermore, the electronic device 800 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 860. As shown, the network adapter 860 communicates with other modules of the electronic device 800 via a bus 830. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 800, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0153] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible implementations, various aspects of the present disclosure may also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary implementations of the present disclosure described in the above "Exemplary Method" section of the present specification.

[0154] The program product for implementing the above method according to the embodiment of the present disclosure may adopt a portable compact disk read-only memory (CD-ROM) and include program code, and may be run on a terminal device, such as a personal computer. However, the program product of the present disclosure is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, a server, a terminal or a device.

[0155] The program product may be any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, server, terminal, or device, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0156] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, wherein readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, server, terminal, or device.

[0157] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0158] Program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0159] According to one aspect of the present disclosure, a computer program product or a computer program is provided, the computer program product or the computer program including computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the methods provided in various optional implementations of the above-mentioned embodiments.

[0160] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0161] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0162] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0163] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any modification, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. An attack detection method, characterized in that: The method comprises: Obtain the flow data to be tested; Performing differential and prediction processing on the flow data to be measured, and obtaining an abnormal time window according to the prediction data; Extracting the flow data within the abnormal time window, and counting the flow frequency value of each network protocol address in the flow data; and Determining an abnormal network protocol address according to the traffic frequency value of each network protocol address, including: counting the traffic frequency value corresponding to the traffic data of each network protocol address based on the network protocol address; determining the abnormal threshold of the traffic frequency value based on the statistical measurement; determining a first difference value characterizing the degree of abnormality of the traffic frequency value based on the traffic frequency value and the abnormal threshold; and determining the abnormal network protocol address according to the comparison result of the first difference value and the abnormal threshold; Determine a second difference value representing the change trend of the current traffic frequency value of the abnormal network protocol address relative to the historical traffic frequency value; determine a third difference value representing the change rate of the traffic frequency value of the abnormal network protocol address relative to the change rate of the traffic frequency value of other network protocol addresses within the abnormal time window; and verify the abnormal network protocol address based on the first difference value, the second difference value and the third difference value; Among them, the traffic data within the abnormal time window is extracted, and the traffic frequency value of each network protocol address in the traffic data is counted, including: grouping the traffic within the abnormal time window according to specific resources, and counting the access frequency of each network protocol address under each specific resource.

2. The attack detection method according to claim 1, characterized in that: The steps of performing differential and prediction processing on the flow data to be measured and obtaining an abnormal time window according to the predicted data include: Get traffic data samples; Customizing a time window to construct a flow time series of the flow data sample; Training a differential prediction model based on the traffic time series; Using a differential prediction model, performing flow prediction on the flow data to be measured to obtain a flow prediction value; and The abnormal time window is obtained according to a comparison result between the flow prediction value and the actual flow value in each custom time window of the flow data to be measured.

3. The attack detection method according to claim 2, characterized in that: The first difference value is expressed as: in, represents the first difference value corresponding to the jth group of network protocol addresses, t is the abnormal threshold, and p i is the traffic frequency value of the i-th group of IP addresses.

4. The attack detection method according to claim 3, characterized in that: The second difference value is expressed as: in, represents the second difference value corresponding to the jth group of network protocol addresses, p j is the current traffic frequency value of the jth group of IP addresses, p k It is the average value of the historical traffic frequency value of the jth group of IP addresses in the previous n days.

5. The attack detection method according to claim 4, characterized in that: The third difference value is expressed as: in, represents the third difference value corresponding to the jth group of network protocol addresses, Indicates the difference in change rate between abnormal IP and other IP on day n+1.

6. The attack detection method according to claim 5, characterized in that: The step of verifying the abnormal network protocol address based on the first difference value, the second difference value and the third difference value comprises: weighting the first difference value, the second difference value, and the third difference value to obtain a weighted result; Whether to intercept the abnormal network protocol address is determined according to the weighted result.

7. An attack detection device, characterized in that: The device comprises: A flow acquisition module is used to acquire flow data to be tested; A differential module, used for performing differential processing on the flow data to be measured, and obtaining an abnormal time window according to the flow data after differential processing; A first statistical module, configured to extract the flow data within the abnormal time window, and to count the flow frequency value of each network protocol address in the flow data; and An abnormal address determination module, used to determine an abnormal network protocol address according to the flow frequency value of each network protocol address; The abnormal address determination module can also be used to count the flow frequency value corresponding to the flow data of each network protocol address based on the network protocol address; determine the abnormal threshold of the flow frequency value based on the statistical measurement; determine the first difference value characterizing the degree of abnormality of the flow frequency value based on the flow frequency value and the abnormal threshold; and determine the abnormal network protocol address according to the comparison result of the first difference value and the abnormal threshold; A second difference value determination module is used to determine a second difference value representing a change trend of a current flow frequency value of an abnormal network protocol address relative to a historical flow frequency value; A third difference value determination module, configured to determine a third difference value representing a change rate of a flow frequency value of an abnormal network protocol address relative to a change rate of a flow frequency value of other network protocol addresses within an abnormal time window; and A weighting module, configured to verify the abnormal network protocol address based on the first difference value, the second difference value, and the third difference value; The first statistical module is further used to group the traffic in the abnormal time window according to specific resources, and count the access frequency of each network protocol address under each specific resource.

8. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the attack detection method according to any one of claims 1 to 6 by executing the executable instructions.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the attack detection method according to any one of claims 1 to 6 is implemented.

Images