A method, device, equipment and medium for determining attack

Abstract

The present invention discloses an attack determination method, apparatus, device and medium, the method comprising: obtaining network traffic data; obtaining first data from the network traffic data; wherein the first data comprises data in the network traffic data representing data downloading behavior; obtaining second data from the network traffic data; wherein the second data comprises context data associated with the data downloading behavior; aggregating the first data and the second data to determine whether the electronic device corresponding to the network traffic data is attacked.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an attack determination method, device, equipment and medium. Background Art

[0002] In actual applications, the detection of network security status, such as threat hunting and advanced persistent threat (APT), is usually achieved by matching the operation information of the network space with pre-set security detection rules, wherein the above security detection rules need to be determined based on professional threat hunting experience. Therefore, the above threat hunting solutions are heavily dependent on the professional experience of hunting experts, with poor flexibility and weak detection capabilities. Summary of the invention

[0003] Based on the above problems, embodiments of the present invention provide an attack determination method, apparatus, device and medium.

[0004] The technical solution provided by the embodiment of the present invention is as follows:

[0005] The embodiment of the present invention first provides an attack determination method, the method comprising:

[0006] Get network traffic data;

[0007] Acquire first data from the network traffic data; wherein the first data includes data representing data downloading behavior in the network traffic data;

[0008] Acquire second data from the network traffic data; wherein the second data includes context data associated with the data downloading behavior in the network traffic data;

[0009] The first data and the second data are aggregated to determine whether the electronic device corresponding to the network traffic data is attacked.

[0010] In some embodiments, obtaining the second data from the network traffic data includes:

[0011] Based on the first data, the data in the network traffic data is correlated and matched to obtain the second data.

[0012] In some embodiments, the step of performing correlation matching on the data in the network traffic data based on the first data to obtain the second data includes:

[0013] Acquire address information of the data downloading behavior from the first data;

[0014] The third data is screened and matched based on the address information to obtain the second data; wherein the third data includes data in the network traffic data excluding the first data.

[0015] In some embodiments, the step of screening and matching the third data based on the address information to obtain the second data includes:

[0016] Determine time period information;

[0017] Based on the address information, data in the third data corresponding to the time period information is screened and matched to obtain the second data.

[0018] In some embodiments, the aggregating the first data and the second data to determine whether the electronic device corresponding to the network traffic data is attacked includes:

[0019] Acquire address information of the data downloading behavior from the first data;

[0020] Acquire, from the second data, associated information within a specified time period associated with the address information;

[0021] The address information and the associated information are aggregated to determine whether the electronic device is attacked.

[0022] In some embodiments, the aggregating the address information and the associated information to determine whether the electronic device is attacked includes:

[0023] Associating the address information with the associated information to obtain attack information associated with the attacking device and attack result information associated with the electronic device;

[0024] Aggregate the attack information and the attack result information to determine whether the electronic device has been attacked.

[0025] In some embodiments, obtaining the first data from the network traffic data includes:

[0026] Obtain download behavior characteristics;

[0027] Filtering the network traffic data based on the download behavior characteristics to obtain fourth data;

[0028] The fourth data is processed to obtain the first data.

[0029] In some embodiments, the processing the fourth data to obtain the first data includes:

[0030] Get address screening information;

[0031] The fourth data is filtered based on the address filtering information to obtain the first data.

[0032] In some embodiments, the method further comprises:

[0033] Determine level information of at least two attack results; wherein the attack result includes whether the electronic device is attacked

[0034] Sorting at least two of the attack results based on the level information to obtain a sorting result;

[0035] The sorting result is output.

[0036] The embodiment of the present invention further provides an attack determination device, the device comprising:

[0037] An acquisition module, used to acquire network traffic data; acquire first data and second data from the network traffic data; wherein the first data includes data in the network traffic data representing data downloading behavior; and the second data includes context data in the network traffic data associated with the data downloading behavior;

[0038] A determination module is used to aggregate the first data and the second data to determine whether the electronic device corresponding to the network traffic data is attacked.

[0039] An embodiment of the present invention further provides an attack determination device, the device comprising a processor and a memory; a computer program is stored in the memory; when the computer program is executed by the processor, it can implement any of the above-mentioned attack determination methods.

[0040] An embodiment of the present invention further provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor of an electronic device, the attack determination method as described above can be implemented.

[0041] In the attack determination method provided by the embodiment of the present invention, since the network traffic data can accurately characterize the actual state of data transmission in the network world, and the first data and the second data obtained from the network traffic data for characterizing the data download behavior can accurately describe each data download behavior of the electronic device, and the download result associated with the data download behavior, then, aggregating the first data and the second data can accurately and comprehensively reproduce the result of whether the electronic device is attacked and the process of how it is attacked; and since attack behaviors such as APT are usually related to data download behaviors, therefore, when the above-mentioned attack determination method is applied to threat hunting scenarios, it can get rid of the dependence on pre-set rules and security detection experts, so that threat hunting can be flexibly, accurately and comprehensively performed. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 A schematic diagram of a flow chart of an attack determination method provided by an embodiment of the present invention;

[0043] Figure 2 A schematic diagram of a process for obtaining second data provided by an embodiment of the present invention;

[0044] Figure 3A A schematic diagram of a process for determining whether an electronic device has been attacked provided by an embodiment of the present invention;

[0045] Figure 3B A schematic diagram of a structure for determining an attack result provided by an embodiment of the present invention;

[0046] Figure 4 A schematic diagram of the APT detection process provided by an embodiment of the present invention;

[0047] Figure 5 A schematic diagram of the structure of an attack determination device provided by an embodiment of the present invention;

[0048] Figure 6 A schematic diagram of the structure of an attack determination device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0049] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0050] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0051] Threat hunting refers to the process of searching for advanced threats in the cyber world that want to evade security detection solutions through active and passive methods. Among them, APT refers to the hidden and persistent intrusion process against computer devices. APT includes three elements: advanced, long-term and threat. Among them, advanced refers to the use of complex and sophisticated malware and technologies to exploit vulnerabilities in electronic equipment systems to perform attack operations; long-term refers to the attacker's continuous monitoring of the attack process and attack status, and continuous acquisition of attack results; and threat refers to the characteristics of attacks planned by humans.

[0052] Therefore, threat hunting is very important for network security and device security. The threat hunting solution in the related art is mainly based on a series of security rules defined by threat hunters to match the activities in the network space.

[0053] The above threat hunting process is mainly for experts to infer the possible features in a certain attack scenario based on their threat hunting experience, and integrate these features to obtain security rules. However, the above security rules are heavily dependent on the experience of threat hunting experts. If the threat hunting experts are not experienced enough, the security rules obtained in the above way cannot guarantee the accuracy of the analysis and detection of known threats or the detection of unknown threats. Especially in the APT threat hunting scenario, the effectiveness of the above rules is difficult to determine.

[0054] Based on the above problems, embodiments of the present invention provide an attack determination method, apparatus, device and medium.

[0055] The attack determination method provided by the embodiment of the present invention can aggregate the first data and the second data to determine whether the electronic device corresponding to the network traffic data is attacked after obtaining network traffic data and obtaining the first data used to characterize the data download behavior and the context data associated with the data download behavior, namely the second data, from the network traffic data. In this way, the attack determination method provided by the embodiment of the present invention does not rely on pre-set rules, but determines whether the electronic device is attacked based on the first data and the second data obtained from the network traffic data, thereby not only getting rid of the dependence on security rules and security detection experts such as threat hunting experts, but also being able to comprehensively and accurately display whether the electronic device is attacked and the attack process based on the aggregation results of the attack behavior represented by the first data and the attack impact represented by the second data.

[0056] The attack determination method provided in the embodiment of the present invention can be implemented by a processor of an attack determination device. It should be noted that the above-mentioned processor can be at least one of an application-specific integrated circuit (ASIC), a digital signal processor (DSP), a digital signal processing device (DSPD), a programmable logic device (PLD), a field programmable gate array (FPGA), a central processing unit (CPU), a controller, a microcontroller, and a microprocessor.

[0057] Exemplarily, the attack determination device may include a server device or a personal computer (PC); exemplary, the attack determination device may include a security detection device set in the network, such as a firewall device, etc.; exemplary, the attack determination device may be the attacked electronic device itself.

[0058] Figure 1 A flow chart of an attack determination method provided by an embodiment of the present invention is shown in FIG. Figure 1 As shown, the process may include steps 101 to 104:

[0059] Step 101: Obtain network traffic data.

[0060] In one embodiment, the network traffic data may include traffic data corresponding to the network operation process of the electronic device, and traffic data related to the data transmission process between electronic devices; exemplarily, the electronic device may include a device that sends data or requests, and may also include an electronic device that receives data or responds to requests; exemplarily, the electronic device may include a PC and a mobile terminal; exemplarily, the mobile terminal includes a smart phone or a smart wearable device, etc.

[0061] Exemplarily, the traffic data related to the electronic device may include a device security log of the electronic device; exemplary, the device security log may include a log for recording the electronic device receiving data, sending data, and the electronic device performing data processing.

[0062] Exemplarily, the traffic data related to the data transmission process may include a network security log associated with the data transmission device or apparatus; exemplary, the network security log may include a log for recording the transmission process of data packets, requests or instructions.

[0063] Exemplarily, the attack determination device may integrate device security logs and network security logs to obtain network traffic data.

[0064] In one embodiment, the attack determination device can obtain the terminal security log from the electronic device with which the attack determination device has established a communication connection, and then obtain the network security log associated with the electronic device. That is, the available devices in the device group can establish a communication connection with the attack determination device, and these devices can respectively send their device security logs to the attack determination device through the above communication connection; exemplarily, when the attack determination device is an electronic device, the network traffic data may only include the device security log of the electronic device.

[0065] Exemplarily, the attack determination device may include a remote device that has a communication connection with the electronic device or the electronic device group, such as a cloud device. Exemplarily, the attack determination device may include a physical machine device or a virtual machine device.

[0066] Step 102: Obtain first data from network traffic data.

[0067] The first data includes data representing data downloading behavior in the network traffic data.

[0068] In one embodiment, the data download behavior may include at least one of a text data download behavior, an audio and video file download behavior, and an executable file download behavior; exemplary, the executable file download behavior may include a malware download behavior; exemplary, the data download behavior may be triggered by APT. Malware refers to software that is spread through the Internet and other channels and causes unexpected information security threats such as data leakage and system damage to personal computers, servers, etc. Malware includes binary executable files, scripts, etc.

[0069] In actual applications, the entry point of network attack activities such as APT is usually the downloading behavior of payload or malware. Therefore, in an embodiment of the present invention, data representing data downloading behavior is obtained from network traffic data, which can lock the traffic data of malicious downloading behavior related to APT, thereby providing data support for subsequent attack determination.

[0070] In one embodiment, the first data may include data in the network traffic data that is used to describe the data download behavior and is directly related to the data download behavior; illustratively, the network traffic data may include multiple first data, and different first data may correspond to different data download behaviors.

[0071] In actual applications, it may include network traffic data that triggers data download behavior, such as security logs, including post-exploitation frameworks such as CobaltStrike, brute force cracking, arbitrary file download vulnerabilities, shellcode execution, traffic forwarding, operating system vulnerabilities, backdoor scanning, command injection, remote desktop, arbitrary code and script execution, etc.

[0072] Exemplarily, the attack determination device may determine keywords or key information of the data download behavior, search the network traffic data based on the keywords or key information, and determine the searched data as the first data.

[0073] In one implementation, after obtaining the first data, information such as the time of the data downloading behavior, the identifier or address of the device executing the data downloading behavior, and the amount and type of data downloaded by the data downloading behavior may also be obtained.

[0074] Step 103: Obtain second data from the network traffic data.

[0075] The second data includes context data associated with the data downloading behavior in the network traffic data.

[0076] In one embodiment, the context data associated with the data downloading behavior may include data on operations performed by the electronic device that performs the data downloading behavior during the data downloading behavior and after the data downloading behavior is completed.

[0077] In one implementation, the context data associated with the data downloading behavior may include a trigger type of the data downloading behavior. Exemplarily, the trigger type may include an active trigger or a passive trigger of the electronic device.

[0078] In one embodiment, the context data associated with the data downloading behavior may include the reason for triggering the electronic device to execute the data downloading behavior, and the impact of the data downloading behavior on the electronic device or the device group to which the electronic device belongs after the data downloading behavior is completed.

[0079] Exemplarily, the execution order of step 102 and step 103 may be adjusted successively or performed in parallel, which is not limited in the embodiment of the present invention.

[0080] Step 104: Aggregate the first data and the second data to determine whether the electronic device corresponding to the network traffic data is attacked.

[0081] In one embodiment, whether an electronic device is attacked may include any one of the following: the electronic device is attacked and successfully attacked, the electronic device is attacked but the attack fails, and the electronic device is attacked but the attack result is undetermined; exemplarily, whether the electronic device is attacked may also include whether the electronic device is attacked by an attack behavior of a specified source or a specified level; exemplarily, in the case that there are multiple electronic devices, whether the electronic device is attacked may include whether the device group to which the electronic device belongs is attacked.

[0082] In one implementation, the electronic device may be an attack determination device; illustratively, the electronic device may include a server device or a terminal device.

[0083] Exemplarily, whether the electronic device is attacked can be determined by any of the following methods:

[0084] Based on the first data, at least part of the second data is aggregated and analyzed to determine the attack probability of at least one electronic device corresponding to the network traffic data, and determine the device with the highest attack probability as the target device, that is, determine that the target device is attacked, while other devices in the at least one electronic device except the target device are not attacked.

[0085] The second data is filtered and aggregated based on the first data to obtain a filtered and aggregated result, and feature recognition is performed on the filtered and aggregated result, so as to determine whether the electronic device corresponding to the network traffic data is attacked based on the feature recognition result.

[0086] From the above, it can be seen that in the attack determination method provided by the embodiment of the present invention, after obtaining the network traffic data, it is possible to obtain the first data characterizing the data download behavior and the context data associated with the data download behavior, namely the second data, from the network traffic data, and aggregate the first data and the second data to determine whether the electronic device corresponding to the network traffic data is attacked.

[0087] Therefore, in the attack determination method provided by the embodiment of the present invention, since the network traffic data can accurately characterize the actual state of data transmission in the network world, and the first data and the second data obtained from the network traffic data for characterizing the data download behavior can accurately describe each data download behavior of the electronic device, and the download result associated with the data download behavior, then, aggregating the first data and the second data can accurately and comprehensively reproduce the result of whether the electronic device is attacked and the process of being attacked; and since attack behaviors such as APT are usually related to data download behaviors, therefore, when the above-mentioned attack determination method is applied to threat hunting scenarios, it can get rid of the dependence on pre-set rules and security detection experts, so that threat hunting can be flexibly, accurately and comprehensively performed.

[0088] Based on the foregoing embodiment, in the attack determination method provided in the embodiment of the present invention, obtaining the second data from the network traffic data can be implemented in the following manner:

[0089] Based on the first data, correlation matching is performed on the data in the network traffic data to obtain the second data.

[0090] Exemplarily, the time point of the data download behavior in the first data can be obtained, and based on the time point, the data in the network traffic data can be time-correlated or logically correlated to obtain the second data; exemplary, the second data can include data in the network traffic data before and / or after the moment when the data download behavior in the first data occurs; exemplary, the second data can include data in the network traffic data that is causally related to the data download behavior in the first data.

[0091] It can be seen from the above that the attack determination method provided by the embodiment of the present invention can perform correlation matching on the data in the network traffic data based on the first data to obtain the second data.

[0092] Therefore, the attack determination method provided by the embodiment of the present invention obtains second data by associating and matching the first data representing the data download behavior with the data in the network traffic data, so that the second data can comprehensively and accurately reproduce the operations performed by the electronic device before and after the data download behavior, as well as the association relationship between various operations.

[0093] Based on the above-mentioned embodiment, in the attack determination method provided by the embodiment of the present invention, the data in the network traffic data is associated and matched based on the first data to obtain the second data, which can be obtained by Figure 2 The process shown is implemented as follows, Figure 2 A schematic diagram of a process for obtaining second data provided by an embodiment of the present invention, such as Figure 2 As shown, the process may include steps 201 to 202:

[0094] Step 201: Acquire address information of data downloading behavior from first data.

[0095] In one embodiment, the above-mentioned address information may include the address of the electronic device that performs the data downloading behavior; exemplarily, the address information may include at least one of the Internet Protocol (IP) address, the Media Access Control (MAC) address, and the Domain Name System (DNS) address of the electronic device; exemplarily, the address information may also include the identifier of the device group to which the electronic device belongs and / or the device identifier of the electronic device, which is not limited to the embodiments of the present invention.

[0096] In one implementation, the address information may include a source address of the download data corresponding to the data download behavior. Exemplarily, the source address may include an address of the attacking device.

[0097] Exemplarily, the attack determination device may filter the first data by regular matching to obtain the address information.

[0098] Step 202: Filter and match the third data based on the address information to obtain the second data.

[0099] The third data includes data in the network traffic data excluding the first data.

[0100] Exemplarily, the second data may be obtained by any of the following methods:

[0101] In the case where the address information is the address of the attacked device, the address information in the third data is screened and matched based on the address information to obtain the data of the attacked device that is time-related to the data download behavior, and the data is determined as the second data; illustratively, the number of the above-mentioned attacked devices can be at least one.

[0102] In the case where the address information represents the address of the attacking device, the address information in the third data is screened and matched based on the address information to obtain subsequent behavior data of the attacking device related to the data downloading behavior, and the subsequent behavior data of the attacking device is determined as the second data; illustratively, the number of attacking devices can also be at least one.

[0103] From the above, it can be seen that in the attack determination method provided by the embodiment of the present invention, after obtaining the address information of the data download behavior from the first data, the third data other than the first data in the network traffic data can be screened and matched based on the address information to obtain the second data.

[0104] Therefore, since the address information can represent the address of the electronic device that performs the data download behavior, and can also represent the address of the attack device that triggers the data download behavior, then the second data obtained by screening and matching the third data based on the address information not only includes the electronic device that performs the data download behavior and the state of performing the data download behavior, but also can cover the information of the attack device that triggers the data download behavior, so that the second data can comprehensively and accurately reflect the attack process related to the actual data download behavior from the dimensions of the attacked device and the attacking device. When the above scheme is applied to the threat hunting scenario, the second data obtained by the above method can comprehensively reflect the process of the APT initiator device launching the attack.

[0105] Based on the above embodiment, in the attack determination method provided by the embodiment of the present invention, the third data is screened and matched based on the address information to obtain the second data, which can be achieved through steps A1 to A2:

[0106] Step A1: Determine time period information.

[0107] In one embodiment, the time period information may be pre-set; illustratively, the time period information may be determined and adjusted based on at least one factor including the type, function, working status, attack determination requirements, and data processing capability of the electronic device corresponding to the network traffic data, and the embodiments of the present invention are not limited to this.

[0108] In one embodiment, the time period information may include a time point or time period carried by the first data. For example, the execution time of the data download behavior indicated by the first data is the first moment, then the time period information may include the first moment; exemplarily, the time period information may include a period of time before the time point or time period carried by the first data. For example, the time period information may include a period of time from a second moment to a first moment, wherein the second moment may be earlier than the first moment, and the period of time between the first moment and the second moment may be, for example, 24 hours; exemplarily, the first moment may not be the starting point or end point of the time period information, and the time period information may include a period of time before the first moment, and may also include a period of time after the first moment.

[0109] Step A2: based on the address information, filter and match the data corresponding to the time period information in the third data to obtain the second data.

[0110] Exemplarily, the data corresponding to the time period information in the third data can be obtained first, and then the data corresponding to the time period information in the third data can be filtered and matched based on the address information to obtain the second data. The third data can also be first filtered and matched based on the address information to obtain the filtered matching results, and then the filtered matching results can be divided based on the time period information to obtain the second data.

[0111] It can be seen from the above that the attack determination method provided in the embodiment of the present invention can, after determining the time period information, filter and match the data corresponding to the time period information in the third data based on the address information to obtain the second data.

[0112] Therefore, in the attack determination method provided by the embodiment of the present invention, redundant data in the third data can be eliminated through the above method, thereby reducing the amount of calculation in the attack determination process; and, based on the address information, when the data corresponding to the time period information in the third data is screened and matched to obtain the second data, by adjusting the time period information, the historical performance of the data associated with the data download behavior in different time windows can be obtained, thereby making the method of determining the second data more flexible.

[0113] When the above scheme is applied to the threat hunting scenario, since the APT attack method has specific time characteristics, determining the time period information based on the APT attack characteristics can enable the second data obtained by the above method to fully reflect the various states of the APT attack process.

[0114] Based on the foregoing embodiment, in the attack determination method provided in the embodiment of the present invention, the first data and the second data are aggregated to determine whether the electronic device corresponding to the network traffic data is attacked. Figure 3A The process shown is implemented as follows, Figure 3A A schematic diagram of a process for determining whether an electronic device is attacked provided by an embodiment of the present invention, such as Figure 3A As shown, the process may include steps 301 to 303:

[0115] Step 301: Acquire address information of data downloading behavior from first data.

[0116] Exemplarily, the address information may include the address of the electronic device that performs the data downloading behavior.

[0117] Step 302: Obtain, from the second data, associated information within a specified time period associated with the address information.

[0118] In one implementation, the associated information may include information about operations performed by the electronic device that performs the data downloading behavior before, during, and after the data downloading behavior is completed.

[0119] In one implementation, the associated information may include the reason for triggering the electronic device to execute the data download behavior, and the impact of the data download behavior on the electronic device or the device group to which the electronic device belongs after the data download behavior is completed.

[0120] Exemplarily, a time window including the triggering moment of the data downloading behavior can be determined, and the second data within the time window can be determined as associated information; exemplary, the above-mentioned time window can include a specified time period; exemplary, the specified time period can be the time period information in the aforementioned embodiment.

[0121] Step 303: Aggregate the address information and associated information to determine whether the electronic device has been attacked.

[0122] Exemplarily, the degree of correlation between the address information and the associated information can be analyzed. If the degree of correlation is greater than a correlation threshold, the address information and the associated information can be aggregated according to the attack determination strategy to determine whether the electronic device has been attacked. Exemplarily, if the degree of correlation is less than or equal to the correlation threshold, the address information and the associated information can be discarded.

[0123] Exemplarily, the associated information can be analyzed to determine the risk level corresponding to the associated information. If the risk level is greater than the risk threshold, the address information and the associated information are feature analyzed and processed according to the attack determination strategy to determine whether the electronic device has been attacked. Exemplarily, if the risk level is less than or equal to the risk threshold, the associated information and address information can be discarded.

[0124] Exemplarily, the attack determination strategy may include at least one of an algorithm for analyzing and processing address information and associated information, a type of feature detection model, and a structure of the feature detection model, which is not limited in the embodiment of the present invention.

[0125] In the threat hunting scheme of related technologies, professional technicians need to analyze massive amounts of traffic data to determine whether an APT attack has occurred. In the embodiments of the present invention, by obtaining address information and associated information of data download behavior from network traffic data, it is possible to quickly and easily determine whether an electronic device has been attacked, thereby reducing the reliance on professional technicians and a large amount of traffic data.

[0126] From the above, it can be seen that the attack determination method provided by the embodiment of the present invention can aggregate the address information and the associated information after obtaining the address information of the data download behavior from the first data and obtaining the associated information within a specified time period associated with the address information from the second data, so as to determine whether the electronic device has been attacked.

[0127] Therefore, in the attack determination method provided by the embodiment of the present invention, the electronic device that performs the data download behavior can be locked through the address information, and the electronic device that performs the data download behavior and the process before and after the data download behavior can be locked through the associated information within a specified time period associated with the address information. Then, the attack result determined by analyzing and processing the address information and the associated information can not only characterize the risk probability or risk level of the data download behavior performed by the electronic device, but also characterize the reasons and impacts of the data download behavior performed by the electronic device, thereby being able to comprehensively and accurately reflect the network security status of the electronic device from multiple dimensions.

[0128] Based on the above embodiments, in the attack determination method provided in the embodiment of the present invention, the address information and the associated information are aggregated to determine whether the electronic device is attacked, which can be achieved through steps B1 to B2:

[0129] Step B1: Associating the address information and the associated information to obtain attack information associated with the attacking device and attack result information associated with the electronic device.

[0130] In one embodiment, the attack device may include a remote device; exemplarily, the attack device may include a server device or a PC, such as a device that initiates an APT; exemplarily, the attack device may include a physical machine device or a virtual machine device; exemplarily, the number of attack devices may be multiple, in which case the types of the multiple attack devices may be different.

[0131] In one implementation, the attack information associated with the attacking device may include at least one of the time when the attacking device launches an attack on the electronic device, the attack type, the attack method, the attack target, and the attack result return method.

[0132] In one embodiment, the attack result information associated with the electronic device may include at least one of the following information: the electronic device is successfully attacked, the electronic device is attacked but fails, the number of times or frequency of the electronic device being attacked, and the state information of the electronic device after being attacked; exemplarily, the attack information may include an Indicator Of Compromise (IOC), where the IOC may include a URL, DNS, file hash value (File Hash), and host registry value (Registry) that are highly related to the attacking device.

[0133] Exemplarily, the address information and the associated information can be associated based on the time information carried in the address information and the time information carried in the associated information, so as to obtain a series of operations performed by the electronic device before and after the attack and the state of the electronic device before and after the series of operations are performed; exemplary, information such as the time when the electronic device performs the data download behavior, the triggering device of the data download behavior, and the reason for triggering the electronic device to perform the data download behavior can be the attack information associated with the attacking device, and the operation or state information associated with the data download behavior before and after the electronic device performs the data download behavior can be the attack result information associated with the electronic device.

[0134] Step B2: Aggregate the attack information and the attack result information to determine whether the electronic device has been attacked.

[0135] Exemplarily, the first operation and the first time can be obtained from the attack information, and the second operation, the second time, and information associated with the second operation can be obtained from the attack result information. Based on the first time and the second time, the first operation, the second operation, and the information associated with the second operation are aggregated and summarized. Information such as the reason why the electronic device performs the data download behavior, the execution process of the data download behavior, and the impact of each link of the data download behavior on the operating status and / or data security of the electronic device can be obtained, and whether the electronic device has been attacked can be determined based on this information.

[0136] Exemplarily, the attack information and the attack result information may be aggregated based on the DNS of the Uniform Resource Locator (URL) of the download data corresponding to the data download behavior and the address of the attack device, such as the IP.

[0137] Exemplarily, the attack result of whether an electronic device has been attacked may include information such as the induction, execution, and impact of the malicious data downloading behavior from the dimensions of the attacking device and the attacked device, so that the attack result can comprehensively and multi-dimensionally reflect information such as the attack behavior initiation process, the attack behavior execution process, and the impact of the attack behavior.

[0138] From the above, it can be seen that the attack determination method provided by the embodiment of the present invention can associate address information and associated information, obtain attack information associated with the attacking device and attack result information associated with the electronic device, and then aggregate the attack information and attack result information to determine whether the electronic device has been attacked.

[0139] Therefore, the attack determination method provided by the embodiment of the present invention can comprehensively and accurately reproduce the changes in the state of the electronic device from the initiation, execution to the subsequent impact of the attack behavior from the two dimensions of the attacking device and the attacked device, so as to not only accurately determine the attack results against the electronic device, but also reproduce the reasons for the above attack results. When the above method is applied to the threat hunting scenario, it can reflect the initiation, execution and impact of the APT attack in a multi-dimensional and comprehensive manner.

[0140] Furthermore, since the address information and the associated information are obtained from the first data and the second data respectively, the associated address information and the associated information, as well as the aggregate processing of the attack information and the attack result information, reflect the integration of multi-source security logs, thereby being able to efficiently and accurately capture security incidents, and quickly track the IOC of the attacking device, thereby improving the effect of determining the attack results.

[0141] Based on the above embodiments, in the attack determination method provided by the embodiment of the present invention, obtaining the first data from the network traffic data can be achieved through steps C1 to C3:

[0142] Step C1: Obtain download behavior characteristics.

[0143] In one implementation, the download behavior feature may be obtained by the attack determination device from other devices, or may be obtained from its storage space, which is not limited in this embodiment of the present invention.

[0144] In one embodiment, the download behavior feature may be determined by analyzing at least one of download time, download frequency, source address of downloaded data, and type of downloaded data in multiple types of data download behaviors.

[0145] In one embodiment, the download behavior characteristics can be determined by the attack determination device performing feature detection on massive network traffic data that includes data download behavior; illustratively, the interception field, return data packet, length of the return data packet, status code, and at least one of the target server type of the network traffic data can be analyzed to determine the download behavior characteristics.

[0146] Exemplarily, the download behavior features may be determined according to the target detection type. For example, if the target detection type is APT, the features of each link in the data download process of APT may be analyzed and these features may be determined as the download behavior features.

[0147] Step C2: Filter the network traffic data based on the download behavior characteristics to obtain fourth data.

[0148] Exemplarily, the download behavior feature may include a network interception feature, wherein the network interception feature may be reflected by an interception field.

[0149] Exemplarily, the interception field of the network traffic data can be determined. If the interception field indicates that the first download behavior is in an interception state, it can indicate that the first download behavior associated with the interception state has been connected to a security detection device such as a firewall device. In this case, the first download behavior is skipped and the network traffic data associated with the first download behavior is discarded.

[0150] Exemplarily, if the intercept field indicates that the second download behavior is in an unintercepted state, the return data packet associated with the second download behavior is obtained, and the return status code is obtained from the return data packet; if the return status code starts with 4 or 5, it may indicate that the second download behavior has failed due to a client or server error. At this time, the second download behavior can be skipped and the network traffic data associated with the second download behavior can be discarded.

[0151] For example, if the return status code of the return data packet associated with the second download behavior starts with 3, it may indicate that the second download behavior is redirected by the server. In this case, the second download behavior may be skipped and the network traffic data associated with the second download behavior may be discarded.

[0152] For example, if the return status code of the return data packet associated with the second download behavior does not start with 3, 4 or 5, but the length of the return data packet is 0, the second download behavior can be skipped and the network traffic data associated with the second download behavior can be discarded.

[0153] Exemplarily, if the interception field indicates that the third download behavior is in an unintercepted state, the status code of the return data packet associated with the third download behavior does not start with 3, 4 or 5, and the length of the return data packet of the third download behavior is not 0, then the network traffic data associated with the third download behavior can be obtained to obtain the fourth data.

[0154] Exemplarily, the first downloading behavior, the second downloading behavior, and the third downloading behavior may be any data downloading behavior included in the network traffic data.

[0155] Step C3: process the fourth data to obtain the first data.

[0156] Exemplarily, the fourth data may be classified and processed according to the device identification of the electronic device that performs the data downloading behavior, so as to obtain the first data; exemplary, the device identification may include the MAC address, IP address and DNS of the electronic device.

[0157] Exemplarily, time information may be acquired from the fourth data, and the fourth data may be sorted according to the time information of the fourth data, thereby acquiring the first data.

[0158] Exemplarily, redundant information in the fourth data may be removed, and the fourth data after the redundant information is removed may be determined as the first data.

[0159] From the above, it can be seen that the attack determination method provided by the embodiment of the present invention can, after obtaining the download behavior characteristics, filter the network traffic data based on the download behavior characteristics to obtain the fourth data, and then process the fourth data to obtain the first data.

[0160] Therefore, in the attack determination method provided by the embodiment of the present invention, since the download behavior characteristics can accurately reflect various types of data download behaviors such as APT and the typical characteristics of various devices when executing data download behaviors, the fourth data obtained by screening the network traffic data based on the download behavior characteristics includes log data of various types of data download behaviors executed by electronic devices such as APT. Then, the first data obtained by processing the fourth data can accurately reflect the historical data download behaviors executed by the electronic device, thereby providing an accurate data basis for the attack determination process.

[0161] Based on the foregoing embodiment, in the attack determination method provided in the embodiment of the present invention, the fourth data is processed to obtain the first data, which can be implemented in the following manner:

[0162] The address filtering information is obtained, and the fourth data is filtered based on the address filtering information to obtain at least the first data.

[0163] In one embodiment, the address filtering information may include information for filtering the address of the source device that triggers the data download behavior; exemplarily, the address filtering information may include a set of at least one target address; exemplarily, the above-mentioned target address may include an address with a threat level greater than or equal to a threat threshold, such as an address of a non-secure device or network; exemplarily, the above-mentioned target address may include an address with a threat level less than the threat threshold, such as a secure DNS set; exemplarily, the secure DNS set may include a DNS within a secure geographical area and registered with an Internet Content Provider (ICP), a well-known DNS, and a trusted DNS.

[0164] In one implementation, the fourth data may be screened in combination with at least one field in the data packet, such as a referer field and address screening information.

[0165] Exemplarily, the DNS of the URL of the data associated with the fourth download behavior in the fourth data can be obtained. If the DNS is a DNS in the security DNS set, the fourth download behavior can be a download behavior with a high security level. At this time, the data associated with the fourth download behavior in the fourth data can be discarded; exemplarily, if the DNS of the URL of the data associated with the fourth download behavior in the fourth data does not meet the above conditions, it can be preliminarily judged that the fourth download behavior may be a dangerous download behavior.

[0166] Exemplarily, if it is preliminarily determined that the fourth download behavior may be a dangerous download behavior, the referer field of the data return package contained in the data associated with the fourth download behavior in the fourth data is analyzed. If the DNS corresponding to the URL of the field belongs to a DNS in the safe DNS set, the fourth download behavior can be determined to be an erroneously recorded download behavior, and the data associated with the fourth download behavior in the fourth data can be discarded. Exemplarily, if the DNS of the referer field URL belongs to a DNS outside the safe DNS set, it is determined whether the fourth download behavior is a known download behavior. If it is a known download behavior, such as a test download behavior, the data associated with the fourth download behavior in the fourth data can be discarded.

[0167] Exemplarily, if the DNS of the referer field URL of the fourth download behavior belongs to a DNS outside the safe DNS set and the fourth download behavior is not a known download behavior, it is determined whether it is a low-risk download behavior, such as a download behavior triggered by software bound to a high-speed downloader; exemplarily, if the fourth download behavior is a low-risk download behavior, the data associated with the fourth download behavior in the fourth data can be discarded.

[0168] Exemplarily, if the DNS of the referer field URL of the fourth download behavior belongs to a DNS outside the safe DNS set, the fourth download behavior is not a known download behavior, and the fourth download behavior is not a low-risk download behavior, then the data associated with the fourth download behavior in the fourth data can be determined as part of the data in the first data.

[0169] By recursively filtering the data in the fourth data in the above manner, the first data can be obtained.

[0170] It can be seen from the above that the attack determination method provided by the embodiment of the present invention can, after acquiring the address screening information, perform screening processing on the fourth data based on the address screening information, thereby obtaining the first data.

[0171] Therefore, in the attack determination method provided by the embodiment of the present invention, after obtaining the fourth data matching the download behavior characteristics, the fourth data can be further screened based on the address filtering information, so that data with a higher threat level and related to the data download behavior can be obtained from the fourth data. In this way, not only the amount of redundant data in the first data is reduced, but also the accuracy of subsequent attack results can be improved.

[0172] Based on the above embodiments, the attack determination method provided by the embodiments of the present invention may further include steps D1 to D3:

[0173] Step D1: Determine level information of at least two attack results.

[0174] The attack result includes whether the electronic device has been attacked.

[0175] In one implementation, the number of attacks, attack sources, attack threat levels, and whether the attacks are successful in at least two attack results may be analyzed and judged according to a preset risk level determination rule, thereby determining the level information of each attack result.

[0176] In one embodiment, the attack results can be divided according to the number and / or frequency of malicious data downloading behaviors performed by a single electronic device in a unit time, and the degree of impact on the working state of the electronic device after performing the malicious data downloading behavior, thereby determining the level information of the attack results.

[0177] Step D2: sort at least two attack results based on the level information to obtain a sorting result.

[0178] Exemplarily, the attack results of a single electronic device may be sorted based on the level information, and the obtained sorting results may represent the attack status of the single electronic device within a certain period of time.

[0179] Exemplarily, the attack results of multiple electronic devices can be sorted based on the level information. The obtained sorting results can represent the impact of at least one malicious data downloading behavior on multiple electronic devices, and can also obtain the dangerous state of multiple electronic devices within a certain period of time.

[0180] Exemplarily, the attack results of multiple electronic devices can be sorted based on the level information, and the obtained sorting results can represent the prevention level of different security detection strategies set in the multiple electronic devices against at least one malicious data download behavior, and the attack depth of at least one malicious data download behavior on the security detection strategy.

[0181] Step D3: output the sorting result.

[0182] Exemplarily, the sorting results may be integrated into a text file or a chart file and output as the text file or the chart file; exemplary, the sorting results may be output in the form of audio, video, lighting, etc.

[0183] As can be seen from the above, in the attack determination method provided by the embodiment of the present invention, after determining the level information of at least two attack results, the at least two attack results can be sorted based on the level information to obtain a sorting result.

[0184] Therefore, the attack determination method provided by the embodiment of the present invention can organically integrate multiple scattered and independent attack results together, so that the sorting results can reflect the threat level of data downloading behavior to different electronic devices, or to electronic devices in different time periods, and thus the sorting results can more comprehensively reflect the impact depth and breadth of data downloading behavior from the time dimension and the device dimension.

[0185] Figure 3B A schematic diagram of a structure for determining an attack result provided by an embodiment of the present invention, such as Figure 3B As shown, the server device 304 can be a remote device that has established a communication connection with the terminal device group 305, or it can be a device located in the same physical space as the terminal device group 305; exemplarily, the server device 304 and / or the devices in the terminal device group 305 can be virtual machine devices or physical machine devices; exemplarily, the first device 3051 to the third device 3053 included in the terminal device group 305 can be the electronic devices in the aforementioned embodiments.

[0186] Exemplarily, the server device 304 can obtain the device security log of at least one device among the first device 3051 to the third device 3053; exemplary, the server device 304 can also obtain the network security log of any device in the terminal device group 305; exemplary, the server device 304 can also associate the device security log and the network security log according to time information and / or device information to obtain network traffic data.

[0187] Exemplarily, the server device 304 can obtain the first data and the second data from the network traffic data by the method provided in the aforementioned embodiment; and then aggregate the first data and the second data to determine whether at least one device in the terminal device group 305 is attacked.

[0188] Exemplarily, the server device 304 can obtain address information of data downloading behavior, such as APT downloading behavior, from the first data, and based on the above address information, filter and match the data corresponding to the predetermined time period information in the network traffic data except the first data, thereby obtaining the second data.

[0189] Exemplarily, the server device 304 can also obtain related information within a specified time period associated with the above-mentioned address information from the second data, such as the operations performed by the devices in the terminal device group 305 in the time period before and after the APT download behavior, and the sequence or causal relationship between the operations; the server device 304 can also aggregate the address information and related information to determine whether the devices in the terminal device group 305 have been attacked, such as whether they have been attacked by APT; exemplarily, the server device 305 can comprehensively and accurately display whether the devices in the terminal device group 305 have been attacked and the process of the attack from dimensions such as the time when the attacking device launches the attack, the source of the attack, the number of attacks, and the operations performed by the attacked device after the attack.

[0190] Exemplarily, the server device 304 can also sort the results of whether the devices in the terminal device group 305 have been attacked to obtain a sorting result; exemplary, the sorting result can display the threat prevention capabilities and threat prevention levels of each device in the terminal device group 305 or the terminal device group 305, thereby providing an overall basis for optimizing and updating the network security prevention strategy in the terminal device group 305.

[0191] From the above, it can be seen that the attack identification method provided in the embodiment of the present invention enables the server-side device to accurately and comprehensively determine whether a device in the terminal device group is attacked through the network traffic data of the terminal device group obtained by the server-side device without relying on the threat prevention experience of experts.

[0192] Figure 4A flow chart of APT detection provided by an embodiment of the present invention is as follows: Figure 4 As shown, the method may include:

[0193] Step 401, start.

[0194] Exemplarily, the attack determination device may switch to a ready state.

[0195] Step 402: APT security log preprocessing.

[0196] Exemplarily, the attack determination device can obtain network logs where APT may occur; exemplary, the network logs where APT may occur can be recorded as APT security logs; exemplary, the attack determination device can be an APT detection device, and the APT detection device can perform APT log preprocessing operations; exemplary, the APT security log can include the network traffic data in the aforementioned embodiments; exemplary, APT log preprocessing can include classifying APT security logs according to APT type data download behavior.

[0197] Step 403: Get the first log.

[0198] Exemplarily, the attack determination device may determine a log in the APT security log that corresponds to the APT download behavior as the first log.

[0199] Step 404: Get the second log.

[0200] Exemplarily, the attack determination device may determine a log associated with the first log in the APT security log as the second log.

[0201] Step 405: APT download behavior screening.

[0202] Exemplarily, the attack determination device may obtain APT download behavior characteristics, and filter the first log based on the APT download behavior characteristics through the method provided in the aforementioned embodiment to obtain a filtering result; exemplary, the filtering result may include the fourth data in the aforementioned embodiment.

[0203] Step 406: APT download domain name filtering.

[0204] Exemplarily, the attack determination device can obtain a secure DNS set, and perform an APT download domain name filtering operation on the screening result based on the secure DNS set, thereby obtaining a filtering result; exemplary, the filtering result can be the first data in the aforementioned embodiment; exemplary, the above-mentioned filtering operation can be consistent with the process of processing the fourth data based on the secure DNS set in the aforementioned embodiment to obtain the first data, which will not be repeated here.

[0205] Step 407: Log association.

[0206] Exemplarily, the attack determination device may associate the filtering result with the data in the second log within the time period corresponding to the filtering result; exemplary, the data in the second log within the time period corresponding to the filtering result may be the second data in the aforementioned embodiment.

[0207] Step 408: Aggregate the association results.

[0208] Exemplarily, the attack determination device may associate the attack information in the filtering result with the attack result information in the second log to obtain an APT detection result; exemplary, the APT detection result may include the attack result of whether the electronic device in the aforementioned embodiment has been attacked, such as the result of being attacked by an APT; exemplary, the APT detection result may include whether an APT has occurred, the APT level, and the number of APT occurrences, etc.

[0209] Step 409: Output the APT detection result.

[0210] Exemplarily, the attack determination device may output an APT detection result.

[0211] Step 410, end.

[0212] From the above, it can be seen that the attack determination method provided by the embodiment of the present invention can flexibly, efficiently and accurately determine the APT attack results through multi-source log association aggregation without relying on professional technicians and pre-set rules.

[0213] Based on the above embodiments, the embodiment of the present invention further provides an attack determination device 5, Figure 5 A schematic diagram of the structure of the attack determination device 5 provided in an embodiment of the present invention is shown in FIG. Figure 5 As shown, the device may include an acquisition module 501 and a determination module 502; wherein:

[0214] The acquisition module 501 is used to acquire network traffic data; acquire first data and second data from the network traffic data; wherein the first data includes data representing data downloading behavior in the network traffic data; and the second data includes context data associated with the data downloading behavior in the network traffic data;

[0215] The determination module 502 is used to aggregate the first data and the second data to determine whether the electronic device corresponding to the network traffic data is attacked.

[0216] In some embodiments, the attack determination device 5 further includes a processing module, which is used to perform correlation matching on the data in the network traffic data based on the first data to obtain the second data.

[0217] In some embodiments, the acquisition module 501 is used to acquire address information of the data download behavior from the first data;

[0218] The processing module is used to screen and match the third data based on the address information to obtain the second data; wherein the third data includes the data in the network traffic data excluding the first data.

[0219] In some embodiments, the determination module 502 is used to determine time period information;

[0220] The processing module is used to filter and match the data corresponding to the time period information in the third data based on the address information to obtain the second data.

[0221] In some embodiments, the acquisition module 501 is used to acquire address information of the data download behavior from the first data; acquire associated information within a specified time period associated with the address information from the second data;

[0222] The processing module is used to aggregate the address information and the associated information to determine whether the electronic device is attacked.

[0223] In some embodiments, the processing module is used to associate address information and associated information to obtain attack information associated with the attacking device and attack result information associated with the electronic device; aggregate the attack information and attack result information to determine whether the electronic device has been attacked.

[0224] In some embodiments, the acquisition module 501 is used to acquire download behavior characteristics;

[0225] The processing module is used to screen the network traffic data based on the download behavior characteristics to obtain fourth data; and process the fourth data to obtain at least the first data.

[0226] In some embodiments, the acquisition module 501 is used to acquire address screening information;

[0227] The processing module is used to filter the fourth data based on the address filtering information to obtain the first data.

[0228] In some embodiments, the determination module 502 is used to determine level information of at least two attack results; wherein the attack result includes a result of whether the electronic device is attacked;

[0229] The processing module is used to sort at least two attack results based on the level information to obtain a sorting result; and output the sorting result.

[0230] Based on the above embodiments, the embodiment of the present invention further provides an attack determination device 6, Figure 6 A schematic diagram of the structure of the attack determination device 6 provided in an embodiment of the present invention is shown in FIG. Figure 6 As shown, the device may include a processor 601 and a memory 602; wherein the memory 602 stores a computer program, and when the computer program is executed by the processor 601, it can implement the attack determination method provided in any of the previous embodiments.

[0231] The processor 601 may be at least one of ASIC, DSP, DSPD, PLD, FPGA, CPU, controller, microcontroller, and microprocessor. The memory may be a volatile memory, such as a random access memory (RAM); or a non-volatile memory, such as a read-only memory (ROM), flash memory, a hard disk drive (HDD) or a solid state drive (SSD); or a combination of the above types of memory, and provide instructions and data to the processor.

[0232] The acquisition module 501 , determination module 502 and processing module mentioned above may be implemented by the processor 601 .

[0233] Based on the foregoing embodiments, an embodiment of the present invention further provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor of an electronic device, the attack determination method provided in any of the foregoing embodiments can be implemented.

[0234] The above description of various embodiments tends to emphasize the differences between the various embodiments. The same or similar aspects can be referenced to each other, and for the sake of brevity, they will not be repeated herein.

[0235] The methods disclosed in the various method embodiments provided by the present invention can be arbitrarily combined without conflict to obtain new method embodiments.

[0236] The features disclosed in the various product embodiments provided by the present invention can be arbitrarily combined without conflict to obtain new product embodiments.

[0237] The features disclosed in the various method or device embodiments provided by the present invention can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

[0238] It should be noted that the above-mentioned computer-readable storage medium can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory (Flash Memory), a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM) and other memories; it can also be various electronic devices including one or any combination of the above-mentioned memories, such as mobile phones, computers, tablet devices, personal digital assistants, etc.

[0239] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0240] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0241] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus necessary general hardware nodes, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), including a number of instructions for an electronic device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present invention.

[0242] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0243] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0244] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0245] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. An attack determination method, characterized in that: The method comprises: Obtaining network traffic data; wherein the network traffic data is obtained by integrating the device security log and the network security log; the device security log is used to record the electronic device sending and receiving data and executing data processing; the network security log is used to record the data packet, request or instruction transmission process; Acquire first data from the network traffic data; wherein the first data includes data representing data downloading behavior in the network traffic data; Acquire second data from the network traffic data; wherein the second data includes context data associated with the data downloading behavior in the network traffic data; The first data and the second data are aggregated to determine whether the electronic device corresponding to the network traffic data is attacked.

2. The method according to claim 1, characterized in that The acquiring the second data from the network traffic data comprises: Based on the first data, the data in the network traffic data is correlated and matched to obtain the second data.

3. The method according to claim 2, characterized in that The step of performing correlation matching on the data in the network traffic data based on the first data to obtain the second data includes: Acquire address information of the data downloading behavior from the first data; The third data is screened and matched based on the address information to obtain the second data; wherein the third data includes data in the network traffic data excluding the first data.

4. The method according to claim 3, characterized in that The step of screening and matching the third data based on the address information to obtain the second data includes: Determine time period information; Based on the address information, data in the third data corresponding to the time period information is screened and matched to obtain the second data.

5. The method according to claim 1, characterized in that The aggregating the first data and the second data to determine whether the electronic device corresponding to the network traffic data is attacked includes: Acquire address information of the data downloading behavior from the first data; Acquire, from the second data, associated information within a specified time period associated with the address information; The address information and the associated information are aggregated to determine whether the electronic device is attacked.

6. The method according to claim 5, characterized in that The aggregating the address information and the associated information to determine whether the electronic device is attacked includes: Associating the address information with the associated information to obtain attack information associated with the attacking device and attack result information associated with the electronic device; Aggregate the attack information and the attack result information to determine whether the electronic device has been attacked.

7. The method according to claim 1, characterized in that The obtaining first data from the network traffic data includes: Get download behavior characteristics; Filtering the network traffic data based on the download behavior characteristics to obtain fourth data; The fourth data is processed to obtain the first data.

8. The method according to claim 7, characterized in that The processing of the fourth data to obtain the first data includes: Get address screening information; The fourth data is filtered based on the address filtering information to obtain the first data.

9. The method according to claim 1, characterized in that: The method further comprises: Determine level information of at least two attack results; wherein the attack result includes a result of whether the electronic device is attacked; Sorting at least two of the attack results based on the level information to obtain a sorting result; The sorting result is outputted.

10. An attack determination device, characterized in that: The device comprises: An acquisition module, used to acquire network traffic data; acquire first data and second data from the network traffic data; wherein the first data includes data in the network traffic data that characterizes data downloading behavior; the second data includes context data in the network traffic data that is associated with the data downloading behavior; the network traffic data is obtained by integrating a device security log and a network security log; the device security log is used to record the electronic device sending and receiving data and executing data processing; the network security log is used to record the data packet, request or instruction transmission process; A determination module is used to aggregate the first data and the second data to determine whether the electronic device corresponding to the network traffic data is attacked.

11. An attack determination device, characterized in that: The device includes a processor and a memory; a computer program is stored in the memory; when the computer program is executed by the processor, the attack determination method according to any one of claims 1 to 9 can be implemented.

12. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor of an electronic device, the attack determination method according to any one of claims 1 to 9 can be implemented.

Images