Scanning flow detection method, device, electronic device and storage medium

Abstract

The present application discloses a method, device, electronic device and storage medium for detecting scanning traffic, characterized in that the method includes: obtaining scanning traffic that meets preset conditions, the scanning traffic including multiple data packets; determining the number of similar data packets in the multiple data packets; and determining whether the scanning traffic is attack traffic based on the relationship between the number of similar data packets in the multiple data packets and a preset threshold.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computers, and in particular to a method, device, electronic device, and storage medium for detecting scanning traffic. Background Art

[0002] In related technologies, the detection of attack traffic is mainly based on known attack traffic characteristics, and corresponding detection rules are formulated. Attack traffic is detected by matching the attack traffic with the formulated detection rules. This method is easy to deploy and has a high accuracy rate for detecting known attack traffic. However, after the attacker uses deformation, obfuscation and other means to modify or deform the known attack traffic, the attack traffic cannot be detected using the pre-established detection rules. In addition, the existing method is also unable to detect unknown attack traffic. Summary of the Invention

[0003] To solve the above technical problems, embodiments of the present application provide a method, device, electronic device, and storage medium for detecting scanning traffic.

[0004] An embodiment of the present application provides a method for detecting scanning traffic, the method comprising:

[0005] Obtaining scanning traffic that meets preset conditions, wherein the scanning traffic includes multiple data packets;

[0006] determining a number of similar data packets among the plurality of data packets;

[0007] Whether the scanning traffic is attack traffic is determined based on a relationship between the number of similar data packets in the multiple data packets and a preset threshold.

[0008] In an optional implementation manner of the present application, before determining the number of similar data packets in the multiple data packets, the method further includes:

[0009] Filtering out attack data packets from the plurality of data packets using preset rules;

[0010] The determining of the number of similar data packets in the plurality of data packets includes: determining the number of similar data packets in a plurality of data packets other than the attack data packet in the plurality of data packets.

[0011] In an optional implementation manner of the present application, determining the number of similar data packets in the multiple data packets includes:

[0012] performing generalization processing on each data packet in the plurality of data packets to obtain a generalized sequence of each data packet;

[0013] Combining the plurality of data packets in pairs, and determining, for the two data packets included in each combination, similarity between the two data packets based on generalized sequences of the two data packets;

[0014] Based on the similarity of every two data packets after the plurality of data packets are combined in pairs, the number of similar data packets in the plurality of data packets is determined.

[0015] In an optional embodiment of the present application, performing generalization processing on each of the multiple data packets to obtain a generalized sequence of each data packet includes:

[0016] Generalizing the target path of each data packet in the plurality of data packets to obtain a generalized sequence of the target path of each data packet; and / or generalizing the file name of each data packet in the plurality of data packets to obtain a generalized sequence of the file name of each data packet.

[0017] In an optional embodiment of the present application, determining the similarity of the two data packets included in each combination based on the generalized sequences of the two data packets includes:

[0018] For the two data packets included in each combination, the similarity between the two data packets is determined based on the similarity of the generalized sequences of the target paths of the two data packets; or,

[0019] For the two data packets included in each combination, the similarity between the two data packets is determined based on the similarity of the generalized sequences of the file names of the two data packets; or,

[0020] For two data packets included in each combination, the similarity between the two data packets is determined based on a weighted similarity of similarities of generalized sequences of target paths of the two data packets and similarities of generalized sequences of file names of the two data packets.

[0021] In an optional embodiment of the present application, generalizing the target path of each data packet in the multiple data packets to obtain a generalized sequence of the target path of each data packet includes:

[0022] For a target path of each data packet in the plurality of data packets, representing each type of character in the target path with a symbol corresponding to each type of character to obtain a generalized sequence of the target path;

[0023] The generalizing the file name of each data packet in the plurality of data packets to obtain a generalized sequence of the file name of each data packet includes:

[0024] For the file name of each data packet in the multiple data packets, each type of character in the file name is represented by a symbol corresponding to each type of character to obtain a generalized sequence of the file name.

[0025] In an optional implementation manner of the present application, obtaining the scanning traffic that meets the preset conditions includes:

[0026] Obtain scanning traffic for backdoor files.

[0027] The present application also provides a scanning flow detection device, the device comprising:

[0028] An obtaining unit, configured to obtain scanning traffic that meets a preset condition, wherein the scanning traffic includes a plurality of data packets;

[0029] a first determining unit, configured to determine the number of similar data packets among the plurality of data packets;

[0030] The second determining unit is configured to determine whether the scanning traffic is attack traffic based on a relationship between the number of similar data packets in the multiple data packets and a preset threshold.

[0031] In an optional embodiment of the present application, before the first determining unit determines the number of similar data packets in the multiple data packets, the apparatus further includes:

[0032] a screening unit, configured to screen out attack data packets from the plurality of data packets using preset rules;

[0033] The first determining unit is specifically configured to determine the number of similar data packets among the multiple data packets excluding the attack data packet.

[0034] In an optional embodiment of the present application, the first determination unit is specifically used to: generalize each data packet in the multiple data packets to obtain a generalized sequence of each data packet; combine the multiple data packets in pairs, and for two data packets included in each combination, determine the similarity of the two data packets based on the generalized sequences of the two data packets; and determine the number of similar data packets in the multiple data packets based on the similarity of each two data packets after the multiple data packets are combined in pairs.

[0035] In an optional embodiment of the present application, the first determination unit is specifically used to: generalize the target path of each data packet in the multiple data packets to obtain a generalized sequence of the target path of each data packet; and / or generalize the file name of each data packet in the multiple data packets to obtain a generalized sequence of the file name of each data packet.

[0036] In an optional embodiment of the present application, the first determination unit is specifically used to: determine, for the two data packets included in each combination, the similarity between the two data packets based on the similarity of the generalized sequences of the target paths of the two data packets; or, determine, for the two data packets included in each combination, the similarity between the two data packets based on the similarity of the generalized sequences of the file names of the two data packets; or, determine, for the two data packets included in each combination, the similarity between the two data packets based on the weighted similarity of the similarity of the generalized sequences of the target paths of the two data packets and the similarity of the generalized sequences of the file names of the two data packets.

[0037] In an optional embodiment of the present application, the first determination unit is specifically used to: for the target path of each data packet in the multiple data packets, represent each type of character in the target path with a symbol corresponding to each type of character, and obtain a generalized sequence of the target path; for the file name of each data packet in the multiple data packets, represent each type of character in the file name with a symbol corresponding to each type of character, and obtain a generalized sequence of the file name.

[0038] In an optional implementation manner of the present application, the obtaining unit is specifically used to obtain the scanning traffic of the backdoor file whose object to be scanned is a backdoor file.

[0039] An embodiment of the present application also provides an electronic device, which includes: a memory and a processor, wherein the memory stores computer-executable instructions, and when the processor runs the computer-executable instructions on the memory, the scanning traffic detection method described in the above embodiment can be implemented.

[0040] An embodiment of the present application further provides a computer storage medium, on which executable instructions are stored. When the executable instructions are executed by a processor, the scanning traffic detection method described in the above embodiment is implemented.

[0041] The technical solution of the embodiment of the present application obtains scanning traffic that meets preset conditions, wherein the scanning traffic includes multiple data packets; determines the number of similar data packets in the multiple data packets; and determines whether the scanning traffic is attack traffic based on the relationship between the number of similar data packets in the multiple data packets and a preset threshold. The technical solution of the embodiment of the present application can detect unknown backdoor scanning traffic based on the attack characteristics of backdoor scanning and the similarity between multiple scans. The technical solution is applicable to various products such as application layer firewalls, website application-level intrusion prevention systems (WAFs), and security situation awareness. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1A flow chart of a method for detecting scanning traffic provided in an embodiment of the present application;

[0043] Figure 2 A schematic diagram of the structure of a flow rate scanning detection device provided in an embodiment of the present application;

[0044] Figure 3 A schematic diagram of the structural composition of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0045] In order to enable a more detailed understanding of the features and technical contents of the embodiments of the present application, the implementation of the embodiments of the present application is described in detail below with reference to the accompanying drawings. The attached drawings are for reference only and are not used to limit the embodiments of the present application.

[0046] The following is an explanation of key terms related to the embodiments of this application:

[0047] Backdoor scanning targets WebShell backdoor scanning behaviors in network communications. It is generally used to detect whether there are backdoor files uploaded by other attackers on a certain system website, or if the attacker uploads the backdoor file himself but does not know the specific location of the backdoor file after uploading, the attacker needs to scan and traverse to obtain the backdoor file location.

[0048] A session, also known as a session, represents the sequence of all traffic between a client and a server within a certain period of time in a communication session. A session can be defined by the source Internet Protocol (IP) address + destination IP address or other methods.

[0049] An application layer firewall, also known as a Web Application Firewall (WAF), is a product that specifically protects web applications by implementing security policies for protocols such as Hypertext Transfer Protocol (HTTP) and Hypertext Transfer Protocol over Secure Socket Layer (HTTPS).

[0050] Traffic, here also refers to data packets, which are divided into request packets and response packets. It is the data format transmitted on the network. It generally consists of a data packet header and transmission content. The transmission content is generally displayed in plain text.

[0051] Scanner fingerprints are identification information of some scanner tools that include their own tool logos (i.e., logos). These information is usually present in the User-Agent field (a field in the HTTP request header).

[0052] WebShell upload bypasses suffix fingerprints. When an attacker bypasses file upload detection by modifying the file name suffix, the special character feature information in the file name suffix is generally used in conjunction with middleware.

[0053] Script files are files that can interact with users and perform certain functions, usually ending with .php, .asp, .jsp, etc.

[0054] 404 response code. When the page accessed by the user does not exist on the server, the status response code returned by the server is 404. If the page accessed by the user has been removed, 301 / 302 may be returned. For the sake of convenience, the following is collectively referred to as the 404 response code.

[0055] Backdoor scanning is primarily used in two scenarios: 1. An attacker uses it to detect whether a website has a WebShell backdoor file uploaded by another attacker; 2. An attacker uploads a backdoor file but does not know its specific location. In either scenario, it's difficult for an attacker to find the backdoor file in a single scan; multiple scans are usually required to locate the backdoor file.

[0056] In an optional implementation of the present application, the following method can be used to detect backdoor scanning traffic:

[0057] 1. Detect backdoor scanning traffic using detection rules. For example, detection rule signatures include suspicious file names (such as shell.php) in the Uniform Resource Locator (URL) and sensitive system component paths (such as / FCKeditor / editor). Rule-based detection methods can only detect known attack patterns, making it extremely easy for attackers to circumvent detection rules. For example, simply modifying the backdoor file name can bypass the detection rules.

[0058] 2. Detect backdoor scanning traffic based on the statistical characteristics of 404 response codes. This method primarily exploits the fact that URLs scanned multiple times consistently do not exist (response code 404). The drawback of this method is that false positives are difficult to control, for example, some legitimate links may become invalid. Furthermore, interception based on time and frequency is easily bypassed by slow scans (such as those currently available with some scanning tools that support slow scan detection).

[0059] Based on the shortcomings of the above-mentioned detection methods, the embodiments of the present application propose a method for detecting backdoor scanning traffic. This method, based on the fact that it is difficult for an attacker to hit a backdoor file with a single scan, and therefore multiple scan operations are usually required to scan for the backdoor file, utilizes the behavioral similarity of multiple scans. By determining whether there is a significant similarity between consecutive scan behaviors, if the similarity between consecutive scan behaviors exceeds a certain threshold, the backdoor scanning traffic is considered to be a backdoor scanning attack. In addition to being able to detect known backdoor scanning attacks, this solution of the present application also has the ability to detect unknown backdoor scanning attacks.

[0060] Figure 1 A flow chart of a method for detecting scanning traffic provided in an embodiment of the present application is shown as follows: Figure 1 As shown, the scanning traffic detection method provided in the embodiment of the present application includes the following steps:

[0061] Step 101: Obtain scanning traffic that meets preset conditions, where the scanning traffic includes multiple data packets.

[0062] In an optional embodiment of the present application, the scanning traffic is specifically backdoor scanning traffic, and the file to be scanned by the backdoor scanning traffic needs to be a backdoor file. The step of obtaining the scanning traffic that meets the preset conditions is specifically: obtaining the scanning traffic whose object to be scanned is a backdoor file.

[0063] Scanning traffic is data generated by attackers performing backdoor scanning operations. These operations are performed using one or more sessions. A session consists of multiple requests, each of which is an HTTP message, and each message is a data packet. Each data packet contains the URL of the backdoor file the attacker is scanning for. This URL includes the file's storage path and file name.

[0064] Backdoor files differ from ordinary files in that they are generally script files. Common script files include, but are not limited to, those with suffixes like ".php," ".asp," and ".jsp." Attackers may exploit file extension bypass techniques to target the file names of backdoor files in the packets included in the scanned traffic. For example, attackers may add redundant information to file extensions like "xxx.asp," ".jpg," "xxx.asp," or "x.jpg," or modify the file extensions to distort the file names of the backdoor files in the packets of the scanned traffic.

[0065] After obtaining the scanning traffic, the present application needs to check the keywords in the URL of each data packet contained in the scanning traffic. For files with set keywords (specifically keywords set according to the suffix of the script file) in the URL of the data packet, it is determined that the object to be accessed by the data packet is a backdoor file, and subsequent steps 102 and 103 are executed for each data packet with the set keywords in the URL. For data packets without the set keywords in the URL of the data packet, it is determined that the object to be accessed by the data packet is not a backdoor file, and the subsequent processing flow of steps 102 and 103 is not executed for the data packet.

[0066] Step 102: Determine the number of similar data packets in the multiple data packets.

[0067] In an optional implementation manner of the present application, before executing the above step 102, the following step may also be executed: using preset rules to filter out attack data packets from the multiple data packets.

[0068] After filtering out the attack data packet from the plurality of data packets using the preset rule, the step 102 includes: determining the number of similar data packets in the plurality of data packets other than the attack data packet.

[0069] In the embodiment of the present application, filtering data packets using preset rules includes filtering data packets using pre-calculated backdoor features. The pre-calculated backdoor features are obtained by statistically analyzing the features of known backdoor scanning traffic. The pre-calculated backdoor features are backdoor features that include some special keywords or special tags, specifically including but not limited to the following features:

[0070] 1. Common scanner fingerprints. Some scanner tools have unique fingerprint features, and the fingerprint features of scanner tools have strong credibility.

[0071] 2. File name characteristics. Some attackers habitually use specific file names or suspicious directories (such as / FCKeditor / editor / filemanager / ); or exploit file name parsing vulnerabilities to bypass security devices, such as the Internet Information Services (IIS) parsing vulnerability, such as xxx.asp / x.jpg, xxx.asp, .jpg, etc.

[0072] By filtering attack packets in the scanning traffic, known attack traffic in the scanning traffic can be filtered out.

[0073] In an optional implementation manner of the present application, the above step 102 can be implemented by the following process:

[0074] performing generalization processing on each data packet in the plurality of data packets to obtain a generalized sequence of each data packet;

[0075] Combining the plurality of data packets in pairs, and determining, for the two data packets included in each combination, similarity between the two data packets based on generalized sequences of the two data packets;

[0076] Based on the similarity of every two data packets after the plurality of data packets are combined in pairs, the number of similar data packets in the plurality of data packets is determined.

[0077] In an embodiment of the present application, generalizing a data packet means summarizing the data by replacing relatively low-level values (e.g., the numerical value of the attribute age) contained in the data packet with higher-level concepts (e.g., youth, middle-aged, and old age). Taking a specific generalization method as an example, in general, a data packet may include a character sequence consisting of characters such as numbers, letters, and special characters. When generalizing the data contained in the data packet, the numbers in the data packet character sequence can be represented by the same type of characters, for example, the numbers "1", "2", "3" and other numbers in the data packet character sequence are all represented by the number "0"; similarly, the letters in the data packet character sequence can be represented by the same type of characters, for example, the letters "m", "n", "z" and other letters in the data packet character sequence are all represented by the letter "a"; in addition, the special characters in the data packet character sequence are represented by the same type of characters, for example, the special characters "_", "!", "*" and other special characters in the data packet character sequence are all represented by the character "*". According to the above generalization method, for a data packet containing the following character sequence “ / Count_n / image2 / 20130825900 / ”, the generalized sequence corresponding to the character sequence contained in the data packet can be obtained as “ / a*a / a0 / 0 / ”.

[0078] In the embodiment of the present application, since each data packet contains the path information (i.e., URL information) of the backdoor file to be scanned, the embodiment of the present application performs generalization processing on each data packet, which is actually generalization processing of the path information contained in the data packet. Here, the path information contained in the data packet includes the directory path information and file name information of the backdoor file to be scanned by the attacker, wherein the directory path is used to indicate the location of the backdoor file, and the file name information is used to indicate the name of the file under the directory path.

[0079] In an optional embodiment of the present application, based on the specific information included in the path information of the data packet, the step of performing generalization processing on each of the multiple data packets to obtain a generalized sequence of each data packet can be specifically implemented by the following process:

[0080] Generalizing the target path of each data packet in the plurality of data packets to obtain a generalized sequence of the target path of each data packet; and / or generalizing the file name of each data packet in the plurality of data packets to obtain a generalized sequence of the file name of each data packet.

[0081] Here, the target path is the directory path contained in the data packet. The embodiment of the present application generalizes each data packet contained in the scan traffic, mainly generalizing the directory path contained in each data packet, generalizing the file name contained in each data packet, or generalizing both the directory path and the file name contained in each data packet.

[0082] An attack scan initiated by an attacker is a communication session, consisting of multiple data packets. Each data packet contains the path to the backdoor file the attacker is scanning for. When performing backdoor scans, attackers often send multiple data packets in a single session, often with some similarity between them. For example, attackers may scan for multiple suspicious files in the same or similar directories.

[0083] The Session sequence 1 shown in Table 1 is a directory path sequence corresponding to the four data packets included in a communication session, where PKG1, PKG2, PKG3, and PKG4 represent Session sequence 1 data packet 1, data packet 2, data packet 3, and data packet 4, respectively.

[0084] Table 1 Session sequence 1

[0085]

[0086] The Session sequence 2 shown in Table 2 is a sequence of file names corresponding to the four data packets included in a communication session.

[0087] Table 2 Session sequence 2

[0088]

[0089] In an optional implementation of the present application, the target path of each data packet in the multiple data packets may be generalized in the following manner to obtain a generalized sequence of the target path of each data packet:

[0090] For a target path of each data packet in the plurality of data packets, representing each type of character in the target path with a symbol corresponding to each type of character to obtain a generalized sequence of the target path;

[0091] Specifically, in an optional embodiment of the present application, for Session sequence 3 shown in the first column of Table 3, for the directory path of each data packet, the alphabetic characters in the directory path are represented by the letter "a", the numeric characters in the directory path are represented by the number "0", and the special characters in the directory path (except " / ") are represented by "*". Figure 3 The second column is the Token sequence obtained by generalizing the directory path of each data packet.

[0092] Table 3 Session sequence 3

[0093]

[0094]

[0095] The step of generalizing the file name of each data packet in the plurality of data packets to obtain a generalized sequence of the file name of each data packet may also be performed in the same manner as the generalization of the target path, specifically as follows:

[0096] For the file name of each data packet in the multiple data packets, each type of character in the file name is represented by a symbol corresponding to each type of character to obtain a generalized sequence of the file name.

[0097] The file name information included in each data packet in the conversation sequence may have the same name but different file types, or the character types of the file names in different data packets may be the same. The file names in each data packet in the conversation sequence may be generalized using the same generalization method as the directory path described above to obtain a generalized sequence of file names in each data packet in the conversation sequence.

[0098] In an optional embodiment of the present application, for the two data packets included in each combination, the similarity between the two data packets can be determined based on the following method to determine the generalized sequences of the two data packets:

[0099] For the two data packets included in each combination, the similarity between the two data packets is determined based on the similarity of the generalized sequences of the target paths of the two data packets; or,

[0100] For the two data packets included in each combination, the similarity between the two data packets is determined based on the similarity of the generalized sequences of the file names of the two data packets; or,

[0101] For two data packets included in each combination, the similarity between the two data packets is determined based on a weighted similarity of similarities of generalized sequences of target paths of the two data packets and similarities of generalized sequences of file names of the two data packets.

[0102] In the embodiment of the present application, for the directory paths contained in any two data packets in the session sequence, the string similarity algorithm Levenshtein distance can be used to measure the distance dist between the generalized sequences of the two directory paths. dir , using this distance value to represent the similarity of the two directory paths, according to the distance dist of the generalized sequences of the two directory paths dir The relationship between the two directory paths and the first distance threshold is used to determine whether the two directory paths are similar. Here, the value of the first distance threshold can be set as needed. For example, the first distance threshold can be set to 0.6. Here, the method for calculating the similarity between the generalized sequences of the two directory paths is not limited to the above-mentioned string similarity algorithm. Other similarity calculation methods, such as fuzzy hashing algorithms, can also be used to calculate the similarity between the generalized sequences of the two directory paths.

[0103] For the file names contained in any two data packets in the session sequence, the distance dist between the generalized sequences of the two file names can also be measured using the same method as the similarity of the directory path. file .

[0104] Based on the method for calculating the similarity of the generalized sequences of the directory paths of two data packets and the method for calculating the generalized sequences of the file names of two data packets introduced in this application, this application can determine the number of similar data packets in a session sequence only through the generalized sequences of the directory paths of each data packet included in the session sequence, and can also determine the number of similar data packets in a session sequence only through the generalized sequences of the file names of each data packet included in the session sequence.

[0105] As a preferred embodiment, the present application embodiment can determine the similarity of two data packets by combining the similarity of the generalized sequence of the directory path of the two data packets and the similarity of the generalized sequence of the file name. dir and dist file The similarity between two data packets is represented by the weighted sum of the weighted distance thresholds. If the weighted sum is greater than the weighted distance threshold, the two data packets are considered similar. Here, the weighted distance threshold can be set as required. For example, the weighted distance threshold can be set to 0.6.

[0106] Step 103: Determine whether the scanning traffic is attack traffic based on a relationship between the number of similar data packets in the multiple data packets and a preset threshold.

[0107] Based on the above step 102, the number of similar data packets in the session sequence can be determined. In the embodiment of the present application, the value of the preset threshold can be determined based on the total number of data packets included in the session sequence (which can be understood as the ratio of the number of similar data packets in the session sequence to the total number of data packets must exceed a certain value). For example, if the total number of data packets included in the session sequence is 10, then when it is determined that the number of similar data packets included in the session sequence is 6 or more, the obtained scanning traffic is determined to be attack traffic, which can also be called attack scanning traffic.

[0108] The technical solution of the embodiment of the present application can detect unknown backdoor scanning traffic based on the attack characteristics of backdoor scanning and the similarities between multiple scans. It is suitable for various products such as application layer firewalls, website application-level intrusion prevention systems, and security situation awareness.

[0109] The present application also provides a scanning flow detection device. Figure 2 A schematic diagram of the structure of a flow scanning detection device provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, the device includes:

[0110] An obtaining unit 201 is configured to obtain scanning traffic that meets a preset condition, wherein the scanning traffic includes a plurality of data packets;

[0111] A first determining unit 202 is configured to determine the number of similar data packets in the plurality of data packets;

[0112] The second determining unit 203 is configured to determine whether the scanning traffic is attack traffic based on a relationship between the number of similar data packets in the multiple data packets and a preset threshold.

[0113] In an optional implementation manner of the present application, before the first determining unit 202 determines the number of similar data packets in the multiple data packets, the apparatus further includes:

[0114] A screening unit 204 is configured to screen out attack data packets from the plurality of data packets using a preset rule;

[0115] The first determining unit 202 is specifically configured to determine the number of similar data packets among the multiple data packets excluding the attack data packet.

[0116] In an optional embodiment of the present application, the first determination unit 202 is specifically used to: generalize each data packet in the multiple data packets to obtain a generalized sequence of each data packet; combine the multiple data packets in pairs, and for two data packets included in each combination, determine the similarity of the two data packets based on the generalized sequences of the two data packets; and determine the number of similar data packets in the multiple data packets based on the similarity of each two data packets after the multiple data packets are combined in pairs.

[0117] In an optional embodiment of the present application, the first determination unit 202 is specifically used to: generalize the target path of each data packet in the multiple data packets to obtain a generalized sequence of the target path of each data packet; and / or generalize the file name of each data packet in the multiple data packets to obtain a generalized sequence of the file name of each data packet.

[0118] In an optional embodiment of the present application, the first determination unit 202 is specifically configured to: for the two data packets included in each combination, determine the similarity between the two data packets based on the similarity of the generalized sequences of the target paths of the two data packets; or, for the two data packets included in each combination, determine the similarity between the two data packets based on the similarity of the generalized sequences of the file names of the two data packets; or, for the two data packets included in each combination, determine the similarity between the two data packets based on the weighted similarity of the similarity of the generalized sequences of the target paths of the two data packets and the similarity of the generalized sequences of the file names of the two data packets.

[0119] In an optional embodiment of the present application, the first determination unit 202 is specifically used to: for the target path of each data packet in the multiple data packets, represent each type of character in the target path with a symbol corresponding to each type of character, and obtain a generalized sequence of the target path; for the file name of each data packet in the multiple data packets, represent each type of character in the file name with a symbol corresponding to each type of character, and obtain a generalized sequence of the file name.

[0120] In an optional implementation manner of the present application, the obtaining unit 201 is specifically used to obtain the scanning flow of the backdoor file whose object to be scanned is a backdoor file.

[0121] Those skilled in the art should understand that Figure 2 The functions implemented by each unit in the scanning flow detection device shown can be understood by referring to the relevant description of the aforementioned scanning flow detection method. Figure 2 The functions of the various units in the scanning flow detection device shown can be implemented by a program running on a processor, or by a specific logic circuit.

[0122] An embodiment of the present application also provides an electronic device. Figure 3 This is a schematic diagram of the hardware structure of the electronic device according to the embodiment of the present application. Figure 3 As shown, the electronic device includes: a communication component 303 for data transmission, at least one processor 301 and a memory 302 for storing computer programs that can be run on the processor 301. The various components in the terminal are coupled together through a bus system 303. It can be understood that the bus system 303 is used to achieve connection and communication between these components. In addition to including a data bus, the bus system 303 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, Figure 3 Various buses are labeled as bus system 303.

[0123] When the processor 301 executes the computer program, it at least performs Figure 1 The steps of the method are shown.

[0124] It is understood that memory 302 can be volatile memory or non-volatile memory, or can include both volatile and non-volatile memory. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), ferromagnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disk, or compact disc read-only memory (CD-ROM); magnetic surface memory can be magnetic disk memory or tape memory. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus random access memory (DRRAM).The memory 302 described in the embodiments of the present application is intended to include, but is not limited to, these and any other suitable types of memories.

[0125] The methods disclosed in the above embodiments of the present application can be applied to or implemented by processor 301. Processor 301 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by hardware integrated logic circuits in processor 301 or by software instructions. The above processor 301 may be a general-purpose processor, a DSP, or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc. Processor 301 can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of this application. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly implemented and executed by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium located in memory 302. Processor 301 reads information from memory 302 and, in conjunction with its hardware, completes the steps of the above method.

[0126] In an exemplary embodiment, the electronic device may be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), FPGAs, general-purpose processors, controllers, MCUs, microprocessors, or other electronic components to perform the aforementioned call recording method.

[0127] The present application also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program is characterized in that when the program is executed by a processor, it is used to perform at least Figure 1 The computer readable storage medium may be a memory. The memory may be Figure 3 Memory 302 is shown.

[0128] The technical solutions described in the embodiments of this application can be combined arbitrarily unless there is any conflict.

[0129] In the several embodiments provided in this application, it should be understood that the disclosed methods and intelligent devices can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0130] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0131] In addition, all functional units in the embodiments of the present application can be integrated into a second processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the above-mentioned integrated units can be implemented in the form of hardware or in the form of hardware plus software functional units.

[0132] The above is only a specific implementation method of the present application, but the scope of protection of the present application is not limited thereto. Any technician familiar with this technical field can easily think of changes or replacements within the technical scope disclosed in this application, which should be covered by the scope of protection of the present application.

Claims

1. A method for detecting scanning traffic, characterized in that: The method comprises: Obtaining scanning traffic that meets preset conditions, wherein the scanning traffic includes multiple data packets; determining a number of similar data packets among the plurality of data packets; determining whether the scanning traffic is attack traffic based on a relationship between the number of similar data packets in the multiple data packets and a preset threshold; Wherein, determining the number of similar data packets in the multiple data packets includes: performing generalization processing on each data packet in the plurality of data packets to obtain a generalized sequence of each data packet; Combining the plurality of data packets in pairs, and determining, for the two data packets included in each combination, similarity between the two data packets based on generalized sequences of the two data packets; Determining the number of similar data packets in the plurality of data packets based on the similarity of each two data packets after pairwise combination of the plurality of data packets; or, Filtering out attack data packets from the plurality of data packets using preset rules; The number of similar data packets among the plurality of data packets excluding the attack data packet is determined.

2. The method according to claim 1, characterized in that The generalizing process is performed on each of the plurality of data packets to obtain a generalized sequence of each data packet, including: Generalizing the target path of each data packet in the plurality of data packets to obtain a generalized sequence of the target path of each data packet; and / or generalizing the file name of each data packet in the plurality of data packets to obtain a generalized sequence of the file name of each data packet.

3. The method according to claim 2, characterized in that The determining, for the two data packets included in each combination, the similarity of the two data packets based on the generalized sequences of the two data packets includes: For the two data packets included in each combination, the similarity between the two data packets is determined based on the similarity of the generalized sequences of the target paths of the two data packets; or, For the two data packets included in each combination, the similarity between the two data packets is determined based on the similarity of the generalized sequences of the file names of the two data packets; or, For two data packets included in each combination, the similarity between the two data packets is determined based on a weighted similarity of similarities of generalized sequences of target paths of the two data packets and similarities of generalized sequences of file names of the two data packets.

4. The method according to claim 3, characterized in that The generalizing the target path of each data packet in the plurality of data packets to obtain a generalized sequence of the target path of each data packet includes: For a target path of each data packet in the plurality of data packets, representing each type of character in the target path with a symbol corresponding to each type of character to obtain a generalized sequence of the target path; The generalizing the file name of each data packet in the plurality of data packets to obtain a generalized sequence of the file name of each data packet includes: For the file name of each data packet in the multiple data packets, each type of character in the file name is represented by a symbol corresponding to each type of character to obtain a generalized sequence of the file name.

5. The method according to any one of claims 1 to 4, characterized in that The obtaining of scanning traffic that meets the preset conditions includes: Obtain the scanning traffic for backdoor files.

6. A scanning flow detection device, characterized in that: The device comprises: An obtaining unit, configured to obtain scanning traffic that meets a preset condition, wherein the scanning traffic includes a plurality of data packets; a first determining unit, configured to determine the number of similar data packets among the plurality of data packets; a second determining unit, configured to determine whether the scanning traffic is attack traffic based on a relationship between the number of similar data packets in the plurality of data packets and a preset threshold; Wherein, determining the number of similar data packets in the multiple data packets includes: performing generalization processing on each data packet in the plurality of data packets to obtain a generalized sequence of each data packet; Combining the plurality of data packets in pairs, and determining, for the two data packets included in each combination, similarity between the two data packets based on generalized sequences of the two data packets; Determining the number of similar data packets in the plurality of data packets based on the similarity of each two data packets after pairwise combination of the plurality of data packets, or, Filtering out attack data packets from the plurality of data packets using preset rules; The number of similar data packets among the plurality of data packets excluding the attack data packet is determined.

7. An electronic device, characterized in that: The electronic device includes: a memory and a processor, wherein the memory stores computer-executable instructions, and the processor can implement any one of claims 1 to 5 when executing the computer-executable instructions on the memory.

8. A computer storage medium, characterized in that The storage medium stores executable instructions, which, when executed by a processor, implement the method according to any one of claims 1 to 5.

Images