Network security event prediction method, device, electronic device and storage medium

Abstract

Embodiments of the present application provide a network security event prediction method and device, electronic equipment and storage medium. The method comprises: constructing a defense program of a target object; obtaining attack and defense strategy data of the target object based on the defense program; calling a multi-step network attack prediction model to process the attack and defense strategy data, and predicting a network security event of the target object. In a massive alarm scenario, the embodiments of the present application can reduce the difficulty of analysts in understanding and managing the network security situation, and effectively improve the network security.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network security event prediction method, device, electronic device and storage medium. Background Art

[0002] Cybersecurity incident prediction primarily refers to applying scientific theories, methods, and existing experience to identify and predict the development trends and potential harm of major security incidents discovered in network systems. This is a crucial stage in cybersecurity situational awareness. Its primary purpose is to predict cybersecurity incidents. This involves analyzing potential and possible attack paths and predicting them based on network and system vulnerabilities. This involves continuously learning about new attack patterns and uncovering and understanding the obfuscation and deception tactics used by attackers.

[0003] In complex cybersecurity environments, attackers frequently employ a wide range of reconnaissance, vulnerability discovery, and obfuscation techniques to conduct malicious activities or sabotage. Current situational awareness systems are already working to discover and detect the exploitation of new vulnerabilities. However, the information currently captured by situational awareness includes some inaccurate observations. This requires automatically associating relevant events with known or unknown attack strategies and predicting ongoing network attack strategies. This makes it difficult for analysts to understand and manage the network security landscape amidst a flood of alerts, hindering effective network security improvements. Summary of the Invention

[0004] The technical problem to be solved by the embodiments of the present application is to provide a network security event prediction method, device, electronic device and storage medium to reduce the difficulty for analysts to understand and manage the situation and effectively improve network security.

[0005] In a first aspect, an embodiment of the present application provides a method for predicting network security events, the method comprising:

[0006] Build a defense program for the target object;

[0007] Based on the defense program, acquiring attack and defense strategy data of the target object;

[0008] A multi-step network attack prediction model is called to process the attack and defense strategy data to predict network security events of the target object.

[0009] Optionally, constructing a defense program for the target object includes:

[0010] Setting a protection strategy for the target object; the protection strategy includes: any one of the intranet IP parameter flow access strategy, network port parameter flow access strategy and protocol parameter flow access strategy of the target object;

[0011] generating a forged network data packet in response to a simulated attack instruction;

[0012] Based on the forged network data packet and the protection strategy, a simulated attack test is performed on the target object to obtain a simulated test result;

[0013] When the simulation test result is consistent with the expected result, a defense program for the target object is constructed based on the protection strategy.

[0014] Optionally, performing a simulated attack test on the target object based on the forged network data packet and the protection strategy to obtain a simulated test result includes:

[0015] Sending the forged network data packet to the target object based on a set sending interval;

[0016] Call a third-party data crawler to obtain the data message corresponding to the protection policy of the target object;

[0017] According to the data message, obtain message five-tuple information, the message five-tuple information including: source address, destination address, source port, destination port and protocol;

[0018] Determining the message type of the data message based on the message quintuple information with the timestamp added;

[0019] Determine the simulation test result corresponding to the defense strategy according to the message type.

[0020] Optionally, calling a multi-step network attack prediction model to process the attack and defense strategy data to predict a network security event of the target object includes:

[0021] generating a network event sequence corresponding to the attack and defense strategy data according to the timestamp of each network event in the attack and defense strategy data;

[0022] Calling the multi-step network attack prediction model to process the event attributes of each network event in the network event sequence, and predicting a network event prediction value corresponding to the target object;

[0023] Based on the network event prediction value, a network security event of the target object is determined.

[0024] Optionally, after calling the multi-step network attack prediction model to process the event attributes of each network event in the network event sequence and predicting a network event prediction value corresponding to the target object, the method further includes:

[0025] Obtaining the initial network event prediction value of the target object in the previous prediction;

[0026] comparing the network event prediction value with the initial network event prediction value;

[0027] In response to the network event prediction value being consistent with the initial network event prediction value, generating target attack and defense strategy data based on the historical attack and defense strategy data of the target object and the current attack and defense strategy data;

[0028] The multi-step network attack prediction model is called to process the target attack and defense strategy data to predict the network security events of the target object.

[0029] In a second aspect, an embodiment of the present application provides a network security event prediction device, the device comprising:

[0030] A defense program building module, used to build a defense program for a target object;

[0031] An attack and defense strategy data acquisition module, configured to acquire the attack and defense strategy data of the target object based on the defense program;

[0032] The network security event prediction module is used to call a multi-step network attack prediction model to process the attack and defense strategy data and predict the network security events of the target object.

[0033] Optionally, the defense program building module includes:

[0034] A protection strategy setting unit, configured to set a protection strategy for the target object; the protection strategy comprising: any one of an intranet IP parameter flow access strategy, a network port parameter flow access strategy, and a protocol parameter flow access strategy for the target object;

[0035] a forged data packet generating unit, configured to generate a forged network data packet in response to a simulated attack instruction;

[0036] A simulation test result acquisition unit, configured to perform a simulation attack test on the target object based on the forged network data packet and the protection strategy, and obtain a simulation test result;

[0037] The defense strategy construction unit is used to construct a defense program for the target object based on the protection strategy when the simulation test result is consistent with the expected result.

[0038] Optionally, the simulation test result acquisition unit includes:

[0039] a forged data packet sending subunit, configured to send the forged network data packet to the target object based on a set sending interval;

[0040] A data message acquisition subunit, configured to call a third-party data crawler program to acquire data messages corresponding to the protection policy of the target object;

[0041] A message five-tuple obtaining subunit, configured to obtain message five-tuple information according to the data message, wherein the message five-tuple information includes: source address, destination address, source port, destination port and protocol;

[0042] A message type determination subunit, configured to determine the message type of the data message based on the message quintuple information with the timestamp added;

[0043] The simulation test result determination subunit is used to determine the simulation test result corresponding to the defense strategy according to the message type.

[0044] Optionally, the network security event prediction module includes:

[0045] a network event sequence generating unit, configured to generate a network event sequence corresponding to the attack and defense strategy data according to the timestamp of each network event in the attack and defense strategy data;

[0046] A network event prediction value prediction unit, configured to call the multi-step network attack prediction model to process the event attributes of each network event in the network event sequence, and predict a network event prediction value corresponding to the target object;

[0047] A network security event determination unit is used to determine the network security event of the target object based on the network event prediction value.

[0048] Optionally, the device further comprises:

[0049] An initial prediction value acquisition module is used to obtain the initial network event prediction value of the target object in the previous prediction;

[0050] A prediction value comparison module, configured to compare the network event prediction value with the initial network event prediction value;

[0051] a target data generating module, configured to generate target attack and defense strategy data based on the historical attack and defense strategy data of the target object and the current attack and defense strategy data in response to the network event prediction value being consistent with the initial network event prediction value;

[0052] The security event prediction module is used to call the multi-step network attack prediction model to process the target attack and defense strategy data and predict the network security events of the target object.

[0053] In a third aspect, an embodiment of the present application provides an electronic device, including:

[0054] A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements any one of the above-described network security event prediction methods when executing the program.

[0055] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which, when the instructions in the storage medium are executed by a processor of an electronic device, enables the electronic device to execute any of the network security event prediction methods described above.

[0056] Compared with the prior art, the embodiments of the present application have the following advantages:

[0057] In an embodiment of the present application, a defense program for a target object is constructed, and based on the defense program, the attack and defense strategy data for the target object is obtained. A multi-step network attack prediction model is called to process the attack and defense strategy data to predict network security events for the target object. By using a multi-step network attack prediction model in combination with the attack and defense strategy data to predict future actions of an ongoing attack, the present embodiment of the present application estimates the ongoing network attack strategy without automatically associating related events with known or unknown attack strategies. This reduces the difficulty for analysts to understand and manage network security situations amidst a flood of alerts, effectively improving network security.

[0058] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 A flowchart of a method for predicting network security events provided in an embodiment of the present application;

[0060] Figure 2 A flowchart of the steps of a method for constructing a defense program provided in an embodiment of the present application;

[0061] Figure 3 A flowchart of a method for determining a simulation test result provided in an embodiment of the present application;

[0062] Figure 4 A flowchart of a method for determining a network security incident provided by an embodiment of the present application;

[0063] Figure 5 A flowchart of another method for predicting network security incidents provided in an embodiment of the present application;

[0064] Figure 6 A schematic diagram of the structure of a network security event prediction device provided in an embodiment of the present application;

[0065] Figure 7A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0066] In order to make the above-mentioned purposes, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0067] The terms used in the embodiments of the present application are for the purpose of describing specific embodiments only and are not intended to limit the present application. The singular forms "a", "an", "the" and "the" used in the embodiments of the present application and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise.

[0068] Reference Figure 1 , shows a flowchart of the steps of a network security incident prediction method provided by an embodiment of the present application, such as Figure 1 As shown, the network security event prediction method may include: step 101, step 102 and step 103.

[0069] Step 101: Build a defense program for the target object.

[0070] In this embodiment, the target object refers to the electronic device for network security event prediction. In this example, the target object can be a mobile phone, tablet computer, computer and other devices.

[0071] A defense program refers to a program that is pre-built for the target object to defend against network attacks.

[0072] When predicting network security events of target objects, a defense program for the target object can be pre-built. Specifically, a protection strategy for the target object can be set, and a corresponding defense program can be built for the target object by simulating attack tests. Figure 2 A detailed description is given below.

[0073] Reference Figure 2 , shows a flowchart of the steps of a defense program construction method provided by an embodiment of the present application, such as Figure 2 As shown, the defense program construction method may include: step 201, step 202, step 203 and step 204.

[0074] Step 201: Setting a protection strategy for the target object.

[0075] In this embodiment, the protection policy refers to the policy set for the traffic allowed to access the target object. In this example, the protection policy may include: any one of the intranet IP parameter traffic access policy, network port parameter traffic access policy, and protocol parameter traffic access policy of the target object;

[0076] Intranet IP is also a local area network address, the computer of the intranet accesses the Internet through a public gateway by the NAT (Network Address Translation) protocol. The computer of the intranet can send a connection request to other computers on the Internet, but other computers on the Internet cannot send a connection request to the computer of the intranet.

[0077] Network port: In network technology, port (Port) has two meanings: one is the physical meaning of the port, such as ADSL Modem, hub, switch, router interface for connecting other network devices, such as RJ-45 port, SC port, etc. The second is the logical meaning of the port, which generally refers to the port in the TCP / IP protocol. The port number ranges from 0 to 65535, such as 80 port for web page service, 21 port for FTP service, etc.

[0078] Protocol parameters refer to the formal description of the rules that must be followed when exchanging data between computers. Simply put, computers in the network must be able to communicate smoothly with each other, and they must speak the same language. Language is equivalent to protocol, which includes Ethernet, NetBEUI, IPX / SPX, and TCP / IP protocol.

[0079] When predicting network security events of a target object, a protection policy of the target object can be set. In specific implementation, a network policy can be built by a set of Linux system commands through program execution, which is mainly used for protecting intranet security, and mainly sets protection rules according to three parameters of intranet IP, network port and protocol. When network traffic matches any rule, the traffic is allowed to access.

[0080] After setting the protection policy of the target object, step 202 is executed.

[0081] Step 202: In response to the simulation attack instruction, a fake network packet is generated.

[0082] The simulation attack instruction is an instruction for simulating and testing the protection policy set for the target.

[0083] In some examples, the simulation attack instruction can be an instruction generated by a user-triggered setting control, for example, a control for triggering simulation attack can be pre-set in the simulation test page, and when the user triggers the control (such as clicking, pressing, etc.), the simulation attack instruction can be generated.

[0084] In some examples, the simulation attack instruction can be a voice-triggered instruction, for example, a voice receiving interface can be pre-set in the simulation test page, and the user can input voice through the interface to generate a simulation control instruction, etc.

[0085] It can be understood that the above examples are merely examples listed for a better understanding of the technical solutions of the embodiments of the present application, and are not intended to be the sole limitation on the embodiments.

[0086] Forged network data packets refer to forged data packets that attack the target object.

[0087] After setting the protection strategy of the target object and receiving the simulated attack instruction, a forged network data packet can be generated in response to the simulated attack instruction. In a specific implementation, the forged network data packet can be generated using the third-party function library scapy of the Python development language itself.

[0088] After the forged network data packet is generated in response to the simulated attack instruction, step 203 is executed.

[0089] Step 203: Based on the forged network data packet and the protection strategy, a simulated attack test is performed on the target object to obtain a simulated test result.

[0090] After generating a forged network data packet in response to a simulated attack instruction, a simulated attack test can be performed on the target object based on the forged network data packet and the protection strategy to obtain a simulated attack test result. Specifically, the forged network data packet can be sent to the target object at a set sending interval, and the corresponding data message can be obtained in real time. The simulation test result corresponding to the defense strategy can be determined in combination with the data message. Figure 3 This is described in detail below.

[0091] Reference Figure 3 , shows a flowchart of the steps of a method for determining a simulation test result provided by an embodiment of the present application, such as Figure 3 As shown, the simulation test result determination method may include: step 301 , step 302 , step 303 , step 304 and step 305 .

[0092] Step 301: Send the forged network data packet to the target object based on a set sending interval.

[0093] In this embodiment, the sending interval is a preset time interval for sending forged network data packets to the target object. In this example, the sending interval can be set to 3 seconds, 5 seconds, 8 seconds, etc. The specific value of the sending interval can be determined according to business needs and is not limited in this embodiment.

[0094] After generating forged network packets, they can be sent to the target at a set interval. For example, the scapy library encapsulates TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) packets and sets a network port range. The sr1 module then sends these packets in an ordered fashion as Layer 3 packets. If a response is received, the port is open. Using the received network port IP as a query condition, a legitimate database is accessed to retrieve the application corresponding to that network port. To encapsulate the attack packet against the application, use either an Ether(IP(TCP())) or an Ether(IP(UDP())) packet. The sendp() module uses Inter to set the sending interval (in seconds) and loop to determine whether to continuously send packets, sending a Layer 2 attack packet. Here, sendp sends the Layer 2 packet, Inter specifies the packet sending interval (in seconds), and loop specifies whether the program continuously sends packets. This parameter is set to 1, otherwise it is set to 0.

[0095] It can be understood that the above examples are merely examples listed for a better understanding of the technical solutions of the embodiments of the present application, and are not intended to be the sole limitation on the embodiments.

[0096] After the forged network data packet is sent to the target object based on the set sending interval, step 302 is executed.

[0097] Step 302: Call a third-party data crawler program to obtain the data message corresponding to the protection policy of the target object.

[0098] After sending the forged network data packet to the target object based on the set sending interval, a third-party data crawler can be called to obtain the data message corresponding to the protection policy of the target object.

[0099] After calling a third-party data crawler program to obtain the data message corresponding to the protection policy of the target object, step 303 is executed.

[0100] Step 303: According to the data message, obtain message five-tuple information, the message five-tuple information including: source address, destination address, source port, destination port and protocol.

[0101] After a third-party data crawler obtains the data packets corresponding to the target object's protection policy, it can obtain the packet five-tuple information based on the data packets. The packet five-tuple information includes: source address, destination address, source port, destination port, and protocol. In specific implementation, the newly deployed network policy is sniffed by sending attack instructions to capture data packets. The sniffed packets are analyzed to obtain the packet five-tuple (source address, destination address, source port, destination port, protocol).

[0102] After obtaining the message quintuple information according to the data message, step 304 is executed.

[0103] Step 304: Determine the message type of the data message based on the message quintuple information with the timestamp added.

[0104] The message type is a type used to indicate whether a message is an attack message. In this example, the message type may include an attack message type and a non-attack message type.

[0105] After obtaining the five-tuple information from the data packet, the packet type can be determined based on the timestamp of the five-tuple information. Specifically, after obtaining the five-tuple information, the five-tuple information can be timestamped for categorized storage. The five-tuple information can then be analyzed in conjunction with the timestamp to obtain packet analysis features within a time range. For example, if a source address frequently accesses an intranet application port within a certain time range, this can be identified as an attack packet.

[0106] After the message type of the data message is determined based on the message quintuple information with the timestamp added, step 305 is executed.

[0107] Step 305: Determine the simulation test result corresponding to the defense strategy according to the message type.

[0108] After the message type of the data packet is determined based on the message quintuple information with the timestamp added, the simulation test result corresponding to the defense strategy can be determined according to the message type.

[0109] After performing a simulated attack test on the target object based on the forged network data packet and the protection strategy to obtain a simulated attack test result, step 204 is executed.

[0110] Step 204: When the simulation test result is consistent with the expected result, a defense program for the target object is constructed based on the protection strategy.

[0111] Expected results refer to the expected results that are set in advance for simulated attack tests.

[0112] After performing a simulated attack test on a target object based on forged network data packets and protection policies and obtaining simulated attack test results, the simulated test results can be compared with expected results.

[0113] When the simulation test results are consistent with the expected results, a defense program for the target object can be constructed based on the protection strategy.

[0114] If the simulation test results are inconsistent with the expected results, the protection policy of the target object can be reset and the simulation attack test can be performed again until the simulation test results are consistent with the expected results.

[0115] In the specific implementation, the obtained simulation test result is the defense data result, which can be reported to the database for storage. At the same time, the backdoor program updates the status according to the defense data result identifier stored in the database and executes the self-destruct command to complete the simulated attack test.

[0116] After the defense program for the target object is constructed, step 102 is executed.

[0117] Step 102: Based on the defense program, obtain the attack and defense strategy data of the target object.

[0118] Attack and defense strategy data refers to the attack and defense strategy data collected for the target object. In this example, the attack and defense strategy data is the data collected by the defense program pre-built for the target object to resist the simulated attack test when the target object is simulated attacked using forged network data packets.

[0119] After building a defense program for the target object, the attack and defense strategy data of the target object can be obtained based on the defense program, and then the collected attack and defense strategy data can be reported to the database for storage to carry out subsequent network security event prediction processes.

[0120] After the attack and defense strategy data of the target object is acquired based on the defense program, step 103 is executed.

[0121] Step 103: Calling a multi-step network attack prediction model to process the attack and defense strategy data, and predicting a network security event of the target object.

[0122] A multi-step cyberattack prediction model refers to a pre-built model used to predict cybersecurity incidents.

[0123] After obtaining the attack and defense strategy data of the target object based on the defense program, the multi-step network attack prediction model can be called to process the attack and defense strategy data to predict the network security events of the target object. Specifically, a network event sequence can be generated based on the timestamps of each network event in the attack and defense strategy data. Then, the multi-step network attack prediction model can be called to predict the network event prediction value corresponding to the target object, and the network security events of the target object can be determined in combination with the network event prediction value. Figure 4 A detailed description is given below.

[0124] Reference Figure 4 , shows a flowchart of the steps of a method for determining a network security incident provided by an embodiment of the present application, such as Figure 4 As shown, the network security event determination method may include: step 401, step 402 and step 403.

[0125] Step 401: Generate a network event sequence corresponding to the attack and defense strategy data according to the timestamp of each network event in the attack and defense strategy data.

[0126] In this embodiment, the attack and defense strategy data includes the timestamp of each network event, wherein each network event may include: network attack events (such as information collection attacks, false news attacks, etc.) and normal access events.

[0127] Among them, information collection attacks may include: scanning technology attacks (such as address scanning, port scanning, echo mapping, slow scanning), architecture detection (that is, hackers use automatic tools with a database of known response types to check the responses from the target host to the transmission of bad data packets. Since each operating system has its own unique response method (for example, the specific implementation of the TCP / IP stack of NT and Solaris is different), by comparing this unique response with the known responses in the database, hackers can often determine the operating system running on the target host), DNS domain conversion (the DNS protocol does not authenticate conversions or informational updates, which allows the protocol to be exploited in a number of different ways), Finger service (that is, hackers use the finger command to spy on a finger server to obtain information about the users of the system), LDAP service (that is, hackers use the LDAP protocol to spy on systems and their users within the network), etc.

[0128] Fake news attacks are messages used to attack incorrectly configured targets, primarily including DNS cache pollution and forged emails. In practice, fake news attacks can include two types: 1. DNS cache pollution; 2. Forged emails.

[0129] DNS cache pollution means that the DNS server does not authenticate when exchanging information with other name servers, which allows hackers to mix in incorrect information and lead users to the hacker's own host.

[0130] Forged email means that since SMTP does not authenticate the identity of the sender of the email, hackers can forge emails to your internal customers, claiming to be from someone the customer knows and trusts, and attaching an installable Trojan horse program or a link to a malicious website.

[0131] In actual applications, network attack events may also include: password intrusion, placement of Trojan horse programs, WWW deception techniques, etc. Specifically, the specific type of network attack event may be determined according to actual conditions, and this embodiment does not impose any limitation on this.

[0132] After obtaining the attack and defense strategy data, a network event sequence of the attack and defense strategy data can be generated according to the timestamps of each network event in the attack and defense strategy data. That is, the network events are sorted in order from the earliest to the latest based on the timestamps to obtain the network event sequence.

[0133] After generating a network event sequence corresponding to the attack and defense strategy data according to the timestamps of the network events in the attack and defense strategy data, step 402 is executed.

[0134] Step 402: calling the multi-step network attack prediction model to process the event attributes of each network event in the network event sequence, and predicting a network event prediction value corresponding to the target object.

[0135] After generating a network event sequence corresponding to the attack and defense strategy data based on the timestamps of each network event in the attack and defense strategy data, the multi-step network attack prediction model can be called to predict the event attributes of each network event in the network event sequence to obtain the network event prediction value corresponding to the target object.

[0136] After the multi-step network attack prediction model is called to predict the event attributes of each network event in the network event sequence and obtain the network event prediction value corresponding to the target object, step 403 is executed.

[0137] Step 403: Determine the network security event of the target object based on the network event prediction value.

[0138] After calling the multi-step network attack prediction model to predict the event attributes of each network event in the network event sequence and obtaining the network event prediction value corresponding to the target object, the network security event of the target object can be determined based on the network event prediction value, that is, the network event with the largest prediction value is obtained based on the network event prediction value, and this network event is determined as the network security event of the target object.

[0139] In this embodiment, after obtaining the predicted value of the network event this time, the predicted value of the network event this time can be compared with the predicted value of the network event last time. If they are the same, the adjustment strategy can be executed. Figure 5 This is described in detail below.

[0140] Reference Figure 5 , shows a flowchart of the steps of a network security incident prediction method provided by an embodiment of the present application, such as Figure 5 As shown, the network security event prediction method may include: step 501, step 502, step 503 and step 504.

[0141] Step 501: Obtain the initial network event prediction value of the target object in the previous prediction.

[0142] In this embodiment, the initial network event prediction value predicted on the previous side refers to the network event prediction value obtained when the network security event prediction was last performed before the current prediction.

[0143] After obtaining the network security event predicted this time, the initial network event prediction value of the target object in the previous prediction can be obtained.

[0144] After obtaining the initial network event prediction value of the target object in the previous prediction, step 502 is executed.

[0145] Step 502: Compare the network event prediction value with the initial network event prediction value.

[0146] After obtaining the initial network event prediction value of the target object in the previous prediction, the network event prediction value and the initial network event prediction value may be compared.

[0147] After comparing the network event prediction value with the initial network event prediction value, step 503 is executed.

[0148] Step 503: In response to the network event prediction value being consistent with the initial network event prediction value, target attack and defense strategy data is generated according to the historical attack and defense strategy data of the target object and the current attack and defense strategy data.

[0149] After comparing the network event prediction value with the initial network event prediction value, if the network event prediction value is inconsistent with the initial network event prediction value, then the current prediction is deemed valid, that is, the network security event predicted this time can be identified as an accurate and valid network security event.

[0150] If the network event prediction value is consistent with the initial network event prediction value, it may be caused by the smooth release of the Markov model. At this time, adjustments can be made. Specifically, the target attack and defense strategy data can be generated based on the historical attack and defense strategy data of the target object and the current attack and defense strategy data.

[0151] In the specific implementation, the attack and defense strategy data stored in this database and the differentiated part of the attack and defense strategy data of the most recent 3-5 times (if they are still the same, the most recent 5-10 data will be obtained, and the data will be deferred in sequence) are retained to form the attack and defense strategy data of this time. The data volume cannot be less than the current data volume. If it is less, the number of times the most recent data stored in the database is obtained is increased, and the newly formed attack and defense strategy data (i.e., the target attack and defense strategy data) can be obtained.

[0152] After generating target attack and defense strategy data based on the historical attack and defense strategy data of the target object and the current attack and defense strategy data, step 504 is executed.

[0153] Step 504: Call the multi-step network attack prediction model to process the target attack and defense strategy data to predict the network security event of the target object.

[0154] After generating target attack and defense strategy data based on the target's historical attack and defense strategy data and the current attack and defense strategy data, the multi-step network attack prediction model can be used to process the target attack and defense strategy data and predict network security events for the target. Specifically, the newly generated attack and defense strategy data can be substituted into the multi-step network attack prediction model to predict network security events. If the probability values ​​remain the same, the prediction process is repeated until the probability values ​​differ.

[0155] In the specific implementation, the multi-step network attack prediction model X= <X1,X2,...,X n >. X is an ordered sequence of observations, where the random variable X k ∈o,k∈{1,2,3,...,N} is defined as the kth action in the sequence. In theory, X k It should be defined as a vector consisting of multiple attributes describing the observed event. In this embodiment, X k is considered as a random variable. The attack strategy will be represented as an L-order Markov model C:

[0156] k=1, where: P(X1,X2,...,X L) is the initial distribution of attack model C; f C Given the transfer matrix of the L-order Markov model, P(X n |X n-1 ,...,X n-L This model can be used to represent a hypothetical attack strategy. Compare the cybersecurity event prediction value obtained by the Multi-Step Cyberattack Prediction Model with the previous prediction value. If the probabilities are the same, this could be due to a Markov model release. To address this potential model issue, the aforementioned strategy can be used for adjustments.

[0157] In this embodiment, a self-destruct program can also be used. After completing the prediction of a network security event, a database data storage success return flag can be added and sent to the self-destruct program. The self-destruct program can execute the self-destruct command based on the received database data storage success return flag to complete the network attack and defense drill and prediction.

[0158] The embodiment of the present application adopts an adjustment strategy to ensure that the prediction of the multi-step network attack prediction model is not affected by the Markov stationary release, which can effectively improve the accuracy of network security event prediction.

[0159] The network security event prediction method provided in the embodiments of the present application constructs a defense program for a target object, obtains the target object's attack and defense strategy data based on the defense program, and invokes a multi-step network attack prediction model to process the attack and defense strategy data to predict network security events for the target object. The embodiments of the present application use a multi-step network attack prediction model combined with attack and defense strategy data to predict the future actions of an ongoing attack action. This eliminates the need to automatically associate related events with known or unknown attack strategies, and allows for an estimation of ongoing network attack strategies. This reduces the difficulty for analysts to understand and manage network security situations amidst a flood of alerts, effectively improving network security.

[0160] Reference Figure 6 , shows a schematic structural diagram of a web page information extraction device provided by an embodiment of the present application, such as Figure 6 As shown, the webpage information extraction device 600 may include the following modules:

[0161] A defense program building module 610 is used to build a defense program for a target object;

[0162] An attack and defense strategy data acquisition module 620 is used to acquire the attack and defense strategy data of the target object based on the defense program;

[0163] The network security event prediction module 630 is used to call a multi-step network attack prediction model to process the attack and defense strategy data and predict the network security event of the target object.

[0164] Optionally, the defense program building module 610 includes:

[0165] A protection strategy setting unit, configured to set a protection strategy for the target object; the protection strategy comprising: any one of an intranet IP parameter flow access strategy, a network port parameter flow access strategy, and a protocol parameter flow access strategy for the target object;

[0166] a forged data packet generating unit, configured to generate a forged network data packet in response to a simulated attack instruction;

[0167] A simulation test result acquisition unit, configured to perform a simulation attack test on the target object based on the forged network data packet and the protection strategy, and obtain a simulation test result;

[0168] The defense strategy construction unit is used to construct a defense program for the target object based on the protection strategy when the simulation test result is consistent with the expected result.

[0169] Optionally, the simulation test result acquisition unit includes:

[0170] a forged data packet sending subunit, configured to send the forged network data packet to the target object based on a set sending interval;

[0171] A data message acquisition subunit, configured to call a third-party data crawler program to acquire data messages corresponding to the protection policy of the target object;

[0172] A message five-tuple obtaining subunit, configured to obtain message five-tuple information according to the data message, wherein the message five-tuple information includes: source address, destination address, source port, destination port and protocol;

[0173] A message type determination subunit, configured to determine the message type of the data message based on the message quintuple information with the timestamp added;

[0174] The simulation test result determination subunit is used to determine the simulation test result corresponding to the defense strategy according to the message type.

[0175] Optionally, the network security event prediction module 630 includes:

[0176] a network event sequence generating unit, configured to generate a network event sequence corresponding to the attack and defense strategy data according to the timestamp of each network event in the attack and defense strategy data;

[0177] A network event prediction value prediction unit, configured to call the multi-step network attack prediction model to process the event attributes of each network event in the network event sequence, and predict a network event prediction value corresponding to the target object;

[0178] A network security event determination unit is used to determine the network security event of the target object based on the network event prediction value.

[0179] Optionally, the device further comprises:

[0180] An initial prediction value acquisition module is used to obtain the initial network event prediction value of the target object in the previous prediction;

[0181] A prediction value comparison module, configured to compare the network event prediction value with the initial network event prediction value;

[0182] a target data generating module, configured to generate target attack and defense strategy data based on the historical attack and defense strategy data of the target object and the current attack and defense strategy data in response to the network event prediction value being consistent with the initial network event prediction value;

[0183] The security event prediction module is used to call the multi-step network attack prediction model to process the target attack and defense strategy data and predict the network security events of the target object.

[0184] The network security event prediction device provided in the embodiments of the present application constructs a defense program for the target object, obtains the attack and defense strategy data of the target object based on the defense program, and calls a multi-step network attack prediction model to process the attack and defense strategy data to predict the network security events of the target object. The embodiments of the present application use a multi-step network attack prediction model combined with the attack and defense strategy data to predict the future actions of an ongoing attack action. This eliminates the need to automatically associate related events with known or unknown attack strategies, and estimates the ongoing network attack strategy. This reduces the difficulty for analysts to understand and manage network security situations in the face of massive alerts, effectively improving network security.

[0185] An embodiment of the present application also provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program implements the above-mentioned network security event prediction method when executed by the processor.

[0186] Figure 7 FIG. 7 is a schematic diagram showing the structure of an electronic device 700 according to an embodiment of the present invention. Figure 7As shown, electronic device 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) 702 or computer program instructions loaded from a storage unit 708 into a random access memory (RAM) 703. In RAM 703, various programs and data required for the operation of electronic device 700 can also be stored. CPU 701, ROM 702 and RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to bus 704.

[0187] Multiple components in the electronic device 700 are connected to the I / O interface 705, including an input unit 706, such as a keyboard, a mouse, a microphone, etc.; an output unit 707, such as various types of displays, speakers, etc.; a storage unit 708, such as a magnetic disk, an optical disk, etc.; and a communication unit 709, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 709 allows the electronic device 700 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0188] The various processes and procedures described above may be executed by the processing unit 701. For example, the method of any of the above embodiments may be implemented as a computer software program, which is tangibly contained in a computer-readable medium, such as the storage unit 708. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 700 via the ROM 702 and / or the communication unit 709. When the computer program is loaded into the RAM 703 and executed by the CPU 701, one or more actions in the method described above may be performed.

[0189] In addition, an embodiment of the present application also provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the above-mentioned network security event prediction method is implemented.

[0190] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0191] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, devices, or computer program products. Therefore, the embodiments of the present application can take the form of secure hardware embodiments, secure software embodiments, or embodiments combining software and hardware. Furthermore, the embodiments of the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0192] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, terminals (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal generate instructions for implementing the steps in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0193] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing terminal to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0194] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal so that a series of operational steps are executed on the computer or other programmable terminal to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal to implement the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0195] Although preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they become aware of the basic inventive concepts. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0196] Finally, it is to be understood that the phraseology or terminology such as "first" and "second" etc. used herein is merely intended to differentiate one entity or operation from another entity or operation, without necessarily requiring or implying any actual such relationship or order between such entities or operations. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises... a" does not, without more constraints, exclude the existence of additional identical elements in the process, method, article, or apparatus that comprises the element.

[0197] The network security event prediction method, the network security event prediction device, the electronic device and the computer readable storage medium provided in the present application are described in detail above, the principles and implementation manners of the present application are described by applying specific examples in the present article, the above example is only used to help understand the method and core idea of the present application; at the same time, for those skilled in the art, according to the idea of the present application, the specific implementation manner and application range will be changed, and the above description should not be understood as the limitation of the present application.

Claims

1. A network security incident prediction method, characterized in that: The method comprises: Build a defense program for the target object; Based on the defense program, acquiring attack and defense strategy data of the target object; generating a network event sequence corresponding to the attack and defense strategy data according to the timestamp of each network event in the attack and defense strategy data; Invoking a multi-step network attack prediction model to process event attributes of each network event in the network event sequence, and predicting a network event prediction value corresponding to the target object; Obtaining the initial network event prediction value of the target object in the previous prediction; comparing the network event prediction value with the initial network event prediction value; In response to the network event prediction value being consistent with the initial network event prediction value, generating target attack and defense strategy data based on the historical attack and defense strategy data of the target object and the current attack and defense strategy data; The multi-step network attack prediction model is called to process the target attack and defense strategy data to predict the network security events of the target object.

2. The method according to claim 1, characterized in that The defense program for building the target object includes: Setting a protection strategy for the target object; the protection strategy includes: any one of the intranet IP parameter flow access strategy, network port parameter flow access strategy and protocol parameter flow access strategy of the target object; generating a forged network data packet in response to a simulated attack instruction; Based on the forged network data packet and the protection strategy, a simulated attack test is performed on the target object to obtain a simulated test result; When the simulation test result is consistent with the expected result, a defense program for the target object is constructed based on the protection strategy.

3. The method according to claim 2, characterized in that The step of performing a simulated attack test on the target object based on the forged network data packet and the protection strategy to obtain a simulated test result includes: Sending the forged network data packet to the target object based on a set sending interval; Call a third-party data crawler to obtain the data message corresponding to the protection policy of the target object; According to the data message, obtain message five-tuple information, the message five-tuple information including: source address, destination address, source port, destination port and protocol; Determining the message type of the data message based on the message quintuple information with the timestamp added; Determine the simulation test result corresponding to the protection strategy according to the message type.

4. A network security event prediction device, characterized in that: The device comprises: A defense program building module, used to build a defense program for a target object; An attack and defense strategy data acquisition module, configured to acquire the attack and defense strategy data of the target object based on the defense program; a network event sequence generating unit, configured to generate a network event sequence corresponding to the attack and defense strategy data according to the timestamp of each network event in the attack and defense strategy data; A network event prediction value prediction unit, configured to call a multi-step network attack prediction model to process the event attributes of each network event in the network event sequence, and predict a network event prediction value corresponding to the target object; An initial prediction value acquisition module is used to obtain the initial network event prediction value of the target object in the previous prediction; A prediction value comparison module, configured to compare the network event prediction value with the initial network event prediction value; a target data generating module, configured to generate target attack and defense strategy data based on the historical attack and defense strategy data of the target object and the current attack and defense strategy data in response to the network event prediction value being consistent with the initial network event prediction value; The security event prediction module is used to call the multi-step network attack prediction model to process the target attack and defense strategy data and predict the network security events of the target object.

5. The device according to claim 4, characterized in that The defense program building blocks include: A protection strategy setting unit, configured to set a protection strategy for the target object; the protection strategy comprising: any one of an intranet IP parameter flow access strategy, a network port parameter flow access strategy, and a protocol parameter flow access strategy for the target object; a forged data packet generating unit, configured to generate a forged network data packet in response to a simulated attack instruction; A simulation test result acquisition unit, configured to perform a simulation attack test on the target object based on the forged network data packet and the protection strategy, and obtain a simulation test result; The defense strategy construction unit is used to construct a defense program for the target object based on the protection strategy when the simulation test result is consistent with the expected result.

6. The device according to claim 5, characterized in that The simulation test result acquisition unit includes: a forged data packet sending subunit, configured to send the forged network data packet to the target object based on a set sending interval; A data message acquisition subunit, configured to call a third-party data crawler program to acquire data messages corresponding to the protection policy of the target object; A message five-tuple obtaining subunit, configured to obtain message five-tuple information according to the data message, wherein the message five-tuple information includes: source address, destination address, source port, destination port and protocol; A message type determination subunit, configured to determine the message type of the data message based on the message quintuple information with the timestamp added; The simulation test result determination subunit is used to determine the simulation test result corresponding to the protection strategy according to the message type.

7. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the network security event prediction method according to any one of claims 1 to 3 when executing the program.

8. A computer-readable storage medium, characterized in that When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the network security event prediction method according to any one of claims 1 to 3.

Images