An address identification method, network device and storage medium

Abstract

The embodiment of the application provides an address identification method, a network device and a storage medium, the method comprises the steps of: acquiring a network monitoring log in a preset time period and an Internet Protocol (IP) address in the network monitoring log; determining a network topology structure corresponding to the IP address according to the network monitoring log, and determining a graph feature corresponding to the IP address based on the network topology structure; determining a data statistical feature corresponding to the IP address according to the network monitoring log; inputting the graph feature and the data statistical feature corresponding to the IP address into a preset identification model to obtain a scanning attack IP address in the IP address. Through the above technical solution, the accuracy of identifying the scanning attack IP address is improved.

Description

Technical Field

[0001] This application relates to the field of network security, and in particular to an address identification method, network device, and storage medium. Background Technology

[0002] Scanning attacks are an important part of network intrusion. Attackers send probing messages to discover vulnerabilities in the target system and then use these vulnerabilities to attack the target host.

[0003] Typically, identifying IP addresses used for scanning attacks in Internet Protocol (IP) addresses is done by analyzing the data transmission information of the IP addresses. However, this method relies solely on the number of data packets sent, which can lead to misjudgments when IP addresses are transmitting data packets to each other at high frequencies. This results in low accuracy in identifying IP addresses used for scanning attacks. Summary of the Invention

[0004] This application provides an address identification method, network device, and storage medium, which can improve the accuracy of identifying IP addresses used for scanning attacks.

[0005] The technical solution of this application is implemented as follows:

[0006] In a first aspect, embodiments of this application provide an address identification method, the method comprising:

[0007] Obtain network monitoring logs within a preset time period and the Internet Protocol (IP) addresses in the network monitoring logs;

[0008] Based on the network monitoring logs, the network topology corresponding to the IP address is determined, and the graph features corresponding to the IP address are determined based on the network topology.

[0009] Determine the data statistical characteristics corresponding to the IP address based on the network monitoring logs;

[0010] The graph features and data statistical features corresponding to the IP address are input into a preset identification model to obtain the scanning attack IP address in the IP address.

[0011] In the above address identification method, determining the graph features corresponding to the IP address based on the network topology includes:

[0012] Based on the network topology, determine the maximum values ​​of the out-degree number, in-degree number, node degree, out-degree ratio, in-degree ratio, longest path, and relative connection density of the IP address.

[0013] The number of out-degrees, number of in-degrees, node degree, out-degree ratio, in-degree ratio, longest path, and maximum relative connection density of the IP address are determined as the graph features corresponding to the IP address.

[0014] In the above address identification method, determining the data statistical characteristics corresponding to the IP address based on the network monitoring log includes:

[0015] The total number of outgoing bytes, total number of incoming bytes, total number of outgoing packets, and total number of incoming packets corresponding to the IP address are determined based on the network monitoring logs.

[0016] The total number of outgoing bytes, total number of incoming bytes, total number of outgoing packets, and total number of incoming packets corresponding to the IP address are determined as the data statistical characteristics corresponding to the IP address.

[0017] In the above address identification method, after obtaining the scanning attack IP address from the IP address, the method further includes:

[0018] Determine the first IP address that will receive the data information transmitted from the IP address of the scanning attack;

[0019] The first information entropy corresponding to the scanning attack IP address is determined based on the first IP address; and the scanning type of the scanning attack IP address is determined based on the first information entropy.

[0020] In the above address identification method, when there are multiple first IP addresses, the step of determining the first information entropy corresponding to the scanning attack IP address based on the first IP address, and determining the scanning type of the scanning attack IP address based on the first information entropy, includes:

[0021] Determine a first quantity of multiple first IP addresses, and determine a first information entropy corresponding to the scanning attack IP address based on the first quantity;

[0022] If the value of the first information entropy is greater than the first preset value, the scanning type of the scanning attack IP address is determined to be the first scanning type;

[0023] If the value of the first information entropy is not greater than the first preset value, the scanning type of the scanning attack IP address is determined to be the second scanning type.

[0024] In the above address identification method, when the number of the first IP addresses is one, the step of determining the first information entropy corresponding to the scanning attack IP address based on the first IP address and determining the scanning type of the scanning attack IP address based on the first information entropy includes:

[0025] Determine the number of first ports in a first IP address that receive data information transmitted by the scanning attack IP address; and determine the first information entropy corresponding to the scanning attack IP address based on the number of first ports.

[0026] If the value of the first information entropy is greater than the second preset value, the scanning type of the scanning attack IP address is determined to be the third scanning type;

[0027] If the value of the first information entropy is not greater than the second preset value, the scanning type of the scanning attack IP address is determined to be the second scanning type.

[0028] In the above address identification method, before obtaining the network monitoring logs within a preset time period and the Internet Protocol (IP) addresses in the network monitoring logs, the method further includes:

[0029] Obtain the training sample logs and the sample IP addresses in the training sample logs; the sample IP addresses include normal sample IP addresses and scanning attack sample IP addresses;

[0030] Based on the training sample logs, determine the sample network topology corresponding to the sample IP address, and determine the sample graph features corresponding to the sample IP address based on the sample network topology;

[0031] Determine the statistical characteristics of the sample data corresponding to the sample IP address based on the training sample log;

[0032] Input the sample graph features and sample data statistical features corresponding to the sample IP address into the initial identification model to obtain the predicted scanning attack sample IP address in the sample IP address;

[0033] The initial identification model is trained based on the IP address of the scan attack sample and the IP address of the predicted scan attack sample to obtain the preset identification model.

[0034] Secondly, embodiments of this application provide a network device, the device comprising:

[0035] The acquisition module is used to acquire network monitoring logs within a preset time period and the Internet Protocol (IP) addresses in the network monitoring logs;

[0036] The determination module is used to determine the network topology corresponding to the IP address based on the network monitoring log, and to determine the graph features corresponding to the IP address based on the network topology.

[0037] The determining module is further configured to determine the data statistical characteristics corresponding to the IP address based on the network monitoring log;

[0038] The input module is used to input the graph features and data statistical features corresponding to the IP address into a preset identification model to obtain the scanning attack IP address in the IP address.

[0039] Thirdly, embodiments of this application provide a network device, characterized in that the device includes: a processor, a memory, and a communication bus; when the processor executes a running program stored in the memory, it implements the address identification method as described in any of the above claims.

[0040] Fourthly, embodiments of this application provide a storage medium storing a computer program thereon, characterized in that the computer program, when executed by a processor, implements the address identification method as described in any of the preceding claims.

[0041] This application provides an address identification method, network device, and storage medium. The method includes: acquiring network monitoring logs and Internet Protocol (IP) addresses from the network monitoring logs within a preset time period; determining the network topology corresponding to the IP address based on the network monitoring logs, and determining the graph features corresponding to the IP address based on the network topology; determining the data statistical features corresponding to the IP address based on the network monitoring logs; and inputting the graph features and data statistical features corresponding to the IP address into a preset identification model to obtain the scanning attack IP address. Using the above implementation scheme, this application establishes a network topology using the bidirectional transmission relationship between IP addresses, then extracts graph features from the network topology and data statistical features of the data generated by the IP address during bidirectional transmission from the monitoring logs. The graph features and data statistical features are then input together into the preset identification model for identification. Since the graph features and data statistical features of this application include bidirectional transmission information between IP addresses, i.e., the received and sent information of the IP address, identifying scanning attack IP addresses by using both graph features and data statistical features together avoids the misjudgment caused by identifying only the number of data packets during bidirectional transmission in the prior art, thereby improving the accuracy of identifying scanning attack IP addresses. Attached Figure Description

[0042] Figure 1 A flowchart of an address identification method provided in this application embodiment;

[0043] Figure 2 A flowchart illustrating an exemplary address identification method provided in this application embodiment;

[0044] Figure 3 An exemplary flowchart for training a preset recognition model is provided for embodiments of this application;

[0045] Figure 4 A schematic diagram of the composition structure of a network device 1 provided in an embodiment of this application;

[0046] Figure 5 This is a schematic diagram of the composition structure of a network device 1 provided in an embodiment of this application. Detailed Implementation

[0047] It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit the scope of this application.

[0048] This application provides an address identification method applied to a network device. Figure 1 A flowchart of an address identification method provided in this application embodiment is shown below. Figure 1 As shown, address identification methods may include:

[0049] S101. Obtain the network monitoring logs and Internet Protocol (IP) addresses from the network monitoring logs within a preset time period.

[0050] In this embodiment of the application, the network device obtains network monitoring logs within a preset time period and Internet Protocol (IP) addresses from the network monitoring logs.

[0051] The address identification method provided in this application can be applied to scenarios where scanning attack IP addresses are identified from network monitoring logs.

[0052] In this embodiment of the application, the network monitoring log is a network monitoring netflow log, which collects IP address information entering and leaving the network interface, such as source IP address, first IP address, source port, destination port, timestamp, traffic direction, protocol and other information.

[0053] In this embodiment, the network device can be a switch or a router. The specific network device is determined according to the actual situation, and this embodiment does not limit it.

[0054] It should be noted that the preset time period can be within 5 minutes or within 30 minutes. The specific preset time period is determined according to the actual situation, and this application embodiment does not limit it here.

[0055] It should be noted that, Figure 2 A flowchart illustrating an exemplary address recognition method is provided in this application embodiment, such as... Figure 2 As shown, this application first obtains the IP address from the network detection log, then extracts the graph features and statistical features of the IP address, and inputs the graph features and statistical features of the IP address into the trained preset recognition model. If the IP address is identified as a scanning attack IP address, the information entropy of the scanning attack IP address is calculated, and the scanning type of the scanning attack IP address is determined based on the information entropy of the scanning attack IP address.

[0056] S102. Based on the network monitoring logs, determine the network topology corresponding to the IP address, and determine the graph features corresponding to the IP address based on the network topology.

[0057] In this embodiment of the application, after obtaining network monitoring logs and Internet Protocol (IP) addresses, the network device determines the network topology corresponding to the IP address based on the network monitoring logs, and determines the graph features corresponding to the IP address based on the network topology.

[0058] It should be noted that when determining the network topology corresponding to an IP address, each IP address is treated as a node in the network topology, and the data transmission relationships between each IP address are treated as edges in the network topology, ultimately generating the network topology.

[0059] It should be noted that since the data transmission relationship between IP addresses is directional, the network topology can be understood as a directed graph. For example, suppose IP address 1 corresponds to node A and IP address 2 corresponds to node B. According to the network monitoring log, IP address 1 sends data to IP address 2. In this case, in the network topology, the relationship between node A and node B is that node A points to node B.

[0060] It should be noted that since an IP address has multiple ports, if IP address 1 sends data to the first port and the second port of IP address 2 within a preset time period, then in the network topology, the first port of IP address 2 is regarded as node B, and the second port of IP address 2 is regarded as node C.

[0061] Specifically, based on the network topology, the maximum values ​​of out-degree number, in-degree number, node degree, out-degree ratio, in-degree ratio, longest path, and relative connection density of an IP address are determined; these values ​​are then used as the graph features corresponding to the IP address.

[0062] It should be noted that the out-degree count represents the number of flows from an IP address within a preset time period, that is, how many times an IP address sends data out within the preset time period; the in-degree count represents the number of flows from an IP address within a preset time period, that is, how many times an IP address receives data within the preset time period.

[0063] It should be noted that the node degree represents the number of IP addresses that communicate with IP address within a preset time period. For example, suppose that within the preset time period, IP address 1 sends data to IP address 2, IP address 3, and IP address 4, and also receives data from IP address 4, IP address 5, and IP address 6. At this time, the addresses that communicate with IP address 1 are IP address 2, IP address 3, IP address 4, IP address 5, and IP address 6. Even if there are two communications with IP address 4, it is only counted as one. Therefore, the node degree of the node corresponding to IP address 1 is 5.

[0064] It should be noted that the out-degree ratio represents the number of IP addresses that send data but do not receive any returned data. For example, suppose that within a preset time period, IP address 1 sends data to 10 IP addresses, but only receives data back from 2 of them. In this case, the out-degree ratio of IP address 1 is 0.8.

[0065] It should be noted that the in-degree ratio represents the number of IP addresses that only receive data but do not send data. For example, suppose that within a preset time period, IP address 1 receives data sent by 10 IP addresses, but only returns data to 2 of them. In this case, the in-degree ratio of IP address 1 is 0.8.

[0066] It should be noted that the longest path represents the maximum depth of an IP address in the network topology, which can be obtained using the longest path algorithm.

[0067] It should be noted that the maximum relative connection density is expressed as the ratio of the node degree of an IP address to the degree of the network topology. For example, assuming that the node degree of the node corresponding to IP address 1 is 5, the degree of the network topology is 10, and the maximum relative connection density is 0.5.

[0068] S103. Determine the statistical characteristics of the data corresponding to the IP address based on the network monitoring log.

[0069] In this embodiment of the application, after obtaining the network monitoring log and the Internet Protocol (IP) address, the network device determines the data statistical characteristics corresponding to the IP address based on the network monitoring log.

[0070] Specifically, the total number of outgoing bytes, total number of incoming bytes, total number of outgoing packets, and total number of incoming packets corresponding to an IP address are determined based on network monitoring logs; these figures are then used as the data statistical characteristics corresponding to the IP address.

[0071] It should be noted that the total number of outgoing bytes represents the total number of bytes outgoing from a single IP address within a preset time period, not the total number of bytes outgoing from all IP addresses; the total number of incoming bytes represents the total number of bytes incoming from a single IP address within a preset time period, not the total number of bytes incoming from all IP addresses.

[0072] It should be noted that the total number of outgoing packets represents the total number of packets outgoing from a single IP address within a preset time period, not the total number of packets outgoing from all IP addresses; the total number of incoming packets represents the total number of packets incoming from a single IP address within a preset time period, not the total number of packets incoming from all IP addresses.

[0073] S104. Input the graph features and data statistical features corresponding to the IP address into the preset identification model to obtain the scanning attack IP address in the IP address.

[0074] In this embodiment of the application, after determining the graph features and data statistical features corresponding to the IP address, the network device inputs the graph features and data statistical features corresponding to the IP address into a preset identification model to obtain the scanning attack IP address in the IP address.

[0075] It should be noted that when inputting the graph features and data statistics features corresponding to the IP address into the preset identification model, you can input the graph features and data statistics features corresponding to each IP address into the preset identification model in sequence, or you can input the graph features and data statistics features corresponding to the IP address into the preset identification model at the same time, and finally identify the scanning attack IP address among the IP addresses.

[0076] It should be noted that, since the graph features and data statistics of scanning attack IP addresses differ from those of normal IP addresses, scanning attack IP addresses can be identified from at least one IP address using graph features and data statistics.

[0077] It should be noted that, compared to normal IP addresses, IP addresses used for scanning attacks exhibit the following characteristics in graph features: a larger number of out-degrees, a smaller number of in-degrees, a higher out-degree ratio, a lower in-degree ratio, a shorter longest path, and a higher maximum relative connection density. In terms of data statistics, they show a larger total number of outgoing bytes, a smaller total number of incoming bytes, a larger total number of outgoing packets, and a smaller total number of incoming packets. Therefore, IP addresses used for scanning attacks can be identified through graph features and data statistics.

[0078] In this embodiment, the preset recognition model is obtained by training the initial recognition model with sample data. Figure 3 An exemplary flowchart for training a preset recognition model is provided in this application embodiment, such as... Figure 3 As shown, the method is as follows:

[0079] S201. Obtain the training sample log and the sample IP addresses in the training sample log; the sample IP addresses include normal sample IP addresses and scanning attack sample IP addresses.

[0080] In this embodiment of the application, the network device obtains training sample logs and sample IP addresses in the training sample logs; the sample IP addresses include normal sample IP addresses and scanning attack sample IP addresses.

[0081] It should be noted that in this embodiment, the ratio of normal sample IP addresses to scanning attack sample IP addresses is 9:1. The specific ratio can be determined according to the actual situation, and this embodiment does not limit it here.

[0082] S202. Based on the training sample logs, determine the sample network topology corresponding to the sample IP address, and determine the sample graph features corresponding to the sample IP address based on the sample network topology.

[0083] In this embodiment of the application, after obtaining the training sample logs and sample IP addresses, the network device determines the sample network topology corresponding to the sample IP address based on the training sample logs, and determines the sample graph features corresponding to the sample IP address based on the sample network topology.

[0084] It should be noted that when determining the sample network topology corresponding to the sample IP address, each sample IP address is treated as a node in the sample network topology, and the data transmission relationship between each sample IP address is treated as an edge in the sample network topology, thus generating the final sample network topology.

[0085] S203. Determine the statistical characteristics of the sample data corresponding to the sample IP address based on the training sample log.

[0086] In this embodiment of the application, after obtaining the training sample logs and sample IP addresses, the network device determines the statistical characteristics of the sample data corresponding to the sample IP addresses based on the training sample logs.

[0087] S204. Input the sample graph features and sample data statistical features corresponding to at least one sample IP address into the initial identification model to obtain the predicted scanning attack sample IP address in at least one sample IP address.

[0088] In this embodiment of the application, after determining the sample graph features and sample data statistical features corresponding to the sample IP address, the network device inputs the sample graph features and sample data statistical features corresponding to the sample IP address into the initial identification model to obtain the predicted scanning attack sample IP address in the sample IP address.

[0089] It should be noted that in this embodiment, the initial recognition model is a Light Gradient Boosting Machine (LightGBM) model. The specific initial recognition model can be selected according to the actual situation, and this embodiment does not limit it.

[0090] S205. The initial identification model is trained based on the IP address of the scanned attack sample and the predicted IP address of the scanned attack sample to obtain the preset identification model.

[0091] In this embodiment of the application, after the network device identifies the IP address of the predicted scanning attack sample using the initial identification model, it trains the initial identification model based on the IP address of the scan attack sample and the IP address of the predicted scanning attack sample to obtain a preset identification model.

[0092] It should be noted that after obtaining the IP address of the predicted scanning attack sample, the correctness of the predicted scanning attack sample IP address can be determined by searching for the IP address of the scanning attack sample. This allows for the adjustment of the model parameters of the initial identification model and the training of the initial identification model.

[0093] In this embodiment of the application, if the prediction accuracy value is greater than a first preset threshold, the model training is determined to be complete, and a preset recognition model is obtained.

[0094] It should be noted that prediction accuracy can be understood as the ratio of the correct scan attack sample IP address to the correct scan attack sample IP address in the prediction. When the ratio is greater than the first preset threshold, the characterization model training is completed and the preset recognition model is obtained.

[0095] In this embodiment of the application, after identifying the IP address of the scanning attack, the IP address of the scanning attack is classified according to different scanning types.

[0096] Specifically, the process involves determining the first IP address that receives the data transmitted by the IP address used for the scanning attack; determining the first information entropy corresponding to the IP address used for the scanning attack based on the first IP address; and determining the scanning type of the IP address used for the scanning attack based on the first information entropy.

[0097] In this application embodiment, the scanning types for scanning attack IP addresses include a first scanning type, a second scanning type, and a third scanning type.

[0098] It should be noted that in the embodiments of this application, the first scan type is horizontal scan, the second scan type is block scan, and the third scan type is vertical scan; the specific scan type is determined according to the actual situation, and this embodiment of the application does not limit it here.

[0099] In one optional embodiment, when there are multiple first IP addresses that receive data information transmitted by the scanning attack IP address, the scanning type of the scanning attack IP address is determined by the number of first IP addresses.

[0100] Specifically, a first quantity of multiple first IP addresses is determined, and a first information entropy corresponding to the scanning attack IP address is determined based on the first quantity; if the value of the first information entropy is greater than a first preset value, the scanning type of the scanning attack IP address is determined to be a first scanning type; if the value of the first information entropy is not greater than the first preset value, the scanning type of the scanning attack IP address is determined to be a second scanning type.

[0101] It should be noted that the formula for calculating information entropy is as follows:

[0102]

[0103] In formula (1), N represents the number of first IP addresses that receive data information transmitted by the IP addresses of the scanning attack.

[0104] It should be noted that in this embodiment, the first preset value is preset to 0.9. The specific first preset value can be determined according to the actual situation, and this embodiment does not limit it here.

[0105] In another optional embodiment, when the number of first IP addresses receiving data information transmitted by the scanning attack IP address is one, the scanning type of the scanning attack IP address is determined by the number of ports through which the first IP address receives data information.

[0106] Specifically, the first number of ports in a first IP address that receive data transmitted from the scanning attack IP address is determined; and the first information entropy corresponding to the scanning attack IP address is determined based on the first port number; if the value of the first information entropy is greater than a second preset value, the scanning type of the scanning attack IP address is determined to be a third scanning type; if the value of the first information entropy is not greater than a second preset value, the scanning type of the scanning attack IP address is determined to be a second scanning type.

[0107] It should be noted that when a scanning attack IP address transmits data, it may only send data to one IP address, but it may send data to multiple ports of that IP address. In this case, determining the number of ports that receive the data can determine the first information entropy corresponding to the scanning attack IP address.

[0108] It should be noted that in this embodiment, the second preset value is preset to 0.9. The specific second preset value can be determined according to the actual situation, and this embodiment does not limit it here.

[0109] This application provides an address identification method, which includes: acquiring network monitoring logs and Internet Protocol (IP) addresses from the network monitoring logs within a preset time period; determining the network topology corresponding to the IP address based on the network monitoring logs, and determining the graph features corresponding to the IP address based on the network topology; determining the data statistical features corresponding to the IP address based on the network monitoring logs; and inputting the graph features and data statistical features corresponding to the IP address into a preset identification model to obtain the scanning attack IP address. Using the above implementation scheme, this application establishes a network topology using the bidirectional transmission relationship between IP addresses, then extracts graph features from the network topology and data statistical features of the data generated by the IP address during bidirectional transmission from the monitoring logs. The graph features and data statistical features are then input together into the preset identification model for identification. Since the graph features and data statistical features of this application include bidirectional transmission information between IP addresses, i.e., the received and sent information of the IP address, identifying scanning attack IP addresses by using both graph features and data statistical features together avoids the misjudgment caused by identifying only the number of data packets during bidirectional transmission in the prior art, thereby improving the accuracy of identifying scanning attack IP addresses.

[0110] Based on the above embodiments, in another embodiment of this application, a network device 1 is provided. Figure 4 A schematic diagram of the composition structure of a network device 1 provided in this application Figure 1 ,like Figure 4 As shown, the network device 1 includes:

[0111] The acquisition module 10 is used to acquire network monitoring logs within a preset time period and Internet Protocol (IP) addresses in the network monitoring logs;

[0112] The determination module 11 is used to determine the network topology corresponding to the IP address based on the network monitoring log, and to determine the graph features corresponding to the IP address based on the network topology.

[0113] The determining module 11 is further configured to determine the data statistical characteristics corresponding to the IP address based on the network monitoring log;

[0114] The input module 12 is used to input the graph features and data statistical features corresponding to the IP address into a preset identification model to obtain the scanning attack IP address in the IP address.

[0115] Optionally, the determining module 11 is further configured to determine the number of out-degrees, number of in-degrees, node degree, out-degree ratio, in-degree ratio, longest path, and maximum relative connection density of the IP address based on the network topology.

[0116] The determining module 11 is further configured to determine the number of out-degrees, number of in-degrees, node degree, out-degree ratio, in-degree ratio, longest path, and maximum relative connection density of the IP address as the graph features corresponding to the IP address.

[0117] Optionally, the determining module 11 is further configured to determine the total number of outgoing bytes, the total number of incoming bytes, the total number of outgoing packets, and the total number of incoming packets corresponding to the IP address based on the network monitoring log;

[0118] The determining module 11 is further configured to determine the total number of outgoing bytes, the total number of incoming bytes, the total number of outgoing packets, and the total number of incoming packets corresponding to the IP address as the data statistical characteristics corresponding to the IP address.

[0119] Optionally, the determining module 11 is further configured to determine the first IP address that receives the data information transmitted by the scanning attack IP address;

[0120] The determining module 11 is further configured to determine the first information entropy corresponding to the scanning attack IP address based on the first IP address; and to determine the scanning type of the scanning attack IP address based on the first information entropy.

[0121] Optionally, the determining module 11 is further configured to determine a first number of multiple first IP addresses, and determine a first information entropy corresponding to the scanning attack IP address based on the first number;

[0122] The determining module 11 is further configured to determine the scanning type of the scanning attack IP address as the first scanning type if the value of the first information entropy is greater than the first preset value;

[0123] The determining module 11 is further configured to determine the scanning type of the scanning attack IP address as the second scanning type if the value of the first information entropy is not greater than the first preset value.

[0124] Optionally, the determining module 11 is further configured to determine the number of first ports in a first IP address that receive data information transmitted by the scanning attack IP address; and to determine the first information entropy corresponding to the scanning attack IP address based on the number of first ports;

[0125] The determining module 11 is further configured to determine the scanning type of the scanning attack IP address as a third scanning type if the value of the first information entropy is greater than the second preset value;

[0126] The determining module 11 is further configured to determine the scanning type of the scanning attack IP address as the second scanning type if the value of the first information entropy is not greater than the second preset value.

[0127] Optionally, the network device 1 further includes: a model training module;

[0128] The acquisition module 10 is further configured to acquire training sample logs and sample IP addresses in the training sample logs; the sample IP addresses include normal sample IP addresses and scanning attack sample IP addresses;

[0129] The determining module 11 is further configured to determine the sample network topology corresponding to the sample IP address based on the training sample log, and determine the sample graph features corresponding to the sample IP address based on the sample network topology.

[0130] The determining module 11 is further configured to determine the statistical characteristics of the sample data corresponding to the sample IP address based on the training sample log;

[0131] The input module 12 is also used to input the sample graph features and sample data statistical features corresponding to the sample IP address into the initial identification model to obtain the predicted scanning attack sample IP address in the sample IP address;

[0132] The model training module is used to train the initial identification model based on the IP address of the scan attack sample and the IP address of the predicted scan attack sample to obtain the preset identification model.

[0133] This application provides a network device comprising: acquiring network monitoring logs and Internet Protocol (IP) addresses from the network monitoring logs within a preset time period; determining the network topology corresponding to the IP addresses based on the network monitoring logs, and determining the graph features corresponding to the IP addresses based on the network topology; determining the data statistical features corresponding to the IP addresses based on the network monitoring logs; and inputting the graph features and data statistical features corresponding to the IP addresses into a preset identification model to obtain the scanning attack IP addresses. By employing the above implementation scheme, this application establishes a network topology using the bidirectional transmission relationship between IP addresses, then extracts graph features from the network topology and data statistical features of the data generated by the IP addresses during bidirectional transmission from the monitoring logs. The graph features and data statistical features are then input together into the preset identification model for identification. Since the graph features and data statistical features of this application include bidirectional transmission information between IP addresses, i.e., the received and sent information of the IP addresses, identifying scanning attack IP addresses by using both graph features and data statistical features together avoids the misjudgment caused by identifying only the number of data packets during bidirectional transmission in the prior art, thereby improving the accuracy of identifying scanning attack IP addresses.

[0134] Figure 5 A schematic diagram of the composition structure of a network device 1 provided in this application embodiment. Figure 2In practical applications, based on the same disclosed concept of the above embodiments, such as Figure 5 As shown, the network device 1 in this embodiment includes: a processor 13, a memory 14, and a communication bus 15.

[0135] In a specific embodiment, the acquisition module 10, determination module 11, input module 12, and model training module described above can be implemented by a processor 13 located on the network device 1. The processor 13 can be at least one of the following: Application Specific Integrated Circuit (ASIC), Digital Signal Processor (DSP), Digital Signal Processing Device (DSPD), Programmable Logic Device (PLD), Field Programmable Gate Array (FPGA), CPU, controller, microcontroller, or microprocessor. It is understood that for different network devices, the electronic devices used to implement the above processor functions can also be other types; this embodiment does not impose specific limitations.

[0136] In this embodiment, the communication bus 15 is used to realize the connection communication between the processor 13 and the memory 14; when the processor 13 executes the running program stored in the memory 14, it implements the following address recognition method:

[0137] Obtain network monitoring logs within a preset time period and the Internet Protocol (IP) addresses in the network monitoring logs;

[0138] Based on the network monitoring logs, the network topology corresponding to the IP address is determined, and the graph features corresponding to the IP address are determined based on the network topology.

[0139] Determine the data statistical characteristics corresponding to the IP address based on the network monitoring logs;

[0140] The graph features and data statistical features corresponding to the IP address are input into a preset identification model to obtain the scanning attack IP address in the IP address.

[0141] Optionally, the processor 13 is further configured to determine the number of out-degrees, number of in-degrees, node degree, out-degree ratio, in-degree ratio, longest path, and maximum relative connection density of the IP address based on the network topology; and to determine the number of out-degrees, number of in-degrees, node degree, out-degree ratio, in-degree ratio, longest path, and maximum relative connection density of the IP address as the graph features corresponding to the IP address.

[0142] Optionally, the processor 13 is further configured to determine the total number of outgoing bytes, the total number of incoming bytes, the total number of outgoing packets, and the total number of incoming packets corresponding to the IP address based on the network monitoring log; and to determine the total number of outgoing bytes, the total number of incoming bytes, the total number of outgoing packets, and the total number of incoming packets corresponding to the IP address as the data statistical characteristics corresponding to the IP address.

[0143] Optionally, the processor 13 is further configured to determine a first IP address that receives the data information transmitted by the scanning attack IP address; determine a first information entropy corresponding to the scanning attack IP address based on the first IP address; and determine the scanning type of the scanning attack IP address according to the first information entropy.

[0144] Optionally, the processor 13 is further configured to determine a first number of multiple first IP addresses, and determine a first information entropy corresponding to the scanning attack IP address based on the first number; if the value of the first information entropy is greater than a first preset value, determine that the scanning type of the scanning attack IP address is a first scanning type; if the value of the first information entropy is not greater than the first preset value, determine that the scanning type of the scanning attack IP address is a second scanning type.

[0145] Optionally, the processor 13 is further configured to determine the number of first ports in a first IP address that receive data information transmitted by the scanning attack IP address; and determine the first information entropy corresponding to the scanning attack IP address based on the number of first ports; if the value of the first information entropy is greater than a second preset value, determine that the scanning type of the scanning attack IP address is a third scanning type; if the value of the first information entropy is not greater than a second preset value, determine that the scanning type of the scanning attack IP address is a second scanning type.

[0146] Optionally, the processor 13 is further configured to acquire training sample logs and sample IP addresses in the training sample logs; the sample IP addresses include normal sample IP addresses and scanning attack sample IP addresses; determine the sample network topology corresponding to the sample IP address based on the training sample logs, and determine the sample graph features corresponding to the sample IP address based on the sample network topology; determine the sample data statistical features corresponding to the sample IP address based on the training sample logs; input the sample graph features and sample data statistical features corresponding to the sample IP address into an initial recognition model to obtain the predicted scanning attack sample IP address in the sample IP address; train the initial recognition model based on the scanning attack sample IP address and the predicted scanning attack sample IP address to obtain the preset recognition model.

[0147] This application provides a storage medium storing a computer program thereon. The computer-readable storage medium stores one or more programs, which can be executed by one or more processors and applied in a network device. The computer program implements the address identification method described above.

[0148] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0149] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this disclosure, in essence, or the part that contributes to the related technology, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause an image display device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the address recognition method described in the various embodiments of this disclosure.

[0150] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application.

Claims

1. An address identification method, characterized in that, The method includes: Obtain network monitoring logs within a preset time period and the Internet Protocol (IP) addresses in the network monitoring logs; Based on the network monitoring logs, the network topology corresponding to the IP address is determined, and the graph features corresponding to the IP address are determined based on the network topology. Determine the data statistical characteristics corresponding to the IP address based on the network monitoring logs; Input the graph features and data statistical features corresponding to the IP address into a preset identification model to obtain the scanning attack IP address in the IP address; The graph features corresponding to the IP address consist of the number of out-degrees, the number of in-degrees, the node degree, the out-degree ratio, the in-degree ratio, the longest path, and the maximum relative connection density of the IP address. Wherein, the out-degree count represents the number of flows out of the IP address within a preset time period, the in-degree count represents the number of flows into the IP address within a preset time period, the node degree represents the number of IP addresses communicating with the IP address within a preset time period, the out-degree ratio represents the number of addresses where the IP address only sends data but does not receive return data, the in-degree ratio represents the number of addresses where the IP address only receives data but does not send data, the longest path represents the maximum depth of the IP address in the network topology, and the maximum relative connection density represents the ratio of the node degree of the IP address to the degree of the network topology.

2. The method according to claim 1, characterized in that, The step of determining the data statistical characteristics corresponding to the IP address based on the network monitoring log includes: The total number of outgoing bytes, total number of incoming bytes, total number of outgoing packets, and total number of incoming packets corresponding to the IP address are determined based on the network monitoring logs. The total number of outgoing bytes, total number of incoming bytes, total number of outgoing packets, and total number of incoming packets corresponding to the IP address are determined as the data statistical characteristics corresponding to the IP address.

3. The method according to claim 1, characterized in that, After obtaining the scanning attack IP address from the IP address, the method further includes: Determine the first IP address that receives the data information transmitted from the IP address of the scanning attack; The first information entropy corresponding to the scanning attack IP address is determined based on the first IP address; and the scanning type of the scanning attack IP address is determined based on the first information entropy.

4. The method according to claim 3, characterized in that, When there are multiple first IP addresses, the first information entropy corresponding to the scanning attack IP address is determined based on the first IP address; And determine the scan type of the scanning attack IP address based on the first information entropy, including: Determine a first quantity of multiple first IP addresses, and determine a first information entropy corresponding to the scanning attack IP address based on the first quantity; If the value of the first information entropy is greater than the first preset value, the scanning type of the scanning attack IP address is determined to be the first scanning type; If the value of the first information entropy is not greater than the first preset value, the scanning type of the scanning attack IP address is determined to be the second scanning type.

5. The method according to claim 3, characterized in that, When the number of the first IP addresses is one, the first information entropy corresponding to the scanning attack IP address is determined based on the first IP address; And determine the scan type of the scanning attack IP address based on the first information entropy, including: Determine the number of first ports in a first IP address that receive data information transmitted by the scanning attack IP address; and determine the first information entropy corresponding to the scanning attack IP address based on the number of first ports. If the value of the first information entropy is greater than the second preset value, the scanning type of the scanning attack IP address is determined to be the third scanning type; If the value of the first information entropy is not greater than the second preset value, the scanning type of the scanning attack IP address is determined to be the second scanning type.

6. The method according to claim 1, characterized in that, Before obtaining the network monitoring logs within the preset time period and the Internet Protocol (IP) addresses in the network monitoring logs, the method further includes: Obtain the training sample logs and the sample IP addresses in the training sample logs; the sample IP addresses include normal sample IP addresses and scanning attack sample IP addresses; Based on the training sample logs, determine the sample network topology corresponding to the sample IP address, and determine the sample graph features corresponding to the sample IP address based on the sample network topology; Determine the statistical characteristics of the sample data corresponding to the sample IP address based on the training sample log; Input the sample graph features and sample data statistical features corresponding to the sample IP address into the initial identification model to obtain the predicted scanning attack sample IP address in the sample IP address; The initial identification model is trained based on the IP address of the scan attack sample and the IP address of the predicted scan attack sample to obtain the preset identification model.

7. A network device, characterized in that, The device includes: The acquisition module is used to acquire network monitoring logs within a preset time period and the Internet Protocol (IP) addresses in the network monitoring logs; The determination module is used to determine the network topology corresponding to the IP address based on the network monitoring log, and to determine the graph features corresponding to the IP address based on the network topology. The determining module is further configured to determine the data statistical characteristics corresponding to the IP address based on the network monitoring log; The input module is used to input the graph features and data statistical features corresponding to the IP address into a preset identification model to obtain the scanning attack IP address in the IP address; The graph features corresponding to the IP address consist of the number of out-degrees, the number of in-degrees, the node degree, the out-degree ratio, the in-degree ratio, the longest path, and the maximum relative connection density of the IP address. Wherein, the out-degree count represents the number of flows out of the IP address within a preset time period, the in-degree count represents the number of flows into the IP address within a preset time period, the node degree represents the number of IP addresses communicating with the IP address within a preset time period, the out-degree ratio represents the number of addresses where the IP address only sends data but does not receive return data, the in-degree ratio represents the number of addresses where the IP address only receives data but does not send data, the longest path represents the maximum depth of the IP address in the network topology, and the maximum relative connection density represents the ratio of the node degree of the IP address to the degree of the network topology.

8. A network device, characterized in that, The device includes: a processor, a memory, and a communication bus; when the processor executes the running program stored in the memory, it implements the method as described in any one of claims 1-6.

9. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-6.

Images