A method, device, equipment and medium for processing network alarm logs

Abstract

The present application discloses a method, apparatus, device and medium for processing network alarm logs, relating to the field of computer technologies, including: obtaining network traffic to be detected and sending the network traffic to a local network attack traffic detection engine; using the network attack traffic detection engine to determine whether there is a processing flag in the network traffic, if there is a processing flag in the network traffic, generating an attack alarm log based on the network traffic and sending the attack alarm log to a local post-alarm processing engine; using the post-alarm processing engine to process the attack alarm log to obtain an alarm processing result. Through the above technical solution of the present application, the efficiency of processing network alarm logs can be improved, the workload and cost of developers can be reduced, the response ability can be improved, and thus the customer satisfaction can be enhanced.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and particularly to a method, device, equipment and medium for processing network alarm logs. Background Art

[0002] Currently, mainstream network traffic IDS (Intrusion Detection Systems) devices rely primarily on detecting abnormal behavior in network traffic through pre-extracted network traffic features, i.e., signature-based IDS. During this detection process, features are typically pre-written by threat analysts, and the detection rules are formatted in a format compatible with the text format supported by the detection engine used by the IDS device. In reality, the format used for detection features is strongly coupled to the development of the detection engine, and engine developers and rule writers often collaborate across departments. Detection engine releases and detection feature rule packages are provided separately, and their update times differ significantly. Engine releases are typically measured in weeks or months, but the minimum release time for attack detection rule packages can be measured in hours. Network attack detection also often requires code bypasses and encryption and decryption detection. If support for detecting specific complex attacks is required, such as multiple string decoding, encryption and decryption detection for specific attacks, and parsing of abnormal protocols, traditional approaches typically require the cooperation of engine code developers. The code used by traffic detection engines is typically written in programming languages such as C and C++, and has specific requirements for stability and real-time processing capabilities. This poses significant challenges, such as high programming skills requirements for developers and long testing and release cycles. However, network attack detection typically requires timely response, creating a significant conflict between the two. To address this issue, existing technologies integrate the logical functions required for specific attacks, such as attack traffic decoding, with the traffic attack detection engine, preventing threat analysts from effectively and promptly addressing sudden network attack detection issues. Therefore, by separating traditional attack detection methods from engine binding, a post-alarm log processing engine written in an interpreted programming language is proposed, which incorporates multiple encoding and decryption methods. This network attack traffic detection method processes the alarm logs output by the attack detection engine and then outputs an alarm. While existing network attack traffic detection engines can integrate attack detection behaviors through coding by engine developers, the actual development process for attack traffic detection engines involves cross-departmental collaboration between attack engine developers and threat analysts (i.e., those who write network attack traffic signatures). Their scope of work and background knowledge differ significantly. Network traffic attack detection personnel are typically software developers and are familiar with parsing network protocols and writing robust code, but they lack specific knowledge of network security detection methods. While threat analysts are generally not particularly familiar with compiled programming languages like C / C++, they possess a relatively broad knowledge of attack traffic detection and can use scripting languages to write attack traffic detection scripts.Moreover, since the network attack traffic detection engine usually has requirements for stability and real-time processing capabilities, and there are also requirements in the release process, threat analysts cannot fully participate in it. Therefore, for newly emerging threat detection requirements, there is a certain lag in detecting through the integration of the attack engine, and new attack behaviors cannot be responded to in a timely manner, resulting in the failure to meet customer needs in a timely manner.

[0003] As can be seen from the above, in the process of processing network alarm logs, how to improve the efficiency of processing network alarm logs, reduce the workload and costs of developers, improve the response ability, and thus enhance customer satisfaction is an issue to be solved in this field. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a method, device, equipment and medium for processing network alarm logs, which can improve the efficiency of processing network alarm logs, reduce the workload and costs of developers, improve the response ability, and thus enhance customer satisfaction. The specific solutions are as follows:

[0005] In a first aspect, the present application discloses a method for processing network alarm logs, including:

[0006] Obtain the network traffic to be detected and send the network traffic to the local network attack traffic detection engine;

[0007] Use the network attack traffic detection engine to determine whether there is a processing mark in the network traffic. If there is a processing mark in the network traffic, generate an attack alarm log based on the network traffic and send the attack alarm log to the local post-alarm processing engine;

[0008] Use the post-alarm processing engine to process the attack alarm log to obtain an alarm processing result.

[0009] Optionally, the obtaining of the network traffic to be detected includes:

[0010] Obtain the network traffic to be detected by using the method of offline processing network attack traffic and the method of mirror traffic.

[0011] Optionally, the using the network attack traffic detection engine to determine whether there is a processing mark in the network traffic includes:

[0012] Use the network attack traffic detection engine to perform data stream recombination operation, protocol parsing operation and abnormal attack load detection operation on the network traffic, and at the same time determine whether there is a processing mark in the network traffic.

[0013] Optionally, after determining whether there is a preset detection mark in the network traffic, it further includes:

[0014] If there is no processing mark in the network traffic, directly determine the network traffic as abnormal network traffic;

[0015] Generate an attack warning log based on the network traffic and issue an alarm according to a preset alarm method.

[0016] Optionally, before using the post-alarm processing engine to process the attack warning log, it further includes:

[0017] Add a decoding function, an encoding function, an encryption / decryption function, a blacklist function, a statistics function, a logical operation function, and an abnormal protocol parsing function to the local post-alarm processing engine.

[0018] Optionally, using the post-alarm processing engine to process the attack warning log to obtain an alarm processing result includes:

[0019] Use the decoding function, encoding function, encryption / decryption function, blacklist function, statistics function, logical operation function, and abnormal protocol parsing function in the post-alarm processing engine to perform logical processing on the attack warning log to obtain a logical processing result;

[0020] If the logical processing result is illogical, mark the attack result of the attack warning log as failed, and at the same time discard the attack warning log.

[0021] Optionally, after obtaining the logical processing result, it further includes:

[0022] If the logical processing result is logical, determine the attack warning log as an abnormal attack warning log, and mark the attack result of the attack warning log as successful;

[0023] Obtain the processing content generated during the logical processing process, display the attack result, the processing content, and the attack warning log, and at the same time perform alarm processing according to a preset alarm method.

[0024] In a second aspect, the present application discloses a network alarm log processing device, including:

[0025] A network traffic acquisition module, configured to acquire network traffic to be detected and send the network traffic to a local network attack traffic detection engine;

[0026] An attack warning log generation module, configured to use the network attack traffic detection engine to determine whether there is a processing mark in the network traffic. If there is a processing mark in the network traffic, generate an attack warning log based on the network traffic and send the attack warning log to a local post-alarm processing engine;

[0027] An attack alert log processing module is used to process the attack alert log by using the post - alert processing engine to obtain an alert processing result.

[0028] In a third aspect, the present application discloses an electronic device, including:

[0029] A memory for storing a computer program;

[0030] A processor for executing the computer program to implement the foregoing network alert log processing method.

[0031] In a fourth aspect, the present application discloses a computer storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the steps of the foregoing disclosed network alert log processing method are implemented.

[0032] It can be seen that the present application provides a network alert log processing method, including obtaining network traffic to be detected and sending the network traffic to a local network attack traffic detection engine; using the network attack traffic detection engine to determine whether there is a processing mark in the network traffic, if there is a processing mark in the network traffic, generating an attack alert log based on the network traffic and sending the attack alert log to a local post - alert processing engine; using the post - alert processing engine to process the attack alert log to obtain an alert processing result. In this embodiment, the network traffic attack alert log detected in real - time is processed twice, and the detection of specific complex attacks is completed within a reasonable lag time, supporting multiple decoding of strings, encryption and decryption detection of specific attacks, parsing of abnormal protocols and other detection methods, but not limited thereto. It has the characteristics of reducing false alarms and increasing the detection rate of successful attacks. The traffic parsing function is separated from the complex detection function, that is, traffic detection is separated from attack log processing. The function scripts written in an interpreted programming language can be encapsulated in a rule package, and there is no need for frequent engine upgrades. For complex attack detection, it can respond quickly, shorten the detection response time, and improve customer satisfaction. Since it is written in an interpreted language (such as python, ruby, lua), interpreted languages generally have low - level encapsulation of the language, reducing the need for users to master language details, improving the ease of use, and reducing the requirements for threat analysts to master compiled languages. Description of the Drawings

[0033] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are only the embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on the provided drawings.

[0034] Figure 1 It is a flowchart of a method for processing network alarm logs disclosed in this application;

[0035] Figure 2 It is a flowchart of a method for processing network alarm logs disclosed in this application;

[0036] Figure 3 It is a specific flowchart of a method for processing network alarm logs disclosed in this application;

[0037] Figure 4 It is a specific example diagram of a method for processing network alarm logs disclosed in this application;

[0038] Figure 5 It is a schematic structural diagram of a device for processing network alarm logs disclosed in this application;

[0039] Figure 6 It is a structural diagram of an electronic device provided by this application. Specific embodiments

[0040] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present invention.

[0041] Currently, mainstream network traffic IDS (Intrusion Detection Systems) devices rely primarily on detecting abnormal behavior in network traffic through pre-extracted network traffic features, i.e., signature-based IDS. During this detection process, features are typically pre-written by threat analysts, and the detection rules are formatted in a format compatible with the text format supported by the detection engine used by the IDS device. In reality, the format used for detection features is strongly coupled to the development of the detection engine, and engine developers and rule writers often collaborate across departments. Detection engine releases and detection feature rule packages are provided separately, and their update times differ significantly. Engine releases are typically measured in weeks or months, but the minimum release time for attack detection rule packages can be measured in hours. Network attack detection also often requires code bypasses and encryption and decryption detection. If support for detecting specific complex attacks is required, such as multiple string decoding, encryption and decryption detection for specific attacks, and parsing of abnormal protocols, traditional approaches typically require the cooperation of engine code developers. The code used by traffic detection engines is typically written in programming languages such as C and C++, and has specific requirements for stability and real-time processing capabilities. This poses significant challenges, such as high programming skills requirements for developers and long testing and release cycles. However, network attack detection typically requires timely response, creating a significant conflict between the two. To address this issue, existing technologies integrate the logical functions required for specific attacks, such as attack traffic decoding, with the traffic attack detection engine, preventing threat analysts from effectively and promptly addressing sudden network attack detection issues. Therefore, by separating traditional attack detection methods from engine binding, a post-alarm log processing engine written in an interpreted programming language is proposed, which incorporates multiple encoding and decryption methods. This network attack traffic detection method processes the alarm logs output by the attack detection engine and then outputs an alarm. While existing network attack traffic detection engines can integrate attack detection behaviors through coding by engine developers, the actual development process for attack traffic detection engines involves cross-departmental collaboration between attack engine developers and threat analysts (i.e., those who write network attack traffic signatures). Their scope of work and background knowledge differ significantly. Network traffic attack detection personnel are typically software developers and are familiar with parsing network protocols and writing robust code, but they lack specific knowledge of network security detection methods. While threat analysts are generally not particularly familiar with compiled programming languages like C / C++, they possess a relatively broad knowledge of attack traffic detection and can use scripting languages to write attack traffic detection scripts.Moreover, since network attack traffic detection engines usually have requirements for stability and real-time processing capabilities, and there are also requirements in the release process, threat analysts cannot fully participate. Therefore, for newly emerging threat detection requirements, there is a certain lag in detecting through the integration of attack engines, and new attack behaviors cannot be responded to in a timely manner, resulting in the inability to meet customer requirements in a timely manner. As can be seen from the above, in the process of network alarm log processing, how to improve the efficiency of network alarm log processing, reduce the workload and cost of developers, improve the response ability, and thus enhance customer satisfaction is an issue to be solved in this field.

[0042] The main purpose of this application is to solve the detection of specific complex attacks, such as the multiple decoding of strings, the encryption and decryption detection of specific attacks, the parsing of abnormal protocols, etc., and decouple the network attack detection engine from the post-alarm log processing engine, reduce the workload of attack engine developers, improve the timely response ability to complex attacks, and thus enhance customer satisfaction. The solution of the present invention includes two parts: a network attack traffic detection engine and a post-alarm processing engine. Among them, the network attack traffic detection engine is usually written in compiled languages such as C / C++, such as suricata, snort, and the self-developed network attack detection engine. The network attack traffic detection engine is mainly responsible for reorganizing data packets, classifying protocols, detecting abnormal network attack behaviors, etc. for the accessed network traffic, and then outputting alarm logs, protocol audit logs, etc. The post-alarm log processing engine is responsible for using the specific logs marked and output by the attack detection engine as input data, processing the data in the logs according to a predetermined logic, outputting and alarming the data that meets the logic, and discarding the data that does not meet the requirements.

[0043] See Figure 1 As shown, an embodiment of the present invention discloses a method for processing network alarm logs, which may specifically include:

[0044] Step S11: Obtain the network traffic to be detected and send the network traffic to the local network attack traffic detection engine.

[0045] In this embodiment, the network traffic to be detected is obtained by using the method of offline processing of network attack traffic and the method of mirror traffic, and then the network traffic is sent to the local network attack traffic detection engine.

[0046] Step S12: Use the network attack traffic detection engine to determine whether there is a processing mark in the network traffic. If there is a processing mark in the network traffic, generate an attack alarm log based on the network traffic and send the attack alarm log to the local post-alarm processing engine.

[0047] In this embodiment, the network attack traffic detection engine takes the traffic obtained through mirroring as input, performs data stream recombination, protocol parsing, and detects abnormal attack loads through pre-loaded rules, etc. In this step, for the detected abnormal attack loads, if they are not specially marked (that is, there is no processing mark in the network traffic), they do not enter the post-warning processing engine and are directly alarmed, that is, an attack alarm log is generated. For the attack loads with special marks (that is, there is a processing mark in the network traffic, and the marking method is not limited to matching rule numbers, rule names, rule classifications, etc.), they enter the post-warning processing engine for processing.

[0048] Step S13: Use the post-warning processing engine to process the attack alarm log to obtain an alarm processing result.

[0049] In this embodiment, before using the post-warning processing engine to process the attack alarm log, it further includes: adding a decoding function, an encoding function, an encryption / decryption function, a blacklist function, a statistics function, a logical operation function, and an abnormal protocol parsing function to the local post-warning processing engine.

[0050] Specifically, use the decoding function, encoding function, encryption / decryption function, blacklist function, statistics function, logical operation function, and abnormal protocol parsing function in the post-warning processing engine to perform logical processing on the attack alarm log to obtain a logical processing result. If the logical processing result is illogical, mark the attack result of the attack alarm log as failed, and at the same time discard the attack alarm log; if the logical processing result is logical, determine that the attack alarm log is an abnormal attack alarm log, mark the attack result of the attack alarm log as successful, obtain the processing content generated during the logical processing, and display the attack result, the processing content, and the attack alarm log, and at the same time perform alarm processing according to a preset alarm method.

[0051] In this embodiment, for the attack warning logs marked to enter the post-warning processing engine, they are processed according to the corresponding logic of the corresponding vulnerabilities. The post-warning processing engine includes decoding and encoding function modules (including but not limited to URL (Uniform Resource Locator) decoding, Base64 decoding), encryption and decryption modules (including but not limited to XOR decryption, AES (Advanced Encryption Standard) decryption, MD5 (Message-Digest Algorithm) hash collision, etc.), blacklist list modules (JAVA code blacklist,), statistical modules, logical operation modules, abnormal protocol parsing modules, etc. For those successfully processed according to the corresponding logic, the corresponding warning name is modified, the attack status is modified (whether the attack is successful), the processed message content is displayed (such as the decrypted content display), etc. For the logs that have not been successfully processed and enter the corresponding detection logic, the attack result is marked as failed and discarded without generating warnings, etc.

[0052] In this embodiment, the network traffic to be detected is obtained and sent to the local network attack traffic detection engine; the network attack traffic detection engine is used to determine whether there is a processing mark in the network traffic. If there is a processing mark in the network traffic, an attack warning log is generated based on the network traffic and sent to the local post-warning processing engine; the post-warning processing engine is used to process the attack warning log to obtain a warning processing result. In this embodiment, the network traffic attack warning logs detected in real time are processed twice, and the detection of specific complex attacks is completed within a reasonable lag time, supporting multiple decoding of strings, encryption and decryption detection of specific attacks, parsing of abnormal protocols and other detection methods, but not limited to this. It has the characteristics of reducing false alarms and improving the detection rate of successful attacks. The traffic parsing function is separated from the complex detection function, that is, traffic detection is separated from attack log processing. The function scripts written in an interpreted programming language can be encapsulated in a rule package, and there is no need for frequent engine upgrades. For complex attack detection, it can respond quickly, shorten the detection response time, and improve customer satisfaction. Since it is written in an interpreted language (such as python, ruby, lua), interpreted languages generally have low-level encapsulation of the language, reducing the need for users to master language details, improving usability, and reducing the requirements for threat analysts to master compiled languages.

[0053] See Figure 2 As shown, an embodiment of the present invention discloses a method for processing network warning logs, which may specifically include:

[0054] Step S21: Obtain the network traffic to be detected and send the network traffic to the local network attack traffic detection engine.

[0055] Step S22: Use the network attack traffic detection engine to perform data stream reorganization operation, protocol parsing operation, and abnormal attack load detection operation on the network traffic. At the same time, determine whether there is a processing mark in the network traffic. If there is a processing mark in the network traffic, generate an attack alarm log based on the network traffic and send the attack alarm log to the local post-alarm processing engine.

[0056] In this embodiment, after determining whether there is a preset detection mark in the network traffic, it further includes: if there is no processing mark in the network traffic, directly determine the network traffic as abnormal network traffic; generate an attack alarm log based on the network traffic and perform alarm according to a preset alarm method.

[0057] Step S23: Use the post-alarm processing engine to process the attack alarm log to obtain an alarm processing result.

[0058] In this embodiment, the specific process is as Figure 3 shown. First, obtain the network traffic to be detected by using the method of offline processing network attack traffic and the method of mirror traffic; then send the network traffic to the local network attack traffic detection engine; then use the network attack traffic detection engine to determine whether there is a processing mark in the network traffic. If there is a processing mark in the network traffic (i.e., there is a specific attack), generate an attack alarm log based on the network traffic and send the attack alarm log to the local post-alarm processing engine. Use the decoding function, encoding function, encryption / decryption function, blacklist function, statistical function, logical operation function, and abnormal protocol parsing function in the post-alarm processing engine to perform logical processing on the attack alarm log to obtain a logical processing result. Determine the logical processing result. If the logical processing result is illogical, mark the attack result of the attack alarm log as failed, and at the same time discard the attack alarm log (i.e., do not alarm). If the logical processing result is logical, determine the attack alarm log as an abnormal attack alarm log, mark the attack result of the attack alarm log as successful, obtain the processing content generated during the logical processing, and display the attack result, the processing content, and the attack alarm log, and at the same time perform alarm processing according to a preset alarm method; if there is no processing mark in the network traffic (i.e., there is no specific attack), directly determine the network traffic as abnormal network traffic, generate an attack alarm log based on the network traffic, and perform alarm according to a preset alarm method.

[0059] Taking the detection of HTTP (Hyper Text Transfer Protocol) tunnel communication involved in MetaSploit (The Metasploit Framework, MSF with high modularity) as an example, the specific process is as follows Figure 4As shown, in the first step, the data packets containing MetaSploit HTTP tunnel communication are replayed in the network attack traffic detection engine, which, together with the method of mirroring traffic, is called the parallel method. The replay method is an offline method for processing network attack traffic detection. The network traffic to be detected is obtained by mirroring traffic. In the second step, triggering the MetaSploit HTTP tunnel communication alarm by replaying in the attack traffic detection engine. The attack payload is the attack traffic of the HTTP protocol, and one of the URLs is aaa / whmlWItb4jfIRslEqZA_KgttDeRXpBg / , but the communication will change dynamically according to different factors (such as operating system changes, operation time, etc.). For example, / sAKn6SUwQ3jCMsQwo3Anpwvh3KC-GtoZ82XVkSauqJHx2O8TW541RBIwP6Zx6IL3_cQ3lPufQ2AH4s / 0L3xh9Nz1dgPjA6Nbam9AQCUn3YDwlrz_ELAvCqrioS04AbomYMuOGxtyLkMGws3ib9Z, etc. Therefore, there is a problem of difficult detection. Currently, the rules in the attack traffic detection engine are used to match the HTTP request traffic that seemingly contains this type of URL. In the third step, the attack logs of the incoming MetaSploit HTTP tunnel communication in the first step are sent to the post-alarm processing engine. Currently, for the alarm logs hit in step A, it cannot be fully confirmed whether they are real attacks or false alarms of normal business traffic in real business. Through the analysis of the source code of MetaSploit HTTP tunnel communication by threat analysis engineers in the early stage, it can be known that the way to generate this type of URL is to encode the fixed allocation ID of the operating system architecture of the controlled host (for example, mapping X86 to number 1), the fixed allocation ID of the operating system type of the controlled host (for example, mapping android to number 3), the system timestamp, and multiple XOR encryption keys in a fixed way (8-bit checksum), and then perform Base64 encoding for transmission, and add random characters in front of the Base64 encoding, such as aaa in aaa / whmlWItb4jfIRslEqZA_KgttDeRXpBg / . In the post-processing engine, perform the reverse operation on the URL (aaa / whmlWItb4jfIRslEqZA_KgttDeRXpBg / ) obtained in the first step according to the URL generation method described above, and the information existing in the corresponding URL can be obtained. For similar URLs existing in normal business, since they cannot pass the corresponding detection logic, no alarm will be generated in the post-alarm processing engine, avoiding false alarms of normal business and thus having an impact. In the fourth step, the alarm logs can be output to obtain information such as the HTTP_MSF version, etc.

[0060] In this embodiment, the network traffic to be detected is obtained and sent to the local network attack traffic detection engine; the network attack traffic detection engine is used to determine whether there is a processing tag in the network traffic. If there is a processing tag in the network traffic, an attack alarm log is generated based on the network traffic and sent to the local post-alarm processing engine; the post-alarm processing engine is used to process the attack alarm log to obtain an alarm processing result. In this embodiment, the network traffic attack alarm log detected in real time is processed twice, and the detection of specific complex attacks is completed within a reasonable lag time. It supports multiple decoding of strings, encryption and decryption detection of specific attacks, parsing of abnormal protocols and other detection methods, but is not limited thereto. It has the characteristics of reducing false alarms and improving the detection rate of successful attacks. The traffic parsing function is separated from the complex detection function, that is, traffic detection is separated from attack log processing. The function scripts written in interpretive programming languages can be encapsulated in rule packages, and there is no need for frequent engine upgrades. For complex attack detection, it can respond quickly, shorten the detection response time, and improve customer satisfaction. Since it is written in interpretive languages (such as Python, Ruby, Lua), interpretive languages generally have low-level encapsulation of the language, reducing the need for users to master language details, improving usability, and reducing the requirements for threat analysts to master compiled languages.

[0061] See Figure 5 As shown, an embodiment of the present invention discloses a network alarm log processing device, which may specifically include:

[0062] A network traffic acquisition module 11, configured to obtain the network traffic to be detected and send the network traffic to the local network attack traffic detection engine;

[0063] An attack alarm log generation module 12, configured to use the network attack traffic detection engine to determine whether there is a processing tag in the network traffic. If there is a processing tag in the network traffic, an attack alarm log is generated based on the network traffic and sent to the local post-alarm processing engine;

[0064] An attack alarm log processing module 13, configured to use the post-alarm processing engine to process the attack alarm log to obtain an alarm processing result.

[0065] In this embodiment, the network traffic to be detected is obtained and sent to the local network attack traffic detection engine; the network attack traffic detection engine is used to determine whether there is a processing flag in the network traffic. If there is a processing flag in the network traffic, an attack warning log is generated based on the network traffic and sent to the local post-warning processing engine; the post-warning processing engine is used to process the attack warning log to obtain a warning processing result. In this embodiment, the network traffic attack warning log detected in real time is processed twice, and the detection of specific complex attacks is completed within a reasonable lag time, supporting multiple decoding of strings, encryption and decryption detection of specific attacks, parsing of abnormal protocols and other detection methods, but not limited to this. It has the characteristics of reducing false alarms and improving the detection rate of successful attacks. The traffic parsing function is separated from the complex detection function, that is, traffic detection is separated from attack log processing. The functional scripts written in an interpreted programming language can be encapsulated in a rule package, and there is no need for frequent engine upgrades. For complex attack detection, it can respond quickly, shorten the detection response time, and improve customer satisfaction. Since it is written in an interpreted language (such as python, ruby, lua), interpreted languages generally have low-level encapsulation of the language, reducing the need for users to master language details, improving usability, and reducing the requirements for threat analysts to master compiled languages.

[0066] In some specific embodiments, the network traffic acquisition module 11 may specifically include:

[0067] The network traffic acquisition module is used to obtain the network traffic to be detected by using the methods of offline processing of network attack traffic and mirror traffic.

[0068] In some specific embodiments, the attack warning log generation module 12 may specifically include:

[0069] The judgment module is used to perform data stream recombination operations, protocol parsing operations, and abnormal attack load detection operations on the network traffic by using the network attack traffic detection engine, and at the same time judge whether there is a processing flag in the network traffic.

[0070] In some specific embodiments, the attack warning log generation module 12 may specifically include:

[0071] The abnormal network traffic determination module is used to directly determine the network traffic as abnormal network traffic if there is no processing flag in the network traffic;

[0072] The warning module is used to generate an attack warning log based on the network traffic and perform warnings according to a preset warning method.

[0073] In some specific embodiments, the attack alert log processing module 13 may specifically include:

[0074] A function addition module, configured to add decoding functions, encoding functions, encryption and decryption functions, blacklist functions, statistical functions, logical operation functions, and abnormal protocol parsing functions to the local post-alert processing engine.

[0075] In some specific embodiments, the attack alert log processing module 13 may specifically include:

[0076] A logic processing module, configured to perform logical processing on the attack alert log by using the decoding function, encoding function, encryption and decryption function, blacklist function, statistical function, logical operation function, and abnormal protocol parsing function in the post-alert processing engine to obtain a logical processing result;

[0077] A discard processing module, configured to, if the logical processing result is illogical, mark the attack result of the attack alert log as failed and discard the attack alert log.

[0078] In some specific embodiments, the attack alert log processing module 13 may specifically include:

[0079] An attack result marking module, configured to, if the logical processing result is logical, determine that the attack alert log is an abnormal attack alert log and mark the attack result of the attack alert log as successful;

[0080] An attack alert log display module, configured to obtain the processing content generated during the logical processing, display the attack result, the processing content, and the attack alert log, and perform alert processing according to a preset alert method.

[0081] Figure 6 The figure is a schematic structural diagram of an electronic device provided by an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. Among them, the memory 22 is used to store a computer program, and the computer program is loaded and executed by the processor 21 to implement the relevant steps in the network alert log processing method executed by the electronic device disclosed in any of the foregoing embodiments.

[0082] In this embodiment, the power supply 23 is used to provide operating voltages for the various hardware devices on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and no specific limitation is imposed on it here; the input / output interface 25 is used to obtain external input data or output data to the outside, and its specific interface type can be selected according to specific application needs, and no specific limitation is imposed here.

[0083] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, a random access memory, a magnetic disk, an optical disk, etc. The resources stored thereon include an operating system 221, a computer program 222, data 223, etc., and the storage method can be temporary storage or permanent storage.

[0084] Among them, the operating system 221 is used to manage and control the various hardware devices and the computer program 222 on the electronic device 20 to enable the processor 21 to perform operations and processing on the data 223 in the memory 22, and it can be Windows, Unix, Linux, etc. In addition to the computer program that can be used to complete the network alarm log processing method executed by the electronic device 20 disclosed in any of the foregoing embodiments, the computer program 222 can further include computer programs that can be used to complete other specific tasks. In addition to the data that can include the data transmitted by external devices received by the network alarm log processing device, the data 223 can also include the data collected by its own input / output interface 25, etc.

[0085] The steps of the method or algorithm described in combination with the embodiments disclosed in this article can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be placed in a random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, register, hard disk, removable disk, CD-ROM, or any other form of storage medium well-known in the technical field.

[0086] Furthermore, the embodiments of this application also disclose a computer-readable storage medium. When the computer program stored in the storage medium is loaded and executed by a processor, the steps of the network alarm log processing method disclosed in any of the foregoing embodiments are implemented.

[0087] Finally, it should also be noted that in this text, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements not only includes those elements, but also includes other elements not expressly listed, or also includes elements inherent to such process, method, article or device. Without further limitation, an element defined by the statement "comprising an..." does not exclude the existence of additional identical elements in the process, method, article or device comprising the said element.

[0088] The above has introduced in detail a network alarm log processing method, apparatus, device and storage medium provided by the present invention. Specific examples are used in this text to elaborate on the principle and implementation manner of the present invention. The description of the above embodiments is only used to help understand the method and its core idea of the present invention; at the same time, for those of ordinary skill in the art, according to the idea of the present invention, there will be changes in the specific implementation manner and application scope. In summary, the content of this specification should not be construed as a limitation to the present invention.

Claims

1. A method for processing network alarm logs, characterized in that, Including: Obtain the network traffic to be detected and send the network traffic to the local network attack traffic detection engine; Use the network attack traffic detection engine to determine whether there is a processing mark in the network traffic. If there is a processing mark in the network traffic, generate an attack alarm log based on the network traffic and send the attack alarm log to the local post-alarm processing engine; Use the post-alarm processing engine to process the attack alarm log to obtain an alarm processing result; Among them, the step of using the network attack traffic detection engine to determine whether there is a processing mark in the network traffic includes: using the network attack traffic detection engine to perform data stream recombination operation, protocol parsing operation, and abnormal attack load detection operation on the network traffic, and simultaneously determining whether there is a processing mark in the network traffic; After determining whether there is a preset detection mark in the network traffic, it further includes: if there is no processing mark in the network traffic, directly determine the network traffic as abnormal network traffic; generate an attack alarm log based on the network traffic and perform an alarm according to a preset alarm method.

2. The network alarm log processing method according to claim 1, wherein The step of obtaining the network traffic to be detected includes: Obtain the network traffic to be detected by using the method of offline processing network attack traffic and the method of mirror traffic.

3. The network alarm log processing method according to any one of claims 1 to 2, characterized in that Before using the post-alarm processing engine to process the attack alarm log, it further includes: Add a decoding function, an encoding function, an encryption / decryption function, a blacklist function, a statistics function, a logical operation function, and an abnormal protocol parsing function to the local post-alarm processing engine.

4. The network alarm log processing method according to claim 3, wherein The step of using the post-alarm processing engine to process the attack alarm log to obtain an alarm processing result includes: Use the decoding function, encoding function, encryption / decryption function, blacklist function, statistics function, logical operation function, and abnormal protocol parsing function in the post-alarm processing engine to perform logical processing on the attack alarm log to obtain a logical processing result; If the logical processing result is illogical, mark the attack result of the attack alarm log as failed, and at the same time discard the attack alarm log.

5. The network alarm log processing method according to claim 4, wherein After obtaining the logical processing result, it further includes: If the logical processing result is logical, determine the attack alarm log as an abnormal attack alarm log, and mark the attack result of the attack alarm log as successful; Obtain the processing content generated during the logical processing process, display the attack result, the processing content, and the attack alarm log, and at the same time perform an alarm processing according to a preset alarm method.

6. A network alarm log processing device, characterized in that, Including: A network traffic acquisition module, configured to obtain the network traffic to be detected and send the network traffic to the local network attack traffic detection engine; An attack alarm log generation module, configured to use the network attack traffic detection engine to determine whether there is a processing mark in the network traffic. If there is a processing mark in the network traffic, generate an attack alarm log based on the network traffic and send the attack alarm log to the local post-alarm processing engine; An attack alert log processing module, which is used to process the attack alert log by using the post-alert processing engine to obtain an alert processing result; Among them, the step of using the network attack traffic detection engine to determine whether there is a processing flag in the network traffic includes: using the network attack traffic detection engine to perform data stream recombination operation, protocol parsing operation and abnormal attack load detection operation on the network traffic, and at the same time determining whether there is a processing flag in the network traffic; After determining whether there is a preset detection flag in the network traffic, the following steps are further included: if there is no processing flag in the network traffic, directly determine the network traffic as abnormal network traffic; generate an attack alert log based on the network traffic, and perform an alert according to a preset alert method.

7. An electronic device, characterized in that, It includes: A memory, which is used to store computer programs; A processor, which is used to execute the computer programs to implement the network alert log processing method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, It is used to store computer programs; among them, when the computer programs are executed by the processor, the network alert log processing method according to any one of claims 1 to 5 is implemented.

Images