A network attack detection method and device

Abstract

An embodiment of the present invention provides a network attack detection method and device, the method comprising: obtaining a first traffic sequence of a network during a preset detection period, the first traffic sequence comprising traffic data collected by each terminal in the network during the preset detection period sorted by time; obtaining a network situation awareness value of the network based on the similarity between the traffic data of each terminal in the first traffic sequence; obtaining a value range of each traffic data at each sampling time point based on the network situation awareness value and the first traffic sequence; if traffic data that exceeds the value range of the corresponding sampling time point exists in the preset standard traffic sequence, it is determined that a network attack has occurred; wherein the standard traffic sequence comprises the mean value of each traffic data at each sampling time point. Through the embodiment of the present invention, automatic detection of network attacks is achieved, the accuracy of detection is increased, and the security of the network is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network attack detection method and device. Background Art

[0002] Currently, detecting distributed denial of service (DDOS) attacks from the IoT focuses on analyzing the network status of the target. The required data comes from logs generated by routers, such as Netflow logs. These logs are centrally collected and then analyzed by the detection system, which falls under the category of Deep Flow Inspection (DFI).

[0003] The detection technology solution establishes a threshold per minute for the number of packets or traffic flowing into a specific IP address. If a certain type of packet or traffic volume increases abnormally and exceeds the threshold, it is considered a DDOS attack from the Internet of Things. Once an attack is detected, the corresponding cleaning equipment must be activated to clean the attack traffic through diversion and other methods.

[0004] The current attack detection method is based on empirically generated thresholds, which may result in a large number of false positives and false negatives, making attack detection less accurate. Summary of the Invention

[0005] The purpose of the embodiments of the present invention is to provide a network attack detection method and apparatus to solve the problem that attack detection is not accurate enough due to a large number of false positives and missed positives.

[0006] In order to solve the above technical problems, the embodiment of the present invention is implemented as follows:

[0007] In a first aspect, an embodiment of the present invention provides a network attack detection method, comprising:

[0008] Acquire a first traffic sequence of the network during a preset detection period, the first traffic sequence comprising traffic data collected by each terminal in the network during the preset detection period in chronological order;

[0009] Obtaining a network situation awareness value of the network based on similarities between traffic data of each terminal in the first traffic sequence;

[0010] Obtaining a value range of each flow data at each sampling time point according to the network situation awareness value and the first flow sequence;

[0011] If there is traffic data in a preset standard traffic sequence that exceeds the value range of the corresponding sampling time point, it is determined that a network attack has occurred; wherein the standard traffic sequence includes the average value of each traffic data at each sampling time point.

[0012] In a second aspect, an embodiment of the present invention provides a network attack detection device, comprising:

[0013] A collection module, configured to obtain a first traffic sequence of the network during a preset detection period, wherein the first traffic sequence includes traffic data collected from each terminal in the network during the preset detection period in chronological order;

[0014] a perception module, configured to obtain a network situation awareness value of the network based on similarities between traffic data of each terminal in the first traffic sequence;

[0015] A calculation module, configured to obtain a value range of each flow data at each sampling time point according to the network situation awareness value and the first flow sequence;

[0016] The detection module is used to determine that a network attack has occurred if there is traffic data in a preset standard traffic sequence that exceeds the value range of the corresponding sampling time point; wherein the standard traffic sequence includes the average value of each traffic data at each sampling time point.

[0017] It can be seen from the technical solution provided by the above embodiment of the present invention that the embodiment of the present invention obtains the first traffic sequence of the network during the preset detection period, wherein the first traffic sequence includes the traffic data collected by each terminal in the network during the preset detection period sorted by time; according to the similarity between the traffic data of each terminal in the first traffic sequence, the network situation awareness value of the network is obtained; according to the network situation awareness value and the first traffic sequence, the value range of each traffic data at each sampling time point is obtained; if there is traffic data in the preset standard traffic sequence that exceeds the value range of the corresponding sampling time point, it is determined that the network is under attack; wherein the standard traffic sequence includes the mean value of each traffic data at each sampling time point. Through the embodiment of the present invention, automatic detection of network attacks is achieved, the accuracy of detection is increased, and the security of the network is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0019] Figure 1A schematic diagram of a flow chart of a network attack detection method provided by an embodiment of the present invention;

[0020] Figure 2 Another flowchart of the network attack detection method provided by an embodiment of the present invention;

[0021] Figure 3 Another flowchart of the network attack detection method provided by an embodiment of the present invention;

[0022] Figure 4 A schematic diagram of the blockchain structure for a network attack detection method provided by an embodiment of the present invention;

[0023] Figure 5 A schematic diagram of the network structure provided by an embodiment of the present invention;

[0024] Figure 6 A schematic diagram of the structure of a network attack detection device provided by an embodiment of the present invention;

[0025] Figure 7 A schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0026] The embodiments of the present invention provide a network attack detection method and device.

[0027] In order to enable those skilled in the art to better understand the technical solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0028] like Figure 1 As shown, an embodiment of the present invention provides a network attack detection method. The execution subject of the method can be an attack detection node in the network. The attack detection node can be a server, a terminal, or other devices. The method can specifically include the following steps:

[0029] Step S110: Acquire a first traffic sequence of the network during a preset detection period, where the first traffic sequence includes traffic data collected by each terminal in the network during the preset detection period in time order.

[0030] Each terminal in the network will report its traffic data in real time to the attack detection node in the network. The traffic data may include: source IP, traffic, packet speed, etc.

[0031] The network may be an Internet of Things.

[0032] The detection period can be set according to actual needs, for example, it can be 1 month or 1 week.

[0033] The attack detection node sorts the acquired traffic data by time to form a first traffic sequence.

[0034] Step S120: Obtain a network situation awareness value of the network based on the similarity between the traffic data of each terminal in the first traffic sequence.

[0035] The similarity between the traffic data corresponding to each terminal is calculated based on the traffic data corresponding to each terminal, and the network situation awareness value of the network is calculated based on the obtained similarity results.

[0036] Step S130: Obtain a value range of each flow data at each sampling time point according to the network situation awareness value and the first flow sequence.

[0037] Numerical calculations are performed on each flow data item in the first flow sequence based on the network situation awareness value B, and a value range of each value in each flow data item is calculated. This may include a value range of the flow rate and a value range of the packet rate of each flow data item. Since the flow data in the first flow sequence are sorted by time, each flow data item corresponds to a sampling time point. Therefore, the value range of each value in each flow data item can be a value range corresponding to each sampling time point.

[0038] Step S140: If there is traffic data exceeding the value range of the corresponding sampling time point in the preset standard traffic sequence, it is determined that a network attack has occurred; wherein the standard traffic sequence includes the average value of each traffic data at each sampling time point.

[0039] A standard flow sequence is obtained in advance. The standard flow sequence can be the same length as the first flow sequence and contain the same amount of flow data. This means that the standard flow sequence contains flow data corresponding to each sampling time point. Each flow data in the standard flow sequence can be pre-set or calculated based on historical flow data using methods such as weighted averaging.

[0040] If the values ​​in the traffic data corresponding to each sampling time point in the standard traffic sequence all meet the value range at each sampling time point, it can be determined that there is no network attack on the network.

[0041] If the value of the traffic data corresponding to any sampling time point in the standard traffic sequence exceeds the value range of any sampling time point, it can be determined that the network has been attacked. The network attack can be a DDOS attack. For simplicity, the following embodiments use DDOS attacks as an example for illustration.

[0042] Of course, it can also be set that if the number of traffic data in the standard traffic sequence that exceeds the value range of the corresponding sampling time point reaches a preset number threshold, it is determined that there is a network attack on the network; otherwise, it is determined that there is no network attack on the network.

[0043] It can be seen from the technical solution provided by the above embodiment of the present invention that the embodiment of the present invention obtains the first traffic sequence of the network during the preset detection period, wherein the first traffic sequence includes the traffic data collected by each terminal in the network during the preset detection period sorted by time; according to the similarity between the traffic data of each terminal in the first traffic sequence, the network situation awareness value of the network is obtained; according to the network situation awareness value and the first traffic sequence, the value range of each traffic data at each sampling time point is obtained; if there is traffic data in the preset standard traffic sequence that exceeds the value range of the corresponding sampling time point, it is determined that the network is under attack; wherein the standard traffic sequence includes the mean value of each traffic data at each sampling time point. Through the embodiment of the present invention, automatic detection of network attacks is achieved, the accuracy of detection is increased, and the security of the network is improved.

[0044] Based on the above embodiment, further, Figure 2 As shown, the specific processing methods of the above step S120 can be various. An optional processing method is provided below. For details, please refer to the processing of the following steps S121-S122.

[0045] Step S121: Determine the security value of each terminal according to the similarity between the traffic data of each terminal in the first traffic sequence.

[0046] In one embodiment, taking terminal i as an example, the process of determining the security value of terminal i includes:

[0047] The traffic data of terminal i is extracted from the first traffic sequence and sorted in chronological order.

[0048] Select one flow data from the flow data of the terminal i in turn as the first flow data j, and calculate the similarity sim(j,u) between the first flow data j and the flow data u of other terminals i with a later sampling time point through the second calculation formula.

[0049] In one embodiment, taking the flow rate and packet rate in the flow data as an example to calculate the similarity, the second calculation formula is expressed as follows:

[0050] sim(j,u)=(w t ×sim t (j,u)+w v ×sim v (j,u)) / |t(j,u)|

[0051] Wherein, sim(j,u) is the similarity between the first flow data j and the flow data u of the other terminal i, w t is the traffic weight, w v is the packet speed weight, t(j,u) is the sampling time difference between the first flow data j and the flow data u of the other terminal i, sim t (j, u) is the traffic similarity between the first traffic data j and the traffic data u of the other terminal i, sim v (j, u) is the packet rate similarity between the first traffic data j and the traffic data u of the other terminal i.

[0052] in,

[0053]

[0054] The number of traffic data of other terminals i whose similarity is lower than the similarity threshold is counted as the similarity statistical value n of the first traffic data j. j Since a higher similarity indicates that the values ​​in the traffic data are closer, and if a DDOS attack occurs, the values ​​in the traffic data will fluctuate, the number of traffic data with similarity lower than the similarity threshold counted here can reflect the abnormality of the traffic data.

[0055] In one embodiment, a corresponding similarity threshold may be set for each first traffic data j.

[0056] In one embodiment, the similarity threshold of the first traffic data j can be obtained by the following calculation formula:

[0057]

[0058] The similarity statistics n of all first traffic data j corresponding to the terminal i j The maximum value among them is taken as the security value A of the terminal i i .

[0059] Step S122: According to the security value of each terminal, a network situation awareness value of the network is obtained by a first calculation formula.

[0060] In one embodiment, the first calculation formula is expressed as follows:

[0061] B=A min ×∑A i / A max

[0062] Among them, A min is the minimum security value of each terminal in the network, ∑A i is the security value A of each terminal i in the network i A max is the maximum value of the security values ​​of all terminals in the network.

[0063] As can be seen from the technical solutions provided by the above embodiments of the present invention, the embodiments of the present invention determine the security value of each terminal based on the similarity between the traffic data of each terminal in the first traffic sequence; and based on the security value of each terminal, obtain the network situation awareness value of the network using a first calculation formula. Through the embodiments of the present invention, the network situation awareness value is accurately calculated to indicate the network situation, which is used for automatic detection of network attacks, thereby increasing detection accuracy and improving network security.

[0064] Based on the above embodiments, Figure 3 As shown, further, step S130 includes:

[0065] Step S131: According to the network situation awareness value B and the first traffic sequence, the upper limit values ​​of the numerical values ​​in each traffic data in the first traffic sequence are calculated by the third calculation formula to form an upper limit sequence, and the lower limit values ​​of the numerical values ​​in each traffic data in the first traffic sequence are calculated by the fourth calculation formula to form a lower limit sequence.

[0066] Furthermore, the third calculation formula is expressed as upper limit value = value in flow data × (1 + B); the fourth calculation formula is expressed as lower limit value = value in flow data × (1 + C).

[0067] The step S140 includes:

[0068] Step S141: If all traffic data in the standard traffic sequence are between the upper limit sequence and the lower limit sequence, it is determined that the network is not under a DDOS attack; otherwise, it is determined that it is under a DDOS attack. As long as the value of any traffic data in the standard traffic sequence exceeds the corresponding upper limit or is lower than the corresponding lower limit, it is determined that it is under a DDOS attack.

[0069] As can be seen from the technical solutions provided by the above embodiments of the present invention, the embodiments of the present invention calculate the upper limit of the numerical value of each flow data in the first flow sequence using the third calculation formula based on the network situation awareness value B and the first flow sequence to form an upper limit sequence, and calculate the lower limit of the numerical value of each flow data in the first flow sequence using the fourth calculation formula to form a lower limit sequence. Through the embodiments of the present invention, the accuracy of attack detection is improved and the security of the network is enhanced.

[0070] Based on the above embodiment, further, the standard flow sequence can be obtained by pre-setting or by calculation, and the embodiment of the present application provides one implementation method thereof.

[0071] Based on the length of the time window during the preset detection period, a historical traffic data sequence of the preset window data is intercepted from the historical traffic data of the network; wherein the historical traffic data sequence includes historical traffic data for the length of the time window. For example, historical traffic data for m time windows before the detection period may be selected. If the detection period is one month, historical traffic data for three months before the detection period may be selected, resulting in three historical traffic data sequences of one month each, with each historical traffic data sequence containing the same amount of traffic data.

[0072] The flow data in the historical flow data sequence of the preset window data is averaged to obtain the average value of the flow data corresponding to each sampling time point to form a standard flow sequence. The flow data in each historical flow data sequence is aligned according to the sampling time point and then averaged to obtain a flow data sequence with an average value, i.e., the standard flow sequence.

[0073] As can be seen from the technical solution provided by the above embodiment of the present invention, the embodiment of the present invention intercepts a historical traffic data sequence of preset window data from the historical traffic data of the network according to the time window length of the preset detection period; wherein the historical traffic data sequence includes historical traffic data of the time window length; the traffic data in the historical traffic data sequence of the preset window data is averaged to obtain the average value of the traffic data corresponding to each sampling time point to form a standard traffic sequence. Through the embodiment of the present invention, network attacks can be detected more accurately, thereby improving the security of the network.

[0074] Based on the above embodiments, Figure 4 and Figure 5 As shown, further, each network 402 is connected to the blockchain through a corresponding attack detection node 401, and the network 402 includes a central node 501 and each terminal 502, and the central node 501 is connected to each terminal 502 respectively.

[0075] The present application provides a blockchain structure, which evaluates the network status of the corresponding network 402 through the attack detection node 401 in the blockchain, and detects the network attack situation based on the network status perception value to achieve automatic detection of DDOS attacks.

[0076] In the blockchain, each network 402 communicates with an attack detection node 401. Each terminal in network 402 synchronizes its traffic data to attack detection node 401 in real time. Each attack detection node 401 can execute the method described in the above embodiment, namely, detecting whether the network 402 connected to it is under DDOS attack. The attack detection node 401 can be a server, a terminal, or other device, as long as it is a node in the blockchain.

[0077] like Figure 5 As shown, each network 402 may include a central node 501 and multiple terminals 502 .

[0078] The central node 501 is used to send control data to each terminal 502 and obtain traffic data uploaded by each terminal 502. The central node 501 can be a server, a user device in a network environment, or one of the terminals 502.

[0079] The central node 501 establishes a direct connection with each terminal 502 .

[0080] The terminal 502 may be an end node in the Internet of Things, such as a curtain, a computer, a switch, a water heater, etc. The terminals 502 may be connected or not connected to each other.

[0081] For a new network, such as a network composed of new terminals, if it is desired to perform the network attack detection method described above, the following steps need to be performed.

[0082] 1. The central node of the new network broadcasts a joining request to the blockchain, which includes the central node identifier, central node address, and number of terminals of the new network.

[0083] 2. After receiving the request, each node on the blockchain votes on whether to agree to join the blockchain based on the corresponding smart contract, and sends the voting results to the head node of the blockchain.

[0084] The smart contract describes the voting basis, which is predetermined, such as an address range. The voting process then determines whether the address in the request falls within the region range. If so, the vote is cast in favor, and if not, the vote is cast in the opposite direction.

[0085] The determination and voting process of smart contracts are not specifically limited here.

[0086] 3. The head node of the blockchain determines the number of votes received, n1. If the quotient of n1 and the total number of nodes in the blockchain, N, is greater than a threshold, such as 0.95, the vote is considered valid. At this time, if all votes are in favor, the new network joining request is approved.

[0087] 4. Add a node to the end of the blockchain, which establishes a connection with the new network. This node is the attack detection node corresponding to the new network.

[0088] The head of the blockchain broadcasts new node information to the blockchain and reaches consensus on smart contracts.

[0089] There can be multiple consensus smart contracts, including the aforementioned smart contract for voting on new network members, and a smart contract for attack detection. This smart contract stores the network attack detection solution provided in the above embodiment. New nodes will perform DDOS attack detection based on this smart contract.

[0090] As can be seen from the technical solutions provided by the above embodiments of the present invention, each network is connected to the blockchain through a corresponding attack detection node. The network includes a central node and terminals, and the central node is connected to each terminal separately. Through the embodiments of the present invention, each network can automatically detect network attacks by joining the blockchain, thereby improving network security.

[0091] Corresponding to the network attack detection method provided in the above embodiment, based on the same technical concept, an embodiment of the present invention also provides a network attack detection device. Figure 6 A schematic diagram of the module composition of a network attack detection device provided by an embodiment of the present invention, wherein the network attack detection device is used to perform Figures 1 to 5 Network attack detection methods described, such as Figure 6 As shown, the network attack detection device includes: a collection module 601, a perception module 602, a calculation module 603 and a detection module 604.

[0092] The acquisition module 601 is used to obtain a first traffic sequence of the network during a preset detection period, wherein the first traffic sequence includes traffic data collected by each terminal in the network during the preset detection period, sorted by time; the perception module 602 is used to obtain a network situation awareness value of the network based on the similarity between the traffic data of each terminal in the first traffic sequence; the calculation module 603 is used to obtain a value range of each traffic data at each sampling time point based on the network situation awareness value and the first traffic sequence; the detection module 604 is used to determine that a network attack has occurred if there is traffic data in the preset standard traffic sequence that exceeds the value range of the corresponding sampling time point; wherein the standard traffic sequence includes the average value of each traffic data at each sampling time point.

[0093] It can be seen from the technical solution provided by the above embodiment of the present invention that the embodiment of the present invention obtains the first traffic sequence of the network during the preset detection period, wherein the first traffic sequence includes the traffic data collected by each terminal in the network during the preset detection period sorted by time; according to the similarity between the traffic data of each terminal in the first traffic sequence, the network situation awareness value of the network is obtained; according to the network situation awareness value and the first traffic sequence, the value range of each traffic data at each sampling time point is obtained; if there is traffic data in the preset standard traffic sequence that exceeds the value range of the corresponding sampling time point, it is determined that the network is under attack; wherein the standard traffic sequence includes the mean value of each traffic data at each sampling time point. Through the embodiment of the present invention, automatic detection of network attacks is achieved, the accuracy of detection is increased, and the security of the network is improved.

[0094] Based on the above embodiment, the perception module is further configured to:

[0095] determining a safety value of each terminal based on similarities between traffic data of each terminal in the first traffic sequence;

[0096] According to the security value of each terminal, the network situation awareness value of the network is obtained by a first calculation formula. Further, the first calculation formula is expressed as follows:

[0097] B=A min ×∑A i / A max

[0098] Among them, A min is the minimum security value of each terminal in the network, ∑A i is the security value A of each terminal i in the network i A max is the maximum value of the security values ​​of all terminals in the network.

[0099] Furthermore, the perception module is used to:

[0100] Extracting traffic data of terminal i from the first traffic sequence;

[0101] Selecting one piece of flow data from the flow data of the terminal i in sequence as the first flow data j, and calculating the similarity between the first flow data j and the flow data of other terminals i whose sampling time point is later using the second calculation formula;

[0102] The number of traffic data of other terminals i whose similarity is lower than the similarity threshold is counted as the similarity statistical value n of the first traffic data j. j ;

[0103] The similarity statistics n of all first traffic data j corresponding to the terminal i j The maximum value among them is taken as the security value A of the terminal i i .

[0104] Furthermore, the second calculation formula is expressed as follows:

[0105] sim(j,u)=(w t ×sim t (j,u)+w v ×sim v (j,u)) / |t(j,u)|

[0106] Wherein, sim(j,u) is the similarity between the first flow data j and the flow data u of the other terminal i, w t is the traffic weight, w v is the packet speed weight, t(j,u) is the sampling time difference between the first flow data j and the flow data u of the other terminal i, sim t (j, u) is the traffic similarity between the first traffic data j and the traffic data u of the other terminal i, sim v (j, u) is the packet rate similarity between the first traffic data j and the traffic data u of the other terminal i.

[0107] As can be seen from the technical solutions provided by the above embodiments of the present invention, the embodiments of the present invention determine the security value of each terminal based on the similarity between the traffic data of each terminal in the first traffic sequence; and based on the security value of each terminal, obtain the network situation awareness value of the network using a first calculation formula. Through the embodiments of the present invention, the network situation awareness value is accurately calculated to indicate the network situation, which is used for automatic detection of network attacks, thereby increasing detection accuracy and improving network security.

[0108] Based on the above embodiment, further, the calculation module is used to:

[0109] According to the network situation awareness value B and the first traffic sequence, the upper limit values ​​of the numerical values ​​in each traffic data in the first traffic sequence are calculated by the third calculation formula to form an upper limit sequence, and the lower limit values ​​of the numerical values ​​in each traffic data in the first traffic sequence are calculated by the fourth calculation formula to form a lower limit sequence.

[0110] Furthermore, the third calculation formula is expressed as upper limit value = value in flow data × (1 + B); the fourth calculation formula is expressed as lower limit value = value in flow data × (1 + C).

[0111] As can be seen from the technical solutions provided by the above embodiments of the present invention, the embodiments of the present invention calculate the upper limit of the numerical value of each flow data in the first flow sequence using the third calculation formula based on the network situation awareness value B and the first flow sequence to form an upper limit sequence, and calculate the lower limit of the numerical value of each flow data in the first flow sequence using the fourth calculation formula to form a lower limit sequence. Through the embodiments of the present invention, the accuracy of attack detection is improved and the security of the network is enhanced.

[0112] Based on the above embodiment, further, the detection module is further configured to:

[0113] According to the time window length of the preset detection period, a historical traffic data sequence of the preset window data is intercepted from the historical traffic data of the network; wherein the historical traffic data sequence includes the historical traffic data of the time window length;

[0114] The flow data in the historical flow data sequence of the preset window data are averaged to obtain the average value of the flow data corresponding to each sampling time point to form a standard flow sequence.

[0115] As can be seen from the technical solution provided by the above embodiment of the present invention, the embodiment of the present invention intercepts a historical traffic data sequence of preset window data from the historical traffic data of the network according to the time window length of the preset detection period; wherein the historical traffic data sequence includes historical traffic data of the time window length; the traffic data in the historical traffic data sequence of the preset window data is averaged to obtain the average value of the traffic data corresponding to each sampling time point to form a standard traffic sequence. Through the embodiment of the present invention, network attacks can be detected more accurately, thereby improving the security of the network.

[0116] Based on the above embodiment, further, each network is connected to the blockchain through a corresponding attack detection node, and the network includes a central node and each terminal, and the central node is connected to each terminal respectively.

[0117] As can be seen from the technical solutions provided by the above embodiments of the present invention, each network is connected to the blockchain through a corresponding attack detection node. The network includes a central node and terminals, and the central node is connected to each terminal separately. Through the embodiments of the present invention, each network can automatically detect network attacks by joining the blockchain, thereby improving network security.

[0118] The network attack detection device provided in the embodiment of the present invention can implement each process in the embodiment corresponding to the above-mentioned network attack detection method. To avoid repetition, it will not be described here.

[0119] It should be noted that the network attack detection device provided in the embodiment of the present invention and the network attack detection method provided in the embodiment of the present invention are based on the same inventive concept. Therefore, the specific implementation of this embodiment can refer to the implementation of the aforementioned network attack detection method, and the repeated parts will not be repeated.

[0120] Corresponding to the network attack detection method provided in the above embodiment, based on the same technical concept, an embodiment of the present invention further provides an electronic device, which is used to execute the above network attack detection method. Figure 7 A schematic diagram of the structure of an electronic device for implementing various embodiments of the present invention is shown in FIG. Figure 7 As shown. Electronic devices may have relatively large differences due to different configurations or performances, and may include one or more processors 701 and memory 702, and the memory 702 may store one or more storage applications or data. Among them, the memory 702 may be a temporary storage or a persistent storage. The application stored in the memory 702 may include one or more modules (not shown in the figure), and each module may include a series of computer executable instructions in the electronic device. Furthermore, the processor 701 can be configured to communicate with the memory 702 to execute a series of computer executable instructions in the memory 702 on the electronic device. The electronic device may also include one or more power supplies 703, one or more wired or wireless network interfaces 704, one or more input and output interfaces 705, and one or more keyboards 706.

[0121] Specifically in this embodiment, the electronic device includes a processor, a communication interface, a memory, and a communication bus; wherein the processor, the communication interface, and the memory communicate with each other via the bus; the memory is used to store a computer program; and the processor is used to execute the program stored in the memory to implement the following method steps:

[0122] Acquire a first traffic sequence of the network during a preset detection period, the first traffic sequence comprising traffic data collected by each terminal in the network during the preset detection period in chronological order;

[0123] Obtaining a network situation awareness value of the network based on similarities between traffic data of each terminal in the first traffic sequence;

[0124] Obtaining a value range of each flow data at each sampling time point according to the network situation awareness value and the first flow sequence;

[0125] If there is traffic data in a preset standard traffic sequence that exceeds the value range of the corresponding sampling time point, it is determined that a network attack has occurred; wherein the standard traffic sequence includes the average value of each traffic data at each sampling time point.

[0126] The present application also provides a computer-readable storage medium, wherein the storage medium stores a computer program. When the computer program is executed by a processor, the following method steps are implemented:

[0127] Acquire a first traffic sequence of the network during a preset detection period, the first traffic sequence comprising traffic data collected by each terminal in the network during the preset detection period in chronological order;

[0128] Obtaining a network situation awareness value of the network based on similarities between traffic data of each terminal in the first traffic sequence;

[0129] Obtaining a value range of each flow data at each sampling time point according to the network situation awareness value and the first flow sequence;

[0130] If there is traffic data in a preset standard traffic sequence that exceeds the value range of the corresponding sampling time point, it is determined that a network attack has occurred; wherein the standard traffic sequence includes the average value of each traffic data at each sampling time point.

[0131] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, apparatus, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0132] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0133] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0134] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0135] In a typical configuration, an electronic device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0136] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0137] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0138] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0139] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, devices, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0140] The foregoing is merely an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A network attack detection method, characterized in that: The method comprises: Acquire a first traffic sequence of the network during a preset detection period, the first traffic sequence comprising traffic data collected by each terminal in the network during the preset detection period in chronological order; Obtaining a network situation awareness value of the network based on similarities between traffic data of each terminal in the first traffic sequence; Obtaining a value range of each flow data at each sampling time point according to the network situation awareness value and the first flow sequence; If there is traffic data in a preset standard traffic sequence that exceeds the value range of the corresponding sampling time point, it is determined that a network attack has occurred; wherein the standard traffic sequence includes the average value of each traffic data at each sampling time point.

2. The method according to claim 1, characterized in that Obtaining a network situation awareness value of the network according to the similarity between the flow data of each terminal in the first flow sequence includes: determining a safety value of each terminal based on similarities between traffic data of each terminal in the first traffic sequence; According to the security value of each terminal, a network situation awareness value of the network is obtained by a first calculation formula.

3. The method according to claim 2, characterized in that The first calculation formula is expressed as follows: in, is the minimum security value of each terminal in the network, is the security value of each terminal i in the network of and, is the maximum value of the security values ​​of all terminals in the network.

4. The method according to claim 2, characterized in that The determining the security value of each terminal according to the similarity between the traffic data of each terminal in the first traffic sequence includes: Extracting traffic data of terminal i from the first traffic sequence; Selecting one piece of flow data from the flow data of the terminal i in sequence as the first flow data j, and calculating the similarity between the first flow data j and the flow data of other terminals i whose sampling time point is later using the second calculation formula; The number of traffic data of other terminals i whose similarity is lower than the similarity threshold is counted as the similarity statistical value n of the first traffic data j. j ; The similarity statistics n of all first traffic data j corresponding to the terminal i j The maximum value among them is taken as the security value A of the terminal i i .

5. The method according to claim 4, characterized in that The second calculation formula is expressed as follows: Among them, the is the similarity between the first flow data j and the flow data u of the other terminal i, is the traffic weight, is the package speed weight, is the sampling time difference between the first flow data j and the flow data u of the other terminal i, is the traffic similarity between the first traffic data j and the traffic data u of the other terminal i, is the packet speed similarity between the first traffic data j and the traffic data u of the other terminal i.

6. The method according to claim 1, characterized in that The obtaining, based on the network situation awareness value and the first traffic sequence, a value range of each traffic data at each sampling time point, includes: According to the network situation awareness value B and the first traffic sequence, the upper limit values ​​of the numerical values ​​in each traffic data in the first traffic sequence are calculated by the third calculation formula to form an upper limit sequence, and the lower limit values ​​of the numerical values ​​in each traffic data in the first traffic sequence are calculated by the fourth calculation formula to form a lower limit sequence.

7. The method according to claim 6, characterized in that The third calculation formula is expressed as ; The fourth calculation formula is expressed as .

8. The method according to any one of claims 1 to 7, characterized in that: The method further comprises: According to the time window length of the preset detection period, a historical traffic data sequence of the preset window data is intercepted from the historical traffic data of the network; wherein the historical traffic data sequence includes the historical traffic data of the time window length; The flow data in the historical flow data sequence of the preset window data are averaged to obtain the average value of the flow data corresponding to each sampling time point to form a standard flow sequence.

9. The method according to claim 8, characterized in that The network is connected to the blockchain through a corresponding attack detection node. The network includes a central node and each terminal, and the central node is connected to each terminal respectively.

10. A network attack detection device, characterized in that: The device comprises: A collection module, configured to obtain a first traffic sequence of the network during a preset detection period, wherein the first traffic sequence includes traffic data collected from each terminal in the network during the preset detection period in chronological order; a perception module, configured to obtain a network situation awareness value of the network based on similarities between traffic data of each terminal in the first traffic sequence; a calculation module, configured to obtain a value range of each flow data at each sampling time point according to the network situation awareness value and the first flow sequence; The detection module is used to determine that a network attack has occurred if there is traffic data in a preset standard traffic sequence that exceeds the value range of the corresponding sampling time point; wherein the standard traffic sequence includes the average value of each traffic data at each sampling time point.

Images