A network security protection method, terminal and storage medium

Abstract

The present invention discloses a network security protection method, terminal and storage medium, which obtains the attack event sequence of the network to be detected and inputs it into the network attack action generation model to obtain the corresponding predicted attack action; uses the attack weapon of the predicted attack action to carry out a network attack on the preset attack target of the network to be detected; when the network attack is an invalid attack, generates the next attack event sequence according to the predicted attack action, and continues to execute the steps of inputting the next attack event sequence into the network attack action generation model, generating the predicted attack action and using the attack weapon of the predicted attack action to carry out a network attack on the preset attack target of the network to be detected, until the network attack is a valid attack; according to the valid attack, determines the corresponding network vulnerability and repairs the vulnerability of the network to be detected. Through the above scheme, the network to be detected can be efficiently repaired before the network attack arrives, and the security capability of the network is efficiently improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security protection method, a terminal and a computer-readable storage medium. Background Art

[0002] With the rapid development of technologies such as the Internet, big data, and the Internet of Things, a large number of network devices have been connected to the network and become targets of malicious attackers. In recent years, network attacks have been on the rise, and more and more attack weapons have been developed and used by attackers, especially in Advanced Persistent Threat (APT) attacks, which seriously threaten network security. Therefore, how to improve the network's defense capabilities has become crucial.

[0003] In the prior art, network attack testing is often used to improve the defense capability of network attacks. Network attack testing usually uses existing network attack weapons to launch network attacks on the device or network under test to find the weak points in the device or network under test, so as to find network vulnerabilities as early as possible, take protective measures, repair vulnerabilities in time, reduce potential security threats, and thus improve the defense capability of the network.

[0004] As can be seen from the above, the current network attack test needs to rely on network attack technology. The current network attack technology usually includes scanning detection, weapon construction, vulnerability exploitation, lateral movement, target achievement and other stages. It is necessary to conduct a comprehensive detection of the target system, extract key feature information, compare the detection results with the existing vulnerability library, and extract attack weapons to implement network attacks. Therefore, in order to make the network attack test more perfect and further improve the network's defense capabilities, a large amount of prior knowledge reserves in the security field are required, especially the need to establish a large-scale vulnerability attack library in advance to cover most common vulnerabilities, resulting in a large amount of resource consumption, and the need to update the knowledge base regularly. This method can only replay existing attack weapons according to predefined rules, resulting in the inability of network attack testing technology to cope with unknown threats. In the context of APT attacks, it is difficult to adapt to the rapid changes of attackers, resulting in low network security and low defense capabilities, which seriously restricts the development of cyberspace security defense technology.

[0005] Based on this, how to provide a network security protection technology that can improve network defense capabilities and network security has become a technical problem that needs to be solved urgently. Summary of the invention

[0006] The main purpose of the present invention is to provide a network security protection method, a terminal and a computer-readable storage medium, aiming to solve the technical problems of low network security and poor defense capability in the prior art.

[0007] In order to achieve the above object, an embodiment of the present invention provides a network security protection method, the method comprising:

[0008] Obtaining an attack event sequence of the network to be detected; wherein the attack event sequence is composed of a number of attack actions arranged in order of attack time;

[0009] Inputting the attack event sequence into a network attack action generation model to obtain a predicted attack action of the attack event sequence;

[0010] Determining an attack weapon corresponding to the predicted attack action, and using the attack weapon to carry out a network attack on a preset attack target of the network to be detected;

[0011] In the case where the network attack is an invalid attack, the attack event sequence is updated according to the predicted attack action, a next attack event sequence is generated, and the steps of inputting the next attack event sequence into the network attack action generation model, generating a predicted attack action, and using the predicted attack action to perform a network attack on a preset attack target of the network to be detected are continued until the network attack is a valid attack;

[0012] According to the effective attack, the corresponding network vulnerability is determined and the vulnerability is repaired for the network to be detected.

[0013] Optionally, before inputting the attack event sequence into the network attack action generation model, the method further includes: generating the network attack action generation model, specifically including:

[0014] Acquire training samples; wherein the training samples include: a sample attack event sequence, and a labeled attack action of the sample attack event sequence;

[0015] Inputting the sample attack event sequence into a preset network model to obtain a predicted attack action at the next moment of the sample attack event sequence;

[0016] According to the labeled attack action of the sample attack event sequence and the predicted attack action, the preset network model is adjusted, and the step of inputting the next sample attack event sequence into the preset network model to generate the predicted attack event action is continued until the training status of the preset network model meets the preset conditions, thereby obtaining a trained network attack action generation model.

[0017] Optionally, before obtaining the training sample, the method further includes:

[0018] Acquire a historical attack event sequence of each other network environment; wherein the other network environment is a network environment other than the network to be detected; the historical attack event sequence is composed of a number of historical attack actions sorted by attack time;

[0019] Iteratively extracting a number of historical attack actions from the historical attack event sequence according to a preset length to obtain a number of historical attack event subsequences;

[0020] Using each of the historical attack event subsequences as the sample attack event sequence; and

[0021] Determining, from the historical attack event sequence, a historical attack action at the next moment of the historical attack event subsequence as the label attack action;

[0022] The training sample is formed according to the sample attack event sequence and the corresponding label attack action.

[0023] Optionally, after acquiring the historical attack event sequences of each other network environment, the method further includes:

[0024] Obtaining executable attack code for each of the historical attack event sequences;

[0025] Disassembling the executable attack code to obtain executable attack code segments corresponding to each historical attack action in the historical attack event sequence;

[0026] The executable attack code segment corresponding to the historical attack action is stored in a preset attack weapon library as an attack weapon of the historical attack action.

[0027] Optionally, after using the executable attack code segment corresponding to the historical attack action as the attack weapon of the historical attack action, the method further includes:

[0028] Generate an association relationship between the historical attack action and the corresponding attack weapon, and store it in a preset relationship table.

[0029] Optionally, the determining the attack weapon corresponding to the predicted attack action specifically includes:

[0030] Determine the association relationship corresponding to the predicted attack action according to the preset relationship table;

[0031] Based on the association relationship, the attack weapon corresponding to the predicted attack action is obtained from the preset attack weapon library.

[0032] Optionally, historical attack event sequences of other network environments are obtained, specifically including:

[0033] Acquire original attack behavior data collected by a preset probe system from the other network environment; wherein the original attack behavior data at least includes: attack actions and attacked objects corresponding to each attack action;

[0034] According to the classification of the attacked object and the attack time, corresponding attack actions are extracted from the original attack data to form an attack event sequence of the other network environment.

[0035] Optionally, after the sample attack event sequence and the corresponding label attack action are combined into the training sample, the method further includes:

[0036] According to the training samples, an attack event data set is formed;

[0037] Dividing the attack event data set into a training sample set and a test sample set according to a preset ratio;

[0038] Among them, the training samples in the training sample set are used to train the preset network model; the training samples in the test sample set are used to test the network attack action generation model.

[0039] Optionally, after obtaining the trained network attack action generation model, the method further includes:

[0040] Testing the network attack action generation model according to the training samples in the test sample set to determine whether the network attack action generation model complies with the preset rules;

[0041] In the case that the network attack action generation model does not conform to the preset rules, the network attack action generation model continues to be trained until the network attack action generation model conforms to the preset rules.

[0042] Optionally, inputting the attack event sequence into a network attack action generation model to obtain a predicted attack action of the attack event sequence specifically includes:

[0043] Inputting the attack event sequence into a network attack action generation model to obtain a number of predicted attack actions at the next moment and an output probability of each predicted attack action;

[0044] A predicted attack event is randomly selected from the first N predicted attack actions with the largest output probabilities as the predicted attack action of the attack event sequence.

[0045] Optionally, there is at least one preset attack target.

[0046] In order to achieve the above objectives, an embodiment of the present invention also provides a computer-readable storage medium, which stores one or more programs. The one or more programs can be executed by one or more processors to implement the steps in the network security protection method as described in any one of the above.

[0047] In order to achieve the above-mentioned purpose, an embodiment of the present invention also provides a terminal, which includes: a processor and a memory; the memory stores a computer-readable program that can be executed by the processor; when the processor executes the computer-readable program, it implements the steps in the network security protection method described in any one of the above.

[0048] The present invention first obtains the attack event sequence of the network to be detected, and then inputs the attack event sequence into a network attack action generation model to obtain the predicted attack action of the attack event sequence, and uses the attack weapon corresponding to the predicted attack action to carry out a network attack on a preset attack target of the network to be detected. In the case that the network attack is an invalid attack, the attack event sequence is updated by predicting the attack action, and the predicted attack action of the updated attack event sequence is obtained through the network attack action generation model, and then a network attack is carried out on the preset attack target of the network to be detected, until the attack on the network to be detected is successful, thereby determining the corresponding network vulnerability to repair the network vulnerability.

[0049] Among them, through the above scheme, the attack event sequence is obtained to actively attack the network to be detected. Compared with predicting the attacker's next attack action based on the attack action that the network to be detected has already suffered, the network vulnerability of the network to be detected can be repaired before the network attack. Moreover, in the present invention, through the network attack action generation model, the attack action at the next moment can be quickly generated (i.e., the predicted attack action), saving the time of attack action generation, thereby improving the efficiency of complete network protection. In addition, the present invention continuously generates new attack actions through the network attack action generation model, which can effectively respond to unknown threats, further improve network security protection capabilities, and improve the security and network defense capabilities of the network to be detected. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 A flowchart of a network security protection method provided by an embodiment of the present invention;

[0051] Figure 2 A schematic diagram of a network security protection method provided by an embodiment of the present invention;

[0052] Figure 3 A flowchart of step S102 provided in an embodiment of the present invention;

[0053] Figure 4 A flow chart of generating a network attack action generation model provided by an embodiment of the present invention;

[0054] Figure 5 Another flow chart of the network security protection method provided by the embodiment of the present invention;

[0055] Figure 6A schematic diagram of obtaining a sample attack event sequence using an information security competition provided by an embodiment of the present invention as an example;

[0056] Figure 7 A schematic diagram of a network attack action generation model provided by an embodiment of the present invention;

[0057] Figure 8 Another flow chart of the network security protection method provided by the embodiment of the present invention;

[0058] Fig. 9 A schematic diagram of the structure of a terminal provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical solution and advantages of the present invention clearer and more specific, the present invention is further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0060] With the rapid development of technologies such as the Internet and the Internet of Things, network security protection has become a limiting condition for their development. In order to improve network security, network attack testing (such as penetration testing) technology is currently used to detect security risks in network systems and patch vulnerabilities before network attacks arrive. In this process, it is necessary to rely on network attack technology. Current network attack technology usually includes scanning detection, weapon construction, vulnerability exploitation, lateral movement, target achievement and other stages. It is necessary to conduct a comprehensive detection of the target system, extract key feature information, compare the detection results with the existing vulnerability library, extract attack weapons to implement network attacks, and complete network attack tests. However, the current network attack technology has the following problems:

[0061] 1) It relies heavily on expert knowledge. It requires a large amount of prior knowledge in the security field, especially the need to build a large-scale vulnerability attack library in advance to cover most common vulnerabilities. This will lead to a large amount of resource consumption and the knowledge base needs to be updated regularly.

[0062] 2) It is difficult to generate new attack methods. Relying on pre-built vulnerability attack libraries and replaying attack weapons in the vulnerability attack library, it is impossible to explore new attack methods, thus being unable to cope with unknown threats. Under APT attacks, it is difficult to adapt to the rapid changes of attackers.

[0063] 3) The speed of generating attacks is slow. Since the current network attack technology relies on the scanning and detection of the network system and the manual attack weapon attack, the efficiency of generating attacks is low and the time is long. This makes it difficult to quickly and randomly mutate the attack and generate a large amount of attack data in a short period of time, thus limiting the improvement of network security.

[0064] Therefore, current network attack testing technology is difficult to update and iterate, and cannot cope with new threats, which seriously restricts the development of network security defense technology.

[0065] Based on this, how to realize a network security protection technology with high efficiency and strong defense capability has become a technical problem that needs to be solved urgently.

[0066] In order to solve the above technical problems, the embodiment of the present invention provides a network security protection method, such as Figure 1 As shown, the network security protection method includes at least the following steps:

[0067] S101, obtaining a sequence of attack events of a network to be detected.

[0068] Among them, the attack event sequence consists of several attack actions sorted according to the attack time.

[0069] In the embodiment of the present invention, the attack event sequence of the network to be detected can be randomly generated, or obtained from a historical attack event sequence, or generated in the previous stage of the network attack action generation model, which is not specifically limited in the embodiment of the present invention.

[0070] like Figure 2 As shown, after obtaining the attack event sequence of the network to be detected, the model can be loaded to obtain a preset network attack action generation model. Among them, the network attack action generation model can predict the attack action at the next moment according to the input attack event sequence.

[0071] And, if Figure 2 As shown, each attack action in the attack event sequence of the network to be detected needs to be vectorized. In an embodiment of the present invention, the attack action can be converted into a vectorized representation by a preset natural language vectorization algorithm, including but not limited to a word set model, a bag of words model, a word embedding model, etc.

[0072] It can be understood that any attack action in the embodiment of the present invention is represented by vectorization, which will not be described in detail later.

[0073] S102, inputting the attack event sequence into a network attack action generation model to obtain a predicted attack action of the attack event sequence.

[0074] Among them, the predicted attack action of the attack event sequence, that is, the attack action at the next moment of the attack event sequence, can be generated by a network attack action generation model.

[0075] like Figure 3 As shown, step S102 can be implemented by at least the following steps:

[0076] S301, input the attack event sequence into the network attack action generation model to obtain a number of predicted attack actions at the next moment and the output probability of each predicted attack action.

[0077] like Figure 2 As shown in Figure 1, the network attack action model can predict the possible attack actions and their probabilities at the next moment based on the input attack event sequence.

[0078] S302: Randomly select a predicted attack action from the first N predicted attack actions with the largest output probabilities as the predicted attack action of the attack event sequence.

[0079] Wherein, N is a preset parameter.

[0080] Through the above steps S301-S302, the diversity and randomness of the generated predicted attack actions can be guaranteed, so that the network attack on the network to be detected is more in line with reality, thereby further improving the security protection capability of the network.

[0081] S103, determining an attack weapon corresponding to the predicted attack action, and using the attack weapon to carry out a network attack on a preset attack target of the network to be detected.

[0082] There is at least one preset attack target for the network to be detected.

[0083] In the embodiment of the present invention, the attack weapon of the predicted attack action can be extracted according to the preset attack weapon library, so as to carry out network attacks on different preset attack targets in the network to be detected according to the attack weapon.

[0084] S104, determining whether the network attack is a valid attack.

[0085] like Figure 2 As shown, after a network attack is carried out on the network to be detected, an attack verification is performed to verify the effectiveness of the network attack.

[0086] Specifically, after a network attack is carried out on a preset attack target of the network to be detected by predicting the attack weapon corresponding to the attack action, the attack result can be determined to determine whether the network attack is effective.

[0087] Among them, a valid attack indicates that the network attack is successful, and an invalid attack indicates that the network attack is successfully defended.

[0088] S105, when the network attack is an invalid attack, the attack event sequence is updated according to the predicted attack action to generate the next attack event sequence.

[0089] In the case that the network attack is an invalid attack, the predicted attack action is added to the attack event sequence to obtain the next attack event sequence.

[0090] For example, the attack event sequence is: attack action A, attack action B, attack action C, and they are sorted by attack time. Then the predicted attack action D is added to the attack event sequence, and the next attack event sequence generated is: attack action A, attack action B, attack action C, predicted attack action D.

[0091] S106, continue to execute the steps of inputting the next attack event sequence into the network attack action generation model, generating a predicted attack action, and using the predicted attack action to perform a network attack on a preset attack target of the network to be detected, until the network attack is a valid attack.

[0092] Through step S106, a new predicted attack action can be generated, and the new predicted attack action can be used to conduct a network attack again on the preset attack target of the network to be detected, and determine whether the network attack is a valid attack. When the network attack is an invalid attack, continue to execute steps S105-S106 until the network attack is a valid attack, that is, until a successful predicted attack action can be generated to complete the attack on the preset attack target, that is, the defense of the network to be detected fails.

[0093] S107: According to the effective attack, a corresponding network vulnerability is determined and the vulnerability is repaired on the network to be detected.

[0094] If the network attack is a valid attack, it indicates that the network to be detected has a network vulnerability. In the embodiment of the present invention, the network vulnerability can be displayed to the R&D personnel so that the R&D personnel can repair the network vulnerability, thereby improving the security protection capability of the network and completing the defense before the network attack arrives.

[0095] The network security protection method provided by the present invention obtains the attack event sequence of the network to be detected, and then inputs the attack event sequence into a network attack action generation model to obtain the predicted attack action of the attack event sequence, and uses the attack weapon corresponding to the predicted attack action to carry out a network attack on the preset attack target of the network to be detected. In the case that the network attack is an invalid attack, the attack event sequence is updated by predicting the attack action, and the predicted attack action of the updated attack event sequence is obtained by the network attack action generation model, and then the network attack is carried out on the preset attack target of the network to be detected, until the attack on the network to be detected is successful, thereby determining the corresponding network vulnerability to repair the network vulnerability.

[0096] Through the above scheme, the attack event sequence is obtained to actively attack the network to be detected. Compared with predicting the attacker's next attack action based on the attack action that the network to be detected has already suffered, the network vulnerability of the network to be detected can be repaired before the network attack. In addition, the network attack action generation model in the present invention can quickly generate the attack action at the next moment (i.e., predict the attack action), saving the time of attack action generation, thereby improving the efficiency of complete network protection. In addition, the present invention continuously generates new attack actions through the network attack action generation model, which can effectively respond to unknown threats, further improve network security protection capabilities, and improve the security and network defense capabilities of the network to be detected.

[0097] In some embodiments of the present invention, before inputting the attack event sequence into the network attack action generation model, it is also necessary to generate and store the network attack action generation model. Figure 4 As shown, generating a network attack action generation model can be achieved by at least the following steps:

[0098] S401, obtaining training samples.

[0099] The training samples include: sample attack event sequences and labeled attack actions of each sample attack event sequence. The sample attack event sequence is composed of a number of sample attack events in order of attack events, and the labeled attack action is the real attack action of the sample attack event sequence at the next moment.

[0100] In the embodiment of the present invention, the training samples may be obtained from a training sample set.

[0101] In some embodiments of the present invention, an attack event dataset is required before executing step S401, such as Figure 5 As shown, the embodiment of the present invention may further include the following steps:

[0102] S501, obtaining historical attack event sequences of other network environments.

[0103] Among them, other network environments are other network environments except the network to be detected. Other network environments at least include: information security competitions, real network environments, etc. For example: information security flag grabbing competitions, etc. The historical attack event sequence is composed of several historical attack actions sorted by attack events. In addition, the historical attack event sequence contains the temporal dependency of historical attack actions, which can reflect the attack behavior pattern.

[0104] In an embodiment of the present invention, the original attack behavior data collected by the preset probe system from other network environments can be first obtained; then, according to the classification of the attacked object and the attack time, the corresponding attack actions are extracted from the original attack data to form a historical attack event sequence of other network environments.

[0105] The above-mentioned original attack behavior data at least includes: attack actions, and the attacked objects corresponding to each attack action. The preset probe system at least includes: network probes and host probes. The network probe records various network-level information such as key node traffic information, network protocol data, and device control data, and the host probe records system-level information such as file operations, process behaviors, and user behaviors.

[0106] It is understandable that in addition to the preset probe system, firewalls, intrusion detection systems, anti-virus software, etc. can also be used to continuously monitor the target network and host and record the attacker's attack behavior (original attack data).

[0107] S502, iteratively extracting a number of historical attack actions from the historical attack event sequence according to a preset length to obtain a number of historical attack event subsequences.

[0108] In the embodiment of the present invention, a plurality of continuous historical attack actions are iteratively extracted from the historical attack event sequence according to a preset length until the historical attack event sequence is traversed to obtain a corresponding historical attack event subsequence.

[0109] For example, the historical attack event sequence N includes historical attack actions n1, n2, n3, n4, and n5, and the preset length is 2, then the historical attack event subsequences are N1, N2, and N3, where N1 is {n1, n2}, N2 is {n2, n3}, and N3 is {n3, n4}.

[0110] S503: taking each historical attack event subsequence as a sample attack event sequence.

[0111] S504: Determine, from the historical attack event sequence, a historical attack action at the next moment of the historical attack event subsequence as a label attack action of the sample attack event sequence.

[0112] For example, the historical attack event sequence M includes historical attack actions m1, m2, m3, m4, and m5, and the preset length is 2, then the historical attack event subsequences are M1, M2, and M3 respectively.

[0113] Among them, M1 is {m1, m2}, M2 is {m2, m3}, M3 is {m3, m4}, the label attack action of M1 is m3, the label attack action of M2 is m4, and the label attack action of M3 is m5.

[0114] S505, composing training samples according to the sample attack event sequence, ie, the corresponding label attack actions.

[0115] like Figure 6As shown in the figure, taking the information security competition as an example, the original attack behavior data in the security information competition is collected through the preset probe system, and the attack events are extracted according to the host and time order to obtain the attack event sequence. In addition, the executable attack code is collected and disassembled to generate attack weapons, thereby filling the preset attack weapon library.

[0116] S402, inputting the sample attack event sequence into a preset network model to obtain the predicted attack action of the sample attack event sequence at the next moment.

[0117] The preset network model is a sequence learning model based on deep learning, which is used to automatically extract and learn the timing model of attack actions. The sequence learning model based on deep learning includes but is not limited to:

[0118] Deep Neural Networks (DNNs);

[0119] Recurrent neural network (RNN) and its derivative models, including long short-term memory network (LSTM), gated recurrent unit model (GRU), etc., you can choose unidirectional or bidirectional network, and you can choose to add attention mechanism;

[0120] Convolutional neural network (CNN) and its derivative models, including 1D-CNN, Text-CNN, RCNN, DPCNN, etc.;

[0121] Transformer and its derivative models.

[0122] In the embodiment of the present invention, the sample attack event sequence is input into the preset network model, and several predicted attack actions and their output probabilities at the next moment can be obtained. The predicted attack actions with the largest output probabilities are selected as the predicted attack actions at the next moment of the sample attack event sequence.

[0123] S403, adjusting the preset network model according to the labeled attack actions and the predicted attack actions of the sample attack event sequence.

[0124] Specifically, according to the labeled attack actions and predicted attack actions of the sample attack event sequence, the model parameters of the preset network model are adjusted to maximize the output probability that the predicted attack action output by the model is the same as the labeled attack action.

[0125] S404, continue to execute the step of inputting the next sample attack event sequence into the preset network model to generate a predicted attack action, until the training status of the preset network model meets the preset conditions, and obtain the trained network attack action generation model.

[0126] The above-mentioned preset conditions may include that the loss function value meets the preset requirements or the number of training times reaches the preset number of times. The preset requirements may be determined according to the accuracy of the network attack action generation model, which is not described in detail here. The preset number of times may be the maximum number of training times of the preset network model, for example, 5000 times.

[0127] In an embodiment of the present invention, a preset network model is trained through a sequence of sample attack events, that is, the attacker's historical attack event sequence is used as training data, so that the timing characteristics of real attack actions can be learned, and the real attack behavior patterns can be learned, so that new attack actions can be automatically generated to continuously carry out network attacks on the network to be detected, thereby improving the network security protection capability of the network to be detected.

[0128] In some embodiments of the present invention, the training samples obtained in the above steps S501-S505 can be used to form an attack event data set; then, the attack event data set is divided into a training sample set and a test sample set according to a preset ratio. The training samples in the training sample set are used to train the preset network model; the training samples in the test sample set are used to test the network attack action generation model.

[0129] Therefore, in some embodiments of the present invention, after obtaining the trained network attack action generation model, the network attack action generation model can also be tested according to the training samples in the test sample set to determine whether the network attack action generation model complies with the preset rules; if the network attack action generation model does not comply with the preset rules, the network attack action generation model continues to be trained until the network attack action generation model complies with the preset rules.

[0130] like Figure 7 As shown, the attack event dataset is divided, and then each attack action is vectorized, a sequence learning model based on deep learning is selected as the preset network model, and then the preset network model is trained according to the training samples in the training sample set, and the model performance of the trained network attack action generation model is evaluated through the test sample set.

[0131] Through the above scheme, the network attack action generation model can be further tested to determine whether the network attack action generation model meets the preset rules, and the preset rules may include: accuracy and / or recall rate. In the case that the network attack action generation model does not meet the preset rules, training samples can be selected to continue training the network attack action generation model until the network attack action generation model meets the preset rules, so as to further improve the accuracy of the network attack action generation model.

[0132] In some embodiments of the present invention, after step S501, as Figure 8As shown, the network security protection method provided by the embodiment of the present invention also includes the following steps:

[0133] S801, obtaining executable attack codes of each historical attack event sequence.

[0134] The executable attack code is written in a high-level programming language, and the optional programming languages ​​include but are not limited to Python.

[0135] S802, disassemble the executable attack code to obtain the executable attack code segment corresponding to each historical attack action in the historical attack event sequence.

[0136] Specifically, the executable attack code is disassembled according to the historical attack event sequence. If the executable attack code cannot be disassembled any further, it is not necessary to disassemble it.

[0137] S803: Store the executable attack code segment corresponding to the historical attack action as the attack weapon of the historical attack action in a preset attack weapon library.

[0138] S804: Generate an association relationship between historical attack actions and corresponding attack weapons, and store the association relationship in a preset relationship table.

[0139] In some embodiments of the present invention, the determination of the attack weapon corresponding to the predicted attack action in the above-mentioned step S103 can determine the association relationship corresponding to the predicted attack action according to a preset relationship table; then based on the association relationship, the corresponding attack weapon is obtained from the preset attack weapon library, that is, the attack weapon corresponding to the predicted attack action.

[0140] Through the above S801-S804, corresponding attack weapons can be constructed according to the executable attack codes of the historical attack event sequence, thereby constructing a preset attack weapon library to determine the attack weapons corresponding to the predicted attack actions to carry out network attacks on the preset attack targets of the network to be detected.

[0141] Based on the above network security protection method, an embodiment of the present invention also provides a computer-readable storage medium, which stores one or more programs. The one or more programs can be executed by one or more processors to implement the steps in the network security protection method described in the above embodiment.

[0142] Based on the above network security protection method, the present invention also provides a terminal, such as Fig. 9As shown, it includes at least one processor (processor) 30; display screen 31; and memory (memory) 32, and may also include a communication interface (Communications Interface) 33 and a bus 34. Among them, the processor 30, the display screen 31, the memory 32 and the communication interface 33 can communicate with each other through the bus 34. The display screen 31 is configured to display the user guide interface preset in the initial setting mode. The communication interface 33 can transmit information. The processor 30 can call the logic instructions in the memory 32 to execute the network security protection method described in the above embodiment.

[0143] In addition, the logic instructions in the memory 32 described above can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product.

[0144] The memory 32 is a computer-readable storage medium that can be configured to store software programs, computer executable programs, such as program instructions or modules corresponding to the methods in the embodiments of the present disclosure. The processor 30 executes functional applications and data processing by running the software programs, instructions or modules stored in the memory 32, that is, implementing the methods in the above embodiments.

[0145] The memory 32 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and at least one application required for a function; the data storage area may store data created according to the use of the terminal, etc. In addition, the memory 32 may include a high-speed random access memory and may also include a non-volatile memory. For example, a variety of media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, may also be a transient storage medium.

[0146] Each embodiment in this application is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the terminal and medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0147] The terminal and medium provided in the embodiments of the present application correspond one-to-one to the method. Therefore, the terminal and the medium also have similar beneficial technical effects to the corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the terminal and the medium will not be repeated here.

[0148] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0149] Of course, those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware (such as a processor, a controller, etc.) through a computer program, and the program can be stored in a computer-readable storage medium that can be read by a computer, and the program can include the processes of the above-mentioned method embodiments when executed. The computer-readable storage medium can be a memory, a disk, an optical disk, etc.

[0150] It should be understood that the application of the present invention is not limited to the above examples. For ordinary technicians in this field, improvements or changes can be made based on the above description. All these improvements and changes should fall within the scope of protection of the claims attached to the present invention.

Claims

1. A network security protection method, characterized in that: The method comprises: Obtaining an attack event sequence of the network to be detected; wherein the attack event sequence is composed of a number of attack actions arranged in order of attack time; Inputting the attack event sequence into a network attack action generation model to obtain a predicted attack action of the attack event sequence; Before inputting the attack event sequence into the network attack action generation model, the method further includes: generating the network attack action generation model, specifically including: Acquire training samples; wherein the training samples include: a sample attack event sequence, and a labeled attack action of the sample attack event sequence; Inputting the sample attack event sequence into a preset network model to obtain a predicted attack action at the next moment of the sample attack event sequence; According to the label attack action of the sample attack event sequence and the predicted attack action, the preset network model is adjusted, and the step of inputting the next sample attack event sequence into the preset network model to generate the predicted attack action is continued until the training condition of the preset network model meets the preset conditions, and a trained network attack action generation model is obtained; Before obtaining the training sample, the method further includes: Acquire a historical attack event sequence of each other network environment; wherein the other network environment is a network environment other than the network to be detected; the historical attack event sequence is composed of a number of historical attack actions sorted by attack time; Iteratively extracting a number of historical attack actions from the historical attack event sequence according to a preset length to obtain a number of historical attack event subsequences; Using each of the historical attack event subsequences as the sample attack event sequence; and determining, from the historical attack event sequence, a historical attack action at the next moment of the historical attack event subsequence as the label attack action; According to the sample attack event sequence and the corresponding label attack action, the training sample is formed; After acquiring the historical attack event sequences of each other network environment, the method further includes: Obtaining executable attack code for each of the historical attack event sequences; Disassembling the executable attack code to obtain executable attack code segments corresponding to each historical attack action in the historical attack event sequence; The executable attack code segment corresponding to the historical attack action is stored in a preset attack weapon library as an attack weapon of the historical attack action; Determining an attack weapon corresponding to the predicted attack action, and using the attack weapon to carry out a network attack on a preset attack target of the network to be detected; In the case where the network attack is an invalid attack, the attack event sequence is updated according to the predicted attack action, a next attack event sequence is generated, and the steps of inputting the next attack event sequence into the network attack action generation model, generating a predicted attack action, and using the predicted attack action to perform a network attack on the preset attack target of the network to be detected are continued until the network attack is a valid attack; According to the effective attack, the corresponding network vulnerability is determined and the vulnerability is repaired for the network to be detected.

2. The method according to claim 1, characterized in that After using the executable attack code segment corresponding to the historical attack action as the attack weapon of the historical attack action, the method further includes: Generate an association relationship between the historical attack action and the corresponding attack weapon, and store it in a preset relationship table.

3. The method according to claim 2, characterized in that The determining the attack weapon corresponding to the predicted attack action specifically includes: Determine the association relationship corresponding to the predicted attack action according to the preset relationship table; Based on the association relationship, the attack weapon corresponding to the predicted attack action is obtained from the preset attack weapon library.

4. The method according to claim 1, characterized in that: Obtain historical attack event sequences for other network environments, including: Acquire original attack behavior data collected by a preset probe system from the other network environment; wherein the original attack behavior data at least includes: attack actions and attacked objects corresponding to each attack action; According to the classification of the attacked object and the attack time, corresponding attack actions are extracted from the original attack behavior data to form an attack event sequence of the other network environment.

5. The method according to claim 1, characterized in that After the sample attack event sequence and the corresponding label attack action are combined into the training sample, the method further includes: According to the training samples, an attack event data set is formed; Dividing the attack event data set into a training sample set and a test sample set according to a preset ratio; Among them, the training samples in the training sample set are used to train the preset network model; the training samples in the test sample set are used to test the network attack action generation model.

6. The method according to claim 5, characterized in that After obtaining the trained network attack action generation model, the method further includes: Testing the network attack action generation model according to the training samples in the test sample set to determine whether the network attack action generation model complies with the preset rules; In the case that the network attack action generation model does not conform to the preset rules, the network attack action generation model continues to be trained until the network attack action generation model conforms to the preset rules.

7. The method according to claim 1, characterized in that Inputting the attack event sequence into a network attack action generation model to obtain a predicted attack action of the attack event sequence specifically includes: Inputting the attack event sequence into a network attack action generation model to obtain a number of predicted attack actions at the next moment and an output probability of each predicted attack action; A predicted attack event is randomly selected from the first N predicted attack actions with the largest output probabilities as the predicted attack action of the attack event sequence.

8. The method according to claim 1, characterized in that The number of preset attack targets is at least one.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps in the network security protection method as described in any one of claims 1-8.

10. A terminal, characterized in that: The terminal includes: a processor and a memory; the memory stores a computer-readable program that can be executed by the processor; when the processor executes the computer-readable program, the steps in the network security protection method according to any one of claims 1 to 8 are implemented.

Images