Network attack data research and judgment method and device, electronic equipment and storage medium
By acquiring user traffic feature profiles and alarm data feature information, and utilizing feature analysis models and natural language processing technology, the problem of low efficiency in network attack event assessment has been solved, and efficient network attack event assessment has been achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- BEIJING TOPSEC NETWORK SECURITY TECH
- Filing Date
- 2022-12-19
- Publication Date
- 2026-08-04
AI Technical Summary
In existing technologies, the efficiency of assessing cyberattacks is low, and the manpower-intensive approach cannot effectively handle massive amounts of alarm information, resulting in low assessment efficiency.
By acquiring user traffic feature profiles and alarm data, and using feature analysis models and natural language processing techniques, we can determine whether alarm data constitutes an attack event. By combining user traffic feature profiles with qualitative analysis of alarm data, we can improve the efficiency of judgment.
It enables efficient analysis of cyberattacks, reduces human intervention, improves the quality and efficiency of alerts, and avoids inefficient manpower-intensive tactics.
Smart Images
Figure CN116015820B_ABST
Abstract
Description
Technical Field
[0001] This disclosure relates to the field of network security technology, and in particular to a method, apparatus, electronic device and storage medium for network attack data analysis. Background Technology
[0002] In a network security defense system, multiple security technologies, such as firewalls, intrusion detection systems, antivirus systems, and vulnerability assessment systems, are typically configured to provide comprehensive protection for the network system. Security devices, primarily intrusion detection systems, generate a large number of alerts in real time. However, low-level alert information suffers from a series of problems, including redundancy, errors, and irrelevance to the protected network system. This makes it difficult to analyze and judge the alert information, and isolated alert information cannot accurately reflect the current security status of the network.
[0003] In related technologies, intervention in network attack data and the capabilities of analysts ensures timely responses to urgent network attack data. However, this manpower-intensive approach is not optimal when facing massive numbers of network attack events. Therefore, improving the efficiency of network attack event analysis and effectively ensuring the quality of alert information are pressing technical issues that need to be addressed. Summary of the Invention
[0004] To solve the above-mentioned technical problems, or at least partially solve them, this disclosure provides a method for analyzing network attack data, which solves the problem of low efficiency in the prior art due to the reliance on manpower in analyzing network attack events.
[0005] To achieve the above objectives, the present disclosure provides the following technical solutions:
[0006] In a first aspect, embodiments of this disclosure provide a method for analyzing network attack data, the method comprising:
[0007] Obtain a user traffic feature profile; the user traffic feature profile is used to label various feature information of network traffic data to obtain the access behavior of the raw network traffic data.
[0008] Obtain the characteristic information of the alarm data; the characteristic information of the alarm data includes one or more of the following: file path, IP address, domain name, URL, system operation command, script function name, and SQL system table name;
[0009] Based on the user traffic feature profile, the analysis information of the alarm data is determined; the analysis information of the alarm data includes: whether the event corresponding to the alarm data is an attack event, the number of times the alarm data accesses the target path, the number of times the alarm data accesses the target SQL table, the number of times the alarm data accesses system commands, and the number of times the alarm data accesses the target file.
[0010] As an optional implementation of this disclosure, the step of obtaining a user traffic feature profile includes:
[0011] Obtain characteristic information of network traffic data; the characteristic information of network traffic data includes one or more of the following: file path, IP address, domain name, URL, system operation command, script function name, and SQL system table name;
[0012] Feature labels are obtained by analyzing the feature information of the network traffic data using a feature analysis model.
[0013] User profiles corresponding to the network traffic data are generated based on the feature tags.
[0014] As an optional implementation of this disclosure, the acquisition of feature information of network traffic data includes:
[0015] Based on regular expressions, feature information of the network traffic data is extracted;
[0016] or;
[0017] Based on natural language processing, feature information is extracted from the network traffic data.
[0018] As an optional implementation of this disclosure, the step of extracting feature information from the network traffic data based on regular expressions includes:
[0019] Obtain the text information of the network traffic data;
[0020] The text information of the network traffic data is matched with a preset regular expression to obtain the feature information of the network traffic data.
[0021] As an optional implementation of this disclosure, the extraction of feature information from the network traffic data based on natural language processing further includes:
[0022] According to the preset annotation method, all words in the network traffic data are labeled according to entity type to obtain the annotation result of each word;
[0023] The entity types include: functions, SQL statements, system operation commands, and others; the annotation results include any one of the following: first type label, second type label, third type label, fourth type label, fifth type label, sixth type label, and seventh type label;
[0024] The annotation result of each word is mapped to the corresponding word vector based on the continuous bag-of-words model;
[0025] The corresponding word vectors are input into a bidirectional long short-term memory network layer, and through context learning, the probability of each word corresponding to each annotation result is output.
[0026] The probability of each word corresponding to each annotation result is input into a conditional random field layer. Combined with preset constraints, the probability of each word corresponding to each annotation result is corrected to obtain the feature information of the acquired network traffic data.
[0027] As an optional implementation of this disclosure, the method further includes:
[0028] If at least three of the analysis information in the alarm data meets the preset indicators, the event corresponding to the alarm data is determined to be an attack event.
[0029] As an optional implementation of this disclosure, the step of determining the event corresponding to the alarm data as an attack event when at least three of the analysis information of the alarm data meet preset indicators includes:
[0030] When any three of the following conditions are met: the number of times the alarm data accesses the target path is less than the first threshold number; the number of times the alarm data accesses the target SQL table is less than the second threshold number; the number of times the alarm data accesses system commands is less than the third threshold number; or the number of times the alarm data accesses the target file is less than the fourth threshold number, the event corresponding to the alarm data is determined to be an attack event, and the analysis information of the alarm data is output.
[0031] Secondly, embodiments of this disclosure provide a network attack data analysis device, comprising:
[0032] The feature profile acquisition module is used to acquire user traffic feature profiles; the user traffic feature profiles are used to label various feature information of network traffic data to obtain access behavior of raw network traffic data.
[0033] The alarm information acquisition module is used to acquire the characteristic information of alarm data; the characteristic information of alarm data includes one or more of the following: file path, IP address, domain name, URL, system operation command, script function name, and SQL system table name;
[0034] The alarm information analysis module is used to determine the analysis information of the alarm data based on the user traffic feature profile. The analysis information of the alarm data includes: whether the event corresponding to the alarm data is an attack event, the number of times the alarm data accesses the target path, the number of times the alarm data accesses the target SQL table, the number of times the alarm data accesses system commands, and the number of times the alarm data accesses the target file.
[0035] As an optional implementation of this disclosure, the feature profile acquisition module includes:
[0036] The feature acquisition unit is used to acquire feature information of network traffic data; the feature information of the network traffic data includes one or more of the following: file path, IP address, domain name, URL, system operation command, script function name, and SQL system table name;
[0037] The feature tagging unit is used to analyze the feature information of the network traffic data through a feature analysis model to obtain feature tags;
[0038] The user profiling unit is used to generate a user profile corresponding to the network traffic data based on the feature tags.
[0039] As an optional implementation of this disclosure, the feature acquisition unit is specifically used for:
[0040] Based on regular expressions, feature information of the network traffic data is extracted;
[0041] or;
[0042] Based on natural language processing, feature information is extracted from the network traffic data.
[0043] As an optional implementation of this disclosure, the step of extracting feature information from the network traffic data based on regular expressions includes:
[0044] Obtain the text information of the network traffic data;
[0045] The text information of the network traffic data is matched with a preset regular expression to obtain the feature information of the network traffic data.
[0046] As an optional implementation of this disclosure, the extraction of feature information from the network traffic data based on natural language processing further includes:
[0047] According to the preset annotation method, all words in the network traffic data are labeled according to entity type to obtain the annotation result of each word;
[0048] The entity types include: functions, SQL statements, system operation commands, and others; the annotation results include any one of the following: first type label, second type label, third type label, fourth type label, fifth type label, sixth type label, and seventh type label;
[0049] The annotation result of each word is mapped to the corresponding word vector based on the continuous bag-of-words model;
[0050] The corresponding word vectors are input into a bidirectional long short-term memory network layer, and through context learning, the probability of each word corresponding to each annotation result is output.
[0051] The probability of each word corresponding to each annotation result is input into a conditional random field layer. Combined with preset constraints, the probability of each word corresponding to each annotation result is corrected to obtain the feature information of the acquired network traffic data.
[0052] As an optional implementation of this disclosure, the apparatus further includes:
[0053] The alarm judgment module is used to determine that the event corresponding to the alarm data is an attack event when at least three of the judgment information of the alarm data meets the preset indicators.
[0054] As an optional implementation of this disclosure, the alarm judgment module is specifically used for:
[0055] When any three of the following conditions are met: the number of times the alarm data accesses the target path is less than the first threshold number; the number of times the alarm data accesses the target SQL table is less than the second threshold number; the number of times the alarm data accesses system commands is less than the third threshold number; or the number of times the alarm data accesses the target file is less than the fourth threshold number, the event corresponding to the alarm data is determined to be an attack event, and the analysis information of the alarm data is output.
[0056] Thirdly, embodiments of this disclosure provide an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the network attack data analysis method described in the first aspect or any embodiment of the first aspect.
[0057] Fourthly, embodiments of this disclosure provide a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the network attack data analysis method described in the first aspect or any embodiment of the first aspect.
[0058] The network attack data analysis method disclosed herein obtains a user traffic feature profile. This profile is used to label various characteristic information of network traffic data to obtain the access behavior of the raw network traffic data. After obtaining the feature information of alarm data, the analysis information of the alarm data is determined based on the user traffic feature profile. Since the user traffic feature profile can reveal the number of times network traffic data accesses the target path, the number of times it accesses the target SQL table, the number of times it accesses system commands, and the number of times it accesses the target file, qualitative analysis of alarm data can be performed in conjunction with the user profile. This allows for the determination of whether the event corresponding to the alarm data is an attack event, providing a basis for the analysis conclusion. This further improves the efficiency of network attack event analysis and avoids the problem of low efficiency caused by relying on a large number of people to analyze network attack events in existing technologies. Attached Figure Description
[0059] The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure.
[0060] To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0061] Figure 1 This is a flowchart illustrating a network attack data analysis method in one embodiment;
[0062] Figure 2 This is a schematic diagram of the normal distribution results of a network attack data analysis method in one embodiment;
[0063] Figure 3 This is a schematic diagram illustrating the principle of obtaining feature information from network traffic data in one embodiment.
[0064] Figure 4 This is a schematic diagram of the network attack data analysis device in one embodiment;
[0065] Figure 5 This is a schematic diagram of the structure of the electronic device described in an embodiment of this disclosure. Detailed Implementation
[0066] To better understand the above-mentioned objectives, features, and advantages of this disclosure, the solutions disclosed herein will be further described below. It should be noted that, unless otherwise specified, the embodiments and features described herein can be combined with each other.
[0067] Numerous specific details are set forth in the following description in order to provide a full understanding of this disclosure, but this disclosure may also be implemented in other ways different from those described herein; obviously, the embodiments in the specification are only some, and not all, of the embodiments of this disclosure.
[0068] The terms "first" and "second" and other relational terms used in this disclosure and claims are merely used to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations.
[0069] In this disclosure, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design described as "exemplary" or "for example" in this disclosure should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a specific manner. Furthermore, in the description of the embodiments in this disclosure, unless otherwise stated, "a plurality of" means two or more.
[0070] In one embodiment, such as Figure 1 As shown, a method for analyzing network attack data is provided, including the following steps:
[0071] S11. Obtain user traffic characteristic profiles.
[0072] Among them, user traffic feature profiling is used to label various feature information of network traffic data to obtain access behavior of raw network traffic data.
[0073] Optionally, obtaining user traffic feature profiles can be achieved through the following steps:
[0074] a. Obtain characteristic information of network traffic data.
[0075] In this embodiment, feature information of multiple network traffic data is obtained. The feature information of each network traffic data includes one or more of the following: file path, IP address, domain name, URL, system operation command, script function name, and SQL system table name.
[0076] For example, multiple network traffic data points within a certain time period can be obtained first, such as network traffic data within a certain day, a certain week, or a certain month. Then, feature information of each network traffic data point is extracted based on a preset feature extraction method.
[0077] b. Analyze the feature information of the network traffic data using a feature analysis model to obtain feature labels.
[0078] Specifically, the feature analysis model is trained using a large amount of sample data. This sample data includes various built-in databases. These include a knowledge base of important SQL tables, pre-labeled with the importance of various table names, and a system command table, pre-labeled with the types of system operation commands. In other words, the feature information of network data is labeled using the various tags already present in the sample data, resulting in feature labels for each piece of network traffic data. See Table 1 for the SQL important table knowledge base. See Table 2 for the system command table.
[0079] Table 1
[0080] Table name Importance information_schema Core Table performance_schema Core Table bussinsess Core Table sys_config Non-core tables
[0081] Table 2
[0082] System operation commands Label whoami User permissions exec Execute command shell_exec Execute shell command
[0083] c. Generate a user profile corresponding to the network traffic data based on the feature tags.
[0084] Specifically, user profiling involves abstracting network traffic data characteristics into tags and then using different categories of feature tags to concretize the network traffic data. A user profile describes the overall characteristics of a user's network traffic data. That is, it describes network traffic access behavior by the number of times network traffic data accesses target paths, target SQL tables, system commands, and target files.
[0085] For example, network traffic data feature information is abstracted into tags, and related attributes are partially aggregated to obtain the following aggregation results, as shown in Table 3. Table 3 is an example of partial aggregation results.
[0086] Table 3
[0087]
[0088] S12. Obtain the characteristic information of alarm data.
[0089] The alarm data features include one or more of the following: file path, IP address, domain name, URL, system operation command, script function name, and SQL system table name.
[0090] Specifically, when security devices such as firewalls, intrusion detection systems, antivirus systems, and vulnerability assessment systems generate alarms, alarm data is acquired. The number of alarm data is determined according to the actual situation, and may be dozens, hundreds, or thousands. After acquiring multiple alarm data, feature information of multiple alarm messages is extracted.
[0091] S13. Determine the analysis information of the alarm data based on the user traffic feature profile.
[0092] The information for analyzing alarm data includes: whether the event corresponding to the alarm data is an attack event, the number of times the alarm data accesses the target path, the number of times the alarm data accesses the target SQL table, the number of times the alarm data accesses system commands, and the number of times the alarm data accesses the target file.
[0093] Specifically, since isolated alarm information is difficult to characterize network attacks, the aggregation results of network traffic data characteristics are combined. That is, the number of times network traffic data accesses the target path, the number of times network traffic data accesses the target SQL table, the number of times network traffic data accesses system commands, and the number of times network traffic data accesses the target file are combined to perform qualitative analysis on the alarm data. This allows us to determine whether the event corresponding to the alarm data is an attack event and provides a basis for the judgment conclusion. This further improves the efficiency of network attack event judgment and avoids the problem of low judgment efficiency caused by the use of manpower to judge network attack events in the existing technology.
[0094] By applying embodiments of this disclosure, a user traffic feature profile is obtained. This profile is used to label various feature information of network traffic data to obtain the access behavior of the raw network traffic data. After obtaining the feature information of alarm data, the analysis information of the alarm data is determined based on the user traffic feature profile. Since the user traffic feature profile can reveal the number of times network traffic data accesses the target path, the number of times network traffic data accesses the target SQL table, the number of times network traffic data accesses system commands, and the number of times network traffic data accesses the target file, qualitative analysis of the alarm data can be performed in conjunction with the user profile. This allows for the determination of whether the event corresponding to the alarm data is an attack event, providing a basis for the analysis conclusion. This further improves the efficiency of network attack event analysis and avoids the problem of low efficiency caused by relying on a large number of personnel to analyze network attack events in the prior art.
[0095] In some embodiments, the access count of relevant feature items of the alarm data is calculated based on the normal distribution function to obtain the normal access count and the abnormal access count of the relevant feature items; the judgment information of the alarm data is determined based on the abnormal access count of the relevant feature items.
[0096] Specifically, the access count of relevant feature items of alarm data is calculated according to formulas (1) and (2) to obtain the normal access count and abnormal access count of relevant feature items.
[0097]
[0098] Where x is the value of a certain relevant feature, μ is the expected value, and σ is the expected value. 2 Let f(x) be the variance, and f(x) be the probability calculation result of a certain relevant feature information.
[0099]
[0100] For example, x represents the number of users accessing the target path, and f(x) represents the probability of accessing the target path. For instance, suppose there are 7 paths, and the number of users accessing each path is 15, 20, 25, 30, 35, 40, and 45 respectively. The sample mean μ is calculated to be 30. According to the formula (2) above, the variance is 100 and the standard deviation is 10. Thus, the number of normal accesses = μ ± 2 = 30 ± 2 * 10 = (10 ~ 50). Therefore, when the number of accesses is less than 10, it is determined to be an abnormal access. Similarly, the number of times a file is accessed or the probability of accessing a file can also be counted in the same way. The number of times a system command is accessed or the probability of accessing a system command can also be counted in the same way. The number of times a core SQL table is accessed or the probability of accessing a core SQL table can also be counted in the same way.
[0101] Additionally, refer to Figure 2 As shown, assuming there are 7 paths, namely path 1, path 2, path 3, path 4, path 5, path 6, and path 7, the probabilities of accessing each path are calculated according to formula (1) as follows: 0.002, 0.01, 0.05, 0.08, 0.05, 0.01, and 0.002. According to the law of normal distribution, the threshold probability can be set to 0.005. When the probability of accessing a certain path is less than 0.005, it is confirmed as an abnormal access.
[0102] In some embodiments, if at least three of the judgment information in the alarm data meets preset indicators, the event corresponding to the alarm data is determined to be an attack event.
[0103] Optionally, if any three of the following conditions are met: the number of times the alarm data accesses the target path is less than the first threshold number; the number of times the alarm data accesses the target SQL table is less than the second threshold number; the number of times the alarm data accesses system commands is less than the third threshold number; or the number of times the alarm data accesses the target file is less than the fourth threshold number, the event corresponding to the alarm data is determined to be an attack event, and the analysis information of the alarm data is output.
[0104] Optionally, if any three of the following conditions are met: the probability of the alarm data accessing the target path is less than the first threshold probability; the probability of the alarm data accessing the target SQL table is less than the second threshold probability; the probability of the alarm data accessing the system command is less than the third threshold probability; and the probability of the alarm data accessing the target file is less than the fourth threshold probability, then the event corresponding to the alarm data is determined to be an attack event.
[0105] For example, when a network request is identified as an alert, such as http: / / 106.15.190.147 / js / hrm / getdata.jsp?cmd=getSelectAllId&sql=select%20password%20as%20id%20from%20HrmResourceManager, the target path is js / hrm, the target SQL table is HrmResourceManager, the system command is cmd, and the target file is getdata.jsp, where the target file stores critical information such as passwords. If at least three of the alert data's analysis information meet preset indicators, the event corresponding to the alert data is determined to be an attack event. For example, the user accessed the target path 2 times, the target SQL table 3 times, the system command 1 time, and the target file 2 times; the first threshold is 10 times, the second threshold is 15 times, the third threshold is 10 times, and the fourth threshold is 12 times. Since the number of times the user accessed the target path is less than the first threshold, the number of times the user accessed the target SQL table is less than the second threshold, the number of times the user accessed the system command is less than the third threshold, and the number of times the user accessed the target file is less than the fourth threshold, the event corresponding to the alarm data is determined to be an attack event. Furthermore, since the target file stores critical information such as passwords, the alarm data is further determined to be an attempt to steal passwords using a webshell.
[0106] In some embodiments, obtaining characteristic information of network traffic data can be achieved in the following ways:
[0107] Based on regular expressions, feature information is extracted from network traffic data.
[0108] Specifically, this feature extraction method based on regular expressions is suitable for network traffic data with explicit identifiers.
[0109] Optionally, obtain text information about network traffic data.
[0110] The text information of network traffic data is matched with a preset regular expression to obtain the feature information of the network traffic data.
[0111] The default regular expression can be a string indicating file type, or it can be a character such as " / " or "?". For example, the string indicating file type can include, but is not limited to, "jsp", "asp", "php", etc., used to identify the file type. The file path can be extracted by splitting it with " / ", and the request parameters can be obtained by splitting them with "?".
[0112] For example, if the text information of the obtained network traffic data is: http: / / 106.15.190.147 / js / hrm / getdata.jsp?cmd=getSelectAllId&sql=select%20password%20as%20id%20from%20HrmResourceManager, the text information of the network traffic data is matched with a preset regular expression to obtain the following feature information of the network traffic data: the request path of the network traffic data: / js / hrm; the request URL of the network traffic data: 106.15.190.147; the system operation command of the network traffic data: cmd; the script function name of the network traffic data: getSelectAllId; and the SQL system table name: HrmResourceManager.
[0113] In some embodiments, obtaining the characteristic information of network traffic data can also be achieved in the following ways:
[0114] Based on natural language processing, feature information is extracted from the network traffic data.
[0115] Specifically, natural language processing is suitable for feature extraction without explicit identifiers, such as the SQL statement: select password as id from HrmResourceManager, in which regular expressions cannot be used for matching.
[0116] Optionally, all words in the network traffic data can be labeled according to entity type using a preset labeling method to obtain the labeling result for each word.
[0117] Specifically, the default annotation method can be the BIO annotation method, where B stands for begin (the start of an entity), I stands for inside (the middle of an entity), and O represents a non-entity, meaning it does not belong to any type. Each element is labeled as "BX", "IX", or "O". "BX" indicates that the segment containing this element belongs to type X and this element is at the beginning of the segment; "IX" indicates that the segment containing this element belongs to type X and this element is in the middle of the segment; and "O" indicates that it does not belong to any type.
[0118] The entity types include: functions, SQL statements, system operation commands, and others. The first, second, third, fourth, fifth, sixth, and seventh type tags are B-main, I-main, B-sql, I-sql, B-cmd, I-cmd, and O, respectively.
[0119] For example, each word in the SQL statement is annotated according to the above annotation rules. For example, the SQL statement is: cmd getSelectAllId select password as id from HrmResourceManager. The annotation results are shown in Table 5.
[0120] Table 5
[0121] Words to be tagged Annotation results Cmd O getSelectAllId O select B-SQL password I-sql as I-sql id I-sql from I-sql HrmResourceManager I-sql
[0122] The continuous bag-of-words model maps the annotation results of each word to the corresponding word vector.
[0123] Specifically, based on CBOW (continuous bag of words), the annotation result of each word is mapped to the corresponding word vector.
[0124] The corresponding word vectors are input into a bidirectional long short-term memory network layer. Through context learning, the probability of each word corresponding to each annotation result is output.
[0125] Specifically, the corresponding word vectors are input into the BiLSTM (Bi-directional Long Short-Term Memory) layer. The BiLSTM is composed of a forward LSTM and a backward LSTM. Through context learning, it outputs the probability of each word corresponding to each annotation result.
[0126] The probability of each word corresponding to each annotation result is input into the conditional random field layer. Combined with preset constraints, the probability of each word corresponding to each annotation result is corrected to obtain the feature information of the acquired network traffic data.
[0127] The preset constraint is that the label of the first word in a sentence must be "B-" or "O", but not "I-".
[0128] Specifically, each word output by BiLSTM is assigned to a Conditional Random Field (CRF) layer as the probability input for each labeled result. The CRF layer can reduce invalid predicted label sequences by setting predefined constraints.
[0129] For example, see Figure 3 As shown, assuming a sequence contains 5 words: w0, w1, w2, w3, and w4, firstly, each word is labeled using the BIO annotation method, resulting in the following labels: B-main, I-main, B-sql, I-sql, B-cmd, I-cmd, and O. Secondly, the labeling results of each word are mapped to corresponding word vectors using the CBOW model. Then, the corresponding word vectors are input into a BiLSTM layer to obtain the probability of each word corresponding to each labeling result. Next, these probabilities are input into a CRF layer for correction, resulting in a predicted label sequence corrected according to preset constraints. Finally, the predicted label sequence with the highest probability is determined as the target label sequence. It should be noted that the weights x0, x1, x2, x3, and x4 of each word in the CRF layer are obtained from the training data, and CRF_Score = x0*w0 + x1*w1 + x2*w2 + x3*w3 + x4*w4. Since the highest probability result for the predicted label sequence is 0.9, the final target label sequence is: "B-sql, I-sql, O, B-main, I-main".
[0130] By applying embodiments of this disclosure, a user traffic feature profile is obtained. This profile is used to label various characteristic information of network traffic data to obtain the access behavior of the raw network traffic data. After obtaining the feature information of alarm data, the analysis information of the alarm data is determined based on the user traffic feature profile. Since the user traffic feature profile can reveal the number of times network traffic data accesses the target path, the number of times network traffic data accesses the target SQL table, the number of times network traffic data accesses system commands, and the number of times network traffic data accesses the target file, qualitative analysis of the alarm data can be performed by combining the user profile. This allows for determining whether the event corresponding to the alarm data is an attack event and provides a basis for the analysis conclusion.
[0131] In one embodiment, such as Figure 4 As shown, a network attack data analysis device 400 is provided, comprising:
[0132] The feature profile acquisition module 410 is used to acquire a user traffic feature profile; the user traffic feature profile is used to label various feature information of network traffic data to obtain the access behavior of the original network traffic data.
[0133] The alarm information acquisition module 420 is used to acquire the feature information of alarm data; the feature information of the alarm data includes one or more of the following: file path, IP address, domain name, URL, system operation command, script function name, and SQL system table name;
[0134] The alarm information analysis module 430 is used to determine the analysis information of the alarm data based on the user traffic feature profile. The analysis information of the alarm data includes: whether the event corresponding to the alarm data is an attack event, the number of times the alarm data accesses the target path, the number of times the alarm data accesses the target SQL table, the number of times the alarm data accesses system commands, and the number of times the alarm data accesses the target file.
[0135] As an optional implementation of this disclosure, the feature profile acquisition module includes:
[0136] The feature acquisition unit is used to acquire feature information of network traffic data; the feature information of the network traffic data includes one or more of the following: file path, IP address, domain name, URL, system operation command, script function name, and SQL system table name;
[0137] The feature tagging unit is used to analyze the feature information of the network traffic data through a feature analysis model to obtain feature tags;
[0138] The user profiling unit is used to generate a user profile corresponding to the network traffic data based on the feature tags.
[0139] As an optional implementation of this disclosure, the feature acquisition unit is specifically used for:
[0140] Based on regular expressions, feature information of the network traffic data is extracted;
[0141] or;
[0142] Based on natural language processing, feature information is extracted from the network traffic data.
[0143] As an optional implementation of this disclosure, the step of extracting feature information from the network traffic data based on regular expressions includes:
[0144] Obtain the text information of the network traffic data;
[0145] The text information of the network traffic data is matched with a preset regular expression to obtain the feature information of the network traffic data.
[0146] As an optional implementation of this disclosure, the extraction of feature information from the network traffic data based on natural language processing further includes:
[0147] According to the preset annotation method, all words in the network traffic data are labeled according to entity type to obtain the annotation result of each word;
[0148] The entity types include: functions, SQL statements, system operation commands, and others; the annotation results include any one of the following: first type label, second type label, third type label, fourth type label, fifth type label, sixth type label, and seventh type label;
[0149] The annotation result of each word is mapped to the corresponding word vector based on the continuous bag-of-words model;
[0150] The corresponding word vectors are input into a bidirectional long short-term memory network layer, and through context learning, the probability of each word corresponding to each annotation result is output.
[0151] The probability of each word corresponding to each annotation result is input into a conditional random field layer. Combined with preset constraints, the probability of each word corresponding to each annotation result is corrected to obtain the feature information of the acquired network traffic data.
[0152] As an optional implementation of this disclosure, the apparatus further includes:
[0153] The alarm judgment module is used to determine that the event corresponding to the alarm data is an attack event when at least three of the judgment information of the alarm data meets the preset indicators.
[0154] As an optional implementation of this disclosure, the alarm judgment module is specifically used for:
[0155] When any three of the following conditions are met: the number of times the alarm data accesses the target path is less than the first threshold number; the number of times the alarm data accesses the target SQL table is less than the second threshold number; the number of times the alarm data accesses system commands is less than the third threshold number; or the number of times the alarm data accesses the target file is less than the fourth threshold number, the event corresponding to the alarm data is determined to be an attack event, and the analysis information of the alarm data is output.
[0156] By applying embodiments of this disclosure, a user traffic feature profile is obtained. This profile is used to label various feature information of network traffic data to obtain the access behavior of the raw network traffic data. After obtaining the feature information of alarm data, the analysis information of the alarm data is determined based on the user traffic feature profile. Since the user traffic feature profile can reveal the number of times network traffic data accesses the target path, the number of times network traffic data accesses the target SQL table, the number of times network traffic data accesses system commands, and the number of times network traffic data accesses the target file, qualitative analysis of the alarm data can be performed in conjunction with the user profile. This allows for the determination of whether the event corresponding to the alarm data is an attack event, providing a basis for the analysis conclusion. This further improves the efficiency of network attack event analysis and avoids the problem of low efficiency caused by relying on a large number of personnel to analyze network attack events in the prior art.
[0157] For specific limitations regarding the network attack data analysis method, please refer to the limitations outlined above; they will not be repeated here. Each module in the aforementioned network attack data analysis method can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor of the electronic device in hardware form, or stored in the processor of the electronic device in software form, so that the processor can call and execute the corresponding operations of each module.
[0158] This disclosure also provides an electronic device. Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. Figure 5As shown, the electronic device provided in this embodiment includes a memory 51 and a processor 52. The memory 51 is used to store computer programs; the processor 52 is used to execute the steps performed in any embodiment of the network attack data analysis method provided in the above method embodiments when the computer program is invoked. The electronic device includes a processor, a memory, a communication interface, a display screen, and an input device connected via a system bus. The processor of the electronic device provides computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. When the computer program is executed by the processor, it implements a network attack data analysis method. The display screen of the electronic device can be a liquid crystal display screen or an electronic ink display screen. The input device of the electronic device can be a touch layer covering the display screen, or a button, trackball, or touchpad provided on the casing of a computer device, or an external keyboard, touchpad, or mouse, etc.
[0159] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present disclosure and does not constitute a limitation on the computer device to which the present disclosure is applied. Specific electronic devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.
[0160] In one embodiment, the network attack data analysis method provided in this disclosure can be implemented in the form of a computer, and the computer program can be used in a manner such as... Figure 5 The electronic device shown operates on this device. The memory of the electronic device can store various program modules that constitute the network attack data analysis method for that electronic device, for example, Figure 4 The feature profile acquisition module 410, alarm information acquisition module 420, and alarm information analysis module 430 shown are included. The computer program, comprised of these modules, causes the processor to execute the steps in the network attack data analysis method for the electronic device according to the various embodiments of this disclosure.
[0161] This disclosure also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the network attack data analysis method provided in the above-described method embodiments.
[0162] Those skilled in the art will understand that embodiments of this disclosure can be provided as methods, systems, or computer program products. Therefore, this disclosure can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this disclosure can take the form of a computer program product embodied on one or more computer-usable storage media containing computer-usable program code.
[0163] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.
[0164] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, like read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.
[0165] Computer-readable media include both permanent and non-permanent, removable and non-removable storage media. Storage media can store information using any method or technology; the information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media do not include transient computer-readable media, such as modulated data signals and carrier waves.
[0166] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0167] The above description is merely a specific embodiment of this disclosure, enabling those skilled in the art to understand or implement it. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this disclosure. Therefore, this disclosure is not to be limited to the embodiments described herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. A network attack data research and judgment method, characterized in that, include: Obtain user traffic characteristic profiles; The user traffic feature profile is used to label various feature information of the raw network traffic data to obtain the access behavior of the raw network traffic data. Obtain the characteristic information of alarm data; The alarm data features include one or more of the following: file path, Internet Protocol IP address, domain name, Uniform Resource Locator (URL), system operation command, script function name, and Structured Query Language (SQL) system table name. Based on the user traffic feature profile, the analysis information of the alarm data is determined; the analysis information of the alarm data includes: whether the event corresponding to the alarm data is an attack event, the number of times the alarm data accesses the target path, the number of times the alarm data accesses the target SQL table, the number of times the alarm data accesses system commands, and the number of times the alarm data accesses the target file; The method further includes: If at least three of the analysis information in the alarm data meets the preset indicators, the event corresponding to the alarm data is determined to be an attack event; When at least three of the analysis information in the alarm data meets preset indicators, the event corresponding to the alarm data is determined to be an attack event, including: When any three of the following conditions are met: the number of times the alarm data accesses the target path is less than the first threshold number; the number of times the alarm data accesses the target SQL table is less than the second threshold number; the number of times the alarm data accesses system commands is less than the third threshold number; or the number of times the alarm data accesses the target file is less than the fourth threshold number, the event corresponding to the alarm data is determined to be an attack event, and the analysis information of the alarm data is output.
2. The method of claim 1, wherein, The process of obtaining user traffic feature profiles includes: Obtain characteristic information of network traffic data; the characteristic information of network traffic data includes one or more of the following: file path, IP address, domain name, URL, system operation command, script function name, and SQL system table name; Feature labels are obtained by analyzing the feature information of the network traffic data using a feature analysis model. User profiles corresponding to the network traffic data are generated based on the feature tags.
3. The method of claim 2, wherein, The characteristic information of the acquired network traffic data includes: Based on regular expressions, feature information of the network traffic data is extracted; or; Based on natural language processing, feature information is extracted from the network traffic data.
4. The method of claim 3, wherein, The extraction of feature information from the network traffic data based on regular expressions includes: Obtain the text information of the network traffic data; The text information of the network traffic data is matched with a preset regular expression to obtain the feature information of the network traffic data.
5. The method of claim 3, wherein, The extraction of feature information from the network traffic data based on natural language processing also includes: According to the preset annotation method, all words in the network traffic data are labeled according to entity type to obtain the annotation result of each word; The entity types include: functions, SQL statements, system operation commands, and others; the annotation results include any one of the following: first type label, second type label, third type label, fourth type label, fifth type label, sixth type label, and seventh type label; The annotation result of each word is mapped to the corresponding word vector based on the continuous bag-of-words model; The corresponding word vectors are input into a bidirectional long short-term memory network layer, and through context learning, the probability of each word corresponding to each annotation result is output. The probability of each word corresponding to each annotation result is input into a conditional random field layer. Combined with preset constraints, the probability of each word corresponding to each annotation result is corrected to obtain the feature information of the acquired network traffic data.
6. A network attack data research and judgment device, characterized in that, include: The feature profile acquisition module is used to acquire user traffic feature profiles; The user traffic feature profile is used to label various feature information of network traffic data to obtain the access behavior of the original network traffic data. The alarm information acquisition module is used to acquire the characteristic information of alarm data; The alarm data features include one or more of the following: file path, IP address, domain name, URL, system operation command, script function name, and SQL system table name. The alarm information analysis module is used to determine the analysis information of the alarm data based on the user traffic feature profile. The analysis information of the alarm data includes: whether the event corresponding to the alarm data is an attack event, the number of times the alarm data accesses the target path, the number of times the alarm data accesses the target SQL table, the number of times the alarm data accesses system commands, and the number of times the alarm data accesses the target file. The device further includes: The alarm judgment module is used to determine that the event corresponding to the alarm data is an attack event when at least three of the judgment information of the alarm data meets the preset indicators. The alarm judgment module is specifically used to: determine that the event corresponding to the alarm data is an attack event when any three of the following conditions are met: the number of times the alarm data accesses the target path is less than the first threshold number; the number of times the alarm data accesses the target SQL table is less than the second threshold number; the number of times the alarm data accesses system commands is less than the third threshold number; and the number of times the alarm data accesses the target file is less than the fourth threshold number; and output the judgment information of the alarm data. 7.An electronic device comprising a memory and a processor, the memory storing a computer program, wherein, When the processor executes the computer program, it implements the network attack data analysis method according to any one of claims 1 to 5.
8. A computer-readable storage medium, characterized in that, It stores a computer program, which, when executed by a processor, implements the network attack data analysis method as described in any one of claims 1-5.