Network attack response method, apparatus, device, and storage medium

Abstract

The embodiment of the application discloses a network attack coping method and device, equipment and storage medium, which can be applied to the fields of computer technology, artificial intelligence and the like. The method comprises the following steps: obtaining at least one attack packet based on a honeypot probe; determining a target computer service attacked by each attack packet based on packet characteristic information of each attack packet through an attack semantic library or an intention analysis model; determining a target honeypot corresponding to each attack packet; establishing a communication connection between an attacker corresponding to each attack packet and the target honeypot, so that the attacker corresponding to each attack packet interacts with a target computer service operated by the target honeypot; obtaining interaction data between the attacker corresponding to each attack packet and the target computer service, and analyzing and processing the interaction data. According to the embodiment of the application, the target computer service attacked by the attacker can be quickly and accurately identified, and the attack packet can be coped with, so that the applicability is high.

Claims

1. A method for responding to network attacks, characterized in that, The method includes: At least one attack message is obtained based on the honeypot probe, and each attack message is sent by the corresponding attacker through any port in the full port range; The message feature information of each attack message is determined. Based on the message feature information of each attack message, the target computer service that each attack message intends to attack is determined by an attack semantic database or an intent analysis model. The attack semantic database includes message feature information of at least one historical attack message that attacks each preset computer service. The intent analysis model is trained based on the message feature information of each historical attack message and the computer service attacked by the historical attack message. The target honeypot corresponding to each attack packet is determined from the honeypot cluster. The target honeypot corresponding to each attack packet is used to simulate the target computer service that the attack packet intends to attack. Establish a communication connection between the attacker and the target honeypot corresponding to each attack message, so that the attacker corresponding to each attack message can interact with the target computer service running by the corresponding target honeypot; The interaction data between the attacker and the target computer service corresponding to each attack message is obtained, and the interaction data corresponding to each attack message is analyzed and processed.

2. The method according to claim 1, characterized in that, The acquisition of at least one attack message based on the honeypot probe includes: The honeypot probe is used to obtain at least one attack message sent by the proxy server to a preset port. The proxy server acquires connection requests sent by each attacker across all ports, and after establishing a communication connection with each attacker, acquires attack messages sent by each attacker across all ports.

3. The method according to claim 1, characterized in that, The message feature information includes an access address; for each attack message, based on the message feature information of the attack message, the target computer service that the attack message intends to attack is determined through the attack semantic database, including: In response to the attack message including an access address, the access address of the attack message is matched with the access addresses of each historical attack message in the attack semantic database. If the attack semantic database includes a target access address associated with the access address of the attack message, the preset computer service attacked by the historical attack message including the target access address is determined as the target computer service that the attack message intends to attack. If the attack semantic database does not include the target access address, the HTTP service is determined as the target computer service that the attack message intends to attack. In response to the fact that the attack message does not include an access address, the target computer service that the attack message intends to attack is determined by the attack semantics database based on at least one of the payload or access port of the attack message.

4. The method according to claim 3, characterized in that, The message characteristic information includes a payload and an access port; for each attack message, based on at least one of the attack message's payload or access port, the target computer service that the attack message intends to attack is determined through the attack semantic database, including at least one of the following: The payload of the attack message is matched with the payloads of each historical attack message in the attack semantic database. If the attack semantic database includes a target payload that is consistent with the payload of the attack message, the preset computer service attacked by the historical attack message that includes the target payload is determined as the target computer service that the attack message intends to attack. The access port of the attack message is matched with the access ports of each historical attack message in the attack semantic database. If the attack semantic database includes a target access port that matches the access port of the attack message, the preset computer service attacked by the historical attack message that includes the target access port is determined as the target computer service that the attack message intends to attack. The matching priority between the access port and payload of the attack message is determined, and based on the matching priority, the target computer service that the attack message intends to attack is determined through the attack semantic database.

5. The method according to claim 4, characterized in that, For each attack message, the matching priority of the attack message's payload is higher than the matching priority of the access port; The step of determining the target computer service that the attack message intends to attack based on the matching priority and the attack semantic database includes: The payload of the attack message is matched with the payloads of each historical attack message in the attack semantic database. If the attack semantic database includes a target payload that is consistent with the payload of the attack message, the preset computer service attacked by the historical attack message that includes the target payload is determined as the target computer service that the attack message intends to attack. If the attack semantics library does not contain the target payload, the access port of the attack message is matched with the access ports of each historical attack message in the attack semantics library. If the attack semantics library includes a target access port that matches the access port of the attack message, the preset computer service attacked by the historical attack message that includes the target access port is determined as the target computer service that the attack message intends to attack. If the target access port is not included in the attack semantics database, any one of the preset computer services will be identified as the target computer service that the attack message intends to attack.

6. The method according to claim 3, characterized in that, For each attack packet, when it is determined that the target computer service intended to be attacked by the attack packet is an HTTP service, the step of determining the target honeypot corresponding to each attack packet from the honeypot cluster includes: The honeypot in the honeypot cluster used to simulate the HTTP service is identified as the target honeypot for the attack message. When it is determined that the target computer service intended to be attacked by the attack message is any preset computer service, the step of determining the target honeypot corresponding to each attack message from the honeypot cluster includes: Any honeypot in the honeypot cluster is identified as the target honeypot corresponding to the attack message, and each honeypot in the honeypot cluster is used to simulate the operation of one of the preset computer services.

7. The method according to claim 1, characterized in that, The intent analysis model was trained in the following way: Determine a training sample set, which includes message feature information of at least one historical attack message attacking each of the preset computer services; Input the message feature information of each historical attack message into the initial model to obtain the predicted computer service of the intent attack of each historical attack message; The total training loss is determined based on the predicted computer service and the corresponding preset attack intent of each historical attack message. The initial model is iteratively trained based on the training sample set until the total training loss meets the training termination condition. The model at the time of training termination is then determined as the intent analysis model.

8. A network attack response device, characterized in that, The device includes: The message acquisition module is used to acquire at least one attack message based on the honeypot probe, and each attack message is sent by the corresponding attacker through any port in the full port range; The information determination module is used to determine the message feature information of each attack message, and based on the message feature information of each attack message, determine the target computer service that each attack message intends to attack through an attack semantic database or an intent analysis model. The attack semantic database includes the message feature information of at least one historical attack message that attacks each preset computer service, and the intent analysis model is trained based on the message feature information of each historical attack message and the computer service attacked by the historical attack message. The honeypot determination module is used to determine the target honeypot corresponding to each attack packet from the honeypot cluster. The target honeypot corresponding to each attack packet is used to simulate the target computer service that the attack packet intends to attack. The connection establishment module is used to establish a communication connection between the attacker and the target honeypot corresponding to each attack message, so that the attacker corresponding to each attack message can interact with the target computer service running by the corresponding target honeypot; The data processing module is used to acquire the interaction data between the attacker and the target computer service corresponding to each attack message, and to analyze and process the interaction data corresponding to each attack message.

9. An electronic device, characterized in that, It includes a processor and a memory, which are interconnected; The memory is used to store computer programs; The processor is configured to perform the method as described in any one of claims 1 to 7 when the computer program is invoked.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that is executed by a processor to implement the method of any one of claims 1 to 7.

Images