A method, apparatus, and processing device for data packet recovery against attack behavior.

Abstract

This application provides a method, apparatus, and processing device for restoring data packets in response to attacks, ensuring the capture of complete traffic at the time of the attack, thereby guaranteeing the effective implementation of network security measures. The data packet restoration method provided in this application includes: acquiring event data of a network attack on a server, wherein the network attack refers to an attack originating from outside the server and directed at it; determining the port corresponding to the network attack from the event data; listening for request packets passing through the port; and restoring the target PCAP traffic data packets at the time of the network attack based on the listened-out request packets.

Description

Technical Field

[0001] This application relates to the field of network security, specifically to a method, apparatus, and processing device for restoring data packets in response to attack behavior. Background Technology

[0002] In cybersecurity work, if relevant attack behaviors are detected on the server, it is obviously necessary to take appropriate action, such as identifying, tracking, stopping, or analyzing the attack behaviors.

[0003] In specific response processes, in some scenarios, when an attack is detected, it may be impossible to capture the complete traffic related to the attack. Therefore, even if the attack is detected, it is difficult to identify, track, stop, or analyze the attack, which will obviously affect the progress of network security work. Summary of the Invention

[0004] This application provides a method, apparatus, and processing device for restoring data packets in response to attacks, which ensures that the complete traffic at the time of the attack is captured, thereby ensuring the effective implementation of network security work.

[0005] Firstly, this application provides a method for restoring data packets in response to attack behavior, the method comprising:

[0006] Acquire event data of network attack behaviors that have been subjected to the server, where network attack behaviors refer to attacks that are launched against the server from outside the server.

[0007] Identify the ports corresponding to network attack activities from the event data;

[0008] Listen for request messages passing through the port;

[0009] Based on the intercepted request messages, the target PCAP traffic data packets at the time of the network attack are reconstructed.

[0010] In conjunction with the first aspect of this application, in a first possible implementation of the first aspect of this application, listening for request messages passing through the port includes:

[0011] Construct a simulated request message using the log entries in the event data;

[0012] Send a simulated request message to the port;

[0013] Interact with the port by combining the port's feedback and log entries;

[0014] The interactive content is processed to obtain request messages that pass through the port.

[0015] In conjunction with the first possible implementation of the first aspect of this application, in the second possible implementation of the first aspect of this application, sending a simulated request message to the server includes:

[0016] Use the socks module or the go module to send simulated request messages to the port.

[0017] In conjunction with the first aspect of this application, in a third possible implementation of the first aspect of this application, listening for request messages passing through the port includes:

[0018] Using packet capture tools like tcpdump or Wireshark, listen to the loopback port traffic related to the port in 3-second intervals to obtain request packets.

[0019] In conjunction with the first aspect of this application, in the fourth possible implementation of the first aspect of this application, based on the intercepted request message, the target PCAP traffic data packet at the time of the network attack is reconstructed, including:

[0020] Based on the IP 5-tuple of the intercepted request message, modify the PCAP session information of the request message to restore the target PCAP traffic data packet.

[0021] In conjunction with the first aspect of this application, in the fifth possible implementation of the first aspect of this application, the method is specifically applied to the server as an automated script remotely deployed on the server.

[0022] In conjunction with the first aspect of this application, in the sixth possible implementation of the first aspect of this application, the method further includes:

[0023] The event data and target PCAP traffic data packets are uploaded to a pre-defined web server, and a download path is provided for analysis and processing of network attack behavior.

[0024] Secondly, this application provides a data packet recovery device for attack behaviors, the device comprising:

[0025] The acquisition unit is used to acquire event data of network attack behavior that the server has been subjected to. Network attack behavior refers to attack behavior that comes from outside the server and is imposed on the server.

[0026] The determination unit is used to determine the port corresponding to the network attack behavior from the event data;

[0027] The listening unit is used to listen for request messages passing through the port;

[0028] The reconstruction unit is used to reconstruct the target PCAP traffic data packets at the time of the network attack based on the intercepted request messages.

[0029] In conjunction with the second aspect of this application, in a first possible implementation of the second aspect of this application, the listening unit is specifically used for:

[0030] Construct a simulated request message using the log entries in the event data;

[0031] Send a simulated request message to the port;

[0032] Interact with the port by combining the port's feedback and log entries;

[0033] The interactive content is processed to obtain request messages that pass through the port.

[0034] In conjunction with the first possible implementation of the second aspect of this application, in the second possible implementation of the second aspect of this application, the listening unit is specifically used for:

[0035] Use the socks module or the go module to send simulated request messages to the port.

[0036] In conjunction with the second aspect of this application, in a third possible implementation of the second aspect of this application, the listening unit is specifically used for:

[0037] Using packet capture tools like tcpdump or Wireshark, listen to the loopback port traffic related to the port in 3-second intervals to obtain request packets.

[0038] In conjunction with the second aspect of this application, in the fourth possible implementation of the second aspect of this application, the restoration unit is specifically used for:

[0039] Based on the IP 5-tuple of the intercepted request message, modify the PCAP session information of the request message to restore the target PCAP traffic data packet.

[0040] In conjunction with the second aspect of this application, in the fifth possible implementation of the second aspect of this application, the apparatus is specifically applied to the server as an automated script remotely deployed on the server.

[0041] In conjunction with the second aspect of this application, in a sixth possible implementation of the second aspect of this application, the apparatus further includes a uploading unit, used for:

[0042] The event data and target PCAP traffic data packets are uploaded to a pre-defined web server, and a download path is provided for analysis and processing of network attack behavior.

[0043] Thirdly, this application provides a processing device, including a processor and a memory, wherein a computer program is stored in the memory, and when the processor invokes the computer program in the memory, it executes the method provided by the first aspect of this application or any possible implementation of the first aspect of this application.

[0044] Fourthly, this application provides a computer-readable storage medium storing a plurality of instructions adapted for loading by a processor to perform the method provided in the first aspect of this application or any possible implementation thereof.

[0045] From the above, it can be concluded that this application has the following beneficial effects:

[0046] To address the need for complete traffic capture of network attacks on servers, this application first obtains event data of the network attack behavior on the server, determines the port corresponding to the network attack behavior from the event data, then listens for request packets passing through the port, and then, based on the listened request packets, reconstructs the target PCAP traffic data packets at the time of the network attack behavior. In this way, based on the idea of ​​reconstructing the data packets of the network attack behavior at that time, the network attack behavior itself at that time can be directly reconstructed. For subsequent network security work, this can not only ensure the effective implementation of network security work, but also promote more targeted and accurate network security work results. Attached Figure Description

[0047] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0048] Figure 1 This is a flowchart illustrating a data packet restoration method for attack behaviors according to this application;

[0049] Figure 2 This is a schematic diagram illustrating a scenario where the request packet's txt content is parsed in this application.

[0050] Figure 3 This is a schematic diagram illustrating a scenario where the response packet txt content is parsed in this application;

[0051] Figure 4 This is a schematic diagram of a scenario for the eavesdropping process described in this application;

[0052] Figure 5 This is a schematic diagram of a scenario for the outsourcing process of this application;

[0053] Figure 6This is a schematic diagram of a packet capture processing scenario in this application;

[0054] Figure 7 This is a schematic diagram of a data packet recovery device for attack behavior according to this application;

[0055] Figure 8 This is a schematic diagram of one type of processing equipment used in this application. Detailed Implementation

[0056] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0057] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that includes a series of steps or modules is not necessarily limited to those explicitly listed, but may include other steps or modules not explicitly listed or inherent to such processes, methods, products, or devices. The naming or numbering of steps appearing in this application does not imply that the steps in the method flow must be performed in the chronological / logical order indicated by the naming or numbering. The execution order of named or numbered process steps can be changed according to the desired technical purpose, as long as the same or similar technical effect is achieved.

[0058] The module division described in this application is a logical division. In practical applications, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed. In addition, the coupling or direct coupling or communication connection between modules shown or discussed may be through some interfaces, and the indirect coupling or communication connection between modules may be electrical or other similar forms, none of which are limited in this application. Furthermore, the modules or sub-modules described as separate components may or may not be physically separated, may or may not be physical modules, or may be distributed in multiple circuit modules. Some or all of the modules may be selected to achieve the purpose of the solution in this application according to actual needs.

[0059] Before introducing the data packet restoration method for attack behavior provided in this application, we will first introduce the background content involved in this application.

[0060] The data packet recovery method, apparatus, and computer-readable storage medium provided in this application can be applied to processing devices to ensure that the complete traffic at the time of the attack is captured, thereby ensuring the effective implementation of network security work.

[0061] The data packet restoration method for attack behaviors mentioned in this application can be implemented by a data packet restoration device for attack behaviors, or by different types of processing devices such as servers, physical hosts, or user equipment (UE) that integrate such a data packet restoration device for attack behaviors. The data packet restoration device for attack behaviors can be implemented in hardware or software. The UE can be a terminal device such as a smartphone, tablet, laptop, desktop computer, or personal digital assistant (PDA). The processing devices can be configured in a device cluster.

[0062] It is understood that the processing equipment involved in this application, in practical applications, can specifically be the equipment of the company to which the server under network attack belongs. This can help capture the complete traffic (traffic data packets) of the network attack on the server within the company or the company's local area network, thus facilitating the company's internal network security work.

[0063] The processing device can be any hardware device with data processing capabilities. The data processing involved can also be configured in any network device through application services, or even on a server that may be subject to network attacks. The data packet restoration method for attack behavior provided in this application can be applied.

[0064] The following section introduces the packet restoration method for attack behaviors provided in this application.

[0065] First, refer to Figure 1 , Figure 1 The diagram illustrates a flowchart of a data packet restoration method for attack behaviors according to this application. The data packet restoration method for attack behaviors provided by this application may specifically include the following steps S101 to S104:

[0066] Step S101: Obtain event data of network attack behavior that the server has been subjected to, wherein network attack behavior refers to attack behavior that comes from outside the server and is applied to the server.

[0067] It is understood that the data packet reconstruction to be performed in this application is aimed at network attacks on the server, with the purpose of capturing the complete traffic of the network attack at that time, so as to facilitate the corresponding network security work.

[0068] To address this, it is necessary to first identify the complete traffic capture target, namely the network attack behavior suffered by the server. This process begins with obtaining its event data. Each network attack behavior can be considered a network attack event. When a network attack event is detected, its content can be described through event data for recording and subsequent data.

[0069] Furthermore, it's important to understand that the network attack event data acquired here is generally real-time monitored data, facilitating the immediate capture of complete traffic. Of course, in specific application scenarios, there may also be a need to acquire historical network attack event data (over a significant time span) to capture the complete traffic of that historical attack.

[0070] This application does not involve the confirmation of the network attack itself, but is carried out after the network attack has been detected and confirmed. Therefore, the confirmation of the network attack itself will not be explained further, as it falls within the scope of existing technology. It is worth noting that in existing technology, when a network attack is confirmed, sometimes the complete traffic cannot be captured for network security work. For example, security engines such as Snort can only capture a single request or response information and cannot capture the complete request message containing the three-way handshake, which makes it impossible to output it to other linked devices for further analysis and confirmation. Therefore, the solution provided in this application can overcome this problem.

[0071] Step S102: Determine the port corresponding to the network attack behavior from the event data;

[0072] It is understandable that the event data of network attack behavior contains its own content, such as directly describing the relevant request message. The request message will carry the port information of the network attack behavior at that time, so the request message can be parsed and the corresponding port can be extracted from it.

[0073] Specifically, in practical applications, a parsing module can be configured to parse the content of request messages, such as... Figure 2 The illustration shown illustrates a scenario where this application parses the content of a request packet (txt). This allows for the parsing of the content of the request packet (txt). For example... Figure 3 The illustration shows a scenario where the content of a response packet (txt) can be parsed.

[0074] The parsing of event data (including request messages) provides the data foundation for port extraction.

[0075] As an example of port extraction processing, it can specifically extract host field information and port information from the request message, for example:

[0076] Based on the Host field: 43.143.168.252:8000, the IP address 43.143.168.252 and port 8000 are extracted. It can be seen that the port extracted in this application can also include network path information such as IP address.

[0077] Step S103: Listen for request packets passing through the port;

[0078] Once the port from which the cyberattack was launched is identified, the interception of the request packets it passed through can begin.

[0079] like Figure 4 The diagram shown illustrates one scenario of the listening process in this application, which can read response information, recalculate the content-length, and initiate specific listening processes.

[0080] Specifically, in practical applications, a listening module can be configured to perform the listening processing here.

[0081] In addition, the ports required for the preceding monitoring can also be handled by the monitoring module.

[0082] In this regard, it should be emphasized that the data packet restoration performed in this application is configured based on the idea of ​​restoring the data packets of the network attack behavior at that time. In this way, the subsequent network security work such as identification, tracking, prevention or analysis of attack behavior can be directly aimed at the network attack behavior itself, so as to achieve a more targeted and more accurate network security work effect.

[0083] In this case, after determining the port corresponding to the network attack, the request messages that pass through it (including those sent and received) can be listened to to provide a reference for the request messages of the attack that this application wants to reconstruct.

[0084] In practical applications, since the device to which the port that initiates the network attack belongs is generally from the outside, this application considers that directly listening to the port corresponding to the network attack is difficult to implement. Therefore, it can also achieve the purpose of listening to the request packets passing through it indirectly.

[0085] Specifically, as a preferred implementation, this application can also determine the request packets that the corresponding port of the network attack behavior passed through by actually sending relevant request packets, as follows:

[0086] Construct a simulated request message using the log entries in the event data;

[0087] Send a simulated request message to the port;

[0088] Interact with the port by combining the port's feedback and log entries;

[0089] The interactive content is processed to obtain request messages that pass through the port.

[0090] It can be seen that, regarding the network attack itself, although there was no complete traffic, once the network attack was confirmed, it was recorded, for example, in relevant logs (without involving specific traffic). Thus, this log can also be included in the scope of the previous event data. At this time, the corresponding request message can be constructed based on the log content of the network attack, and a session can be established with the port corresponding to the network attack. In this way, the request message to be listened to can be obtained. Moreover, the request message obtained in this way is still strongly related to or has the same substantive content as the network attack at that time, and has better practical significance.

[0091] One approach is to first construct a simulated request message and send it to the port corresponding to the network attack. This allows you to check if the device behind the port will respond (the device initiating the network attack will usually respond effectively). You can then continue to interact with the port (or the device behind the port) based on the log entries. The subsequent request messages can also be represented by simulated request messages. This process, through a virtual session, achieves the goal of listening to request messages passing through the port. It is effective and highly secure because it is conducted under controlled, virtual security conditions. Furthermore, this method is obviously independent of the original environment and can be easily implemented.

[0092] Specifically, in practical applications, a packet sending module can be configured to perform the session processing involved here, including sending simulated request messages.

[0093] As an example, the packet sending module can read log content, connect to the local 127.0.0.1, as well as the corresponding path and port, and send the corresponding content to the port. It can also listen to all interface IPs, read the response packet content, and continue to respond with the corresponding data to the port.

[0094] In practical applications, one specific implementation method for sending simulated request messages is as follows:

[0095] Use the socks module or the go module to send simulated request messages to the port.

[0096] It's understandable that it can support Python queries, using Python's socks module to simulate sending request messages, or it can support related modules from other languages, such as Go, to simulate sending request messages.

[0097] For more details, you can refer to... Figure 5 The diagram illustrates a scenario of the packet processing in this application.

[0098] The request message that is ultimately output and listened to can be captured by the configured packet capture module.

[0099] Specifically, as a specific implementation method, it can be:

[0100] Using packet capture tools like tcpdump or Wireshark, listen to the loopback port traffic related to the port in 3-second intervals to obtain request packets.

[0101] Taking the tcpdump packet capture tool as an example, in specific applications, the pexpect module based on Python can be used. The tcpdump packet capture tool (tcpdump program) listens to the corresponding loopback port traffic, captures the specified session, filters the corresponding port information, and terminates the process after a specified time of 3 seconds each time, outputting the corresponding packet capture (PCAP) file (request message).

[0102] For more details, you can refer to... Figure 6 The diagram illustrates a scenario of packet capture processing in this application.

[0103] Step S104: Based on the intercepted request messages, reconstruct the target PCAP traffic data packets at the time of the network attack.

[0104] Once the request message received from the port where the network attack was initiated is obtained, the PCAP traffic data packets of the network attack can be reconstructed based on this.

[0105] It should be understood that the request message obtained at this time is also in the form of a PCAP traffic data packet. In terms of its substantive content, it is quite similar to or even the same as the PCAP traffic data packet of the network attack at that time. Therefore, only some content needs to be adjusted to restore the PCAP traffic data packet of the network attack at that time.

[0106] Specifically, as a practical implementation method, the restoration process here can be as follows:

[0107] Based on the IP 5-tuple of the intercepted request message, modify the PCAP session information of the request message to restore the target PCAP traffic data packet.

[0108] It is understandable that the condition set here is that the actual content of the request message obtained at this time is the same as the PCAP traffic data packet of the network attack at that time. Therefore, it is only necessary to adjust the IP 5-tuple in the form to achieve the purpose of effective restoration.

[0109] The IP 5-tuple can be understood as the identification information of a session, which is represented by five fields: source IP, source port, destination IP, destination port, and the layer 4 protocol.

[0110] The PCAP traffic data packets reconstructed at that time can then be used in relevant network security work, such as identifying, tracking, stopping, or analyzing the attack.

[0111] Furthermore, as mentioned earlier, the data processing involved in the processing device can also be configured in any network device, or even on a server that may be subject to network attacks, through application services. In this case, the configuration of application services can be completed in a more convenient way.

[0112] Specifically, as a practical implementation method, the data processing involved in this application can be applied to the server as an automated script remotely deployed on the server.

[0113] This setup obviously offers the advantages of easy deployment and maintenance.

[0114] Furthermore, for any server that may be subject to a network attack, the data packet reconstruction method provided in this application can be used to accurately capture the complete traffic of the network attack at that time. Since the attack was itself, it can be processed in a more convenient and efficient manner.

[0115] After capturing the complete traffic of a network attack, it can be done in a centralized manner to facilitate the identification, tracking, prevention, or analysis of the attack. This also involves the centralized storage and processing of the complete traffic of each captured network attack.

[0116] Correspondingly, this application can be configured with a web server to centrally store the complete traffic of each captured network attack behavior.

[0117] Specifically, as a practical implementation method, the method of this application may also include:

[0118] The event data and target PCAP traffic data packets are uploaded to a pre-defined web server, and a download path is provided for analysis and processing of network attack behavior.

[0119] As can be seen, in the process of capturing a complete traffic flow, in addition to the uploading of the target PCAP traffic data packet, the uploading of corresponding event data may also be involved. Both can be used as specific data of the network attack behavior at that time for network security work.

[0120] In addition, web servers can also provide centralized data access services through cloud storage. For example, the Python-based simple_http module can be used to enable web listening, which can output the final file to the listening directory configured on the web server (the web server can be configured to open download services, which may also involve download permission verification).

[0121] Specifically, in practical applications, the upload process here can also be implemented through a download module.

[0122] As can be seen from the above, in response to the complete traffic capture requirement of a server under network attack, this application first obtains the event data of the network attack behavior, determines the port corresponding to the network attack behavior from the event data, then listens for the request packets passing through the port, and then, based on the listened request packets, reconstructs the target PCAP traffic data packets at the time of the network attack behavior. In this way, based on the idea of ​​reconstructing the data packets of the network attack behavior at that time, the network attack behavior itself at that time can be directly reconstructed. For subsequent network security work, this can not only ensure the effective implementation of network security work, but also promote more targeted and accurate network security work results.

[0123] The above is an introduction to the data packet restoration method for attack behavior provided in this application. In order to facilitate better implementation of the data packet restoration method for attack behavior provided in this application, this application also provides a data packet restoration device for attack behavior from the perspective of functional modules.

[0124] See Figure 7 , Figure 7 This is a schematic diagram of a data packet restoration device for attack behavior according to this application. In this application, the data packet restoration device 700 for attack behavior may specifically include the following structure:

[0125] The acquisition unit 701 is used to acquire event data of network attack behavior that the server has been subjected to, wherein network attack behavior refers to attack behavior that comes from outside the server and is imposed on the server.

[0126] The determining unit 702 is used to determine the port corresponding to the network attack behavior from the event data;

[0127] Listening unit 703 is used to listen for request messages passing through the port;

[0128] The restoration unit 704 is used to restore the target PCAP traffic data packets at the time of the network attack based on the intercepted request messages.

[0129] In one exemplary implementation, the listening unit 703 is specifically used for:

[0130] Construct a simulated request message using the log entries in the event data;

[0131] Send a simulated request message to the port;

[0132] Interact with the port by combining the port's feedback and log entries;

[0133] The interactive content is processed to obtain request messages that pass through the port.

[0134] In yet another exemplary implementation, the listening unit 703 is specifically used for:

[0135] Use the socks module or the go module to send simulated request messages to the port.

[0136] In yet another exemplary implementation, the listening unit 703 is specifically used for:

[0137] Using packet capture tools like tcpdump or Wireshark, listen to the loopback port traffic related to the port in 3-second intervals to obtain request packets.

[0138] In yet another exemplary implementation, the restoration unit 704 is specifically used for:

[0139] Based on the IP 5-tuple of the intercepted request message, modify the PCAP session information of the request message to restore the target PCAP traffic data packet.

[0140] In yet another exemplary implementation, the device is applied to the server as an automated script remotely deployed on the server.

[0141] In yet another exemplary implementation, the apparatus further includes an uploading unit 705, for:

[0142] The event data and target PCAP traffic data packets are uploaded to a pre-defined web server, and a download path is provided for analysis and processing of network attack behavior.

[0143] This application also provides a processing device from a hardware architecture perspective, see [link / reference]. Figure 8 , Figure 8 This diagram illustrates a structural schematic of the processing device of this application. Specifically, the processing device may include a processor 801, a memory 802, and an input / output device 803. The processor 801 executes the computer program stored in the memory 802 to implement, for example... Figure 1 The corresponding steps of the data packet restoration method for attack behavior in the embodiment; or, when the processor 801 executes the computer program stored in the memory 802, it implements as follows: Figure 7 Corresponding to the functions of each unit in the embodiment, the memory 802 is used to store the functions executed by the processor 801 as described above. Figure 1 The computer program required for the packet restoration method for attack behavior in the corresponding embodiment.

[0144] For example, a computer program may be divided into one or more modules / units, one or more of which are stored in memory 802 and executed by processor 801 to complete this application. One or more modules / units may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in a computer device.

[0145] The processing device may include, but is not limited to, processor 801, memory 802, and input / output device 803. Those skilled in the art will understand that the illustrations are merely examples of the processing device and do not constitute a limitation on the processing device. It may include more or fewer components than illustrated, or combine certain components, or different components. For example, the processing device may also include network access devices, buses, etc., and processor 801, memory 802, input / output device 803, etc., are connected via a bus.

[0146] The processor 801 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of the processing device, connecting various parts of the device through various interfaces and lines.

[0147] The memory 802 can be used to store computer programs and / or modules. The processor 801 implements various functions of the computer device by running or executing the computer programs and / or modules stored in the memory 802 and by calling data stored in the memory 802. The memory 802 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, application programs required for at least one function, etc.; the data storage area may store data created according to the use of the processing device, etc. In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, RAM, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0148] When processor 801 executes a computer program stored in memory 802, it can specifically perform the following functions:

[0149] Acquire event data of network attack behaviors that have been subjected to the server, where network attack behaviors refer to attacks that are launched against the server from outside the server.

[0150] Identify the ports corresponding to network attack activities from the event data;

[0151] Listen for request messages passing through the port;

[0152] Based on the intercepted request messages, the target PCAP traffic data packets at the time of the network attack are reconstructed.

[0153] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the packet recovery device, processing equipment, and its corresponding units described above for attack behavior can be found in, for example... Figure 1 The specific details of the data packet restoration method for attack behaviors described in the corresponding embodiments will not be repeated here.

[0154] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be performed by instructions, or by instructions controlling related hardware. These instructions can be stored in a computer-readable storage medium and loaded and executed by a processor.

[0155] Therefore, this application provides a computer-readable storage medium storing a plurality of instructions that can be loaded by a processor to execute the present application. Figure 1 The steps of the data packet restoration method for attack behavior in the corresponding embodiment can be found in the following example. Figure 1 The description of the data packet restoration method for attack behavior in the corresponding embodiment will not be repeated here.

[0156] The computer-readable storage medium may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0157] Because of the instructions stored in the computer-readable storage medium, the present application can be executed as described above. Figure 1 The steps of the data packet restoration method for attack behavior in the corresponding embodiment can therefore achieve the results of this application. Figure 1 The beneficial effects that the packet restoration method for attack behavior can achieve in the corresponding embodiments are detailed in the preceding description and will not be repeated here.

[0158] The data packet restoration method, apparatus, processing device, and computer-readable storage medium for attack behaviors provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for restoring data packets in response to attack behavior, characterized in that, The method includes: Acquire event data of network attack behaviors that have been subjected to the server, wherein the network attack behaviors refer to attack behaviors that are imposed on the server from outside the server; Determine the port corresponding to the network attack behavior from the event data; Listen for request messages passing through the port; Based on the intercepted request message, reconstruct the target PCAP traffic data packets at the time of the network attack. The listening for request messages passing through the port includes: A simulated request message is constructed based on the log entries in the event data. Send the simulated request message to the port; Interact with the port by combining the feedback from the port and the contents of the log; The interactive content is processed to obtain the request message that passes through the port.

2. The method according to claim 1, characterized in that, Sending the simulated request message to the server includes: The simulated request message is sent to the port using the socks module or the go module.

3. The method according to claim 1, characterized in that, The listening for request messages passing through the port includes: Using packet capture tools such as tcpdump or Wireshark, listen to the loopback port traffic related to the port in 3-second intervals to obtain the request message.

4. The method according to claim 1, characterized in that, The step of reconstructing the target PCAP traffic data packets at the time of the network attack based on the intercepted request message includes: Based on the IP 5-tuple of the intercepted request message, the PCAP session information of the request message is modified to restore the target PCAP traffic data packet.

5. The method according to claim 1, characterized in that, The method is specifically applied to the server in the form of an automated script remotely deployed on the server.

6. The method according to claim 1, characterized in that, The method further includes: The event data and the target PCAP traffic data packet are uploaded to a preset web server, and a download path is provided for analysis and processing of the network attack behavior.

7. A data packet recovery device for attack behavior, characterized in that, The device includes: The acquisition unit is used to acquire event data of network attack behavior that the server is subjected to, wherein the network attack behavior refers to the attack behavior that is imposed on the server from outside the server. A determining unit is configured to determine the port corresponding to the network attack behavior from the event data; A listening unit is used to listen for request messages passing through the port; The restoration unit is used to restore the target PCAP traffic data packets at the time of the network attack based on the intercepted request message. The listening unit is specifically used for: A simulated request message is constructed based on the log entries in the event data. Send the simulated request message to the port; Interact with the port by combining the feedback from the port and the contents of the log; The interactive content is processed to obtain the request message that passes through the port.

8. A processing apparatus, characterized in that, It includes a processor and a memory, wherein the memory stores a computer program, and the processor executes the method as described in any one of claims 1 to 6 when it invokes the computer program in the memory.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a plurality of instructions adapted for loading by a processor to perform the method of any one of claims 1 to 6.

Images