Network attack data set construction method, device, electronic device and storage medium

Abstract

The present application discloses a network attack data set construction method, device, electronic device and readable storage medium, which are applied to the field of Internet technology. The network attack data set construction method includes: obtaining a network attack traffic packet stored in a network simulation verification platform; determining the platform single-step attack log data corresponding to the network attack traffic packet, and determining a target attack traffic packet in the network attack traffic packet according to the platform single-step attack log data; and constructing a network attack data set according to the target attack traffic packet and the features corresponding to the target attack traffic packet. The present application solves the technical problem of low efficiency in constructing a network attack data set.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a method, device, electronic device and readable storage medium for constructing a network attack data set. Background Art

[0002] With the deepening of research in the field of network security and the widespread application of network security services, the use of network attack datasets is becoming more and more extensive, and the demand for network attack datasets is also increasing.

[0003] At present, network attack datasets are usually downloaded from authoritative websites. However, when the demand for network attack datasets is too great, it is necessary to frequently download network attack datasets from authoritative websites. Alternatively, when professionals use attack tools or attack principles to launch attacks or write attack scripts to build network attack datasets, they rely too much on the dataset building experience and professional ability of professionals. However, human ability is limited, which can easily lead to a long construction time for network attack datasets, resulting in low construction efficiency of network attack datasets. Summary of the invention

[0004] The main purpose of the present application is to provide a method, device, electronic device and readable storage medium for constructing a network attack dataset, aiming to solve the technical problem of low efficiency in constructing a network attack dataset in the prior art.

[0005] To achieve the above objectives, the present application provides a method for constructing a network attack dataset, the method comprising:

[0006] Obtain network attack traffic packets stored in the network simulation verification platform;

[0007] Determine the platform single-step attack log data corresponding to the network attack traffic packet, and determine the target attack traffic packet in the network attack traffic packet according to the platform single-step attack log data;

[0008] A network attack data set is constructed according to the target attack traffic packet and features corresponding to the target attack traffic packet.

[0009] Optionally, the network attack traffic packet includes at least one threat traffic packet.

[0010] The step of obtaining the network attack traffic packet stored in the network simulation verification platform includes:

[0011] Querying the network simulation verification platform to obtain at least one piece of threat traffic data;

[0012] Each threat flow data is sliced ​​according to the attack behavior time corresponding to each threat flow data to obtain the threat flow packet.

[0013] Optionally, the network attack traffic packet includes at least one threat traffic packet, the platform single-step attack log data includes first single-step attack log data corresponding to the threat traffic packet, and the target attack traffic packet includes a target attack and defense activity traffic packet.

[0014] The step of determining a target attack traffic packet in the network attack traffic packet according to the platform single-step attack log data comprises:

[0015] Querying the first single-step attack log data to obtain the attack behavior type of each threat flow data in each threat flow packet after being merged by the network simulation verification platform;

[0016] According to each of the attack behavior types, each threat flow data in each of the threat flow packets is sliced ​​to obtain at least one target attack and defense activity flow packet.

[0017] Optionally, the network attack traffic packet includes at least one network tester traffic packet, the platform single-step attack log data includes second single-step attack log data corresponding to the network tester traffic packet, and the target attack traffic packet includes a target network tester traffic packet.

[0018] The step of determining a target attack traffic packet in the network attack traffic packet according to the platform single-step attack log data comprises:

[0019] Query the second single-step attack log data to obtain the fusion vulnerability information of each network tester flow packet after being fused by the network simulation verification platform;

[0020] Performing vulnerability analysis on the traffic packets of each network tester to obtain analysis vulnerability information;

[0021] A target network tester traffic packet that matches the fused vulnerability information and the analyzed vulnerability information is selected from each of the network tester traffic packets.

[0022] Optionally, the network attack traffic packet includes at least one website attack traffic packet, and the platform single-step attack log data includes third single-step attack log data corresponding to the website attack traffic packet.

[0023] The step of determining the platform single-step attack log data corresponding to the network attack traffic packet comprises:

[0024] Taking the website attack traffic packets as target traffic packets, performing attack detection on each of the target traffic packets through the network simulation verification platform to obtain detection results;

[0025] If the detection result is a threat log result, the platform single-step attack log data corresponding to the target traffic packet is used as the third single-step attack log data;

[0026] If the detection result is that no threat log result is generated, the target traffic packet is retained through the network simulation verification platform.

[0027] Optionally, after the step of retaining the target traffic packet through the network simulation verification platform, the method further includes:

[0028] After a preset time interval, the target traffic packet is updated to a traffic packet whose detection result is that no threat log result is generated in each of the website attack traffic packets;

[0029] Return to executing the step of performing attack detection on each of the target traffic packets through the network simulation verification platform to obtain the detection result and subsequent steps, until the detection results corresponding to each of the target traffic packets generate threat log results.

[0030] Optionally, the step of constructing a network attack data set according to the target attack traffic packet and the features corresponding to the target attack traffic packet includes:

[0031] Obtaining traffic packet information of the target attack traffic packet;

[0032] Adjusting the traffic packet information, decrypting the target attack traffic packet, and obtaining a decrypted attack traffic packet;

[0033] A network attack data set is constructed according to the features corresponding to the decrypted attack traffic packets.

[0034] To achieve the above-mentioned purpose, the present application also provides a network attack dataset construction device, the network attack dataset construction device comprising:

[0035] An acquisition module, used to acquire network attack traffic packets stored in a network simulation verification platform;

[0036] A determination module, used to determine the platform single-step attack log data corresponding to the network attack traffic packet, and determine the target attack traffic packet in the network attack traffic packet according to the platform single-step attack log data;

[0037] A construction module is used to construct a network attack data set according to the target attack traffic packet and the characteristics corresponding to the target attack traffic packet.

[0038] Optionally, the network attack traffic packet includes at least one threat traffic packet, and the acquisition module is further used to:

[0039] Querying the network simulation verification platform to obtain at least one piece of threat traffic data;

[0040] Each threat flow data is sliced ​​according to the attack behavior time corresponding to each threat flow data to obtain the threat flow packet.

[0041] Optionally, the network attack traffic packet includes at least one threat traffic packet, the platform single-step attack log data includes first single-step attack log data corresponding to the threat traffic packet, the target attack traffic packet includes a target attack and defense activity traffic packet, and the determination module is further used to:

[0042] Querying the first single-step attack log data to obtain the attack behavior type of each threat flow data in each threat flow packet after being merged by the network simulation verification platform;

[0043] According to each of the attack behavior types, each threat flow data in each of the threat flow packets is sliced ​​to obtain at least one target attack and defense activity flow packet.

[0044] Optionally, the network attack traffic packet includes at least one network tester traffic packet, the platform single-step attack log data includes second single-step attack log data corresponding to the network tester traffic packet, the target attack traffic packet includes a target network tester traffic packet, and the determination module is further used to:

[0045] Query the second single-step attack log data to obtain the fusion vulnerability information of each network tester flow packet after being fused by the network simulation verification platform;

[0046] Performing vulnerability analysis on the traffic packets of each network tester to obtain analysis vulnerability information;

[0047] A target network tester traffic packet that matches the fused vulnerability information and the analyzed vulnerability information is selected from each of the network tester traffic packets.

[0048] Optionally, the network attack traffic packet includes at least one website attack traffic packet, the platform single-step attack log data includes third single-step attack log data corresponding to the website attack traffic packet, and the determination module is further used to:

[0049] Taking the website attack traffic packets as target traffic packets, performing attack detection on each of the target traffic packets through the network simulation verification platform to obtain detection results;

[0050] If the detection result is a threat log result, the platform single-step attack log data corresponding to the target traffic packet is used as the third single-step attack log data;

[0051] If the detection result is that no threat log result is generated, the target traffic packet is retained through the network simulation verification platform.

[0052] Optionally, after the step of retaining the target traffic packet through the network simulation verification platform, the network attack data set construction device is further used to:

[0053] After a preset time interval, the target traffic packet is updated to a traffic packet whose detection result is that no threat log result is generated in each of the website attack traffic packets;

[0054] Return to executing the step of performing attack detection on each of the target traffic packets through the network simulation verification platform to obtain the detection result and subsequent steps, until the detection results corresponding to each of the target traffic packets generate threat log results.

[0055] Optionally, the building block is further used to:

[0056] Obtaining traffic packet information of the target attack traffic packet;

[0057] Adjusting the traffic packet information, decrypting the target attack traffic packet, and obtaining a decrypted attack traffic packet;

[0058] A network attack data set is constructed according to the features corresponding to the decrypted attack traffic packets.

[0059] The present application also provides an electronic device, comprising: a memory, a processor, and a program of the network attack dataset construction method stored in the memory and executable on the processor. When the program of the network attack dataset construction method is executed by the processor, the steps of the network attack dataset construction method as described above can be implemented.

[0060] The present application also provides a computer-readable storage medium, on which is stored a program for implementing a method for constructing a network attack dataset. When the program for the method for constructing a network attack dataset is executed by a processor, the steps of the method for constructing a network attack dataset as described above are implemented.

[0061] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned network attack data set construction method when executed by a processor.

[0062] The present application provides a method, device, electronic device and readable storage medium for constructing a network attack data set. Compared with a method for constructing a network attack data set by downloading the network attack data set from an authoritative website or by professionals launching attacks or writing attack scripts with the help of attack tools or attack principles, the present application obtains network attack traffic packets stored in a network simulation verification platform; determines platform single-step attack log data corresponding to the network attack traffic packet, and determines a target attack traffic packet in the network attack traffic packet according to the platform single-step attack log data; constructs a network attack data set according to the target attack traffic packet and the characteristics corresponding to the target attack traffic packet, and realizes the automatic construction of the network attack data set by using the network attack traffic packets and the platform single-step attack log data determined by the network simulation verification platform, without relying on the dataset construction experience and professional ability of professionals, greatly shortening the construction time of the network attack data set, thereby improving the construction efficiency of the network attack data set. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0064] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0065] Figure 1 This is a flow chart of the first embodiment of the network attack dataset construction method of the present application;

[0066] Figure 2 A schematic diagram of the construction process of a network attack data set when the network attack traffic packet is a threat traffic packet;

[0067] Figure 3 A schematic diagram of the construction process of a network attack data set when the network attack traffic packet is a network tester traffic packet;

[0068] Figure 4 A schematic diagram of the construction process of a network attack data set when the network attack traffic packet is a website attack traffic packet;

[0069] Figure 5 Schematic diagram of the device structure of the hardware operating environment involved in the network attack dataset construction method in the embodiment of the present application.

[0070] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0071] In order to make the above-mentioned purposes, features and advantages of the present application more obvious and understandable, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work belong to the scope of protection of this application.

[0072] Embodiment 1

[0073] The present application embodiment provides a method for constructing a network attack dataset. In the first embodiment of the network attack dataset construction method of the present application, refer to Figure 1 , the network attack data set construction method includes:

[0074] Step S10, obtaining the network attack traffic packet stored in the network simulation verification platform;

[0075] In this embodiment, it should be noted that the network attack traffic packet is a traffic packet stored by the network simulation verification platform and obtained from at least one source when the network simulation verification platform launches an attack on at least one organization or institution, and the network attack traffic packet includes at least one or more of a threat traffic packet, a network tester traffic packet, and a website attack traffic packet. The network simulation verification platform, also known as a network range, is a network system simulation platform that simulates a target network based on a set of software and hardware resources, including computing storage service resources, network resources, software resources, etc., for collaborative use by multiple roles, serving network security talent training, network attack and defense training, security product evaluation, and network new technology verification, and can be used as a large scientific device serving network security technology and network new technology research.

[0076] As an example, step S10 includes: screening out network attack traffic packets from various network traffic packets stored in the network simulation verification platform.

[0077] As an example, step S10 includes: building a preset traffic packet acquisition environment in the network simulation verification platform, and obtaining stored network attack traffic packets under the preset traffic packet acquisition environment through the network simulation verification platform, wherein the preset traffic packet acquisition environment is a pre-set basic environment for establishing a network simulation verification platform for collecting network attack traffic packets.

[0078] Step S20, determining the platform single-step attack log data corresponding to the network attack traffic packet, and determining the target attack traffic packet in the network attack traffic packet according to the platform single-step attack log data;

[0079] Exemplarily, step S20 includes: determining the platform single-step attack log data corresponding to the network attack traffic packet, and determining the traffic packet information corresponding to the network attack traffic packet based on the platform single-step attack log data, and screening the target attack traffic packet from the network attack traffic packet based on the traffic packet information.

[0080] As an example, filtering out target attack traffic packets from the network attack traffic packets according to the traffic packet information includes: classifying each of the network attack traffic packets according to the traffic packet information to obtain a classification result; and filtering out target attack traffic packets from the network attack traffic packets according to the classification result.

[0081] As an example, screening out target attack traffic packets from the network attack traffic packets according to the traffic packet information includes: performing traffic packet analysis on each of the network attack traffic packets according to the traffic packet information to obtain analysis results; and screening out target attack traffic packets from the network attack traffic packets according to the analysis results.

[0082] Step S30: construct a network attack data set according to the target attack traffic packet and the features corresponding to the target attack traffic packet.

[0083] In this embodiment, it should be noted that the characteristics corresponding to the target attack traffic packet include the traffic packet information and / or traffic packet attributes of the target attack traffic packet. The characteristics corresponding to the target attack traffic packet can be the attack behavior type of the target attack traffic packet, or can be information such as the packet header of the target attack traffic packet.

[0084] Among them, in step S30, the step of constructing a network attack data set according to the target attack traffic packet and the features corresponding to the target attack traffic packet includes:

[0085] Step S31, obtaining traffic packet information of the target attack traffic packet;

[0086] Step S32, adjusting the traffic packet information, decrypting the target attack traffic packet, and obtaining a decrypted attack traffic packet;

[0087] Step S33: construct a network attack data set according to the features corresponding to the decrypted attack traffic packets.

[0088] In this embodiment, it should be noted that the traffic packet information is the information carried by the target attack traffic packet, and the traffic packet information includes at least one of an IP address, a MAC address, a data packet description, and an attack identification code based on a network simulation verification platform.

[0089] Exemplarily, steps S31 to S33 include: obtaining traffic packet information of the target attack traffic packet; adjusting the traffic packet information to preset traffic packet information, decrypting the target attack traffic packet to obtain a decrypted attack traffic packet; performing feature extraction on the decrypted attack traffic packet to obtain features corresponding to the decrypted attack traffic packet, and constructing a network attack data set based on the features corresponding to the decrypted attack traffic packet.

[0090] As an example, after the step of constructing a network attack data set according to the characteristics corresponding to the decrypted attack traffic packet, it also includes: adding a traffic packet label to the decrypted attack traffic packet according to a preset traffic packet naming format, wherein the preset traffic packet naming format is a naming method of a pre-set traffic packet label, and the traffic packet label is used to characterize the identification information of the decrypted attack traffic packet; and updating the network attack data set description list according to the traffic packet label and the decrypted attack traffic packet.

[0091] It is understandable that when a network attack dataset is constructed by downloading a network attack dataset from an authoritative website, or by professionals launching attacks or writing attack scripts with the help of attack tools or attack principles, the source of the constructed network attack dataset is single, limited to a certain authoritative website or limited to a certain attack or certain items, resulting in a high limitation in the construction of the network attack dataset. The embodiment of the present application obtains network attack traffic packets in a network simulation verification platform, and has a diversified source of traffic packets. Since the network attack dataset is constructed from network attack traffic packets, the constructed network attack dataset has the characteristics of network attack traffic packets from multiple sources, thereby reducing the construction limitations of the network attack dataset.

[0092] It is understandable that due to relevant regulations, individuals or organizations are usually not allowed to spontaneously launch attack scripts. Therefore, when constructing a network attack dataset by downloading a network attack dataset from an authoritative website, or by professionals launching attacks with the help of attack tools or attack principles or writing attack scripts, it is easy for the relevant data of the obtained network attack traffic packets to be different from the actual data, resulting in low authenticity in the construction of the network attack dataset. The embodiment of the present application can collect real threat events by acquiring network attack traffic packets stored in a network simulation verification platform (the network simulation verification platform is a real attack that is allowed to be launched within a specified time, and therefore, meets the above-mentioned relevant regulations), and the network attack dataset is constructed by the network attack traffic packets of the network simulation verification platform, so the authenticity of the construction of the network attack dataset is improved.

[0093] The embodiment of the present application provides a method for constructing a network attack data set. Compared with the method of constructing a network attack data set by downloading the network attack data set from an authoritative website or by professionals launching attacks with the help of attack tools or attack principles or writing attack scripts, the embodiment of the present application obtains a network attack traffic packet stored in a network simulation verification platform; determines the platform single-step attack log data corresponding to the network attack traffic packet, and determines a target attack traffic packet in the network attack traffic packet according to the platform single-step attack log data; constructs a network attack data set according to the target attack traffic packet and the characteristics corresponding to the target attack traffic packet, and realizes the automatic construction of the network attack data set by using the network attack traffic packet and the platform single-step attack log data determined by the network simulation verification platform, without relying on the dataset construction experience and professional ability of professionals, greatly shortening the construction time of the network attack data set, thereby improving the construction efficiency of the network attack data set.

[0094] Embodiment 2

[0095] Further, based on the first embodiment of the present application, in another embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can be referred to the above introduction, and will not be repeated later. On this basis, in step S10, the network attack traffic packet includes at least one threat traffic packet, and the step of obtaining the network attack traffic packet stored in the network simulation verification platform includes:

[0096] Step S11, querying the network simulation verification platform to obtain at least one piece of threat traffic data;

[0097] Step S12: Slice each threat flow data according to the attack behavior time corresponding to each threat flow data to obtain the threat flow packet.

[0098] Exemplarily, steps S11 to S12 include: querying the stored traffic data in the network simulation verification platform to obtain at least one piece of threat traffic data; obtaining the attack behavior time corresponding to each piece of the threat traffic data, and slicing each piece of the threat traffic data according to each piece of the attack behavior time to obtain the threat traffic package, wherein the attack behavior time is the time when each piece of the threat traffic data generates an attack behavior, and the attack behavior time can be time period information or moment information.

[0099] As an example, the step of obtaining the attack behavior time corresponding to each of the threat traffic data may be: obtaining a preset traffic time file, wherein the preset traffic time file includes a mapping relationship between each stored traffic data and the attack behavior time of each of the stored traffic data, and querying the preset traffic time file according to the threat traffic data to obtain the attack behavior time corresponding to each of the threat traffic data.

[0100] As an example, the step S12 includes: the attack behavior time includes the attack behavior moment, and according to each attack behavior moment, the threat traffic data at the same moment is sliced ​​to obtain the threat traffic package, or the attack behavior time includes the attack behavior time period, and according to each attack behavior time period, the threat traffic data in the same time period is sliced ​​to obtain the threat traffic package.

[0101] By slicing the threat traffic data according to the attack behavior time, the obtained threat traffic packets are threat traffic data at the same attack behavior moment or the same attack behavior time period, which can reduce the subsequent analysis and processing time of the threat traffic data packets, thereby improving the efficiency of constructing the network attack data set.

[0102] Wherein, in step S20, the network attack traffic packet includes at least one threat traffic packet, the platform single-step attack log data includes first single-step attack log data corresponding to the threat traffic packet, the target attack traffic packet includes a target attack and defense activity traffic packet, and the step of determining the target attack traffic packet in the network attack traffic packet according to the platform single-step attack log data includes:

[0103] Step S21, querying the first single-step attack log data to obtain the attack behavior type of each threat flow data in each threat flow packet after being merged by the network simulation verification platform;

[0104] Step S22: According to each of the attack behavior types, each threat flow data in each of the threat flow packets is sliced ​​to obtain at least one target attack and defense activity flow packet.

[0105] In this embodiment, it should be noted that the first single-step attack log data includes the attack behavior type of each threat flow data in each threat flow packet after being merged by the network simulation verification platform.

[0106] Exemplarily, steps S21 to S22 include: querying the first single-step attack log data to obtain the attack behavior type of each threat traffic data in each threat traffic package after fusion through the network simulation verification platform; according to each attack behavior type, slicing each threat traffic data in each threat traffic package to obtain the threat traffic data as at least one target attack and defense activity traffic package of the same attack behavior type and the same attack behavior time.

[0107] On the basis of slicing the threat traffic data according to the attack behavior time to obtain the threat traffic package, the threat traffic package is further sliced ​​according to the attack behavior type to obtain the target attack and defense activity traffic package, so that the obtained target attack and defense activity traffic package is of the same attack behavior type and the attack behavior time corresponding to the attack behavior type is also the same, which further reduces the subsequent analysis and processing time of the target attack and defense activity traffic package, thereby further improving the efficiency of constructing the network attack data set.

[0108] As an example, see Figure 2 , Figure 2 This is a schematic diagram of the construction process of a network attack data set when the network attack traffic packet is a threat traffic packet. The threat traffic data is obtained through the network simulation verification platform, and then the threat traffic packet (the traffic packet in the valid time period shown in the figure) is obtained. The threat traffic packet is sliced ​​and the traffic data is filtered according to the single-step attack log of the network simulation verification platform. Then, the attack-related traffic and attack category are obtained, and the feature representation data set is updated.

[0109] It is understandable that during the construction of a conventional network attack data set, the network attack traffic packets obtained usually carry a large amount of key information such as IP addresses, MAC addresses, and data packet descriptions. Therefore, they cannot be widely disclosed for external use, resulting in high limitations on the use of the constructed network attack data set. The embodiment of the present application decrypts the target attack traffic packets, thereby hiding the key information of the data packets in the target attack traffic packets. Therefore, the network attack data set constructed from the target attack traffic packets does not contain the above key information of the data packets, so it can be used and studied by researchers and / or institutions in various fields, thereby reducing the limitations of the use of the network attack data set.

[0110] Embodiment 3

[0111] Further, based on the first embodiment and / or the second embodiment of the present application, in another embodiment of the present application, the same or similar contents as those in the above embodiments can be referred to the above description, and will not be described in detail later. On this basis, in step S20, the network attack traffic packet includes at least one network tester traffic packet, the platform single-step attack log data includes the second single-step attack log data corresponding to the network tester traffic packet, the target attack traffic packet includes the target network tester traffic packet,

[0112] The step of determining a target attack traffic packet in the network attack traffic packet according to the platform single-step attack log data comprises:

[0113] Step A10, querying the second single-step attack log data to obtain the fusion vulnerability information of each network tester flow packet after being fused by the network simulation verification platform;

[0114] Step A20, performing vulnerability analysis on the traffic packets of each network tester to obtain analysis vulnerability information;

[0115] Step A30, selecting a target network tester traffic packet whose fusion vulnerability information matches the analysis vulnerability information from each of the network tester traffic packets.

[0116] Exemplarily, steps A10 to A30 include: querying the second single-step attack log data to obtain the fused vulnerability information of each network tester traffic packet after being merged by the network simulation verification platform; performing vulnerability analysis on each network tester traffic packet to obtain analysis vulnerability information; selecting the target network tester traffic packet that matches the fused vulnerability information and the analysis vulnerability information in each network tester traffic packet; and retaining the fused vulnerability information and the analysis vulnerability information in each network tester traffic packet that do not match in the network simulation verification platform.

[0117] Wherein, after the step of retaining the fusion vulnerability information and the analysis vulnerability information in each of the network tester traffic packets that do not match in the network simulation verification platform, it also includes:

[0118] After a preset time interval, return to execute the step of querying the second single-step attack log data to obtain the fused vulnerability information of each network tester traffic packet after fusion by the network simulation verification platform and subsequent steps, until the fused vulnerability information corresponding to each network tester traffic packet and the corresponding analysis vulnerability information are matched one by one.

[0119] The network attack traffic packet includes at least one network tester traffic packet, and the step of obtaining the network attack traffic packet stored in the network simulation verification platform includes:

[0120] A network tester traffic packet collection environment is established through the network simulation verification platform, and traffic collection is performed under the network tester traffic packet collection environment through the network simulation verification platform to obtain a network tester traffic packet.

[0121] As an example, see Figure 3 , Figure 3 The figure is a flow chart of constructing a network attack data set when the network attack traffic packet is a network tester traffic packet. The network tester traffic packet is obtained, and the network tester traffic packet is detected by the attack detection system of the network simulation verification platform. The attack category and fused vulnerability information (the vulnerability information shown in the figure) of the network tester traffic packet are obtained through the single-step attack threat log of the network simulation verification platform. It is determined whether the vulnerability information matches the analyzed vulnerability information. If they match, the feature identification data set is updated. If they do not match, the network tester traffic packet is retained by the network simulation verification platform.

[0122] It is understandable that when a method is adopted in which professionals use attack tools or attack principles to launch attacks or write attack scripts to construct a network attack dataset, since the acquisition method is relatively single and human capabilities are limited, there may be a situation where the constructed network attack dataset is of a low version. When a method is adopted in which a network attack dataset is downloaded from an authoritative website, the version of the downloaded network attack dataset may be low, so it is necessary to frequently re-download to ensure that the obtained network attack dataset is the latest version. Therefore, it is impossible to balance the use effect and construction efficiency of the network attack dataset.

[0123] An embodiment of the present application provides a method for constructing a network attack dataset. Compared with a method for constructing a network attack dataset by downloading the network attack dataset from an authoritative website or by professionals launching attacks with the help of attack tools or attack principles or writing attack scripts, the embodiment of the present application obtains the fused vulnerability information of each network tester traffic packet after being merged by a network simulation verification platform by querying the second single-step attack log data; performs vulnerability analysis on each network tester traffic packet to obtain analysis vulnerability information; selects a target network tester traffic packet that matches the fused vulnerability information and the analysis vulnerability information from each network tester traffic packet. Since the network tester data packet is obtained through the network tester in the network simulation verification platform, it can be updated in real time, quickly updated, and continuously updated, and the target network tester traffic packet is used to construct the network attack dataset, thereby avoiding the technical defect that the constructed network attack dataset is a low version, thereby improving the construction efficiency of the network attack dataset while ensuring the high use effect of the network attack dataset.

[0124] Embodiment 4

[0125] Further, based on the first embodiment and / or the second embodiment and / or the third embodiment of the present application, in another embodiment of the present application, the same or similar contents as the above embodiments can be referred to the above introduction, and will not be repeated later. On this basis, in step S20, the network attack traffic packet includes at least one website attack traffic packet, and the platform single-step attack log data includes the third single-step attack log data corresponding to the website attack traffic packet,

[0126] The step of determining the platform single-step attack log data corresponding to the network attack traffic packet comprises:

[0127] Step B10, taking the website attack traffic packets as target traffic packets, and performing attack detection on each of the target traffic packets through the network simulation verification platform to obtain detection results;

[0128] Step B20: if the detection result is a threat log result, the platform single-step attack log data corresponding to the target traffic packet is used as the third single-step attack log data;

[0129] Step B30: If the detection result is that no threat log result is generated, the target traffic packet is retained through the network simulation verification platform.

[0130] Among them, in step B30, after the step of retaining the target traffic packet through the network simulation verification platform, it also includes:

[0131] Step B40, after a preset time interval, updating the target traffic packet to a traffic packet whose detection result is that no threat log result is generated among the website attack traffic packets;

[0132] Step B50, returns to execute the step of performing attack detection on each of the target traffic packets through the network simulation verification platform to obtain the detection result and subsequent steps, until the detection results corresponding to each of the target traffic packets generate threat log results.

[0133] It is understandable that the network simulation verification platform will periodically launch attacks on organizations or individuals, and therefore, the network simulation verification platform can be updated in real time.

[0134] In this embodiment, it should be noted that the preset time interval is a preset update time interval of the network simulation verification platform.

[0135] As an example, step B10 to step B50 include: the website attack traffic packet includes traffic packet 1, traffic packet 2 and traffic packet 3, and traffic packet 1, traffic packet 2 and traffic packet 3 are taken as target traffic packets, and attack detection is performed on the target traffic packets to obtain detection results. If the detection result of traffic packet 1 is a threat log result, the platform single-step attack log data corresponding to traffic packet 1 is taken as the third single-step attack log data; if the detection results of traffic packet 2 and traffic packet 3 are no threat log results, traffic packet 2 and traffic packet 3 are retained through the network simulation verification platform; after a preset time interval, traffic packet 2 and traffic packet 3 are updated to target traffic packets, and the step of performing attack detection on each of the target traffic packets through the network simulation verification platform to obtain the detection results and subsequent steps is returned until the detection results of traffic packet 2 and traffic packet 3 are both threat log results.

[0136] By performing multiple detections on the traffic packets that did not generate threat logs in the previous time step after a preset time interval, the detection of the target traffic packets is made real-time. Since the target traffic packets are used to construct a network attack dataset, the real-time construction of the network attack dataset is improved.

[0137] The step of obtaining the network attack traffic packet stored in the network simulation verification platform includes:

[0138] Attack traffic is obtained on a preset website, a network traffic playback environment is built through the network simulation verification platform, and traffic is collected under the network traffic playback environment through the network simulation verification platform to obtain website attack traffic packets.

[0139] As an example, see Figure 4 , Figure 4 The present invention is a flowchart of constructing a network attack data set when the network attack traffic packet is a website attack traffic packet. The attack traffic publicly available on the Internet is obtained, and the attack traffic is detected by the attack detection system of the network simulation verification platform to determine whether the network simulation verification platform can generate threat logs. If not, the attack traffic is retained. If so, the attack alarm and pcap (Packet Capture, network data packet capture format) data of the attack traffic are obtained, the data set features of the attack traffic are extracted, and the data set of the feature identification is updated.

[0140] The embodiment of the present application provides a method for constructing a network attack data set. Compared with the method of constructing a network attack data set by downloading the network attack data set from an authoritative website or by professionals launching attacks with the help of attack tools or attack principles or writing attack scripts, the embodiment of the present application obtains a network attack traffic packet stored in a network simulation verification platform; determines the platform single-step attack log data corresponding to the network attack traffic packet, and determines a target attack traffic packet in the network attack traffic packet according to the platform single-step attack log data; constructs a network attack data set according to the target attack traffic packet and the characteristics corresponding to the target attack traffic packet, and realizes the automatic construction of the network attack data set by using the network attack traffic packet and the platform single-step attack log data determined by the network simulation verification platform, without relying on the dataset construction experience and professional ability of professionals, greatly shortening the construction time of the network attack data set, thereby improving the construction efficiency of the network attack data set.

[0141] Embodiment 5

[0142] The embodiment of the present application also provides a network attack data set construction device, the network attack data set construction device comprising:

[0143] An acquisition module, used to acquire network attack traffic packets stored in a network simulation verification platform;

[0144] A determination module, used to determine the platform single-step attack log data corresponding to the network attack traffic packet, and determine the target attack traffic packet in the network attack traffic packet according to the platform single-step attack log data;

[0145] A construction module is used to construct a network attack data set according to the target attack traffic packet and the characteristics corresponding to the target attack traffic packet.

[0146] Optionally, the network attack traffic packet includes at least one threat traffic packet, and the acquisition module is further used to:

[0147] Querying the network simulation verification platform to obtain at least one piece of threat traffic data;

[0148] Each threat flow data is sliced ​​according to the attack behavior time corresponding to each threat flow data to obtain the threat flow packet.

[0149] Optionally, the network attack traffic packet includes at least one threat traffic packet, the platform single-step attack log data includes first single-step attack log data corresponding to the threat traffic packet, the target attack traffic packet includes a target attack and defense activity traffic packet, and the determination module is further used to:

[0150] Querying the first single-step attack log data to obtain the attack behavior type of each threat flow data in each threat flow packet after being merged by the network simulation verification platform;

[0151] According to each of the attack behavior types, each threat flow data in each of the threat flow packets is sliced ​​to obtain at least one target attack and defense activity flow packet.

[0152] Optionally, the network attack traffic packet includes at least one network tester traffic packet, the platform single-step attack log data includes second single-step attack log data corresponding to the network tester traffic packet, the target attack traffic packet includes a target network tester traffic packet, and the determination module is further used to:

[0153] Query the second single-step attack log data to obtain the fusion vulnerability information of each network tester flow packet after being fused by the network simulation verification platform;

[0154] Performing vulnerability analysis on the traffic packets of each network tester to obtain analysis vulnerability information;

[0155] A target network tester traffic packet that matches the fused vulnerability information and the analyzed vulnerability information is selected from each of the network tester traffic packets.

[0156] Optionally, the network attack traffic packet includes at least one website attack traffic packet, the platform single-step attack log data includes third single-step attack log data corresponding to the website attack traffic packet, and the determination module is further used to:

[0157] Taking the website attack traffic packets as target traffic packets, performing attack detection on each of the target traffic packets through the network simulation verification platform to obtain detection results;

[0158] If the detection result is a threat log result, the platform single-step attack log data corresponding to the target traffic packet is used as the third single-step attack log data;

[0159] If the detection result is that no threat log result is generated, the target traffic packet is retained through the network simulation verification platform.

[0160] Optionally, after the step of retaining the target traffic packet through the network simulation verification platform, the network attack data set construction device is further used to:

[0161] After a preset time interval, the target traffic packet is updated to a traffic packet whose detection result is that no threat log result is generated in each of the website attack traffic packets;

[0162] Return to executing the step of performing attack detection on each of the target traffic packets through the network simulation verification platform to obtain the detection result and subsequent steps, until the detection results corresponding to each of the target traffic packets generate threat log results.

[0163] Optionally, the building block is further used to:

[0164] Obtaining traffic packet information of the target attack traffic packet;

[0165] Adjusting the traffic packet information, decrypting the target attack traffic packet, and obtaining a decrypted attack traffic packet;

[0166] A network attack data set is constructed according to the features corresponding to the decrypted attack traffic packets.

[0167] The network attack dataset construction device provided by the present application adopts the network attack dataset construction method in the above embodiment to solve the technical problem of low efficiency in constructing the network attack dataset. Compared with the prior art, the beneficial effects of the network attack dataset construction device provided by the embodiment of the present application are the same as the beneficial effects of the network attack dataset construction method provided by the above embodiment, and the other technical features in the network attack dataset construction device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0168] Embodiment 6

[0169] An embodiment of the present application provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the network attack data set construction method in the above embodiment.

[0170] Reference below Figure 5 , which shows a schematic diagram of the structure of an electronic device suitable for implementing the embodiments of the present disclosure. The electronic device in the embodiments of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers PDA (Personal Digital Assistant), PAD (tablet computer), PMP (Portable Media Player), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 5 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0171] like Figure 5As shown, the electronic device may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a ROM (Read-Only Memory) or a program loaded from a storage device into a RAM (Random Access Memory). In the RAM, various programs and data required for the operation of the electronic device are also stored. The processing device, ROM, and RAM are connected to each other via a bus. An input / output (I / O) interface is also connected to the bus.

[0172] Typically, the following systems can be connected to the I / O interface: input devices including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices including, for example, a magnetic tape, a hard disk, etc.; and communication devices. The communication device can allow the electronic device to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows an electronic device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems may be implemented or have alternatively.

[0173] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processing device, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0174] The electronic device provided by the present application adopts the network attack data set construction method in the above embodiment to solve the technical problem of low efficiency in constructing the network attack data set. Compared with the prior art, the beneficial effects of the electronic device provided by the embodiment of the present application are the same as the beneficial effects of the network attack data set construction method provided by the above embodiment, and the other technical features in the electronic device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0175] It should be understood that the various parts of the present disclosure can be implemented with hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0176] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0177] Embodiment 7

[0178] This embodiment provides a computer-readable storage medium having computer-readable program instructions stored thereon, and the computer-readable program instructions are used to execute the method of constructing a network attack dataset in the above embodiment.

[0179] The computer-readable storage medium provided in the embodiment of the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, RAM, ROM, EPROM (Erasab l eProgrammab le Read On ly Memory, erasable programmable read-only memory) or flash memory, optical fiber, CD-ROM (compact disk read-on ly memory, portable compact disk read-only memory), optical storage device, magnetic storage device, or any suitable combination of the above. In the present embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency, radio frequency), etc., or any suitable combination of the above.

[0180] The computer-readable storage medium may be included in the electronic device, or may exist independently without being installed in the electronic device.

[0181] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by an electronic device, the electronic device: obtains a network attack traffic packet stored in a network simulation verification platform; determines the platform single-step attack log data corresponding to the network attack traffic packet, and determines a target attack traffic packet in the network attack traffic packet based on the platform single-step attack log data; and constructs a network attack data set based on the target attack traffic packet and the features corresponding to the target attack traffic packet.

[0182] The computer program code for performing the operation of the present disclosure can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer, partially on the remote computer, or completely on the remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a LAN (Local Area Network) or a WAN (Wi de Area Network, Wide Area Network), or can be connected to an external computer (e.g., using an Internet service provider to connect through the Internet).

[0183] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0184] The modules involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0185] The computer-readable storage medium provided by the present application stores computer-readable program instructions for executing the above-mentioned network attack dataset construction method, which solves the technical problem of low efficiency in constructing the network attack dataset. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the embodiment of the present application are the same as the beneficial effects of the network attack dataset construction method provided by the above-mentioned implementation, and will not be repeated here.

[0186] Embodiment 8

[0187] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned network attack data set construction method when executed by a processor.

[0188] The computer program product provided by the present application solves the technical problem of low efficiency in constructing a network attack dataset. Compared with the prior art, the beneficial effects of the computer program product provided by the embodiment of the present application are the same as the beneficial effects of the network attack dataset construction method provided by the above embodiment, which will not be repeated here.

[0189] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent processing scope of the present application.

Claims

1. A method for constructing a network attack dataset, characterized in that: The network attack data set construction method comprises: Acquire a network attack traffic packet stored in a network simulation verification platform, wherein the network attack traffic packet is a traffic packet stored in the network simulation verification platform and obtained from at least one source when the network simulation verification platform launches an attack on at least one organization or institution; Determine the platform single-step attack log data corresponding to the network attack traffic packet, and determine the traffic packet information corresponding to the network attack traffic packet according to the platform single-step attack log data, and select the target attack traffic packet from the network attack traffic packet according to the traffic packet information; Obtaining traffic packet information of the target attack traffic packet; Adjusting the traffic packet information, decrypting the target attack traffic packet, and obtaining a decrypted attack traffic packet; Constructing a network attack data set according to the features corresponding to the decrypted attack traffic packets; The network attack traffic packet includes at least one threat traffic packet, The step of obtaining the network attack traffic packet stored in the network simulation verification platform includes: Querying the network simulation verification platform to obtain at least one piece of threat traffic data; Each threat flow data is sliced ​​according to the attack behavior time corresponding to each threat flow data to obtain the threat flow packet.

2. The method for constructing a network attack dataset according to claim 1, characterized in that: The network attack traffic packet includes at least one threat traffic packet, the platform single-step attack log data includes the first single-step attack log data corresponding to the threat traffic packet, and the target attack traffic packet includes a target attack and defense activity traffic packet. The step of determining a target attack traffic packet in the network attack traffic packet according to the platform single-step attack log data comprises: Querying the first single-step attack log data to obtain the attack behavior type of each threat flow data in each threat flow packet after being merged by the network simulation verification platform; According to each of the attack behavior types, each threat flow data in each of the threat flow packets is sliced ​​to obtain at least one target attack and defense activity flow packet.

3. The method for constructing a network attack dataset according to claim 1, characterized in that: The network attack traffic packet includes at least one network tester traffic packet, the platform single-step attack log data includes second single-step attack log data corresponding to the network tester traffic packet, and the target attack traffic packet includes a target network tester traffic packet. The step of determining a target attack traffic packet in the network attack traffic packet according to the platform single-step attack log data comprises: Query the second single-step attack log data to obtain the fusion vulnerability information of each network tester flow packet after being fused by the network simulation verification platform; Performing vulnerability analysis on the traffic packets of each network tester to obtain analysis vulnerability information; A target network tester traffic packet that matches the fused vulnerability information and the analyzed vulnerability information is selected from each of the network tester traffic packets.

4. The method for constructing a network attack dataset according to claim 1, characterized in that: The network attack traffic packet includes at least one website attack traffic packet, and the platform single-step attack log data includes third single-step attack log data corresponding to the website attack traffic packet. The step of determining the platform single-step attack log data corresponding to the network attack traffic packet comprises: Taking the website attack traffic packets as target traffic packets, performing attack detection on each of the target traffic packets through the network simulation verification platform to obtain detection results; If the detection result is a threat log result, the platform single-step attack log data corresponding to the target traffic packet is used as the third single-step attack log data; If the detection result is that no threat log result is generated, the target traffic packet is retained through the network simulation verification platform.

5. The method for constructing a network attack dataset as claimed in claim 4, characterized in that: After the step of retaining the target traffic packet through the network simulation verification platform, the method further includes: After a preset time interval, the target traffic packet is updated to a traffic packet whose detection result is that no threat log result is generated in each of the website attack traffic packets; Return to executing the step of performing attack detection on each of the target traffic packets through the network simulation verification platform to obtain the detection result and subsequent steps, until the detection results corresponding to each of the target traffic packets generate threat log results.

6. A network attack data set construction device, characterized in that: The network attack data set construction device comprises: An acquisition module, used to acquire a network attack traffic packet stored in a network simulation verification platform, wherein the network attack traffic packet is a traffic packet stored in the network simulation verification platform and obtained from at least one source when the network simulation verification platform launches an attack on at least one organization or institution; A determination module, used to determine the platform single-step attack log data corresponding to the network attack traffic packet, and determine the traffic packet information corresponding to the network attack traffic packet according to the platform single-step attack log data, and screen the network attack traffic packet to obtain the target attack traffic packet according to the traffic packet information; A construction module is used to: obtain flow packet information of the target attack flow packet; Adjusting the traffic packet information, decrypting the target attack traffic packet, and obtaining a decrypted attack traffic packet; Constructing a network attack data set according to the features corresponding to the decrypted attack traffic packets; The network attack traffic packet includes at least one threat traffic packet, The acquisition module is further used for: Querying the network simulation verification platform to obtain at least one piece of threat traffic data; Each threat flow data is sliced ​​according to the attack behavior time corresponding to each threat flow data to obtain the threat flow packet.

7. An electronic device, characterized in that: The electronic device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the steps of the network attack dataset construction method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a program for implementing a method for constructing a network attack dataset, and the program for implementing a method for constructing a network attack dataset is executed by a processor to implement the steps of the method for constructing a network attack dataset as described in any one of claims 1 to 5.

Images