A network attack defense method, device, intrusion detection equipment, and storage medium.

Abstract

This application provides a network attack defense method, apparatus, intrusion detection device, and storage medium. Applied to an intrusion detection device, the device maintains multiple attack rules, each labeled with an attack chain tag. The attack chain tag indicates the attack chain to which the attack rule belongs. The method includes: performing intrusion detection on network traffic to determine a first attack rule that the network traffic has hit; the first attack rule is labeled with a target attack chain tag; querying at least one second attack rule labeled with the target attack chain tag from the multiple attack rules; sending the first and second attack rules belonging to the same attack chain to a firewall, so that the firewall performs attack defense according to a protection policy; the protection policy is generated based on the first and second attack rules. The firewall can also perform pre-defense against subsequent attack behaviors based on the attack rules associated with the attack chain, thereby improving the firewall's defense effectiveness.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to a network attack defense method, apparatus, intrusion detection device, and storage medium. Background Technology

[0002] Currently, in the linkage mechanism between intrusion detection and firewall blocking, firewalls often only block traffic based on the five-tuple information. However, in a real-world environment, if the attack source changes its IP address or port during the attack, the firewall may struggle to block the attack, resulting in less than ideal blocking effectiveness. Summary of the Invention

[0003] The purpose of this application is to provide a network attack defense method, apparatus, intrusion detection device, and storage medium to achieve the technical effect of improving the firewall defense effect.

[0004] The first aspect of this application provides a network attack defense method applied to an intrusion detection device. The intrusion detection device maintains multiple attack rules, each attack rule being labeled with an attack chain tag, the attack chain tag indicating the attack chain to which the attack rule belongs; the method includes:

[0005] Intrusion detection is performed on network traffic to determine the first attack rule that the network traffic is matched with; the first attack rule is labeled with a target attack chain tag.

[0006] From the multiple attack rules described, at least one second attack rule labeled with the target attack chain tag is retrieved;

[0007] The first attack rule and the second attack rule, which belong to the same attack chain, are sent to the firewall so that the firewall can perform attack defense according to the protection policy; the protection policy is generated based on the first attack rule and the second attack rule.

[0008] In the above implementation process, since the protection strategy is generated based on the first and second attack rules, the firewall can predict subsequent attack behaviors based on all attack rules in the protection strategy. Therefore, even if the attack source changes its IP address and port information during the subsequent attack, as long as the target traffic hits an attack rule in the protection strategy—that is, hits either the first or second attack rule—the firewall will block the target traffic, regardless of whether the target traffic corresponds to the malicious five-tuple information recorded by the firewall. Thus, the firewall no longer only blocks traffic based on the five-tuple information but can also pre-defend against subsequent attack behaviors based on the attack rules associated with the attack chain, thereby improving the firewall's defense effectiveness.

[0009] Furthermore, the network traffic is a first resolution request sent to a Domain Name System (DNS) server, the first resolution request carrying a suspicious domain name to be resolved; the first attack rule matched by the network traffic is a DNS query rule; the method further includes:

[0010] In response to capturing the first response traffic returned by the DNS server based on the first resolution request, the suspicious 5-tuple information carried in the first response traffic is obtained; wherein, the suspicious 5-tuple information is obtained by the DNS server after resolving the suspicious domain name;

[0011] The suspicious quintuple information is sent to the firewall; the protection policy is generated based on the first attack rule, the second attack rule and the suspicious quintuple information.

[0012] In the above implementation process, by incorporating the suspicious 5-tuple information resolved by the DNS server into the protection policy, subsequent target traffic corresponding to that suspicious 5-tuple information can be intercepted. This further improves the effectiveness of network security protection.

[0013] Furthermore, the method also includes:

[0014] In response to the failure of the first response traffic capture, the suspicious domain name is obtained from the first resolution request, and a second resolution request carrying the suspicious domain name is sent to the DNS server;

[0015] Receive the second response traffic returned by the DNS server based on the second resolution request;

[0016] The suspicious 5-tuple information carried in the second response traffic is obtained and sent to the firewall; the protection policy is generated based on the first attack rule, the second attack rule and the suspicious 5-tuple information.

[0017] In the above implementation process, when the first response traffic capture fails, the intrusion detection device, acting as a target machine, actively requests the DNS server to resolve the suspicious domain name carried in the first resolution request. This allows it to obtain the suspicious 5-tuple information corresponding to the suspicious domain name from the second response traffic returned by the DNS server. This suspicious 5-tuple information is then added to the protection policy, enabling the interception of subsequent target traffic corresponding to this suspicious 5-tuple information. This further improves the effectiveness of network security protection.

[0018] Furthermore, the method also includes:

[0019] The network traffic five-tuple information is obtained and sent to the firewall; the protection policy is generated based on the first attack rule, the second attack rule and the five-tuple information.

[0020] In the above implementation process, by adding the five-tuple information of the network traffic that hits the first attack rule to the protection policy, subsequent network traffic from the same IP address and port information as that network traffic can be intercepted, thereby blocking the attack source's attack behavior on the target.

[0021] Furthermore, the attack chain tag is generated through the following steps:

[0022] Identify all target attack rules belonging to the same attack chain from among the multiple attack rules described above;

[0023] Perform a hash operation on the rule number of all the aforementioned target attack rules to obtain a hash value;

[0024] The hash value is used as the attack chain label to mark all the target attack rules.

[0025] In the above implementation, the rule numbers of all target attack rules belonging to the same attack chain are hashed, and the resulting hash value serves as the attack chain label. All attack rules are then grouped according to the correlation effect of the attack chain methods using these attack chain labels. This achieves pre-defense against subsequent attack behaviors.

[0026] Furthermore, the firewall performs attack defense according to the protection policy, including:

[0027] Set the aging time for the protection strategy;

[0028] Before the aging time is reached, attack defense is carried out according to the protection strategy.

[0029] In the above implementation process, by setting an aging time for the protection policy, the firewall performs attack defense according to the protection policy within the aging time, thereby achieving network security protection. After the aging time is reached, the protection policy is deleted, thus saving storage space.

[0030] Furthermore, the intrusion detection of network traffic includes:

[0031] Analyze the traffic characteristics of the network traffic;

[0032] The traffic characteristics are matched with multiple attack rules, and the attack behavior of the network traffic is determined based on the first attack rule that is matched.

[0033] In the above implementation process, intrusion detection is performed by utilizing the traffic characteristics of network traffic. Based on the first attack rule that is hit, the specific attack behavior of the network traffic can be determined, thereby completing the detection of intrusion behavior and providing a reference for subsequent protection strategies.

[0034] Furthermore, the intrusion detection device is deployed in a bypass configuration or in series configuration within the network.

[0035] In the above implementation process, intrusion detection devices are deployed in the network in a bypass or in series, which improves the flexibility of intrusion detection device deployment in the network.

[0036] A second aspect of this application provides a network attack defense device applied to an intrusion detection device. The intrusion detection device maintains multiple attack rules, each attack rule being labeled with an attack chain tag, the attack chain tag indicating the attack chain to which the attack rule belongs; the device includes:

[0037] The detection module is used to perform intrusion detection on network traffic and determine the first attack rule that the network traffic is matched with; the first attack rule is labeled with a target attack chain tag.

[0038] The query module is used to query at least one second attack rule labeled with the target attack chain tag from multiple attack rules;

[0039] The sending module is used to send the first attack rule and the second attack rule belonging to the same attack chain to the firewall, so that the firewall can perform attack defense according to the protection policy; the protection policy is generated based on the first attack rule and the second attack rule.

[0040] A third aspect of this application provides an intrusion detection device, the device comprising:

[0041] processor;

[0042] Memory used to store processor-executable instructions;

[0043] Wherein, when the processor invokes the executable instructions, it implements the operation of any of the methods described in the first aspect.

[0044] A fourth aspect of this application provides a computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the steps of any of the methods described in the first aspect. Attached Figure Description

[0045] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0046] Figure 1A flowchart illustrating a network attack defense method provided in an embodiment of this application;

[0047] Figure 2 A flowchart illustrating another network attack defense method provided in this application embodiment;

[0048] Figure 3 A flowchart illustrating another network attack defense method provided in this application embodiment;

[0049] Figure 4 A flowchart illustrating another network attack defense method provided in this application embodiment;

[0050] Figure 5 A flowchart illustrating another network attack defense method provided in this application embodiment;

[0051] Figure 6 A flowchart illustrating another network attack defense method provided in this application embodiment;

[0052] Figure 7 A flowchart illustrating another network attack defense method provided in this application embodiment;

[0053] Figure 8 A structural block diagram of a network attack defense device provided in an embodiment of this application;

[0054] Figure 9 This is a hardware structure diagram of an intrusion detection device provided in an embodiment of this application. Detailed Implementation

[0055] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0056] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0057] Firewalls, as an access control technology, strictly control data entering and leaving the network boundary, serving as the first line of defense for network security. However, firewalls are a passive defense; they cannot block all intrusions or perform any operations on activities occurring within the network. As the second line of defense, Intrusion Detection Systems (IDS) monitor network traffic in real time through eavesdropping to determine if it contains malicious intent—a proactive defense approach. IDS can detect not only external attacks but also internal malicious activities. Therefore, IDS is a necessary complement to firewalls. The integration of IDS and firewalls creates a more complete network security solution.

[0058] Currently, the linkage between IDS and firewalls typically employs a dedicated response method. When the IDS detects an attack attempt in network data, it communicates with the firewall through an open interface. Both parties transmit network security events according to a fixed protocol. The firewall then generates a dynamic security policy based on the corresponding five-tuple information (source IP address, source port, destination IP address, destination port, and transport layer protocol) to block the attack source. This linkage combines the real-time response capability of the IDS with the static access control capability of the firewall, generating a dynamic security protection policy based on network activity to achieve network security protection.

[0059] In the coordinated blocking mechanism of IDS and firewalls, the firewall often blocks traffic based solely on the five-tuple information. That is, if the firewall records malicious five-tuple information, it will block traffic corresponding to that malicious five-tuple. However, in a real-world environment, if the attack source changes its IP address or port during the attack, the firewall may struggle to block the attack, resulting in less than ideal blocking effectiveness.

[0060] Therefore, this application proposes a network attack defense method applied to intrusion detection equipment. The intrusion detection equipment can be an electronic device equipped with the aforementioned intrusion detection system.

[0061] Intrusion detection devices maintain multiple attack rules. For example, an intrusion detection device may maintain a rule base, which includes multiple attack rules.

[0062] In this application, each attack rule is labeled with an attack chain tag, which is used to indicate the attack chain to which the attack rule belongs.

[0063] Thus, the network attack defense method provided in this application includes, as follows: Figure 1 The steps shown are as follows:

[0064] Step 110: Perform intrusion detection on the network traffic to determine the first attack rule that the network traffic has been hit by;

[0065] The first attack rule is labeled with a target attack chain tag;

[0066] Step 120: Query at least one second attack rule labeled with the target attack chain tag from among the multiple attack rules;

[0067] Step 130: Send the first attack rule and the second attack rule belonging to the same attack chain to the firewall so that the firewall can perform attack defense according to the protection policy;

[0068] The protection strategy is generated based on the first attack rule and the second attack rule.

[0069] Attacks on a network are not singular; an attack source may launch multiple different attacks against a target. These attacks form an attack chain, meaning an attack chain consists of attacks that occur sequentially. Alternatively, an attack source typically launches attacks on the target one by one, following the actions within the attack chain.

[0070] As an example, in a Trojan control attack, a complete attack chain consists of DNS lookup, Trojan going online, starting mining, downloading malicious components, and mining pool response. The attack source initiates these attack behaviors step by step according to this attack chain to control the target.

[0071] Thus, once an intrusion detection device detects an attack, it may detect the next stage of the attack chain within a certain timeframe. For example, in the above scenario, if the intrusion detection device detects that a Trojan has been launched, it may then detect the start of a mining attack some time later.

[0072] Given that cyberattacks often occur in the form of attack chains, this application proposes a method for associating multiple attack rules maintained by intrusion detection devices according to attack chains. Specifically, attack rules are labeled with attack chain tags based on the attack chain they belong to. Of course, an attack rule may belong to multiple attack chains, thus potentially having multiple attack chain tags. Based on the attack chain tags assigned to the attack rules, all attack rules belonging to the same attack chain can be identified among all attack chain rules.

[0073] Thus, when an intrusion detection device performs intrusion detection on captured network traffic and determines that the network traffic has matched the first attack rule among multiple attack rules, it can search for all second attack rules labeled with the target attack chain tag carried by the first attack rule. It can be understood that the attack rule matched by the network traffic is the first attack rule, and the attack chain tag on the first attack rule is the target attack chain tag. Among all attack rules, those other than the first attack rule that also bear the target attack chain tag are the second attack rules. There can be one or more second attack rules. Therefore, since both the first and second attack rules are labeled with the target attack chain tag, they belong to the same attack chain.

[0074] Subsequently, the intrusion detection device can send the first attack rule and the second attack rule to the firewall, enabling the firewall to defend against the attack according to the protection policy. The protection policy is generated based on the first and second attack rules.

[0075] For example, an intrusion device can transmit a first attack rule and a second attack rule according to a fixed protocol through an interface with a firewall.

[0076] Optionally, the intrusion detection device can generate a protection policy based on the first attack rule and the second attack rule, and send the protection policy to the firewall so that the firewall can defend against attacks according to the protection policy. In this way, the first attack rule and the second attack rule are sent to the firewall along with the protection policy.

[0077] Optionally, the intrusion device can directly send the first attack rule and the second attack rule to the firewall, and then the firewall can generate a protection policy based on the first attack rule and the second attack rule, and use the protection policy to defend against the attack.

[0078] This application provides a network attack defense method. Since the protection strategy is generated based on a first attack rule and a second attack rule, the firewall can predict subsequent attack behaviors based on all attack rules in the protection strategy. Therefore, even if the attack source changes its IP address and port information during the subsequent attack, as long as the target traffic hits an attack rule in the protection strategy—that is, hits either the first or second attack rule—the firewall will block the target traffic, regardless of whether the target traffic corresponds to the malicious five-tuple information recorded by the firewall. Thus, the firewall no longer only blocks traffic based on the five-tuple information but can also pre-defend against subsequent attack behaviors based on the attack rules associated with the attack chain, thereby improving the firewall's defense effectiveness.

[0079] Regarding the deployment method of intrusion detection devices, in some embodiments, the intrusion detection devices are deployed in series in the network. That is, the intrusion detection devices are deployed in the network traffic transmission link, and the network traffic flows through the intrusion detection devices as it is sent to the target network device.

[0080] In other embodiments, the intrusion detection device is deployed in a bypass configuration within the network. That is, the intrusion detection device is not deployed in the network traffic transmission link, but rather captures mirrored network traffic through a mirroring configuration on a switch.

[0081] Understandably, if the captured network traffic does not match the attack rules maintained by the intrusion detection device, it can be determined that the network traffic is safe and allowed to be transmitted to the next network node.

[0082] If the captured network traffic matches the first attack rule, it indicates that the network traffic may be suspicious and potentially involved in an attack. This network traffic may be transmitted between the attack source and the attack target. To block the transmission of traffic between the attack source and the attack target, in some embodiments, the method further includes the step of: obtaining the five-tuple information of the network traffic and sending the five-tuple information to the firewall. The protection policy is generated based on the first attack rule, the second attack rule, and the five-tuple information.

[0083] For example, the five-tuple information of network traffic can be sent to the firewall along with the first attack rule and the second attack rule mentioned above.

[0084] For example, a protection policy can be generated based on the first attack rule, the second attack rule, and the five-tuple information, and then the protection policy can be sent to the firewall.

[0085] For example, the first attack rule, the second attack rule, and the five-tuple information can be sent to the firewall, and then the firewall can generate a protection policy based on the first attack rule, the second attack rule, and the five-tuple information.

[0086] Thus, when the firewall detects target traffic that matches the protection policy, that is, target traffic that hits any one of the first attack rule, the second attack rule, or the five-tuple information in the protection policy, it will block the target traffic, thereby achieving the effect of network security protection.

[0087] In this embodiment, by adding the five-tuple information of the network traffic that hits the first attack rule to the protection policy, subsequent network traffic from the same IP address and port information as the network traffic can be intercepted, thereby blocking the attack source's attack behavior on the target.

[0088] Regarding intrusion detection, network traffic exhibits several traffic characteristics. These characteristics can be used to determine the corresponding attack behavior. Therefore, step 110 above may include, for example... Figure 2 The steps shown are as follows:

[0089] Step 111: Analyze the traffic characteristics of the network traffic;

[0090] Step 112: Match the traffic characteristics with multiple attack rules, and determine the attack behavior of the network traffic based on the first attack rule that is matched.

[0091] For example, after capturing network traffic, the intrusion detection device first establishes a connection on the connection table and parses the application-layer traffic within the network traffic. Then, by employing deep attack detection technology, it accurately detects intrusion behaviors in the network, matching the parsed traffic characteristics with multiple attack rules. Based on the first matched attack rule, it obtains the actual attack behavior. As examples, attack behaviors may include, but are not limited to, brute-force attacks, SQL (Structured Query Language) injection, and cryptocurrency mining attacks.

[0092] In this embodiment, intrusion detection is performed using the traffic characteristics of network traffic. Based on the first attack rule that is hit, the specific attack behavior of the network traffic can be determined, thereby completing the detection of intrusion behavior and providing a reference for subsequent protection strategies.

[0093] Regarding attack chain tags, in some embodiments, the attack chain generation process includes, for example: Figure 3 The steps shown are as follows:

[0094] Step 310: Identify all target attack rules belonging to the same attack chain from the multiple attack rules described above;

[0095] Step 320: Perform a hash operation on the rule number of all the target attack rules to obtain the hash value;

[0096] Step 330: Label all the target attack rules with the hash value as the attack chain tag.

[0097] First, based on historical attack experience, select all target attack rules belonging to the same attack chain from all attack rules.

[0098] Optionally, target attack rules can be manually selected; alternatively, target attack rules can be automatically selected using technologies such as deep learning.

[0099] Each attack rule has a corresponding rule number, which uniquely identifies the attack rule. A hash value can be obtained by hashing the rule numbers of all target attack rules.

[0100] For example, the rule numbers of all target attack rules belonging to the same attack chain can be combined in a preset order, and the combination can be hashed to obtain the hash value as the attack chain label corresponding to the attack chain.

[0101] For example, attack chain tags can be pre-generated and assigned to each target attack rule. In this way, once it is determined that network traffic hits the first attack rule, the second attack rule can be found directly based on the attack chain tags marked on the first attack rule.

[0102] Optionally, an attack rule belongs to an attack chain, and thus the attack rule is labeled with an attack chain tag.

[0103] Optionally, an attack rule may belong to multiple attack chains at the same time, thus the attack rule may be labeled with multiple attack chain tags.

[0104] If the first attack rule is labeled with multiple attack chain tags, then all second attack rules corresponding to the multiple attack chain tags will be sent to the firewall.

[0105] In this embodiment, the rule numbers of all target attack rules belonging to the same attack chain are hashed, and the resulting hash value is used as the attack chain label. All attack rules are then grouped according to the correlation effect of the attack chain methods using these attack chain labels. This achieves pre-defense against subsequent attack behaviors.

[0106] In some scenarios, network devices may request access to malicious websites for various reasons. For example, a malicious website might impersonate another website to lure users. In this case, the network device will request a DNS (Domain Name System) server to resolve the domain name of the malicious website and obtain its IP address. In such situations, the network traffic captured by the intrusion detection device represents the first resolution request sent by the network device to the DNS server. This first resolution request carries the suspicious domain name to be resolved. The network traffic, i.e., the first resolution request, matches the first attack rule, which is a DNS query rule. In response to the first resolution request, the DNS server resolves the suspicious domain name carried in the request, obtaining the suspicious IP address corresponding to the suspicious domain name. Subsequently, the DNS server returns a first response traffic to the network device. This first response traffic carries suspicious 5-tuple information. As an example, the suspicious 5-tuple information includes at least the aforementioned suspicious IP address.

[0107] Thus, in the embodiments, the above method further includes, for example, Figure 4 The steps shown are as follows:

[0108] Step 411: In response to capturing the first response traffic returned by the DNS server based on the first resolution request, obtain the suspicious 5-tuple information carried in the first response traffic;

[0109] The suspicious 5-tuple information is obtained by the DNS server after resolving the suspicious domain name;

[0110] Step 412: Send the suspicious 5-tuple information to the firewall; the protection policy is generated based on the first attack rule, the second attack rule and the suspicious 5-tuple information.

[0111] The intrusion detection device captures the first response traffic returned by the DNS server and extracts suspicious 5-tuple information, such as suspicious IP addresses. This suspicious 5-tuple information is then sent to the firewall.

[0112] For example, suspicious five-tuple information can be sent to the firewall along with the first attack rule and the second attack rule mentioned above.

[0113] For example, a protection policy can be generated based on the first attack rule, the second attack rule, and the suspicious five-tuple information, and then the protection policy can be sent to the firewall.

[0114] For example, the first attack rule, the second attack rule, and the suspicious five-tuple information can be sent to the firewall, and then the firewall can generate a protection policy based on the first attack rule, the second attack rule, and the suspicious five-tuple information.

[0115] Thus, when the firewall detects target traffic that matches the protection policy, that is, target traffic that hits any one of the first attack rule, the second attack rule, or the suspicious five-tuple information in the protection policy, it will block the target traffic, thereby achieving the effect of network security protection.

[0116] In this embodiment, by incorporating the suspicious 5-tuple information resolved by the DNS server into the protection policy, subsequent target traffic corresponding to the suspicious 5-tuple information can be intercepted. This further improves the effectiveness of network security protection.

[0117] Furthermore, in some embodiments, the above method further includes, for example, Figure 5 The steps shown are as follows:

[0118] Step 421: In response to the failure of the first response traffic capture, obtain the suspicious domain name from the first resolution request, and send a second resolution request carrying the suspicious domain name to the DNS server;

[0119] Step 422: Receive the second response traffic returned by the DNS server based on the second resolution request;

[0120] Step 423: Obtain the suspicious 5-tuple information carried in the second response traffic, and send the suspicious 5-tuple information to the firewall;

[0121] The protection strategy is generated based on the first attack rule, the second attack rule, and the suspicious quintuple information.

[0122] Optionally, before performing steps 421-423, the intrusion detection device may first check whether it is connected to the network. Steps 421-423 are then performed if the intrusion detection device is connected to the network.

[0123] As mentioned above, intrusion detection devices (IDDs) can be deployed in series or in a bypass configuration within a network. When an ICD is deployed in a bypass configuration, it may fail to capture network traffic. Therefore, in some cases, if the ICD fails to capture the first response traffic returned by the DNS server (i.e., it cannot obtain suspicious 5-tuple information from the first response traffic), the ICD, acting as a target machine, will actively connect to the attack source corresponding to the suspicious domain name and attempt to obtain the suspicious 5-tuple information by executing steps 421-423 above.

[0124] Specifically, a suspicious domain name is obtained from the first resolution request sent by the network device to the DNS server, and then a second resolution request carrying the suspicious domain name is sent to the DNS server.

[0125] In response to the second resolution request, the DNS server resolves the suspicious domain name carried in the second resolution request, obtaining the suspicious IP address corresponding to the suspicious domain name. Subsequently, the DNS server returns a second response traffic to the intrusion detection device. This second response traffic carries suspicious 5-tuple information. As an example, the suspicious 5-tuple information includes at least the aforementioned suspicious IP address.

[0126] In this way, the intrusion detection device can obtain suspicious 5-tuple information from the second response traffic and send the suspicious 5-tuple information to the firewall.

[0127] Understandably, the first DNS resolution request is sent from the network device to the DNS server, and therefore the first response traffic based on this request will be fed back to the network device. During this process, due to various reasons such as the intrusion detection device's bypass deployment, the intrusion detection device may fail to capture the first response traffic. The second DNS resolution request is sent from the intrusion detection device to the DNS server, and therefore the second response traffic based on this request will be fed back to the intrusion detection device. Thus, the second response traffic is sent directly from the DNS server to the intrusion detection device, rather than being captured by the intrusion detection device from other transmission links. Under normal circumstances, the intrusion detection device can receive the second response traffic. In other words, the probability of the intrusion detection device obtaining the second response traffic is greater than the probability of obtaining the first response traffic.

[0128] As can be seen in this embodiment, when the first response traffic capture fails, the intrusion detection device, acting as the target machine, actively requests the DNS server to resolve the suspicious domain name carried in the first resolution request. This allows it to obtain the suspicious 5-tuple information corresponding to the suspicious domain name from the second response traffic returned by the DNS server. By adding this suspicious 5-tuple information to the protection strategy, subsequent target traffic corresponding to this suspicious 5-tuple information can be intercepted, further improving the network security protection effect.

[0129] As mentioned above, cyberattacks often occur in the form of attack chains, where the attack source typically launches attacks on the target one step at a time, following the attack behaviors in the chain. Generally, the attack chain initiated by the attack source against the target is completed within a certain timeframe. Therefore, the protection policies in firewalls can be configured with a certain lifespan.

[0130] Thus, step 130 above, in which the firewall defends against attacks according to the protection policy, may include, for example: Figure 6 The steps shown are as follows:

[0131] Step 131: Set the aging time for the protection strategy;

[0132] Step 132: Before the aging time is reached, perform attack defense according to the protection strategy.

[0133] Optionally, if the protection policy is generated by the intrusion detection device, the aging time of the protection policy can be set by the intrusion detection device. Alternatively, after the intrusion detection device sends the protection policy to the firewall, the firewall sets the aging time of the protection policy.

[0134] Optionally, if the protection policy is generated by the firewall, the aging time of the protection policy can be set by the firewall.

[0135] Before the aging period expires, the firewall defends against attacks according to the protection policy. When the aging period is reached, the firewall can delete the protection policy to save storage space.

[0136] The aging time can be set by those skilled in the art according to actual needs. The aging time is related to the implementation duration of the attack chain. Different attack chains may have different implementation durations. Therefore, for protection strategies targeting different attack chains, the aging time can be determined based on the implementation duration of that attack chain. Generally, as an example, the aging time can be set to 600 seconds.

[0137] In this embodiment, by setting an aging time for the protection policy, the firewall performs attack defense according to the protection policy within the aging time, thereby achieving network security protection. After the aging time is reached, the protection policy is deleted, thereby saving storage space.

[0138] In addition, this application also provides a network attack defense method, such as Figure 7 As shown, the intrusion device first captures network traffic and matches it against attack rules (step 701). If the network traffic does not match any attack rules, it is determined to be safe traffic; if the network traffic matches the first attack rule, it is determined to be suspicious traffic.

[0139] If the network traffic hits the first attack rule, and the hit first attack rule is a DNS query rule (step 702), it means that the network traffic is the first resolution request sent by the network device to the DNS server. The first resolution request carries a suspicious domain name. At this time, the intrusion detection device can capture the first response traffic returned by the DNS server to the network device based on the first resolution request (step 703). The first response traffic carries suspicious 5-tuple information corresponding to the suspicious domain name, such as a suspicious IP address.

[0140] If the first response traffic capture is successful, the intrusion detection device can obtain target information such as suspicious IP addresses and suspicious domain names from the first response traffic (step 704). If the first response traffic capture fails, the intrusion detection device checks whether the local machine is connected to the internet (step 705).

[0141] If the intrusion detection device is already connected to the network, it actively connects to the attack source as a target machine (step 706). Specifically, it can obtain a suspicious domain name from the first DNS resolution request and send a second DNS resolution request to the DNS server, carrying the suspicious domain name obtained from the first DNS resolution request. Then, it receives the second response traffic returned by the DNS server to the intrusion detection device based on the second DNS resolution request. It then obtains target information such as suspicious IP addresses and ports from the second response traffic (step 707).

[0142] Subsequently, based on the target attack chain tag carried by the first attack rule, a second attack rule carrying the same target attack chain tag is searched (step 708). The target information, the first attack rule, and the second attack rule are then sent to the firewall (step 709). The firewall implements defense based on the protection strategy determined by the target information, the first attack rule, and the second attack rule (step 710).

[0143] If the intrusion detection device is not connected to the network, or if the first attack rule detected is not a DNS lookup rule, the second attack rule is directly searched based on the target attack chain tag. Both the first and second attack rules are then sent to the firewall, and the protection policy is generated based on these two attack rules.

[0144] Furthermore, the operation of obtaining target information from the first response traffic and the operation of finding the second attack rule can be executed by different threads; the operation of the intrusion device actively connecting to the attack source as a target machine and the operation of finding the second attack rule can be executed by different threads to improve execution efficiency.

[0145] Continuing with the Trojan control attack example described above, a complete attack chain consists of DNS lookup, Trojan going online, starting mining, downloading malicious components, and mining pool response. When an intrusion detection device (IDD) detects a Trojan domain attack, it records the suspicious domain, captures the response packet returned by the DNS server, and obtains information such as suspicious IP addresses from the response packet. If the IMD fails to capture the response packet, the management port of a networked IMD will actively connect to the suspicious domain and obtain the suspicious IP address from the response packet returned by the DNS server. The rule matched in this process is the DNS lookup. Based on the attack chain tag marked by the DNS lookup rule, a query is performed in the rule base to obtain rules with the same attack chain tag, including Trojan going online rules, starting mining rules, downloading malicious components rules, and mining pool response rules. Finally, these associated rules, along with the obtained suspicious IP addresses, suspicious domains, protocols, etc., are sent to the firewall, where a dynamic protection policy is established to block the attack.

[0146] Based on the network attack defense method provided in any of the above embodiments, this application also provides a network attack defense device applied to an intrusion detection device. The intrusion detection device maintains multiple attack rules, each attack rule being labeled with an attack chain tag. The attack chain tag is used to indicate the attack chain to which the attack rule belongs. For example... Figure 8 As shown, the network attack defense device 800 includes:

[0147] The detection module 810 is used to perform intrusion detection on network traffic and determine the first attack rule that the network traffic is matched with; the first attack rule is labeled with a target attack chain tag.

[0148] The query module 820 is used to query at least one second attack rule labeled with the target attack chain tag from among the multiple attack rules;

[0149] The sending module 830 is used to send the first attack rule and the second attack rule belonging to the same attack chain to the firewall, so that the firewall can perform attack defense according to the protection policy; the protection policy is generated based on the first attack rule and the second attack rule.

[0150] In some embodiments, the network traffic is a first resolution request sent to a Domain Name System (DNS) server, the first resolution request carrying a suspicious domain name to be resolved; the first attack rule hit by the network traffic is a DNS query rule; the device 800 further includes:

[0151] The acquisition module is configured to, in response to capturing the first response traffic returned by the DNS server based on the first resolution request, acquire suspicious 5-tuple information carried in the first response traffic; wherein, the suspicious 5-tuple information is obtained by the DNS server after resolving the suspicious domain name;

[0152] The sending module 830 is also used to send the suspicious five-tuple information to the firewall; the protection policy is generated based on the first attack rule, the second attack rule and the suspicious five-tuple information.

[0153] In some embodiments, the acquisition module is further configured to, in response to the failure of the first response traffic capture, acquire the suspicious domain name from the first resolution request and send a second resolution request carrying the suspicious domain name to the DNS server;

[0154] Device 800 also includes:

[0155] The receiving module is configured to receive the second response traffic returned by the DNS server based on the second resolution request;

[0156] The sending module 830 is further configured to obtain the suspicious five-tuple information carried in the second response traffic and send the suspicious five-tuple information to the firewall; the protection policy is generated based on the first attack rule, the second attack rule and the suspicious five-tuple information.

[0157] In some embodiments, the acquisition module is further configured to: acquire the five-tuple information of the network traffic, and send the five-tuple information to the firewall; the protection policy is generated based on the first attack rule, the second attack rule and the five-tuple information.

[0158] In some embodiments, the attack chain tag is generated through the following steps:

[0159] Identify all target attack rules belonging to the same attack chain from among the multiple attack rules described above;

[0160] Perform a hash operation on the rule number of all the aforementioned target attack rules to obtain a hash value;

[0161] The hash value is used as the attack chain label to mark all the target attack rules.

[0162] In some embodiments, the firewall performs attack defense according to a protection policy, including:

[0163] Set the aging time for the protection strategy;

[0164] Before the aging time is reached, attack defense is carried out according to the protection strategy.

[0165] In some embodiments, the detection module 810 is specifically used for:

[0166] Analyze the traffic characteristics of the network traffic;

[0167] The traffic characteristics are matched with multiple attack rules, and the attack behavior of the network traffic is determined based on the first attack rule that is matched.

[0168] In some embodiments, the intrusion detection device is deployed in a bypass or in series within the network.

[0169] The specific implementation process of the functions and roles of each module in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0170] Based on the network attack defense method described in any of the above embodiments, this application also provides, as well as... Figure 9 The diagram shows the structure of an intrusion detection device. Figure 9 At the hardware level, the intrusion detection device includes a processor, an internal bus, a network interface, memory, and non-volatile storage, and may also include other hardware required for business operations. The processor reads the corresponding computer program from the non-volatile storage into memory and then runs it to implement a network attack defense method as described in any of the above embodiments.

[0171] This application also provides a computer storage medium storing a computer program, which, when executed by a processor, can be used to perform a network attack defense method described in any of the above embodiments.

[0172] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0173] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0174] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0175] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0176] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0177] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A network attack defense method characterized by, The method is applied to an intrusion detection device, which maintains multiple attack rules, each of which is labeled with an attack chain tag, the attack chain tag indicating the attack chain to which the attack rule belongs; the method includes: Intrusion detection is performed on network traffic to determine the first attack rule that the network traffic is matched with; the first attack rule is labeled with a target attack chain tag. From the multiple attack rules described, at least one second attack rule labeled with the target attack chain tag is retrieved; The first attack rule and the second attack rule, which belong to the same attack chain, are sent to the firewall so that the firewall can perform attack defense according to the protection policy; the protection policy is generated based on the first attack rule and the second attack rule. The network traffic is a first resolution request sent to a Domain Name System (DNS) server, and the first resolution request carries a suspicious domain name to be resolved; the first attack rule matched by the network traffic is a DNS query rule; the method further includes: In response to capturing the first response traffic returned by the DNS server based on the first resolution request, the suspicious 5-tuple information carried in the first response traffic is obtained; wherein, the suspicious 5-tuple information is obtained by the DNS server after resolving the suspicious domain name; The suspicious quintuple information is sent to the firewall; the protection policy is generated based on the first attack rule, the second attack rule and the suspicious quintuple information.

2. The method of claim 1, wherein, The method further includes: In response to the failure of the first response traffic capture, the suspicious domain name is obtained from the first resolution request, and a second resolution request carrying the suspicious domain name is sent to the DNS server; Receive the second response traffic returned by the DNS server based on the second resolution request; The suspicious 5-tuple information carried in the second response traffic is obtained and sent to the firewall; the protection policy is generated based on the first attack rule, the second attack rule and the suspicious 5-tuple information.

3. The method of claim 1, wherein, The method further includes: The network traffic five-tuple information is obtained and sent to the firewall; the protection policy is generated based on the first attack rule, the second attack rule and the five-tuple information.

4. The method of claim 1, wherein, The attack chain tag is generated through the following steps: Identify all target attack rules belonging to the same attack chain from among the multiple attack rules described above; Perform a hash operation on the rule number of all the aforementioned target attack rules to obtain a hash value; The hash value is used as the attack chain label to mark all the target attack rules.

5. The method of claim 1, wherein, The firewall performs attack defense according to the protection policy, including: Set the aging time for the protection strategy; Before the aging time is reached, attack defense is carried out according to the protection strategy.

6. The method of claim 1, wherein, The intrusion detection of network traffic includes: Analyze the traffic characteristics of the network traffic; The traffic characteristics are matched with multiple attack rules, and the attack behavior of the network traffic is determined based on the first attack rule that is matched.

7. The method of claim 1, wherein, The intrusion detection equipment is deployed in a bypass or in series within the network.

8. A cyber attack defense apparatus characterized by comprising: An intrusion detection device is used to maintain multiple attack rules, each of which is labeled with an attack chain tag, the attack chain tag indicating the attack chain to which the attack rule belongs; the device includes: The detection module is used to perform intrusion detection on network traffic and determine the first attack rule that the network traffic is matched with; the first attack rule is labeled with a target attack chain tag. The query module is used to query at least one second attack rule labeled with the target attack chain tag from multiple attack rules; The sending module is used to send the first attack rule and the second attack rule belonging to the same attack chain to the firewall, so that the firewall can perform attack defense according to the protection policy; the protection policy is generated based on the first attack rule and the second attack rule. The network traffic is a first resolution request sent to a Domain Name System (DNS) server, and the first resolution request carries a suspicious domain name to be resolved; the first attack rule matched by the network traffic is a DNS query rule; the device further includes: The acquisition module is configured to, in response to capturing the first response traffic returned by the DNS server based on the first resolution request, acquire suspicious 5-tuple information carried in the first response traffic; wherein, the suspicious 5-tuple information is obtained by the DNS server after resolving the suspicious domain name; The sending module is also used to send the suspicious 5-tuple information to the firewall; the protection policy is generated based on the first attack rule, the second attack rule and the suspicious 5-tuple information.

9. An intrusion detection device, characterized by The device includes: processor; Memory used to store processor-executable instructions; Wherein, when the processor invokes the executable instructions, it implements the operation of any one of the methods described in claims 1-7.

10. A computer-readable storage medium, characterized in that, It stores computer instructions that, when executed by a processor, implement the steps of the method according to any one of claims 1-7.

Images