Method for determining network attack, electronic device and computer readable storage medium
By constructing an attack result determination expression environment, loading pre-configured expressions, and analyzing attack alarm data, the problem of low determination efficiency in existing technologies is solved, enabling rapid identification of fatal attack alarms and reducing manpower costs.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- 南京中孚信息技术有限公司
- Filing Date
- 2022-11-21
- Publication Date
- 2026-05-19
AI Technical Summary
In existing technologies, network attack detection methods struggle to quickly identify critical attack alerts, resulting in low efficiency and high manpower costs when dealing with a massive number of alerts.
The system constructs an environment for determining attack results using expressions, loads pre-configured expressions, and transmits key information from network data associated with attack alerts. It then obtains attack determination results through expression analysis and supports dynamic editing and updating of expressions to meet preset conditions.
It enables the rapid identification of critical attack alerts from a massive number of attack alerts, improving judgment efficiency and reducing manpower costs.
Smart Images
Figure CN116155530B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security, and more specifically, to a method for determining network attacks, an electronic device, and a computer-readable storage medium. Background Technology
[0002] In the field of cybersecurity, inadequate network defense can lead to unpredictable losses. In today's era of rapid internet penetration and development, cyberattacks are becoming increasingly diverse and frequent, making effective cybersecurity work particularly crucial.
[0003] Currently, network intrusion detection systems (NIDS) and network threat detection and response (NDR) are commonly used as monitoring devices. Specifically, security personnel first write signature codes or regular expressions, and then use these signature codes or regular expressions to match incoming network traffic packets. If a match is found, an attack alert is generated.
[0004] However, existing methods can only identify attacks through the built-in rules of monitoring equipment manufacturers or determine attack results through more complex association rules, and their rule syntax is closed. Therefore, in existing methods, it is difficult for judges to adjust the judgment strategy for attack results, making it impossible to quickly identify critical attack alerts when faced with a large number of attack alerts. Summary of the Invention
[0005] The purpose of this invention is to address the shortcomings of the prior art by providing a method, electronic device, and computer-readable storage medium for determining network attacks. This method can quickly identify critical attack alerts from a large number of attack alerts, improve the efficiency of the determination process, and effectively reduce the cost of manual determination.
[0006] To achieve the above objectives, the embodiments of this application adopt the following technical solutions:
[0007] Firstly, embodiments of this application provide a method for determining network attacks, the method comprising:
[0008] Load the pre-configured expression and pass it to the attack result determination expression environment, which includes: pre-injected types and methods defined according to the syntax;
[0009] Pass key information from attack alerts and associated network data to the attack result determination expression environment;
[0010] An attack result determination expression environment is used to analyze key information based on the expression and obtain the attack determination result.
[0011] Optionally, before passing key information about the attack alert-related network data to the attack result determination expression environment, the following may also be included:
[0012] Extract attack alert-related network data from the network device's database;
[0013] Extract key information from the network data associated with the attack alert. The key information includes at least one of the following: time, request header, request body, attack payload, and time, response status code, and response body in the response.
[0014] Optionally, key information can be extracted from the network data associated with the attack alerts, including:
[0015] Retrieve request and response data from network data associated with attack alerts;
[0016] The request and response data are parsed according to a preset protocol that associates attack alerts with network data to extract key information.
[0017] Optionally, the method of passing key information of the attack alert-related network data to the attack result determination expression environment includes:
[0018] Pass key information as variables to the attack result determination expression environment;
[0019] Using an attack result determination expression environment, key information is analyzed based on the expression to obtain the attack determination result, including:
[0020] An attack result determination expression environment is used to analyze the received variables and expressions and obtain the attack determination result.
[0021] Optionally, after using an attack result determination expression environment to analyze key information based on the expression and obtain the attack determination result, the process also includes:
[0022] If the alarm from the attack determination result does not meet the preset conditions, receive editing information for the expression;
[0023] Update the expression based on the edit information.
[0024] Optionally, an attack result determination expression environment is used to analyze key information based on the expression and obtain the attack determination result, including:
[0025] Based on key information, filter the corresponding target expressions in the attack result determination expression environment;
[0026] Lexical and syntactic analysis are performed on the target expression to generate bytecode and obtain the loaded expression.
[0027] The key information is used as variables in the loaded expression to calculate and obtain the attack determination result.
[0028] Optionally, extracting key information from attack alert-related network data may also include:
[0029] The request and response data are parsed according to a preset protocol for attack alarm-related network data to obtain the IP address of the attacking network as supplementary information for the attack determination result.
[0030] Optionally, the method further includes:
[0031] Obtain host process tree information associated with attack alerts;
[0032] Obtain key host information based on host process tree information, including: processes and process commands;
[0033] Based on the key host information, the attack determination result of the host is determined.
[0034] Secondly, embodiments of this application also provide an electronic device including: a processor and a memory, the memory storing machine-readable instructions executable by the processor, wherein when the electronic device is running, the processor executes the machine-readable instructions to perform the method steps as described in the first aspect above.
[0035] Thirdly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the method steps described in the first aspect above.
[0036] Fourthly, embodiments of this application also provide a device for determining network attacks, including:
[0037] The loading module is used to load pre-configured expressions and pass them to the attack result determination expression environment, which includes pre-injected types and methods defined according to syntax.
[0038] The sending module is used to pass key information of the attack alarm associated network data to the attack result determination expression environment.
[0039] The analysis module is used to analyze key information based on the attack result determination expression environment and obtain the attack determination result.
[0040] Optionally, the device further includes:
[0041] The extraction module is used to extract attack alarm-related network data from the network device's database; and to extract key information from the attack alarm-related network data, including at least one of the following: time, request header, request body, attack payload, and time, response status code, and response body in the response.
[0042] Optionally, the extraction module is specifically used to obtain request data and response data from the attack alarm associated network data; and to parse the request data and response data according to a preset protocol of the attack alarm associated network data to extract key information.
[0043] Optionally, the sending module is specifically used to pass key information as variables to the attack result determination expression environment;
[0044] The analysis module is specifically used to analyze the received variables and expressions using the attack result determination expression environment to obtain the attack determination result.
[0045] Optionally, the device further includes:
[0046] An update module is used to receive editing information for the expression if the alarm of the attack determination result does not meet the preset conditions; and to update the expression according to the editing information.
[0047] Optionally, the analysis module is specifically used to filter the corresponding target expression in the attack result determination expression environment based on key information; perform lexical and syntactic analysis on the target expression to generate bytecode and obtain the loaded expression; and use the key information as variables of the loaded expression to calculate and obtain the attack determination result.
[0048] Optionally, the analysis module is further configured to parse the request data and the response data according to a preset protocol of the attack alarm associated network data, and obtain the IP address of the attacking network as supplementary information for the attack determination result.
[0049] Optionally, the analysis module is further configured to obtain host process tree information associated with attack alarm host data; obtain key host information based on the host process tree information, wherein the key host information includes: processes and process commands; and determine the attack judgment result of the host based on the key host information.
[0050] The beneficial effects of the embodiments of the present invention are:
[0051] The network attack determination method provided in this application includes an attack result determination expression environment comprising: pre-injected types and methods defined by syntax; loading and passing pre-configured expressions to the attack result determination expression environment; and passing key information of attack alarm-related network data to the attack result determination expression environment. The attack result determination expression environment analyzes the key information based on the expressions to obtain the attack determination result. By passing key information of attack alarm-related network data to the attack result determination expression environment, this application can quickly obtain the final attack result through the dynamic execution of expressions. Compared with existing technologies, it can quickly identify fatal attack alarms from a massive number of attack alarms, improving the determination efficiency of personnel and effectively reducing the cost of manual determination. Attached Figure Description
[0052] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.
[0053] Figure 1 A flowchart illustrating a method for determining a network attack provided in an embodiment of this application;
[0054] Figure 2 A flowchart illustrating another method for determining network attacks provided in this application embodiment;
[0055] Figure 3 A flowchart illustrating another method for determining network attacks provided in this application embodiment;
[0056] Figure 4 A flowchart illustrating another method for determining network attacks provided in this application embodiment;
[0057] Figure 5 A flowchart illustrating another method for determining network attacks provided in this application embodiment;
[0058] Figure 6 A flowchart illustrating another method for determining network attacks provided in this application embodiment;
[0059] Figure 7 A schematic diagram of the functional modules of the network attack determination device provided in the embodiments of this application;
[0060] Figure 8 This is a schematic diagram of an electronic device structure provided in an embodiment of this application. Detailed Implementation
[0061] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments.
[0062] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the accompanying drawings in this application are for illustrative and descriptive purposes only and are not intended to limit the scope of protection of this application. Furthermore, it should be understood that the schematic drawings are not drawn to scale. The flowcharts used in this application illustrate operations implemented according to some embodiments of this application. It should be understood that the operations in the flowcharts may not be implemented in sequence, and steps without logical contextual relationships may be reversed or implemented simultaneously. In addition, those skilled in the art, guided by the content of this application, may add one or more other operations to the flowcharts, or remove one or more operations from the flowcharts.
[0063] Furthermore, the described embodiments are merely some, not all, of the embodiments of this application. The components of the embodiments of this application described and illustrated herein can typically be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.
[0064] It should be noted that the term "comprising" will be used in the embodiments of this application to indicate the presence of the features declared thereafter, but does not exclude the addition of other features.
[0065] The following section will explain the specific application scenarios of the network attack determination method provided in the embodiments of this application.
[0066] The methods for determining network attacks can be applied to scenarios where security personnel attempt to analyze network attack alerts. This scenario involves the databases of network devices and their backend processing systems. The network device's database can be that of a network intrusion detection system (NIDS) or a network security device employing network detection and response technologies. The backend processing system interacts with these network device databases to obtain relevant alert information and ultimately analyzes and processes it to arrive at the alert results.
[0067] Figure 1 This is a flowchart illustrating a method for determining network attacks provided in an embodiment of this application. This method is applied in the aforementioned scenario, and its execution entity can be a computer, server, or other computing device with processing or computing capabilities; no limitations are imposed here. Figure 1 As shown, the method includes:
[0068] S101. Load the pre-configured expression and pass it to the attack result determination expression environment.
[0069] Optionally, the expressions mentioned above can come from various types of expression files already stored on the computing device. All expressions in these files can be edited and verified by developers based on attack traffic samples, which can be obtained from the database of the network attack detection device. Before loading the expressions, it is necessary to construct an attack result determination expression environment. This involves initializing the attack result determination expression environment so that it can include pre-injected, syntactically defined types and methods. The purpose of injecting these syntactically defined types and methods is that if a satisfactory attack determination result cannot be obtained through the attack result determination expression environment, the expression needs to be updated and recalculated; that is, the expression needs to be rewritten or modified. Therefore, when security personnel write the corresponding expressions, they need to use the syntactically defined types and methods already injected into the attack result determination expression environment.
[0070] It should be noted that the attack result determination expression environment may also include an initialized general expression environment. In some embodiments, this initialized general expression environment can be written during the determination process to obtain the aforementioned attack result determination expression environment. Of course, the method of generating the attack result determination expression environment is not limited to this.
[0071] S102. Pass the key information of the attack alarm associated network data to the attack result determination expression environment.
[0072] The attack alarm-related network data can be obtained through a network or database, without restriction. The computing device pre-stores methods and pathways for transmitting key information from the attack alarm-related network data to the attack result determination expression environment. These pre-stored methods and pathways allow the attack result determination expression environment to utilize this key information for subsequent processing.
[0073] S103. Using the attack result determination expression environment, analyze key information based on the expression to obtain the attack determination result.
[0074] Optionally, the attack determination result may meet the requirements, i.e., the attack is successful or the attack fails, or it may not meet the requirements, i.e., the attack alarm is not effectively calculated and processed, resulting in invalid information as the final input.
[0075] In summary, this application provides a method for determining network attacks, including: loading a pre-configured expression and passing it to an attack result determination expression environment, wherein the attack result determination expression environment includes: pre-injected types and methods defined according to syntax; passing key information of network data associated with attack alarms to the attack result determination expression environment; and using the attack result determination expression environment to analyze the key information according to the expression to obtain the attack determination result. By passing the key information of network data associated with attack alarms to the attack result determination expression environment, this application can quickly obtain the final attack result through the dynamic execution of the expression. Compared with the prior art, it can quickly identify fatal attack alarms from a large number of attack alarms, improve the determination efficiency of personnel, and effectively reduce the cost of human judgment.
[0076] Figure 2 A flowchart illustrating a method for determining a network attack provided in this application embodiment is shown below. Figure 2 As shown, as an optional implementation, before step S102, the following step is further included:
[0077] S201. Extract attack alarm-related network data from the network device's database.
[0078] Optionally, the database of the aforementioned network device can be the database of a network intrusion detection system (NIDS), the database of a network security device that applies network detection and response technologies, or the database of any device capable of acquiring attack alarm information. Specifically, an attack alarm can refer to an alarm triggered when the full monitoring device detects an attack attempt from the outside or inside, and the associated network data refers to the data corresponding to the alarm, such as network request data, log data, etc., which are referred to as attack alarm associated network data in this embodiment.
[0079] S202. Extract key information from network data associated with attack alerts.
[0080] Optionally, for the extraction of key information from attack alarm-related network data, the corresponding extraction method can be selected according to the characteristics and type of the data, and these methods are pre-existing on the computing device.
[0081] The attack alert-related network data includes a variety of data, such as user behavior data, network request data, and log data. Some of this data is not useful for obtaining the subsequent attack results. Therefore, it is necessary to filter the acquired attack alert-related network data to obtain the valid data required for the attack result determination expression environment. This valid information is the key information. Optionally, the above-mentioned key information includes at least one of the following: time, request headers, request body, attack payload, and the time, response status code, and response body in the response. Among them, the attack payload is the code executed after a successful attack.
[0082] Figure 3 A flowchart illustrating another method for determining network attacks provided in this application embodiment is shown below. Figure 3 As shown, as an optional implementation, step S202 specifically includes:
[0083] S301. Obtain request and response data from the network data associated with the attack alarm.
[0084] Specifically, the network data associated with attack alerts includes request data and response data, which are the valid data required by the attack result determination expression environment.
[0085] S302. Parse the request and response data according to the preset protocol of the network data associated with the attack alarm, and extract key information.
[0086] Optionally, the aforementioned preset protocol can be a network protocol such as Hypertext Transfer Protocol (HTTP), Transmission Control Protocol (TCP), or File Transfer Protocol (FTP). The computing device will select a suitable protocol based on the network data type associated with the attack alarm to parse the request data and the response data to extract key information.
[0087] The following describes the process for handling the situation where the alarm of the attack determination result does not meet the preset conditions, as mentioned in step S103 above.
[0088] Figure 4 A flowchart illustrating another method for determining network attacks provided in this application embodiment is shown below. Figure 4 As shown, as an optional implementation, after step S103, the method further includes:
[0089] S401. If the alarm of the attack determination result does not meet the preset conditions, receive the editing information for the expression.
[0090] The aforementioned preset conditions can refer to the attack determination result being either a successful attack or an attack failure. If the attack result obtained after the attack result determination expression environment completes calculation is other invalid information, then the preset conditions are not met. That is, the target expression selected for the obtained attack alarm cannot effectively process and calculate the attack alarm. In this case, the expression can be edited to obtain a corresponding expression that can process this alarm.
[0091] S402. Update the expression according to the editing information.
[0092] Specifically, the aforementioned editing information can be used by the user based on existing experience and key information, utilizing pre-injected types and methods defined by syntax within the attack result judgment expression environment to edit the expression. This allows the edited expression to handle alerts for attack judgment results that do not meet preset conditions. After editing, the updated expression becomes the re-edited expression.
[0093] In this embodiment, if the expression fails to calculate an attack result that meets the preset conditions for the alarm attack, security personnel will re-edit the expression for that attack alarm to obtain a corresponding expression that can handle the alarm. Updating the expression ensures that all attack alarms ultimately yield attack alarm results that meet the preset conditions, thus ensuring the accuracy of attack analysis. It should be noted that if the preset conditions are not met, the editing steps can be repeated until a suitable expression is obtained.
[0094] Figure 5 A flowchart illustrating another method for determining network attacks provided in this application embodiment is shown below. Figure 5 As shown, as an optional implementation, step S103 specifically includes:
[0095] S501. Based on the key information, filter the corresponding target expression in the attack result determination expression environment.
[0096] Specifically, the constructed attack result determination expression environment loads multiple expressions from the configuration file. Based on the aforementioned key information, it filters these expressions, with the filtering criteria and conditions pre-existing in the attack result determination expression environment, ultimately obtaining the corresponding target expression.
[0097] S502. Perform lexical and syntactic analysis on the target expression to generate bytecode and obtain the loaded expression.
[0098] Specifically, after obtaining the corresponding target expression, to enable the target expression to be dynamically executed to obtain attack results, the target expression must first be loaded. That is, firstly, the static expression file is input into the scanner in the attack result determination expression environment. The scanner performs lexical analysis on the static expression. The target expression is then converted into a series of tokens, which can include keywords, identifiers, special symbols, etc. Then, these tokens converted from the static expression are input into the analyzer in the attack result determination expression environment. The analyzer scans the generated tokens and performs syntax analysis to generate a syntax tree. The syntax tree determines the priority and meaning of many operators in the expression, and finally obtains the bytecode. The backend system then uses the obtained bytecode to generate the loaded expression.
[0099] S503. Use the key information as variables in the loaded expression to calculate and obtain the attack determination result.
[0100] Specifically, in step S202 above, key information can be obtained, including at least one of the following: time, request header, request body, attack payload, and the time, response status code, and response body in the response. All of the above key information is transformed into variables that can be input into the loaded expression, and these variables are input into the loaded expression. The expression then automatically selects the necessary variables for calculation, ultimately obtaining the attack result. If the attack result meets the preset conditions, the attack result is either successful or failed.
[0101] As an optional implementation, the attack determination result may further include: the IP address of the attacking network; correspondingly, step S302 above may include:
[0102] The request data and response data are parsed according to the preset protocol of the attack alarm associated network data to obtain the IP address of the attacking network as supplementary information for the attack determination result.
[0103] It is worth noting that in some embodiments, the supplementary information for the attack determination result may include not only the IP address of the attacking network, but also the attack frequency, attack time, etc., which are not limited here.
[0104] Figure 6 A flowchart illustrating another method for determining network attacks provided in this application embodiment is shown below. Figure 6 As shown, as an optional implementation, the above method further includes:
[0105] S601. Obtain host process tree information related to attack alarm host data.
[0106] Based on the above description, optionally, in addition to extracting attack alarm-related network data from the network device's database, the computing device can also extract attack alarm-related host data from the host. Through this attack alarm-related host data, host process tree information can be further obtained, wherein the host process tree information can reflect the list of attack alarm processes corresponding to the host.
[0107] It should be noted that the host in the embodiments of this application may specifically be a computer, a server, etc., and is not limited here.
[0108] S602. Obtain key host information based on host process tree information.
[0109] The key information of the host may include: processes, process commands, the generation time of each process, the execution time of the process commands, etc., which are not limited here and may vary depending on the actual application scenario.
[0110] S603. Determine the attack judgment result of the host based on the host's key information.
[0111] Based on the key host information determined above, the attack strategy's attack determination result against the host can be further determined. Optionally, the attack determination result may include: the attacker's IP address, attack time, attack frequency, and indication information of whether the attack was successful, etc., which are not limited here. By applying the embodiments of this application, attacks launched against host devices can be identified, thereby improving the applicability of the method of this application.
[0112] Of course, it should be noted that in some embodiments, the attack determination results targeting the network can be combined to comprehensively determine the specific attack behavior, so as to improve the accuracy of the determination results.
[0113] Figure 7 This is a schematic diagram of the functional modules of the network attack determination device provided in this application embodiment; the basic principle and technical effects of this device are the same as those of the corresponding method embodiment described above. For the sake of brevity, parts not mentioned in this embodiment can be referred to the corresponding content in the method embodiment. Figure 7 As shown, the network attack detection device 700 includes:
[0114] Loading module 710 is used to load pre-configured expressions and pass them to the attack result determination expression environment, wherein the attack result determination expression environment includes: pre-injected types and methods defined according to syntax;
[0115] The sending module 720 is used to transmit key information of the attack alarm associated network data to the attack result determination expression environment;
[0116] Analysis module 730 is used to analyze the key information according to the attack result determination expression environment to obtain the attack determination result;
[0117] In alternative implementations, such as Figure 7 As shown, the above-mentioned device also includes:
[0118] Extraction module 740 is used to extract the attack alarm associated network data from the database of the network device; and to extract the key information from the attack alarm associated network data, wherein the key information includes at least one of the following: time, request header, request body, attack payload and time, response status code and response body in the response.
[0119] In an optional implementation, the extraction module 740 is specifically used to obtain request data and response data from the attack alarm associated network data; and to parse the request data and response data according to the preset protocol of the attack alarm associated network data to extract key information.
[0120] In an optional implementation, the sending module 720 is specifically used to pass key information as variables to the attack result determination expression environment.
[0121] The analysis module 730 is specifically used to analyze the received variables and the expression in the attack result determination environment to obtain the attack determination result.
[0122] In alternative implementations, such as Figure 7 As shown, the above-mentioned device also includes:
[0123] The update module 750 is used to receive editing information for the expression if the alarm of the attack judgment result does not meet the preset conditions; and to update the expression according to the editing information.
[0124] In an optional implementation, the analysis module 730 is specifically used to filter the corresponding target expression in the attack result determination expression environment based on key information; perform lexical analysis and syntax analysis on the target expression to generate bytecode and obtain the loaded expression; and use the key information as variables of the loaded expression to calculate and obtain the attack determination result.
[0125] In an optional implementation, the extraction module 740 is used to parse the request data and the response data according to a preset protocol of the attack alarm associated network data, and obtain the IP address of the attacking network as supplementary information for the attack determination result.
[0126] In an optional implementation, the analysis module 730 is further configured to acquire host process tree information associated with attack alarm host data; acquire host key information based on the host process tree information, wherein the host key information includes: processes and process commands; and determine the attack judgment result of the host based on the host key information.
[0127] The above-described device is used to execute the method provided in the foregoing embodiments, and its implementation principle and technical effect are similar, so they will not be described again here.
[0128] These modules can be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), one or more microprocessors, or one or more Field Programmable Gate Arrays (FPGAs). Alternatively, when a module is implemented using processing element scheduler code, the processing element can be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor capable of calling program code. Furthermore, these modules can be integrated together as a system-on-a-chip (SOC).
[0129] Figure 8 This is a schematic diagram of an electronic device structure provided in an embodiment of this application. The electronic device can be a computing device with processing or computing capabilities, such as a computer or server. Figure 8 As shown, the electronic device includes: a processor 810, a memory 820, and a bus 830.
[0130] The memory 820 stores machine-readable instructions executable by the processor 810. When the electronic device is running, the processor 810 communicates with the memory 820 via the bus 830. The processor 810 executes the machine-readable instructions to perform the steps of the above method embodiment. The specific implementation and technical effects are similar and will not be described again here.
[0131] Optionally, this application also provides a storage medium storing a computer program, which, when run by a processor, executes the steps of the above-described method embodiments. The specific implementation and technical effects are similar and will not be repeated here.
[0132] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.
[0133] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.
[0134] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in the form of hardware plus software functional units.
[0135] The integrated units implemented as software functional units described above can be stored in a computer-readable storage medium. These software functional units, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0136] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.
Claims
1. A method for determining network attacks, characterized in that, include: Load a pre-configured expression and pass it to the attack result determination expression environment, wherein the attack result determination expression environment includes: pre-injected types and methods defined according to syntax; The key information of the attack alarm associated network data is passed to the attack result determination expression environment; Using the attack result determination expression environment, the key information is analyzed according to the expression to obtain the attack determination result, which includes: indication information of whether the attack was successful; The attack result determination environment, which uses the aforementioned attack result determination expression, analyzes the key information based on the expression to obtain the attack determination result, includes: Based on the key information, the corresponding target expression is selected in the attack result determination expression environment; Lexical and syntactic analysis are performed on the target expression to generate bytecode and obtain the loaded expression. The key information is used as a variable in the loaded expression to calculate and obtain the attack determination result; After the environment using the attack result determination expression analyzes the key information according to the expression and obtains the attack determination result, it further includes: If the alarm of the attack determination result does not meet the preset conditions, the editing information for the expression is received, and the preset conditions refer to whether the attack determination result is successful or unsuccessful. Update the expression based on the edited information.
2. The method as described in claim 1, characterized in that, Before passing the key information of the attack alarm-related network data to the attack result determination expression environment, the process also includes: Extract the attack alarm-related network data from the network device's database; The key information is extracted from the network data associated with the attack alarm. The key information includes at least one of the following: time, request header, request body, attack payload, and time, response status code, and response body in the response.
3. The method as described in claim 2, characterized in that, The extraction of the key information from the attack alert-related network data includes: Obtain the request and response data from the network data associated with the attack alarm; The request data and response data are parsed according to a preset protocol for the attack alarm associated network data to extract the key information.
4. The method as described in claim 1, characterized in that, The step of passing key information from attack alert-related network data to the attack result determination expression environment includes: The key information is passed as a variable to the attack result determination expression environment; Using the aforementioned attack result determination expression environment, the key information is analyzed based on the expression to obtain the attack determination result, including: Using the attack result determination expression environment, the received variables and the expression are analyzed to obtain the attack determination result.
5. The method as described in claim 3, characterized in that, The method further includes: The request data and response data are parsed according to a preset protocol for the attack alarm associated network data to obtain the IP address of the attacking network as supplementary information for the attack determination result.
6. The method as described in claim 3, characterized in that, Also includes: Obtain host process tree information associated with attack alerts; Based on the host process tree information, key host information is obtained, wherein the key host information includes: processes and process commands; Based on the key host information, the attack determination result of the host is determined.
7. An electronic device, characterized in that, include: The device includes a processor and a memory, the memory storing machine-readable instructions executable by the processor, which, when the electronic device is running, are executed by the processor to perform the steps of the network attack determination method as described in any one of claims 1 to 6.
8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the steps of the network attack determination method as described in any one of claims 1 to 6.