Methods, apparatus and computer-readable storage media for detecting abnormal traffic

Abstract

This application discloses a method, apparatus, and computer-readable storage medium for detecting abnormal traffic. The method includes: acquiring traffic data from a terminal; comparing the traffic data with preset features in a sandbox model to obtain a first comparison result; determining first normal traffic data based on the first comparison result and classifying the first normal traffic data; filtering the classified first normal traffic data; and determining first abnormal traffic data within the first normal traffic data based on the filtering result. This application improves the detection accuracy of APTs by performing secondary detection and classification on the traffic data to identify abnormal traffic data.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus and computer-readable storage medium for detecting abnormal traffic. Background Technology

[0002] Currently, with the rapid popularization and development of computer communication and mobile networks, Advanced Persistent Threat (APT) cyberattacks are posing significant economic and social security problems. Malware / payloads in APT attacks often engage in malicious communication activities to steal data or download new malware. Therefore, current APT detection methods generally employ "sandboxing" or anomaly-based detection approaches; however, existing APT detection methods have low accuracy. Summary of the Invention

[0003] This application provides a method, apparatus, and computer-readable storage medium for detecting abnormal traffic, aiming to solve the problem of low accuracy in APT detection.

[0004] To achieve the above objectives, this application provides a method for detecting abnormal traffic, the method comprising:

[0005] Obtain traffic data from the terminal;

[0006] The traffic data is compared with preset features in the sandbox model to obtain the first comparison result;

[0007] Based on the first comparison result, the first normal traffic data in the traffic data is determined, and the first normal traffic data is classified.

[0008] The first normal traffic data after classification is filtered, and the first abnormal traffic data in the first normal traffic data is determined based on the filtering results.

[0009] Optionally, the step of determining the first normal traffic data in the traffic data based on the first comparison result and classifying the first normal traffic data includes:

[0010] Based on the first comparison result, determine the first normal traffic data and the second abnormal traffic data in the traffic data;

[0011] The first normal traffic data is stored in the first virtual region, and the second abnormal traffic data is stored in the second virtual region;

[0012] The first normal traffic data stored in the first virtual area is classified.

[0013] Optionally, the step of classifying the first normal traffic data includes:

[0014] Obtain the traffic type of the first normal traffic data;

[0015] The first normal traffic data is classified according to the traffic type.

[0016] Optionally, the step of filtering the first normal traffic data after classification includes:

[0017] Obtain the communication characteristics of the first normal traffic data after classification, and compare the communication characteristics with the communication characteristics of the abnormal traffic data;

[0018] The first normal traffic data is filtered based on the second comparison result.

[0019] Optionally, after the step of determining the first abnormal traffic data in the first normal traffic data based on the filtering results, the method includes:

[0020] Based on the filtering results, determine the second normal traffic data in the first normal traffic data;

[0021] The second normal traffic data is stored in a virtual security zone, and the first abnormal traffic data is stored in a virtual recycling zone, and alarm information is output. The virtual security zone and the virtual recycling zone are both sub-regions of the first virtual zone.

[0022] Optionally, after the step of determining the first abnormal traffic data in the first normal traffic data based on the filtering results, the method includes:

[0023] Obtain the storage space of the virtual security zone, and the storage duration of the second normal traffic data in the virtual security zone;

[0024] The second normal traffic data in the virtual security zone is deleted based on the storage space and / or the storage duration.

[0025] Optionally, the method further includes:

[0026] Construct an attack scenario graph;

[0027] Obtain the weight value of each attack stage in each of the attack scenario graphs, and the score of each attack stage;

[0028] The score of each attack scenario graph is determined based on the weight value and the score of each attack phase;

[0029] When the score value is greater than the set threshold, an alarm message is output.

[0030] Furthermore, to achieve the above objectives, this application also provides an abnormal traffic detection device, which includes an acquisition module, a comparison module, a classification module, and a filtering module, wherein:

[0031] The acquisition module is used to acquire the terminal's traffic data;

[0032] The comparison module is used to compare the traffic data with preset features in the sandbox model to obtain a first comparison result;

[0033] The classification module is used to determine the first normal traffic data in the traffic data based on the first comparison result, and to classify the first normal traffic data.

[0034] The filtering module is used to filter the classified first normal traffic data and determine the first abnormal traffic data in the first normal traffic data based on the filtering results.

[0035] In addition, to achieve the above objectives, this application also provides an abnormal traffic detection device, the device including a memory, a processor, and an abnormal traffic detection program stored in the memory and running on the processor, wherein the abnormal traffic detection program, when executed by the processor, implements the steps of the abnormal traffic detection method described above.

[0036] In addition, to achieve the above objectives, this application also provides a computer-readable storage medium storing an abnormal traffic detection program, which, when executed by a processor, implements the steps of the abnormal traffic detection method described above.

[0037] This application proposes a method for detecting abnormal traffic. The method involves acquiring terminal traffic data; comparing the traffic data with preset features in a sandbox model to obtain a first comparison result; identifying first normal traffic data based on the first comparison result; classifying the first normal traffic data; filtering the classified first normal traffic data; and identifying first abnormal traffic data within the first normal traffic data based on the filtering result. This application improves the detection accuracy of APTs by performing secondary detection and classification on the traffic data. Attached Figure Description

[0038] Figure 1 This is a schematic diagram of the terminal structure of the hardware operating environment involved in the embodiments of this application;

[0039] Figure 2 This is a flowchart illustrating the first embodiment of the abnormal traffic detection method of this application;

[0040] Figure 3 This is a flowchart illustrating the second embodiment of the abnormal traffic detection method of this application;

[0041] Figure 4 This is a flowchart illustrating a specific embodiment of the abnormal traffic detection method of this application;

[0042] Figure 5 This is a schematic diagram of the modules of the abnormal traffic detection method of this application.

[0043] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0044] It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of this application.

[0045] The main solution of this application embodiment is: to obtain the terminal's traffic data; to compare the traffic data with preset features in the sandbox model to obtain a first comparison result; to determine the first normal traffic data in the traffic data based on the first comparison result, and to classify the first normal traffic data; to filter the classified first normal traffic data, and to determine the first abnormal traffic data in the first normal traffic data based on the filtering result.

[0046] Because APT detection using a "sandbox approach" or anomaly-based detection methods suffers from low accuracy, this application proposes a solution. This solution involves acquiring terminal traffic data; comparing the traffic data with preset features in a sandbox model to obtain a first comparison result; identifying first normal traffic data based on the first comparison result; classifying the first normal traffic data; filtering the classified first normal traffic data; and identifying first abnormal traffic data within the first normal traffic data based on the filtering results. This application improves APT detection accuracy by performing secondary detection and classification on the traffic data to identify abnormal traffic data.

[0047] like Figure 1 As shown, Figure 1 This is a schematic diagram of the terminal structure of the hardware operating environment involved in the embodiments of this application.

[0048] like Figure 1As shown, the terminal may include: a processor 1001, such as a CPU; a network interface 1004; a user interface 1003; a memory 1005; and a communication bus 1002. The communication bus 1002 is used to enable communication between these components. The user interface 1003 may include a display screen and an input unit such as a keyboard. Optionally, the user interface 1003 may also include a standard wired interface or a wireless interface. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface). The memory 1005 may be high-speed RAM or non-volatile memory, such as a disk drive. Optionally, the memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0049] Those skilled in the art will understand that Figure 1 The terminal structure shown does not constitute a limitation on the terminal device and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0050] like Figure 1 As shown, the memory 1005, which is a computer-readable storage medium, may include an abnormal traffic detection program.

[0051] exist Figure 1 In the terminal shown, network interface 1004 is mainly used for data communication with the backend server; user interface 1003 is mainly used for data communication with the client (user terminal); processor 1001 can be used to call the abnormal traffic detection program in memory 1005 and perform the following operations:

[0052] Obtain traffic data from the terminal;

[0053] The traffic data is compared with preset features in the sandbox model to obtain the first comparison result;

[0054] Based on the first comparison result, the first normal traffic data in the traffic data is determined, and the first normal traffic data is classified.

[0055] The first normal traffic data after classification is filtered, and the first abnormal traffic data in the first normal traffic data is determined based on the filtering results.

[0056] refer to Figure 2 , Figure 2 This is a flowchart illustrating the first embodiment of the abnormal traffic detection method of this application.

[0057] This application provides a method for detecting abnormal traffic. It should be noted that although the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than that shown here.

[0058] The abnormal traffic detection method in this embodiment is applied to a video ringback tone platform and includes the following steps:

[0059] Step S10: Obtain the terminal's traffic data;

[0060] It should be noted that current APT detection methods generally employ sandboxing and anomaly-based detection approaches. However, the biggest challenge with sandboxing lies in the diversity of testing environments. Sandboxes have limitations on operating system types, browser versions, and related plugins; without a suitable testing environment, malicious code in the traffic may go undetected, leading to missed detections. Anomaly-based detection methods can only detect known botnets and Trojan communication behaviors. Therefore, most current APT detection methods cannot detect abnormal traffic originating from the endpoint, thus reducing protection capabilities. While some methods exist that detect abnormal traffic from the endpoint, their detection accuracy is low. Based on this, this application proposes an abnormal traffic detection method to address the aforementioned problems.

[0061] This embodiment mainly captures and stores traffic data flowing through the network adapter.

[0062] Optionally, since each user has different network usage habits at different times of the day, different data collection time periods can be defined: from 11 PM to 8 AM the next day and from 12 PM to 2 PM, traffic will be relatively low due to rest periods; from 8 AM to 12 PM and from 2 PM to 6 PM, there may be more traffic data due to work needs; and from 6 PM to 11 PM, there may also be more traffic data due to evening entertainment activities. Thus, by collecting traffic data in different time periods, the accuracy for different time periods can be improved.

[0063] Optionally, the frequency of traffic collection can also be determined, as well as the collection frequency for different time periods. For example, during the two time periods from 11 p.m. to 8 a.m. the next day and from 12 p.m. to 2 p.m., the collection frequency can be set to collect once every 15 minutes. During the two time periods from 8 a.m. to 12 p.m. and from 2 p.m. to 6 p.m., the collection frequency can be set to collect once every 5 minutes.

[0064] Step S20: Compare the traffic data with preset features in the sandbox model to obtain the first comparison result;

[0065] This application pre-establishes a sandbox model for the first screening of traffic data. The sandbox model is constructed using traffic generated by normal network behavior. At the same time, the sandbox model stores a malicious code library, which stores the communication characteristics of abnormal traffic data.

[0066] When traffic data is input into the sandbox model, the sandbox model compares the traffic data with a malware database. For example, it extracts the communication characteristics of the traffic data and compares these characteristics with the communication characteristics of abnormal traffic data in the malware database to determine whether abnormal traffic data exists. If the matching degree between the communication characteristics of the traffic data and the communication characteristics of abnormal traffic data reaches a set threshold (e.g., 95%), it indicates that abnormal traffic data exists in the traffic data; if the matching degree is less than the set threshold, it indicates that abnormal traffic data does not exist in the traffic data.

[0067] Optionally, a sandbox (also known as a sandbox or sand table) is installed on the terminal, and a first virtual area (virtual temporary folder one) and a second virtual area (virtual temporary folder two) are created in the sandbox. Then, multiple virtual category areas (virtual category folders) are created in the first virtual area. At the same time, virtual security areas (virtual security folders) and virtual recycling areas (virtual junk folders) are created in the virtual category areas. After determining the first normal traffic data and the second abnormal traffic data in the traffic data according to the first comparison result, the first normal traffic data is stored in the first virtual area, and the second abnormal traffic data is stored in the second virtual area. Then, the first normal traffic data stored in the first virtual area is classified.

[0068] Optionally, the traffic type of the first normal traffic data is obtained, and the first normal traffic data is classified according to the traffic type. For example, the traffic type includes video traffic, image traffic, audio traffic, etc. Based on the traffic type, video traffic data, image traffic data, audio traffic data, web page traffic data, application traffic data, etc. are extracted from the traffic data. At the same time, these different types of traffic data are stored in different virtual classification areas.

[0069] Step S40: Filter the first normal traffic data after classification, and determine the first abnormal traffic data in the first normal traffic data based on the filtering results.

[0070] In this embodiment, the classified first normal traffic data is filtered, and then the first abnormal traffic data in the first normal traffic data is determined based on the filtering results. Specifically, the communication characteristics of the classified first normal traffic data are obtained, and then the communication characteristics are compared with the communication characteristics of the abnormal traffic data. If the matching degree between the communication characteristics and the communication characteristics of the abnormal traffic data reaches a set threshold (e.g., 95%), it indicates that there is abnormal traffic data in the first normal traffic data; if the matching degree is less than the set threshold, it indicates that there is no abnormal traffic data in the first normal traffic data.

[0071] Optionally, based on the filtering results, the second normal traffic data in the first normal traffic data is determined. Then, the second normal traffic data is stored in a virtual secure area, and the first abnormal traffic data is stored in a virtual recycling area. Alarm information is then output. For example, the second normal traffic data is stored in a virtual secure folder, and the first abnormal traffic data is stored in a virtual junk folder.

[0072] Optionally, to save storage space in the virtual security zone, it is necessary to periodically clean up the traffic data in the virtual security zone. Specifically, the storage space (remaining storage space) of the virtual security zone and the storage duration of the second normal traffic data in the virtual security zone are obtained. It is then determined whether the remaining storage space is less than a preset space value (e.g., 30%) and whether the storage duration is greater than or equal to a preset duration (e.g., 12 hours or 1 day). If the remaining storage space is less than the preset space value and / or the storage duration is greater than or equal to the preset duration, the second normal traffic data in the virtual security zone is deleted to free up more space.

[0073] This embodiment improves detection accuracy and speed by classifying traffic; it further improves detection accuracy by performing secondary detection on traffic, and it addresses the issue that malicious code in traffic may go undetected and result in missed detections if a suitable testing environment is lacking.

[0074] Further, refer to Figure 3 , Figure 3 This is a flowchart illustrating the second embodiment of the abnormal traffic detection method of this application.

[0075] The method further includes:

[0076] Step S50: Construct an attack scenario diagram;

[0077] Step S60: Obtain the weight value of each attack stage in each attack scenario graph, and the score of each attack stage;

[0078] Step S70: Determine the score value of each attack scenario graph based on the weight value and the score value of each attack stage;

[0079] Step S80: When the score value is greater than the set threshold, an alarm message is output.

[0080] It should be noted that the purpose of constructing the attack scenario diagram in this embodiment is to track attackers and effectively identify APT attack groups that subsequently launch new APT attacks.

[0081] In this embodiment, TTP rules (i.e., attack scenario rules) are obtained, APT attack scenario graphs are constructed based on the TTP rules, and then the score value (i.e., total score) of each APT attack scenario graph is determined. Optionally, the total score T of each APT attack scenario graph is calculated according to the following formula:

[0082]

[0083] In the formula, w i Let S be the weight of the APT attack scenario graph in the i-th attack phase of the TTP specification, where n = 7. i Let represent the score of the i-th attack phase in the TTP specification for the APT attack scenario graph.

[0084] Furthermore, the APT attack scenario graphs are sorted according to the total score T of all APT attack scenario graphs to remove most nodes and edges unrelated to APT attack activities, effectively distinguishing between attack and benign scenarios. In one embodiment, the maximum total score of the APT attack scenario graph during benign activity is defined as the benign score; the minimum total score of the APT attack scenario graph during malicious activity is defined as the malicious score. Then, a value between the benign and malicious scores is selected and defined as the alarm threshold. When the total score of the APT attack scenario graph during real-time operation is detected to be greater than the alarm threshold, an alarm message is output.

[0085] Optionally, refer to Table 1, which provides examples of TTP rules.

[0086] Table 1

[0087]

[0088]

[0089] The TTP specification primarily employs two methods to map raw audit log data to attack steps: First, it uses general rules developed based on expert experience for mapping. Second, it utilizes the information flow (i.e., path correlation) between nodes involved in TTPs for mapping.

[0090] In Table 1, the first column represents the APT attack stage, the second column represents the associated TTP name, and the third column represents the severity level associated with each TTP: L, M, H, and C represent low, medium, high, and very high, respectively. The fourth column represents the TTP rules, where S.ip not belonging to {Trusted IP Addresses} and P0.name belonging to {Sensitive Commands} use the first mapping method mentioned above (mapping using common rules developed based on expert experience). Meanwhile, path correlation(P0, F) <= path thres uses the second mapping method mentioned above (mapping using the information flow between nodes involved in TTPs), where path correlation is the path correlation calculation function, and path thres is an empirical value that can be determined based on actual scenario testing. The last column provides an explanation of the TTP rules.

[0091] Optionally, refer to Table 2, which lists the parameters corresponding to the severity level.

[0092] Table 2

[0093] Severity level Fraction range average value L [0.2，4.1) 2.0 M [5.0，7.0) 6.0 H [8.0，10.0) 9.0 C [9.0，11.0) 10.0

[0094] In this embodiment, by constructing an APT attack scenario, attacks such as Trojan viruses and abnormal network behavior can be detected, and alarms can be triggered for the detected malicious signals. This has the function of terminating malicious processes and deleting malicious software on the terminal, thereby enabling the system to block the operation of malicious software from the source and improve protection capabilities.

[0095] To better illustrate the abnormal traffic detection method of this application, refer to... Figure 4 , Figure 4 This is a flowchart illustrating a specific embodiment of the abnormal traffic detection method of this application.

[0096] In this embodiment, the method for detecting abnormal traffic includes the following implementation scheme:

[0097] 1. Create virtual folders: Install a sandbox on the terminal and create two virtual temporary folders, namely Virtual Temporary Folder 1 and Virtual Temporary Folder 2, in the sandbox. Then, create multiple virtual category folders in Virtual Temporary Folder 1, and create a virtual security folder and a virtual junk folder in the virtual category folders.

[0098] 2. Model building: A sandbox model is built by creating traffic generated by normal behavior in the network. All changes made in the sandbox will not cause any loss to the operating system.

[0099] A sandbox runs software in a restricted system environment, controlling the resources that the program can use (such as file descriptors, memory, disk space, etc.).

[0100] Here are some concrete implementations of sandboxes:

[0101] Software jail: Restricts network access and limits file system namespaces. Optionally, software jails are most commonly used on virtual hosts.

[0102] Rule-based execution: Through system security mechanisms, certain access permissions are assigned to users and programs according to a series of preset rules, giving complete control over program startup, code injection, and network access. At the same time, it can also control program access to files and the registry. Based on this, the chance of viruses and Trojans infecting the system will be reduced.

[0103] Virtual machine: simulates a complete host system.

[0104] Local host sandboxing: Security researchers rely heavily on sandboxing technology to analyze malware behavior. By creating an environment that simulates a real desktop, researchers can observe how malware infects a host. Several malware analysis services use sandboxing technology.

[0105] Online judging system: used for program testing in programming competitions.

[0106] Secure Compute Mode (seccomp): A sandbox built into the Linux kernel. When enabled, seccomp only allows the write(), read(), exit(), and sigreturn() system calls.

[0107] 3. Preliminary screening: When running a browser or other program in a sandbox environment, the traffic will first undergo preliminary screening through the sandbox model. If the traffic contains malicious network information, it will enter the second virtual temporary folder and trigger a precise alarm. If the traffic does not contain malicious network information, it will enter the first virtual temporary folder for temporary storage.

[0108] 4. Categorization for Improved Accuracy: When traffic enters the temporary folder, network traffic analysis software monitors and analyzes the traffic to obtain corresponding information. Then, based on this information, the traffic is categorized into corresponding virtual folders. For example, images or videos can be categorized separately to achieve fine-grained traffic classification. Monitoring and analyzing the finely categorized traffic further improves accuracy and detection speed.

[0109] 5. Secondary Filtering: When traffic enters the corresponding virtual category folder, the sandbox's file system, processes, registry, network behavior, etc., are monitored in real time, as well as for Trojan viruses and abnormal network behavior, to determine whether the traffic contains malicious network information and to perform secondary filtering. If the traffic contains malicious network information, the malicious network information will enter the virtual junk folder and a precise alarm will be triggered. If the traffic does not contain malicious network information, it will enter the virtual safe folder.

[0110] 6. Free up space: Delete traffic that enters the virtual secure folder to free up more space.

[0111] 7. Find the source: Construct an attack scenario, extract alarm signals, thereby finding the source and deleting it. Selective deletion can be performed based on the total score of each APT attack scenario graph.

[0112] This embodiment achieves dynamic analysis of suspicious file samples by periodically monitoring them at different times and with varying traffic volumes, thereby obtaining malicious network information. Then, based on this malicious network information, the strategy configuration for abnormal traffic analysis is optimized. The technical solution provided in this application improves the accuracy of traffic analysis, as well as the accuracy and effectiveness of APT detection. Furthermore, when abnormal traffic from a terminal is detected, the system processes the relevant malicious network behaviors according to the malicious network information to terminate malicious processes and delete malware from the terminal. This allows the system to block the operation of malware at its source, improving detection accuracy and protection capabilities.

[0113] Furthermore, this application also provides an abnormal traffic detection device. The device includes a memory, a processor, and an abnormal traffic detection program stored in the memory and running on the processor. The device acquires traffic data from a terminal; compares the traffic data with preset features in a sandbox model to obtain a first comparison result; determines first normal traffic data based on the first comparison result; classifies the first normal traffic data; filters the classified first normal traffic data; and determines first abnormal traffic data within the first normal traffic data based on the filtering result. This application improves the detection accuracy of APTs by performing secondary detection and classification on the traffic data to identify abnormal traffic data.

[0114] Further, refer to Figure 5 , Figure 5 This is a schematic diagram of the modules of the abnormal traffic detection method of this application.

[0115] The abnormal traffic detection device 100 includes an acquisition module 10, a comparison module 20, a classification module 30, and a filtering module 40, wherein:

[0116] The acquisition module 10 is used to acquire the terminal's traffic data;

[0117] The comparison module 20 is used to compare the traffic data with preset features in the sandbox model to obtain a first comparison result;

[0118] The classification module 30 is used to determine the first normal traffic data in the traffic data based on the first comparison result, and to classify the first normal traffic data.

[0119] The filtering module 40 is used to filter the classified first normal traffic data and determine the first abnormal traffic data in the first normal traffic data based on the filtering results.

[0120] Furthermore, the classification module 30 includes a determining unit, a storage unit, and a classification unit;

[0121] The determining unit is configured to determine, based on the first comparison result, the first normal traffic data and the second abnormal traffic data in the traffic data.

[0122] The storage unit is used to store the first normal traffic data in a first virtual area and to store the second abnormal traffic data in a second virtual area;

[0123] The classification unit is used to classify the first normal traffic data stored in the first virtual area.

[0124] Furthermore, the classification module 30 also includes an acquisition unit;

[0125] The acquisition unit is used to acquire the traffic type of the first normal traffic data;

[0126] The classification unit is further configured to classify the first normal traffic data according to the traffic type.

[0127] Furthermore, the screening module 40 includes a comparison unit and a screening unit;

[0128] The comparison unit is used to obtain the communication characteristics of the first normal traffic data after classification, and compare the communication characteristics with the communication characteristics of the abnormal traffic data.

[0129] The filtering unit is used to filter the first normal traffic data based on the second comparison result.

[0130] Furthermore, the filtering module 40 also includes a first determining unit and a first storage unit;

[0131] The first determining unit is configured to determine the second normal traffic data in the first normal traffic data based on the filtering result;

[0132] The first storage unit is used to store the second normal traffic data in a virtual secure area and store the first abnormal traffic data in a virtual recycling area, and output alarm information. The virtual secure area and the virtual recycling area are both sub-areas of the first virtual area.

[0133] Furthermore, the first storage unit includes an acquisition subunit and a deletion subunit;

[0134] The acquisition subunit is used to acquire the storage space of the virtual security zone and the storage duration of the second normal traffic data in the virtual security zone;

[0135] The deletion subunit is used to delete the second normal traffic data in the virtual security area according to the storage space and / or the storage duration.

[0136] Furthermore, the abnormal traffic detection device 100 also includes a construction module, a first acquisition module, a determination module, and a judgment module.

[0137] The building module is used to construct the attack scenario graph;

[0138] The first acquisition module is used to acquire the weight value of each attack stage in each of the attack scenario graphs, and the score of each attack stage;

[0139] The determining module is used to determine the score value of each attack scenario graph based on the weight value of each attack stage and the score value.

[0140] The judgment module is used to output an alarm message when the score value is greater than a set threshold.

[0141] The implementation of the functions of each module of the above-mentioned abnormal traffic detection device is similar to the process in the above method embodiment, and will not be described in detail here.

[0142] In addition, this application also provides a computer-readable storage medium storing a method program for detecting abnormal traffic, which, when executed by a processor, implements the steps of the above-mentioned method for detecting abnormal traffic.

[0143] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0144] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0145] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0146] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0147] It should be noted that any reference signs placed between parentheses in the claims should not be construed as limiting the claims. The word "comprising" does not exclude the presence of components or steps not listed in the claims. The word "a" or "an" preceding a component does not exclude the presence of a plurality of such components. This application can be implemented by means of hardware comprising several different components and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names.

[0148] Although alternative embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make further changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the alternative embodiments as well as all changes and modifications falling within the scope of this application.

[0149] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for detecting abnormal traffic flow, characterized in that, The method includes: Obtain traffic data from the terminal; The traffic data is compared with preset features in the sandbox model to obtain a first comparison result. After the traffic data is input into the sandbox model, the sandbox model extracts the communication features of the traffic data and compares the communication features with the communication features of abnormal traffic data in the malicious code library to determine whether there is abnormal traffic data in the traffic data. Based on the first comparison result, determine the first normal traffic data in the traffic data, obtain the traffic type of the first normal traffic data, and classify the first normal traffic data according to the traffic type; The communication characteristics of the first normal traffic data after classification are obtained, and the communication characteristics are compared with the communication characteristics of the abnormal traffic data. If the matching degree between the communication characteristics and the communication characteristics of the abnormal traffic data reaches a set threshold, it is determined that there is abnormal traffic data in the first normal traffic data. If the matching degree between the communication characteristics and the communication characteristics of the abnormal traffic data is less than the set threshold, it is determined that there is no abnormal traffic data in the first normal traffic data, so as to obtain a second comparison result. The first normal traffic data is filtered according to the second comparison result, and the first abnormal traffic data and the second normal traffic data are determined according to the filtering result. The second normal traffic data is stored in a virtual security area, and the first abnormal traffic data is stored in a virtual recycling area, and an alarm message is output. The virtual security area and the virtual recycling area are both sub-areas of the first virtual area. Obtain the storage space of the virtual security zone, and the storage duration of the second normal traffic data in the virtual security zone; The second normal traffic data in the virtual security zone is deleted based on the storage space and / or the storage duration.

2. The abnormal flow detection method as described in claim 1, characterized in that, The method for detecting abnormal traffic also includes: Based on the first comparison result, determine the first normal traffic data and the second abnormal traffic data in the traffic data; The first normal traffic data is stored in the first virtual region, and the second abnormal traffic data is stored in the second virtual region; The first normal traffic data stored in the first virtual area is classified.

3. The abnormal flow detection method as described in claim 1, characterized in that, The method further includes: Construct an attack scenario graph; Obtain the weight value of each attack stage in each of the attack scenario graphs, and the score of each attack stage; The score of each attack scenario graph is determined based on the weight value and the score of each attack phase; When the score value is greater than the set threshold, an alarm message is output.

4. A device for detecting abnormal flow rates, characterized in that, The abnormal traffic detection device includes an acquisition module, a comparison module, a classification module, and a filtering module, wherein: The acquisition module is used to acquire the terminal's traffic data; The comparison module is used to compare the traffic data with preset features in the sandbox model to obtain a first comparison result. After the traffic data is input into the sandbox model, the sandbox model extracts the communication features of the traffic data and compares the communication features with the communication features of abnormal traffic data in the malicious code library to determine whether there is abnormal traffic data in the traffic data. The classification module is used to determine the first normal traffic data in the traffic data based on the first comparison result, obtain the traffic type of the first normal traffic data, and classify the first normal traffic data according to the traffic type. The filtering module is used to acquire the communication characteristics of the classified first normal traffic data, compare the communication characteristics with the communication characteristics of abnormal traffic data; if the matching degree between the communication characteristics and the communication characteristics of the abnormal traffic data reaches a set threshold, it is determined that there is abnormal traffic data in the first normal traffic data; if the matching degree between the communication characteristics and the communication characteristics of the abnormal traffic data is less than the set threshold, it is determined that there is no abnormal traffic data in the first normal traffic data, so as to obtain a second comparison result; the first normal traffic data is filtered according to the second comparison result, and the first abnormal traffic data and the second normal traffic data in the first normal traffic data are determined according to the filtering result. The second normal traffic data is stored in a virtual security area, and the first abnormal traffic data is stored in a virtual recycling area, and an alarm message is output. The virtual security area and the virtual recycling area are both sub-areas of the first virtual area. Obtain the storage space of the virtual security zone, and the storage duration of the second normal traffic data in the virtual security zone; The second normal traffic data in the virtual security zone is deleted based on the storage space and / or the storage duration.

5. A device for detecting abnormal flow rates, characterized in that, The apparatus includes a memory, a processor, and an abnormal traffic detection program stored in the memory and running on the processor, wherein the processor, when executing the abnormal traffic detection program, implements the steps of the method as described in any one of claims 1 to 3.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores an abnormal traffic detection program, which, when executed by a processor, implements the steps of the method as described in any one of claims 1 to 3.

Images