An internet attack prediction method, system, device and medium

Abstract

The application discloses an internet attack prediction method, system, device and medium, and the method comprises the following steps: acquiring the alarm information of a worm attack; classifying and aggregating the source IP address and the destination IP address of the alarm information to obtain an aggregated alarm sequence with the same source IP address but different destination IP addresses; performing similarity measurement processing on the aggregated alarm sequence to obtain a correlation matrix between the alarm information with different destination IP addresses; obtaining the correlation strength between each propagation link of the worm attack through the correlation matrix, and predicting the next attack target of the worm attack according to the correlation strength. The application can accurately improve the availability of the alarm information through the aggregated alarm sequence, convert the aggregated alarm sequence into a correlation matrix, obtain the correlation strength between each propagation link of the worm attack according to the correlation matrix, accurately quantitatively calculate and predict the next attack target of the worm attack, and greatly improve the prediction granularity and precision.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer network security, and in particular to an Internet attack prediction method, system, device and medium. BACKGROUND

[0002] With the popularity of the Internet in various companies, the security problem of company-specific Internet is increasingly prominent. Due to the strong association between the devices in the private network, the worm attack is a great threat in the private network. The worm attack virus is an independent program that can run without the intervention of the computer user, and it spreads by constantly obtaining partial or full control of the computer with vulnerabilities in the network. The worm attack virus has fast propagation speed and many variants, and the fixed virus defense mode has poor defense effect, the defense by manually updating the virus library has high cost and is easy to cause loss before defense. The existing intrusion detection system can effectively detect various attacks, but the detection effect of the worm attack with fast propagation speed and many variants is limited, and it is easy to misreport and miss report, so the existing intrusion detection method can only be used as a tool for preliminary extraction of alarm information, and further fine-grained attack detection is needed after obtaining the alarm information. SUMMARY

[0003] The present application aims to at least solve one of the technical problems existing in the prior art. To this end, the present application provides an Internet attack prediction method, system, device and medium, which can improve the availability of information by aggregating alarm sequences, and convert the aggregated alarm sequences into a correlation matrix, obtain the correlation strength between each propagation link of the worm attack according to the correlation matrix, accurately quantify and calculate the next attack target of the worm attack, and greatly improve the fine granularity and precision of the prediction.

[0004] In a first aspect, an embodiment of the present application provides an Internet attack prediction method, which comprises:

[0005] obtaining alarm information of a worm attack;

[0006] classifying and aggregating according to the source IP address and the destination IP address of the alarm information to obtain an aggregated alarm sequence with the same source IP address but different destination IP addresses;

[0007] obtaining a correlation matrix between the alarm information with different destination IP addresses after similarity measurement processing of the aggregated alarm sequence;

[0008] obtaining the correlation strength between each propagation link of the worm attack through the correlation matrix, and predicting the next attack target of the worm attack according to the correlation strength.

[0009] According to the method of the embodiment of the present application, at least the following beneficial effects are achieved:

[0010] Firstly, the alarm information is classified and aggregated to obtain an aggregated alarm sequence with the same source IP address but different destination IP addresses, the availability of the information is improved, and the alarm information with the same source IP address but different destination IP addresses is integrated by the aggregated alarm sequence, the horizontal transmission characteristics of the worm attack are utilized, and the output format is standardized. Then, the correlation matrix between the alarm information is obtained by processing the aggregated alarm sequence, the relationship between the alarm information is quantified by the correlation matrix, the attack steps of the worm attack are facilitated to be expressed, and the subsequent attack target prediction is facilitated. Finally, the correlation strength between each propagation link of the worm attack is obtained by the correlation matrix, the next attack target of the worm attack is predicted by the correlation strength, the attack steps of the worm attack can be accurately quantified and calculated by the correlation strength between the propagation links obtained by the correlation matrix, the next attack target of the worm attack can be accurately predicted by the correlation strength, false positives and false negatives can be avoided according to the accurate quantification and calculation, and the prediction granularity and precision are greatly improved.

[0011] According to some embodiments of the present application, the classification and aggregation according to the source IP address and the destination IP address of the alarm information to obtain the aggregated alarm sequence with the same source IP address but different destination IP addresses comprises:

[0012] extracting the source IP address and the destination IP address from the alarm information;

[0013] storing the alarm information in a hash type manner through a time window to obtain the aggregated alarm sequence with the same source IP address but different destination IP addresses.

[0014] According to some embodiments of the present application, the calculation formula of the correlation matrix comprises:

[0015] C[x][y]=similarity[w1][w2]*freq[x][y]*α+C[x][y]*β

[0016] wherein C[x][y] represents the correlation matrix, w1 and w2 represent the time window, x and y represent two types of alarm information, freq represents the frequency, freq[x][y] represents the frequency of the occurrence of the alarm information y after the occurrence of the alarm information x, and α and β represent the weight.

[0017] According to some embodiments of the present application, the correlation strength between each propagation link of the worm attack is obtained by the correlation matrix, comprising:

[0018] determining the worm attack of the directed graph node corresponding to each propagation link by the correlation matrix.

[0019] According to the correlation strength between each propagation link of the worm attack, the worm attack is calculated.

[0020] According to some embodiments of the present application, the worm attack of each propagation link is determined by the correlation matrix, including:

[0021] The correlation strength threshold and the directed graph set are initialized;

[0022] The alarm information with different destination IP addresses in the correlation matrix is converted into nodes;

[0023] The directed edges between the nodes with the correlation strength greater than the correlation strength threshold are obtained by traversing the correlation matrix, and the node with the entry degree of 0 is used as the attack starting point to obtain the worm attack of the directed graph node.

[0024] According to some embodiments of the present application, the next attack target of the worm attack is predicted according to the correlation strength, including:

[0025] The correlation strength of the worm attack with the same attack starting point is normalized as a forward correlation strength; the calculation formula of the forward correlation strength includes:

[0026]

[0027] Wherein, FC[x][y] represents the forward correlation strength, and n represents the type of the destination node.

[0028] The next attack target of the worm attack is predicted by the forward correlation strength or the correlation strength.

[0029] According to some embodiments of the present application, after the correlation strength between each propagation link of the worm attack is obtained by the correlation matrix, and the next attack target of the worm attack is predicted according to the correlation strength, the internet attack prediction method further includes:

[0030] According to the correlation strength, a defense means corresponding to the correlation strength is selected; the defense means includes defense for the source IP address with the correlation strength higher than the threat threshold and defense for predicting the next attack target of the worm attack.

[0031] In a second aspect, embodiments of the present application provide an internet attack prediction system, which includes:

[0032] An alarm information acquisition module is configured to acquire alarm information of a worm attack;

[0033] The alarm information classification and aggregation module is configured to classify and aggregate the alarm information according to the source IP address and the destination IP address of the alarm information, and obtain an aggregated alarm sequence with the same source IP address but different destination IP addresses.

[0034] The correlation matrix conversion module is configured to convert the aggregated alarm sequence into a correlation matrix between the alarm information with different destination IP addresses by a similarity measurement method.

[0035] The attack prediction module is configured to obtain the correlation strength between each propagation link of the worm attack according to the correlation matrix, and predict the next attack target of the worm attack according to the correlation strength.

[0036] In a third aspect, an embodiment of the present application provides an electronic device, including at least one control processor and a memory connected with the at least one control processor; the memory stores instructions executable by the at least one control processor, and the instructions are executed by the at least one control processor to enable the at least one control processor to execute the internet attack prediction method according to the first aspect.

[0037] In a fourth aspect, an embodiment of the present application provides a computer storage medium, which stores computer executable instructions for enabling a computer to execute the internet attack prediction method according to the first aspect.

[0038] It should be noted that the beneficial effects of the second to fourth aspects of the present application are the same as those of the internet attack prediction method according to the first aspect, which will not be described here.

[0039] Other features and advantages of the present application will be described in the following description, and will become apparent from the description, or will be learned from the practice of the present application. BRIEF DESCRIPTION OF DRAWINGS

[0040] The above and / or additional aspects and advantages of the present application will become apparent and be readily understood from the following description, taken in conjunction with the accompanying drawings, in which:

[0041] Figure 1 is a flowchart of an internet attack prediction method according to an embodiment of the present application;

[0042] Figure 2 is a flowchart of obtaining network performance index data of data packets on different sending rate flows by monitoring packet-level events of data packets transmitted at different sending rates on the flows according to an embodiment of the present application;

[0043] Figure 3 is a flowchart of obtaining the correlation strength between each propagation link of the worm attack according to the correlation matrix according to an embodiment of the present application;

[0044] Figure 4 is a flow chart of a worm attack provided by an embodiment of the present application, which determines a directed graph node corresponding to each propagation link through a correlation matrix;

[0045] Figure 5 is a flow chart of predicting a next attack target of a worm attack according to a correlation strength provided by an embodiment of the present application;

[0046] Figure 6 is a flow chart of selecting a defense means corresponding to a correlation strength according to the correlation strength provided by an embodiment of the present application;

[0047] Figure 7 is a structure diagram of an Internet attack prediction system provided by an embodiment of the present application;

[0048] Figure 8 is a structure diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0049] Embodiments of the present application will be described in detail below, examples of which are shown in the drawings, wherein the same or similar notations represent the same or similar elements or elements having the same or similar functions throughout. The embodiments described below by reference to the drawings are exemplary only, and are used only for explaining the present application, and cannot be understood as limiting the present application.

[0050] In the description of the present application, if there is a description to first, second, etc., it is only for distinguishing technical features for the purpose, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features or implicitly indicating the sequence of indicated technical features.

[0051] In the description of the present application, it is to be understood that the orientation description, such as up, down, etc., indicates the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, which is only for the convenience of describing the present application and simplifying the description, and is not to indicate or imply that the device or element indicated must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as limiting the present application.

[0052] In the description of the present application, it is to be noted that, unless otherwise explicitly limited, the words such as setting, installing, connecting, etc. should be broadly understood, and the person skilled in the art can reasonably determine the specific meaning of the above words in the present application in combination with the specific content of the technical solution.

[0053] The technical solutions of the present application will be described below in conjunction with the drawings, obviously, the following described embodiments are part of the embodiments of the present application, not all embodiments.

[0054] Referring toFigure 1 In some embodiments of the present application, an Internet attack prediction method is provided, comprising:

[0055] Step S100, obtaining alert information of a worm attack.

[0056] Step S200, classifying and aggregating according to the source IP address and the destination IP address of the alert information to obtain an aggregated alert sequence with the same source IP address but different destination IP addresses.

[0057] Step S300, obtaining a correlation matrix between the alert information with different destination IP addresses after similarity measurement processing of the aggregated alert sequence.

[0058] Step S400, obtaining the correlation strength between each propagation link of the worm attack through the correlation matrix, and predicting the next attack target of the worm attack according to the correlation strength.

[0059] It should be noted that the similarity measurement is used to describe the similarity between two vectors, which is a binary function with a one-dimensional value range. Generally, similarity measurement essentially refers to distance measurement, except that the numerical value is just the opposite. If it is distance, the smaller the numerical value, the closer the distance, and the greater the similarity. If it is similarity, the smaller the numerical value, the smaller the similarity, and the greater the distance. Similarity measurement is a very basic concept in machine learning, especially in clustering, recommendation system and other algorithms, so the numerical value can be obtained through similarity measurement processing to obtain the correlation matrix. The similarity measurement includes but is not limited to Euclidean distance, Manhattan distance, Chebyshev distance, Minkowski distance, standardized Euclidean distance, Mahalanobis distance, cosine of the angle, Hamming distance, Jaccard distance or Jaccard similarity coefficient, correlation coefficient or correlation distance, and information entropy.

[0060] Firstly, the alarm information is classified and aggregated through step S200 to obtain an aggregated alarm sequence with the same source IP address and different destination IP addresses, improve the availability of information, and obtain the alarm information with the same source IP address and different destination IP addresses through the aggregated alarm sequence integration, utilize the horizontal transmission characteristics of the worm attack, and standardize the output format; then the correlation matrix between the alarm information is obtained through step S300 after processing the aggregated alarm sequence, the correlation between the alarm information is quantified through the correlation matrix, the attack steps of the worm attack are facilitated to be expressed, and the attack target prediction is facilitated; finally, the correlation strength between each propagation link of the worm attack is obtained through step S400 using the correlation matrix, the next attack target of the worm attack is obtained through the correlation strength prediction, the attack steps of the worm attack can be accurately quantified and calculated through the correlation strength between the propagation links obtained through the correlation matrix, the next attack target of the worm attack can be accurately predicted through the correlation strength, and according to the accurate quantification and calculation, false positives and false negatives can be avoided, so that the prediction granularity and precision are greatly improved.

[0061] Reference Figure 2 In some embodiments of the application, the alarm information is classified and aggregated according to the source IP address and the destination IP address to obtain an aggregated alarm sequence with the same source IP address and different destination IP addresses, including:

[0062] Step S210, extracting the source IP address and the destination IP address from the alarm information.

[0063] Step S220, classifying and storing the alarm information in a hash type through a time window to obtain an aggregated alarm sequence with the same source IP address and different destination IP addresses.

[0064] It should be noted that the classified storage of the alarm information includes but is not limited to the aggregated alarm sequence with the same source IP address and different destination IP addresses, in order to better quantify the alarm information, the aggregated alarm sequence with different source IP addresses and the same destination IP address can also be obtained.

[0065] The classified storage of the alarm information through the time window and in the hash type can store the alarm information according to the time sequence and through the hash type in the redis, so that the obtained aggregated alarm sequence can reflect the path of the worm attack, and provide good data for quantifying the alarm information.

[0066] In some embodiments of the application, the calculation formula of the correlation matrix includes:

[0067] C[x][y]=similarity[w1][w2]*freq[x][y]*α+C[x][y]*β

[0068] Wherein, C[x][y] represents a correlation matrix, w1, w2 represent a time window, x, y represent two types of alarm information, freq represents a frequency, freq[x][y] represents a frequency of alarm information y appearing after alarm information x appears, and a, b represent weights.

[0069] Each alarm information is quantified by a correlation matrix calculation formula for the alarm information, a correlation matrix corresponding to the aggregated alarm sequence is formed, and the correlation between the alarm information can be accurately calculated by the correlation matrix.

[0070] Referring to Figure 3 In some embodiments of the present application, the correlation matrix is used to obtain the correlation strength of the worm attack between each propagation link, including:

[0071] In step S410, the worm attack of each propagation link corresponding to the directed graph node is determined by the correlation matrix.

[0072] In step S420, the correlation strength of the worm attack between each propagation link is calculated according to the worm attack of the directed graph node.

[0073] By abstracting each propagation link as the worm attack of the directed graph node, and calculating the correlation strength between each propagation link according to the worm attack of the directed graph node, it is convenient to analyze and find the source of the worm attack and the next target of the worm attack.

[0074] Referring to Figure 4 In some embodiments of the present application, the worm attack of each propagation link corresponding to the directed graph node is determined by the correlation matrix, including:

[0075] In step S411, the correlation strength threshold and the directed graph set are initialized.

[0076] In step S412, the alarm information with different destination IP addresses in the correlation matrix is converted into nodes.

[0077] In step S413, the directed edges between the nodes with a correlation strength greater than the correlation strength threshold are obtained by traversing the correlation matrix, and the node with an entry degree of 0 is used as the attack starting point to obtain the worm attack of the directed graph node.

[0078] It should be noted that the correlation strength threshold is set to improve the confidence of the directed graph and filter out some information corresponding to the correlation strength with low confidence.

[0079] The alarm information with different destination IP addresses is converted into nodes by the directed graph set, and the directed edges between the nodes with a correlation strength greater than the correlation strength threshold are obtained by traversing the correlation matrix, which ensures the robustness of predicting the next attack target of the worm attack and improves the confidence of the prediction.

[0080] Referring to Figure 5 In some embodiments of the present application, the next attack target of the worm attack is predicted according to the correlation strength, including:

[0081] Step S430, normalizing the correlation strength of the worm attack with the same attack starting point into a forward correlation strength; the calculation formula of the forward correlation strength includes:

[0082]

[0083] Wherein, FC[x][y] represents the forward correlation strength, and n represents the type of the destination node.

[0084] Step S440, predicting the next attack target of the worm attack through the forward correlation strength or the correlation strength.

[0085] It should be noted that the worm attack can cause many same starting points to reach multiple endpoints, so the correlation strength is normalized to obtain the forward correlation strength, which indicates the probability of the current attack link turning to the next attack. The higher the forward correlation strength, the greater the possibility of skipping this attack mode.

[0086] By normalizing the correlation strength into the forward correlation strength, the case that the worm attack can reach multiple endpoints from the same starting point can be uniformly calculated, the complexity of the calculation is reduced, the calculation efficiency is improved, and at the same time, the forward correlation strength can also prevent the path of the worm attack from being misjudged, causing a major security problem.

[0087] Referring to Figure 6 In some embodiments of the present application, after obtaining the correlation strength between each propagation link of the worm attack through the correlation matrix and predicting the next attack target of the worm attack according to the correlation strength, the internet attack prediction method further includes:

[0088] Step S500, selecting a defense means corresponding to the correlation strength according to the correlation strength; the defense means includes defense on the source IP address with the correlation strength higher than a threat threshold and defense on the predicted next attack target of the worm attack.

[0089] It should be noted that the defense on the source IP address with the correlation strength higher than the threat threshold includes all-around intrusion detection and virus killing on the high-risk host with the correlation strength higher than the threat threshold, and the defense on the predicted next attack target of the worm attack includes the edge node in the directed graph node performing defense means including discarding specific flow, discarding all specific source address flow packets, etc. according to different threat levels and the forward correlation strength.

[0090] By selecting the defense means corresponding to the correlation strength according to the correlation strength, the next attack target of the worm attack is predicted according to the correlation strength, and meanwhile, the corresponding defense means is selected according to the correlation strength, so that the safe operation of the network is ensured.

[0091] In order to facilitate the understanding of those skilled in the art, one specific embodiment of the present application provides an Internet attack prediction method, comprising:

[0092] The first step is to standardize the alarm information according to the unified output format. According to the horizontal propagation characteristics of the worm attack alarm, the aggregation method based on the source IP address or the destination IP address is used to identify the attacks from the same source to different targets or different sources to the same target. Specifically, the aggregation method is as follows:

[0093] The key information (including the source IP address and the destination IP address) of the alarm information is extracted from the data packet;

[0094] The alarm information is stored in a hash type according to a time window;

[0095] The aggregated alarm sequence is returned.

[0096] The second step is to generate a correlation matrix between the alarm information of different destination IP addresses by using the alarm correlation method of similarity measurement.

[0097] Specifically, the calculation of the correlation matrix follows the following formula:

[0098] C[x][y]=similarity[w1][w2]*freq[x][y]*α+C[x][y]*β

[0099] Wherein, C[x][y] represents the correlation matrix, w1 and w2 represent the time window, x and y represent two types of alarm information, freq represents the frequency, freq[x][y] represents the frequency of the occurrence of the alarm information y after the occurrence of the alarm information x, and alpha and beta represent the weights.

[0100] The third step is that after obtaining the correlation matrix between the alarm information of different destination IP addresses, the correlation strength from one propagation link to another propagation link can be obtained, and each propagation link is abstracted as a worm attack to a directed graph node.

[0101] Specifically, the implementation manner of obtaining the correlation strength from one propagation link to another propagation link, and each propagation link being abstracted as a worm attack to a directed graph node is as follows:

[0102] Initialize the correlation strength threshold and the directed graph set;

[0103] The alarm information with different destination IP addresses in the correlation matrix is converted into nodes;

[0104] The directed edges between the nodes with the correlation strength greater than the correlation strength threshold are obtained by traversing the correlation matrix, and the nodes with the in-degree of 0 are used as the attack starting points to obtain the directed graph nodes of the worm attack.

[0105] In the fourth step, the correlation strength between each propagation link of the worm attack is obtained by the correlation matrix, and the next attack target of the worm attack is predicted according to the correlation strength. Specifically, the next attack target of the worm attack is predicted according to the correlation strength, including:

[0106] The correlation strength of the worm attack with the same attack starting point is normalized as a forward correlation strength; the calculation formula of the forward correlation strength includes:

[0107]

[0108] Wherein, FC[x][y] represents the forward correlation strength, and n represents the type of the destination node.

[0109] The next attack target of the worm attack is predicted by the forward correlation strength or the correlation strength.

[0110] Meanwhile, the defense means corresponding to the correlation strength is selected according to the correlation strength, the source IP address with large correlation strength is a high-risk host, the all-round intrusion detection and virus killing are performed on the host of this type, and the edge nodes in the directed graph nodes are subjected to the defense means including discarding specific flow, discarding all specific source address flow packets and the like according to different threat levels.

[0111] Referring to Figure 7 An embodiment of the present application further provides an Internet attack prediction system, which comprises an alarm information acquisition module 1001, an alarm information classification and aggregation module 1002, a correlation matrix conversion module 1003 and an attack prediction module 1004, wherein:

[0112] The alarm information acquisition module 1001 is used for acquiring the alarm information of the worm attack.

[0113] The alarm information classification and aggregation module 1002 is used for classifying and aggregating according to the source IP address and the destination IP address of the alarm information to obtain an aggregated alarm sequence with the same source IP address but different destination IP addresses.

[0114] The correlation matrix conversion module 1003 is used for converting the aggregated alarm sequence into a correlation matrix between the alarm information with different destination IP addresses by a similarity measurement method.

[0115] The attack prediction module 1004 is used for obtaining the correlation strength between each propagation link of the worm attack by the correlation matrix, and predicting the next attack target of the worm attack according to the correlation strength.

[0116] It should be noted that since the internet attack prediction system in this embodiment and the above-mentioned internet attack prediction method are based on the same inventive concept, the corresponding contents in the method embodiment are also applicable to the device embodiment, which will not be described in detail here.

[0117] Reference Figure 8 Another embodiment of the present application also provides an electronic device 6000, which can be any type of intelligent terminal, such as a mobile phone, a tablet computer, a personal computer, etc.

[0118] Specifically, the electronic device 6000 includes one or more control processors 6001 and a memory 6002, Figure 8 For example, the control processor 6001 and the memory 6002 can be connected through a bus or other means, Figure 8 For example, by connecting through a bus.

[0119] The memory 6002 as a non-transitory computer readable storage medium can be used to store non-transitory software programs, non-transitory computer executable programs and modules, such as program instructions / modules corresponding to the electronic device in the embodiment of the present application.

[0120] The control processor 6001 executes various functions and data processing of the internet attack prediction method by running the non-transitory software programs, instructions and modules stored in the memory 6002, that is, implements the internet attack prediction method of the above-mentioned method embodiment.

[0121] The memory 6002 can include a program storage area and a data storage area, wherein the program storage area can store an operating system and at least one application required by a function; the data storage area can store data created by the use of the internet attack prediction method, etc. In addition, the memory 6002 can include a high-speed random access memory, and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory 6002 can optionally include a memory remotely arranged with respect to the control processor 6001, and these remote memories can be connected to the electronic device 6000 through a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0122] When one or more modules are stored in the memory 6002 and executed by the one or more control processors 6001, the internet attack prediction method of the above-mentioned method embodiment is executed, such as the method steps of Figures 1 to 6 described above.

[0123] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0124] It should be noted that since the electronic device in this embodiment is based on the same inventive concept as the Internet attack prediction method described above, the corresponding content in the method embodiment is also applicable to this device embodiment, and will not be described in detail here.

[0125] In one embodiment of the present invention, a computer-readable storage medium is also provided, storing computer-executable instructions for performing: the Internet attack prediction method as described in the above embodiment.

[0126] It should be noted that since the computer-readable storage medium in this embodiment is based on the same inventive concept as the Internet attack prediction method described above, the corresponding content in the method embodiment is also applicable to this device embodiment, and will not be described in detail here.

[0127] Those skilled in the art will understand that all or some of the steps and systems in the methods disclosed above can be implemented as software, firmware, hardware, and suitable combinations thereof. Some or all of the physical components can be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, which can include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing data (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired data and is accessible to a computer. Furthermore, as is known to those skilled in the art, communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any data delivery medium.

[0128] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "illustrative embodiment," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0129] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

Claims

1. An Internet attack prediction method characterized by, The Internet attack prediction method comprises: obtaining alarm information of a worm attack; classifying and aggregating the alarm information according to source IP addresses and destination IP addresses of the alarm information to obtain aggregated alarm sequences with the same source IP addresses but different destination IP addresses; performing similarity measurement on the aggregated alarm sequences to obtain a correlation matrix between the alarm information with different destination IP addresses; obtaining correlation strength between each propagation link of the worm attack through the correlation matrix, and predicting a next attack target of the worm attack according to the correlation strength; the method of obtaining the correlation strength between each propagation link of the worm attack through the correlation matrix comprises: determining worm attacks of directed graph nodes corresponding to each propagation link through the correlation matrix; calculating the correlation strength between each propagation link of the worm attack according to the worm attacks of the directed graph nodes; the method of determining the worm attacks of the directed graph nodes corresponding to each propagation link through the correlation matrix comprises: initializing a correlation strength threshold and a directed graph set; converting the alarm information with different destination IP addresses in the correlation matrix into nodes; obtaining directed edges between nodes with the correlation strength greater than the correlation strength threshold through the correlation matrix, and using a node with an entry degree of 0 as an attack starting point to obtain the worm attacks of the directed graph nodes. 2.The Internet attack prediction method of claim 1, wherein, the method of classifying and aggregating the alarm information according to source IP addresses and destination IP addresses of the alarm information to obtain aggregated alarm sequences with the same source IP addresses but different destination IP addresses comprises: extracting source IP addresses and destination IP addresses from the alarm information; classifying and storing the alarm information in a hash type through a time window to obtain aggregated alarm sequences with the same source IP addresses but different destination IP addresses. 3.The Internet attack prediction method of claim 1, wherein, the calculation formula of the correlation matrix comprises: wherein, denotes a correlation matrix, denotes a time window, denotes two types of alarm information, denotes a frequency of occurrence, denotes alarm information occurrence, a frequency of occurrence, denotes a weight.

4. The Internet attack prediction method of claim 3, wherein, the method of predicting a next attack target of the worm attack according to the correlation strength comprises: normalizing the correlation strength of the worm attack with the same attack starting point into forward correlation strength; predicting the next attack target of the worm attack through the forward correlation strength or the correlation strength. 5.The Internet attack prediction method of claim 1, wherein, after the method of obtaining the correlation strength between each propagation link of the worm attack through the correlation matrix, and predicting a next attack target of the worm attack according to the correlation strength, the Internet attack prediction method further comprises: selecting a defense means corresponding to the correlation strength according to the correlation strength; the defense means comprises defense for a source IP address with a correlation strength higher than a threat threshold and defense for predicting a next attack target of the worm attack.

6. An internet attack prediction system characterized by, the Internet attack prediction system comprises: an alarm information obtaining module for obtaining alarm information of a worm attack; an alarm information classifying and aggregating module for classifying and aggregating the alarm information according to source IP addresses and destination IP addresses of the alarm information to obtain aggregated alarm sequences with the same source IP addresses but different destination IP addresses; a correlation matrix conversion module for converting the aggregated alarm sequences into a correlation matrix between the alarm information with different destination IP addresses through a similarity measurement method; The attack prediction module is configured to obtain the correlation strength between each propagation link of the worm attack through the correlation matrix, and predict the next attack target of the worm attack according to the correlation strength. The obtaining the correlation strength between each propagation link of the worm attack through the correlation matrix comprises: determining the worm attack of the directed graph node corresponding to each propagation link through the correlation matrix; calculating the correlation strength between each propagation link of the worm attack according to the worm attack of the directed graph node; The determining the worm attack of the directed graph node corresponding to each propagation link through the correlation matrix comprises: initializing a correlation strength threshold and a directed graph set; converting the alarm information with different destination IP addresses in the correlation matrix into nodes; traversing the correlation matrix to obtain directed edges between nodes with a correlation strength greater than the correlation strength threshold, and using a node with an entry degree of 0 as an attack starting point to obtain the worm attack of the directed graph node.

7. An electronic device, comprising: The computer readable storage medium stores computer executable instructions for causing a computer to perform the internet attack prediction method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that: The computer readable storage medium stores computer executable instructions for causing a computer to perform the internet attack prediction method according to any one of claims 1 to 5.

Images