Complex network attack detection method, system, electronic device and storage medium

Abstract

The present application discloses a complex network attack detection method, system, electronic device and storage medium, which relates to the field of network security technology. By obtaining the alarm information to be detected, extracting its key information to generate an MDATA to-be-matched node, the key information includes address features and time features, and the MDATA to-be-matched node includes an address entity generated according to the address features and a time entity generated according to the time features, and then matching the MDATA to-be-matched node with the MDATA subgraph in the MDATA graph database. If the match is successful, the MDATA to-be-matched node is set as a matching node and added to the attack sequence. By continuously obtaining the alarm information to be detected, repeating the above process until the preset conditions are met, the corresponding complex network attack is output according to the attack sequence. Thus, by obtaining alarms in real time, an MDATA to-be-matched node with spatiotemporal features is generated, and matched with the MDATA graph database, false alarms are effectively eliminated, and the detection speed and accuracy of complex network attacks are improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a complex network attack detection method, system, electronic device and storage medium. Background Art

[0002] A complex network attack refers to an attack method that uses multiple attack means and techniques, consisting of a series of logically related basic attack behaviors, to deeply penetrate and destroy the network. Its attack means and techniques are diverse and complex, highly concealed, highly destructive, and have a wide range of threats. It has become one of the main forms of network attacks.

[0003] In related technologies, detection of complex network attacks is typically based on correlation analysis, such as machine learning-based methods and provenance graph-based methods. However, machine learning-based methods lack interpretability and cannot effectively explain false alarms. Provenance graph-based methods primarily rely on host audit logs, making it difficult to integrate multi-dimensional information for effective detection. This results in low accuracy and slow detection of complex network attacks. Summary of the Invention

[0004] The present application aims to solve at least one of the technical problems existing in the prior art. To this end, the embodiments of the present application provide a complex network attack detection method, system, electronic device, and storage medium that can quickly detect and match in an MDATA graph database, thereby effectively eliminating false alarms and improving the detection speed and accuracy of complex network attacks.

[0005] In a first aspect, an embodiment of the present application provides a complex network attack detection method, comprising:

[0006] Acquire alarm information to be detected, and extract key information for constructing an MDATA graph from the alarm information, wherein the key information includes address features and time features;

[0007] Generate an MDATA to-be-matched node based on the key information, the MDATA to-be-matched node including an address entity and a time entity; wherein the address feature is used to generate the address entity, and the time feature is used to generate the time entity;

[0008] Matching the MDATA node to be matched with an MDATA subgraph in an MDATA graph database; wherein the MDATA graph database includes at least one MDATA subgraph; the MDATA subgraph includes a plurality of nodes, and there is a temporal feature relationship and a spatial feature relationship between each of the nodes, so that the MDATA subgraph is used to characterize the spatiotemporal rules of a complex network attack;

[0009] If the match is successful, the MDATA to-be-matched node is set as a matching node, and the matching node is added to the attack sequence;

[0010] Get the next alarm information to be detected and repeat the above process until the preset conditions are met;

[0011] Based on the attack sequence, the complex network attack is output.

[0012] In some embodiments of the present application, before obtaining the alarm information to be detected, the process further includes:

[0013] Build the MDATA graph database, including:

[0014] Acquire preset data from a preset data source; the preset data source includes a security knowledge base and a vulnerability database, and the preset data includes security knowledge data and vulnerability data;

[0015] Preprocessing the preset data to obtain spatiotemporal rules corresponding to various complex network attacks; the spatiotemporal rules include multiple attack steps, and the attack steps include attack address features and attack time features;

[0016] Based on each of the spatiotemporal rules, construct the MDATA subgraph corresponding to each of the complex network attacks;

[0017] Multiple MDATA subgraphs are merged to construct the MDATA graph database.

[0018] In some embodiments of the present application, the attack step further includes behavioral attributes, an attack space feature relationship exists between the multiple attack address features, and an attack time feature relationship exists between the multiple attack time features; and constructing the MDATA subgraph corresponding to each complex network attack based on each of the spatiotemporal rules includes:

[0019] Generating an attack time entity according to the attack time characteristics;

[0020] Generate an attack address entity according to the attack address feature, wherein the attack address feature includes an attack source address and / or an attack destination address, and correspondingly, the attack address entity includes an attack source address entity and / or an attack destination address entity;

[0021] Setting a relationship connection edge to connect the attack time entity and the attack address entity;

[0022] Generate nodes of the MDATA subgraph based on the attack time entity, the attack address entity, the relationship connection edge and the behavior attribute;

[0023] Based on the attack time characteristic relationship and the attack space characteristic relationship, each of the nodes is linked to construct the MDATA subgraph corresponding to the complex network attack.

[0024] In some embodiments of the present application, the key information further includes attack attributes; and generating an MDATA node to be matched based on the key information includes:

[0025] Generating the time entity accordingly according to the time feature;

[0026] Generate the address entity according to the address feature, the address feature including the first attack address and / or the second attack address, and correspondingly, the address entity includes the first attack address entity and / or the second attack address entity;

[0027] Setting an attack connection edge to connect the time entity and the address entity;

[0028] Based on the time entity, the address entity, the attack connection edge and the attack attribute, the MDATA node to be matched is generated.

[0029] In some embodiments of the present application, matching the MDATA to-be-matched node with an MDATA subgraph in an MDATA graph database includes:

[0030] Determine whether the MDATA node to be matched is the first node of the MDATA subgraph in the MDATA graph database;

[0031] If the MDATA node to be matched is the first node of the MDATA subgraph, the match is successful; otherwise, it is determined whether the MDATA node to be matched is the subsequent node of the matching node in the attack sequence;

[0032] If the MDATA node to be matched is the subsequent node of the matching node, the match is successful; otherwise, the match fails.

[0033] In some embodiments of the present application, the MDATA node to be matched includes an attack connection edge and an attack attribute, and each node of the MDATA subgraph includes a relationship connection edge and a behavior attribute; and determining whether the MDATA node to be matched is the first node of the MDATA subgraph in the MDATA graph database includes:

[0034] Based on the MDATA graph database, query whether the attack connection edge of the MDATA to-be-matched node matches the relationship connection edge of the first node of the MDATA subgraph;

[0035] Based on the MDATA graph database, query whether the attack attribute of the MDATA node to be matched matches the behavior attribute of the first node of the MDATA subgraph;

[0036] If the attack connection edge and the attack attribute of the MDATA node to be matched match the relationship connection edge and the behavior attribute of the first node of the MDATA subgraph, the MDATA node to be matched is judged to be the first node of the MDATA subgraph.

[0037] In some embodiments of the present application, determining whether the MDATA to-be-matched node is a subsequent node of the matching node in the attack sequence includes:

[0038] Determine whether the MDATA to-be-matched node and the matching node in the attack sequence satisfy a time characteristic relationship;

[0039] Determine whether the MDATA to-be-matched node and the matching node in the attack sequence satisfy a spatial feature relationship;

[0040] If the time feature relationship and the space feature relationship are satisfied at the same time, the MDATA node to be matched is determined to be the post-node of the matching node.

[0041] In some embodiments of the present application, the matching node includes an attack connection edge and an attack attribute, and each of the nodes of the MDATA subgraph includes a relationship connection edge and a behavior attribute; the preset condition includes that the matching node is the tail node of the MDATA subgraph in the MDATA graph database;

[0042] The predetermined conditions are met, including:

[0043] Based on the MDATA graph database, query whether the attack connection edge of the matching node in the attack sequence matches the relationship connection edge of the tail node of the MDATA subgraph;

[0044] Based on the MDATA graph database, query whether the attack attribute of the matching node in the attack sequence matches the behavior attribute of the tail node of the MDATA subgraph;

[0045] If the attack connection edge and the attack attribute of the matching node match the relationship connection edge and the behavior attribute of the tail node of the MDATA subgraph, the matching node is determined to be the tail node of the MDATA subgraph.

[0046] In some embodiments of the present application, outputting the complex network attack based on the attack sequence includes:

[0047] Linking the matching nodes in the attack sequence in a storage order so that the temporal feature relationship and the spatial feature relationship are satisfied between the matching nodes, thereby obtaining the corresponding MDATA subgraph;

[0048] Obtain and output the complex network attack corresponding to the MDATA subgraph.

[0049] In some embodiments of the present application, the temporal characteristic relationship is the order of attack times of each of the nodes in the MDATA subgraph, and the spatial characteristic relationship is the order of change of attack addresses of each of the nodes in the MDATA subgraph.

[0050] In some embodiments of the present application, obtaining the alarm information to be detected includes:

[0051] Obtain alarm generation signal;

[0052] In response to an alarm generation signal, obtaining corresponding alarm information from a work log corresponding to the alarm as the alarm information to be detected;

[0053] The obtaining of the next alarm information to be detected includes:

[0054] Get the next alarm generation signal;

[0055] In response to the next alarm generation signal, corresponding alarm information is obtained from the work log corresponding to the alarm as the next alarm information to be detected.

[0056] In some embodiments of the present application, the preset condition includes reaching a preset time length;

[0057] The method further comprises:

[0058] After the MDATA to-be-matched node is set as a matching node, a timer is started to count, and the timer is restarted when the next MDATA to-be-matched node is set as a matching node;

[0059] The predetermined conditions are met, including:

[0060] When the timing reaches the preset duration, the complex network attack is output according to the attack sequence.

[0061] In some embodiments of the present application, the preset duration is pre-set in the following manner:

[0062] Acquire a sample attack set, where the sample attack set includes multiple sample attacks, and each sample attack includes multiple attack steps;

[0063] Obtaining the time interval between each adjacent step in each sample attack;

[0064] calculating an average of a plurality of said time intervals;

[0065] The preset duration is determined based on the average value and the first coefficient.

[0066] In a second aspect, an embodiment of the present application further provides a complex network attack detection system, which applies the complex network attack detection method described in the embodiment of the first aspect of the present application, including:

[0067] An alarm module is used to obtain alarm information to be detected and extract key information for constructing an MDATA graph from the alarm information, wherein the key information includes address features and time features;

[0068] A node generation module is used to generate an MDATA to-be-matched node based on the key information, wherein the MDATA to-be-matched node includes an address entity and a time entity; wherein the address feature is used to generate the address entity, and the time feature is used to generate the time entity;

[0069] A node matching module is used to match the MDATA to-be-matched node with an MDATA subgraph in an MDATA graph database; wherein the MDATA graph database includes at least one MDATA subgraph; the MDATA subgraph includes a plurality of nodes, and there is a temporal feature relationship and a spatial feature relationship between each of the nodes, so that the MDATA subgraph is used to characterize the spatiotemporal rules of a complex network attack;

[0070] A node processing module is used to set the MDATA to-be-matched node as a matching node when the MDATA to-be-matched node is successfully matched, and to add the matching node to the attack sequence.

[0071] The attack output module is used to output the complex network attack based on the attack sequence when a preset condition is met.

[0072] In a third aspect, an embodiment of the present application further provides an electronic device comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the complex network attack detection method as described in the embodiment of the first aspect of the present application is implemented.

[0073] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, wherein the storage medium stores a program, and the program is executed by a processor to implement the complex network attack detection method as described in the embodiment of the first aspect of the present application.

[0074] The embodiments of the present application include at least the following beneficial effects:

[0075] The embodiments of the present application provide a complex network attack detection method, system, electronic device and storage medium, which generates an MDATA to-be-matched node by acquiring alarm information to be detected and extracting key information in the alarm information, wherein the key information includes address features and time features, and the MDATA to-be-matched node includes an address entity generated according to the address features and a time entity generated according to the time features, and then matches the MDATA to-be-matched node with an MDATA subgraph in an MDATA graph database, wherein the MDATA graph database includes at least one MDATA subgraph, and the MDATA subgraph includes multiple nodes, and there is a time feature relationship and a spatial feature relationship between each node, so that the MDATA subgraph represents the spatiotemporal rules of a complex network attack. If the MDATA to-be-matched node successfully matches the MDATA subgraph of the MDATA graph database, the MDATA to-be-matched node is set as a matching node and added to the attack sequence, and the above process is repeated by continuously acquiring alarm information to be detected until the preset conditions are met, and the corresponding complex network attack is output according to the attack sequence. In this way, alarms can be obtained in real time. By generating MDATA matching nodes with time characteristics and spatial characteristics and matching them with the MDATA graph database with time feature relationships and spatial feature relationships, false alarms can be effectively eliminated and the detection speed and accuracy of complex network attacks can be improved.

[0076] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become obvious from the description below, or will be learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0078] Figure 1 This is a flow chart of a complex network detection method provided by an embodiment of the present application;

[0079] Figure 2 This is a schematic diagram of an MDATA node to be matched provided by an embodiment of the present application;

[0080] Figure 3 This is a schematic diagram of a complex network attack provided by an embodiment of the present application;

[0081] Figure 4 This is a schematic diagram of a complex network attack MDATA diagram provided by an embodiment of the present application;

[0082] Figure 5 yes Figure 1 Flowchart before step S101;

[0083] Figure 6 yes Figure 5 Flow diagram of step S203;

[0084] Figure 7 This is a schematic diagram of the attack time characteristic relationship provided by an embodiment of the present application;

[0085] Figure 8 This is a schematic diagram of the attack space feature relationship provided by an embodiment of the present application;

[0086] Figure 9 This is a schematic diagram of an MDATA subgraph provided by an embodiment of the present application;

[0087] Figure 10 yes Figure 1 Flow diagram of step S102;

[0088] Figure 11 yes Figure 1 Flow diagram of step S103;

[0089] Figure 12 yes Figure 1 Flow diagram of step S101;

[0090] Figure 13 This is a flow chart of complex network attack detection provided by one embodiment of the present application;

[0091] Figure 14 This is a real-time attack diagram provided by an embodiment of the present application;

[0092] Figure 15 This is a schematic diagram of a complex network detection system module provided by an embodiment of the present application;

[0093] Figure 16 This is a schematic diagram of the structure of an electronic device provided by an embodiment of the present application.

[0094] Reference numerals: alarm module 100 , node generation module 200 , node matching module 300 , node processing module 400 , attack output module 500 , electronic device 1000 , processor 1001 , memory 1002 . DETAILED DESCRIPTION

[0095] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0096] The following describes in detail embodiments of the present application. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application and are not to be construed as limiting the present application.

[0097] In the description of this application, it should be understood that descriptions involving orientations, such as up, down, front, back, left, right, etc., indicating orientations or positional relationships, are based on the orientations or positional relationships shown in the accompanying drawings. They are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation. Therefore, they cannot be understood as limitations on this application.

[0098] In the description of this application, "several" means one or more, "many" means more than two, "greater than," "less than," and "exceed" are understood to exclude the number itself, while "above," "below," and "within" are understood to include the number itself. The terms "first" and "second" are used solely to distinguish technical features and are not to be construed as indicating or implying relative importance, or as implicitly specifying the number or order of the technical features indicated.

[0099] In the description of this application, unless otherwise clearly defined, terms such as setting, installing, and connecting should be understood in a broad sense, and technicians in the relevant technical field can reasonably determine the specific meanings of the above terms in this application based on the specific content of the technical solution.

[0100] In order to better understand the technical solutions provided by this application, the terms appearing in this document are explained accordingly:

[0101] MDATA: Multidimensional Data Association and Telligent Analysis (MDATA) is a model that can represent spatiotemporal characteristics and dynamic knowledge.

[0102] IDS: An Intrusion Detection System (IDS) is a security device used to monitor security events within networks and systems and detect possible intrusions. An IDS device can be considered a security defense line that detects and reports potential security threats, helping administrators take timely action to address them.

[0103] Source IP Address: (Source IP Address) refers to the network address of the device or host that initiates communication. It is used to identify the source of the communication data packet and is usually a 32-bit IP address.

[0104] Destination IP Address: (Destination IP Address) refers to the network address of the device or host that receives the communication data packet. It is used to identify the destination of the communication data packet and is usually a 32-bit IP address.

[0105] Complex network attacks utilize multiple attack methods and techniques, consisting of a series of logically related basic attack behaviors, to deeply penetrate and damage a network. These diverse and complex attack methods and techniques are highly concealed, destructive, and pose a wide threat, making them a major form of cyberattack. Discovering the inherent connections between complex network attacks and identifying their attack intent is crucial for detecting complex network attacks and serves as the foundation for establishing large-scale network defense and early warning mechanisms.

[0106] Among related technologies, most complex network attack detection techniques are based on correlation analysis, which detects attacks based on the different relationships between them. Correlation analysis can be categorized into machine learning-based methods and provenance graph-based methods. Machine learning-based methods lack interpretability and cannot effectively explain false alarms. Provenance graph-based methods rely primarily on host audit logs, making it difficult to integrate multi-dimensional information for effective detection. This results in low accuracy and slow detection of complex network attacks. In contrast, existing knowledge representation models, such as knowledge graphs, offer excellent interpretability, and the temporal and spatial characteristics between complex network attacks can theoretically be used to analyze the correlations between the underlying attacks and thereby complete detection.

[0107] Based on this, the embodiment of the present application provides a complex network attack detection method, system, electronic device and storage medium, which can generate an MDATA to-be-matched node by obtaining the alarm information to be detected and extracting the key information in the alarm information, wherein the key information includes address features and time features, and the MDATA to-be-matched node includes an address entity generated according to the address features and a time entity generated according to the time features, and then the MDATA to-be-matched node is matched with the MDATA subgraph in the MDATA graph database. If the MDATA to-be-matched node successfully matches the MDATA subgraph of the MDATA graph database, the MDATA to-be-matched node is set as a matching node and added to the attack sequence. By continuously obtaining the alarm information to be detected, repeating the above process until the preset conditions are met, the corresponding complex network attack is output according to the attack sequence. In this way, alarms can be obtained in real time, and by generating an MDATA to-be-matched node with time features and spatial features, and matching it with the MDATA graph database, false alarms can be effectively removed, thereby improving the detection speed and accuracy of complex network attacks.

[0108] The embodiments of the present invention provide a complex network attack detection method, system, electronic device, and storage medium, which are specifically described through the following embodiments. First, the complex network attack detection method in the embodiments of the present invention is described.

[0109] The complex network attack detection method provided by the embodiment of the present invention relates to the field of network security technology, and in particular to the field of network attack and defense technology. The complex network attack detection method provided by the embodiment of the present invention can be applied to a terminal, can be applied to a server side, and can also be a computer program running in a terminal or a server side. For example, a computer program can be a native program or software module in an operating system; it can be a local (Native) application (APP, Application), that is, a program that needs to be installed in the operating system before it can run, such as a client that supports the generation of network attack rule maps, that is, a program that can be run only by downloading it into a browser environment. In short, the above-mentioned computer program can be any form of application, module or plug-in. Among them, the terminal communicates with the server through a network. The network attack rule map generation method can be executed by the terminal or the server, or by the terminal and the server in collaboration.

[0110] In some embodiments, the terminal can be a smartphone, tablet computer, laptop computer, desktop computer, or smartwatch. The server can be an independent server, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms; it can also be a service node in a blockchain system, where each service node in the blockchain system forms a peer-to-peer (P2P) network. The P2P protocol is an application layer protocol running on top of the Transmission Control Protocol (TCP). The server can be installed with a server end of a complex network attack detection system, through which the terminal can interact. For example, the server end can be installed with corresponding software, and the software can be an application that implements a complex network attack detection method, etc., but is not limited to the above forms. The terminal and the server can be connected via a communication connection method such as Bluetooth, USB (Universal Serial Bus), or a network, which is not limited in this embodiment.

[0111] The present invention can be used in a wide variety of general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, and the like. The present invention can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present invention can also be practiced in distributed computing environments in which tasks are performed by remote processing devices connected via a communications network. In a distributed computing environment, program modules can be located in local and remote computer storage media, including storage devices.

[0112] The following describes a complex network attack detection method in an embodiment of the present invention.

[0113] Figure 1 This is an optional flowchart of the network attack rule graph generation method provided by an embodiment of the present invention. Figure 1 The method may include but is not limited to steps S101 to S106. Figure 1 The order of step S101 to step S106 is not specifically limited, and the order of steps can be adjusted or some steps can be reduced or added according to actual needs.

[0114] Step S101, obtain the alarm information to be detected, and extract the key information used to construct the MDATA graph from the alarm information.

[0115] It is understood that network attack alerts are typically automatically generated by security devices or security software. These devices or software monitor network traffic, system logs, security events, and so on, automatically triggering alerts upon detecting unusual behavior or malicious attacks. Examples include network device alerts, such as firewalls and intrusion detection systems, which monitor network traffic and generate alerts upon detecting unusual or attacking traffic; host security software alerts, such as antivirus software and intrusion detection software, which monitor host system logs, processes, and files and generate alerts upon detecting unusual behavior or malicious attacks; and user-reported alerts. While some security incidents may not be easily detected automatically, users may discover unusual behavior or malicious attacks and report them to security personnel, who will then investigate and generate alerts.

[0116] In some embodiments, after an IDS device generates an alarm, the alarm information to be detected is obtained and key information for constructing an MDATA graph is extracted from the alarm information. The key information includes address features and time features. For example, the alarm information to be detected is as follows:

[0117] Alarm level: High

[0118] Alert content: A malicious IP address was found attempting a DDoS attack. The target IP address was 192.168.1.100, and the attack timestamp was 13:45:00 on June 1, 2021.

[0119] Alarm time: June 1, 2021, 13:45:30

[0120] Alarm source: Intrusion Detection System

[0121] Source IP address: 203.0.113.1

[0122] Destination IP address: 192.168.1.100

[0123] Attack timestamp: June 1, 2021, 13:45:00

[0124] In some embodiments, the key information extracted from the warning information by the code program is as follows:

[0125] "src":203.0.113.1

[0126] "dst":192.168.1.100

[0127] "time": June 1, 2021, 1:45:00 PM

[0128] It can be understood that the time feature is the attack timestamp; the address feature may include the source IP address and destination IP address of the attack, or may include the source IP address, source port number, destination IP address and destination port number of the attack, etc. This embodiment does not limit this.

[0129] In some embodiments, the MDATA graph is a knowledge graph represented based on the MDATA model, and the knowledge graph is a graph-based data structure composed of nodes (Point) and edges (Edge). In the knowledge graph, each node represents an "entity" that exists in the real world, and each edge is a "relationship" between entities. Binary relationship facts in the knowledge graph are usually represented as triples, namely (head entity, relationship, tail entity). Based on the knowledge graph, the MDATA model also implements the entity representation of time and space, enhancing the representation ability of the knowledge graph. Specifically, the MDATA graph can take the attack steps as entities, the time features and the temporal relationship between the steps as entities, and the address features as entities. For example, the source IP address can be used as an entity, the destination IP address can be used as an entity, and both the source IP address and the destination IP address can be used as entities. Then, a relationship edge is constructed based on the relationship between the attack steps and the time features, a relationship edge is constructed based on the relationship between the attack steps and the address features, and a relationship edge is constructed based on the spatial relationship between the addresses, thereby forming an MDATA graph. This helps to more intuitively present the temporal and spatial relationships between attack steps, and at the same time helps to more quickly search and match attack steps.

[0130] Step S102: Generate an MDATA node to be matched based on key information. The MDATA node to be matched includes an address entity and a time entity.

[0131] In some embodiments, a time entity of the MDATA node to be matched is generated based on the time characteristics in the key information; an address entity of the MDATA node to be matched is generated based on the address characteristics in the key information. For example, the attack timestamp can be used as a time entity, the source IP address of the attack as an address entity, and the destination IP address of the attack as another address entity, etc. This embodiment does not limit this.

[0132] In some embodiments, different entities are linked to form MDATA nodes to be matched. Figure 2 The schematic diagram of the MDATA node to be matched is shown. An MDATA node to be matched includes the time entity t of the attack timestamp, the address entity dst of the attack destination IP address, and the entity step a of the attack step, wherein the attack source IP address can be used as an attribute of step a and associated with the entity step a. Specifically, the attack source IP address initiates a network attack on the attack destination IP address. Correspondingly, the entity step a where the attack source IP address is located is pointed to the address entity dst of the attack destination IP address and is linked to the time entity t corresponding to the attack timestamp, thereby generating an MDATA node to be matched. This embodiment does not impose any restrictions on this.

[0133] Step S103: Match the MDATA node to be matched with the MDATA subgraph in the MDATA graph database.

[0134] In some embodiments, an MDATA graph database includes at least one MDATA subgraph, wherein an MDATA subgraph includes multiple nodes, and temporal and spatial characteristic relationships exist between the nodes, so that an MDATA subgraph can be used to characterize the spatiotemporal rules of a complex network attack. Therefore, the MDATA graph database includes at least one spatiotemporal rule of a complex network attack, thereby converting the spatiotemporal rules of a complex network attack into an MDATA subgraph representation, and utilizing methods such as distributed graph computing to facilitate improving the detection speed of complex network attacks.

[0135] In some embodiments, the temporal feature relationship is the chronological order of attack times for each node in the MDATA subgraph, and the spatial feature relationship is the order in which the attack addresses of each node in the MDATA subgraph change. It is understood that a complex network attack typically includes multiple attack steps, and there is a chronological order of attack times and a change relationship of attack addresses between different attack steps. This can be used as the temporal feature relationship and spatial feature relationship for each node in the MDATA subgraph.

[0136] For example, refer to Figure 3 The following is a diagram of a complex network attack, which is carried out by the "Night Dragon" APT. The diagram includes three host servers: the attacker, the web server, and the sensitive host. The "Night Dragon" APT includes five attack steps:

[0137] Step 1: Compromise the web server using SQL injection attacks

[0138] Step 2: Scanning and detection – scanning sensitive hosts and servers;

[0139] Step 3: Attack and break through - use weak passwords to attack and crack;

[0140] Step 4: Install control - install remote control tools;

[0141] Step 5: Resource theft – returning a large number of sensitive files.

[0142] Specifically, there is a time characteristic relationship between the various attack steps of the "Night Dragon" APT attack: step 1.t < step 2.t < step 3.t < step 4.t < step 5.t, that is, the execution order of the attack steps is step 1, step 2, step 3, step 4, step 5; there is a spatial characteristic relationship between the various attack steps of the "Night Dragon" APT attack: the attack source address 1.src of step 1 = the attack source address 2.src of step 2, the attack destination address 1.dst of step 1 = the attack destination address 2.dst of step 2, the attack destination address 2.dst of step 2 = the attack source address 3.src of step 3, the attack destination address 3.dst of step 3 = the attack source address 4.src of step 4, the attack source address 4.src of step 4 = the attack destination address 4.dst of step 4, the attack destination address 4.dst of step 4 = the attack source address 5.src of step 5, and the attack destination address 5.dst of step 5 = the attack source address 1.src of step 1. It is understandable that some of the above IP addresses may be disguised IP addresses.

[0143] Step S104: If the match is successful, the MDATA to-be-matched node is set as the matching node, and the matching node is added to the attack sequence.

[0144] In some embodiments, if the MDATA node to be matched successfully matches the MDATA subgraph in the MDATA graph database, that is, the MDATA node to be matched belongs to the attack step of the complex network attack, then the MDATA node to be matched is set as a matching node, and the matching node is added to the attack sequence. Exemplarily, the matching nodes in the attack sequence already include step 1 and step 2 in the "Night Dragon" APT attack. If it is detected as step 3 at this time, the match is successful. If it is detected as step 2 or step 5, the match fails. This embodiment is only an example. It can be understood that the attack sequence is used to store multiple matching nodes. The attack sequence can be represented as a set of ordered steps or operations, or as an MDATA graph, where each matching node represents an attack step. This embodiment does not limit this.

[0145] In some embodiments, if the MDATA node to be matched fails to match the MDATA subgraph in the MDATA graph database, that is, the MDATA node to be matched does not belong to the attack step of the complex network attack, then the MDATA node to be matched is discarded, thereby effectively removing a large number of false alarms generated by the IDS device, which is conducive to improving the accuracy of complex network attack detection.

[0146] Step S105: Acquire the next alarm information to be detected and repeat the above process until the preset conditions are met.

[0147] In some embodiments, a complex network attack typically includes multiple attack steps, and thus an MDATA subgraph in the MDATA graph database also includes multiple nodes. Exemplarily, a complex network attack A includes seven attack steps. At this time, there are three nodes in the MDATA subgraph that are successfully matched, and complex network attack A has not yet been constituted. It is necessary to continue waiting and obtain the next alarm information to be detected, and repeat the above process until the matching node corresponding to the seventh attack step is detected. Only then does complex network attack A constitute. That is, the preset condition is to match the tail node of the MDATA subgraph, and this embodiment does not impose any restrictions on this.

[0148] Step S106: output complex network attacks based on the attack sequence.

[0149] In some embodiments, after meeting the preset conditions, each matching node stored in the attack sequence is used as each attack step of the complex network attack, and the corresponding complex network attack is output. Specifically, each matching node in the attack sequence is linked in the order of storage, so that the time feature relationship and the spatial feature relationship are satisfied between each matching node, thereby obtaining the corresponding MDATA subgraph, and then obtaining and outputting the complex network attack corresponding to the MDATA subgraph. For example, referring to Figure 4 The following diagram shows an MDATA graph for a complex network attack. If a matching node is detected for step 5 of the "Night Dragon" APT attack and matches the matching nodes corresponding to the first four steps in the attack sequence, the matching nodes are linked in storage order to obtain the corresponding MDATA subgraph. The nodes satisfy the temporal and spatial characteristic relationships of the "Night Dragon" APT. This completes the detection of a complex network attack. By matching the graph database, the detection speed of complex network attacks is effectively improved, and the false alarms generated by a large number of IDS devices are eliminated, improving detection accuracy.

[0150] Reference Figure 5 As shown, in some embodiments of the present application, before the above-mentioned step S101, that is, before obtaining the alarm information to be detected, it also includes constructing an MDATA graph database, which may specifically include but not be limited to the following steps S201 to S204.

[0151] Step S201: Acquire preset data from a preset data source.

[0152] In some embodiments, the preset data source includes a security knowledge base and a vulnerability database, and the preset data correspondingly includes security knowledge data and vulnerability data. It is understandable that a large amount of network security-related knowledge is published on the Internet every day, and the various knowledge bases established by many organizations and institutions can effectively manage the knowledge of attacks and vulnerabilities, such as the Common Vulnerabilities & Exposures (CVE) and Common Weakness Enumeration (CWE) databases. Therefore, this embodiment obtains the preset data in the preset data source by crawling the website with web crawler technology or directly obtaining data from a public database, specifically including network attack information such as security reports, vulnerability data, and security forum news. It should be noted that the embodiment of the present application does not specifically limit the method of obtaining the preset data.

[0153] Step S202 : pre-processing the preset data to obtain the spatiotemporal rules corresponding to each complex network attack.

[0154] In some embodiments, the preset data is preprocessed. Exemplarily, the preprocessing may include deleting duplicates, processing missing values, removing garbled characters and punctuation, and processing non-English text. The preset data includes a variety of complex network attacks. It is understood that a complex network attack includes multiple attack steps, each of which includes attack address characteristics and attack time characteristics. As time changes, the attack address will also change, thereby forming the spatiotemporal rules corresponding to the complex network attack.

[0155] Step S203: Based on each spatiotemporal rule, construct an MDATA subgraph corresponding to each complex network attack.

[0156] In some embodiments, an MDATA subgraph corresponding to a complex network attack is constructed based on spatiotemporal rules. Specifically, nodes in the MDATA subgraph corresponding to the complex network attack can be constructed based on the attack time characteristics and attack address characteristics in the attack steps. Specifically, an attack time entity is generated based on the attack time characteristics, and an attack address entity is generated based on the attack address characteristics. The nodes of the MDATA subgraph are generated by linking different entities. According to the spatiotemporal rules of the complex network attack, different nodes in the MDATA subgraph are generated by different attack steps. Finally, the MDATA subgraph corresponding to the complex network attack is obtained by linking the nodes.

[0157] Step S204: merge multiple MDATA subgraphs to construct an MDATA graph database.

[0158] In some embodiments, different complex network attacks are correspondingly fused to obtain MDATA subgraphs, thereby constructing an MDATA graph database. It can be understood that each MDATA subgraph can be separately stored in the MDATA graph database, so as to facilitate the management, maintenance, and optimization of each MDAT subgraph. It is also possible to fuse each MDATA subgraph into a large MDATA graph, de-duplicate the nodes of each MDATA subgraph, and then store them in the MDATA graph database, so as to process the entire graph database and reduce the storage of duplicate nodes at the same time. This embodiment does not limit this.

[0159] Referring to Figure 6 As shown, in some embodiments of the present application, the above step S203 may further include, but is not limited to, the following steps S301 to step S305.

[0160] Step S301, generate an attack time entity according to the attack time feature.

[0161] In some embodiments, there is an attack time feature relationship between the attack time features in different attack steps. Exemplarily, referring to Figure 7 As shown in the schematic diagram of the attack time feature relationship, a complex network attack A includes four attack steps, namely attack step a, attack step b, attack step c, and attack step d. This complex network attack needs to execute each step in a specific order to complete the attack. Specifically, before attack step c, attack steps a and b need to be completed, that is, a.t < b.t < c.t < d.t. Therefore, the attack time feature relationship is the sequence of attack time features in each attack step. An attack time entity for this attack step is generated according to the attack time feature, so as to have a sequence relationship with different time entities.

[0162] Step S302, generate an attack address entity according to the attack address feature.

[0163] In some embodiments, the addresses attacked by different attack steps are different. Therefore, as time changes, there is an attack space feature relationship between the attack address features corresponding to different attack steps. It can be understood that the attack address feature in the attack step includes the attack source address and / or the attack destination address. Correspondingly, the attack address entity also includes the attack source address entity and / or the attack destination address entity. Exemplarily, referring to Figure 8The attack space feature relationship diagram shown in the figure shows a complex network attack A consisting of four attack steps: attack step a, attack step b, attack step c, and attack step d. Since each attack step contains an attack behavior, namely an attack destination IP address, this is used as the corresponding address entity dst. The attack source IP address is associated with the step entity as an attribute of the step entity. As can be seen from the figure, the attack space feature relationship corresponding to complex network attack A is: the attack source address a.src of step a = the attack source address b.src of step b; the attack destination address a.dst of step a = the attack destination address b.dst of step b; the attack destination address b.dst of step b = the attack source address c.src of step c; the attack destination address c.dst of step c = the attack source address d.src of step d; and the attack destination address d.dst of step d = the attack source address a.src of step a. Therefore, based on the attack address features, the attack address entities corresponding to each attack step are generated, thus forming spatial relationships with different address entities.

[0164] Step S303: Setting a relationship connection edge to connect the attack time entity and the attack address entity.

[0165] In some embodiments, for each attack step, a relationship connection edge is set to connect the attack time entity and the attack address entity to express the spatiotemporal relationship of the attack step. It can be understood that the spatiotemporal relationship of each attack step constitutes the spatiotemporal rules of the corresponding complex network attack.

[0166] Step S304, generating nodes of the MDATA subgraph based on the attack time entity, attack address entity, relationship connection edge and behavior attribute.

[0167] In some embodiments, the attack step also includes behavioral attributes. For example, the behavioral attributes can be the attacker's identity, attack type, and attack tool, etc., which are not limited in this embodiment. Based on the attack time entity, attack address entity, relationship connection edge, and behavioral attributes, the nodes of the MDATA subgraph are generated accordingly. A node represents an attack step in a complex network attack. The various entities and relationship connection edges in the node together constitute the spatiotemporal relationship in the attack step.

[0168] Step S305: Based on the attack time feature relationship and the attack space feature relationship, each node is linked to construct an MDATA subgraph corresponding to the complex network attack.

[0169] In some embodiments, based on the attack time characteristic relationship and attack space characteristic relationship between each attack step in a complex network attack, each node of the generated MDATA subgraph is linked so that the same attack time characteristic relationship and attack space characteristic relationship exist between each linked node, so as to construct the MDATA subgraph corresponding to the complex network attack. Figure 9 The MDATA subgraph diagram shown combines the attack time characteristic relationships and attack space characteristic relationships of the four steps of complex network attack A to obtain the MDATA subgraph corresponding to complex network attack A. For example, the attack step entity in the attack space characteristic relationship can be pointed to the time entity in the attack time characteristic relationship, but this embodiment does not impose a limitation on this.

[0170] Reference Figure 10 As shown, in some embodiments of the present application, the above-mentioned step S102 may also include but is not limited to the following steps S401 to S404.

[0171] Step S401: Generate a time entity according to the time feature.

[0172] In some embodiments, a time entity is generated based on the time characteristics of the key information in the alarm. Specifically, the attack timestamp in the key information is used as the time entity to facilitate comparison with the time entities generated by the key information of other alarms, thereby determining the order of attacks corresponding to different alarms.

[0173] Step S402: Generate an address entity according to the address characteristics.

[0174] In some embodiments, an address entity is generated based on the address features in the key information of the alarm. Specifically, the address features in the key information include a first attack address and / or a second attack address, and correspondingly, the attack address entity also includes a first attack address entity and / or a second attack address entity. It is understood that the first attack address is the attack source address, and the second attack address is the attack destination address. It is also understood that, based on the attack information in the key information of the alarm, a step entity is generated, and the first attack address of the attack is used as an attribute of the step entity, that is, the first attack address entity and the step entity are jointly represented, which is not limited in this embodiment.

[0175] Step S403: Setting an attack connection edge to connect the time entity and the address entity.

[0176] In some embodiments, a relationship connection edge is set for the entity generated for the key information of the alarm, thereby connecting the time entity and the address entity to express the spatiotemporal relationship in the alarm.

[0177] Step S404: Generate MDATA nodes to be matched based on the time entity, address entity, attack connection edge and attack attribute.

[0178] In some embodiments, the key information also includes attack attributes. Specifically, the attack attributes may include the attacker's identity, attack type, and attack tool. For example, if the key information also includes the attack source port and attack destination port, the attack source port and attack destination port are used as attack attributes. This embodiment does not limit this. Based on the time entity, address entity, attack connection edge, and attack attributes, an MDATA matching node is generated.

[0179] Reference Figure 11 As shown, in some embodiments of the present application, the above-mentioned step S103 may also include but is not limited to the following steps S501 to S503.

[0180] Step S501, determine whether the MDATA node to be matched is the first node of the MDATA subgraph in the MDATA graph database.

[0181] In some embodiments, after the MDATA node to be matched is generated, it is convenient to match each MDATA subgraph in the MDATA graph database. First, it is determined whether the MDATA node to be matched is the first node of a certain MDATA subgraph.

[0182] In some embodiments, the MDATA node to be matched includes attack connection edges and attack attributes, and each node of the MDATA subgraph includes relationship connection edges and behavior attributes. It is understandable that querying a graph database usually requires the use of a specific query language or API, such as Cypher, Gremlin, SPARQL, etc. Specifically, based on the MDATA graph database, query whether the attack connection edges of the MDATA node to be matched match the relationship connection edges of the first node of the MDATA subgraph; based on the MDATA graph database, query whether the attack attributes of the MDATA node to be matched match the behavior attributes of the first node of the MDATA subgraph. If the attack connection edges and attack attributes of the MDATA node to be matched match the relationship connection edges and behavior attributes of the first node of the MDATA subgraph, then the node to be matched is judged to be the first node of the MDATA subgraph.

[0183] In some embodiments, the head node may exhibit specific attack behaviors. For example, in the "Night Dragon" APT attack, the attack behavior corresponding to step 1 is a SQL injection attack, which may trigger an IDS device to generate an SQL injection alarm. It is understood that those skilled in the art can configure the relevant attributes of the head node according to actual needs, and this embodiment does not limit this.

[0184] Step S502: If the MDATA node to be matched is the first node of the MDATA subgraph, the match is successful; otherwise, it is determined whether the MDATA node to be matched is the subsequent node of the matching node in the attack sequence.

[0185] In some embodiments, if the MDATA node to be matched is the first node of the MDATA subgraph, the match is successful. Otherwise, it is necessary to further determine whether the MDATA node to be matched is a subsequent node of the matching node in the attack sequence. Specifically, in addition to determining whether the attack connection edge matches the relationship connection edge and the attack attribute matches the behavior attribute, it is also necessary to further determine whether the MDATA node to be matched and the matching node in the attack sequence satisfy a temporal feature relationship, and determine whether the MDATA node to be matched and the matching node in the attack sequence satisfy a spatial feature relationship. If both the temporal feature relationship and the spatial feature relationship are satisfied, the MDATA node to be matched is determined to be a subsequent node of the matching node.

[0186] For example, refer to Figure 4 The complex network attack MDATA diagram shown in the figure shows the attack sequence, which stores matching nodes corresponding to steps 1 and 2 of the "Night Dragon" APT attack. When the MDATA node to be matched is the node corresponding to step 3, its temporal characteristic relationship satisfies: step 1.t < step 2.t < step 3.t, and its spatial characteristic relationship satisfies: the attack destination address 2.dst in step 2 = the attack source address 3.src in step 3, and the attack destination address 3.dst in step 3 = the attack source address 4.src in step 4. Therefore, the MDATA node to be matched is the post-node of the matching node corresponding to step 2, which is not limited in this embodiment.

[0187] Step S503: If the MDATA node to be matched is the subsequent node of the matching node, the matching is successful, otherwise the matching fails.

[0188] In some embodiments, if the MDATA node to be matched is a subsequent node of the matching node, the match is successful, i.e., the MDATA node to be matched is a node of the MDATA subgraph in the MDATA graph database. If the MDATA node to be matched is neither the first node of the MDATA subgraph nor a subsequent node of the matching node in the attack sequence, the match fails, i.e., the MDATA node to be matched is not a node of the MDATA subgraph in the MDATA graph database.

[0189] In some embodiments, MDATA matching nodes that fail to match are discarded, thereby removing the corresponding false alarms, which is beneficial to improving the detection accuracy of complex network attacks.

[0190] In some embodiments of the present application, after processing an alarm, if the various matching nodes in the attack sequence have not yet formed a complex network attack, it is necessary to continue to obtain the next alarm information to be detected, and repeat the above process until the preset conditions are met. Exemplarily, the preset conditions include that the matching node is the tail node of the MDATA subgraph in the MDATA graph database, that is, the last attack step corresponding to a complex network attack is successfully matched. Specifically, based on the MDATA graph database, query whether the attack connection edge of the matching node in the attack sequence matches the relationship connection edge of the tail node of the MDATA subgraph; based on the MDATA graph database, query whether the attack attribute of the matching node in the attack sequence matches the behavior attribute of the tail node of the MDATA subgraph. If the attack connection edge and attack attribute of the matching node both match the relationship connection edge and behavior attribute of the tail node of the MDATA subgraph, then the matching node is judged to be the tail node of the MDATA subgraph.

[0191] In some embodiments, the tail node exhibits specific attack behaviors. For example, in the "Night Dragon" APT attack, the attack behavior corresponding to step 5 is the return of a large number of sensitive files, thereby causing actual harm. It is understood that those skilled in the art can configure the relevant attributes of the tail node according to actual needs, and this embodiment does not limit this.

[0192] In some embodiments of the present application, the preset condition may also be a preset duration. Specifically, after an MDATA node to be matched is set as a matching node, a timer is started and restarted when the next MDATA node to be matched is set as a matching node. When the timer reaches the preset duration, a complex network attack is output according to the attack sequence. This effectively controls the detection time of complex network attacks and avoids wasting resources.

[0193] In some embodiments of the present application, the preset duration can be pre-set by first obtaining a sample attack set, where the sample attack set includes multiple sample attacks, each sample attack including multiple attack steps. Then, the time intervals between adjacent steps in each sample attack are obtained. The average of the multiple time intervals is calculated, and the preset duration is determined based on the average value and a first coefficient. For example, if the calculated average value is 10 minutes and the first coefficient is 1.5, the preset duration is determined to be 10*1.5=15 minutes.

[0194] The preset duration can be determined by multiplying the average of the time intervals between each sample attack by the first coefficient. For example, let the median value be Among them, β is the first coefficient, p k is the time interval between the kth sample attack and the next sample attack, and n is the number of time intervals between sample attacks in the sample attack set. The preset time length can be determined according to the size of the intermediate value M.

[0195] The first coefficient can be set appropriately as needed. Generally, the value range of the first coefficient is between 1 and 2. For example, the first coefficient can be set to 1.5. The advantage of setting the preset duration in this way is that by multiplying the average of the time intervals between sample attacks by a reasonable coefficient, the waiting time for most sample attacks is met. Furthermore, the waiting time can be adjusted by adjusting the first coefficient. Compared to determining the preset duration based on the maximum value, using the average to determine the preset duration can shorten the waiting time, thereby saving resources.

[0196] Reference Figure 12 As shown, in some embodiments of the present application, the above step S101 may also include but is not limited to the following steps S601 to S602.

[0197] Step S601: Acquire an alarm generation signal.

[0198] In some embodiments, if abnormal behavior or malicious attacks are detected, an alarm mechanism will be automatically triggered, and the IDS device will issue an alarm signal. There are many reasons why the IDS device issues an alarm signal. For example, it may be caused by unauthorized access. The attacker may try to access the victim's network or system without authorization through brute force or exploiting vulnerabilities. Or it may be caused by a malware attack. The attacker may send malware, such as viruses and Trojans, to the victim through email, social media, etc. Or it may be caused by a SQL injection attack: the attacker may try to exploit application vulnerabilities to attack the victim's database through methods such as SQL injection, etc. The IDS device may detect these behaviors and issue an alarm signal.

[0199] Step S602 : in response to the alarm generation signal, obtaining corresponding alarm information from the work log corresponding to the alarm as the alarm information to be detected.

[0200] In some embodiments, in response to an alarm generation signal, corresponding alarm information is obtained from the work log corresponding to the alarm and used as the alarm information to be detected. It is understood that the work log generally includes the following information:

[0201] Alarm level: Indicates the severity of the alarm, usually divided into several levels such as emergency, important, and general

[0202] Device Name: The name of the device or system involved in the alarm

[0203] Alarm type: the type of alarm, such as network failure, hardware failure, software error, etc.

[0204] Timestamp: the time when the alarm occurred

[0205] Alarm description: Detailed description of the alarm event

[0206] Alarm source: the module or program that issues the alarm

[0207] Processing status: Alarm processing status, such as processed, unprocessed, etc.

[0208] Alarm handler: Name or account number of the person responsible for handling the alarm

[0209] Additional information: may also include other information related to the alarm, such as the impact range of the alarm, recommended solutions, etc.

[0210] It should be understood that this embodiment is only an example and is not limiting.

[0211] In some embodiments, obtaining the next alarm information to be detected in step S105 further includes obtaining the next alarm generation signal, and then, in response to the next alarm generation signal, obtaining the corresponding alarm information from the work log corresponding to the alarm as the next alarm information to be detected. This allows for real-time alarm detection, effectively increasing the speed of detecting complex network attacks.

[0212] The following is a complete example of this application. When the IDS device generates an alarm, it extracts the key information in the alarm information to generate the MDATA matching node, and then performs detection and matching based on the MDATA graph database. Figure 13 The complex network attack detection flow chart shown in the figure first determines whether the MDATA to-be-matched node is the first node of a certain MDATA subgraph in the MDATA graph database. If it matches the first node, the MDATA to-be-matched node is set as the matching node and added to the attack sequence. Otherwise, it continues to determine whether it is the post-node of the matching node in the attack sequence. If it matches the post-node, the MDATA to-be-matched node is also set as the matching node and added to the attack sequence. At this time, if the preset conditions are met, the corresponding complex network attack is output according to the attack sequence. Otherwise, it continues to wait for the detection of the next alarmed MDATA to-be-matched node. If the detected MDATA to-be-matched node is neither the first node nor the post-node, it will be judged as a non-attack behavior and discarded without recording, thereby effectively eliminating a large number of false alarms and improving the speed and accuracy of complex network attack detection.

[0213] Exemplarily, an MDATA sub-graph corresponding to the complex network attack B is stored in the MDATA graph database. The complex network attack B has three attack steps, that is, the corresponding MDATA sub-graph has three nodes. It can be understood that each node corresponds to a time entity, a destination address entity, and a step entity, and the step entity has the attribute of the attack source address, or the attack source address can also be directly used as the source address entity. This embodiment does not limit this. Referring to Figure 14 the shown real-time attack schematic diagram, when a SQL injection alarm is generated, an MDATA pending matching node 1 for the SQL injection attack is correspondingly generated. The node 1 has a time entity t1, a destination address entity dst1, a step entity b1, and a source address entity src1. Through detection with the MDATA graph database, it is matched as the first node of the MDATA sub-graph of the complex network attack B, and then the SQL injection attack is stored in the attack sequence. Subsequently, a buffer overflow alarm is generated, and an MDATA pending matching node 2 for the buffer overflow attack is correspondingly generated. The node 2 has a time entity t2, a destination address entity dst2, a step entity b2, and a source address entity src2. Through detection with the MDATA graph database and satisfying the time feature relationship and the space feature relationship with the first node. For example, the attack timestamp of the buffer overflow attack is later than the attack timestamp of the SQL injection attack, that is, the time entities t1 and t2 satisfy the time feature relationship t1 < t2. Thus, it is matched as step 2 of the complex network attack B, that is, the second node. The nodes corresponding to the buffer overflow attack and the SQL injection attack can be linked to form a real-time attack graph and stored in the attack sequence, and wait for the addition of the next attack step to form a complete complex network real-time attack graph. If the MDATA pending matching node corresponding to the next alarm does not conform to the third node corresponding to the MDATA sub-graph of the complex network attack B, it is discarded and the next alarm is continuously detected until the last step of the complex network attack B, that is, the tail node of the corresponding MDATA sub-graph, is detected, then it meets the preset conditions, and then the complex network attack B is output according to the attack sequence.

[0214] By obtaining alarms in real time, generating MDATA pending matching nodes with time features and space features, and matching them with the MDATA graph database, false alarms are effectively removed, and the calculation and detection based on the graph effectively improve the detection speed and accuracy of complex network attacks.

[0215] The embodiment of the present invention further provides a complex network attack detection system, which can implement the above complex network attack detection method. Referring to Figure 15 as shown, in some embodiments of the present application, the complex network attack detection system includes:

[0216] The alarm module 100 is used to obtain the alarm information to be detected and extract key information for constructing the MDATA graph from the alarm information, the key information including address characteristics and time characteristics;

[0217] The node generation module 200 is used to generate an MDATA to-be-matched node based on key information. The MDATA to-be-matched node includes an address entity and a time entity. The address feature is used to generate the corresponding address entity, and the time feature is used to generate the corresponding time entity.

[0218] A node matching module 300 is configured to match an MDATA node to be matched with an MDATA subgraph in an MDATA graph database; wherein the MDATA graph database includes at least one MDATA subgraph; and the MDATA subgraph includes a plurality of nodes, each of which has a temporal and spatial characteristic relationship, so that the MDATA subgraph is used to characterize the spatiotemporal rules of a complex network attack.

[0219] The node processing module 400 is used to set the MDATA to-be-matched node as a matching node when the MDATA to-be-matched node is successfully matched, and to add the matching node to the attack sequence;

[0220] The attack output module 500 is used to output a complex network attack based on an attack sequence when a preset condition is met.

[0221] The specific implementation of the complex network attack detection system of this embodiment is basically the same as the specific implementation of the complex network attack detection method described above, and will not be described in detail here.

[0222] Figure 16 The electronic device 1000 provided in an embodiment of the present application is shown. The electronic device 1000 includes: a processor 1001, a memory 1002, and a computer program stored in the memory 1002 and executable on the processor 1001. When the computer program is executed, it is used to execute the above-mentioned complex network attack detection method.

[0223] The processor 1001 and the memory 1002 may be connected via a bus or other means.

[0224] Memory 1002, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer executable programs, such as the complex network attack detection method described in the embodiments of this application. Processor 1001 implements the complex network attack detection method described above by executing the non-transitory software programs and instructions stored in memory 1002.

[0225] The memory 1002 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and application programs required for at least one function; the data storage area may store and execute the above-mentioned complex network attack detection method. In addition, the memory 1002 may include a high-speed random access memory 1002, and may also include a non-volatile memory 1002, such as at least one storage device memory device, a flash memory device or other non-volatile solid-state memory device. In some embodiments, the memory 1002 may optionally include a memory 1002 remotely located relative to the processor 1001, and these remote memories 1002 may be connected to the electronic device 1000 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0226] The non-transient software programs and instructions required to implement the above-mentioned complex network attack detection method are stored in the memory 1002. When executed by one or more processors 1001, the above-mentioned complex network attack detection method is executed, for example, Figure 1 Steps S101 to S106 of the method, Figure 5 Steps S201 to S204 of the method, Figure 6 Steps S301 to S305 of the method, Figure 10 Steps S401 to S404 of the method, Figure 11 Steps S501 to S504 of the method, Figure 12 Method steps S601 to S602 in .

[0227] The embodiment of the present application also provides a storage medium, which is a computer-readable storage medium, and the storage medium stores a computer program, which implements the above-mentioned complex network attack detection method when executed by the processor. The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory optionally includes a memory remotely arranged relative to the processor, and these remote memories can be connected to the processor via a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network and a combination thereof.

[0228] The complex network attack detection method, system, electronic device and storage medium provided by the embodiment of the present application can generate an MDATA to-be-matched node by acquiring the alarm information to be detected and extracting the key information in the alarm information, wherein the key information includes address features and time features, and the MDATA to-be-matched node includes an address entity generated according to the address features and a time entity generated according to the time features, and then the MDATA to-be-matched node is matched with the MDATA subgraph in the MDATA graph database. If the MDATA to-be-matched node successfully matches the MDATA subgraph of the MDATA graph database, the MDATA to-be-matched node is set as a matching node and added to the attack sequence. By continuously acquiring the alarm information to be detected, the above process is repeated until the preset conditions are met, and the corresponding complex network attack is output according to the attack sequence. Thus, by acquiring alarms in real time, an MDATA to-be-matched node with time features and spatial features is generated, and matched with the MDATA graph database, false alarms are effectively removed, and the graph-based calculation and detection effectively improve the detection speed and accuracy of complex network attacks.

[0229] The embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, i.e., they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the embodiments.

[0230] Those skilled in the art will appreciate that all or some of the steps and systems in the method disclosed above can be implemented as software, firmware, hardware, and appropriate combinations thereof. Some physical components or all physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, and the computer-readable medium can include computer storage media (or non-transitory media) and communication media (or temporary media). As known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory, or other memory technology, CD-ROM, digital versatile disks (DVD), or other optical disk storage, magnetic cassettes, magnetic tapes, storage device storage, or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, as is well known to those skilled in the art, communication media typically includes computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0231] It should also be understood that the various implementations provided in the embodiments of this application can be arbitrarily combined to achieve different technical effects. The above is a specific description of the preferred implementation of this application, but this application is not limited to the above implementation. Those skilled in the art can also make various equivalent modifications or substitutions under the conditions that do not violate the spirit of this application.

Claims

1. A complex network attack detection method, characterized in that: include: Acquire alarm information to be detected, and extract key information for constructing an MDATA graph from the alarm information, wherein the key information includes address features and time features; Generate an MDATA to-be-matched node based on the key information, the MDATA to-be-matched node including an address entity and a time entity; wherein the address feature is used to generate the address entity, and the time feature is used to generate the time entity; Matching the MDATA node to be matched with an MDATA subgraph in an MDATA graph database; wherein the MDATA graph database includes at least one MDATA subgraph; the MDATA subgraph includes a plurality of nodes, and there is a temporal feature relationship and a spatial feature relationship between each of the nodes, so that the MDATA subgraph is used to characterize the spatiotemporal rules of a complex network attack; If the match is successful, the MDATA to-be-matched node is set as a matching node, and the matching node is added to the attack sequence; Get the next alarm information to be detected and repeat the above process until the preset conditions are met; Based on the attack sequence, the complex network attack is output.

2. The complex network attack detection method according to claim 1, characterized in that: Before obtaining the alarm information to be detected, the method further includes: Build the MDATA graph database, including: Acquire preset data from a preset data source; the preset data source includes a security knowledge base and a vulnerability database, and the preset data includes security knowledge data and vulnerability data; Preprocessing the preset data to obtain spatiotemporal rules corresponding to various complex network attacks; the spatiotemporal rules include multiple attack steps, and the attack steps include attack address features and attack time features; Based on each of the spatiotemporal rules, construct the MDATA subgraph corresponding to each of the complex network attacks; Multiple MDATA subgraphs are merged to construct the MDATA graph database.

3. The complex network attack detection method according to claim 2, characterized in that: The attack step further includes a behavior attribute, a relationship between attack space characteristics exists between the plurality of attack address characteristics, and a relationship between attack time characteristics exists between the plurality of attack time characteristics; The constructing of the MDATA subgraph corresponding to each of the complex network attacks based on each of the spatiotemporal rules includes: Generating an attack time entity according to the attack time characteristics; Generate an attack address entity according to the attack address feature, the attack address feature including an attack source address and / or an attack destination address, and correspondingly, the attack address entity includes an attack source address entity and / or an attack destination address entity; Setting a relationship connection edge to connect the attack time entity and the attack address entity; Generate nodes of the MDATA subgraph based on the attack time entity, the attack address entity, the relationship connection edge and the behavior attribute; Based on the attack time characteristic relationship and the attack space characteristic relationship, each of the nodes is linked to construct the MDATA subgraph corresponding to the complex network attack.

4. The complex network attack detection method according to claim 1, characterized in that: The key information also includes attack attributes; generating an MDATA node to be matched based on the key information includes: Generating the time entity accordingly according to the time feature; Generate the address entity according to the address feature, the address feature including the first attack address and / or the second attack address, and correspondingly, the address entity includes the first attack address entity and / or the second attack address entity; Setting an attack connection edge to connect the time entity and the address entity; Based on the time entity, the address entity, the attack connection edge and the attack attribute, the MDATA node to be matched is generated.

5. The complex network attack detection method according to claim 1, characterized in that: The matching of the MDATA to-be-matched node with the MDATA subgraph in the MDATA graph database includes: Determine whether the MDATA node to be matched is the first node of the MDATA subgraph in the MDATA graph database; If the MDATA node to be matched is the first node of the MDATA subgraph, the match is successful; otherwise, it is determined whether the MDATA node to be matched is the subsequent node of the matching node in the attack sequence; If the MDATA node to be matched is the subsequent node of the matching node, the match is successful; otherwise, the match fails.

6. The complex network attack detection method according to claim 5, characterized in that: The MDATA nodes to be matched include attack connection edges and attack attributes, and each of the nodes in the MDATA subgraph includes relationship connection edges and behavior attributes; The determining whether the MDATA to-be-matched node is the first node of the MDATA subgraph in the MDATA graph database includes: Based on the MDATA graph database, query whether the attack connection edge of the MDATA to-be-matched node matches the relationship connection edge of the first node of the MDATA subgraph; Based on the MDATA graph database, query whether the attack attribute of the MDATA node to be matched matches the behavior attribute of the first node of the MDATA subgraph; If the attack connection edge and the attack attribute of the MDATA node to be matched match the relationship connection edge and the behavior attribute of the first node of the MDATA subgraph, the MDATA node to be matched is judged to be the first node of the MDATA subgraph.

7. The complex network attack detection method according to claim 5, characterized in that: The determining whether the MDATA to-be-matched node is a subsequent node of the matching node in the attack sequence includes: Determine whether the MDATA to-be-matched node and the matching node in the attack sequence satisfy a time characteristic relationship; Determine whether the MDATA to-be-matched node and the matching node in the attack sequence satisfy a spatial feature relationship; If the time feature relationship and the space feature relationship are satisfied at the same time, the MDATA node to be matched is determined to be the post-node of the matching node.

8. The complex network attack detection method according to claim 1, characterized in that: The matching node includes an attack connection edge and an attack attribute, and each node of the MDATA subgraph includes a relationship connection edge and a behavior attribute; The preset condition includes that the matching node is the tail node of the MDATA subgraph in the MDATA graph database; The predetermined conditions are met, including: Based on the MDATA graph database, query whether the attack connection edge of the matching node in the attack sequence matches the relationship connection edge of the tail node of the MDATA subgraph; Based on the MDATA graph database, query whether the attack attribute of the matching node in the attack sequence matches the behavior attribute of the tail node of the MDATA subgraph; If the attack connection edge and the attack attribute of the matching node match the relationship connection edge and the behavior attribute of the tail node of the MDATA subgraph, the matching node is determined to be the tail node of the MDATA subgraph.

9. The complex network attack detection method according to claim 1, characterized in that: Outputting the complex network attack based on the attack sequence includes: Linking the matching nodes in the attack sequence in a storage order so that the temporal feature relationship and the spatial feature relationship are satisfied between the matching nodes, thereby obtaining the corresponding MDATA subgraph; Obtain and output the complex network attack corresponding to the MDATA subgraph.

10. The complex network attack detection method according to any one of claims 1 to 9, characterized in that: The temporal characteristic relationship is the order of attack time of each node in the MDATA subgraph, and the spatial characteristic relationship is the order of change of attack addresses of each node in the MDATA subgraph.

11. The complex network attack detection method according to claim 1, characterized in that: The obtaining of the alarm information to be detected includes: Obtain alarm generation signal; In response to an alarm generation signal, obtaining corresponding alarm information from a work log corresponding to the alarm as the alarm information to be detected; The obtaining of the next alarm information to be detected includes: Get the next alarm generation signal; In response to the next alarm generation signal, corresponding alarm information is obtained from the work log corresponding to the alarm as the next alarm information to be detected.

12. The complex network attack detection method according to claim 11, characterized in that: The preset conditions include reaching a preset time length; The method further comprises: After the MDATA to-be-matched node is set as a matching node, a timer is started to count, and the timer is restarted when the next MDATA to-be-matched node is set as a matching node; The predetermined conditions are met, including: When the timing reaches the preset duration, the complex network attack is output according to the attack sequence.

13. The complex network attack detection method according to claim 12, characterized in that: The preset duration is preset in the following manner: Acquire a sample attack set, where the sample attack set includes multiple sample attacks, and each sample attack includes multiple attack steps; Obtaining the time interval between each adjacent step in each sample attack; calculating an average of a plurality of said time intervals; The preset duration is determined based on the average value and the first coefficient.

14. A complex network attack detection system, characterized in that: Applying the complex network attack detection method according to any one of claims 1 to 13, comprising: An alarm module is used to obtain alarm information to be detected and extract key information for constructing an MDATA graph from the alarm information, wherein the key information includes address features and time features; A node generation module is used to generate an MDATA to-be-matched node based on the key information, wherein the MDATA to-be-matched node includes an address entity and a time entity; wherein the address feature is used to generate the address entity, and the time feature is used to generate the time entity; A node matching module is used to match the MDATA to-be-matched node with an MDATA subgraph in an MDATA graph database; wherein the MDATA graph database includes at least one MDATA subgraph; the MDATA subgraph includes a plurality of nodes, and there is a temporal feature relationship and a spatial feature relationship between each of the nodes, so that the MDATA subgraph is used to characterize the spatiotemporal rules of a complex network attack; A node processing module is used to set the MDATA to-be-matched node as a matching node when the MDATA to-be-matched node is successfully matched, and to add the matching node to the attack sequence. The attack output module is used to output the complex network attack based on the attack sequence when a preset condition is met.

15. An electronic device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method for detecting complex network attacks according to any one of claims 1 to 13 is implemented.

16. A computer-readable storage medium, characterized in that The storage medium stores a program, and the program is executed by a processor to implement the complex network attack detection method according to any one of claims 1 to 13.

Images