An attack detection rule generation method and device, electronic equipment and storage medium

Abstract

The application provides an attack detection rule generation method and device, electronic equipment and a storage medium. The method comprises: obtaining an attack feature set; the attack feature set comprises a first flow direction attack feature and a protocol keyword of each first flow direction attack feature; obtaining a second flow direction attack feature corresponding to the first flow direction attack feature according to the protocol keyword of the first flow direction attack feature; expanding attack features in the attack feature set based on the second flow direction attack feature to obtain an updated attack feature set; the updated attack feature set comprises updated attack features; generating an attack detection rule based on the updated attack features and the protocol keyword corresponding to the updated attack features; and the attack detection rule is used to detect whether traffic data is network attack data. By associating the first flow direction attack feature and the second flow direction attack feature, a bidirectional detection rule is generated.

Description

Technical Field

[0001] This application relates to the field of cybersecurity, and more specifically, to an attack detection rule generation method, apparatus, electronic device, and storage medium. Background Technology

[0002] With the continuous development of the internet, various cyberattack methods are emerging one after another, posing a great challenge to network security. To ensure enterprise network security, timely detection of cyberattacks is crucial, allowing more valuable time for further analysis, emergency response, and evidence collection and tracing. Currently, detecting cyberattacks through security detection devices is the most common method, and the detection rules built into these devices are the core of the detection process. However, current cyberattack detection rules are generated based on vulnerabilities in network traffic request packets, resulting in single attack characteristics and low detection accuracy. Summary of the Invention

[0003] The purpose of this invention is to provide an attack detection rule generation method, apparatus, electronic device, and storage medium that associates a first flow attack feature with a second flow attack feature. This not only generates network attack detection rules based on attack features in network traffic request packets but also generates network attack detection rules based on attack features in the corresponding response packets, thereby improving the accuracy of network attack detection rules.

[0004] In a first aspect, embodiments of this application provide an attack detection rule generation method, comprising: acquiring an attack feature set; the attack feature set including a first flow attack feature and a protocol keyword for each of the first flow attack features; acquiring a second flow attack feature corresponding to the first flow attack feature based on the protocol keyword of the first flow attack feature; expanding the attack features in the attack feature set based on the second flow attack feature to obtain an updated attack feature set; the updated attack feature set including the updated attack features; generating an attack detection rule based on the updated attack features and the protocol keyword corresponding to the updated attack features; the attack detection rule is used to detect whether traffic data is network attack data.

[0005] In the above implementation process, by associating the first flow attack feature with its corresponding second flow attack feature, the attack features in the attack feature set are expanded using the second flow attack feature to obtain an updated attack feature set, thereby improving the richness and coverage of the attack features. By using the attack features in the network traffic request packets and the attack features in the response packets, network attack detection rules are generated. Since the request packets and response packets are associated, the attack features of a successful attack can be determined, thereby improving the accuracy of the detection rules in detecting network attacks.

[0006] Optionally, in this embodiment of the application, obtaining the second flow attack feature corresponding to the first flow attack feature based on the protocol keyword of the first flow attack feature includes: obtaining an execution command set containing the protocol keyword and an execution result dataset corresponding to the execution command set from the traffic log; performing correlation analysis on the execution command set and the first flow attack feature based on the protocol keyword to obtain the target execution result corresponding to the first flow attack feature; and obtaining the second flow attack feature corresponding to the first flow attack feature based on the target execution result.

[0007] In the above implementation process, the target execution result of the first flow attack feature is determined from the execution result dataset by using the set of executed commands and their corresponding execution result dataset in the traffic log. Then, the second flow attack feature corresponding to the first flow attack feature can be determined so that bidirectional detection rules can be generated based on the associated attack features.

[0008] Optionally, in this embodiment of the application, based on protocol keywords, the execution command set and the first flow attack feature are correlated and analyzed to obtain the target execution result corresponding to the first flow attack feature, including: matching the protocol keywords in the execution command with the protocol keywords of the first flow attack feature to obtain the target execution command associated with the first flow attack feature; and determining the target execution result corresponding to the first flow attack feature in the execution result dataset according to the target execution command.

[0009] In the above implementation process, by using the protocol keywords in the executed commands in the traffic logs and the protocol keywords of the first flow attack characteristics, the first flow attack characteristics and the execution result dataset are associated to determine the target execution result corresponding to the first flow attack characteristics.

[0010] Optionally, in this embodiment of the application, obtaining the second flow attack feature corresponding to the first flow attack feature based on the target execution result includes: if the target execution result indicates successful execution, then determining the attack success message corresponding to the first flow attack feature from the traffic log; extracting the second flow attack feature corresponding to the first flow attack feature from the attack success message; the second flow attack feature includes at least one of status code, response body class, or response body function.

[0011] In the above implementation process, the successful attack message corresponding to the first flow attack feature is determined from the traffic log based on the target execution result, thus locating the successfully attacked vulnerability attack message. Then, the second flow attack feature corresponding to the first flow attack feature is extracted from the successful attack message, thus correlating the first and second flow attack features and improving the richness of the attack features.

[0012] Optionally, in this embodiment of the application, obtaining the attack feature set includes: determining protocol keywords based on the transmission protocol of the traffic log; extracting information from pre-acquired network traffic data based on the protocol keywords to generate training data; the training data includes attack training data and security training data; training the training data to obtain an attack detection model; using the attack detection model to detect the data to be detected and determining predicted attack data from the data to be detected; and generating the attack feature set based on the predicted attack data and the attack data.

[0013] In the above implementation process, training data is obtained by extracting information from attack data and security data, and the model is further trained using the training data to obtain an attack detection model. The attack detection model is then used to detect the data to be detected, predicting the attack data that represents the attack data in the data to be detected. The predicted attack data is used to update the attack feature set, thus obtaining a richer set of attack features. The use of the model improves the efficiency of obtaining the sample set, and machine learning enhances the detection accuracy of network attack detection rules.

[0014] Optionally, in this embodiment of the application, generating attack detection rules based on the updated attack features and the protocol keywords corresponding to the updated attack features includes: converting the updated attack features into preset format data; generating attack detection rules according to preset rules and the preset format data and the protocol keywords corresponding to the updated attack features.

[0015] In the above implementation process, the efficiency of generating network attack detection rules is improved by utilizing the updated attack feature set and generating syntax according to preset rules. Attack detection rules for the request side and the response side are generated based on the first and second flow attack features respectively, realizing the generation of bidirectional detection rules. This improves the problem of missed network attack detection on the response side and increases the accuracy and detection rate of network attacks.

[0016] Optionally, in this embodiment of the application, after generating attack detection rules based on the updated attack features and the protocol keywords corresponding to the updated attack features, the method further includes: using a detection engine to verify the attack detection rules to confirm whether the syntax of the attack detection rules is correct; if the syntax of the attack detection rules is correct, then using the detection engine to verify the traffic data, outputting the hit result of the attack detection rules; the hit result is used to characterize the accuracy of whether the traffic data detected by the attack detection rules is network attack data.

[0017] In the above implementation process, the accuracy of the attack detection rules is improved by performing syntax verification and hit verification on the generated attack detection rules, so that the attack detection rules can detect network attacks more accurately, automatically identify and process normal and abnormal network behaviors, and reduce the false alarm rate.

[0018] Secondly, embodiments of this application also provide an attack detection rule generation apparatus, comprising: an attack feature acquisition module, configured to acquire an attack feature set; the attack feature set includes a first flow attack feature and a protocol keyword for each of the first flow attack features; an association module, configured to acquire a second flow attack feature corresponding to the first flow attack feature based on the protocol keyword of the first flow attack feature; an expansion feature module, configured to expand the attack features in the attack feature set based on the second flow attack feature to obtain an updated attack feature set; the updated attack feature set includes the updated attack features; and a rule generation module, configured to generate attack detection rules based on the updated attack features and the protocol keyword corresponding to the updated attack features; the attack detection rules are used to detect whether traffic data is network attack data.

[0019] Thirdly, embodiments of this application also provide an electronic device, including: a processor and a memory, the memory storing machine-readable instructions executable by the processor, which, when executed by the processor, perform the method described above.

[0020] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, performs the methods described above.

[0021] The attack detection rule generation method, apparatus, electronic device, and storage medium provided in this application associate a first-flow attack feature with its corresponding second-flow attack feature, expand the attack features in the attack feature set using the second-flow attack feature, obtain an updated attack feature set, and improve the richness and coverage of attack features; and generate network attack detection rules using attack features in network traffic request packets and attack features in response packets, thereby improving the accuracy of network attack detection rules. Attached Figure Description

[0022] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 A flowchart illustrating an attack detection rule generation method provided in an embodiment of this application;

[0024] Figure 2 This application provides a training data preprocessing method.

[0025] Figure 3 An automated method for generating and analyzing network attack detection rules is provided in the embodiments of this application.

[0026] Figure 4 This is a schematic diagram of the attack detection rule generation device provided in the embodiments of this application;

[0027] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0028] The embodiments of the technical solution of this application will now be described in detail with reference to the accompanying drawings. These embodiments are only used to more clearly illustrate the technical solution of this application and are therefore merely examples, and should not be used to limit the scope of protection of this application.

[0029] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs; the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this application.

[0030] In the description of the embodiments of this application, technical terms such as "first" and "second" are used only to distinguish different objects and should not be construed as indicating or implying relative importance or implicitly specifying the number, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, "multiple" means two or more, unless otherwise explicitly defined.

[0031] Traditional network attack detection rules are generated solely based on known attack characteristics in network traffic request packets. This means the rule generation is unrelated to the response packet corresponding to the network traffic request. Such generated rules can only detect packets containing the vulnerability, indicating a possible attack, but they do not determine whether the attack characteristics carried in the request packet were successful or whether the attack was detected.

[0032] Therefore, the accuracy of network attack detection rules in identifying vulnerabilities that have actually succeeded in attacking is not high, and even after detecting a network attack, the alert result for that attack cannot be determined. Furthermore, network attack detection rules generated by existing methods may fail to detect attack behaviors in response packets.

[0033] The applicant discovered through research that when a network request message exhibits attack characteristics and the attack is successful, the corresponding response message will also display some corresponding attack characteristics. Based on this discovery, this application provides an attack detection rule generation method that associates uplink attack characteristics with their corresponding downlink attack characteristics. Specifically, the attack characteristics of the response message corresponding to the request message are also used as features for generating rules, thus achieving bidirectional network attack detection rule generation. This improves the richness and coverage of attack characteristics, thereby enhancing the accuracy of network attack detection rules.

[0034] Furthermore, after associating uplink and downlink attack characteristics, if a request message containing a network attack is detected, the network attack result corresponding to the vulnerability can be determined in advance through the associated downlink attack characteristics, thereby improving network security.

[0035] Please see Figure 1 The illustrated diagram shows a flowchart of an attack detection rule generation method provided in an embodiment of this application. The attack detection rule generation method provided in this embodiment can be applied to electronic devices, which may include a terminal and a server; wherein the terminal may specifically be a smartphone, tablet computer, computer, personal digital assistant (PDA), etc.; the server may specifically be an application server or a web server. The attack detection rule generation method may include:

[0036] Step S110: Obtain the attack feature set; the attack feature set includes the first flow attack features and the protocol keyword of each first flow attack feature.

[0037] Step S120: Obtain the second flow attack feature corresponding to the first flow attack feature based on the protocol keyword of the first flow attack feature.

[0038] Step S130: Expand the attack features in the attack feature set based on the second flow attack features to obtain an updated attack feature set; the updated attack feature set includes the updated attack features.

[0039] Step S140: Based on the updated attack features and the corresponding protocol keywords, generate attack detection rules; the attack detection rules are used to detect whether traffic data is network attack data.

[0040] In step S110, the attack feature set is a collection of multiple attack features. The attack feature set can take the form of an attack feature table, attack feature text, or attack feature vector, etc. Attack features can include information such as threat name, attack type, data flow direction, attack characteristics, and protocol keywords. Taking an attack feature table as an example, the threat name, attack type, data flow direction, attack characteristics, and protocol keywords can be used as column labels for the attack feature table. Each row of data in the attack feature table represents one attack feature data point.

[0041] The attack signature set includes first-direction attack signatures, where first-direction represents the data flow direction of the attack signature, including uplink and downlink; uplink refers to the direction from the client or terminal device to the server or other network service; downlink is the direction from the server or other network service to the client or terminal device.

[0042] The first set of attack characteristics can be either uplink or downlink attack characteristics. Uplink attacks typically refer to network attacks that may occur during data transmission from mobile devices to base stations or servers; downlink attacks typically refer to network attacks that may occur during data transmission from base stations or servers to mobile devices. Understandably, the attack characteristic set can also include both uplink and downlink attack characteristics simultaneously.

[0043] The protocol keywords that identify the primary characteristics of a flow attack are determined based on the protocols found in traffic logs. Different protocols can have different protocol keywords. Taking the HTTP protocol as an example, HTTP protocol keywords can include paths, parameters, and encoded content.

[0044] Attack signatures can be obtained by acquiring network traffic data such as packets and flows, and using feature extraction algorithms to extract useful information from this traffic data as attack signatures. Specifically, this can involve collecting network attack payloads, proof-of-concept (PoC), and exploit (Exp) information, writing the feature extraction method into a scripting language, and then using the scripting language to extract features from the collected information to obtain the attack signatures.

[0045] In step S120, taking the first flow attack feature as the uplink attack feature and the second flow attack feature as the downlink attack feature as an example, the command execution result dataset can be obtained from the traffic log. This dataset can identify successfully executed packets, and the first flow attack feature can identify packets containing that attack feature. Therefore, by performing correlation analysis between the first flow attack feature in the attack feature set and the command execution result dataset, successfully attacked packets can be identified. The second flow attack feature can be extracted from these successfully attacked packets. The second flow attack feature is the downlink attack feature corresponding to the uplink attack feature.

[0046] For example, in correlation analysis, traffic logs may contain the first-flow attack characteristics and their protocol keywords. The traffic logs may also contain the executed command set and its corresponding command execution result dataset. Since the executed commands also include protocol keywords, the first-flow attack characteristics and the command execution result dataset can be correlated based on the protocol keywords.

[0047] Based on the command execution result, the successful attack message with uplink attack characteristics is located. The response message content is obtained from the successful attack message, and then the second-direction attack characteristics corresponding to the first-direction attack characteristics are obtained from the response message content.

[0048] In step S130, a second flow attack feature is added to the attack feature set. The column labels of the second flow attack feature are the same as those of the first flow attack feature. Taking the attack feature table as an example, different flow attack features can be distinguished by different rows. Specifically, the second flow attack feature can be written into the attack feature table, and corresponding column information can be added to expand the attack feature table and obtain an updated attack feature set.

[0049] The updated attack signature set includes the updated attack signatures, which can be the union of the first flow attack signatures and the second flow attack signatures.

[0050] In step S140, after obtaining the updated attack features, network detection rules are generated according to the updated attack features and their corresponding protocol keywords, following a rule syntax structure. For example, the collected updated attack features and protocol keywords are integrated together using a rule syntax structure. The attack detection rules are used to detect whether traffic data constitutes a network attack.

[0051] In an optional embodiment, since the updated attack signature includes both first-flow attack signatures and second-flow attack signatures, attack detection rules for the request side and the response side can be generated based on the first-flow attack signature and the second-flow attack signature respectively, thus achieving bidirectional detection rule generation. Utilizing bidirectional detection rules to detect network data improves the problem of missed network attack detection on the response side, increasing the accuracy and detection rate of network attacks.

[0052] In the above implementation process, by associating the first flow attack feature with its corresponding second flow attack feature, the attack features in the attack feature set are expanded using the second flow attack feature to obtain an updated attack feature set, thereby improving the richness and coverage of the attack features. By using the attack features in the network traffic request packets and the attack features in the response packets, network attack detection rules are generated. Since the request packets and response packets are associated, the attack features of a successful attack can be determined, thereby improving the accuracy of the detection rules in detecting network attacks.

[0053] Optionally, in this embodiment of the application, obtaining the second flow attack feature corresponding to the first flow attack feature based on the protocol keyword of the first flow attack feature includes: obtaining an execution command set containing the protocol keyword and an execution result dataset corresponding to the execution command set from the traffic log; performing correlation analysis on the execution command set and the first flow attack feature based on the protocol keyword to obtain the target execution result corresponding to the first flow attack feature; and obtaining the second flow attack feature corresponding to the first flow attack feature based on the target execution result.

[0054] In the specific implementation process: Traffic logs refer to logs that record network access traffic. The acquisition of traffic logs can be achieved by deploying a traffic collector and a detection engine at the traffic monitoring point. The traffic collector is used to collect full traffic data and alarm traffic data, while the detection engine can be used for periodic rule-based testing. The collected traffic data is then parsed into traffic logs, which may include timestamps, attacking IPs and ports, target IPs and ports, protocol keywords and their content, etc.

[0055] Retrieve the execution command set containing protocol keywords and the corresponding execution result dataset from traffic logs. The command execution result dataset can be obtained by using batch commands to automatically execute the command set on multiple hosts, recording the execution result of each command, comparing the multiple results for each command, retaining the common content, and generating the command execution result dataset. For example, ipconfig is a command-line tool in the Windows operating system used to display the computer's network configuration information. For instance, the common content retained in the ipconfig command execution results could include: Windows IP configuration, Ethernet adapter, connection-specific DNS suffix, local link IPv6 address, IPv4 address, subnet mask, and default gateway.

[0056] Based on protocol keywords, the first-flow attack characteristics and command execution result datasets can be linked, thereby determining the target execution result corresponding to the first-flow attack characteristics. The command execution result dataset can identify the packets from which the attack succeeded, and the first-flow attack characteristics can identify the packets containing those attack characteristics. Therefore, determining the target execution result corresponding to the first-flow attack characteristics allows us to determine the alert result for those characteristics.

[0057] After obtaining the target execution result, the successful attack message is located in the traffic log through correlation analysis, and the second-direction attack feature corresponding to the first-direction attack feature is extracted.

[0058] In the above implementation process, the target execution result of the first flow attack feature is determined from the execution result dataset by using the set of executed commands and their corresponding execution result dataset in the traffic log. Then, the second flow attack feature corresponding to the first flow attack feature can be determined so that bidirectional detection rules can be generated based on the associated attack features.

[0059] Optionally, in this embodiment of the application, based on protocol keywords, the execution command set and the first flow attack feature are correlated and analyzed to obtain the target execution result corresponding to the first flow attack feature, including: matching the protocol keywords in the execution command with the protocol keywords of the first flow attack feature to obtain the target execution command associated with the first flow attack feature; and determining the target execution result corresponding to the first flow attack feature in the execution result dataset according to the target execution command.

[0060] In the specific implementation process: Successful execution messages can be identified in the command execution result dataset of the traffic logs. However, these successful execution messages may not necessarily indicate a successful attack; they could simply mean that operations or maintenance personnel successfully executed the command. The first-direction attack signature can identify messages containing this attack signature. The execution result of these messages can be either a successful or failed attack. Only when the execution result is determined to be a successful attack can the second-direction attack signature be extracted from the successful attack messages.

[0061] It is evident that relying solely on either the execution result dataset or the first-flow attack signature is insufficient to determine whether the first-flow attack was successful, nor can it pinpoint the successfully attacked packets. Therefore, it is necessary to perform correlation analysis between the first-flow attack signature and the execution result dataset. By analyzing the target execution results determined after successful correlation, the successfully attacked packets can be identified.

[0062] The process of correlation analysis between the first-line attack characteristics and the execution result dataset is as follows: Based on keywords, the execution commands and the first-line attack characteristics are correlated. For example, protocol keywords in the execution commands are matched with protocol keywords in the first-line attack characteristics. Successfully matched execution commands are the target execution commands associated with the first-line attack characteristics. Based on the target execution commands, the corresponding target execution results are determined in the execution result dataset, which are the target execution results corresponding to the first-line attack characteristics.

[0063] In the above implementation process, by using the protocol keywords in the executed commands in the traffic logs and the protocol keywords of the first flow attack characteristics, the first flow attack characteristics and the execution result dataset are associated to determine the target execution result corresponding to the first flow attack characteristics.

[0064] Optionally, in this embodiment of the application, obtaining the second flow attack feature corresponding to the first flow attack feature based on the target execution result includes: if the target execution result indicates successful execution, then determining the attack success message corresponding to the first flow attack feature from the traffic log; extracting the second flow attack feature corresponding to the first flow attack feature from the attack success message; the second flow attack feature includes at least one of status code, response body class, or response body function.

[0065] In the specific implementation process: if the target execution result indicates successful execution, the attack success message corresponding to the first flow attack feature is determined from the traffic log based on the target execution result. Then, the response portion of the message is obtained from the attack success message, and the second flow attack feature corresponding to the first flow attack feature is extracted from this response portion. The second flow attack feature includes at least one of the following: status code, class of the response body, or function of the response body.

[0066] After obtaining the second-direction attack signature, corresponding second-direction attack signatures can be added to the attack signature table to obtain an updated attack signature set. Taking the attack signature table as an example, as shown in Table 1, the updated attack signature table can add two columns: "Response Status Code" and "Response Body". The second row of data contains the second-direction attack signatures corresponding to the first-direction attack signature "Spring Arbitrary Command Execution Vulnerability M1"; the second row of data contains the second-direction attack signatures corresponding to the first-direction attack signature "Spring Arbitrary Command Execution Vulnerability M2".

[0067]

[0068]

[0069] Table 1 Updated Attack Characteristics Table

[0070] In an optional embodiment, if the target execution result indicates execution failure, i.e., the first flow attack feature attack fails, then there will be no successful attack packets in the traffic log, and thus the second flow attack feature corresponding to the first flow attack feature cannot be extracted. If the first flow attack feature cannot be associated with the second flow attack feature, then there is no need to expand the attack feature set using the second flow attack feature; instead, attack detection rules can be generated based on the first flow attack feature.

[0071] In the above implementation process, the successful attack message corresponding to the first flow attack feature is determined from the traffic log based on the target execution result, thus locating the successfully attacked vulnerability attack message. Then, the second flow attack feature corresponding to the first flow attack feature is extracted from the successful attack message, thus correlating the first and second flow attack features and improving the richness of the attack features.

[0072] Optionally, in this embodiment of the application, obtaining the attack feature set includes: determining protocol keywords based on the transmission protocol of the traffic log; extracting information from pre-acquired network traffic data based on the protocol keywords to generate training data; the training data includes attack training data and security training data; training the training data to obtain an attack detection model; using the attack detection model to detect the data to be detected and determining predicted attack data from the data to be detected; and generating the attack feature set based on the predicted attack data and the attack data.

[0073] In the specific implementation process: the collected traffic data is parsed into traffic logs, which include protocol keywords. Taking the HTTP protocol as an example, as shown in Table 2, Table 2 shows the HTTP protocol parsing structure and protocol keywords.

[0074]

[0075]

[0076] Table 2 HTTP Protocol Parsing Structure and Protocol Keywords

[0077] The pre-acquired network traffic data includes normal traffic data and attack data; attack data can be payloads, proof-of-concept (PoC), and exploits (Exp). Attack data can be acquired by collecting and storing attack payloads, PoCs, and exploits through existing threat intelligence sources such as GitHub, vulnerability management systems of various security vendors, security monitoring platforms, vulnerability sharing articles, or attack scripts. This type of network traffic data can be collected through online vulnerability analysis sharing articles, local reproduction, or on-site collection at the customer's location. The file storage naming format can be "threat name + attack type". Refer to Table 3 for the attack type configuration table, which includes the attack type of the collected attack data, the corresponding Chinese name of the attack type, and the threat level.

[0078]

[0079]

[0080] Table 3, the attack type configuration table, extracts information from the collected normal traffic data and attack data to generate training data. An initial attack feature table can be generated from the training data based on protocol keywords; the data in this initial feature table is used to train the attack detection model.

[0081] The process of information extraction and generating the initial feature table is as follows: The obtained training data, such as Payload, PoC, and Exp, are split according to protocol keywords. The split data is then recorded in a table in text form to generate the initial attack feature table. The initial attack feature table includes threat name, attack type, data flow direction, attack characteristics, and protocol keywords. Taking the HPPT protocol as an example, HTTP protocol keywords include path, parameters, and encoded content. The content corresponding to the protocol keywords in the attack data is split out, and each split content is extracted and stored. Table 4 shows the initial attack feature table, where each row of data represents a different data flow direction (request / response) for an attack. For example, the table below shows the upstream and downstream (request / response) content of a sample. Different samples with the same threat name are distinguished using M1 and M2 sequences.

[0082]

[0083]

[0084] Table 4 Initialization Attack Characteristics Table

[0085] Training labels are added to both attack training data and security training data in the training dataset. These labels can be for normal business data and attack data, or the attack training data can be labeled with the attack type. The labeled training data is then input into a pre-defined network model. Machine learning algorithms are used to train the model on the input samples and labels, generating an attack detection model. This model identifies the input data and determines whether it is attack data; it can also predict the attack type. Machine learning algorithms include, but are not limited to, XGBoost (eXtreme Gradient Boosting), Naive Bayesian algorithm, or Multilayer Perceptron.

[0086] After obtaining the attack detection model, it can be used to detect the data to be detected, which may be some unknown sample traffic data. The attack detection model can predict the attack data that represents the attack data in the data to be detected, and use these predicted attack data to expand the sample size.

[0087] Based on the predicted attack data and the actual attack data, an attack feature set is generated, which includes an attack feature table. The specific process for generating the attack feature table is as follows: the predicted attack data is split according to protocol keywords to obtain table data; the content corresponding to each protocol keyword in the table data is compared with the content of the corresponding protocol keyword in the initial attack feature table to obtain the differences, and the differences are added to the initial attack feature table; commas can be used to separate the differences from the original content when adding the differences. The attack feature table after adding the differences is shown in Table 5.

[0088]

[0089]

[0090] Table 5 Attack Characteristics Table

[0091] Please see Figure 2 The illustrated embodiment of this application provides a training data preprocessing method.

[0092] As an optional embodiment, the training data includes attack training data and security training data, wherein the attack training data is used as black samples and the security training data is used as white samples.

[0093] The attack sample data and normal business access data are preprocessed. Preprocessing may include at least one of the following operations: decoding, case neutralization, and deduplication; decoding operations may include Base64 decoding or URL decoding.

[0094] Taking the Spring arbitrary command execution vulnerability M1 as an example: The original sample is "%5B%23this.getClass().forName(%E2%80%98java.lang.Runtime%E2%80%99)%3BgetRuntime().exec"; the characters in the original sample are converted to lowercase and processed to "%5b%23this.getclass().forname(%e2%80%98java.lang.runtime%e2%80%99)%3bgetruntime().exec"; then the URL is decoded to obtain "[#this.getclass().forname('java.lang.runtime');getruntime().exec", which completes the preprocessing operation of the attack sample data.

[0095] The preprocessed samples are then modeled using N-Gram, with 2-Gram used as an example for word splitting and deduplication, generating combinations of multiple words. The TF-IDF model is then used to convert the text into a numerical matrix, where each row represents the number of samples, each column represents a word, and the number of unique words in a sample represents the number of columns in the matrix. The TF-IDF model can statistically analyze the frequency of a given word in each document within a text set.

[0096] It can deduplicate identical sample data based on statistical data, and can also expand the sample size by generating sample sets based on combinations of multiple words.

[0097] The example above has only one sample containing 50 different words, so the output is a 1*50 matrix. Here, TF-IDF = TF*IDF, where TF represents the number of times a word or attack feature appears in the document, and IDF reflects the frequency of the word or attack feature in the document.

[0098] The preprocessed training data can be divided into a sample set and a test set. The division ratio is determined according to actual needs, for example, 80% sample data and 20% test data; or 70% sample data and 30% test data.

[0099] Preprocessed data can prevent duplicate data from generating the same rules, improve the accuracy of training data, and increase the efficiency of rule generation.

[0100] In the above implementation process, training data is obtained by extracting information from attack data and security data, and the model is further trained using this training data to obtain an attack detection model. The model then detects the data to be detected, predicting the attack data that represents the attack data within the data to be detected. This predicted attack data is used to update the attack feature set, enriching the data in the attack feature set. Furthermore, the use of the model improves the efficiency of obtaining the sample set, and machine learning enhances the detection accuracy of network attack detection rules.

[0101] Optionally, in this embodiment of the application, generating attack detection rules based on the updated attack features and the protocol keywords corresponding to the updated attack features includes: converting the updated attack features into preset format data; generating attack detection rules according to preset rules and the preset format data and the protocol keywords corresponding to the updated attack features.

[0102] In the specific implementation process: the attack features in the attack feature set generated from the predicted attack data and the attack data in the above embodiment are converted into data in a preset format. The conversion format can be JSON format or other formats.

[0103] Send the preset format data to the rule generation module, which automatically generates bidirectional network attack detection rules according to the rule syntax structure based on the protocol keywords. For example, the rule generation syntax format can be: "<action><protocol type><source IP><source port><flow symbol><target IP><target port>(msg:"<rule name>";<flow>;[protocol keyword 1;][content:protocol keyword matching content 1][protocol keyword 2;][content:protocol keyword matching content 2][flow marker]<attack type><rule number><version><other information>."

[0104] Among them, <Action> defaults to alert (network attack detection), the protocol type can be identified based on protocol keywords, <Source IP>, <Source Port>, <Flow Symbol>, <Destination IP>, <Destination Port> default to any any->any any, <Rule Name>, <Flow>, [Protocol Keyword], [Protocol Keyword Matching Content], and <Attack Type> can all be obtained by querying the attack feature table, and <Rule Number> and <Version> can be added automatically, etc.

[0105] For example, in the attack signature table, the protocol is identified as http, http.method (request method) is POST; http.uri is users; http.user_agent is cpp-httplib / ; http.request_body contains [#this.getClass().forName(|22|java.lang.Runtime|22|) and getRuntime().exec. Based on the built-in custom rule number, alarm category, alarm level, alarm result (one-way detection rules are for attempts, two-way detection rules are automatically assigned success, failure, etc. based on the response part), the request part detection rule (i.e., uplink attack detection rule) can be automatically generated according to the syntax based on the built-in custom rule number, alarm category, alarm level, alarm result (one-way detection rule is for attempts, two-way detection rules are for success, failure, etc. based on the response part). The result is: "alert http any any->anyany(msg:"Spring arbitrary command execution vulnerability"; flow:to_server,established; http.method; content:"POST"; nocase; http.ur i; content:"users"; nocase; Http.user_agent; content:"cpp-httplib / "; http.request_body; content:"[#this.getClass().forName(|22|java.lang.Runtime|22|)"; nocase; content:"getRuntime().exec"; flowbits:set,springrce; reference:url,www.flame.com; classtype:web-vulnerability-exploit-Comm and-execution;sid:30000350;rev:1;metadata:alertattempt,created_at2023_01_01,by flame;)”

[0106] In the attack signature table, if a first-flow attack signature has a corresponding second-flow attack signature, that is, a response attack signature that includes the request and is associated with it, such as http.stat_code being 500 and http.response_body being java.lang.reflect.Invocation TargetException, the corresponding response part detection rule is automatically generated based on the syntax, that is, the downlink attack detection rule.

[0107] In the above implementation process, the efficiency of generating network attack detection rules is improved by utilizing the updated attack feature set and generating syntax according to preset rules. Attack detection rules for the request side and the response side are generated based on the first and second flow attack features respectively, realizing the generation of bidirectional detection rules. This improves the problem of missed network attack detection on the response side and increases the accuracy and detection rate of network attacks.

[0108] Optionally, in this embodiment of the application, after generating attack detection rules based on the updated attack features and the protocol keywords corresponding to the updated attack features, the method further includes: using a detection engine to verify the attack detection rules to confirm whether the syntax of the attack detection rules is correct; if the syntax of the attack detection rules is correct, then using the detection engine to verify the traffic data, outputting the hit result of the attack detection rules; the hit result is used to characterize the accuracy of whether the traffic data detected by the attack detection rules is network attack data.

[0109] In the specific implementation process: To improve the accuracy of attack detection rules, it is necessary to verify the attack detection rules. Verification includes syntax checking and hit results.

[0110] First, syntax validation is performed. The detection engine validates the attack detection rules to confirm whether the syntax of the attack detection rules is correct. Rules with syntax errors can be regenerated. For example, rules with syntax errors can be returned to the rule generation module and regenerated based on the attack feature table.

[0111] If the attack detection rule syntax is correct, the detection engine uses verification traffic data to output the attack detection rule hit result. The verification traffic data can be attack traffic data retained by the detection engine during replay detection, as well as normal traffic data. The alarm hit calculation method is shown in Table 6:

[0112]

[0113] True positives and true negatives are considered true, meaning the detection result is accurate; false positives and false negatives are considered false, meaning the detection result is inaccurate. The alarm hit rate can be calculated based on the number of true hits, and the alarm hit rate is used to characterize the accuracy of the rule.

[0114] As one implementation method, if the alarm hit rate is lower than a first threshold, the rule is directly discarded and new data is collected to generate a new rule; if the alarm hit rate is greater than or equal to the first threshold but lower than the second threshold, the rule is returned to the rule generation module for rule optimization processing, where the rule is adjusted and optimized; if the alarm hit rate is greater than or equal to the second threshold, the rule is stored. The first and second thresholds are set according to implementation requirements, and this application embodiment does not limit them. For example, the first threshold can be set to 50%, and the second threshold to 80%; alternatively, the first threshold can be set to 55%, and the second threshold to 85%, etc. Based on the alarm hit rate, a confidence level label is added to the rule. The confidence level label includes high confidence, medium confidence, and low confidence. Rules with high confidence can be directly enabled. The new rule is compared with existing rules in the rule base; if a duplicate rule is found, it is deleted.

[0115] In the above implementation process, the accuracy of the attack detection rules is improved by performing syntax verification and hit verification on the generated attack detection rules, so that the attack detection rules can detect network attacks more accurately, automatically identify and process normal and abnormal network behaviors, and reduce the false alarm rate.

[0116] Please participate Figure 3 The illustrated embodiment of this application provides an automated method for generating and analyzing network attack detection rules.

[0117] In an optional embodiment, the acquisition module acquires traffic data from traffic monitoring points and parses the traffic data into traffic logs.

[0118] Simultaneously, payloads, proof-of-concepts (PoCs), and exploits are collected and stored through threat intelligence sources. Attack characteristics are extracted from these data using a scripting language (Python). An attack characteristic table is generated by using vulnerability names, attack types, protocol keywords, and data flow as column labels. The collected network attack payloads, PoCs, and exploits are then digitized and sequence labels are added to generate an attack sample set.

[0119] The attack sample set and normal business access data were used as training data. The bag-of-words model was used to extract text features, and machine learning algorithms were used to train the model.

[0120] The model is used to predict unknown samples. The predicted black samples are then used to generate table data through a script. This data is compared with the attack feature table. If the same keyword is used but the content is different, feature content is added to update the attack feature table.

[0121] Collect and generate a command execution result dataset. Correlate the uplink attack features in the attack feature table, the command execution result dataset, and the traffic logs to locate the successfully attacked packets. Extract the attack features from the response portion of the hit packets and add the corresponding downlink attack features to the attack feature table.

[0122] The attack signature table is sent to the rule generation module, which generates network attack detection rules based on the tags and content and in accordance with the rule syntax structure.

[0123] Attack detection rules are sent to the rule verification module. The detection engine replays the retained attack traffic data and normal traffic data, and finally outputs alarm hit status and rule syntax error information. Existing rules in the rule base are compared, and duplicate rules are removed. The alarm engine simulates the operation to determine if there are any syntax errors in the rules. If errors are found, rules are regenerated based on the attack feature table. If the alarm hit rate is less than the threshold, the rule is discarded and new data is collected to generate it. If the threshold is less than or equal to the hit rate, the rule is added to the manual optimization list for review and optimization. If the hit rate is greater than or equal to the threshold, a confidence tag is added based on the alarm hit status. Rules are uploaded to the rule base, and new rules are loaded into the traffic monitoring point engine for regular manual review and verification.

[0124] Please see Figure 4 The diagram shown is a structural schematic of the attack detection rule generation device provided in an embodiment of this application; this embodiment of the application provides an attack detection rule generation device 200, including:

[0125] The attack feature acquisition module 210 is used to acquire an attack feature set; the attack feature set includes a first flow attack feature and a protocol keyword for each of the first flow attack features;

[0126] The association module 220 is used to obtain a second flow attack feature corresponding to the first flow attack feature based on the protocol keyword of the first flow attack feature;

[0127] The feature expansion module 230 is used to expand the attack features in the attack feature set based on the second flow attack features to obtain an updated attack feature set; the updated attack feature set includes the updated attack features;

[0128] The rule generation module 240 is used to generate attack detection rules based on the updated attack features and the protocol keywords corresponding to the updated attack features; the attack detection rules are used to detect whether traffic data is network attack data.

[0129] Optionally, in this embodiment of the application, the attack detection rule generation device, the association module 220, is further configured to obtain an execution command set containing the protocol keyword and an execution result dataset corresponding to the execution command set from the traffic log; based on the protocol keyword, perform association analysis on the execution command set and the first flow attack feature to obtain the target execution result corresponding to the first flow attack feature; and obtain the second flow attack feature corresponding to the first flow attack feature according to the target execution result.

[0130] Optionally, in this embodiment of the application, the attack detection rule generation device, the association module 220, is further configured to match the protocol keywords in the execution command with the protocol keywords of the first flow attack feature to obtain the target execution command associated with the first flow attack feature; and determine the target execution result corresponding to the first flow attack feature in the execution result dataset according to the target execution command.

[0131] Optionally, in this embodiment of the application, the attack detection rule generation device, the association module 220, is further configured to, if the target execution result characterization is successful, determine the attack success message corresponding to the first flow attack feature from the traffic log; extract the second flow attack feature corresponding to the first flow attack feature from the attack success message; the second flow attack feature includes at least one of status code, response body class, or response body function.

[0132] Optionally, in this embodiment of the application, the attack detection rule generation device includes an attack feature acquisition module 210, which is specifically used to determine the protocol keyword based on the transmission protocol of the traffic log; extract information from pre-acquired network traffic data based on the protocol keyword to generate training data; the training data includes attack training data and security training data; train the training data to obtain an attack detection model; detect the data to be detected using the attack detection model to determine predicted attack data from the data to be detected; and generate the attack feature set based on the predicted attack data and the attack data.

[0133] Optionally, in this embodiment of the application, the attack detection rule generation device, rule generation module 240, is specifically used to convert the updated attack features into preset format data; and generate the attack detection rules according to the preset format data and the protocol keywords corresponding to the updated attack features, in accordance with a preset rule generation syntax.

[0134] Optionally, in this embodiment of the application, the attack detection rule generation device further includes a verification module, used to verify the attack detection rule using a detection engine to confirm whether the syntax of the attack detection rule is correct; if the syntax of the attack detection rule is correct, the detection engine uses the verified traffic data to output the hit result of the attack detection rule; the hit result is used to characterize the accuracy of the attack detection rule in detecting whether the traffic data is network attack data.

[0135] It should be understood that this device corresponds to the above-described attack detection rule generation method embodiment and is capable of executing the various steps involved in the above method embodiment. The specific functions of this device can be found in the description above, and detailed descriptions are omitted here to avoid repetition. The device includes at least one software functional module that can be stored in memory or embedded in the device's operating system (OS) in the form of software or firmware.

[0136] Please see Figure 5 The diagram shows a structural schematic of an electronic device provided in an embodiment of this application. An electronic device 300 provided in this application includes a processor 310 and a memory 320. The memory 320 stores machine-readable instructions executable by the processor 310. When the machine-readable instructions are executed by the processor 310, the method described above is performed.

[0137] This application also provides a storage medium storing a computer program, which is executed by a processor to perform the above-described method.

[0138] The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0139] It should be understood that the disclosed apparatus and methods can also be implemented in other ways, given the several embodiments provided in this application. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, or they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0140] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0141] The above description is only an optional implementation of the embodiments of this application, but the protection scope of the embodiments of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the embodiments of this application should be covered within the protection scope of the embodiments of this application.

Claims

1. A method for generating attack detection rules, characterized in that, include: Obtain a set of attack signatures; The attack feature set includes a first flow attack feature and a protocol keyword for each of the first flow attack features; Based on the protocol keyword of the first flow attack feature, obtain the second flow attack feature corresponding to the first flow attack feature; The attack features in the attack feature set are expanded based on the second flow attack feature to obtain an updated attack feature set; the updated attack feature set includes the updated attack features. Based on the updated attack characteristics and the corresponding protocol keywords, attack detection rules are generated; the attack detection rules are used to detect whether traffic data is network attack data. The acquired attack feature set includes: The protocol keywords are determined based on the transmission protocol of the traffic logs; Based on the protocol keywords, information is extracted from the pre-acquired network traffic data to generate training data; the training data includes attack training data and security training data. The attack detection model is obtained by training the training data. The attack detection model is used to detect the data to be detected and to determine the predicted attack data from the data to be detected. The attack feature set is generated based on the predicted attack data and the attack data; The attack feature set includes an attack feature table; the process of generating the attack feature set includes: splitting the predicted attack data according to the protocol keywords to obtain table data; comparing the content corresponding to each protocol keyword in the table data with the content of the corresponding protocol keyword in the initialized attack feature table to obtain the difference part, and adding the difference part to the initialized attack feature table.

2. The method according to claim 1, characterized in that, The step of obtaining the second flow attack feature corresponding to the first flow attack feature based on the protocol keyword of the first flow attack feature includes: Obtain the set of execution commands containing the protocol keywords from the traffic logs, as well as the dataset of execution results corresponding to the set of execution commands; Based on the protocol keywords, the execution command set and the first flow attack feature are correlated and analyzed to obtain the target execution result corresponding to the first flow attack feature; Based on the target execution result, the second flow attack feature corresponding to the first flow attack feature is obtained.

3. The method according to claim 2, characterized in that, The step of performing correlation analysis between the execution command set and the first flow attack feature based on the protocol keywords to obtain the target execution result corresponding to the first flow attack feature includes: The protocol keywords in the execution command are matched with the protocol keywords of the first flow attack feature to obtain the target execution command associated with the first flow attack feature; Based on the target execution command, determine the target execution result corresponding to the first flow attack feature in the execution result dataset.

4. The method according to claim 2, characterized in that, The step of obtaining the second flow attack feature corresponding to the first flow attack feature based on the target execution result includes: If the target execution result indicates successful execution, then the attack success message corresponding to the first flow attack feature is determined from the traffic log; Extract the second flow attack feature corresponding to the first flow attack feature from the successful attack message; the second flow attack feature includes at least one of status code, response body class, or response body function.

5. The method according to claim 1, characterized in that, The step of generating attack detection rules based on the updated attack features and the corresponding protocol keywords includes: The updated attack characteristics are converted into data in a preset format. Based on the preset format data and the protocol keywords corresponding to the updated attack features, the attack detection rules are generated according to preset rules to generate syntax.

6. The method according to any one of claims 1-5, characterized in that, After generating attack detection rules based on the updated attack features and the corresponding protocol keywords, the method further includes: The attack detection rules are validated using a detection engine to confirm whether the syntax of the attack detection rules is correct. If the syntax of the attack detection rule is correct, the detection engine uses the verified traffic data to output the hit result of the attack detection rule; the hit result is used to characterize the accuracy of the attack detection rule in detecting whether the traffic data is network attack data.

7. An attack detection rule generation device, characterized in that, include: The attack signature acquisition module is used to acquire a set of attack signatures; The attack feature set includes a first flow attack feature and a protocol keyword for each of the first flow attack features; The association module is used to obtain the second flow attack feature corresponding to the first flow attack feature based on the protocol keyword of the first flow attack feature; An extended feature module is used to expand the attack features in the attack feature set based on the second flow attack features to obtain an updated attack feature set; the updated attack feature set includes the updated attack features; The rule generation module is used to generate attack detection rules based on the updated attack features and the protocol keywords corresponding to the updated attack features; the attack detection rules are used to detect whether traffic data is network attack data. The attack feature acquisition module is further configured to determine the protocol keyword based on the transmission protocol of the traffic log; Based on the protocol keywords, information is extracted from the pre-acquired network traffic data to generate training data; The training data includes attack training data and security training data; The attack detection model is trained on the training data to obtain an attack detection model; the attack detection model is used to detect the data to be detected to determine the predicted attack data from the data to be detected; the attack feature set is generated based on the predicted attack data and the attack data. The attack signature set includes an attack signature table; The process of generating the attack feature set includes: splitting the predicted attack data according to the protocol keywords to obtain table data; The content corresponding to each protocol keyword in the table data is compared with the content of the corresponding protocol keyword in the initial attack feature table. The difference is then added to the initial attack feature table.

8. An electronic device, characterized in that, include: A processor and a memory, the memory storing machine-readable instructions executable by the processor, which, when executed by the processor, perform the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the method as described in any one of claims 1 to 6.

Images