An attack detection method and apparatus, an electronic device, and a medium

Abstract

The application relates to an attack detection method and device, electronic equipment and medium, which comprises the following steps: collecting traffic data passing through a firewall in a network, extracting the IP of the initiator of a session in the traffic data, matching the initiator IP with an attack IP library, and performing attack detection on the initiator IP based on an attacker traffic processing model if the initiator IP matches the attack IP library; matching the initiator IP with a suspicious IP library if the initiator IP does not match the attack IP library, and performing attack detection on the initiator IP based on a suspicious person traffic processing model if the initiator IP matches the suspicious IP library; matching the initiator IP with a normal IP library if the initiator IP does not match the suspicious IP library, and performing attack detection on the initiator IP based on a normal traffic processing model if the initiator IP matches the normal IP library; and performing attack detection on the initiator IP based on an unknown traffic processing model if the initiator IP does not match the normal IP library. The application processes the traffic data layer by layer through grading, so that threat detection resources are concentrated on traffic that may have threats, and the detection efficiency is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and in particular to an attack detection method and device, electronic equipment and medium. BACKGROUND

[0002] In the field of network security, real-time threat detection needs to be performed on network traffic to discover threat behaviors in the network in a timely manner. In order to more accurately discover threats in network traffic, threat detection is performed on all traffic of all users.

[0003] In the prior art, threat traffic accounts for less than one ten-thousandth of all network traffic, but the same threat detection method is performed on all traffic of all users. In a large traffic scenario, in order to guarantee the accuracy of threat detection, more threat detection time or threat detection equipment needs to be consumed. SUMMARY

[0004] Therefore, it is necessary to provide an attack detection method, device, electronic equipment and medium to solve the problem of low threat detection efficiency caused by the same threat detection method performed on all traffic.

[0005] To solve the above problem, the present application provides an attack detection method, comprising:

[0006] Collecting traffic data passing through a firewall in a network;

[0007] Extracting an IP of an initiator of a session in the traffic data;

[0008] Obtaining an attack IP library, a suspicious IP library and a normal IP library;

[0009] In a case where the initiator IP matches the attack IP library, performing attack detection on the initiator IP based on an attacker traffic processing model;

[0010] In a case where the initiator IP does not match the attack IP library, determining whether the initiator IP matches the suspicious IP library. If yes, performing attack detection on the initiator IP based on a suspicious person traffic processing model;

[0011] In a case where the initiator IP does not match the attack IP library and the initiator IP does not match the suspicious IP library, determining whether the initiator IP matches the normal IP library. If yes, performing attack detection on the initiator IP based on a normal traffic processing model;

[0012] In a case where the initiator IP does not match the attack IP library, the suspicious IP library and the normal IP library, performing attack detection on the initiator IP based on an unknown traffic processing model.

[0013] In some possible implementations, the attack detection of the initiator IP based on the attacker traffic processing model includes:

[0014] The attacker traffic processing model includes traffic data that hits suspicious rules into the suspicious IP database, and the attacker traffic processing model includes traffic data that hits attack rules into the attack IP database.

[0015] The attacker traffic processing model inputs traffic data that does not match the rules into a fully trained threat model to determine whether the traffic data that does not match the rules contains attack traffic. If attack traffic is found, the traffic data that does not match the rules is added to the attack IP database.

[0016] In some possible implementations, the attack detection of the initiating IP based on the suspicious traffic processing model includes:

[0017] The suspicious traffic processing model includes traffic data that matches the suspicious rules into the suspicious IP database, and the suspicious traffic processing model includes traffic data that matches the attack rules into the attack IP database.

[0018] The suspicious traffic processing model inputs traffic data that does not match the rules into a fully trained threat model to determine whether the traffic data that does not match the rules contains attack traffic. If attack traffic is found, the traffic data that does not match the rules is added to the attack IP database.

[0019] In some possible implementations, the attack detection of the initiating IP based on the normal traffic processing model includes:

[0020] The normal flow processing model performs sampling detection on the flow data to obtain the selected flow data.

[0021] The normal traffic processing model includes the extracted traffic data that hits the suspicious rule into the suspicious IP database, and the normal traffic processing model includes the extracted traffic data that hits the attack rule into the attack IP database.

[0022] In some possible implementations, the attack detection of the initiating IP based on the unknown traffic processing model includes:

[0023] The unknown traffic processing model includes traffic data that matches suspicious rules into the suspicious IP database, and traffic data that matches attack rules into the attack IP database.

[0024] In some possible implementations, the attack IP database, the suspicious IP database, and the normal IP database are aged out, and the aged IPs are deleted from the attack IP database, the suspicious IP database, and the normal IP database.

[0025] In some possible implementations, it is determined whether the number of sessions of the IPs in the non-threat IP database exceeds a preset number within a preset time. If it does, the number of sessions of the IPs is reset to zero, and the IPs are added to the normal IP database.

[0026] On the other hand, the present invention also provides an attack detection device, comprising:

[0027] Traffic data acquisition unit, used to collect traffic data passing through firewalls in the network;

[0028] A traffic data extraction unit is used to extract the IP address of the session initiator from the traffic data;

[0029] The IP database acquisition unit is used to acquire attack IP databases, suspicious IP databases, and normal IP databases.

[0030] The attacker traffic processing model detection unit is used to perform attack detection on the initiator IP based on the attacker traffic processing model when the initiator IP matches the attack IP database.

[0031] The suspicious traffic processing model detection unit is used to determine whether the initiator IP matches the suspicious IP database when the initiator IP does not match the attack IP database. If they match, the initiator IP is attacked based on the suspicious traffic processing model.

[0032] The normal traffic processing model detection unit is used to determine whether the initiator IP matches the normal IP database when the initiator IP does not match the attack IP database and the initiator IP does not match the suspicious IP database. If they match, the initiator IP is attacked based on the normal traffic processing model.

[0033] The unknown traffic processing model detection unit is used to perform attack detection on the initiator IP based on the unknown traffic processing model when the initiator IP does not match the attack IP database, the suspicious IP database, and the normal IP database.

[0034] On the other hand, the present invention also provides an electronic device, including a memory and a processor, wherein,

[0035] The memory is used to store programs;

[0036] The processor, coupled to the memory, is used to execute the program stored in the memory to implement the steps in the attack detection method described in any of the above implementations.

[0037] On the other hand, the present invention also provides a computer-readable storage medium for storing a computer-readable program or instructions, which, when executed by a processor, can implement the steps of an attack detection method described in any of the above implementations.

[0038] The beneficial effects of the above embodiments are as follows: The attack detection method provided by the present invention first collects network traffic data passing through the firewall, extracts the IP of the initiator of the session from the traffic data, and performs attack detection on the initiator IP based on the attacker traffic processing model if the initiator IP matches the attacker IP database. If the initiator IP does not match the attacker IP database, it is matched with a suspicious IP database. If they match, the initiator IP is attacked based on the suspicious IP traffic processing model. If they do not match, it is matched with a normal IP database. If they match, the initiator IP is attacked based on the normal traffic processing model. If they do not match, the initiator IP is attacked based on the unknown traffic processing model. The present invention processes traffic data layer by layer in a hierarchical manner, thereby concentrating threat detection resources on potentially threatening traffic and improving detection efficiency. Attached Figure Description

[0039] Figure 1 A flowchart illustrating an embodiment of an attack detection method provided by the present invention;

[0040] Figure 2 This is a schematic diagram of an embodiment of an attack detection device provided by the present invention;

[0041] Figure 3 A schematic diagram of an embodiment of the electronic device provided by the present invention. Detailed Implementation

[0042] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.

[0043] Figure 1 This is a schematic flowchart of an embodiment of an attack detection method provided by the present invention, as shown below. Figure 1 As shown, an attack detection method includes:

[0044] S101. Collect network traffic data passing through the firewall;

[0045] S102. Extract the IP address of the session initiator from the traffic data;

[0046] S103. Obtain the attack IP database, suspicious IP database, and normal IP database;

[0047] S104. If the initiator IP matches the attack IP database, perform attack detection on the initiator IP based on the attacker traffic processing model.

[0048] S105. If the initiator IP does not match the attack IP database, determine whether the initiator IP matches the suspicious IP database. If they match, perform attack detection on the initiator IP based on the suspicious traffic processing model.

[0049] S106. If the initiator's IP does not match the attack IP database and the initiator's IP does not match the suspicious IP database, determine whether the initiator's IP matches the normal IP database. If they match, perform attack detection on the initiator's IP based on the normal traffic processing model.

[0050] S107. If the initiator IP does not match the attack IP database, the suspicious IP database, and the normal IP database, perform attack detection on the initiator IP based on the unknown traffic processing model.

[0051] Compared with existing technologies, the attack detection method provided in this embodiment first collects network traffic data passing through the firewall, extracts the IP of the initiator of the session from the traffic data, and performs attack detection on the initiator IP based on the attacker traffic processing model if the initiator IP matches the attacker IP database. If the initiator IP does not match the attacker IP database, it is matched with a suspicious IP database. If they match, attack detection is performed on the initiator IP based on the suspicious IP traffic processing model. If they do not match, it is matched with a normal IP database. If they match, attack detection is performed on the initiator IP based on the normal traffic processing model. If they do not match, attack detection is performed on the initiator IP based on the unknown traffic processing model. This invention improves detection efficiency by processing traffic data layer by layer in a hierarchical manner, thereby concentrating threat detection resources on potentially threatening traffic.

[0052] It should be noted that, for ease of explanation, the IP address of the initiator of the session will be extracted from the traffic data, abbreviated as src_ip.

[0053] In some embodiments of the present invention, the attack detection of the initiating IP based on the attacker traffic processing model includes:

[0054] The attacker traffic processing model includes traffic data that hits suspicious rules into the suspicious IP database, and the attacker traffic processing model includes traffic data that hits attack rules into the attack IP database.

[0055] The attacker traffic processing model inputs traffic data that does not match the rules into a fully trained threat model to determine whether the traffic data that does not match the rules contains attack traffic. If attack traffic is found, the traffic data that does not match the rules is added to the attack IP database.

[0056] In a specific embodiment of the present invention, the first N4 packets of traffic data are processed, including flow reassembly, application identification, and data restoration. Threat detection based on IPS rules is also performed on the first N4 packets. For sessions that match suspicious rules, the session's src_ip is added to the suspicious IP database. For sessions that match attack rules, the session's src_ip is added to the attack IP database, and the session is stored in its entirety. For sessions that do not match any rules, threat model-based detection is performed. If no attack behavior is detected, no further processing is performed.

[0057] If an attack is detected through the threat model, the session's src_ip is added to the attack IP database, and the session is stored in its entirety.

[0058] These fully packaged attack packets are used to train the threat model, generating a new threat model.

[0059] In some embodiments of the present invention, the attack detection of the initiating IP based on the suspicious traffic processing model includes:

[0060] The suspicious traffic processing model will include traffic data that matches the suspicious rule into the suspicious IP database and traffic data that matches the attack rule into the attack IP database.

[0061] The suspicious traffic processing model inputs traffic data that does not match the rules into a fully trained threat model to determine whether the traffic data that does not match the rules contains attack traffic. If attack traffic is found, the suspicious traffic processing model adds the traffic data that does not match the rules to the attack IP database.

[0062] In a specific embodiment of the present invention, the first N3 packets of traffic data are processed; flow reassembly, application identification, and data restoration are performed on the first N3 packets; threat detection based on IPS rules is also performed on the first N3 packets. For sessions that match suspicious rules, the session's src_ip is added to the suspicious IP database; for sessions that match attack rules, the session's src_ip is added to the attack IP database; for sessions that do not match any rules, threat model-based detection is performed on the sessions. If no attack behavior is detected, no processing is performed.

[0063] If an attack is detected by the threat model, the session's src_ip is added to the attack IP database.

[0064] In some embodiments of the present invention, the attack detection of the initiating IP based on the normal traffic processing model includes:

[0065] The normal flow processing model performs sampling detection on the flow data to obtain the selected flow data.

[0066] The normal traffic processing model includes the extracted traffic data that hits the suspicious rule into the suspicious IP database, and the normal traffic processing model includes the extracted traffic data that hits the attack rule into the attack IP database.

[0067] Traffic data that is selected but not matched by the rules will not be processed.

[0068] In a specific embodiment of the present invention, traffic data sessions are sampled, and traffic not sampled is marked as unprocessed; the first N1 packets of the sampled sessions are processed; the first N1 packets undergo flow reassembly, application identification, and data restoration; the first N1 packets undergo threat detection based on IPS rules, and sessions that do not match the rules are not processed; for sessions that match suspicious rules, the session's src_ip is added to the suspicious IP database. For sessions that match attack rules, the session's src_ip is added to the attack IP database.

[0069] In some embodiments of the present invention, the attack detection of the initiating IP based on the unknown traffic processing model includes:

[0070] Obtain a database of non-threatening IP addresses;

[0071] The unknown traffic processing model includes the traffic data that hits the suspicious rule into the suspicious IP database, and the unknown traffic processing model includes the traffic data that hits the attack rule into the attack IP database.

[0072] Traffic data that does not match the rules will be included in the non-threat IP database.

[0073] In a specific embodiment of the present invention, the first N2 packets of traffic data are processed; the first N2 packets are reassembled, identified by application, and restored.

[0074] Threat detection based on IPS rules is performed on the first N2 packets. For sessions that match suspicious rules, the session's src_ip is added to the suspicious IP database; for sessions that match attack rules, the session's src_ip is added to the attack IP database; for sessions that do not match any rules, the session's src_ip is added to the non-threat IP statistics database when the session ages out.

[0075] In some embodiments of the present invention, the attack IP database, the suspicious IP database, and the normal IP database are aged out, and the aged IPs are deleted from the attack IP database, the suspicious IP database, and the normal IP database.

[0076] In a specific embodiment of the present invention, the management of the attack IP database, the suspicious IP database, the normal IP database, and the non-threat IP database is also included. The process of adding and updating the non-threat IP database includes: each time it is updated, the session count of the IP in the non-threat IP statistics database is incremented by one, and the count is performed every M5 days. If the number of normal sessions of the IP exceeds Q1 within M5 days, the IP is added to the normal IP database, and then the session count of the IP is cleared to zero.

[0077] For the normal IP database, the process of adding and updating includes: adding an IP to the normal IP database without recalculating the aging time of the IP; the normal IP database aging process is performed every M1 days; and the aged IP is deleted from the database.

[0078] For the suspicious IP database, the process of adding and updating includes: adding the IP to the suspicious IP database, recalculating the aging time of the IP, the aging process of the suspicious IP database is repeated every M3 days, and deleting the aged IP from the database.

[0079] For the attack IP database, the process of adding and updating includes: adding the IP to the attack IP database, recalculating the aging time of the IP, the attack IP database aging process is repeated every M4 days, and the aged IP is deleted from the database.

[0080] In some embodiments of the present invention, it is determined whether the number of sessions of the IP in the non-threat IP database exceeds a preset number within a preset time. If it does, the number of sessions of the IP is reset to zero, and the IP is added to the normal IP database.

[0081] In a specific embodiment of the present invention, the fully trained threat model includes:

[0082] A dataset is established based on samples from the attack IP database, and the sample dataset includes a training set, a test set, and a verification set;

[0083] The training set is input into a pre-established initial neural network model for training to obtain a transitional neural network model;

[0084] The transitional neural network model is validated based on the validation set, and it is determined whether the validated model has reached the prediction accuracy or the number of iterations. If it has not reached the required accuracy or the required number of iterations, the transitional neural network model is validated again. If it has reached the required accuracy or the required number of iterations, the transitional neural network model is the target neural network model.

[0085] The predictive performance of the target neural network model is tested using the test set to obtain a fully trained threat model.

[0086] To better implement the attack detection method in this embodiment of the invention, based on an attack detection method, correspondingly, such as... Figure 2 As shown, this embodiment of the invention also provides an attack detection device, an attack detection device 200 comprising:

[0087] Traffic data acquisition unit, used to collect traffic data passing through firewalls in the network;

[0088] A traffic data extraction unit is used to extract the IP address of the session initiator from the traffic data;

[0089] The IP database acquisition unit is used to acquire attack IP databases, suspicious IP databases, and normal IP databases.

[0090] The attacker traffic processing model detection unit is used to perform attack detection on the initiator IP based on the attacker traffic processing model when the initiator IP matches the attack IP database.

[0091] The suspicious traffic processing model detection unit is used to determine whether the initiator IP matches the suspicious IP database when the initiator IP does not match the attack IP database. If they match, the initiator IP is attacked based on the suspicious traffic processing model.

[0092] The normal traffic processing model detection unit is used to determine whether the initiator IP matches the normal IP database when the initiator IP does not match the attack IP database and the initiator IP does not match the suspicious IP database. If they match, the initiator IP is attacked based on the normal traffic processing model.

[0093] The unknown traffic processing model detection unit is used to perform attack detection on the initiator IP based on the unknown traffic processing model when the initiator IP does not match the attack IP database, the suspicious IP database, and the normal IP database.

[0094] The attack detection device 200 provided in the above embodiments can realize the technical solution described in the above attack detection method embodiments. The specific implementation principle of each module or unit can be found in the corresponding content of the above attack detection method embodiments, which will not be repeated here.

[0095] like Figure 3 As shown, the present invention also provides an electronic device 300. The electronic device 300 includes a processor 301, a memory 302, and a display 303. Figure 3 Only some components of the electronic device 300 are shown, but it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0096] In some embodiments, processor 301 may be a central processing unit (CPU), microprocessor, or other data processing chip, used to run program code stored in memory 302 or process data, such as an attack detection method in this invention.

[0097] In some embodiments, processor 301 may be a single server or a group of servers. The server group may be centralized or distributed. In some embodiments, processor 301 may be local or remote. In some embodiments, processor 301 may be implemented on a cloud platform. In one embodiment, the cloud platform may include a private cloud, public cloud, hybrid cloud, community cloud, distributed cloud, intranet, multi-cloud, etc., or any combination thereof.

[0098] In some embodiments, memory 302 may be an internal storage unit of electronic device 300, such as a hard disk or memory of electronic device 300. In other embodiments, memory 302 may also be an external storage device of electronic device 300, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc. equipped on electronic device 300.

[0099] Furthermore, the memory 303 may include both internal storage units of the electronic device 300 and external storage devices. The memory 302 is used to store application software and various types of data installed on the electronic device 300.

[0100] In some embodiments, display 303 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an OLED (Organic Light-Emitting Diode) touchscreen. Display 303 is used to display information from electronic device 300 and to display a visual user interface. Components 301-303 of electronic device 300 communicate with each other via a system bus.

[0101] In one embodiment, when processor 301 executes an attack detection program stored in memory 302, the following steps can be implemented:

[0102] Collect network traffic data passing through firewalls;

[0103] Extract the IP address of the session initiator from the traffic data;

[0104] Obtain attack IP databases, suspicious IP databases, and normal IP databases;

[0105] If the initiator IP matches the attack IP database, attack detection is performed on the initiator IP based on the attacker traffic processing model.

[0106] If the initiator's IP does not match the attack IP database, determine whether the initiator's IP matches the suspicious IP database. If they match, perform attack detection on the initiator's IP based on the suspicious traffic processing model.

[0107] If the initiator's IP does not match the attack IP database and the suspicious IP database, determine whether the initiator's IP matches the normal IP database. If they match, perform attack detection on the initiator's IP based on the normal traffic processing model.

[0108] If the initiator's IP does not match the attack IP database, the suspicious IP database, or the normal IP database, the initiator's IP is attacked based on the unknown traffic processing model.

[0109] It should be understood that when the processor 301 executes an attack detection program in the memory 302, in addition to the functions mentioned above, it can also perform other functions, as detailed in the description of the corresponding method embodiments above.

[0110] Furthermore, the embodiments of the present invention do not specifically limit the type of electronic device 300 mentioned. Electronic device 300 can be a mobile phone, tablet computer, personal digital assistant (PDA), wearable device, laptop computer, or other portable electronic device. Exemplary embodiments of portable electronic devices include, but are not limited to, portable electronic devices running iOS, Android, Microsoft, or other operating systems. The aforementioned portable electronic device can also be other portable electronic devices, such as a laptop computer with a touch-sensitive surface (e.g., a touch panel). It should also be understood that in some other embodiments of the present invention, electronic device 300 may not be a portable electronic device, but rather a desktop computer with a touch-sensitive surface (e.g., a touch panel).

[0111] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0112] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. An attack detection method, characterized in that, include: Collect network traffic data passing through firewalls; Extract the IP address of the session initiator from the traffic data; Obtain attack IP databases, suspicious IP databases, and normal IP databases; If the IP of the initiator matches the attack IP database, attack detection is performed on the IP of the initiator based on the attacker traffic processing model. If the IP of the initiator does not match the attack IP database, it is determined whether the IP of the initiator matches the suspicious IP database. If they match, the IP of the initiator is attacked based on the suspicious traffic processing model. If the IP of the initiator does not match the attack IP database and does not match the suspicious IP database, determine whether the IP of the initiator matches the normal IP database. If they match, perform attack detection on the IP of the initiator based on the normal traffic processing model. If the initiator's IP does not match the attack IP database, the suspicious IP database, or the normal IP database, attack detection is performed on the initiator's IP based on the unknown traffic processing model.

2. The attack detection method according to claim 1, characterized in that, The attack detection of the initiator's IP based on the attacker traffic processing model includes: The attacker traffic processing model includes traffic data that hits suspicious rules into the suspicious IP database, and the attacker traffic processing model includes traffic data that hits attack rules into the attack IP database. The attacker traffic processing model inputs traffic data that does not match the rules into a fully trained threat model to determine whether the traffic data that does not match the rules contains attack traffic. If attack traffic exists, the traffic data that does not match the rules is added to the attack IP database.

3. The attack detection method according to claim 1, characterized in that, The attack detection of the initiator's IP based on the suspicious traffic processing model includes: The suspicious traffic processing model includes traffic data that matches the suspicious rules into the suspicious IP database, and the suspicious traffic processing model includes traffic data that matches the attack rules into the attack IP database. The suspicious traffic processing model inputs traffic data that does not match the rules into a fully trained threat model to determine whether the traffic data that does not match the rules contains attack traffic. If attack traffic is found, the traffic data that does not match the rules is added to the attack IP database.

4. The attack detection method according to claim 1, characterized in that, The attack detection of the initiator's IP based on the normal traffic processing model includes: The normal flow processing model performs sampling detection on the flow data to obtain the selected flow data. The normal traffic processing model includes the traffic data that has been selected and hit the suspicious rule into the suspicious IP database, and the normal traffic processing model includes the traffic data that has been selected and hit the attack rule into the attack IP database.

5. The attack detection method according to claim 1, characterized in that, The attack detection of the initiator's IP based on the unknown traffic processing model includes: The unknown traffic processing model includes traffic data that matches suspicious rules into the suspicious IP database, and traffic data that matches attack rules into the attack IP database.

6. The attack detection method according to claim 1, characterized in that, Also includes: The attack IP database, the suspicious IP database, and the normal IP database are aged out, and the aged IPs are deleted from the attack IP database, the suspicious IP database, and the normal IP database.

7. The attack detection method according to claim 5, characterized in that, Also includes: Determine whether the number of sessions of the IPs in the non-threat IP database exceeds a preset number within a preset time. If it does, reset the number of sessions of the IPs in the non-threat IP database to zero and add the IPs in the non-threat IP database to the normal IP database.

8. An attack detection device, characterized in that, include: Traffic data acquisition unit, used to collect traffic data passing through firewalls in the network; A traffic data extraction unit is used to extract the IP address of the session initiator from the traffic data; The IP database acquisition unit is used to acquire attack IP databases, suspicious IP databases, and normal IP databases. The attacker traffic processing model detection unit is used to detect attacks on the IP of the initiator based on the attacker traffic processing model when the IP of the initiator matches the attack IP database. The suspicious traffic processing model detection unit is used to determine whether the IP of the initiator matches the suspicious IP database when the IP of the initiator does not match the attack IP database. If they match, the unit performs attack detection on the IP of the initiator based on the suspicious traffic processing model. The normal traffic processing model detection unit is used to determine whether the IP of the initiator matches the normal IP database when the IP of the initiator does not match the attack IP database and the IP of the initiator does not match the suspicious IP database. If they match, the unit performs attack detection on the IP of the initiator based on the normal traffic processing model. The unknown traffic processing model detection unit is used to perform attack detection on the initiator's IP based on the unknown traffic processing model when the initiator's IP does not match the attack IP database, the suspicious IP database, and the normal IP database.

9. An electronic device, characterized in that, Including memory and processor, among which, The memory is used to store programs; The processor, coupled to the memory, is used to execute the program stored in the memory to implement the steps in the attack detection method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store computer-readable programs or instructions, which, when executed by a processor, can implement the steps in an attack detection method according to any one of claims 1 to 7.

Images