Method for defending against network attacks, terminal device and storage medium

Abstract

The application discloses a network attack defense method, a terminal device and a storage medium, and belongs to the technical field of network security, wherein the network attack defense method comprises the following steps: when an access request is received, acquiring a request parameter corresponding to the access request and extracting a request feature corresponding to the request parameter; based on a target ICM-PPO model, selecting a defense strategy sequence corresponding to the access request according to the request feature; and performing attack detection on the access request according to the defense strategy sequence. According to the request feature of the access request, the corresponding defense strategy sequence is selected for attack detection, and it is not necessary to execute all defense strategy schemes, so that the calculation cost of the system is reduced.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method for defending against network attacks, a terminal device, and a storage medium. Background Technology

[0002] With the deepening development of the Internet, various web applications have sprung up like mushrooms after rain, and attacks have also emerged one after another. Attack detection, identification and system protection have received increasing attention, especially for financial systems involving user funds security.

[0003] In related technologies, detection schemes for different attack types are typically pre-set. When a request is received, all attack type detection schemes are executed on the request to determine whether the request carries an attack. However, network attacks are diverse, and executing all attack type detection schemes for every request would result in enormous computational overhead for the system.

[0004] The above content is only used to help understand the technical solution of the present invention and does not represent an admission that the above content is prior art. Summary of the Invention

[0005] This invention provides a method for defending against network attacks, a terminal device, and a storage medium, aiming to solve the technical problem of high attack detection overhead and achieve the effect of reducing the computational cost of attack detection.

[0006] To achieve the above objectives, embodiments of the present invention provide a method for defending against network attacks, the method comprising the following:

[0007] Upon receiving an access request, obtain the request parameters corresponding to the access request and extract the request features corresponding to the request parameters;

[0008] Based on the target ICM-PPO model, a defense strategy sequence corresponding to the access request is selected according to the request characteristics;

[0009] Attack detection is performed on the access request according to the defense strategy sequence.

[0010] Optionally, before the step of obtaining the request parameters corresponding to the access request and extracting the request features corresponding to the request parameters upon receiving the access request, the method includes:

[0011] Obtain the request parameters corresponding to each access request of the terminal;

[0012] Based on the request parameters, determine the training data and test data corresponding to the access request;

[0013] Based on the training data, train the ICM-PPO model and determine the initial ICM-PPO model;

[0014] Based on the test data, the initial ICM-PPO model is tested, and the target ICM-PPO model is determined.

[0015] Optionally, the step of training the ICM-PPO model based on the training data and determining the initial ICM-PPO model includes:

[0016] The training data is input into the ICM-PPO model, and the defense strategy sequence output by the ICM-PPO model is obtained.

[0017] Based on the defense strategy sequence, attack detection is performed on the access requests corresponding to the training data to determine the hit rate of the defense strategy sequence and the actual detection time of the attack detection on the access requests.

[0018] Based on the hit rate and the actual detection time, adjust the model parameters of the ICM-PPO model;

[0019] The steps of inputting the training data into the ICM-PPO model and obtaining the defense strategy sequence output by the ICM-PPO model are performed until a converged initial ICM-PPO model is obtained.

[0020] Optionally, the step of testing the initial ICM-PPO model based on the test data and determining the target ICM-PPO model includes:

[0021] Receive the evaluation metrics of the initial ICM-PPO model;

[0022] Under a preset network traffic scenario, the access request generated from the test data is sent to the terminal;

[0023] Input the access request into the initial ICM-PPO model and obtain the defense strategy sequence output by the initial ICM-PPO model;

[0024] According to the defense strategy sequence, attack detection is performed on the access request to obtain the detection result;

[0025] Based on the detection results and the evaluation indicators, the target ICM-PPO model is determined.

[0026] Optionally, the step of selecting the defense strategy sequence corresponding to the access request based on the target ICM-PPO model and the request characteristics includes:

[0027] Based on the request characteristics, a defense strategy scheme corresponding to the access request and the implementation probability of the defense strategy scheme are selected;

[0028] Obtain the target defense strategy scheme whose implementation probability is greater than a preset threshold;

[0029] The target defense strategy schemes are sorted according to a preset method to obtain the defense strategy sequence.

[0030] Optionally, the step of obtaining the request parameters corresponding to the access request and extracting the request features corresponding to the request parameters when receiving an access request includes:

[0031] Upon receiving the access request, obtain the request parameters corresponding to the access request;

[0032] Based on preprocessing tools, request features corresponding to the request parameters are extracted.

[0033] Optionally, the step of obtaining the request parameters corresponding to the access request and extracting the request features corresponding to the request parameters when receiving an access request includes:

[0034] Based on the request parameters, obtain the request type corresponding to the access request;

[0035] Based on the request type, obtain the corresponding defense strategy rules;

[0036] Based on the defense strategy rules, extract the request features corresponding to the request parameters.

[0037] Optionally, the step of obtaining the request type corresponding to the access request based on the request parameters includes:

[0038] Upon receiving the access request, obtain the access path of the access request;

[0039] Based on the access path, determine the request type corresponding to the access request.

[0040] In addition, to achieve the above objectives, the present invention also provides a terminal device, the terminal device comprising: a memory, a processor, and a network attack defense program stored in the memory and executable on the processor, wherein the network attack defense program, when executed by the processor, implements the steps of the network attack defense method as described above.

[0041] In addition, to achieve the above objectives, the present invention also provides a computer-readable storage medium storing a network attack defense program, which, when executed by a processor, implements the steps of the network attack defense method described above.

[0042] An embodiment of this invention proposes a network attack defense method. The method involves a terminal device and a computer-readable storage medium. Upon receiving an access request, the method acquires the request parameters corresponding to the access request and extracts the request features corresponding to the request parameters. Then, based on a target ICM-PPO model, it selects a defense strategy sequence corresponding to the access request according to the extracted request features, and performs attack detection on the access request according to the defense strategy sequence. By selecting the corresponding defense strategy sequence based on the request features of the access request for attack detection, it is unnecessary to execute all defense strategy schemes, thus reducing the computational overhead of the system. Attached Figure Description

[0043] Figure 1 This is a flowchart illustrating an embodiment of the network attack defense method of the present invention;

[0044] Figure 2 This is a detailed flowchart of step S10 in the second embodiment of the network attack defense method of the present invention;

[0045] Figure 3 This is a detailed flowchart of step S70 in the third embodiment of the network attack defense method of the present invention.

[0046] Figure 4 This is a further detailed flowchart of step S10 in the fourth embodiment of the network attack defense method of the present invention;

[0047] Figure 5 This is a schematic diagram of the terminal structure of the hardware operating environment involved in the embodiments of the present invention.

[0048] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0049] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0050] In related technologies, different attack type detection schemes are typically pre-set. When a request is received, all attack type detection schemes are executed to determine whether the request carries an attack. However, network attacks are diverse, and executing all attack type detection schemes for every received request would result in enormous computational overhead.

[0051] To address the aforementioned deficiencies in related technologies, this invention proposes a method for defending against network attacks, the main steps of which include the following:

[0052] Upon receiving an access request, the system retrieves the request parameters and extracts the corresponding request features. Then, based on the target ICM-PPO model and the extracted request features, it selects a defense strategy sequence corresponding to the access request and performs attack detection on the access request according to the defense strategy sequence. By selecting the appropriate defense strategy sequence based on the access request's features, it is unnecessary to execute all defense strategy schemes, thus reducing the system's computational overhead.

[0053] To better understand the above technical solutions, exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the drawings, it should be understood that the present invention can be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present invention and to fully convey the scope of the invention to those skilled in the art.

[0054] Reference Figure 1 In one embodiment of the network attack defense method of the present invention, the network attack defense method includes the following steps:

[0055] Step S10: Upon receiving an access request, obtain the request parameters corresponding to the access request and extract the request features corresponding to the request parameters;

[0056] In this embodiment, the execution entity is the terminal. This invention aims to predict the corresponding defense strategy based on the request parameters of the access request, thereby executing the defense strategy on the access request and detecting existing attacks, without having to execute all defense strategies, thus avoiding high computational overhead. It should be noted that the request parameters include, but are not limited to, request type, number of parameters, number of abnormal symbols, number of long parameters, IP address, and port. The request types include, but are not limited to, transaction-related, database operation-related, upload-related, download-related, and login authorization-related. When the terminal receives an access request, it can obtain the access path of the access request and determine the corresponding request type based on the access path. It should be noted that, apart from the request type, the other parameters in the request parameters are parameters carried in the access request and can be directly obtained from the received access request.

[0057] Step S20: Based on the target ICM-PPO model, select the defense strategy sequence corresponding to the access request according to the request characteristics;

[0058] In this embodiment, the present invention constructs a DRL (Deep Reinforcement Learning) model based on the PPO (Proximal Policy Optimization) algorithm, and then embeds an Instinct Curiosity Module (ICM) into the constructed DRL model to obtain the target ICM-PPO model. The PPO algorithm has stronger learning capabilities and robustness in various scenarios. Combining ICM and PPO helps to explore more under complex traffic change conditions. Compared with general RL (Reinforcement Learning) models, it has better training effects and can improve the accuracy of the defense strategy sequence selected based on request features according to the ICM-PPO model, thereby improving the success rate of attack detection. After extracting the request features corresponding to the access request, the request features are input into the target ICM-PPO model, which selects the corresponding defense strategy sequence based on the extracted request features.

[0059] Step S40: Perform attack detection on the access request according to the defense strategy sequence.

[0060] In this embodiment, attack detection of access requests is achieved by sequentially executing defense strategy schemes from the defense strategy sequence. When abnormal attack data is detected in an access request, corresponding processing measures can be taken according to the attack type corresponding to the abnormal attack data, and corresponding alarm messages can be output to prevent the terminal or the terminal's server from being attacked, causing data leakage or system crash. The alarm messages include, but are not limited to, the attack type and processing measures.

[0061] For example, if an access request is detected to contain suspicious XSS (Cross-Site Scripting) statements, the corresponding handling measure for that type is to block the access request.

[0062] Optionally, the step of selecting the defense strategy sequence corresponding to the access request based on the request characteristics includes: selecting the defense strategy scheme corresponding to the access request and the implementation probability corresponding to the defense strategy scheme based on the request characteristics, then obtaining the target defense strategy scheme with the implementation probability greater than a preset threshold, sorting the target defense strategy scheme according to a preset method, and obtaining the defense strategy sequence.

[0063] In this embodiment, based on the target ICM-PPO model, according to the request characteristics, the defense strategy scheme corresponding to the access request and the implementation probability of the defense strategy scheme are selected. The defense strategy scheme with the implementation probability less than a preset threshold is excluded, and the defense strategy scheme with the implementation probability greater than the preset threshold is sorted in ascending order to obtain the defense strategy sequence, thereby achieving the goal of reducing the number of defense strategy schemes and further reducing the computational overhead of the system.

[0064] Optionally, in another optional embodiment, the step of obtaining the request parameters corresponding to the access request and extracting the request features corresponding to the request parameters when the access request is received includes: obtaining the request parameters corresponding to the access request when the access request is received, and then extracting the request features corresponding to the request parameters based on a preprocessing tool.

[0065] In this embodiment, a preprocessing tool is used to extract request features from the request parameters. For example, a network packet capture tool can be used to capture and analyze the received access request, obtain the request parameters, and extract and calculate the request features from the request parameters. Alternatively, a dedicated web security testing tool can be used, or a corresponding regular expression can be written to extract request features from the request parameters. This embodiment does not specifically limit the specific methods used.

[0066] In the technical solution provided in this embodiment, upon receiving an access request, the request parameters corresponding to the access request are obtained, and the request features corresponding to the request parameters are extracted. Then, based on the target ICM-PPO model, a defense strategy sequence corresponding to the access request is selected according to the extracted request features. Finally, attack detection is performed on the access request according to the defense strategy sequence. By selecting the corresponding defense strategy sequence for attack detection based on the request features of the access request, it is not necessary to execute all defense strategy schemes for all received access requests, thus reducing the computational overhead of the system.

[0067] Reference Figure 2 In the second embodiment, based on the first embodiment, before step S10, the following steps are included:

[0068] Step S40: Obtain the request parameters corresponding to each access request of the terminal;

[0069] Step S50: Determine the training data and test data corresponding to the access request based on the request parameters;

[0070] In this embodiment, based on the request parameters corresponding to each access request from the terminal, automated tools are used to randomly generate attack requests, thereby obtaining training data and test data. It is understood that the training data and test data include access requests carrying abnormal attack data and normal access requests.

[0071] Step S60: Train the ICM-PPO model based on the training data to determine the initial ICM-PPO model;

[0072] In this embodiment, the ICM-PPO model constructed by this invention consists of three elements of reinforcement learning: State, Action, and Reward. By analyzing each access request from the terminal, these three elements are defined. The State element is defined as the request characteristics and the statistical performance of each defense strategy scheme. The statistical performance is the detection time for executing the defense strategy sequence. Action is defined as the opening / closing and sequence of the defense strategy scheme. It should be noted that the number of Actions in this invention is equal to the number of defense strategy schemes, and each Action corresponds to the implementation probability of that defense strategy scheme. Reward is defined as the time consumed in executing the defense strategy sequence. It should be noted that the time consumed is determined based on the hit rate of the defense strategy sequence and the actual detection time for executing the defense strategy sequence. The model parameters of ICM-PPO are continuously adjusted based on the time consumed until a convergent initial ICM-PPO model is obtained. The model parameter is Reward.

[0073] Optionally, by acquiring various defense strategy schemes of the terminal, combining the various defense strategy schemes into the defense strategy sequence, and executing the defense strategy sequence on access requests received within a preset time period, the detection time of executing the defense strategy sequence a preset number of times can be obtained. Based on the detection time of the preset number of times, the average detection time of executing the defense strategy sequence can be determined, and the average detection time can be used as the detection time of executing the defense strategy sequence, i.e., the statistical performance. This embodiment does not specifically limit this.

[0074] Optionally, the step of training the ICM-PPO model based on the training data and determining the initial ICM-PPO model includes: inputting the training data into the ICM-PPO model and obtaining the defense strategy sequence output by the ICM-PPO model; performing attack detection on the access requests corresponding to the training data according to the defense strategy sequence, determining the hit rate of the defense strategy sequence, and the actual detection time of the attack detection on the access requests; adjusting the model parameters of the ICM-PPO model according to the hit rate and the actual detection time; and performing the step of inputting the training data into the ICM-PPO model and obtaining the defense strategy sequence output by the ICM-PPO model until a converged initial ICM-PPO model is obtained.

[0075] In this embodiment, the model parameter is Reward. This invention determines the execution time of the defense strategy sequence based on the hit rate and actual detection time, and then adjusts the Reward of ICM-PPO according to the execution time, continuing training until a converged initial ICM-PPO model is obtained. The ICM-PPO model can be trained for a preset number of rounds, and the distribution of access request numbers in each round is set differently, resulting in variations in network traffic, thereby effectively avoiding overfitting. For example, the preset number of rounds can be set to 300 rounds, and the detection time can be set to 1200 seconds, with the number of access requests increasing by 5 in each round. It should be noted that the hit rate is divided into three cases: both normal and abnormal requests are correctly identified; abnormal requests are identified as normal requests; and normal requests are identified as abnormal requests. This invention assigns corresponding hit coefficients to different hit scenarios to characterize the accuracy of the defense strategy sequence selected by the ICM-PPO model, and sets a latency threshold based on the detection time corresponding to the statistical performance. The latency threshold can be the detection time corresponding to the statistical performance, or it can be reasonably set based on the detection time corresponding to the statistical performance; this embodiment does not specifically limit this. Then, based on the hit coefficients corresponding to the hit scenarios, the latency threshold, and the actual detection time, the time consumption is determined, and the reward is adjusted based on the time consumption. The time consumption Rt = hit coefficient * (latency threshold - actual detection time).

[0076] Optionally, the step of performing attack detection on the access request corresponding to the training data according to the defense strategy sequence, determining the hit rate of the defense strategy sequence, and the actual detection time of the attack detection on the access request includes: obtaining the detection result of executing the defense strategy sequence, matching the detection result with the training data, and determining the hit rate of the defense strategy sequence.

[0077] In this embodiment, the training data includes access requests carrying abnormal attack data and normal access requests. The present invention uses a pre-recorded data table of access requests corresponding to the training data, where the data table records all attacks carried by the access requests. Therefore, after obtaining the detection results, the detected attacks can be obtained based on the detection results, and the detected attacks can be matched with the attacks in the data table to determine the hit rate. This embodiment does not impose specific limitations on this process.

[0078] Step S70: Based on the test data, test the initial ICM-PPO model and determine the target ICM-PPO model.

[0079] In this embodiment, after obtaining the converged initial ICM-PPO model, the present invention performs traffic testing on the initial ICM-PPO model to further determine whether the hit rate and actual detection time corresponding to the output defense strategy sequence of the initial ICM-PPO model still meet the requirements in the scenario of constantly changing traffic, that is, whether the initial ICM-PPO model is still in a converged state.

[0080] In the technical solution provided in this embodiment, by acquiring the request parameters corresponding to each access request from the terminal, training data and test data corresponding to the access requests are determined based on the request parameters. Then, an ICM-PPO model is trained based on the training data to determine the initial ICM-PPO model. Finally, the initial ICM-PPO model is tested based on the test data to determine the target ICM-PPO model. By pre-training and testing the ICM-PPO model, the accuracy of the selected defense strategy sequence is improved, thereby increasing the hit rate of attack detection.

[0081] Reference Figure 3 In the third embodiment, based on any of the above embodiments, step S70 includes:

[0082] Step S71: Receive the evaluation metrics of the initial ICM-PPO model;

[0083] In this embodiment, after training a converged initial ICM-PPO model, the present invention further tests whether the defense strategy sequence selected by the initial ICM-PPO model meets the requirements of the evaluation indicators under different traffic scenarios, so as to improve the hit rate of attack detection. The evaluation indicators can be the hit rate of the defense strategy sequence and the detection time. For example, the evaluation indicator is that both normal and abnormal requests are correctly identified, and the detection time is less than 100 seconds. Alternatively, it can be the hit rate of the defense strategy sequence and the detection time, where the hit rate is the ratio of the number of attacks detected by the defense strategy sequence to the number of attacks actually carried by the access request. For example, the evaluation indicator is a hit rate greater than 0.7 and a detection time less than 100 seconds. The present invention does not impose specific limitations on this.

[0084] Step S72: Under a preset network traffic scenario, send the access request generated by the test data to the terminal;

[0085] Step S73: Input the access request into the initial ICM-PPO model and obtain the defense strategy sequence output by the initial ICM-PPO model;

[0086] Step S74: Perform attack detection on the access request according to the defense strategy sequence and obtain the detection result;

[0087] Step S75: Determine the target ICM-PPO model based on the detection results and the evaluation indicators.

[0088] In this embodiment, under a preset network traffic scenario, the detection results of the initial ICM-PPO model are tested to see if they match the evaluation metrics. If they match, the initial ICM-PPO model is used as the target ICM-PPO model; if they do not match, the model parameters of the initial ICM-PPO model are adjusted until a target ICM-PPO model whose detection results match the evaluation metrics is obtained. It should be noted that this invention simulates the preset network traffic scenario by setting the terminal's QPS (Queries Per Second). The detection results include the hit status, hit rate, and actual detection time.

[0089] Optionally, in another implementation, the step of determining the target ICM-PPO model based on the detection results and the evaluation indicators further includes: determining whether the detection results meet the evaluation indicators; if the detection results meet the evaluation indicators, deploying the initial ICM-PPO model into a real network traffic scenario, obtaining the detection results of the initial ICM-PPO model in the real network traffic scenario, and performing the step of determining the target ICM-PPO model based on the detection results and the evaluation indicators. The real network traffic scenario refers to deploying the initial ICM-PPO model into a terminal for use, without simulating network traffic. By testing the initial ICM-PPO model in a real network traffic scenario, the obtained target ICM-PPO model achieves a high degree of fit with the terminal in the real network traffic scenario, improving the accuracy of the selected defense strategy sequence and thus increasing the attack detection hit rate.

[0090] For example, the terminal is set from 0.1 QPS to 10 QPS to simulate different network traffic scenarios, i.e., preset network traffic scenarios. Each network traffic scenario is tested for a preset number of rounds. Under the preset network traffic scenarios, if the detection results of the initial ICM-PPO model meet the evaluation indicators, the detection results of the initial ICM-PPO model in the real scenario are then tested to see if they meet the evaluation indicators, thereby determining the target ICM-PPO model.

[0091] In the technical solution provided in this embodiment, by receiving the evaluation metrics of the initial ICM-PPO model, under a preset network traffic scenario, an access request generated from test data is sent to the terminal. The access request is input into the initial ICM-PPO model, and the defense strategy sequence output by the initial ICM-PPO model is obtained. Then, according to the defense strategy sequence, attack detection is performed on the access request to obtain the detection result. Based on the detection result and the evaluation metrics, the target ICM-PPO model is determined. After obtaining a converged initial ICM-PPO model through training, the defense strategy sequence selected by the initial ICM-PPO model is further tested under different traffic scenarios to determine whether it meets the requirements of the evaluation metrics, thereby improving the hit rate of attack detection.

[0092] Reference Figure 4 In the fourth embodiment, based on any of the above embodiments, step S10 includes:

[0093] Step S11: Obtain the request type corresponding to the access request based on the request parameters;

[0094] Step S12: Obtain the corresponding defense strategy rules according to the request type;

[0095] Step S13: Extract the request features corresponding to the request parameters according to the defense strategy rules.

[0096] Because different request types require different data, hackers often employ different attacks targeting different request types to steal end-users' personal information or crash the server. For example, database operation attacks may involve SQL (Structured Query Language) injection, where external parameters are appended to the SQL statement, tricking the server into executing malicious SQL statements and causing serious consequences such as data leaks, database deletion, and page tampering. Transaction attacks may involve password attacks and semantic URL (uniform resource locator) attacks, attempting to obtain transaction passwords and steal users' assets or personal information.

[0097] In this embodiment, a corresponding defense strategy rule is obtained based on the request type of the access request. This defense strategy rule is pre-set according to the characteristics of attacks launched by hackers for different types of access requests, specifically specifying which request parameters carry the abnormal attack data. It should be noted that the defense strategy rule specifies which parameters in the request parameters should have their corresponding request features extracted. Therefore, upon receiving an access request, the defense strategy rule can be obtained based on the request type, and the corresponding request features in the request parameters can be extracted. This eliminates the need to extract request features corresponding to all request parameters for every access request, reducing the system's computational overhead. For example, for database operation access requests, the defense strategy rule only needs to be set to extract corresponding request features based on the number of abnormal matches, IP address, and port of the access request.

[0098] Optionally, after the step of performing attack detection on the access request according to the defense strategy sequence, the method further includes: obtaining the detection result of the attack detection on the access request; determining the attack type carried by the access request based on the detection result; and taking corresponding protective measures according to the attack level of the attack type. The protective measures include ignoring, recording, warning, and blocking. Different protective measures are taken for different attack levels to avoid damage to the terminal and leakage of terminal user information.

[0099] In the technical solution provided in this embodiment, the request type corresponding to the access request is obtained based on the request parameters. Then, the corresponding defense strategy rule is obtained based on the request type. Based on the defense strategy rule, the request features corresponding to the request parameters are extracted. By obtaining the defense strategy rule based on the request type corresponding to the access request and extracting the corresponding request features from the request parameters, it is not necessary to extract the request features corresponding to all request parameters for every access request, thus reducing the computational overhead of the system.

[0100] Reference Figure 5 , Figure 5 This is a schematic diagram of the terminal structure of the hardware operating environment involved in the embodiments of the present invention.

[0101] In this embodiment of the invention, the terminal can be a terminal device, which can be a mobile phone, computer, tablet computer, or virtual device. This embodiment does not specifically limit the type of device.

[0102] like Figure 5As shown, the terminal may include: a processor 1001, such as a CPU; a network interface 1004; a user interface 1003; a memory 1005; and a communication bus 1002. The communication bus 1002 is used to enable communication between these components. The user interface 1003 may include a display screen, an input unit, etc., and optionally, the user interface 1003 may also include a standard wired interface or a wireless interface. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface). The memory 1005 may be high-speed RAM or stable non-volatile memory, such as a disk drive. Optionally, the memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0103] Those skilled in the art will understand that Figure 5 The terminal structure shown does not constitute a limitation on the terminal and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0104] like Figure 5 As shown, the memory 1005, which serves as a computer storage medium, may include an operating system, a network communication module, a user interface module, and a network attack defense program.

[0105] exist Figure 5 In the terminal shown, network interface 1004 is mainly used to connect to the backend server and communicate with it; processor 1001 can be used to call the network attack defense program stored in memory 1005 and perform the following operations:

[0106] Upon receiving an access request, obtain the request parameters corresponding to the access request and extract the request features corresponding to the request parameters;

[0107] Based on the target ICM-PPO model, a defense strategy sequence corresponding to the access request is selected according to the request characteristics;

[0108] Attack detection is performed on the access request according to the defense strategy sequence.

[0109] Furthermore, the processor 1001 can invoke the network attack defense program stored in the memory 1005 and also perform the following operations:

[0110] Obtain the request parameters corresponding to each access request of the terminal;

[0111] Based on the request parameters, determine the training data and test data corresponding to the access request;

[0112] Based on the training data, train the ICM-PPO model and determine the initial ICM-PPO model;

[0113] Based on the test data, the initial ICM-PPO model is tested, and the target ICM-PPO model is determined.

[0114] Furthermore, the processor 1001 can invoke the network attack defense program stored in the memory 1005 and also perform the following operations:

[0115] The training data is input into the ICM-PPO model, and the defense strategy sequence output by the ICM-PPO model is obtained.

[0116] Based on the defense strategy sequence, attack detection is performed on the access requests corresponding to the training data to determine the hit rate of the defense strategy sequence and the actual detection time of the attack detection on the access requests.

[0117] Based on the hit rate and the actual detection time, adjust the model parameters of the ICM-PPO model;

[0118] The steps of inputting the training data into the ICM-PPO model and obtaining the defense strategy sequence output by the ICM-PPO model are performed until a converged initial ICM-PPO model is obtained.

[0119] Furthermore, the processor 1001 can invoke the network attack defense program stored in the memory 1005 and also perform the following operations:

[0120] Receive the evaluation metrics of the initial ICM-PPO model;

[0121] Under a preset network traffic scenario, the access request generated from the test data is sent to the terminal;

[0122] Input the access request into the initial ICM-PPO model and obtain the defense strategy sequence output by the initial ICM-PPO model;

[0123] According to the defense strategy sequence, attack detection is performed on the access request to obtain the detection result;

[0124] Based on the detection results and the evaluation indicators, the target ICM-PPO model is determined.

[0125] Furthermore, the processor 1001 can invoke the network attack defense program stored in the memory 1005 and also perform the following operations:

[0126] Based on the request characteristics, a defense strategy scheme corresponding to the access request and the implementation probability of the defense strategy scheme are selected;

[0127] Obtain the target defense strategy scheme whose implementation probability is greater than a preset threshold;

[0128] The target defense strategy schemes are sorted according to a preset method to obtain the defense strategy sequence.

[0129] Furthermore, the processor 1001 can invoke the network attack defense program stored in the memory 1005 and also perform the following operations:

[0130] Upon receiving the access request, obtain the request parameters corresponding to the access request;

[0131] Based on preprocessing tools, request features corresponding to the request parameters are extracted.

[0132] Furthermore, the processor 1001 can invoke the network attack defense program stored in the memory 1005 and also perform the following operations:

[0133] Based on the request parameters, obtain the request type corresponding to the access request;

[0134] Based on the request type, obtain the corresponding defense strategy rules;

[0135] Based on the defense strategy rules, extract the request features corresponding to the request parameters.

[0136] Furthermore, the processor 1001 can invoke the network attack defense program stored in the memory 1005 and also perform the following operations:

[0137] Upon receiving the access request, obtain the access path of the access request;

[0138] Based on the access path, determine the request type corresponding to the access request.

[0139] In addition, to achieve the above objectives, the present invention also provides a terminal device, the terminal device comprising: a memory, a processor, and a network attack defense program stored in the memory and executable on the processor, wherein the network attack defense program, when executed by the processor, implements the steps of the network attack defense method as described above.

[0140] In addition, to achieve the above objectives, the present invention also provides a computer-readable storage medium storing a network attack defense program, which, when executed by a processor, implements the steps of the network attack defense method described above.

[0141] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0142] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0143] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device (which may be a mobile phone, computer, tablet computer, or virtual device) to execute the methods described in the various embodiments of the present invention.

[0144] The above are merely preferred embodiments of the present invention and do not limit the patent scope of the present invention. Any equivalent structural or procedural transformations made based on the content of the present invention's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A method for defending against network attacks, characterized in that, The methods for defending against network attacks include: Upon receiving an access request, obtain the request parameters corresponding to the access request and extract the request features corresponding to the request parameters; Based on the target ICM-PPO model, a defense strategy sequence corresponding to the access request is selected according to the request characteristics; According to the defense strategy sequence, attack detection is performed on the access request; Prior to the step of obtaining the request parameters corresponding to the access request and extracting the request features corresponding to the request parameters upon receiving the access request, the procedure includes: Obtain the request parameters corresponding to each access request from the terminal; Based on the request parameters, determine the training data and test data corresponding to the access request; Based on the training data, train the ICM-PPO model and determine the initial ICM-PPO model; Based on the test data, test the initial ICM-PPO model and determine the target ICM-PPO model; The target ICM-PPO model is a proximal policy optimization model with an embedded intrinsic curiosity module, and the initial ICM-PPO model is trained in the following way: Input the training data into the ICM-PPO model to obtain the defense strategy sequence output by the ICM-PPO model; Based on the defense strategy sequence, attack detection is performed on the access requests corresponding to the training data to determine the hit rate of the defense strategy sequence and the actual detection time of the attack detection on the access requests. Based on the hit rate and the actual detection time, adjust the model parameters of the ICM-PPO model until a converged initial ICM-PPO model is obtained. The adjustment of the model parameters is based on the reward function Rt = hit coefficient × (delay threshold - actual detection time), where the hit coefficient is set for different hit situations to characterize the accuracy of the defense strategy sequence selected by the ICM-PPO model, and the delay threshold is set according to the detection time corresponding to the statistical performance of the defense strategy sequence.

2. The method as described in claim 1, characterized in that, The step of testing the initial ICM-PPO model based on the test data and determining the target ICM-PPO model includes: Receive the evaluation metrics of the initial ICM-PPO model; Under a preset network traffic scenario, the access request generated from the test data is sent to the terminal; Input the access request into the initial ICM-PPO model and obtain the defense strategy sequence output by the initial ICM-PPO model; According to the defense strategy sequence, attack detection is performed on the access request to obtain the detection result; Based on the detection results and the evaluation indicators, the target ICM-PPO model is determined.

3. The method as described in claim 1, characterized in that, The step of selecting the defense strategy sequence corresponding to the access request based on the target ICM-PPO model and the request characteristics includes: Based on the request characteristics, a defense strategy scheme corresponding to the access request and the implementation probability of the defense strategy scheme are selected; Obtain the target defense strategy scheme whose implementation probability is greater than a preset threshold; The target defense strategy schemes are sorted according to a preset method to obtain the defense strategy sequence.

4. The method as described in claim 1, characterized in that, The step of obtaining the request parameters corresponding to the access request and extracting the request features corresponding to the request parameters upon receiving an access request includes: Upon receiving the access request, obtain the request parameters corresponding to the access request; Based on preprocessing tools, request features corresponding to the request parameters are extracted.

5. The method as described in claim 1, characterized in that, The step of obtaining the request parameters corresponding to the access request and extracting the request features corresponding to the request parameters upon receiving an access request includes: Based on the request parameters, obtain the request type corresponding to the access request; Based on the request type, obtain the corresponding defense strategy rules; Based on the defense strategy rules, extract the request features corresponding to the request parameters.

6. The method as described in claim 5, characterized in that, The step of obtaining the request type corresponding to the access request based on the request parameters includes: Upon receiving the access request, obtain the access path of the access request; Based on the access path, determine the request type corresponding to the access request.

7. A terminal device, characterized in that, The terminal device includes: a memory, a processor, and a network attack defense program for the terminal device stored in the memory and executable on the processor. When the network attack defense program for the terminal device is executed by the processor, it implements the steps of the network attack defense method as described in any one of claims 1 to 6.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a network attack defense program for a terminal device, which, when executed by a processor, implements the steps of the network attack defense method as described in any one of claims 1 to 6.

Images