Cyber attack object detection method, system, apparatus, device, and medium

Abstract

The present disclosure provides a network attack object detection method, which relates to the field of information security and the field of artificial intelligence. The method comprises: acquiring device information of N network devices respectively, N being an integer greater than or equal to 2; in response to detecting an attack behavior on the nth network device, obtaining cross-device features according to the device information of the nth network device and the mth network device, n and m being integers greater than or equal to 1 and less than or equal to N, and n not equal to m; inputting the cross-device features into a risk prediction model to obtain a first risk probability of the mth network device; and when the first risk probability of the mth network device is greater than or equal to a first preset threshold, determining that the mth network device is a first potential attack object. The present disclosure also provides a network attack object detection apparatus, device, storage medium and program product.

Description

Technical Field

[0001] This disclosure relates to the fields of information security and artificial intelligence, and more specifically, to a method, system, device, equipment, medium, and program product for detecting network attack targets. Background Technology

[0002] With the rapid development of internet technology and its widespread application in various fields, the global internet's characteristics of "users everywhere, programs everywhere, and threats everywhere" have become more prominent. To prevent hacker attacks, enterprise security personnel typically deploy intrusion detection systems at network data access points or on hosts.

[0003] However, most traditional intrusion detection systems rely on the attack characteristics of known vulnerabilities for simple detection. Due to the complexity of the network environment and the diversity of attack types, if attackers use unknown vulnerabilities or newer attack techniques to launch an attack, the intrusion detection system can often only capture a single node that has been compromised and is carrying out a large number of attack operations.

[0004] In realizing the inventive concept of this publication, the inventors discovered that because only one attacked node can be detected, it is difficult to identify the attack entry point and the overall attack path. This means that even if security personnel take the attacked host offline or repair it, attackers can still continue to attack the internal network through vulnerabilities or other similar paths, making other hosts still vulnerable to attack. This creates a situation that is difficult to defend against and poses a significant security risk. Therefore, how to promptly identify other unattacked but potentially compromised hosts when a network attack is detected, so as to take corresponding network attack defense actions in advance, is an urgent problem to be solved. Summary of the Invention

[0005] In view of the above problems, this disclosure provides a method, system, apparatus, device, medium and program product for detecting network attack targets.

[0006] One aspect of this disclosure provides a method for detecting network attack targets, comprising: acquiring device information of N network devices respectively, where N is an integer greater than or equal to 2; in response to detecting an attack on the nth network device, obtaining cross-device features based on the device information of the nth and mth network devices respectively, where n and m are both integers greater than or equal to 1 and both less than or equal to N, and n is not equal to m; inputting the cross-device features into a risk prediction model to obtain a first risk probability of the mth network device; and determining the mth network device as a first potential attack target when the first risk probability of the mth network device is greater than or equal to a first preset threshold.

[0007] According to an embodiment of this disclosure, after determining that the m-th network device is a first potential attack target, the method further includes: obtaining a first weighted value based on the first risk probability and its first weight; obtaining a second weighted value based on the transition probability and its second weight, wherein the transition probability indicates the probability that the m-th network device will be accessed after accessing the n-th network device; obtaining a second risk probability of the m-th network device based on the first weighted value and the second weighted value; and determining that the m-th network device is a second potential attack target when the second risk probability of the m-th network device is greater than or equal to a second preset threshold, wherein the probability of the second potential attack target being attacked is greater than the probability of the first potential attack target being attacked.

[0008] According to an embodiment of this disclosure, the method further includes: acquiring historical access data between the nth network device and the mth network device; and determining the transition probability between the nth network device and the mth network device based on the historical access data.

[0009] According to embodiments of this disclosure, obtaining the cross-device feature based on the device information of the nth network device and the mth network device includes: determining the data transmission link between the nth network device and the mth network device; determining other network devices involved in the data transmission link besides the nth network device and the mth network device; and obtaining the cross-device feature based on the device information of the nth network device, the mth network device, and the other network devices.

[0010] According to embodiments of this disclosure, the device information includes behavioral information, the cross-device features include behavioral features, and obtaining the cross-device features includes: determining a behavioral sequence based on the behavioral information of the nth network device and the mth network device respectively; and obtaining the behavioral features based on the behavioral sequence.

[0011] According to embodiments of this disclosure, the device information includes basic information, the cross-device features include basic features, and obtaining the cross-device features further includes: obtaining the basic features based on the basic information of the m-th network device; wherein, the method further includes: obtaining the cross-device features based on the behavioral features and the basic features.

[0012] According to embodiments of this disclosure, the risk prediction model includes a convolutional subnetwork and a temporal subnetwork. The step of inputting the cross-device features into the risk prediction model includes: inputting the basic features into the convolutional subnetwork, which is constructed based on a convolutional neural network; and inputting the behavioral features into the temporal subnetwork, which is constructed based on a neural network with temporal processing capabilities.

[0013] According to an embodiment of this disclosure, obtaining the first risk probability of the m-th network device includes: obtaining a first intermediate feature output by the convolutional sub-network after processing the basic features; obtaining a second intermediate feature output by the temporal sub-network after processing the behavioral features; and obtaining the first risk probability of the m-th network device based on the first intermediate feature and the second intermediate feature.

[0014] According to an embodiment of this disclosure, obtaining the first risk probability of the m-th network device based on the first intermediate feature and the second intermediate feature includes: inputting the first intermediate feature into a first multilayer perceptron to obtain a first output vector; inputting the second intermediate feature into a second multilayer perceptron to obtain a second output vector; and inputting the first output vector and the second output vector into a gating network to obtain the first risk probability of the m-th network device.

[0015] According to embodiments of this disclosure, the behavior sequence includes at least one of a command execution sequence, a process execution sequence, and a file creation sequence. Determining the behavior sequence includes at least one of the following operations: based on command execution information, constructing the command execution sequence of at least two commands in a chronological order, wherein any one of the at least two commands is executed on a different network device than at least one other command; based on process execution information, constructing the process execution sequence of at least two processes in a chronological order, wherein any one of the at least two processes is run on a different network device than at least one other process; based on file creation information, constructing the file creation sequence of at least two files in a chronological order, wherein any one of the at least two files is created on a different network device than at least one other file.

[0016] According to embodiments of this disclosure, the behavioral feature includes at least one of a command encoding vector, a process encoding vector, and a file encoding vector, and obtaining the behavioral feature based on the behavioral sequence includes at least one of the following operations: obtaining the command encoding vector based on the command execution sequence; obtaining the process encoding vector based on the process running sequence; and obtaining the file encoding vector based on the file creation sequence.

[0017] According to embodiments of this disclosure, the basic features include a basic information vector obtained based on basic information, and obtaining the cross-device features based on the behavioral features and the basic features includes obtaining the cross-device features based on the basic information vector and at least one of the command encoding vector, process encoding vector, and file encoding vector.

[0018] According to embodiments of this disclosure, obtaining the device information of each of the N network devices includes: collecting basic information of each of the N network devices, wherein the basic information includes information describing the basic attributes and characteristics of the network devices themselves; collecting behavioral information of each of the N network devices, wherein the behavioral information includes internal dynamic information and / or external interaction information generated by the network devices when performing specific operations; and obtaining the device information of each network device based on the basic information and behavioral information of each of the N network devices.

[0019] According to an embodiment of this disclosure, the m-th network device is any one of the N network devices except the n-th network device. The method further includes: determining a first risk probability for each of the N network devices except the n-th network device; determining an attack path between the at least two network devices when the first risk probability of at least two network devices is greater than or equal to a first preset threshold; and performing network attack defense operations on the at least two network devices based on the attack path.

[0020] Another aspect of this disclosure provides a network attack target detection system, comprising: N engine terminals, deployed one-to-one on N network devices, where N is an integer greater than or equal to 2; and a management terminal, configured to receive device information collected by the N engine terminals from the N network devices respectively, and, in response to detecting an attack on the nth network device, execute the network attack target detection method as described in any of the preceding embodiments.

[0021] Another aspect of this disclosure provides a network attack target detection device, comprising: an information acquisition module, configured to acquire device information of N network devices respectively, where N is an integer greater than or equal to 2; a feature acquisition module, configured to, in response to detecting an attack on the nth network device, obtain cross-device features based on the device information of the nth and mth network devices respectively, where n and m are both integers greater than or equal to 1 and both less than or equal to N, and n is not equal to m; a risk prediction module, configured to input the cross-device features into a risk prediction model to obtain a first risk probability of the mth network device; and an object detection module, configured to determine the mth network device as a first potential attack target when the first risk probability of the mth network device is greater than or equal to a first preset threshold.

[0022] Another aspect of this disclosure provides an electronic device, including: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors perform the method as described above.

[0023] Another aspect of this disclosure provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the method described above.

[0024] Another aspect of this disclosure provides a computer program product, including a computer program that, when executed by a processor, implements the method described above.

[0025] The above one or more embodiments have the following beneficial effects: By acquiring the device information of each network device, and when attacked, using the device information of the attacked device and any other device (such as the m-th network device) to obtain cross-device characteristics, when one or more network devices in an enterprise are found to be compromised, but the complete attack path or attack method cannot be confirmed, the first potential attack target can be determined based on the first wind direction probability output by processing the cross-device characteristics according to the risk prediction model. Therefore, based on the determination of the first potential attack target, network attack defense operations can be performed in a timely manner, the attack chain can be cut off in advance, other potentially compromised related devices can be prevented from being attacked, and the risk loss caused by unknown attacks can be reduced. Attached Figure Description

[0026] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0027] Figure 1 This diagram illustrates an application scenario of the network attack target detection method according to an embodiment of the present disclosure.

[0028] Figure 2 This diagram schematically illustrates the architecture of a network attack target detection system according to an embodiment of the present disclosure.

[0029] Figure 3 A flowchart illustrating a network attack target detection method according to an embodiment of the present disclosure is shown schematically.

[0030] Figure 4 A flowchart illustrating a method for detecting network attack targets according to another embodiment of this disclosure is shown schematically.

[0031] Figure 5 A flowchart illustrating the process of obtaining cross-device features according to embodiments of the present disclosure is shown schematically;

[0032] Figure 6 A flowchart illustrating obtaining cross-device features according to another embodiment of this disclosure is shown schematically;

[0033] Figure 7 An architectural diagram of a risk prediction model according to an embodiment of the present disclosure is illustrated schematically;

[0034] Figure 8 A flowchart illustrating input cross-device features according to an embodiment of the present disclosure is shown schematically;

[0035] Figure 9 A flowchart illustrating the process of obtaining transition probabilities according to an embodiment of the present disclosure is shown schematically.

[0036] Figure 1 0. A flowchart illustrating a method for detecting network attack targets according to another embodiment of this disclosure is shown schematically;

[0037] Figure 11 A flowchart illustrating the pre-training phase according to an embodiment of the present disclosure is shown schematically.

[0038] Figure 12 A flowchart illustrating a method for detecting network attack targets according to another embodiment of this disclosure is shown schematically.

[0039] Figure 13 A schematic block diagram of a network attack target detection apparatus according to an embodiment of the present disclosure is shown; and

[0040] Figure 14 A block diagram schematically illustrates an electronic device suitable for implementing a network attack target detection method according to an embodiment of the present disclosure. Detailed Implementation

[0041] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0042] Figure 1 The diagram illustrates an application scenario of the network attack target detection method according to embodiments of the present disclosure. It should be noted that... Figure 1 The examples shown are merely examples to illustrate the application of the embodiments of this disclosure, in order to help those skilled in the art understand the technical content of this disclosure. However, they do not mean that the embodiments of this disclosure cannot be used in other devices, systems, environments, or scenarios.

[0043] like Figure 1 As shown, the network attack target detection system 100 of this embodiment may include a DHCP device 110, a NAT device 120, an intrusion detection and prevention device 130, a network attack target detection system 140, and a network 150.

[0044] DHCP device 110 is deployed on a local area network (LAN) outside the intranet to provide a private IP address and device identifier. NAT device 120 is deployed on the LAN to provide a private IP address, a public IP address, and a public port. Intrusion detection and prevention device 130 is deployed on the intranet to detect network attacks and perform traffic blocking. Network attack target detection system 140 is used to execute the network attack target detection methods provided in some embodiments of this disclosure.

[0045] DHCP device 110, or Dynamic Host Configuration Protocol device, runs the Dynamic Host Configuration Protocol and is responsible for assigning private IP addresses to terminal devices 1 to M in the local area network, and providing other network configuration information, where M is greater than or equal to 1. NAT (Network Address Translation) device 120 is used to translate private IP addresses into public IP addresses (global IP addresses) and can also perform port forwarding and convert data transmitted from the Internet into private IP addresses. Intrusion detection and prevention device 130 includes, for example, IPS (Intrusion Prevention System) devices and WAF (Web Application Firewall) devices.

[0046] Network 150 is a medium used to provide a communication link between a local area network (LAN) and an enterprise business intranet. Network 150 may include various connection types, such as wired, wireless communication links, or fiber optic cables. Terminal devices 1 to M may each be various electronic devices that support network access, including but not limited to servers, smartphones, tablets, laptops, and desktop computers.

[0047] It should be understood that Figure 1 The number of DHCP devices 110, NAT devices 120, intrusion detection and prevention devices 130, and network attack target detection systems 140 shown are merely illustrative. Any number of DHCP devices 110, NAT devices 120, intrusion detection and prevention devices 130, and network attack target detection systems 140 can be included depending on implementation needs.

[0048] Figure 2 The diagram schematically illustrates the architecture of a network attack target detection system according to an embodiment of the present disclosure. It should be noted that... Figure 2 The examples shown are merely examples to illustrate the application of the embodiments of this disclosure, in order to help those skilled in the art understand the technical content of this disclosure, but do not mean that the embodiments of this disclosure cannot be used in other architectures.

[0049] like Figure 2As shown, the network attack handling system 140 includes N engine terminals 1402 (such as engine terminal 1, engine terminal 2... engine terminal N-1 and engine terminal N) and a management terminal 1403. The network asset resources 1401 of the enterprise intranet include various network devices involved in enterprise network assets, such as routers, switches, gateway servers, web servers, application servers, database servers and domain servers, etc.

[0050] In some embodiments, N engine terminals 1402 are deployed one-to-one on N network devices, where N is an integer greater than or equal to 2. The management terminal 1403 receives device information collected by the N engine terminals from the N network devices respectively, and in response to detecting an attack on the nth network device, executes the network attack target detection method provided in some embodiments of this disclosure.

[0051] For example, engine 1402 is deployed on each server, responsible for collecting server information and monitoring traffic, and reporting the collected information to management 1403 in real time. Based on the information collected by engine 1402, management 1403 completes the training and deployment of the risk prediction model, and uses the risk prediction model to carry out risk prediction and identification in the production environment. Engine 1402 and management 1403 can be implemented as software programs, and management can be deployed on a separate server.

[0052] The servers involved in this disclosure can be servers that provide various services, such as a backend management server (for example only). The backend management server can analyze and process the received access requests and other data, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0053] Specifically, the servers involved in this disclosure can be independent physical servers, server clusters or distributed systems composed of multiple physical servers, or cloud servers that provide basic cloud computing services such as cloud services, cloud computing, network services, and middleware services.

[0054] The following will be based on Figure 1 and Figure 2 The content described, through Figures 3 to 12 The network attack target detection method of the present disclosure embodiments will be described in detail.

[0055] Figure 3 A flowchart illustrating a network attack target detection method according to an embodiment of this disclosure is shown schematically. Figure 3 As shown, the network attack target detection method of this embodiment includes:

[0056] In operation S310, obtain the device information of each of the N network devices, where N is an integer greater than or equal to 2.

[0057] For example, after each engine terminal 1402 collects device information from the corresponding network device, it sends the collected information to the management terminal 1403 in real time via heartbeat. The management terminal 1403 then performs feature extraction and processing on the information.

[0058] The device information for each network device can include hardware and software information that records various attributes, statuses, and actions of that device. The network devices involved can include computers, servers (such as...). Figure 2 As shown (e.g., storage devices, printers), each network device's attributes include basic information, host information, service information, and application information. Basic information may include the network device's IP address, name, geographical threat level, and importance. Host information may include operating system type, version, model, login account, and password. Service information may include the port, protocol, and service name provided by the network device. Application information may include the name, version, and vendor of the applications running on the network device. Because network devices may have system vulnerabilities in their operating systems and business logic vulnerabilities in their installed applications, they are vulnerable to network attacks.

[0059] In operation S320, in response to the detection of an attack on the nth network device, cross-device characteristics are obtained based on the device information of the nth and mth network devices, where n and m are both integers greater than or equal to 1 and less than or equal to N, and n is not equal to m.

[0060] For example, the management terminal 1403 and the intrusion detection and prevention device 130 are communicatively connected. When the intrusion detection and prevention device 130 detects an attack, it notifies the management terminal of the host under network attack. Exemplarily, a network attack includes any type of attack targeting a computer information system, infrastructure, computer network, or personal computer device within an intranet. For computers and computer networks, acts such as damaging, revealing, modifying, or disabling software or services, or stealing or accessing data on any computer without authorization, are considered attacks on computers and computer networks. Attack detection includes the use of network technologies capable of detecting abnormal and illegal activity on the network.

[0061] The cross-device features are obtained based on the device information of the nth network device and the device information of the mth network device.

[0062] In some embodiments, cross-device features can be obtained using only the device information of the nth network device and the device information of the mth network device. A smaller number of network devices results in less device information data, which helps save on the amount of device information data, reduces the resources and costs consumed in feature extraction, and still meets the accuracy requirements of risk prediction.

[0063] In other embodiments, obtaining cross-device characteristics based on the device information of the nth network device and the mth network device includes: determining the data transmission link between the nth network device and the mth network device; determining other network devices involved in the data transmission link besides the nth and mth network devices; and obtaining cross-device characteristics based on the device information of the nth network device, the mth network device, and the other network devices. The other network devices may include one or more network devices.

[0064] For example, in a microservice architecture, multiple microservices are deployed on multiple servers, and these microservices can call each other across servers. Users can send user requests through electronic devices, and the microservice architecture can respond to these requests by issuing one or more call requests to fulfill the user's needs. For instance, upon receiving a user request, it might execute call request A→B and call request B→C to return response data. The call chain responding to this user request includes call request A→B and call request B→C, that is, it includes the call relationship of microservice A calling microservice B, and microservice B calling microservice C. The data transmission chain can be determined through the above call relationship.

[0065] For example, the data transmission link can be determined based on the services involved in the nth network device. If each service is pre-configured to be handled by which network devices, the data transmission link can be determined directly, without being limited to a microservice architecture.

[0066] In this embodiment, the device information of all network devices involved in the data transmission link is taken into account, and cross-device features are extracted. Its purpose is to obtain enough information from the perspective of the entire link, identify the influence between network devices in the entire link, and provide accuracy for subsequent risk identification.

[0067] When operating S330, cross-device characteristics are input into the risk prediction model to obtain the first risk probability of the m-th network device.

[0068] For example, risk prediction models can be constructed based on neural network algorithms and obtained through pre-training.

[0069] In operation S340, when the first risk probability of the m-th network device is greater than or equal to the first preset threshold, the m-th network device is determined to be the first potential attack target.

[0070] The first potential attack target refers to the m-th network device that an attacker might exploit by continuing attacks using vulnerabilities identical or similar to those of the n-th network device. The first preset threshold can be pre-set, for example, 0.8 (only an example). If the m-th network device is determined to be the first potential attack target, network attack defense operations can be performed, such as sending alerts, manually investigating potential vulnerabilities, automatically deploying defense scripts for the m-th network device, using the m-th network device for inducing attacks and attack localization, or isolating the m-th network device.

[0071] According to embodiments of this disclosure, by acquiring device information of each network device, and when attacked, using the device information of the attacked device and any other device (such as the m-th network device) to obtain cross-device characteristics, when one or more network devices in an enterprise are found to be compromised, but the complete attack path or attack method cannot be confirmed, the first potential attack target can be determined based on the first wind direction probability output by processing the cross-device characteristics according to the risk prediction model. Therefore, based on the determination of the first potential attack target, network attack defense operations can be performed in a timely manner, the attack chain can be cut off in advance, other potentially compromised related devices can be prevented from being attacked, and the risk and loss caused by unknown attacks can be reduced.

[0072] Figure 4 A flowchart illustrating a method for detecting network attack targets according to another embodiment of this disclosure is shown schematically. Figure 4 As shown, the network attack target detection method of this embodiment includes:

[0073] In operation S410, determine the first risk probability of each network device among the N network devices, excluding the nth network device.

[0074] The m-th network device can be any one of the N network devices. By repeatedly executing operation S330, the first risk probability of each network device other than the n-th network device can be obtained.

[0075] When operating S420, if the first risk probability of at least two network devices is greater than or equal to a first preset threshold, an attack path between at least two network devices is determined.

[0076] For example, by calculating the propagation risk value of the nth network device under attack and adding the propagation risk value to the first risk probability of each network device other than the nth network device, an attack path starting from the nth network device can be constructed based on the accumulated first risk probability of each network device.

[0077] For example, the propagation risk value can be determined based on the device similarity between the nth network device and other network devices. Device similarity can be obtained by calculating the Euclidean distance between the device information of two devices (for example only). The attack path can be determined based on the data transmission links between at least two network devices.

[0078] When operating the S430, network attack defense operations are performed on at least two network devices based on the attack path. For example, for multiple network devices in the attack path whose first risk probability is greater than or equal to a preset threshold, the network devices at the front end of the data transmission link are isolated in a timely manner to complete the attack processing, preventing subsequent attacks on the network devices at the back end through data transmission.

[0079] According to the embodiments of this disclosure, when enterprise assets are attacked and the hacker's entry point and complete attack path cannot be confirmed, a possible attack path can be predicted, other potentially attacked enterprise assets can be quickly identified, and a response can be made in advance to cut off the risk propagation path in a timely manner.

[0080] In some embodiments, obtaining the device information of each of the N network devices in operation S210 includes: collecting basic information of each of the N network devices, wherein the basic information includes information describing the basic attributes and characteristics of the network device itself; collecting behavioral information of each of the N network devices, wherein the behavioral information includes internal dynamic information and / or external interaction information generated by the network device when performing a specific operation; and obtaining the device information of each network device based on the basic information and behavioral information of the N network devices.

[0081] For example, when the network device is a server, basic information includes the operating system version installed on the server, the names and versions of the software deployed on the server, the open ports on the server, and the names and versions of the components included in the applications deployed on the server. Behavioral information includes internal dynamic information such as the operating system commands executed by the server, running processes, and newly added file names, as well as external interactive information such as network inbound and outbound traffic.

[0082] According to embodiments of this disclosure, by simultaneously considering the basic information and behavioral information of network devices, the defensive performance and vulnerability status of network devices can be understood from various dimensions, thereby improving the effectiveness and accuracy of attack prediction.

[0083] Figure 5 A flowchart illustrating the process of obtaining cross-device features according to an embodiment of this disclosure is shown schematically. Device information includes behavioral information, and cross-device features include behavioral features, such as... Figure 5 As shown, this embodiment is one example of operating S320, including:

[0084] In operation S510, a sequence of actions is determined based on the behavioral information of the nth and mth network devices. The sequence of actions indicates the dynamic operational information of the network devices in a sequential order.

[0085] In operating S520, behavioral characteristics are obtained based on the behavioral sequence.

[0086] For example, based on expert experience or historical attack data, it can be determined that when one network device is attacked, other attacked network devices generally exhibit specific behavioral characteristics.

[0087] According to embodiments of this disclosure, it is possible to determine whether a behavioral sequence matches an attacker's behavioral pattern, and to consider whether the behavioral characteristics of network devices match specific attack behaviors, thereby improving attack detection speed and accuracy and reducing false alarm rates.

[0088] In some embodiments, the behavioral information includes at least one of the following: command execution information, including command execution information in the network device according to the time sequence; process execution information, including process execution information in the network device according to the time sequence; and file creation information, including file creation information in the network device according to the time sequence. Time sequence refers to the chronological order.

[0089] By monitoring events within the operating system, the commands executed by the operating system can be determined. Process creation and memory allocation records can be captured from the content to obtain process execution information. File creation information can also be determined by monitoring events within the operating system.

[0090] For example, real-time data is collected on network inbound and outbound traffic, executed operating system commands, running processes, and newly added filenames from each network device. Upon detecting an attack on the nth network device, the source and target server addresses are extracted from the network inbound and outbound traffic within a predetermined time window to construct a behavioral sequence. Using the source and target server addresses as constraints, the required behavioral information can be accurately obtained, avoiding the processing of large amounts of useless data, reducing time costs, and improving prediction accuracy.

[0091] In some embodiments, the behavior sequence includes at least one of a command execution sequence, a process execution sequence, and a file creation sequence, and determining the behavior sequence includes at least one of the following operations:

[0092] Based on command execution information, construct a command execution sequence of at least two commands in chronological order, where at least one of the commands and at least one other command are executed on different network devices. Extract the timing execution information of operating system commands and construct the command execution sequence. For example, after the target is attacked, the possible command execution sequence is: starting a malicious process -> reading system files -> adding a scheduled task.

[0093] Based on process execution information, construct a process execution sequence of at least two processes in chronological order, where at least one of these processes runs on a different network device along with at least one other process. Extract process execution sequence information and construct the process execution sequence; for example, an attack process might involve starting a Word process -> executing a malicious Trojan process -> executing a scanner process.

[0094] Based on file creation information, construct a file creation sequence for at least two files in chronological order, where at least one of the at least two files was created on a different network device along with at least one other file. Extract the file creation timing information and construct the file creation sequence, such as writing a Trojan script -> a tunnel script.

[0095] In some embodiments, the actions in the command execution sequence, process execution sequence, and file creation sequence can be executed in the same network device without having to be executed in different network devices. This allows for prediction for a single network device without having to introduce information from other network devices.

[0096] According to embodiments of this disclosure, command execution sequences, process execution sequences, and file creation sequences reflect the behavioral state of network devices from different dimensions, and can characterize potential vulnerability information of network devices, or pre-attack behaviors such as hijacking, etc., dynamically perceive the real threat situation in network devices, thereby improving the accuracy of predicting network attacks.

[0097] In some embodiments, the behavioral characteristics include at least one of command encoding vector, process encoding vector, and file encoding vector. Obtaining behavioral characteristics based on a behavioral sequence includes at least one of the following operations: obtaining a command encoding vector based on a command execution sequence; obtaining a process encoding vector based on a process execution sequence; and obtaining a file encoding vector based on a file creation sequence.

[0098] For example, one-hot encoding can be performed on command execution sequences, process execution sequences, and file creation sequences to generate command encoding vectors, process encoding vectors, and file encoding vectors.

[0099] Figure 6 A flowchart illustrating the process of obtaining cross-device features according to another embodiment of this disclosure is shown. Figure 6 As shown, this embodiment is one example of operating S320, including:

[0100] When operating S610, basic characteristics are obtained based on the basic information of the m-th network device.

[0101] For example, for S items of basic information such as the operating system version installed on the server, the name and version of the software deployed on the server, the open ports of the server, and the names and versions of the components contained in the applications deployed on the server, an m-dimensional basic information vector [basic1, basic2, basic3, ..., basicS] is constructed, where each dimension corresponds to one item of basic information. Its dictionary value is numbered from letters a to z and numbers 0 to 9 based on the relevant information involved in historical risk assets, and then normalized to obtain the basic features.

[0102] When operating the S620, cross-device characteristics are obtained based on behavioral and basic characteristics.

[0103] In some embodiments, the basic features include a basic information vector obtained based on basic information, and the cross-device features obtained based on behavioral features and basic features include: obtaining cross-device features based on the basic information vector and at least one of command encoding vector, process encoding vector and file encoding vector.

[0104] Cross-device features are composed of basic features obtained from static basic information and behavioral features obtained from dynamic behavioral information. Static basic information can characterize vulnerabilities in the hardware, software and configuration of network devices, while dynamic behavioral information can characterize operational behavior and state changes, making it easier to detect dynamic potential attack behaviors. It supports the detection of multiple attack types and improves the accuracy and speed of attack prediction.

[0105] Figure 7 An architectural diagram of a risk prediction model according to an embodiment of the present disclosure is illustrated.

[0106] In some embodiments, the risk prediction model includes a convolutional subnetwork and a temporal subnetwork. Inputting cross-device features into the risk prediction model includes: inputting basic features into the convolutional subnetwork, which is constructed based on a convolutional neural network; and inputting behavioral features into the temporal subnetwork, which is constructed based on a neural network with temporal processing capabilities.

[0107] Reference Figure 7 The convolutional subnetwork can include multiple densely connected residual modules for processing the underlying information vector. The temporal subnetwork can include multiple bidirectional LSTM (Long Short-Term Memory) modules for temporal processing. It can be understood that the number of residual modules or the number of bidirectional LSTM modules in each temporal subnetwork is flexible and not limited to a fixed number. Figure 7 The quantities shown are among those shown.

[0108] It should be noted that, Figure 7The model architecture shown is only one embodiment of this disclosure and does not mean that the risk prediction model cannot be implemented with other architectures. For example, a semantic recognition model built based on the transformer module can be used to obtain the predicted first risk probability by performing semantic parsing on cross-device features.

[0109] Figure 8 A flowchart illustrating input cross-device features according to an embodiment of this disclosure is shown schematically. Figure 8 As shown, this embodiment is one example of operating S330, including:

[0110] By operating the S810, the first intermediate feature is obtained from the basic features processed by the convolutional subnetwork.

[0111] The second intermediate feature is output by operating the S820 to obtain the temporal sub-network processing behavior characteristics.

[0112] In some embodiments, the temporal subnetwork includes at least one of a first temporal subnetwork, a second temporal subnetwork, and a third temporal subnetwork. Inputting behavioral features into the temporal subnetwork includes at least one of the following operations: inputting a command encoding vector into the first temporal subnetwork; inputting a process encoding vector into the second temporal subnetwork; and inputting a file encoding vector into the third temporal subnetwork.

[0113] Reference Figure 7 The command encoding vector, process encoding vector, and file encoding vector each correspond to a temporal sub-network. Inputting these into the temporal sub-networks yields the first, second, and third sub-features in the second intermediate feature.

[0114] In operation S830, the first risk probability of the m-th network device is obtained based on the first intermediate feature and the second intermediate feature.

[0115] In some embodiments, obtaining the first risk probability of the m-th network device based on the first intermediate feature and the second intermediate feature includes:

[0116] The first intermediate feature is input into the first multilayer perceptron to obtain the first output vector.

[0117] The second intermediate feature is input into the second multilayer perceptron to obtain the second output vector.

[0118] Specifically, refer to Figure 7 The second multilayer perceptron includes a first sub-multilayer perceptron, a second sub-multilayer perceptron, and a third sub-multilayer perceptron, which are multilayer perceptrons that correspond one-to-one with the command encoding vector, the process encoding vector, and the file encoding vector, respectively, and obtain the three corresponding sub-output vectors in the second output vector.

[0119] Input the first output vector and the second output vector into the gating network to obtain the first risk probability of the m-th network device.

[0120] For example, the processing flow of a gating network includes the content shown in Equation 1 below.

[0121]

[0122] Where G represents the output of the gating network, K is the number of multilayer perceptrons, K is an integer greater than or equal to 1, and M is the output of the gating network. k This represents the output of the k-th multilayer perceptron. W k The result is obtained by calculation as follows:

[0123] W k =softmax(w k x)

[0124] The Softmax function is used to map input data to multiple categories, obtaining the probability value for each category, W. k The weight parameters represent the input vector x' of the k-th multilayer perceptron, which are determined during the training phase.

[0125] The first output vector serves as each input vector x', and each sub-output vector of the second output vector serves as each input vector x'. Each input vector x' undergoes two processing steps: first, a multilayer perceptron, and second, a softmax function. The results of both processing steps are simultaneously input into a gating network, achieving temporal fusion. This allows the network to intelligently learn model parameters and weights (such as W) based on different attack risk scenarios. k The final output is the risk probability score G, which is the first risk probability of the m-th network device.

[0126] Figure 9 A flowchart illustrating the process of obtaining transition probabilities according to embodiments of the present disclosure is shown schematically. Figure 9 As shown, the transition probabilities obtained in this embodiment include:

[0127] In operation S910, historical access data between the nth network device and the mth network device is obtained. This includes, for example, historical access records of requests sent via network protocols.

[0128] In operation S920, based on historical access data, the transition probability between the nth network device and the mth network device is determined. The transition probability indicates the probability that the mth network device will be accessed after the nth network device is accessed.

[0129] By utilizing daily server access history and considering inter-server communication relationships, the transition probability of server jumps is calculated based on a Markov model. A Markov model is an algorithm that uses mathematical analysis to study stochastic processes. The Markov model posits that in a stochastic process, the probability of each state occurring is not independent; the current state of each random experiment depends on previous states but is independent of subsequent states. If X... n The server being accessed can be simplified to the (n+1)th server X according to the Markov property. n+1 The conditional probability of being accessed is equal to that of the server X above it. n After being accessed, server X n+1 The probability of being visited, i.e.:

[0130] P(X n+1 = x|X0, X1, X2, ..., X n )=P(X n+1 =x|X n Equation 2

[0131] In Equation 2, the term is referred to as the "transition probability" in a stochastic process.

[0132] Based on the above formula, the transition probability between any two units can be calculated, i.e.

[0133]

[0134] In Equation 3, server n refers to the nth network device, and server m refers to the mth network device. The transition probability calculation formula generates a Markov transition probability matrix between all servers, where each probability value represents the probability of sequential access between the current two servers.

[0135] If the transition probability between two network devices is low, it indicates a lower probability of accessing the nth network device first and then the mth network device, and vice versa. Therefore, the probability of the mth network device being attacked is related to the transition probability. According to embodiments of this disclosure, the transition probability can be used to correct the first risk probability, improve the accuracy of risk prediction, and reduce the false alarm rate.

[0136] In some embodiments, after identifying the first potential attack target, further detection can be performed based on the first potential attack target to improve the reliability of network attack target detection, as follows: Figure 10 As stated above.

[0137] Figure 10 A flowchart illustrating a method for detecting network attack targets according to another embodiment of this disclosure is shown schematically. Figure 10 As shown, the network attack target detection method of this embodiment includes:

[0138] In operation S1010, the first weighted value is obtained based on the first risk probability and its first weight.

[0139] In operation S1020, the second weighted value is obtained based on the transition probability and its second weight.

[0140] In operation S1030, the second risk probability of the m-th network device is obtained based on the first weighted value and the second weighted value.

[0141] t m =r×G m +(1-r)×p nm Formula 4

[0142] Referring to Equation 4, G m This refers to the first risk probability of the m-th network device, P. nm This refers to the transition probability between the nth network device and the mth network device, where r represents the first weight and 1-r represents the second weight. t m This represents the second risk probability. r belongs to [0, 1].

[0143] In operation S1040, when the second risk probability of the m-th network device is greater than or equal to the second preset threshold (e.g., 0.8), the m-th network device is determined to be the second potential attack target, wherein the probability of the second potential attack target being attacked is greater than the probability of the first potential attack target being attacked.

[0144] The first and second weights are used to balance the importance between the first risk probability and the transition probability. The value of r can be manually assigned a fixed value, or it can be assigned an initial value and then dynamically updated during training.

[0145] If the transfer probability between two network devices is very small, or even zero, it means that it is difficult for an attacker to attack the other device based on the same or similar vulnerabilities. Therefore, the probability of the second potential attack target being attacked is greater than that of the first potential attack target. Based on the risk prediction model that processes cross-device features to output the first risk probability, another dimension is used, namely, to optimize and verify the network attack target detection results based on the transfer probability, further filtering any first potential attack target and narrowing down the range of potentially compromised hosts.

[0146] According to embodiments of this disclosure, the second risk probability, obtained based on the first risk probability and the transition probability, can optimize detection accuracy during actual prediction. Furthermore, by further narrowing down the range of potentially compromised network devices, it can improve the accuracy of network attack defense operations, increase the execution speed of defense operations, and reduce unnecessary resource consumption.

[0147] It's understandable that if at least one network device out of N network devices can be identified as the primary potential target of an attack, then network attack defense operations can be directly implemented on those network devices. It's also possible to... Figure 10 After identifying at least one of the aforementioned network devices, the second risk probability of each network device is determined to further narrow down the target range, and network attack defense operations are performed on each network device identified as a second potential attack target.

[0148] Reference Figures 1-10 See below for reference. Figures 11-12 The present disclosure further elaborates on the network attack target detection method provided in the embodiments.

[0149] Figure 11 A flowchart illustrating the pre-training phase according to an embodiment of this disclosure is shown schematically. Figure 11 As shown, the training process in this embodiment includes:

[0150] In operation S1110, the engine deployed on the server collects basic server information and server behavior information. The network device includes the server in this embodiment.

[0151] In operation S1120, server basic characteristics and behavioral characteristics are generated based on server basic information and real-time behavioral information.

[0152] In operation S1130, a risk prediction model is trained based on the server's basic and behavioral characteristics.

[0153] In operation S1140, the daily server access history is used to calculate the transition probability matrix between servers based on the communication relationship between servers and the Markov model.

[0154] For example, during the training process, while training the risk prediction model, the output of the risk prediction model is used as the input of Equation 4, and a Markov model is introduced to calculate the transition probability, thus obtaining t. m Using t m The loss function value is calculated using the risk probability label of the m-th network device (obtained from historical attack data analysis; for example, the probability is greater than 0.8 if attacked and less than 0.8 if not attacked; this is just an example). Then, the gradient descent algorithm is used to update the model parameters of the risk prediction model, as well as related weights such as r.

[0155] Figure 12 A flowchart illustrating a method for detecting network attack targets according to another embodiment of this disclosure is shown schematically. Figure 12 As shown, the network attack target detection method of this embodiment includes:

[0156] When operating S1210, the monitoring equipment discovered that one or more servers in the network assets were under attack.

[0157] In operation S1220, server basic characteristics and behavioral characteristics are generated based on server basic information and real-time behavioral information.

[0158] In operation S1230, the first risk probability of each server is calculated based on the server's basic characteristics and behavioral characteristics.

[0159] In operation S1240, the transition probability of each server is calculated using the transition probability matrix between servers.

[0160] When operating the S1250, a second risk probability is calculated for each server that has not been attacked, based on the risk probability and the transfer probability.

[0161] When operating S1260, select the Q servers with the highest probability for investigation and handling, where Q is greater than or equal to 1.

[0162] Upon detecting an attack, the system can automatically identify which of the enterprise's network assets are potentially vulnerable. Identified assets are prioritized for risk assessment, and if necessary, can be taken offline to prevent further spread of the attack. Specifically, when the nth network device is detected as being attacked or at risk, the system calculates the first risk probability of the mth network device and the transfer probability (access probability) of the mth network device accessing the nth network device. A threshold r is used to adjust the risk focus, allowing risk management personnel to prioritize servers with stronger relevance to the current server (higher access probability) or servers with higher security vulnerabilities (higher first risk probability). This ultimately yields the second risk probability.

[0163] Based on the above-described method for detecting network attack targets, this disclosure also provides a device for detecting network attack targets. The following will be combined with... Figure 13 The device is described in detail.

[0164] Figure 13 A schematic block diagram of a network attack target detection apparatus according to an embodiment of the present disclosure is shown.

[0165] like Figure 13 As shown, the network attack target detection device 1300 of this embodiment includes an information acquisition module 1310, a feature acquisition module 1320, a risk prediction module 1330, and an target detection module 1340.

[0166] The information acquisition module 1310 can perform operation S310 to acquire the device information of each of the N network devices, where N is an integer greater than or equal to 2.

[0167] The feature acquisition module 1320 can perform operation S320 in response to the detection of an attack on the nth network device, and obtain cross-device features based on the device information of the nth network device and the mth network device, where n and m are both integers greater than or equal to 1 and less than or equal to N, and n is not equal to m.

[0168] In some embodiments, the risk prediction module 1330 may perform operations S510 to S520 and operations S610 to S620, which will not be described in detail here.

[0169] The risk prediction module 1330 can perform operation S330 to input cross-device characteristics into the risk prediction model to obtain the first risk probability of the m-th network device.

[0170] In some embodiments, the risk prediction module 1330 may perform operations S410 to S430 and operations S810 to S830, which will not be described in detail here.

[0171] The object detection module 1340 can perform operation S340 to determine the m-th network device as the first potential attack target when the first risk probability of the m-th network device is greater than or equal to the first preset threshold.

[0172] In some embodiments, the object detection module 134 may perform operations S1010 to S1040, which will not be described in detail here.

[0173] In some embodiments, the object detection module 134 may further include a transition probability unit, which can perform operations S910 to S920, which will not be described in detail here.

[0174] In some embodiments, the network attack target detection device 1300 may further include a data acquisition module, which is used to acquire basic information of each of the N network devices, wherein the basic information includes information describing the basic attributes and characteristics of the network devices themselves. The module also acquires behavioral information of each of the N network devices, wherein the behavioral information includes internal dynamic information and / or external interaction information generated by the network devices when performing specific operations. Based on the basic information and behavioral information of each of the N network devices, device information for each network device is obtained.

[0175] The network attack target detection device 1300 includes components for performing the above-mentioned functions. Figures 2 to 12 The modules of each step in any of the described embodiments.

[0176] It should be noted that the implementation methods, technical problems solved, functions achieved, and technical effects of each module / unit / subunit in the device embodiments are the same as or similar to the implementation methods, technical problems solved, functions achieved, and technical effects of each corresponding step in the method embodiments, and will not be repeated here.

[0177] According to embodiments of this disclosure, any and multiple modules among the information acquisition module 1310, feature acquisition module 1320, risk prediction module 1330, and object detection module 1340 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module.

[0178] According to embodiments of this disclosure, at least one of the information acquisition module 1310, feature acquisition module 1320, risk prediction module 1330, and object detection module 1340 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or any other reasonable method of integrating or packaging the circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three methods. Alternatively, at least one of the information acquisition module 1310, feature acquisition module 1320, risk prediction module 1330, and object detection module 1340 can be at least partially implemented as a computer program module, which, when run, can perform corresponding functions.

[0179] Figure 14 A block diagram schematically illustrates an electronic device suitable for implementing a network attack target detection method according to an embodiment of the present disclosure.

[0180] like Figure 14 As shown, an electronic device 1400 according to an embodiment of the present disclosure includes a processor 1401, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1402 or a program loaded from a storage portion 1408 into a random access memory (RAM) 1403. The processor 1401 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1401 may also include onboard memory for caching purposes. The processor 1401 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0181] RAM 1403 stores various programs and data required for the operation of electronic device 1400. Processor 1401, ROM 1402, and RAM 1403 are interconnected via bus 1404. Processor 1401 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 1402 and / or RAM 1403. It should be noted that programs may also be stored in one or more memories other than ROM 1402 and RAM 1403. Processor 1401 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in one or more memories.

[0182] According to embodiments of this disclosure, the electronic device 1400 may further include an input / output (I / O) interface 1405, which is also connected to a bus 1404. The electronic device 1400 may also include one or more of the following components connected to the I / O interface 1405: an input section 1406 including a keyboard, mouse, etc.; an output section 1407 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1408 including a hard disk, etc.; and a communication section 1409 including a network interface card such as a LAN card, modem, etc. The communication section 1409 performs communication processing via a network such as the Internet. A drive 1410 is also connected to the I / O interface 1405 as needed. A removable medium 1411, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 1410 as needed so that computer programs read from it can be installed into the storage section 1408 as needed.

[0183] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments, or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0184] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 1402 and / or RAM 1403 and / or one or more memories other than ROM 1402 and RAM 1403 described above.

[0185] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the methods provided in the embodiments of this disclosure.

[0186] When the computer program is executed by the processor 1401, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0187] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 1409, and / or installed from the removable medium 1411. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0188] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 1409, and / or installed from the removable medium 1411. When the computer program is executed by the processor 1401, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0189] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0190] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0191] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0192] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of this disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A method for detecting network attack targets, comprising: Obtain the device information of each of the N network devices. The device information includes behavioral information and basic information, where N is an integer greater than or equal to 2. In response to the detection of an attack on the nth network device, a behavior sequence is determined based on the behavior information of the nth and mth network devices, wherein the behavior sequence includes at least one of a command execution sequence, a process execution sequence, and a file creation sequence; a behavior feature is obtained based on the behavior sequence, wherein the behavior feature includes at least one of a command encoding vector, a process encoding vector, and a file encoding vector; a basic feature is obtained based on the basic information of the mth network device, wherein the basic feature includes a basic information vector obtained based on the basic information; and a cross-device feature is obtained based on the basic information vector and at least one of the command encoding vector, process encoding vector, and file encoding vector, wherein n and m are both integers greater than or equal to 1 and less than or equal to N, and n is not equal to m; The basic features are input into a convolutional sub-network to obtain a first intermediate feature output by the convolutional sub-network after processing the basic features. The convolutional sub-network is constructed based on a convolutional neural network. The behavioral features are input into a temporal sub-network to obtain a second intermediate feature output by the temporal sub-network after processing the behavioral features. The temporal sub-network is constructed based on a neural network with temporal processing capabilities. The first intermediate feature is input into a first multilayer perceptron to obtain a first output vector. The second intermediate feature is input into a second multilayer perceptron to obtain a second output vector. The first output vector and the second output vector are input into a gating network to obtain the first risk probability of the m-th network device. When the first risk probability of the m-th network device is greater than or equal to the first preset threshold, the m-th network device is determined to be the first potential attack target.

2. The method according to claim 1, wherein, After identifying the m-th network device as the first potential attack target, the method further includes: Based on the first risk probability and its first weight, a first weighted value is obtained; A second weighted value is obtained based on the transition probability and its second weight, wherein the transition probability indicates the probability that the m-th network device will be accessed after the n-th network device is accessed; Based on the first weighted value and the second weighted value, the second risk probability of the m-th network device is obtained; When the second risk probability of the m-th network device is greater than or equal to the second preset threshold, the m-th network device is determined to be the second potential attack target, wherein the probability of the second potential attack target being attacked is greater than the probability of the first potential attack target being attacked.

3. The method according to claim 2, wherein, Before obtaining the second weighted value, the method further includes obtaining the transition probability, specifically including: Obtain historical access data between the nth network device and the mth network device; Based on the historical access data, determine the transition probability between the nth network device and the mth network device.

4. The method according to claim 1, wherein, The obtained cross-device features include: Determine the data transmission link between the nth network device and the mth network device; Identify the network devices involved in the data transmission link, excluding the nth network device and the mth network device; The cross-device feature is obtained based on the device information of the nth network device, the mth network device, and the other network devices.

5. The method according to claim 1, wherein, The determination of the behavior sequence includes at least one of the following operations: Based on command execution information, a command execution sequence of at least two commands is constructed in chronological order, wherein any one of the at least two commands is executed on a different network device along with at least one other command; Based on process execution information, a process execution sequence of at least two processes is constructed according to the time sequence, wherein any one of the at least two processes is run on a different network device along with at least one other process. Based on file creation information, a file creation sequence of at least two files is constructed in chronological order, wherein any one of the at least two files and at least one other file are created on different network devices.

6. The method according to claim 5, wherein, The process of obtaining the behavioral features based on the behavioral sequence includes at least one of the following operations: The command encoding vector is obtained based on the command execution sequence; The process encoding vector is obtained based on the process execution sequence; The file encoding vector is obtained based on the file creation sequence.

7. The method according to claim 1, wherein, The step of obtaining the device information of each of the N network devices includes: Collect basic information for each of the N network devices, wherein the basic information includes information describing the basic attributes and characteristics of the network devices themselves; Collect behavioral information from each of the N network devices, wherein the behavioral information includes internal dynamic information and / or external interaction information generated by the network devices when performing specific operations; Based on the basic information and behavioral information of each of the N network devices, the device information of each network device is obtained.

8. The method according to claim 1, wherein, The m-th network device is any one of the N network devices except the n-th network device, and the method further includes: Determine the first risk probability of each of the N network devices, excluding the nth network device; When the first risk probability of at least two network devices is greater than or equal to a first preset threshold, the attack path between the at least two network devices is determined. Based on the attack path, network attack defense operations are performed on the at least two network devices.

9. A network attack target detection system, comprising: There are N engine terminals, deployed one-to-one on N network devices, where N is an integer greater than or equal to 2; The management terminal is used to receive device information of the N network devices collected by the N engine terminals respectively, and in response to detecting an attack on the nth network device, executes the network attack target detection method according to any one of claims 1 to 8.

10. A network attack target detection device, comprising: The information acquisition module is used to acquire the device information of each of the N network devices. The device information includes behavioral information and basic information, where N is an integer greater than or equal to 2. A feature acquisition module is used to respond to the detection of an attack on the nth network device by determining a behavior sequence based on the behavior information of the nth and mth network devices, wherein the behavior sequence includes at least one of a command execution sequence, a process execution sequence, and a file creation sequence; obtaining behavior features based on the behavior sequence, wherein the behavior features include at least one of a command encoding vector, a process encoding vector, and a file encoding vector; obtaining basic features based on the basic information of the mth network device, wherein the basic features include a basic information vector obtained based on the basic information; and obtaining cross-device features based on the basic information vector and at least one of the command encoding vector, process encoding vector, and file encoding vector, wherein n and m are both integers greater than or equal to 1 and less than or equal to N, and n is not equal to m. The risk prediction module is used to input the basic features into a convolutional sub-network to obtain a first intermediate feature output by the convolutional sub-network after processing the basic features; the convolutional sub-network is constructed based on a convolutional neural network; input the behavioral features into a temporal sub-network to obtain a second intermediate feature output by the temporal sub-network after processing the behavioral features; the temporal sub-network is constructed based on a neural network with temporal processing capabilities; input the first intermediate feature into a first multilayer perceptron to obtain a first output vector; input the second intermediate feature into a second multilayer perceptron to obtain a second output vector; and input the first output vector and the second output vector into a gating network to obtain the first risk probability of the m-th network device. The object detection module is used to determine the m-th network device as a first potential attack target when the first risk probability of the m-th network device is greater than or equal to a first preset threshold.

11. An electronic device, comprising: One or more processors; Storage device for storing one or more programs. Wherein, when the one or more programs are executed by the one or more processors, the one or more processors perform the method according to any one of claims 1 to 8.

12. A computer-readable storage medium having stored thereon executable instructions that, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 8.

13. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 8.

Images