Abnormal traffic attack identification method and device, electronic equipment and storage medium
By training an anomaly attack identification model using a gradient boosting tree model and a genetically optimized fully connected neural network, the problem of untimely updates to anomaly attack identification rules was solved, enabling accurate identification and dynamic handling of abnormal traffic attacks and improving the intelligent management and control capabilities of network security.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- XINYANG BRANCH HENAN CO LTD OF CHINA MOBILE COMM CORP
- Filing Date
- 2022-04-12
- Publication Date
- 2026-08-04
AI Technical Summary
In existing technologies, the rules for identifying abnormal attacks lack automatic learning capabilities, resulting in untimely updates, an inability to effectively identify network attacks in a timely manner, and the failure of the identification rules when attack methods change.
An abnormal attack request identification model is trained using a gradient boosting tree model and combined with a genetically optimized fully connected neural network. The model identifies and handles access requests by acquiring feature information and dynamically updates the abnormal attack identification rules.
It improves the accuracy of identifying abnormal traffic attacks, can update identification rules in a timely manner, adapt to changes in attack methods, and enhances the intelligent management and control capabilities of network security.
Smart Images
Figure CN116961926B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of network security technology, and in particular to a method, apparatus, electronic device, and computer-readable storage medium for identifying abnormal traffic attacks. Background Technology
[0002] As the overall network scale of telecommunications and internet companies continues to expand, multi-layered network security threats and risks are also increasing, and network attacks are gradually becoming more distributed, large-scale, and complex. Currently, relying solely on single network security protection technologies such as firewalls, intrusion detection, antivirus, and access control is no longer sufficient to meet network security needs. Therefore, new technologies are urgently needed to promptly detect abnormal events in the network, monitor the network security status in real time, and handle abnormal events, thereby reducing network security risks and improving intelligent network security management capabilities.
[0003] In related technologies, the identification of anomalous attack events in a network mainly relies on feature matching between anomalous attack identification rules and the network event to be identified, thereby determining whether the network event is an anomalous attack event. However, when using the methods provided by these technologies, the anomalous attack identification rules lack automatic learning capabilities, which can easily lead to situations such as untimely updates to the rules. This results in two problems: firstly, it cannot detect network attacks and other anomalous events in a timely and effective manner; secondly, if the attack methods of anomalous attacks change, the existing anomalous attack identification rules may become invalid, thus failing to accurately identify anomalous events.
[0004] Therefore, how to accurately identify abnormal attack events is a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention
[0005] This application provides a method for identifying abnormal traffic attacks, which solves the problem that existing technologies cannot accurately identify abnormal attack events.
[0006] This application also provides an abnormal traffic attack identification device, an electronic device, and a computer-readable storage medium.
[0007] The embodiments of this application adopt the following technical solutions:
[0008] A method for identifying abnormal traffic attacks includes:
[0009] Obtain the access request to be identified;
[0010] The access request is input into the pre-trained abnormal attack request identification model to obtain the output result; wherein, the abnormal attack request identification model is trained by the normal access request sample and the abnormal access request sample through the gradient boosting tree model, and the nodes of the base learner of the abnormal attack request identification model include the abnormal attack identification rules trained by the normal access request sample and the abnormal access request sample.
[0011] Identify whether the access request is an abnormal attack traffic based on the output results.
[0012] Optionally, before inputting the access request into a pre-trained abnormal attack request identification model and obtaining the output, the method further includes:
[0013] The first base learner of the gradient boosting tree model is trained based on the training set to obtain the trained first base learner. The training sample set includes normal access request samples and abnormal access request samples.
[0014] Calculate the residual of the first base learner after training;
[0015] The second base learner of the gradient boosting tree model is fitted and trained based on the residuals to obtain the fitted and trained second base learner.
[0016] Based on the fitted second base learner, an abnormal attack request identification model is obtained.
[0017] Optionally, before training the first base learner of the gradient boosting tree model based on the training set to obtain the trained first base learner, the method further includes:
[0018] Construct an attack packet corresponding to the preset network attack type;
[0019] Attack logs are obtained by packet capture and analysis based on attack packets. The attack logs contain characteristic information of abnormal attack access traffic.
[0020] Feature rules are extracted based on feature information.
[0021] Optionally, the method also includes:
[0022] The identification results of the access request are input into the pre-trained anomaly handling decision model to obtain the event judgment probability of the access request; wherein, the anomaly handling decision model is trained by the attack confidence, IP reputation, IP region, attack dispersion and attack direction of the access request;
[0023] Based on the event probability of the access request and the correlation between the preset handling strategy and the event probability, the handling strategy for the access request is determined.
[0024] Access requests are processed based on the processing strategy.
[0025] Optionally, before inputting the identification result of the access request into the pre-trained anomaly handling decision model to obtain the event judgment probability of the access request, the method further includes:
[0026] Obtain normal access request samples and abnormal access request samples;
[0027] Determine the attack confidence, IP reputation, IP region, attack dispersion, and attack direction for normal access request samples and abnormal access request samples respectively;
[0028] The attack confidence, IP reputation, IP region, attack dispersion, and attack direction are quantified and assigned values to obtain the input vectors corresponding to normal access request samples and abnormal access request samples, respectively.
[0029] The genetically optimized fully connected neural network model is trained based on the input vector to obtain an anomaly handling decision model.
[0030] Optionally, the method also includes:
[0031] The event judgment probability is output by the abnormal handling decision model after obtaining normal access request samples or abnormal access request samples;
[0032] The error of the anomaly handling decision model is calculated based on the probability of event assessment and the true value of normal access request samples or abnormal access request samples.
[0033] The network weights of the anomaly handling decision model are iteratively updated based on the error until the error of the anomaly handling decision model is less than a preset error threshold.
[0034] An abnormal traffic attack identification device includes an acquisition module, an input module, and an identification module, wherein:
[0035] The acquisition module is used to acquire access requests to be identified.
[0036] The input module is used to input access requests into a pre-trained abnormal attack request identification model and obtain output results. The abnormal attack request identification model is trained by a gradient boosting tree model using normal access request samples and abnormal access request samples. The nodes of the base learner of the abnormal attack request identification model include abnormal attack identification rules trained by normal access request samples and abnormal access request samples.
[0037] The identification module is used to identify whether the access request is an abnormal attack traffic based on the output results.
[0038] Optionally, the device is also used for:
[0039] The first base learner of the gradient boosting tree model is trained based on the training set to obtain the trained first base learner. The training sample set includes normal access request samples and abnormal access request samples.
[0040] Calculate the residual of the first base learner after training;
[0041] The second base learner of the gradient boosting tree model is fitted and trained based on the residuals to obtain the fitted and trained second base learner.
[0042] Based on the fitted second base learner, an abnormal attack request identification model is obtained.
[0043] Optionally, the device is also used for:
[0044] Construct an attack packet corresponding to the preset network attack type;
[0045] Attack logs are obtained by packet capture and analysis based on attack packets. The attack logs contain characteristic information of abnormal attack access traffic.
[0046] Feature rules are extracted based on feature information.
[0047] Optionally, the device is also used for:
[0048] The identification results of the access request are input into the pre-trained anomaly handling decision model to obtain the event judgment probability of the access request; wherein, the anomaly handling decision model is trained by the attack confidence, IP reputation, IP region, attack dispersion and attack direction of the access request;
[0049] Based on the event probability of the access request and the correlation between the preset handling strategy and the event probability, the handling strategy for the access request is determined.
[0050] Access requests are processed based on the processing strategy.
[0051] Optionally, the device is also used for:
[0052] Obtain normal access request samples and abnormal access request samples;
[0053] Determine the attack confidence, IP reputation, IP region, attack dispersion, and attack direction for normal access request samples and abnormal access request samples respectively;
[0054] The attack confidence, IP reputation, IP region, attack dispersion, and attack direction are quantified and assigned values to obtain the input vectors corresponding to normal access request samples and abnormal access request samples, respectively.
[0055] The genetically optimized fully connected neural network model is trained based on the input vector to obtain an anomaly handling decision model.
[0056] Optionally, the device is also used for:
[0057] The event judgment probability is output by the abnormal handling decision model after obtaining normal access request samples or abnormal access request samples;
[0058] The error of the anomaly handling decision model is calculated based on the probability of event assessment and the true value of normal access request samples or abnormal access request samples.
[0059] The network weights of the anomaly handling decision model are iteratively updated based on the error until the error of the anomaly handling decision model is less than a preset error threshold.
[0060] An electronic device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the abnormal traffic attack identification method as described above.
[0061] A computer-readable storage medium is characterized in that a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, it implements the steps of the abnormal traffic attack identification method as described above.
[0062] The above-described technical solutions adopted in the embodiments of this application can achieve the following beneficial effects:
[0063] The method provided in this application embodiment can identify access requests based on the abnormal attack identification rules included in the nodes of the base learner of the abnormal attack request identification model. Since the abnormal attack identification rules are trained from normal access request samples and abnormal access request samples, the abnormal attack identification rules can be updated as the normal access request samples and abnormal access request samples change. In this way, the problem of untimely updates of abnormal attack identification rules due to the lack of automatic learning capability in related technologies can be solved, and the problem of abnormal attack identification rules becoming invalid due to changes in the attack methods of abnormal attack events can be avoided, thereby improving the accuracy of abnormal traffic attack identification. Attached Figure Description
[0064] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:
[0065] Figure 1A schematic diagram illustrating the implementation process of an abnormal traffic attack identification method provided in this application embodiment;
[0066] Figure 2 A schematic diagram illustrating the implementation process of a training method for an abnormal attack request identification model provided in this application embodiment;
[0067] Figure 3 A schematic diagram illustrating the implementation process of a method for handling abnormal attack requests provided in an embodiment of this application;
[0068] Figure 4 This is a schematic diagram of the structure of a genetically optimized fully connected neural network model provided in an embodiment of this application;
[0069] Figure 5 This application provides a schematic diagram of the specific structure of an abnormal traffic attack identification device.
[0070] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation
[0071] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0072] The technical solutions provided by the various embodiments of this application are described in detail below with reference to the accompanying drawings.
[0073] Example 1
[0074] To address the problem that existing technologies cannot accurately identify abnormal attack events, this application provides a method for identifying abnormal traffic attacks.
[0075] The execution subject of this method can be various types of computing devices, or it can be an application or app installed on the computing device. The computing device can be a user terminal such as a mobile phone, tablet computer, or smart wearable device, or it can be a server.
[0076] For ease of description, this application uses a server as the execution subject of the method in its embodiments to illustrate the method. Those skilled in the art will understand that this embodiment uses a server as an example to describe the method, which is merely an illustrative example and does not limit the scope of protection of the corresponding claims.
[0077] Specifically, the implementation flow of the method provided in this application embodiment is as follows: Figure 1 As shown, it includes the following steps:
[0078] Step 11: Obtain the access request to be identified.
[0079] The access request to be identified refers to the access request to be identified as an abnormal attack request. In this application, the access request to be identified can be determined according to actual needs. For example, an access request suspected of being an abnormal attack request can be used as the access request to be identified.
[0080] In this embodiment, the access request to be identified can be obtained from internet traffic data and log data. The log data may include, for example, file operation log data, network connection log data, process log data, and human-computer interaction status log data. The log data can be obtained, for example, by using an optical splitter at the resource pool network egress to acquire HTTP traffic log data.
[0081] It should be noted that the above-described methods for obtaining access requests and the illustrated log data are merely illustrative examples of embodiments of this application and do not impose any limitations on the embodiments of this application.
[0082] Step 12: Input the access request into the pre-trained abnormal attack request identification model to obtain the output result; wherein, the abnormal attack request identification model is trained by the normal access request sample and the abnormal access request sample through the gradient boosting tree model, and the nodes of the base learner of the abnormal attack request identification model include the abnormal attack identification rules trained by the normal access request sample and the abnormal access request sample.
[0083] An abnormal attack request identification model can be used to identify abnormal attack requests. Its output includes the attack confidence of the request to be accessed, which can be used to characterize whether the access request is an abnormal attack request.
[0084] like Figure 2 As shown, in one embodiment, the abnormal attack request identification model can be trained through the following steps S21 to S24:
[0085] S21, the first base learner of the gradient boosting tree model is trained based on the training set to obtain the trained first base learner. The training sample set includes normal access request samples and abnormal access request samples.
[0086] The training set can be determined based on the http dataset csic2010 dataset.
[0087] Optionally, considering that when using the HTTP dataset CSI2010 as the training set, the timeliness and completeness of the training set may differ from actual access requests, potentially negatively impacting the training results, this application proposes adding existing, confirmed normal access request data and abnormal attack request data to the HTTP dataset CSI2010 as training samples. This expands the training set sample and addresses potential negative impacts when using only the HTTP dataset CSI2010 as the training set.
[0088] In practical applications, optical splitting devices can be used at the resource pool network egress to acquire HTTP traffic log data and extract metadata information to identify normal and abnormal access requests already identified on the current network. Optionally, considering that the collected traffic log data may have different formats, this embodiment can further preprocess the collected traffic log data to standardize it. The standardized traffic log data format includes: time, sip, dip, sport, dport, method, proto, app, status, host, uri, referer, content-encoding, content-length, user_agent, cookies, proxy-authorization, proxy-connection, content-location, and link.
[0089] It should be noted that the above-described methods for obtaining confirmed normal and abnormal access requests from the existing network, as well as the preprocessing methods, are merely illustrative examples of embodiments of this application and do not impose any limitations on the embodiments of this application.
[0090] After determining the training set using the above method, feature rules can be further extracted from the training set. Specifically, attack packets corresponding to preset network attack types can be constructed first; then, attack logs can be obtained based on the attack packets using packet capture analysis methods. The attack logs contain feature information of abnormal attack access traffic; finally, feature rules can be extracted from the training set based on the feature information. Optionally, the actual network attack types that need to be identified can be used as preset network attack types.
[0091] For example, assuming the actual network attack types to be identified include brute-force attacks, SQL injection, buffer overflows, information leakage, cross-site scripting, denial of service, remote command execution, path traversal, remote file inclusion, and web crawling, these network attack types can be identified as preset network attack types. Then, attack logs can be obtained through packet capture analysis based on attack packets. Parameters such as URL, HOST, REFERER, GET, PUT, POST, and cookies in the attack logs can be analyzed to determine IP access frequency, string length, keywords, and other characteristic information. Furthermore, for abnormal attack requests, the network attack type information, number of attacks, attack frequency per unit time, number of SQL injections, number of buffer overflows, and other multi-dimensional characteristic information can be further determined. Finally, feature rules are extracted from the training set based on the characteristic information.
[0092] After extracting feature rules from the training set, the first base learner of the gradient boosting tree model can be trained based on the statistically well-defined feature information to obtain the trained first base learner.
[0093] The first base learner can be a classification and regression tree (CART).
[0094] In this embodiment of the application, a gradient boosting tree model can be constructed based on M CART trees, and then the first CART tree can be trained based on the training set. The trained gradient boosting tree model is denoted as f1(x).
[0095] S22, calculate the residual of the first base learner after training.
[0096] In this application, the training set can be predicted based on the first base learner after training to obtain the predicted value; then the residual of the first base learner can be calculated based on the predicted value and the actual value of the training set.
[0097] For example, assuming the actual value of the training set is y and the predicted value is f1(x), then the residual r1 = y - f1(x) can be obtained.
[0098] S23, the second base learner of the gradient boosting tree model is fitted and trained according to the residual to obtain the fitted and trained second base learner.
[0099] The second base learner refers to the classification and regression trees included in the gradient boosting tree model, excluding the first base learner.
[0100] Following the previous example, after obtaining the residual r1 of the first base learner, this residual can be used as the input of one of the classification and regression trees C1 in the second base learner. Then, the classification and regression tree C1 is used to fit and train the residual, thereby obtaining the fitted and trained second base learner C1.
[0101] Then, the predicted value f2(x) of the training set and the residual r2 are determined by the trained second base learner C1. The residual r2 is then used as the input of another classification and regression tree C2 in the second base learner. The classification and regression tree C2 is then used to fit and train the residual r2 to obtain the fitted and trained second base learner C2. This process is repeated until all second base learners have been traversed.
[0102] S24, based on the second base learner, obtains an abnormal attack request identification model.
[0103] Continuing with the previous example, assuming the gradient boosting tree model includes M CART trees, then after executing S23, we can obtain the Mth CART tree model, f m (x)=f m-1 (x)+T m (x), where f m (x) represents the model of the Mth CART tree, f m-1 (x) represents the (M-1)th CART tree model, T m (x) represents the residual of the M-th CART tree fitted to the (M-1)-th CART tree, which is then summed by multiple weak classifiers to obtain the final gradient boosting tree model strong learner: That is, the abnormal attack request identification model, where f M (x) represents the strong learner of the final gradient boosting tree model. This represents the sum of the fitting residuals from the first CART tree to the Mth CART tree.
[0104] Step 13: Identify whether the access request is an abnormal attack traffic based on the output results.
[0105] In this application, the output results include the attack confidence of the request to be accessed, wherein the attack confidence can be used to characterize whether the access request is an abnormal attack request.
[0106] Optionally, considering the lack of effective dynamic handling methods in related technologies, which prevents the effective processing of abnormal attack requests, this application, after obtaining the identification result of the access request to be identified, also provides a method for handling abnormal attack requests. For example... Figure 3 As shown, the method for handling this abnormal attack request includes the following steps S31 to S33:
[0107] S31, input the identification result of the access request into the pre-trained anomaly handling decision model to obtain the event judgment probability of the access request; wherein, the anomaly handling decision model is trained by the attack confidence, IP reputation, IP region, attack dispersion and attack direction of the access request.
[0108] In one embodiment, the anomaly handling decision model can be trained through the following steps (1) to (4):
[0109] (1) Obtain normal access request samples and abnormal access request samples.
[0110] (2) Determine the attack confidence, IP reputation, IP region, attack dispersion and attack direction for normal access request samples and abnormal access request samples respectively.
[0111] Optionally, in one embodiment, the attack frequency within a preset time period (e.g., the last ten days) can be counted based on the attacking IP; and / or the mean, variance, skewness, and kurtosis of a preset amount of data (e.g., 200 data points) can be counted based on the attacking IP; and / or, gray prediction can be performed on the event judgment probability and attack confidence of a preset number of attack records counted based on the attacking IP, thereby obtaining a preliminary prediction probability in the time dimension. This introduces temporal features to enhance the feature dimensionality of the training samples, thereby improving the model accuracy.
[0112] (3) Quantify and assign values to attack confidence, IP reputation, IP region, attack dispersion and attack direction to obtain the input vectors corresponding to normal access request samples and abnormal access request samples respectively.
[0113] When quantifying attack confidence, IP reputation, IP region, attack dispersion, and attack direction, the quantification can be implemented as shown in Table 1 below.
[0114] Table 1
[0115]
[0116] Among them, attack confidence is the output of the abnormal attack request identification model, and its format is: type plus confidence, for example, SQL injection: 0.8. IP reputation refers to the degree of malice of the IP; attack IP region refers to the region to which the attacker's IP belongs; attack dispersion is used to select a time window to judge the access behavior of multiple attack source IPs; attack direction refers to the network location of the attack source and the attack target.
[0117] (4) Train the genetically optimized fully connected neural network model based on the input vector to obtain the abnormal handling decision model.
[0118] like Figure 4The figure shows a schematic diagram of a genetically optimized fully connected neural network model provided in an embodiment of this application. As can be seen from the figure, the structure of this genetically optimized fully connected neural network model is 6×512×256×128×64×1, and the number of optimized parameters is (6×512+512×256+256×128+128×64+64×1) (number of weights) + (512+256+128+64+1) (number of thresholds).
[0119] In this embodiment of the application, the obtained normal access request samples and abnormal access request samples can be divided into training set and test set in an 8:2 ratio; then, sample data preprocessing operation is performed, wherein the sample data preprocessing includes: missing value and outlier handling, normalization processing, that is, attack confidence, IP reputation value, IP region, attack dispersion, attack direction and other indicators are taken as multi-dimensional feature samples and normalized so that their values are between 0 and 1.
[0120] In this embodiment, the normalized transformation function is as follows:
[0121]
[0122] Where, x * This represents the normalized index; x represents the assigned value of the index; min and max represent the minimum and maximum values of the index, respectively.
[0123] S32, determine the handling strategy for the access request based on the event assessment probability of the access request and the correlation between the preset handling strategy and the event assessment probability.
[0124] In this embodiment, a dynamic zero-response strategy can be formulated based on the probability of an event. Then, the IP blocking capabilities of the operator's network layer are utilized to execute different blocking strategies at different response points according to the response strategy. The response points in the response strategy can include both outer and inner networks; the blocking duration strategy in the response strategy includes long-term blocking, short-term blocking, and intermittent blocking.
[0125] For example, in one embodiment, the correlation between the preset handling strategy and the probability of event assessment can be shown in Table 2 below.
[0126] Table 2
[0127] Probability range of the event Disposal point Blocking duration [90％-100％] outer network 7 days [80％-90％) outer network 1 day [60％-80％) Inner network / outer network 1 day / 1 hour [40％-60％) Inner network 1 hour [0％-40％) No action taken No action taken
[0128] It should be noted that in the above handling strategy, the outer network mainly performs blackhole routing at the egress router, which can block both source and destination addresses. Furthermore, considering that a higher probability value indicates a greater impact from the event, large-scale blocking can be performed on the outer network for such events. For events with lower probability values, near-source blocking can be performed at the inner network firewall. Near-source blocking reduces the business impact of event handling.
[0129] For example, assuming the probability of an event is 65%, that is, the probability of an event is in the range of [60%-80%), the corresponding handling strategy is: to use the inner network or the outer network as the handling point and block for 1 day / 1 hour.
[0130] S33, handles access requests based on the handling strategy.
[0131] Following the example in S32, after determining the handling strategy, access requests can be handled accordingly based on the handling strategy.
[0132] Optionally, in one embodiment, after obtaining the anomaly handling decision model, a genetic optimization fully connected algorithm can be used to globally optimize the network. Specifically, the optimization method is as follows: obtain the event judgment probability output by the anomaly handling decision model after normal access request samples or abnormal access request samples pass through it; calculate the error of the anomaly handling decision model based on the event judgment probability and the true value of the normal access request sample or the true value of the abnormal access request sample; iteratively update the network weights of the anomaly handling decision model based on the error until the error of the anomaly handling decision model is less than a preset error threshold.
[0133] In practical applications, the deviations of each network weight and output node in the anomaly handling decision model can be initialized, initially using random numbers between -0.5 and 0.5. Then, training samples (i.e., normal access request samples or abnormal access request samples) are input into the anomaly handling decision model to obtain output values. The error between the output value and the true value is calculated. If the error is greater than a predetermined entropy value, the network weights are corrected. Specifically, a genetic algorithm can be used for iteration, selection, crossover, and mutation to update the weights, thereby obtaining network weights whose error meets the preset error requirements. The method of updating weights through genetic algorithm iteration, selection, crossover, and mutation can be referenced in related technologies regarding genetic optimization fully connected algorithms, and will not be elaborated here.
[0134] The method provided in this application embodiment can identify access requests based on the abnormal attack identification rules included in the nodes of the base learner of the abnormal attack request identification model. Since the abnormal attack identification rules are trained from normal access request samples and abnormal access request samples, the abnormal attack identification rules can be updated as the normal access request samples and abnormal access request samples change. In this way, the problem of untimely updates of abnormal attack identification rules due to the lack of automatic learning ability in related technologies can be solved, and the problem of abnormal attack identification rules becoming invalid due to changes in the attack methods of abnormal attack events can be avoided, thereby improving the accuracy of abnormal traffic attack identification.
[0135] Example 2
[0136] To address the problem of existing technologies failing to accurately identify abnormal attack events, this application provides an abnormal traffic attack identification device, the specific structure of which is shown in the schematic diagram below. Figure 5 As shown, it includes an acquisition module 51, an input module 52, and a recognition module 53. The functions of each unit are as follows:
[0137] The acquisition module 51 is used to acquire the access request to be identified.
[0138] The input module 52 is used to input the access request into the pre-trained abnormal attack request identification model and obtain the output result; wherein, the abnormal attack request identification model is trained by the normal access request sample and the abnormal access request sample through the gradient boosting tree model, and the nodes of the base learner of the abnormal attack request identification model include the abnormal attack identification rules trained by the normal access request sample and the abnormal access request sample.
[0139] The identification module 53 is used to identify whether the access request is an abnormal attack access traffic based on the output result.
[0140] Optionally, the abnormal traffic attack detection device is also used for:
[0141] The first base learner of the gradient boosting tree model is trained based on the training set to obtain the trained first base learner. The training sample set includes normal access request samples and abnormal access request samples.
[0142] Calculate the residual of the first base learner after training;
[0143] The second base learner of the gradient boosting tree model is fitted and trained based on the residuals to obtain the fitted and trained second base learner.
[0144] Based on the fitted second base learner, an abnormal attack request identification model is obtained.
[0145] Optionally, the abnormal traffic attack detection device is also used for:
[0146] Construct an attack packet corresponding to the preset network attack type;
[0147] Attack logs are obtained by packet capture and analysis based on attack packets. The attack logs contain characteristic information of abnormal attack access traffic.
[0148] Feature rules are extracted based on feature information.
[0149] Optionally, the abnormal traffic attack detection device is also used for:
[0150] The identification results of the access request are input into the pre-trained anomaly handling decision model to obtain the event judgment probability of the access request; wherein, the anomaly handling decision model is trained by the attack confidence, IP reputation, IP region, attack dispersion and attack direction of the access request;
[0151] Based on the event probability of the access request and the correlation between the preset handling strategy and the event probability, the handling strategy for the access request is determined.
[0152] Access requests are processed based on the processing strategy.
[0153] Optionally, the abnormal traffic attack detection device is also used for:
[0154] Obtain normal access request samples and abnormal access request samples;
[0155] Determine the attack confidence, IP reputation, IP region, attack dispersion, and attack direction for normal access request samples and abnormal access request samples respectively;
[0156] The attack confidence, IP reputation, IP region, attack dispersion, and attack direction are quantified and assigned values to obtain the input vectors corresponding to normal access request samples and abnormal access request samples, respectively.
[0157] The genetically optimized fully connected neural network model is trained based on the input vector to obtain an anomaly handling decision model.
[0158] Optionally, the abnormal traffic attack detection device is also used for:
[0159] The event judgment probability is output by the abnormal handling decision model after obtaining normal access request samples or abnormal access request samples;
[0160] The error of the anomaly handling decision model is calculated based on the probability of event assessment and the true value of normal access request samples or abnormal access request samples.
[0161] The network weights of the anomaly handling decision model are iteratively updated based on the error until the error of the anomaly handling decision model is less than a preset error threshold.
[0162] The apparatus provided in this application embodiment can identify access requests based on the abnormal attack identification rules included in the nodes of the base learner of the abnormal attack request identification model. Since the abnormal attack identification rules are trained from normal access request samples and abnormal access request samples, the abnormal attack identification rules can be updated as the normal access request samples and abnormal access request samples change. In this way, the problem of untimely updates of abnormal attack identification rules due to the lack of automatic learning capability in related technologies can be solved, and the problem of abnormal attack identification rules becoming invalid due to changes in the attack methods of abnormal attack events can be avoided, thereby improving the accuracy of abnormal traffic attack identification.
[0163] Example 4
[0164] This application relates to an electronic device, such as... Figure 6 As shown. At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, network interface, and memory. The memory may include main memory, such as high-speed random-access memory (RAM), or it may include non-volatile memory, such as at least one disk drive. Of course, the electronic device may also include other hardware required for other business operations.
[0165] The processor, network interface, and memory can be interconnected via an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 5 It is indicated by a single double-headed arrow, but does not mean that there is only one bus or one type of bus.
[0166] Memory is used to store programs. Specifically, programs may include program code, which includes computer operation instructions. Memory may include main memory and non-volatile memory, and provides instructions and data to the processor.
[0167] The processor reads the corresponding computer program from non-volatile memory into memory and then runs it, forming an abnormal traffic attack identification device at the logical level. The processor executes the program stored in memory and specifically performs the following operations: acquiring the access request to be identified; inputting the access request into a pre-trained abnormal attack request identification model and obtaining the output result; wherein, the abnormal attack request identification model is trained from normal access request samples and abnormal access request samples using a gradient boosting tree model, and the nodes of the base learner of the abnormal attack request identification model include abnormal attack identification rules trained from normal access request samples and abnormal access request samples; and identifying whether the access request is abnormal attack traffic based on the output result.
[0168] Optionally, before inputting the access request into the pre-trained abnormal attack request identification model and obtaining the output, it is also used for:
[0169] The first base learner of the gradient boosting tree model is trained based on the training set to obtain the trained first base learner. The training sample set includes normal access request samples and abnormal access request samples.
[0170] Calculate the residual of the first base learner after training;
[0171] The second base learner of the gradient boosting tree model is fitted and trained based on the residuals to obtain the fitted and trained second base learner.
[0172] Based on the fitted second base learner, an abnormal attack request identification model is obtained.
[0173] Optionally, before training the first base learner of the gradient boosting tree model based on the training set to obtain the trained first base learner, it is also used for...
[0174] Construct an attack packet corresponding to the preset network attack type;
[0175] Attack logs are obtained by packet capture and analysis based on attack packets. The attack logs contain characteristic information of abnormal attack access traffic.
[0176] Feature rules are extracted based on feature information.
[0177] Optionally, it is also used to: input the identification result of the access request into a pre-trained anomaly handling decision model to obtain the event judgment probability of the access request; wherein, the anomaly handling decision model is trained from the attack confidence, IP reputation, IP region, attack dispersion and attack direction of the access request; determine the handling strategy of the access request based on the event judgment probability of the access request, as well as the correlation between the preset handling strategy and the event judgment probability; and handle the access request based on the handling strategy.
[0178] Optionally, before inputting the identification result of the access request into the pre-trained anomaly handling decision model to obtain the event judgment probability of the access request, it is also used for
[0179] Obtain normal access request samples and abnormal access request samples;
[0180] Determine the attack confidence, IP reputation, IP region, attack dispersion, and attack direction for normal access request samples and abnormal access request samples respectively;
[0181] The attack confidence, IP reputation, IP region, attack dispersion, and attack direction are quantified and assigned values to obtain the input vectors corresponding to normal access request samples and abnormal access request samples, respectively.
[0182] The genetically optimized fully connected neural network model is trained based on the input vector to obtain an anomaly handling decision model.
[0183] Optionally, it is also used for: obtaining the event judgment probability output by the abnormal access request sample or the abnormal access request sample after passing through the abnormal handling decision model; calculating the error of the abnormal handling decision model based on the event judgment probability and the true value of the normal access request sample or the true value of the abnormal access request sample; iteratively updating the network weights of the abnormal handling decision model based on the error until the error of the abnormal handling decision model is less than a preset error threshold.
[0184] The abnormal traffic attack identification method described above, as provided in this specification, can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed through integrated logic circuits in the processor's hardware or through software instructions. The processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this specification. The general-purpose processor can be a microprocessor or any conventional processor.
[0185] The steps of the method disclosed in the embodiments of this specification can be directly manifested as being executed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory; the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.
[0186] This specification also provides an embodiment of a computer-readable storage medium that stores one or more programs, the programs including instructions that, when executed by an electronic device including multiple applications, enable the electronic device to perform an abnormal traffic attack identification method, specifically for performing:
[0187] Obtain the access request to be identified; input the access request into the pre-trained abnormal attack request identification model to obtain the output result; wherein, the abnormal attack request identification model is trained by the normal access request sample and the abnormal access request sample through the gradient boosting tree model, and the nodes of the base learner of the abnormal attack request identification model include the abnormal attack identification rules trained by the normal access request sample and the abnormal access request sample; identify whether the access request is abnormal attack access traffic based on the output result.
[0188] Optionally, before inputting the access request into the pre-trained abnormal attack request identification model and obtaining the output, it is also used for:
[0189] The first base learner of the gradient boosting tree model is trained based on the training set to obtain the trained first base learner. The training sample set includes normal access request samples and abnormal access request samples.
[0190] Calculate the residual of the first base learner after training;
[0191] The second base learner of the gradient boosting tree model is fitted and trained based on the residuals to obtain the fitted and trained second base learner.
[0192] Based on the fitted second base learner, an abnormal attack request identification model is obtained.
[0193] Optionally, before training the first base learner of the gradient boosting tree model based on the training set to obtain the trained first base learner, it is also used for...
[0194] Construct an attack packet corresponding to the preset network attack type;
[0195] Attack logs are obtained by packet capture and analysis based on attack packets. The attack logs contain characteristic information of abnormal attack access traffic.
[0196] Feature rules are extracted based on feature information.
[0197] Optionally, it is also used to: input the identification result of the access request into a pre-trained anomaly handling decision model to obtain the event judgment probability of the access request; wherein, the anomaly handling decision model is trained from the attack confidence, IP reputation, IP region, attack dispersion and attack direction of the access request; determine the handling strategy of the access request based on the event judgment probability of the access request, as well as the correlation between the preset handling strategy and the event judgment probability; and handle the access request based on the handling strategy.
[0198] Optionally, before inputting the identification result of the access request into the pre-trained anomaly handling decision model to obtain the event judgment probability of the access request, it is also used for
[0199] Obtain normal access request samples and abnormal access request samples;
[0200] Determine the attack confidence, IP reputation, IP region, attack dispersion, and attack direction for normal access request samples and abnormal access request samples respectively;
[0201] The attack confidence, IP reputation, IP region, attack dispersion, and attack direction are quantified and assigned values to obtain the input vectors corresponding to normal access request samples and abnormal access request samples, respectively.
[0202] The genetically optimized fully connected neural network model is trained based on the input vector to obtain an anomaly handling decision model.
[0203] Optionally, it is also used for: obtaining the event judgment probability output by the abnormal access request sample or the abnormal access request sample after passing through the abnormal handling decision model; calculating the error of the abnormal handling decision model based on the event judgment probability and the true value of the normal access request sample or the true value of the abnormal access request sample; iteratively updating the network weights of the abnormal handling decision model based on the error until the error of the abnormal handling decision model is less than a preset error threshold.
[0204] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or physical entities, or by products with certain functions. A typical implementation device is a computer.
[0205] For ease of description, the above devices are described in terms of function, divided into various units. Of course, in implementing this specification, the functions of each unit can be implemented in one or more software and / or hardware components.
[0206] Those skilled in the art will understand that embodiments of this specification can be provided as methods, apparatus, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0207] This specification is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0208] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0209] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0210] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.
[0211] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.
[0212] Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data.
[0213] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0214] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.
Claims
1. A method for identifying abnormal traffic attacks, characterized in that, include: Obtain the access request to be identified; The access request is input into a pre-trained abnormal attack request identification model to obtain an output result; wherein, the abnormal attack request identification model is trained by a gradient boosting tree model from normal access request samples and abnormal access request samples, and the nodes of the base learner of the abnormal attack request identification model include abnormal attack identification rules trained by the normal access request samples and the abnormal access request samples. Based on the output results, identify whether the access request is an abnormal attack traffic; The method further includes: The identification result of the access request is input into the pre-trained anomaly handling decision model to obtain the event judgment probability of the access request; wherein, the anomaly handling decision model is trained by the attack confidence, IP reputation, IP region, attack dispersion and attack direction of the access request, and the attack confidence is the output result of the anomaly attack request identification model; Based on the event assessment probability of the access request and the correlation between the preset handling strategy and the event assessment probability, the handling strategy of the access request is determined. The access request is processed based on the aforementioned processing strategy.
2. The method as described in claim 1, characterized in that, Before inputting the access request into a pre-trained abnormal attack request identification model and obtaining the output result, the method further includes: The first base learner of the gradient boosting tree model is trained based on the training set to obtain the trained first base learner. The training set includes the normal access request samples and the abnormal access request samples. Calculate the residual of the first base learner after training; The second base learner of the gradient boosting tree model is fitted and trained according to the residual to obtain the fitted and trained second base learner. Based on the fitted second base learner, the abnormal attack request identification model is obtained.
3. The method as described in claim 2, characterized in that, Before training the first base learner of the gradient boosting tree model based on the training set to obtain the trained first base learner, the method further includes: Construct an attack packet corresponding to the preset network attack type; Based on the attack packets, attack logs are obtained through packet capture analysis methods. The attack logs contain characteristic information of abnormal attack access traffic. Feature rules are extracted based on the aforementioned feature information.
4. The method as described in claim 1, characterized in that, Before inputting the identification result of the access request into a pre-trained anomaly handling decision model to obtain the event judgment probability of the access request, the method further includes: Obtain the normal access request sample and the abnormal access request sample; The attack confidence, IP reputation, IP region, attack dispersion, and attack direction of the normal access request sample and the abnormal access request sample are determined respectively. The attack confidence, IP reputation, IP region, attack dispersion, and attack direction are quantized and assigned values to obtain the input vectors corresponding to the normal access request sample and the abnormal access request sample, respectively. The genetically optimized fully connected neural network model is trained based on the input vector to obtain the anomaly handling decision model.
5. The method as described in claim 4, characterized in that, The method further includes: The event judgment probability is output by the abnormal access request sample or the abnormal access request sample after being processed by the abnormal handling decision model; The error of the abnormal handling decision model is calculated based on the event assessment probability and the true value of the normal access request sample or the true value of the abnormal access request sample. The network weights of the anomaly handling decision model are iteratively updated based on the error until the error of the anomaly handling decision model is less than a preset error threshold.
6. An abnormal traffic attack identification device, characterized in that, It includes an acquisition module, an input module, and a recognition module, wherein: The acquisition module is used to acquire access requests to be identified. The input module is used to input the access request into a pre-trained abnormal attack request identification model and obtain an output result; wherein, the abnormal attack request identification model is trained by a gradient boosting tree model from normal access request samples and abnormal access request samples, and the nodes of the base learner of the abnormal attack request identification model include abnormal attack identification rules trained by the normal access request samples and the abnormal access request samples. The identification module is used to identify whether the access request is an abnormal attack access traffic based on the output result; The abnormal traffic attack identification device is further used to input the identification result of the access request into a pre-trained abnormal handling decision model to obtain the event judgment probability of the access request; wherein, the abnormal handling decision model is trained by the attack confidence, IP reputation, IP region, attack dispersion and attack direction of the access request, and the attack confidence is the output result of the abnormal attack request identification model. Based on the event assessment probability of the access request and the correlation between the preset handling strategy and the event assessment probability, the handling strategy of the access request is determined. The access request is processed based on the aforementioned processing strategy.
7. The apparatus as claimed in claim 6, characterized in that, The device is also used for: The first base learner of the gradient boosting tree model is trained based on the training set to obtain the trained first base learner. The training set includes the normal access request samples and the abnormal access request samples. Calculate the residual of the first base learner after training; The second base learner of the gradient boosting tree model is fitted and trained according to the residual to obtain the fitted and trained second base learner. Based on the fitted second base learner, the abnormal attack request identification model is obtained.
8. An electronic device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the abnormal traffic attack identification method as described in any one of claims 1 to 5.
9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the abnormal traffic attack identification method as described in any one of claims 1 to 5.