Service attack detection method, device and equipment and computer readable storage medium

Abstract

The application discloses a service attack detection method, device and equipment and a computer readable storage medium. The method comprises the following steps: acquiring an abnormal domain name collected by a collection node, and generating a blacklist according to the abnormal domain name, wherein a service containing a vulnerability is deployed on the collection node, and the service containing the vulnerability does not actively request to resolve a domain name; acquiring real-time access logs of a service collected by a business node, wherein a normal service is deployed on the business node; and if a domain name corresponding to the real-time access logs matches a domain name in the blacklist, it is determined that an access operation corresponding to the real-time access logs is an abnormal attack operation. The application improves the comprehensiveness and timeliness of attack detection.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a service attack detection method, apparatus, device, and computer-readable storage medium. Background Technology

[0002] DNS (Domain Name System) is one of the core infrastructures of the Internet, and many Internet applications rely on DNS services to function effectively. Enterprise networks frequently face the threat of cyber attackers stealing valuable and sensitive data, with attackers increasingly exploiting DNS channels to leak data. Typically, attackers use DNS by registering domain names, allowing them to exploit vulnerabilities in services within containers to steal valuable data such as account passwords or kernel versions from containers and hosts via DNS logs. Traditional methods of application attack detection cannot detect attacks via API calls, and the constantly evolving and emerging APT attack techniques can further hinder the detection of application attacks, resulting in low accuracy in attack detection. Summary of the Invention

[0003] The main objective of this invention is to provide a service attack detection method, apparatus, device, and computer-readable storage medium, aiming to solve the problem of how to improve the accuracy of attack detection.

[0004] To achieve the above objectives, this invention provides a service attack detection method applied to a management platform. The management platform is communicatively connected to both a data collection node and a service node. The data collection node cannot access external networks or other nodes. The service attack detection method includes the following steps:

[0005] Obtain abnormal domain names collected by the collection node, and generate a blacklist based on the abnormal domain names. The collection node has a service with vulnerabilities deployed on it, and the service with vulnerabilities does not actively request to resolve the domain name.

[0006] Obtain real-time access logs of services collected by business nodes, where normal services are deployed.

[0007] If the domain name corresponding to the real-time access log matches the domain name in the blacklist, then the access operation corresponding to the real-time access log is determined to be an abnormal attack operation.

[0008] Optionally, after the step of determining that the access operation corresponding to the real-time access log is an abnormal attack operation if the domain name corresponding to the real-time access log matches a domain name in the blacklist, the method further includes:

[0009] Determine the association information of the real-time access logs that match the domains in the blacklist, wherein the association information includes at least one of process, network, domain name, and Internet Protocol address;

[0010] Alarm information is generated based on the associated information.

[0011] Optionally, after the step of determining that the access operation corresponding to the real-time access log is an abnormal attack operation if the domain name corresponding to the real-time access log matches a domain name in the blacklist, the method further includes:

[0012] Determine the types of vulnerable services associated with the domains in the blacklist matched by the real-time access logs;

[0013] Based on the associated vulnerable service types, identify the vulnerabilities present in the services within the business nodes.

[0014] Optionally, before the step of determining that the access operation corresponding to the real-time access log is an abnormal attack operation if the domain name corresponding to the real-time access log matches a domain name in the blacklist, the method further includes:

[0015] Determine the matching priority of the domains in the blacklist;

[0016] Based on the priority, the domain name corresponding to the real-time access log is matched with the domain name in the blacklist.

[0017] Optionally, after the step of determining that the access operation corresponding to the real-time access log is an abnormal attack operation if the domain name corresponding to the real-time access log matches a domain name in the blacklist, the method further includes:

[0018] Determine the number of successful matches for the domains in the blacklist;

[0019] If the number of successful matches exceeds a preset threshold, the matching priority of the domains in the blacklist will be increased.

[0020] Optionally, after the step of determining that the access operation corresponding to the real-time access log is an abnormal attack operation if the domain name corresponding to the real-time access log matches a domain name in the blacklist, the method further includes:

[0021] Determine the number of times each vulnerable service was attacked;

[0022] If the number of attacks exceeds a preset threshold, the matching priority of the domain name corresponding to the vulnerable service in the blacklist will be increased.

[0023] To achieve the above objectives, the present invention also provides a service attack detection device applied to a management platform, wherein the management platform is communicatively connected to a data collection node and a service node, and the data collection node cannot access external networks or other nodes. The service attack detection device includes:

[0024] The data collection module is used to acquire abnormal domain names collected by the data collection node and generate a blacklist based on the abnormal domain names. The data collection node has a service with vulnerabilities deployed on it, and the service with vulnerabilities does not actively request to resolve the domain names.

[0025] The acquisition module is used to acquire real-time access logs of services collected by business nodes, on which normal services are deployed.

[0026] The matching module is used to determine that the access operation corresponding to the real-time access log is an abnormal attack operation if the domain name corresponding to the real-time access log matches the domain name in the blacklist.

[0027] To achieve the above objectives, the present invention also provides a service attack detection method applied to a data collection node, wherein the data collection node cannot access external networks or other nodes, and a vulnerable service is deployed on the data collection node, the vulnerable service not actively requesting domain name resolution, the method comprising:

[0028] When a connection to a vulnerable service is detected, the domain name corresponding to the connection is determined to be an abnormal domain name.

[0029] The abnormal domain name was sent to the management platform.

[0030] To achieve the above objectives, the present invention also provides a service attack detection device applied to a data collection node. The data collection node cannot access external networks or other nodes. A vulnerable service is deployed on the data collection node, and the vulnerable service does not actively request domain name resolution. The device includes:

[0031] The determination module is used to determine that the domain name corresponding to the connection behavior is an abnormal domain name when a connection behavior containing a vulnerability is detected.

[0032] The sending module is used to send the abnormal domain name to the management platform.

[0033] To achieve the above objectives, the present invention also provides a service attack detection device, which includes a memory, a processor, and a service attack detection program stored in the memory and executable on the processor. When the service attack detection program is executed by the processor, it implements the various steps of the service attack detection method described above.

[0034] To achieve the above objectives, the present invention also provides a computer-readable storage medium storing a service attack detection program, which, when executed by a processor, implements the various steps of the service attack detection method described above.

[0035] This invention provides a service attack detection method, apparatus, device, and computer-readable storage medium. It acquires abnormal domain names collected by a collection node and generates a blacklist based on these abnormal domain names; it also acquires real-time access logs of services collected by a business node, where normal services are deployed; if the domain name corresponding to the real-time access log matches a domain name in the blacklist, the access operation corresponding to the real-time access log is determined to be an abnormal attack operation. By deploying various vulnerable services at the collection node, attack behavior detection is more comprehensive. Furthermore, by monitoring the outbound connection behavior of the domain name system in real time at the business node, unauthorized outbound connections can be detected promptly, improving the comprehensiveness and timeliness of attack detection. Attached Figure Description

[0036] Figure 1 This is a schematic diagram of the hardware structure of the service attack detection device according to an embodiment of the present invention;

[0037] Figure 2 A flowchart illustrating the first embodiment of the attack detection method of the present invention;

[0038] Figure 3 A schematic diagram of the structure of the management platform, data collection node, and business node for the attack detection method of this invention;

[0039] Figure 4 A flowchart illustrating the second embodiment of the attack detection method of the present invention;

[0040] Figure 5 A flowchart illustrating the third embodiment of the attack detection method of the present invention;

[0041] Figure 6 A schematic diagram of the logical structure of the attack detection device for this invention;

[0042] Figure 7 A schematic diagram of the logical structure of the attack detection device for this invention.

[0043] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0044] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0045] The main solution of this invention is as follows: Obtain abnormal domain names collected by the collection nodes and generate a blacklist based on these domain names; obtain real-time access logs of services collected by the business nodes, where normal services are deployed; if the domain name corresponding to the real-time access log matches a domain name in the blacklist, then the access operation corresponding to the real-time access log is determined to be an abnormal attack operation. By deploying various vulnerable services at the collection nodes, attack detection becomes more comprehensive. By monitoring the outbound connection behavior of the domain name system in real time at the business nodes, illegal outbound connection behavior can be detected promptly, improving the comprehensiveness and timeliness of attack detection.

[0046] As one implementation solution, service attack detection equipment can, for example... Figure 1 As shown.

[0047] The embodiments of this invention relate to a service attack detection device, which includes: a processor 101, such as a CPU, a memory 102, and a communication bus 103. The communication bus 103 is used to enable communication between these components.

[0048] Memory 102 can be high-speed RAM or stable memory (non-volatile memory), such as disk storage. Figure 1 As shown, the memory 102, which serves as a computer-readable storage medium, may include a service attack detection program; and the processor 101 may be used to invoke the service attack detection program stored in the memory 102 and perform the following operations:

[0049] Obtain abnormal domain names collected by the collection node, and generate a blacklist based on the abnormal domain names. The collection node has a service with vulnerabilities deployed on it, and the service with vulnerabilities does not actively request to resolve the domain name.

[0050] Obtain real-time access logs of services collected by business nodes, where normal services are deployed.

[0051] If the domain name corresponding to the real-time access log matches the domain name in the blacklist, then the access operation corresponding to the real-time access log is determined to be an abnormal attack operation.

[0052] Optionally, the processor 101 can be used to invoke the service attack detection program stored in the memory 102 and perform the following operations:

[0053] Determine the association information of the real-time access logs that match the domains in the blacklist, wherein the association information includes at least one of process, network, domain name, and Internet Protocol address;

[0054] Alarm information is generated based on the associated information.

[0055] Optionally, the processor 101 can be used to invoke the service attack detection program stored in the memory 102 and perform the following operations:

[0056] Determine the types of vulnerable services associated with the domains in the blacklist matched by the real-time access logs;

[0057] Based on the associated vulnerable service types, identify the vulnerabilities present in the services within the business nodes.

[0058] Optionally, the processor 101 can be used to invoke the service attack detection program stored in the memory 102 and perform the following operations:

[0059] Determine the matching priority of the domains in the blacklist;

[0060] Based on the priority, the domain name corresponding to the real-time access log is matched with the domain name in the blacklist.

[0061] Optionally, the processor 101 can be used to invoke the service attack detection program stored in the memory 102 and perform the following operations:

[0062] Determine the number of successful matches for the domains in the blacklist;

[0063] If the number of successful matches exceeds a preset threshold, the matching priority of the domains in the blacklist will be increased.

[0064] Optionally, the processor 101 can be used to invoke the service attack detection program stored in the memory 102 and perform the following operations:

[0065] Determine the number of times each vulnerable service was attacked;

[0066] If the number of attacks exceeds a preset threshold, the matching priority of the domain name corresponding to the vulnerable service in the blacklist will be increased.

[0067] Based on the hardware architecture of the service attack detection device described above, an embodiment of the service attack detection method of the present invention is proposed.

[0068] Reference Figure 2 , Figure 2 This is a first embodiment of the service attack detection method of the present invention, which includes the following steps:

[0069] Step S10: Obtain the abnormal domain names collected by the collection node, and generate a blacklist based on the abnormal domain names. The collection node has a service with vulnerabilities deployed on it, and the service with vulnerabilities does not actively request to resolve the domain names.

[0070] Optionally, such as Figure 3As shown, the management platform communicates with both the data collection nodes and the business nodes. The data collection nodes cannot access external networks or other nodes; they are deployed independently in a completely isolated environment. The other nodes on the data collection nodes can be business nodes. A vulnerable service is deployed on the data collection nodes. This vulnerable service does not actively request domain name resolution and is easily attacked. Optionally, the types of vulnerabilities can include various types, such as domain transmission vulnerabilities.

[0071] Optionally, the data collection nodes are primarily used to containerize and deploy various vulnerable services to detect actual attack behaviors. The data collection nodes operate in a completely isolated environment; all outbound connections are restricted except for DNS services, and it is essential to ensure that vulnerable services do not actively request DNS resolution. Optionally, the data collection nodes are isolated using micro-segmentation techniques, ensuring complete network isolation between the data collection nodes and other nodes, preventing access to external networks and other node IPs; the vulnerable services deployed on the data collection nodes do not actively request DNS domain name resolution.

[0072] Optionally, a DNS log collector, or Domain Name System log collector, is configured on the collection node. The DNS log collector is used to collect abnormal DNS access logs from host and container processes. When an attacker exploits various vulnerable services deployed on the server to echo information via DNS logs, the DNS log collector obtains the domain name requested by the attacker and sends it back to the management platform. When the DNS log collector detects DNS service connection activity, it determines that the domain name is abnormal and reports the abnormal domain name information to the management platform.

[0073] Optionally, the services containing vulnerabilities on the collection nodes are exposed to the outside world, and attackers can easily scan for service vulnerabilities. Since the collection nodes cannot access the external network and do not actively request DNS resolution, the DNSlog black sample information collected after vulnerability information is echoed through DNSlog is 100% the attacker's attack behavior.

[0074] Step S20: Obtain the real-time access logs of the services collected by the business nodes, where normal services are deployed.

[0075] Optionally, business nodes deploy various business services, which may contain vulnerabilities that attackers can exploit, making them vulnerable to attacks. After an attacker uses DNS log information to attack the application, the detection program uploads all collected DNS domain name resolution records to the management platform.

[0076] Optionally, the dnslog detection program is deployed on each business node. The dnslog detection program is used to collect all DNS access logs of the host and container processes, monitor the domain name resolution events of all processes in the container, and send them back to the management platform when all DNS domain name resolution records are detected.

[0077] Optionally, such as Figure 3 As shown, the data collection nodes and business nodes deploy the same business services. For example, the data collection nodes include vulnerability service A, vulnerability service B, and vulnerability service C, and the business nodes include business service A, business service B, and business service C.

[0078] Step S30: If the domain name corresponding to the real-time access log matches the domain name in the blacklist, then the access operation corresponding to the real-time access log is determined to be an abnormal attack operation.

[0079] Optionally, if the domain name corresponding to the real-time access log matches a domain name in the blacklist, that is, if the domain name corresponding to the real-time access log is the same as a domain name in the blacklist, the access operation corresponding to the real-time access log is determined to be an abnormal attack operation.

[0080] Optionally, after step S30, the method further includes: determining the vulnerable services associated with the domains in the blacklist that match the real-time access logs; and determining the types of vulnerabilities present in the services of the business node based on the types of vulnerabilities present in the associated vulnerable services. For example, the vulnerable service A associated with the domains in the blacklist that match the real-time access logs has a vulnerability type d1, and the vulnerability type present in the services of the business node is also d1.

[0081] Optionally, the attack detection method is applied to a management platform, which mainly includes modules such as DNSlog blacklist, auditing, and alerting. When the management platform receives DNS information sent by the collection nodes, it records it in the DNSlog blacklist. When the management platform receives domain name information sent by the business nodes, it records it in the audit log module and simultaneously compares the domain name information with the DNSlog blacklist. If a match is found, an alert is issued based on information such as the container and process associated with the domain name, and displayed through the management platform. Throughout the detection process, administrators can perform manual review on the management platform and input management operations to process and query data, such as DNSlog blacklist verification, viewing domain audit information, and processing DNSlog attack alert information. Furthermore, the attacker can be fully traced through the IP information in the domain audit information.

[0082] Optionally, the DNSlog blacklist is used to determine whether a domain name is on the DNSlog service blacklist. Optionally, DNSlog auditing is accomplished through a module that records DNS access audit logs for business services. Optionally, DNSlog alerts are accomplished through a module that provides DNS access log analysis, comparison with the DNSlog blacklist, association with containers, processes, domain names, and IP addresses, and the ability to display and trace alerts.

[0083] Optionally, after receiving the domain name information reported by the collection process of the collection nodes, the management platform enters it into the DNSlog blacklist. The DNS access logs reported by the business nodes are entered into the DNSlog audit module for subsequent source tracing. For each business's DNS access log, it first matches it against the DNSlog blacklist; if there is no match, it skips the entry; if there is a match, an alarm entry is recorded. Based on the DNSlog blacklist match, it associates information such as process, network, domain name, and IP address to generate highly accurate alarm information and notifies the administrator.

[0084] Optionally, after step S30, the method further includes: determining the association information of the real-time access logs that match the domains in the blacklist, wherein the association information includes at least one of process, network, domain name, and Internet Protocol address; and generating alarm information based on the association information. Optionally, the alarm information is displayed on the management platform or sent to the administrator's mobile terminal.

[0085] In this embodiment, abnormal domain names collected by the collection nodes are acquired, and a blacklist is generated based on these abnormal domain names. Real-time access logs of services collected by the business nodes are also acquired; normal services are deployed on these business nodes. If the domain name corresponding to the real-time access log matches a domain name in the blacklist, the access operation corresponding to the real-time access log is determined to be an abnormal attack operation. By deploying various vulnerable services at the collection nodes, attack detection becomes more comprehensive. By monitoring the outbound connection behavior of the domain name system in real time at the business nodes, unauthorized outbound connection behavior can be detected promptly, improving the comprehensiveness and timeliness of attack detection.

[0086] Reference Figure 4 , Figure 4 This is a second embodiment of the service attack detection method of the present invention. Based on the first embodiment, before step S30, it further includes:

[0087] Step S40: Determine the matching priority of the domains in the blacklist;

[0088] Step S50: According to the priority, match the domain name corresponding to the real-time access log with the domain name in the blacklist.

[0089] Optionally, domains with higher matching priority in the blacklist are matched with domains in the real-time access log first; domains with lower matching priority in the blacklist are matched with domains in the real-time access log later, in order to improve matching efficiency.

[0090] Optionally, after step S30, the method further includes: determining the number of successful matches of the domains in the blacklist; if the number of successful matches is greater than a preset number threshold, increasing the matching priority of the domains in the blacklist; if the number of successful matches is less than or equal to a preset matching threshold, decreasing the matching priority of the domains in the blacklist, wherein the preset matching threshold is less than the preset number threshold.

[0091] Optionally, after step S30, the method further includes: determining the number of times each vulnerable service has been attacked; if the number of attacks is greater than a preset threshold, increasing the matching priority of the domain name corresponding to the vulnerable service in the blacklist.

[0092] In the technical solution of this embodiment, the matching priority of the domains in the blacklist is determined; according to the priority, the domains corresponding to the real-time access logs are matched with the domains in the blacklist to improve the matching efficiency of the real-time access logs.

[0093] Reference Figure 5 , Figure 5 This is a third embodiment of the service attack detection method of the present invention, the method comprising the following steps:

[0094] Step S60: When a connection to a service containing a vulnerability is detected, the domain name corresponding to the connection is determined to be an abnormal domain name.

[0095] Step S70: Send the abnormal domain name to the management platform.

[0096] Optionally, such as Figure 3 As shown, the management platform communicates with both the data collection nodes and the business nodes. The management platform mainly includes modules for DNS log blacklisting, auditing, and alerting. When the management platform receives DNS information from the data collection nodes, it records it in the DNS log blacklist. When the management platform receives domain name information from the business nodes, it records it in the audit log module and simultaneously compares the domain name information with the DNS log blacklist. If a match is found, an alert is issued based on the associated containers, processes, and other information of the domain name, and displayed on the management platform. Throughout the detection process, administrators can perform manual reviews on the management platform and input management operations to process and query data, such as DNS log blacklist verification, viewing domain audit information, processing DNS log attack alerts, and tracing attackers completely through IP information in the domain audit information.

[0097] Optionally, the DNSlog blacklist is used to determine whether a domain name is on the DNSlog service blacklist. Optionally, DNSlog auditing is accomplished through a module that records DNS access audit logs for business services. Optionally, DNSlog alerts are accomplished through a module that provides DNS access log analysis, comparison with the DNSlog blacklist, association with containers, processes, domain names, and IP addresses, and the ability to display and trace alerts.

[0098] Optionally, after receiving the domain name information reported by the collection process of the collection nodes, the management platform enters it into the DNSlog blacklist. The DNS access logs reported by the business nodes are entered into the DNSlog audit module for subsequent source tracing. For each business's DNS access log, it first matches it against the DNSlog blacklist; if there is no match, it skips the entry; if there is a match, an alarm entry is recorded. Based on the DNSlog blacklist match, it associates information such as process, network, domain name, and IP address to generate highly accurate alarm information and notifies the administrator.

[0099] Optionally, the data collection nodes cannot access external networks or other nodes; that is, the data collection nodes are deployed independently in a completely isolated environment. The data collection nodes may contain vulnerable services that do not actively request domain name resolution and are easily attacked by attackers.

[0100] Optionally, the data collection nodes are primarily used to containerize and deploy various vulnerable services to detect actual attack behaviors. The data collection nodes operate in a completely isolated environment; all outbound connections are restricted except for DNS services, and it is essential to ensure that vulnerable services do not actively request DNS resolution. Optionally, the data collection nodes are isolated using micro-segmentation techniques, ensuring complete network isolation between the data collection nodes and other nodes, preventing access to external networks and other node IPs; the vulnerable services deployed on the data collection nodes do not actively request DNS domain name resolution.

[0101] Optionally, a DNS log collector, or Domain Name System log collector, is configured on the collection node. The DNS log collector is used to collect abnormal DNS access logs from host and container processes. When an attacker exploits various vulnerable services deployed on the server to echo information via DNS logs, the DNS log collector obtains the domain name requested by the attacker and sends it back to the management platform. When the DNS log collector detects DNS service connection activity, it determines that the domain name is abnormal and reports the abnormal domain name information to the management platform.

[0102] Optionally, the services containing vulnerabilities on the collection nodes are exposed to the outside world, and attackers can easily scan for service vulnerabilities. Since the collection nodes cannot access the external network and do not actively request DNS resolution, the DNSlog black sample information collected after vulnerability information is echoed through DNSlog is 100% the attacker's attack behavior.

[0103] Optionally, when a connection to a vulnerable service is detected, the domain name corresponding to the connection is identified as an abnormal domain name. This abnormal domain name is then sent to the management platform. The management platform obtains the abnormal domain names collected by the collection nodes and generates a blacklist based on these abnormal domain names. Real-time access logs of services collected by the business nodes are also obtained; these business nodes host normal services. If the domain name corresponding to the real-time access log matches a domain name in the blacklist, the access operation corresponding to the real-time access log is determined to be an abnormal attack operation. Optionally, the business nodes deploy various business services, which may contain various vulnerabilities that can be exploited by attackers and may be subject to attack behavior. After an attacker uses DNS log information to attack an application, the detection program uploads all collected DNS domain name resolution records to the management platform.

[0104] Optionally, unlike honeypot technology which deliberately creates security vulnerabilities to attract attackers, this method sets up completely isolated collection nodes, restricts outbound connections, and identifies any connection activity related to the Domain Name System (DNS) as an abnormal domain, recording it as black sample data and sending it to the management platform. Furthermore, the collection nodes in this method are completely isolated; they cannot access external networks or other node IPs. The deployed vulnerable service does not actively request to resolve any DNS domains, thus not affecting other normally functioning nodes. Moreover, honeypot technology attracts attackers, allowing for direct tracing and attribution of attracted attackers, without the need to collect black samples from DNS logs.

[0105] In the technical solution of this embodiment, when a connection to a service containing vulnerabilities is detected, the domain name corresponding to the connection is determined to be an abnormal domain name; the abnormal domain name is sent to the management platform, and by deploying various services containing vulnerabilities at the collection nodes, the detection of attack behavior is made more comprehensive.

[0106] Reference Figure 6 The present invention also provides a service attack detection device applied to a management platform, wherein the management platform is communicatively connected to a data collection node and a service node, the data collection node being unable to access external networks or other nodes, and the service attack detection device comprising:

[0107] The collection module 100 is used to obtain abnormal domain names collected by the collection node and generate a blacklist based on the abnormal domain names. The collection node has a service with vulnerabilities deployed on it, and the service with vulnerabilities does not actively request to resolve the domain name.

[0108] The acquisition module 200 is used to acquire real-time access logs of services collected by the business nodes, on which normal services are deployed.

[0109] The matching module 300 is used to determine that the access operation corresponding to the real-time access log is an abnormal attack operation if the domain name corresponding to the real-time access log matches the domain name in the blacklist.

[0110] Optionally, after the step of determining that the access operation corresponding to the real-time access log is an abnormal attack operation if the domain name corresponding to the real-time access log matches a domain name in the blacklist, the method further includes:

[0111] Determine the association information of the real-time access logs that match the domains in the blacklist, wherein the association information includes at least one of process, network, domain name, and Internet Protocol address;

[0112] Alarm information is generated based on the associated information.

[0113] Optionally, after the step of determining that the access operation corresponding to the real-time access log is an abnormal attack operation if the domain name corresponding to the real-time access log matches a domain name in the blacklist, the method further includes:

[0114] Determine the types of vulnerable services associated with the domains in the blacklist matched by the real-time access logs;

[0115] Based on the associated vulnerable service types, identify the vulnerabilities present in the services within the business nodes.

[0116] Optionally, before the step of determining that the access operation corresponding to the real-time access log is an abnormal attack operation if the domain name corresponding to the real-time access log matches a domain name in the blacklist, the method further includes:

[0117] Determine the matching priority of the domains in the blacklist;

[0118] Based on the priority, the domain name corresponding to the real-time access log is matched with the domain name in the blacklist.

[0119] Optionally, after the step of determining that the access operation corresponding to the real-time access log is an abnormal attack operation if the domain name corresponding to the real-time access log matches a domain name in the blacklist, the method further includes:

[0120] Determine the number of successful matches for the domains in the blacklist;

[0121] If the number of successful matches exceeds a preset threshold, the matching priority of the domains in the blacklist will be increased.

[0122] Optionally, after the step of determining that the access operation corresponding to the real-time access log is an abnormal attack operation if the domain name corresponding to the real-time access log matches a domain name in the blacklist, the method further includes:

[0123] Determine the number of times each vulnerable service was attacked;

[0124] If the number of attacks exceeds a preset threshold, the matching priority of the domain name corresponding to the vulnerable service in the blacklist will be increased.

[0125] Reference Figure 7 The present invention also provides a service attack detection device applied to a data collection node, wherein the data collection node cannot access external networks or other nodes, and a vulnerable service is deployed on the data collection node, wherein the vulnerable service does not actively request domain name resolution. The device includes:

[0126] The determination module 400 is used to determine that the domain name corresponding to the connection behavior is an abnormal domain name when a connection behavior containing a vulnerability is detected.

[0127] The sending module 500 is used to send the abnormal domain name to the management platform.

[0128] The present invention also provides a service attack detection device, which includes a memory, a processor, and a service attack detection program stored in the memory and executable on the processor. When the service attack detection program is executed by the processor, it implements the various steps of the service attack detection method described in the above embodiments.

[0129] The present invention also provides a computer-readable storage medium storing a service attack detection program, which, when executed by a processor, implements the various steps of the service attack detection method described in the above embodiments.

[0130] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0131] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, system, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, system, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, system, article, or apparatus that includes that element.

[0132] Through the above description of the embodiments, those skilled in the art can clearly understand that the systems described in the embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a computer-readable storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device (which may be a mobile phone, computer, parking management device, air conditioner, or network device, etc.) to execute the systems described in the various embodiments of the present invention.

[0133] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A method for detecting service attacks, characterized in that, The method is applied to a management platform, which is communicatively connected to both the data collection node and the service node. The service attack detection method includes: Obtain abnormal domain names collected by the collection node, and generate a blacklist based on the abnormal domain names. The collection node has a service with vulnerabilities deployed on it, and the service with vulnerabilities does not actively request to resolve the domain name. Obtain real-time access logs of services collected by business nodes, where normal services are deployed. If the domain name corresponding to the real-time access log matches the domain name in the blacklist, then the access operation corresponding to the real-time access log is determined to be an abnormal attack operation. Identify vulnerable services associated with domains in the blacklist that match the real-time access logs; Based on the types of vulnerabilities present in the associated vulnerable services, determine the types of vulnerabilities present in the services within the business node.

2. The service attack detection method as described in claim 1, characterized in that, After the step of determining that the access operation corresponding to the real-time access log is an abnormal attack operation if the domain name corresponding to the real-time access log matches the domain name in the blacklist, the method further includes: Determine the association information of the real-time access logs that match the domains in the blacklist, wherein the association information includes at least one of process, network, domain name, and Internet Protocol address; Alarm information is generated based on the associated information.

3. The service attack detection method as described in claim 1, characterized in that, Before the step of determining that the access operation corresponding to the real-time access log is an abnormal attack operation if the domain name corresponding to the real-time access log matches the domain name in the blacklist, the method further includes: Determine the matching priority of the domains in the blacklist; Based on the priority, the domain name corresponding to the real-time access log is matched with the domain name in the blacklist.

4. The service attack detection method as described in claim 3, characterized in that, After the step of determining that the access operation corresponding to the real-time access log is an abnormal attack operation if the domain name corresponding to the real-time access log matches the domain name in the blacklist, the method further includes: Determine the number of successful matches for the domains in the blacklist; If the number of successful matches exceeds a preset threshold, the matching priority of the domains in the blacklist will be increased.

5. The service attack detection method as described in claim 3, characterized in that, After the step of determining that the access operation corresponding to the real-time access log is an abnormal attack operation if the domain name corresponding to the real-time access log matches the domain name in the blacklist, the method further includes: Determine the number of times each vulnerable service was attacked; If the number of attacks exceeds a preset threshold, the matching priority of the domain name corresponding to the vulnerable service in the blacklist will be increased.

6. A method for detecting service attacks, characterized in that, The method, applied to a data collection node, wherein a vulnerable service is deployed on the node, the vulnerable service does not actively request domain name resolution, and the data collection node is communicatively connected to a management platform, includes: When a connection to a vulnerable service is detected, the domain name corresponding to the connection is determined to be an abnormal domain name. The abnormal domain name is sent to the management platform, which generates a blacklist based on the abnormal domain name. The management platform obtains real-time access logs of services collected by business nodes, on which normal services are deployed. If the domain name corresponding to the real-time access log matches a domain name in the blacklist, the management platform determines that the access operation corresponding to the real-time access log is an abnormal attack operation. The management platform identifies the vulnerable services associated with the domain names in the blacklist that match the real-time access log. Based on the types of vulnerabilities present in the associated vulnerable services, the management platform determines the types of vulnerabilities present in the services of the business nodes.

7. A service attack detection device, characterized in that, The service attack detection device is applied to a management platform, which is communicatively connected to both the data collection node and the service node. The data collection node cannot access external networks or other nodes. The data collection module is used to acquire abnormal domain names collected by the data collection node and generate a blacklist based on the abnormal domain names. The data collection node has a service with vulnerabilities deployed on it, and the service with vulnerabilities does not actively request to resolve the domain names. The acquisition module is used to acquire real-time access logs of services collected by business nodes, on which normal services are deployed. The matching module is used to determine that the access operation corresponding to the real-time access log is an abnormal attack operation if the domain name corresponding to the real-time access log matches the domain name in the blacklist; to determine the vulnerable service associated with the domain name in the blacklist that matches the real-time access log; and to determine the type of vulnerability in the service in the business node based on the type of vulnerability in the associated vulnerable service.

8. A service attack detection device, characterized in that, The service attack detection device includes a memory, a processor, and a service attack detection program stored in the memory and executable on the processor. When the service attack detection program is executed by the processor, it implements the various steps of the service attack detection method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a service attack detection program, which, when executed by a processor, implements the steps of the service attack detection method as described in any one of claims 1-6.

Images