Network anomaly detection methods, devices, equipment and storage media

Abstract

This invention relates to the field of communication technology and discloses a method, apparatus, device, and storage medium for network anomaly detection. The method includes: determining the probability value of an anomaly in the target network based on device attribute information corresponding to each node in the target network and network topology information of the target network; determining the anomaly value of the target network based on network traffic information of each node; and determining the detection result of the target network based on the probability value of the anomaly and the anomaly value. Through the above method, this invention enables real-time detection of whether anomalies occur in the target network, which can promptly detect whether anomalies occur in the target network and is beneficial to improving the security performance of the target network operation.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of communication technology, specifically to a network anomaly detection method, apparatus, device, and storage medium. Background Technology

[0002] With the continuous development of computer technology and its increasing application, the rapid detection of network security incidents has become a crucial issue for network technicians, and research on many network security technologies has matured significantly. Network security situational awareness, as a technique for network administrators to monitor and detect network security status, is also one of the current research hotspots in information security.

[0003] Existing network anomaly detection solutions involve connecting various network security devices to one or more SDN (Software-defined Networks) switches to form a security resource pool. A security controller issues security control commands to operate the SDN switches, directing network traffic to designated network security devices for security processing based on different user security needs. The security controller centrally manages the policies and monitors the status of the network security devices in real time. When a network security device malfunctions, the security controller issues security policy commands to promptly balance the load or migrate traffic, ensuring that normal network communication is not affected.

[0004] However, existing methods for network anomaly detection based on security policies cannot detect network anomalies in a timely manner due to the significant lag in security policies, which is detrimental to improving the security performance of network operations. Summary of the Invention

[0005] In view of the above problems, embodiments of the present invention provide a network anomaly detection method, apparatus, device and storage medium to solve the problem of the inability to detect network anomalies in a timely manner in the prior art.

[0006] According to one aspect of the present invention, a network anomaly detection method is provided, the method comprising:

[0007] Based on the device attribute information corresponding to each node in the target network and the network topology information of the target network, determine the impact probability value of the target network anomaly;

[0008] Based on the network traffic information of each node, the outliers of the target network are determined;

[0009] The detection result of the target network is determined based on the probability value of the impact of the target network anomaly and the anomaly value of the target network.

[0010] In one optional approach, determining the probability value of the impact of the target network anomaly based on the device attribute information corresponding to each node in the target network and the network topology information of the target network includes:

[0011] Obtain device attribute information corresponding to each node in the target network. Each device attribute information includes the device type, device security level, device installation program information, system operation information, and vulnerability information of the corresponding node.

[0012] Based on the device type, the device security level, the system operation information, the vulnerability information, and the network topology information, determine the attack probability value of each node;

[0013] Based on the device installation program information, the device security level, and the network topology information, determine the corresponding loss value of each node after being attacked;

[0014] Based on the attack probability value and the loss value corresponding to each node, the impact probability value of each node's anomaly is determined, and based on the impact probability value of each node's anomaly, the impact probability value of the target network's anomaly is determined.

[0015] In one optional approach, determining the attack probability value of each node based on the device type, the device security level, the system operation information, the vulnerability information, and the network topology information includes:

[0016] Based on the vulnerability list in the vulnerability information of each node, determine the total number of vulnerabilities and the maximum number of vulnerabilities of the same type for each node.

[0017] Determine the node type parameters according to the device type of each node;

[0018] Based on the system operation information of each node, determine the total number of ports and the number of open ports for each node;

[0019] Based on the network topology information, determine the node degree of each node in the target network;

[0020] The attack probability value of each node is determined based on the device security level, the total number of vulnerabilities, the number of vulnerabilities of the largest category, the type parameter, the total number of ports, the number of open ports, and the node degree corresponding to each node. The attack probability value of each node is positively correlated with the corresponding device security level, the type parameter, the total number of vulnerabilities, and the number of vulnerabilities of the largest category, respectively, and negatively correlated with the corresponding total number of ports, the number of open ports, and the node degree, respectively.

[0021] In one optional approach, determining the loss value of each node after being attacked based on the device installation program information, the device security level, and the network topology information includes:

[0022] For each corresponding node in the target network, the impact value of the corresponding node's installation program being attacked is determined based on the device installation program information of the corresponding node;

[0023] Based on the network topology information, determine each link starting from the corresponding node;

[0024] Based on the network topology information, determine the degree of each node in the link other than the corresponding node in the network topology, and the number of edges between each other node and the corresponding node;

[0025] The influence degree of each of the other nodes is determined based on the device security level, node degree, and number of edges of each of the other nodes; wherein, the influence degree of each of the other nodes is positively correlated with the device security level and node degree of the corresponding other node, and the influence degree of each of the other nodes is negatively correlated with the number of edges of the corresponding other node;

[0026] The influence of each link is determined based on the influence of each of the other nodes in each link;

[0027] Determine the maximum impact of each link of the corresponding node;

[0028] Based on the influence value and the maximum influence of the corresponding node, the loss value of the corresponding node after being attacked is determined; wherein, the loss value of the corresponding node after being attacked is positively correlated with both the influence value and the maximum influence of the corresponding node.

[0029] In one alternative approach, determining the outliers of the target network based on the network traffic information of each of the nodes includes:

[0030] Obtain network traffic information corresponding to each node; wherein, the network traffic information includes CPU utilization information, memory utilization information and traffic log information of the corresponding node;

[0031] Based on the CPU utilization information of each node, a first characterization value representing the fluctuation range of the CPU utilization within the preset time period is determined;

[0032] Based on the memory usage information of each node, a second characterization value is determined to represent the fluctuation range of the memory usage within the preset time period;

[0033] Based on the traffic log information, determine the source IP address, destination IP information, and total number of ports involved in the preset time period;

[0034] The preset time period will be divided into multiple time intervals. Based on the source IP address and destination IP address of the preset time period, the first time interval with the largest number of newly added source IP addresses and the second time interval with the largest number of newly added destination IP addresses will be determined in each of the time intervals.

[0035] Based on the traffic log information, determine the total downlink data volume corresponding to the first time interval, and divide the number of newly added IP addresses corresponding to the first time interval by the total downlink data volume to determine the first quotient.

[0036] Based on the traffic log information, determine the total amount of uplink data corresponding to the second time interval, and divide the number of newly added IP addresses corresponding to the second time interval by the total amount of uplink data to determine the second quotient.

[0037] The outlier value corresponding to each node is determined based on the first representation value, second representation value, first quotient value, second quotient value, and the total number of ports involved for each node; wherein, the outlier value corresponding to each node is positively correlated with the corresponding first representation value, second representation value, first quotient value, and second quotient value, and the outlier value corresponding to each node is negatively correlated with the corresponding total number of ports involved.

[0038] The outliers of the target network are determined based on the outliers of each node.

[0039] In one alternative approach, determining a first characterizing value representing the fluctuation range of the CPU utilization rate within the preset time period, based on the CPU utilization rate, includes:

[0040] Based on the maximum, average, and minimum CPU utilization values ​​within the preset time period, calculate a first difference between the maximum and average CPU utilization values ​​within the preset time period, and calculate a second difference between the average and minimum CPU utilization values ​​within the preset time period. Then, based on the sum of squares of the first and second differences, determine a first characterizing value representing the fluctuation range of the CPU utilization value within the preset time period; and / or,

[0041] The step of determining a second characterizing value representing the fluctuation range of the memory usage rate within the preset time period based on the memory usage rate includes:

[0042] Based on the maximum, average, and minimum values ​​of memory usage within the preset time period, a third difference between the maximum and average values ​​of memory usage within the preset time period is calculated, and a fourth difference between the average and minimum values ​​of memory usage within the preset time period is calculated. Based on the sum of squares of the third and fourth differences, a second characterization value representing the fluctuation range of memory usage within the preset time period is determined.

[0043] In one optional approach, determining the detection result of the target network based on the probability value of the target network anomaly and the anomaly value of the target network includes:

[0044] A detection value is determined based on the probability value of the target network anomaly and the anomaly value of the target network; wherein the detection value is positively correlated with both the probability value of the target network anomaly and the anomaly value of the target network.

[0045] Determine whether the detected value meets the preset conditions; if so, determine that the target network anomaly has been detected.

[0046] According to another aspect of the present invention, a network anomaly detection device is provided, comprising:

[0047] The impact probability value determination module is used to determine the impact probability value of the target network anomaly based on the device attribute information corresponding to each node in the target network and the network topology information of the target network.

[0048] An outlier determination module is used to determine outliers in the target network based on the network traffic information of each node.

[0049] The detection determination module is used to determine the detection result of the target network based on the probability value of the impact of the target network anomaly and the anomaly value of the target network.

[0050] According to another aspect of the present invention, a network anomaly detection device is provided, comprising: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other through the communication bus;

[0051] The memory is used to store at least one executable instruction that causes the processor to execute the network anomaly detection method as described in any of the above.

[0052] According to another aspect of the present invention, a computer-readable storage medium is provided, the storage medium storing at least one executable instruction, which, when executed on a network anomaly detection device, causes the network anomaly detection device to perform the operation of any of the above-described network anomaly detection methods.

[0053] The network anomaly detection method provided in this invention determines the probability value and anomaly value of an anomaly in the target network based on the device attribute information, network traffic information, and network topology information of each node in the target network. Then, based on these probability values ​​and anomaly values, the detection result of the target network is determined. This method detects network anomalies solely based on the device attribute information, network topology information, and the device attribute information of each node. It has a low detection dimension and low information resource requirements, which helps improve the analysis speed of network anomalies. It enables real-time network detection, allowing for timely detection of network anomalies and improving network security.

[0054] The above description is merely an overview of the technical solutions of the embodiments of the present invention. In order to better understand the technical means of the embodiments of the present invention and to implement them in accordance with the contents of the specification, and to make the above and other objects, features and advantages of the embodiments of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0055] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0056] Figure 1 A flowchart illustrating the network anomaly detection method provided in an embodiment of the present invention is shown;

[0057] Figure 2 A schematic diagram of the network topology provided in an embodiment of the present invention is shown;

[0058] Figure 3 This invention illustrates a flowchart of determining the impact probability value of a target network anomaly in a network anomaly detection method provided by an embodiment of the present invention;

[0059] Figure 4 This diagram illustrates the process of determining the attack probability value of each node in the network anomaly detection method provided in this embodiment of the invention.

[0060] Figure 5 This paper illustrates a flowchart of the network anomaly detection method provided in this embodiment of the invention for determining the loss value corresponding to each node after being attacked.

[0061] Figure 6 This diagram illustrates the flowchart for determining the outlier value of the target network in the network anomaly detection method provided in this embodiment of the invention.

[0062] Figure 7 A schematic diagram of the process for determining the target network in a network anomaly detection method provided in another embodiment of the present invention is shown;

[0063] Figure 8 A schematic diagram of the network anomaly detection device provided in an embodiment of the present invention is shown;

[0064] Figure 9 A schematic diagram of the network anomaly detection device provided in an embodiment of the present invention is shown. Detailed Implementation

[0065] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be limited to the embodiments set forth herein.

[0066] Figure 1A flowchart of a network anomaly detection method provided in an embodiment of the present invention is shown. This method is executed by a network anomaly detection device. The network anomaly detection device can be a terminal, a computer, or a similar computing device. Taking the network anomaly detection device as a terminal as an example, it can include one or more processors (the processor may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory for storing data (such as high-speed random access memory, non-volatile memory, one or more magnetic storage devices, flash memory, and / or other non-volatile solid-state memory). Further, the anomaly network detection device may also include transmission devices for communication functions (such as radio frequency modules or network adapters) and input / output devices. The memory of the network detection device can be used to store computer programs, such as application software programs and modules, such as the computer program corresponding to the network traffic anomaly detection method in this embodiment of the present invention. The processor of the network anomaly detection device executes various functional applications and data processing by running the computer program stored in the memory, thereby implementing the network anomaly detection method provided in this embodiment of the present invention. In some instances, the memory in the network anomaly detection device may further include remote memories remotely located relative to its processor, and these remote memories can be connected to the network anomaly detection device via a network. Figure 1 As shown, the method includes the following steps:

[0067] Step 02: Determine the probability value of the impact of the target network anomaly based on the device attribute information corresponding to each node in the target network and the network topology information of the target network.

[0068] The target network refers to the network that needs to be detected for anomalies. Examples of target networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. Figure 2 This diagram illustrates the topology of a target network according to an embodiment of the present invention. The target network includes multiple nodes, each of which is a node device. In some embodiments, such as... Figure 2 As shown, the node devices include terminals, servers, switches, and gateways. The device attribute information refers to the attribute information of each node device in the target network, that is, the resource situation corresponding to each node in the target network. The resource situation describes the security data of the corresponding node device. After the node device is deployed in the target network, its corresponding device attribute information is determined. In some embodiments, the device attribute information of each node includes the device type, device security level, programs installed on the device, system operation information, and vulnerability information of the corresponding node device.

[0069] The device type of each of the aforementioned nodes is used to describe the purpose of the device. Therefore, in situations such as... Figure 2 In the target network, the device types corresponding to each node include terminals, servers, switches, and gateways, and the device type of each node is determined when the corresponding node device is deployed.

[0070] The device security level of each node describes the security positioning of the corresponding node device itself and is information determined at the time of device deployment. For node devices storing confidential data, their corresponding device security level is higher, while for node devices located on the public network, which are only used for relaying ordinary data, their corresponding device security level is lower. The device security level of each node is determined according to its purpose in the target network. When a node device is deployed in the target network, its purpose is determined, and therefore its corresponding device security level is also determined. If the purpose of a node device changes subsequently, its corresponding device security level can be modified.

[0071] The device installation program for each node contains all programs currently installed on the corresponding node device. This information can be obtained by reading data from the operating system of the corresponding node device.

[0072] The vulnerability information for each node describes the vulnerabilities in the operating system or other software of the corresponding node device. This information can be obtained through web scraping. The vulnerability information includes a vulnerability list, which lists port vulnerabilities caused by the current operating system or hardware configuration of the corresponding node device. These vulnerabilities objectively exist on the node device and are unrelated to whether they have been attacked. The vulnerability list can be obtained from officially released vulnerability information such as the operating system of the corresponding node device, and represents the known attributes of the corresponding node device. The vulnerability list specifies the vulnerability type (e.g., DDoS attack) and the corresponding port number.

[0073] The system operation information for each node describes the current operating status of the corresponding node device. In some embodiments, the system operation information includes port information of the node device, such as the number of ports and the status of each port. The status of each port includes open and closed states. For current hardware information, the current status of each port is defined as follows: if a port is currently open, its current status is 1; if a port is currently closed, its current status is 0. For hardware information within a preset time period, the status of each port within that time period is defined as follows: if a port has ever been defined as 1 within the preset time period, its status is 1. In other words, for any port, if it has been open within the preset time period, its status within that time period is 1. In some embodiments, the system operation information also includes the number of services and service types of the corresponding node device.

[0074] The network topology diagram of the target network refers to the connection relationships between the nodes in the target network, i.e., the network topology diagram. Each node in the target network corresponds to a point in the network topology diagram. If two nodes in the network can communicate with each other, then there is an edge between the corresponding two points in the network topology diagram, specifically as follows: Figure 2 As shown.

[0075] The impact probability value of the target network anomaly refers to the consequences of the target network becoming abnormal due to an attack, determined based on the device attribute information of each node device and the topology of the target network. In other words, the higher the impact probability value of the target network anomaly, the more severe the consequences of the target network becoming abnormal due to an attack.

[0076] After the topology of the target network is determined, the abnormal values ​​of each node device after being attacked can be determined based on the device attribute information corresponding to each node. For example, based on the device attribute information of each node and the position and purpose of each node in the network topology of the target network, the degree of impact caused by the abnormal attack of each node device can be determined, thereby determining the probability value of the impact corresponding to the abnormal attack on the target network.

[0077] Step 04: Determine the outliers of the target network based on the network traffic information of each node.

[0078] The network traffic information refers to information describing the status of corresponding nodes in the target network, i.e., the network traffic information of each node is the traffic situation of each node. In some embodiments, the network traffic information includes CPU utilization information and memory utilization information of each node device, as well as traffic information corresponding to each node, such as traffic logs. The traffic logs include relevant information about each data packet received or sent within a preset time period, such as the transmission direction of the data packet, the service port involved in the transmission process, downlink data and its corresponding source IP address, uplink data and its corresponding destination IP address, etc. The transmission direction of the data packet includes uplink transmission and downlink transmission, i.e., the data transmitted between nodes in the target network includes uplink data and downlink data. In some embodiments, the network traffic information further includes network information and attack information. The network information is used to describe the network status of the corresponding node device, such as packet loss rate, maximum number of connections at the same time, traffic situation, etc. The attack information is used to describe the situation of the corresponding node device being attacked, and the attack information can be obtained from the logs of security software such as firewalls on the corresponding node device. For example, the attacker's IP address, attack type, attack time, attack behavior, and vulnerabilities involved in the attack.

[0079] Based on the network traffic information of each node in the target network, anomaly detection indicators for the target network can be determined. For example, regarding CPU utilization, if abnormal fluctuations in CPU utilization occur within a preset time period, it indicates that the corresponding node may be experiencing anomalies, and thus, CPU utilization is considered an anomaly detection indicator. The anomaly detection indicators for the target network can be determined based on the anomaly evaluation algorithm employed. Again, using CPU utilization as an example of anomaly detection indicators, the greater the fluctuation range of CPU utilization, the greater the potential for anomalies in the corresponding node. Therefore, based on the network traffic information of each node, the anomaly value of the target network is determined. The anomaly value of the target network is an assessment of the degree of anomaly in the target network based on the network traffic information of each node.

[0080] Step 06: Determine the detection result of the target network based on the probability value of the target network anomaly and the anomaly value of the target network.

[0081] The detection result of the target network refers to whether an anomaly is detected in the target network. It should be noted that "whether an anomaly exists" here refers to whether there is an anomaly that requires the attention of the user or host computer. If an anomaly is found, a corresponding warning message needs to be issued to the user or host computer to prompt them to take appropriate security measures for the abnormal target network. The detection result is determined by a detection value jointly determined by the probability value of the target network's anomaly and the anomaly value. If the probability value of the target network's anomaly is relatively large, but the anomaly value of the target network is very small, such that the detection value does not meet the set conditions, it indicates that the target network currently does not have an anomaly. An anomaly is only detected when the target value meets the set conditions.

[0082] As can be seen from the above, the network anomaly detection method provided in this embodiment of the invention determines the probability value and anomaly value of the target network anomaly based on the device attribute information, network traffic information, and network topology information of each node in the target network, and determines the detection result of the target network based on the probability value and anomaly value of the target network anomaly. This network anomaly detection method detects network anomalies only based on the device attribute information, network topology information, and device attribute information of each node. It has a low detection dimension and low information resource requirements, which is beneficial for improving the analysis speed of network anomaly conditions. Furthermore, the device attribute information, network topology information, and device attribute information can be acquired in real time. Therefore, the network anomaly detection method can achieve real-time detection of the target network, promptly detecting whether the target network has anomalies, thus improving the security performance of network operation.

[0083] Figure 3 A flowchart illustrating the determination of the impact probability value of a target network anomaly in a network anomaly detection method provided by an embodiment of the present invention is shown. Figure 3 As shown, in this embodiment, step 02: determining the outlier values ​​of the target network based on the network traffic information of each node, further includes, but is not limited to, steps 021, 022, 023, and 024, as described in detail below:

[0084] Step 021: Obtain the device attribute information corresponding to each node in the target network. The device attribute information includes the device type, device security level, device installation program information, system operation information, and vulnerability information of the corresponding node.

[0085] The content and acquisition method of the device attribute information can be referred to in step 02 above, and will not be repeated here. The device type, device security level, device installation program information, system operation information, and vulnerability information in the device attribute information can all be acquired and stored for later use before executing steps 022 and 023, or the corresponding information can be acquired before a certain device attribute information is needed.

[0086] Step 022: Determine the attack probability value of each node based on the device type, the device security level, the system operation information, the vulnerability information, and the network topology information.

[0087] The attack probability value of each node is analyzed based on its own device attribute information, representing the likelihood of the node being attacked. In other words, the attack probability value of each node reflects its own stability. The weaker the node's stability, the higher its attack probability value. Therefore, based on the stability-related indicators in the device attribute information of each node, the stability of the corresponding node, i.e., the attack probability of the corresponding node, can be determined. Nodes of different device types have different importance in the target network; the more important the node, the greater its likelihood of being attacked, i.e., the worse its stability. Furthermore, the higher the device security level of a node, the greater its significance in being attacked, i.e., the greater its likelihood of being attacked. In addition, the more vulnerabilities a node has on each port, the weaker its stability and the more susceptible it is to attack. Simultaneously, the lower the node degree of each node in the network topology of the target network, the lower its corresponding stability. Therefore, in this embodiment, the device type, device security level, system operation information, vulnerability information, and network topology information of each node are determined as the stability-related indicators, and the attack probability value of each node is determined based on each stability-related indicator.

[0088] Step 023: Based on the device installation program information, the device security level, and the network topology information, determine the corresponding loss value of each node after being attacked.

[0089] Determining the probability of an anomalous node is influenced by two factors. First, the node's inherent stability, specifically the attack probability determined in step 022. For example, a node with few vulnerabilities and strong security measures like firewalls is less likely to be attacked, resulting in a lower attack probability. Second, the potential loss from an attack. Attackers tend to target higher-value nodes first. If a node is of low value and an attack would have minimal consequences (lower loss), it is less likely to become a target, thus lowering its attack probability. Therefore, this embodiment also determines the potential loss of each node after an attack before determining the probability of network anomalies.

[0090] For each node, the loss value after an attack is related to its corresponding device installation program, as well as the device's security level and its position in the network topology. Therefore, the loss value of each node after an attack can be determined based on the device installation program information, the device security level, and the network topology information. Different device installation programs result in different loss values ​​after an attack. Therefore, the impact value of an attack on different nodes can be determined based on different device installation programs, and the impact value of a node is related to its corresponding loss value.

[0091] Step 024: Determine the impact probability value of each node's anomaly based on the attack probability value and the loss value corresponding to each node, and determine the impact probability value of the target network's anomaly based on the impact probability value of each node's anomaly.

[0092] The impact probability value of the target network anomaly describes the consequences of an attack on a node based on the node's own situation. In this embodiment, the impact probability value of the target network anomaly is calculated and determined based on the attack probability value of each node and the corresponding loss value after the attack. The impact probability value of each node anomaly is positively correlated with the corresponding node's attack probability value and the loss value after the attack. Determining the impact probability value of the target network anomaly based on the impact probability values ​​of each node anomaly is equivalent to determining the impact probability value of the target network anomaly based on the sum of the impact probability values ​​of each anomaly. The larger the sum of the impact probability values ​​of each anomaly, the larger the impact probability value of the target network anomaly.

[0093] In some embodiments, the probability value of the impact of the target network anomaly is represented by P1, and the probability value of the node i in the target network being attacked is represented by P1. i (1) The loss value after the attack on node i is represented as P1. i(2) The probability value of the impact of node i being abnormal is: P1 i (1)*P1 i (2), and the sum of the probability values ​​of the abnormal influence of each node in the target network is the probability value of the abnormal influence of the target network, which is expressed as P1. Its calculation formula (1) is as follows:

[0094] P1=∑ i P1 i (1)*P1 i (twenty one)

[0095] During the research process, the inventors of this application discovered that whether a node is abnormal is affected by two factors. First, the node's stability, i.e., its susceptibility to attack. If a node has few vulnerabilities and strong security measures such as firewalls, its susceptibility to security attacks is low. Second, the loss value of a node being attacked. Attackers will first target nodes with higher value. If a node is of low value and an attack would have little consequence, it will not become a target, thus reducing its attack probability. Based on this, when determining the impact probability value P1 of the target network anomaly, this application can use the attack probability value P1 of each node as a reference. i (1) and the loss value P1 after being attacked i (2) Obtain the attack probability value P1 of each node. i (1) and the loss value P1 after being attacked i (2) It can also be determined based on the device attribute information of each node and the network topology of the target network. Therefore, the impact probability value of the target network anomaly can be analyzed based solely on the device attribute information of each node and the corresponding network topology information, which can be used as a parameter of the check value. The information resource requirements for determining this parameter are low, and the complexity of the determination process is also low, which is conducive to quickly analyzing the impact probability value of network anomalies.

[0096] Figure 4 This diagram illustrates a flowchart of the network anomaly detection method provided in this embodiment of the invention for determining the attack probability value of each node. Figure 4 As shown, step 022: Based on the device type, the device security level, the system operation information, the vulnerability information, and the network topology information, determine the attack probability value of each node, further including steps 0221, 0222, and 0223. In this embodiment, the attack probability value of each node is represented as P1. i (1), where i is the identifier of the node in the target network.

[0097] Step 0221: Based on the vulnerability list in the vulnerability information of each node, determine the total number of vulnerabilities and the maximum number of vulnerabilities of the same type for each node.

[0098] Based on the vulnerability list in the vulnerability information of each node, the number of different types of vulnerabilities corresponding to each node can be determined, i.e., the total number of vulnerabilities. For example, the total number of vulnerabilities for node i is expressed as follows: Furthermore, based on the vulnerability list, the number of vulnerabilities corresponding to each vulnerability category can be determined, thereby determining the maximum number of vulnerabilities in the maximum category. For example, the maximum number of vulnerabilities in the maximum category for node i is represented as follows: The maximum number of vulnerabilities of the same category is the largest number of vulnerabilities of the same category among the vulnerabilities corresponding to each node. For example, if node i has three vulnerability categories A, B, and C, and the number of vulnerabilities of category A is 2, the number of vulnerabilities of category B is 4, and the number of vulnerabilities of category C is 5, then the maximum number of vulnerabilities of the same category corresponding to node i is... The value is 5. The vulnerability list specifies the vulnerability type (e.g., DDoS attack) and the corresponding port number. It's possible for the same vulnerability type to correspond to multiple ports, or vice versa. Therefore, This represents the total number of records in the vulnerability list. This represents the maximum number of ports corresponding to the same vulnerability type.

[0099] Step 0222: Determine the node type parameters according to the device type of each node.

[0100] Different device types correspond to different type parameters. Based on the device type of each node and the mapping relationship between the device type and the type parameter, the type parameter corresponding to each node can be determined. For example, the type parameter corresponding to node i is represented as W. i The mapping relationship between the device type and the type parameter is pre-set. For example, the type parameter is 2 for a device type of terminal, and the type parameter is 4 for a device type of server, etc.

[0101] Step 0223: Determine the attack probability value of each node based on the device security level, the total number of vulnerabilities, the number of vulnerabilities of the largest category, the type parameter, the total number of ports and the number of open ports in the node's system operation information, and the node degree in the target network structure information. Specifically, the attack probability value of each node is positively correlated with the corresponding device security level, the type parameter, the total number of vulnerabilities, and the number of vulnerabilities of the largest category, respectively; and negatively correlated with the corresponding total number of ports, the number of open ports, and the node degree, respectively.

[0102] The system operation information for each node includes port information corresponding to that node, wherein the port information includes the total number of ports and the number of open ports. The total number of ports corresponding to node i is represented as follows: The number of open state ports corresponding to node i is represented as Furthermore, in the embodiment, the device security level corresponding to node i is represented as I. i The network topology information includes the degree of each node in the network topology, such as the degree of node i being represented as D. i The degree of each node refers to the number of edges associated with that node, also known as the degree of association.

[0103] In some embodiments, the formula (2) for calculating the attack probability value corresponding to node i is as follows:

[0104]

[0105] Figure 5 This diagram illustrates a flowchart of the network anomaly detection method provided in this embodiment of the invention, showing the process of determining the loss value corresponding to each node after it has been attacked. Figure 5 As shown, step 023: Based on the device installation program information, the device security level, and the network topology information, determine the loss value corresponding to each node after being attacked, further including steps 0231, 0232, 0233, 0234, and 0235.

[0106] Step 0231: For each corresponding node in the target network, determine the impact value of the corresponding node's installation program after it has been attacked, based on the device installation program information of the corresponding node.

[0107] For each node i in the target network, its corresponding influence value is represented as A. i Impact value A i This can be obtained by summing the impact values ​​of each installed program for node ID. The impact value of each program can be preset by the user, based on the content of the programs installed on node i and the data involved. This leads to the influence value A. i The mapping relationship between the device installation program information of node i and node i is known. After obtaining the device installation program information of node i, the impact value A after the installation program of node i is attacked can be determined based on this known mapping relationship. i .

[0108] Step 0232: Based on the network topology information, determine each link starting from the corresponding node, and determine the node degree of each other node in the network topology, excluding the corresponding node, and the number of edges between each other node and the corresponding node.

[0109] Wherein, if node i is an endpoint in the target network, then the link corresponding to node i is all the links with node i as one endpoint. Figure 2 Taking the network topology shown as an example, if node i is terminal B, then there are 3 links corresponding to node i: terminal B-server-switch-terminal A; terminal B-server-gateway-terminal D; and terminal B-server-gateway-terminal C.

[0110] If node i is not an endpoint, then the link corresponding to node i is a link from node i to all endpoints, which has 4 links: server-switch-terminal A; server-terminal B; server-gateway-terminal D; server-gateway-terminal C.

[0111] For link j corresponding to node i, denote any node on link j that does not include node i as node u, and denote I... iu This represents the device security level of node u on link j. Based on the network topology information, the node degree of node u on link j can be represented as D. u And determine the number F of edges between node u and node i on link j. ju .

[0112] Step 0233: Determine the influence degree of each of the other nodes based on their device security level, node degree, and number of edges. The influence degree of each other node is positively correlated with its device security level and node degree, and negatively correlated with its number of edges.

[0113] Optionally, in some embodiments, the influence degree of other nodes, such as node u, is represented as...

[0114] Step 0234: Determine the influence of each link based on the influence of each of the other nodes in each link.

[0115] In some embodiments, the influence of each link can be determined based on the sum of the influence of all other nodes. For example, the influence B of link j for node i. ij The calculation formula (3) is as follows:

[0116]

[0117] Where j is the link identifier, and u is the node identifier on link j, including node i.

[0118] Step 0235: Determine the loss value of the corresponding node after being attacked based on the influence value of the corresponding node and the maximum influence value of each link of the corresponding node; wherein, the loss value of the corresponding node after being attacked is positively correlated with both the influence value and the maximum influence value of the corresponding node.

[0119] In some embodiments, the loss value P1 corresponding to node i after being attacked i The calculation formula (4) for (2) is as follows:

[0120]

[0121] Figure 6 This diagram illustrates a flowchart of the network anomaly detection method provided in this embodiment of the invention for determining anomaly values ​​in the target network. Figure 6 As shown, step 04: determining the outlier value of the target network based on the network traffic information of each node further includes steps 041, 042, 043, 044, 045, 046, 047, 048 and 049.

[0122] Step 041: Obtain network traffic information corresponding to each node; wherein, the network traffic information includes CPU utilization information, memory utilization information and traffic log information of the corresponding node.

[0123] The content and method of obtaining the network traffic information corresponding to the nodes have been clearly explained in the description of step 04 above, and will not be repeated here. In this embodiment, the network traffic information includes CPU utilization information, memory utilization information, and traffic log information of each node. The traffic log includes relevant information of each data packet received or sent within a preset time period, such as data packet identifier, data direction (downlink or uplink), service port involved, source IP address (only for downlink data, no such indicator for uplink data), and destination IP address (only for uplink data, no such indicator for downlink data). It should be noted that the step of obtaining the network traffic information corresponding to each node can be executed simultaneously with step 021, or sequentially. Unless otherwise specified, the order of the steps provided in the various embodiments of this application is not limited.

[0124] Step 042: Based on the CPU utilization information of each node, determine a first characterization value that represents the fluctuation range of the CPU utilization within the preset time period.

[0125] The greater the fluctuation range of the CPU utilization rate within the preset time period, the larger the first characteristic value. In some embodiments, the first characteristic value is determined by: determining the maximum, average, and minimum values ​​of the CPU utilization rate within the preset time period based on the CPU utilization rate information of each node. For example, the maximum value of the CPU utilization rate of node i within the preset time period is represented as: The average value is expressed as The minimum value is expressed as The maximum CPU utilization of node i within the preset time period. average value and minimum value Calculate a first difference between the maximum and average values ​​of the CPU utilization rate within the preset time period, and calculate a second difference between the minimum and average values ​​of the CPU utilization rate within the preset time period. Based on the sum of squares of the first difference and the sum of squares of the second difference, determine a first characterization value representing the fluctuation range of the CPU utilization rate within the preset time period.

[0126] The first difference is: The first difference is: In some embodiments, the calculation formula (5) for the first characterization value Ti1 corresponding to node i is as follows:

[0127]

[0128] Step 043: Based on the memory usage information of each node, determine a second characterization value that represents the fluctuation range of the memory usage within the preset time period.

[0129] The greater the fluctuation range of the memory usage rate within the preset time period, the larger the second characteristic value. In some embodiments, the second characteristic value is determined as follows: based on the memory usage rate information of each node, the maximum, average, and minimum values ​​of the memory usage rate within the preset time period are determined. For example, the maximum value of the memory usage rate of node i within the preset time period is represented as... The average value is expressed as The minimum value is expressed as The maximum value of the memory usage of node i within the preset time period. average value and minimum value Calculate the third difference between the maximum and average values ​​of the memory usage rate within the preset time period, and calculate the fourth difference between the minimum and average values ​​of the memory usage rate within the preset time period. Based on the sum of squares of the third and fourth differences, determine a second characterization value representing the fluctuation range of the memory usage rate within the preset time period.

[0130] The first difference is: The first difference is: In some embodiments, the formula (6) for calculating the second characterization value Ti2 corresponding to node i is as follows:

[0131]

[0132] Step 044: Based on the traffic log information, determine the source IP address, destination IP information, and total number of service ports corresponding to the preset time period.

[0133] In this embodiment, the total number of service ports corresponding to node i is represented as Port.

[0134] Step 045: Divide the preset time period into multiple time intervals. Based on the source IP address and destination IP address of the preset time period, determine the first time interval with the largest number of newly added source IP addresses and the second time interval with the largest number of newly added destination IP addresses in each time interval.

[0135] The first time interval is the time interval with the most newly added source IP addresses, and the second time interval is the time interval with the most newly added destination IP addresses.

[0136] Step 046: Based on the traffic log information, determine the total downlink data volume corresponding to the first time interval, and divide the number of newly added IP addresses corresponding to the first time interval by the total downlink data volume to determine the first quotient.

[0137] Taking node i as an example, the number of newly added source IP addresses in its first time interval is That is, the maximum number of newly added source IP addresses. After determining the first time interval, the total amount of downlink data within the first time interval can be determined based on the traffic log information. The total amount of downlink data corresponding to node i within the first time interval can be represented as Di1, and the calculation formula (7) for the first quotient Si1 corresponding to node i is as follows:

[0138]

[0139] Step 047: Based on the traffic log information, determine the total amount of uplink data corresponding to the second time interval, and divide the number of newly added IP addresses corresponding to the second time interval by the total amount of uplink data to determine the second quotient.

[0140] Taking node i as an example, the number of newly added destination IP addresses in the second time interval is That is, the maximum number of newly added destination IP addresses. After determining the second time interval, the total amount of downlink data within the second time interval can be determined based on the traffic log information. The total amount of downlink data corresponding to node i within the second time interval can be represented as Di2, and the calculation formula (8) for the second quotient Si2 corresponding to node i is as follows:

[0141]

[0142] Step 048: Determine the outlier value corresponding to each node based on the first representation value, second representation value, first quotient value, second quotient value, and the total number of service ports corresponding to each node; wherein, the outlier value corresponding to each node is positively correlated with the corresponding first representation value, second representation value, first quotient value, and second quotient value, and the outlier value corresponding to each node is negatively correlated with the corresponding total number of service ports.

[0143] In this embodiment, the outlier value E corresponding to node i i The calculation formula (9) is as follows:

[0144]

[0145] Step 049: Determine the outliers of the target network based on the outliers of each node.

[0146] Optionally, the outlier of the target network can be determined based on the sum of the outliers of each node. Specifically, the formula (10) for determining the outlier E of the target network is as follows:

[0147] E = ∑ i E i (10)

[0148] Figure 7 This diagram illustrates the process of determining the target network in a network anomaly detection method according to another embodiment of the present invention, as shown below. Figure 7 As shown, in this embodiment, step 06: determining the detection result of the target network based on the impact probability value of the target network anomaly and the anomaly value of the target network, further includes steps 061 and 062, as follows:

[0149] Step 061: Determine the detection value based on the probability value of the target network anomaly and the anomaly value of the target network. The detection value is positively correlated with both the probability value of the target network anomaly and the anomaly value of the target network.

[0150] In this embodiment, the detection value is denoted as M, and the calculation formula (11) for the detection value M is as follows:

[0151] M = E * P1 (11)

[0152] That is, in this embodiment, the detection value is proportional to both the probability value P1 of the target network anomaly and the anomaly value E of the target network.

[0153] Step 062: Determine whether the detected value meets the preset conditions. If so, it is determined that the target network is abnormal.

[0154] Determining whether the detection value M meets the preset conditions includes determining whether the detection value M is greater than or equal to a set threshold. If the detection value M is greater than or equal to the set threshold, the determined detection result is: the target network is currently abnormal. Otherwise, it indicates that the target network is currently normal.

[0155] In some embodiments, the target network detection method provided in this application further includes issuing an early warning when an anomaly is detected in the target network, so as to prompt the user or a host computer that can control the network detection device to perform corresponding protective measures on the target network. The preset threshold is an empirical value set by the user and can be obtained through testing with sample data. Furthermore, the early warning method includes displaying the detection result of the target network anomaly on a display screen or sending a message or making a phone call to relevant personnel.

[0156] In summary, the embodiments of this application provide a network anomaly detection method that detects anomalies in the target network by analyzing the device attribute information, network traffic information, and topology of each node in the network. This method has low detection dimensionality, low resource requirements, and effectively improves analysis speed. It can achieve real-time detection of the target network, thereby promptly detecting anomalies in the target network and improving the security performance of the target network.

[0157] In some embodiments, this application also provides a network anomaly detection device. Figure 8The schematic diagram of the abnormal network detection device provided in this application shows that the network anomaly detection device 800 includes: an impact probability value determination module 801, an anomaly value determination module 802, and a detection determination module 803. The impact probability value determination module 801 is used to determine the impact probability value of the target network anomaly based on the device attribute information corresponding to each node in the target network and the network topology information of the target network. The anomaly value determination module 802 is used to determine the anomaly value of the target network based on the network traffic information of each node. The detection determination module 803 is used to determine the detection result of the target network based on the impact probability value of the target network anomaly and the anomaly value of the target network.

[0158] In one optional embodiment, the impact probability determination module 801 includes a first acquisition module, an attack probability determination module, a loss determination module, and an impact probability determination module. The first acquisition module acquires device attribute information corresponding to each node in the target network. Each device attribute information includes the corresponding node's device type, device security level, device installation program information, system operation information, and vulnerability information. The attack probability determination module determines the attack probability value of each node based on the device type, device security level, system operation information, vulnerability information, and network topology information. The loss determination module determines the loss value of each node after being attacked based on the device installation program information, device security level, and network topology information. The impact probability determination module determines the impact probability value of each node's anomaly based on the attack probability value and the loss value, and determines the impact probability value of the target network's anomaly based on the impact probability values ​​of each node's anomaly.

[0159] In one optional embodiment, the attack probability determination module includes a vulnerability count determination module, a type parameter determination module, and an attack probability calculation module. The vulnerability count determination module is used to determine the total number of vulnerabilities and the maximum number of vulnerabilities of the same category for each node based on the vulnerability list in the vulnerability information of each node. The parameter type determination module is used to determine the node type parameter for each node based on the device type of each node. The attack probability calculation module is used to determine the attack probability value of each node based on the device security level, the total number of vulnerabilities, the maximum number of vulnerabilities of the same category, the type parameter, the total number of ports and the number of open ports in the system operation information of the node, and the node degree in the target network structure information. The attack probability value of each node is positively correlated with the corresponding device security level, the type parameter, the total number of vulnerabilities, and the maximum number of vulnerabilities of the same category, respectively, and negatively correlated with the corresponding total number of ports, the number of open ports, and the node degree, respectively.

[0160] In an optional embodiment, the loss value determination module further includes an impact value determination module, a link determination module, a node impact degree determination module, a link impact degree determination module, and a loss calculation module. The impact value determination module is used to determine, for each corresponding node in the target network, the impact value of the corresponding node's installation program after an attack, based on the device installation program information of the corresponding node. The link determination module is used to determine each link starting from the corresponding node based on the network topology information, and to determine the node degree of each other node in each link within the network topology, as well as the number of edges between each other node and the corresponding node. The node impact degree determination module is used to determine the impact degree of each other node based on the device security level, node degree, and number of edges of each other node. The impact degree of each other node is positively correlated with the device security level and node degree of the corresponding other node, and negatively correlated with the number of edges of the corresponding other node. The link impact degree determination module is used to determine the impact degree of each link based on the impact degree of each other node in each link. The loss calculation module is used to determine the loss value of the corresponding node after being attacked based on the influence value of the corresponding node and the maximum influence of each link of the corresponding node; wherein the loss value of the corresponding node after being attacked is positively correlated with both the influence value and the maximum influence of the corresponding node.

[0161] In an optional embodiment, the outlier determination module 802 further includes a second acquisition module, a first characterization value determination module, a second characterization value determination module, an address and port determination module, a maximum new address determination module, a first quotient value determination module, a second quotient value determination module, a node outlier determination module, and a network outlier determination module. Specifically, it acquires network traffic information corresponding to each node; the second acquisition module is used to acquire network traffic information corresponding to each node. The network traffic information includes CPU utilization information, memory utilization information, and traffic log information of the corresponding node. The first characterization value determination module is used to determine a first characterization value representing the fluctuation range of the CPU utilization within a preset time period based on the CPU utilization information of each node. The second characterization value determination module is used to determine a second characterization value representing the fluctuation range of the memory utilization within the preset time period based on the memory utilization information of each node. The address and port determination module is used to determine the source IP address, destination IP address, and total number of service ports corresponding to the preset time period based on the traffic log information. The maximum newly added address determination module is used to divide the preset time period into multiple time intervals, and determine the first time interval with the largest number of newly added source IP addresses and the second time interval with the largest number of newly added destination IP addresses in each of the preset time intervals, based on the source IP addresses and destination IP addresses in the preset time intervals. The first quotient determination module is used to determine the total downlink data volume corresponding to the first time interval based on the traffic log information, and calculate the first quotient by dividing the number of newly added IP addresses corresponding to the first time interval by the total downlink data volume. The second quotient determination module is used to determine the second time interval with the largest number of newly added destination IP addresses from the various time intervals, determine the total uplink data volume corresponding to the second time interval based on the traffic log information, and calculate the second quotient by dividing the number of newly added IP addresses corresponding to the second time interval by the total uplink data volume. The node anomaly determination module is used to determine the anomaly value corresponding to each node based on the first characteristic value, the second characteristic value, the first quotient, the second quotient, and the total number of service ports corresponding to each node. The outlier values ​​corresponding to each node are positively correlated with the corresponding first characteristic value, second characteristic value, first quotient value, and second quotient value, and the outlier values ​​corresponding to each node are negatively correlated with the total number of service ports. The network anomaly determination module is used to determine the outlier values ​​of the target network based on the outlier values ​​of each node.

[0162] In one alternative approach, the first characterization determination module calculates a first difference between the maximum and average values ​​of the CPU utilization rate within the preset time period based on the maximum, average, and minimum values ​​of the CPU utilization rate within the preset time period, and calculates a second difference between the minimum and average values ​​of the CPU utilization rate within the preset time period. Based on the sum of squares of the first difference and the sum of squares of the second difference, a first characterization value characterizing the fluctuation range of the CPU utilization rate within the preset time period is determined.

[0163] In one alternative approach, the second characterization determination module calculates a third difference between the maximum and average values ​​of the memory usage rate within the preset time period, based on the maximum, average, and minimum values ​​of the memory usage rate within the preset time period, and calculates a fourth difference between the minimum and average values ​​of the memory usage rate within the preset time period. Based on the sum of squares of the third difference and the sum of squares of the fourth difference, a second characterization value characterizing the fluctuation range of the memory usage rate within the preset time period is determined.

[0164] In an optional embodiment, the detection determination module 803 includes a detection value determination module and a judgment module. The detection value determination module is used to determine a detection value based on the probability value of the target network anomaly and the anomaly value of the target network. The detection value is positively correlated with both the probability value of the target network anomaly and the anomaly value of the target network. The judgment module is used to determine whether the detection value meets a preset condition; if so, it determines that an anomaly has been detected in the target network.

[0165] The network anomaly detection device provided in this embodiment of the invention determines the probability value and anomaly value of an anomaly in the target network based on the device attribute information, network traffic information, and network topology information of each node in the target network. It then determines the detection result of the target network based on these probability and anomaly values. This network anomaly detection device detects network anomalies solely based on the device attribute information, network topology information, and the device's own attributes. This lower detection dimensionality and lower information resource requirements improve the speed of network anomaly analysis, enabling real-time network detection and timely identification of network anomalies, thus enhancing network security.

[0166] In some embodiments, this application also provides a network anomaly detection device. Figure 8 The diagram shows a structural schematic of an abnormal network detection device provided in an embodiment of the present invention. The specific implementation of the abnormal network detection device is not limited by the specific embodiments of the present invention.

[0167] like Figure 9 As shown, the network anomaly detection device may include: a processor 902, a communications interface 904, a memory 906, and a communications bus 908.

[0168] The processor 902, communication interface 904, and memory 906 communicate with each other via communication bus 908. Communication interface 904 is used to communicate with other network elements such as clients or other servers. The processor 902 executes program 910, specifically performing the relevant steps described in the embodiment of the network anomaly detection method.

[0169] Specifically, program 910 may include program code, which includes computer-executable instructions.

[0170] Processor 902 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention. The network anomaly detection device includes one or more processors, which may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0171] Memory 906 is used to store program 910. Memory 906 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0172] Specifically, program 910 can be invoked by processor 902 to cause the network detection device to perform the following operations:

[0173] Step 02: Determine the probability value of the impact of the target network anomaly based on the device attribute information corresponding to each node in the target network and the network topology information of the target network.

[0174] Step 04: Determine the outliers in the target network based on the network traffic information of each node.

[0175] Step 06: Determine the detection result of the target network based on the probability value of the target network anomaly and the anomaly value of the target network.

[0176] In an alternative manner, the program 910 is invoked by the processor 902 to cause the network detection device to perform the following operations:

[0177] Step 021: Obtain the device attribute information corresponding to each node in the target network. The device attribute information includes the device type, device security level, device installation program information, system operation information, and vulnerability information of the corresponding node.

[0178] Step 022: Determine the attack probability value of each node based on the device type, the device security level, the system operation information, the vulnerability information, and the network topology information.

[0179] Step 023: Based on the device installation program information, the device security level, and the network topology information, determine the corresponding loss value of each node after being attacked.

[0180] Step 024: Determine the impact probability value of each node's anomaly based on the attack probability value and the loss value corresponding to each node, and determine the impact probability value of the target network's anomaly based on the impact probability value of each node's anomaly.

[0181] In an alternative manner, the program 910 is invoked by the processor 902 to cause the network detection device to perform the following operations:

[0182] Step 0221: Based on the vulnerability list in the vulnerability information of each node, determine the total number of vulnerabilities and the maximum number of vulnerabilities of the same type for each node.

[0183] Step 0222: Determine the node type parameters according to the device type of each node.

[0184] Step 0223: Determine the attack probability value of each node based on the device security level, the total number of vulnerabilities, the number of vulnerabilities of the largest category, the type parameter, the total number of ports and the number of open ports in the node's system operation information, and the node degree in the target network structure information. Specifically, the attack probability value of each node is positively correlated with the corresponding device security level, the type parameter, the total number of vulnerabilities, and the number of vulnerabilities of the largest category, respectively; and negatively correlated with the corresponding total number of ports, the number of open ports, and the node degree, respectively.

[0185] In an alternative manner, the program 910 is invoked by the processor 902 to cause the network detection device to perform the following operations:

[0186] Step 0231: For each corresponding node in the target network, determine the impact value of the corresponding node's installation program after it has been attacked, based on the device installation program information of the corresponding node.

[0187] Step 0232: Based on the network topology information, determine each link starting from the corresponding node, and determine the node degree of each other node in the network topology, excluding the corresponding node, and the number of edges between each other node and the corresponding node.

[0188] Step 0233: Determine the influence degree of each of the other nodes based on their device security level, node degree, and number of edges; wherein, the influence degree of each of the other nodes is positively correlated with the device security level and node degree of the corresponding other node, and negatively correlated with the number of edges of the corresponding other node.

[0189] Step 0234: Determine the influence of each link based on the influence of each of the other nodes in each link.

[0190] Step 0235: Determine the loss value of the corresponding node after the attack based on the influence value of the corresponding node and the maximum influence value of each link of the corresponding node. The loss value of the corresponding node after the attack is positively correlated with both the influence value and the maximum influence value of the corresponding node.

[0191] In an alternative manner, the program 910 is invoked by the processor 902 to cause the network detection device to perform the following operations:

[0192] Step 041: Obtain network traffic information corresponding to each node; wherein, the network traffic information includes CPU utilization information, memory utilization information and traffic log information of the corresponding node.

[0193] Step 042: Based on the CPU utilization information of each node, determine a first characterization value that represents the fluctuation range of the CPU utilization within the preset time period.

[0194] Step 043: Based on the memory usage information of each node, determine a second characterization value that represents the fluctuation range of the memory usage within the preset time period.

[0195] Step 044: Based on the traffic log information, determine the source IP address, destination IP information, and total number of service ports corresponding to the preset time period.

[0196] Step 045: Divide the preset time period into multiple time intervals, and determine the first time interval with the largest number of newly added source IP addresses and the second time interval with the largest number of newly added destination IP addresses in each of the preset time intervals, based on the source IP address and destination IP address of the preset time period.

[0197] Step 046: Based on the traffic log information, determine the total downlink data volume corresponding to the first time interval, and divide the number of newly added IP addresses corresponding to the first time interval by the total downlink data volume to determine the first quotient.

[0198] Step 047: From the various time intervals, determine the second time interval with the largest number of newly added destination IP addresses. Based on the traffic log information, determine the total amount of uplink data corresponding to the second time interval. Divide the number of newly added IP addresses corresponding to the second time interval by the total amount of uplink data to determine the second quotient.

[0199] Step 048: Determine the outlier for each node based on the first representation value, second representation value, first quotient, second quotient, and the total number of service ports for each node. The outlier for each node is positively correlated with the corresponding first representation value, second representation value, first quotient, and second quotient, and negatively correlated with the total number of service ports.

[0200] Step 049: Determine the outliers of the target network based on the outliers of each node.

[0201] In an alternative manner, the program 910 is invoked by the processor 902 to cause the network detection device to perform the following operations:

[0202] Based on the maximum, average, and minimum values ​​of CPU usage within the preset time period, calculate a first difference between the maximum and average values ​​of CPU usage within the preset time period, and calculate a second difference between the minimum and average values ​​of CPU usage within the preset time period. Then, based on the sum of squares of the first and second differences, determine a first characteristic value representing the fluctuation range of CPU usage within the preset time period; and / or, based on the maximum, average, and minimum values ​​of memory usage within the preset time period, calculate a third difference between the maximum and average values ​​of memory usage within the preset time period, and calculate a fourth difference between the minimum and average values ​​of memory usage within the preset time period. Then, based on the sum of squares of the third and fourth differences, determine a second characteristic value representing the fluctuation range of memory usage within the preset time period.

[0203] In an alternative manner, the program 910 is invoked by the processor 902 to cause the network detection device to perform the following operations:

[0204] Step 061: Determine the detection value based on the probability value of the target network anomaly and the anomaly value of the target network. The detection value is positively correlated with both the probability value of the target network anomaly and the anomaly value of the target network.

[0205] Step 062: Determine whether the detected value meets the preset conditions. If so, it is determined that the target network is abnormal.

[0206] The network anomaly detection device provided in this embodiment of the invention determines the probability value and anomaly value of an anomaly in the target network based on the device attribute information, network traffic information, and network topology information of each node in the target network. Based on these values, the detection result of the target network is determined. This network anomaly detection device detects network anomalies solely based on the device attribute information, network topology information, and the device attribute information of each node. This results in a lower detection dimension and lower information resource requirements, which improves the speed of network anomaly analysis. It enables real-time network detection, allowing for timely detection of network anomalies and improving network security.

[0207] Furthermore, embodiments of the present invention also provide a computer-readable storage medium storing at least one executable instruction, which, when executed on a network anomaly detection device, causes the network anomaly detection device to perform the network anomaly detection method in any of the above method embodiments.

[0208] Specifically, the executable instructions can be used to cause the network anomaly detection device to perform the following operations:

[0209] Step 02: Determine the probability value of the impact of the target network anomaly based on the device attribute information corresponding to each node in the target network and the network topology information of the target network.

[0210] Step 04: Determine the outliers in the target network based on the network traffic information of each node.

[0211] Step 06: Determine the detection result of the target network based on the probability value of the target network anomaly and the anomaly value of the target network.

[0212] In one alternative approach, the executable instructions can specifically be used to cause the network anomaly detection device to perform the following operations:

[0213] Step 021: Obtain the device attribute information corresponding to each node in the target network. The device attribute information includes the device type, device security level, device installation program information, system operation information, and vulnerability information of the corresponding node.

[0214] Step 022: Determine the attack probability value of each node based on the device type, the device security level, the system operation information, the vulnerability information, and the network topology information.

[0215] Step 023: Based on the device installation program information, the device security level, and the network topology information, determine the corresponding loss value of each node after being attacked.

[0216] Step 024: Determine the impact probability value of each node's anomaly based on the attack probability value and the loss value corresponding to each node, and determine the impact probability value of the target network's anomaly based on the impact probability value of each node's anomaly.

[0217] In one alternative approach, the executable instructions can specifically be used to cause the network anomaly detection device to perform the following operations:

[0218] Step 0221: Based on the vulnerability list in the vulnerability information of each node, determine the total number of vulnerabilities and the maximum number of vulnerabilities of the same type for each node.

[0219] Step 0222: Determine the node type parameters according to the device type of each node.

[0220] Step 0223: Determine the attack probability value of each node based on the device security level, the total number of vulnerabilities, the number of vulnerabilities of the largest category, the type parameter, the total number of ports and the number of open ports in the node's system operation information, and the node degree in the target network structure information. Specifically, the attack probability value of each node is positively correlated with the corresponding device security level, the type parameter, the total number of vulnerabilities, and the number of vulnerabilities of the largest category, respectively; and negatively correlated with the corresponding total number of ports, the number of open ports, and the node degree, respectively.

[0221] In an alternative manner, the program 910 is invoked by the processor 902 to cause the network detection device to execute, in an alternative manner, the executable instructions may specifically be used to cause the network anomaly detection device to perform the following operations:

[0222] Step 0231: For each corresponding node in the target network, determine the impact value of the corresponding node's installation program after it has been attacked, based on the device installation program information of the corresponding node.

[0223] Step 0232: Based on the network topology information, determine each link starting from the corresponding node, and determine the node degree of each other node in the network topology, excluding the corresponding node, and the number of edges between each other node and the corresponding node.

[0224] Step 0233: Determine the influence degree of each of the other nodes based on their device security level, node degree, and number of edges; wherein, the influence degree of each of the other nodes is positively correlated with the device security level and node degree of the corresponding other node, and negatively correlated with the number of edges of the corresponding other node.

[0225] Step 0234: Determine the influence of each link based on the influence of each of the other nodes in each link.

[0226] Step 0235: Determine the loss value of the corresponding node after the attack based on the influence value of the corresponding node and the maximum influence value of each link of the corresponding node. The loss value of the corresponding node after the attack is positively correlated with both the influence value and the maximum influence value of the corresponding node.

[0227] In one alternative approach, the executable instructions can specifically be used to cause the network anomaly detection device to perform the following operations:

[0228] Step 041: Obtain network traffic information corresponding to each node; wherein, the network traffic information includes CPU utilization information, memory utilization information and traffic log information of the corresponding node.

[0229] Step 042: Based on the CPU utilization information of each node, determine a first characterization value that represents the fluctuation range of the CPU utilization within the preset time period.

[0230] Step 043: Based on the memory usage information of each node, determine a second characterization value that represents the fluctuation range of the memory usage within the preset time period.

[0231] Step 044: Based on the traffic log information, determine the source IP address, destination IP information, and total number of service ports corresponding to the preset time period.

[0232] Step 045: Divide the preset time period into multiple time intervals, and determine the first time interval with the largest number of newly added source IP addresses and the second time interval with the largest number of newly added destination IP addresses in each of the preset time intervals, based on the source IP address and destination IP address of the preset time period.

[0233] Step 046: Based on the traffic log information, determine the total downlink data volume corresponding to the first time interval, and divide the number of newly added IP addresses corresponding to the first time interval by the total downlink data volume to determine the first quotient.

[0234] Step 047: From the various time intervals, determine the second time interval with the largest number of newly added destination IP addresses. Based on the traffic log information, determine the total amount of uplink data corresponding to the second time interval. Divide the number of newly added IP addresses corresponding to the second time interval by the total amount of uplink data to determine the second quotient.

[0235] Step 048: Determine the outlier for each node based on the first representation value, second representation value, first quotient, second quotient, and the total number of service ports for each node. The outlier for each node is positively correlated with the corresponding first representation value, second representation value, first quotient, and second quotient, and negatively correlated with the total number of service ports.

[0236] Step 049: Determine the outliers of the target network based on the outliers of each node.

[0237] In one alternative approach, the executable instructions can specifically be used to cause the network anomaly detection device to perform the following operations:

[0238] Based on the maximum, average, and minimum values ​​of CPU usage within the preset time period, calculate a first difference between the maximum and average values ​​of CPU usage within the preset time period, and calculate a second difference between the minimum and average values ​​of CPU usage within the preset time period. Then, based on the sum of squares of the first and second differences, determine a first characteristic value representing the fluctuation range of CPU usage within the preset time period; and / or, based on the maximum, average, and minimum values ​​of memory usage within the preset time period, calculate a third difference between the maximum and average values ​​of memory usage within the preset time period, and calculate a fourth difference between the minimum and average values ​​of memory usage within the preset time period. Then, based on the sum of squares of the third and fourth differences, determine a second characteristic value representing the fluctuation range of memory usage within the preset time period.

[0239] In one alternative approach, the executable instructions can specifically be used to cause the network anomaly detection device to perform the following operations:

[0240] Step 061: Determine the detection value based on the probability value of the target network anomaly and the anomaly value of the target network. The detection value is positively correlated with both the probability value of the target network anomaly and the anomaly value of the target network.

[0241] Step 062: Determine whether the detected value meets the preset conditions. If so, it is determined that the target network is abnormal.

[0242] The computer-readable storage medium provided in this embodiment of the invention enables a network anomaly detection device to determine the probability value and anomaly value of an anomaly in the target network based on the device attribute information, network traffic information, and network topology information of each node in the target network, and to determine the detection result of the target network based on the probability value and anomaly value of the anomaly. The computer-readable storage medium allows the network anomaly detection device to detect network anomalies solely based on the device attribute information, network topology information, and the device attribute information of each node. This results in a lower detection dimension and lower information resource requirements, which is beneficial for improving the analysis speed of network anomalies, enabling real-time network detection, timely detection of network anomalies, and improving the security performance of network operation.

[0243] This invention also provides a network anomaly detection device for performing the above-described network anomaly detection method.

[0244] This invention also provides a computer program that can be called by a processor to cause a network anomaly detection device to execute the network anomaly detection method in any of the above method embodiments.

[0245] This invention also provides a computer program product, which includes a computer program stored on a computer-readable storage medium. The computer program includes program instructions that, when executed on a computer, cause the computer to perform the network anomaly detection method described in any of the above method embodiments.

[0246] The algorithms or displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used in conjunction with the teachings herein. The required structure for constructing such systems is apparent from the above description. Furthermore, the embodiments of the present invention are not directed to any particular programming language. It should be understood that the content of the invention described herein can be implemented using various programming languages, and the above description of specific languages ​​is for the purpose of disclosing the best mode of implementation of the invention.

[0247] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0248] Similarly, it should be understood that, in order to streamline the invention and aid in understanding one or more of the various aspects of the invention, features of the embodiments of the invention are sometimes grouped together in a single embodiment, figure, or description thereof in the above description of exemplary embodiments of the invention. However, this disclosure should not be construed as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim.

[0249] Those skilled in the art will understand that modules in the device of the embodiments can be adaptively changed and placed in one or more devices different from that embodiment. Modules, units, or components in the embodiments can be combined into a single module, unit, or component, and can be divided into multiple sub-modules, sub-units, or sub-components. Except where at least some of such features and / or processes or units are mutually exclusive, any combination can be used to combine all features disclosed in this specification (including the accompanying claims, abstract, and drawings) and all processes or units of any method or device so disclosed. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstract, and drawings) may be replaced by an alternative feature that serves the same, equivalent, or similar purpose.

[0250] It should be noted that the above embodiments are illustrative of the invention and not restrictive, and that those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names. The steps in the above embodiments, unless otherwise specified, should not be construed as limiting the order of execution.

Claims

1. A method for detecting network anomalies, characterized in that, The method includes: Based on the device attribute information corresponding to each node in the target network and the network topology information of the target network, determine the impact probability value of the target network anomaly; Obtain network traffic information corresponding to each node; wherein, the network traffic information includes CPU utilization information, memory utilization information and traffic log information of the corresponding node; Based on the maximum, average, and minimum CPU usage within a preset time period, calculate a first difference between the maximum and average CPU usage within the preset time period, and calculate a second difference between the minimum and average CPU usage within the preset time period. Based on the sum of squares of the first difference and the sum of squares of the second difference, determine a first characterization value representing the fluctuation range of the CPU usage within the preset time period. Based on the maximum, average, and minimum values ​​of memory usage within the preset time period, calculate the third difference between the maximum and average values ​​of memory usage within the preset time period, and calculate the fourth difference between the minimum and average values ​​of memory usage within the preset time period. Based on the sum of squares of the third and fourth differences, determine a second characterization value representing the fluctuation range of memory usage within the preset time period. Based on the traffic log information, determine the total number of source IP addresses, destination IP addresses, and service ports corresponding to the preset time period; The preset time period is divided into multiple time intervals. Based on the source IP address and destination IP address of the preset time period, the first time interval with the largest number of newly added source IP addresses and the second time interval with the largest number of newly added destination IP addresses are determined in each of the time intervals. Based on the traffic log information, determine the total downlink data volume corresponding to the first time interval, and divide the number of newly added IP addresses corresponding to the first time interval by the total downlink data volume to determine the first quotient. Based on the traffic log information, determine the total amount of uplink data corresponding to the second time interval, and divide the number of newly added IP addresses corresponding to the second time interval by the total amount of uplink data to determine the second quotient. An outlier value for each node is determined based on the first representation value, second representation value, first quotient value, second quotient value, and the total number of service ports for each node; wherein, the outlier value for each node is positively correlated with the corresponding first representation value, second representation value, first quotient value, and second quotient value, and the outlier value for each node is negatively correlated with the corresponding total number of service ports. Based on the outlier values ​​of each node, the outlier values ​​of the target network are determined; The detection result of the target network is determined based on the probability value of the impact of the target network anomaly and the anomaly value of the target network.

2. The method according to claim 1, characterized in that, The step of determining the probability value of the impact of the target network anomaly based on the device attribute information corresponding to each node in the target network and the network topology information of the target network includes: Obtain device attribute information corresponding to each node in the target network. Each device attribute information includes the device type, device security level, device installation program information, system operation information, and vulnerability information of the corresponding node. Based on the device type, the device security level, the system operation information, the vulnerability information, and the network topology information, determine the attack probability value of each node; Based on the device installation program information, the device security level, and the network topology information, determine the corresponding loss value of each node after being attacked; Based on the attack probability value and the loss value corresponding to each node, the impact probability value of each node's anomaly is determined, and based on the impact probability value of each node's anomaly, the impact probability value of the target network's anomaly is determined.

3. The method according to claim 2, characterized in that, The step of determining the attack probability value of each node based on the device type, the device security level, the system operation information, the vulnerability information, and the network topology information includes: Based on the vulnerability list in the vulnerability information of each node, determine the total number of vulnerabilities and the maximum number of vulnerabilities of the same type for each node. Determine the node type parameters according to the device type of each node; The attack probability value of each node is determined based on the device security level, the total number of vulnerabilities, the maximum number of vulnerabilities of the same type, the type parameter, the total number of ports and the number of open ports in the system operation information of the node, and the node degree in the target network structure information. The attack probability value of each node is positively correlated with the corresponding device security level, the type parameter, the total number of vulnerabilities, and the maximum number of vulnerabilities of the same type, respectively, and negatively correlated with the corresponding total number of ports, the number of open ports, and the node degree, respectively.

4. The method according to claim 2, characterized in that, The step of determining the loss value of each node after being attacked based on the device installation program information, the device security level, and the network topology information includes: For each corresponding node in the target network, the impact value of the corresponding node's installation program being attacked is determined based on the device installation program information of the corresponding node; Based on the network topology information, each link starting from the corresponding node is determined, and the node degree of each other node in each link (excluding the corresponding node) in the network topology is determined, as well as the number of edges between each other node and the corresponding node. The influence degree of each of the other nodes is determined based on the device security level, node degree, and number of edges of each of the other nodes; wherein, the influence degree of each of the other nodes is positively correlated with the device security level and node degree of the corresponding other node, and the influence degree of each of the other nodes is negatively correlated with the number of edges of the corresponding other node; The influence of each link is determined based on the influence of each of the other nodes in each link; Based on the influence value of the corresponding node and the maximum influence of each link of the corresponding node, the loss value of the corresponding node after being attacked is determined; wherein, the loss value of the corresponding node after being attacked is positively correlated with both the influence value and the maximum influence of the corresponding node.

5. The method according to claim 1, characterized in that, The step of determining the detection result of the target network based on the impact probability value of the target network anomaly and the anomaly value of the target network includes: A detection value is determined based on the probability value of the target network anomaly and the anomaly value of the target network; wherein the detection value is positively correlated with both the probability value of the target network anomaly and the anomaly value of the target network. Determine whether the detected value meets the preset conditions; if so, determine that the target network anomaly has been detected.

6. A network anomaly detection device, characterized in that, The device includes: The impact probability value determination module is used to determine the impact probability value of the target network anomaly based on the device attribute information corresponding to each node in the target network and the network topology information of the target network. An outlier determination module is used to acquire network traffic information corresponding to each node; wherein, the network traffic information includes CPU utilization information, memory utilization information, and traffic log information of the corresponding node; based on the maximum, average, and minimum values ​​of CPU utilization within a preset time period, a first difference between the maximum and average values ​​of CPU utilization within the preset time period is calculated, and a second difference between the minimum and average values ​​of CPU utilization within the preset time period is calculated, and a first characterizing value representing the fluctuation range of CPU utilization within the preset time period is determined based on the sum of squares of the first difference and the sum of squares of the second difference; based on the maximum, average, and minimum values ​​of memory utilization within the preset time period, a third difference between the maximum and average values ​​of memory utilization within the preset time period is calculated, and a fourth difference between the minimum and average values ​​of memory utilization within the preset time period is calculated, and a second characterizing value representing the fluctuation range of memory utilization within the preset time period is determined based on the sum of squares of the third difference and the sum of squares of the fourth difference; based on the traffic log information, the corresponding source IP address, destination IP address, and... The total number of service ports; the preset time period is divided into multiple time intervals, and based on the source IP address and destination IP address of the preset time period, a first time interval with the largest number of newly added source IP addresses and a second time interval with the largest number of newly added destination IP addresses are determined in each time interval; based on the traffic log information, the total downlink data volume corresponding to the first time interval is determined, and the number of newly added IP addresses corresponding to the first time interval is divided by the total downlink data volume to determine a first quotient; based on the traffic log information, the total uplink data volume corresponding to the second time interval is determined, and the number of newly added IP addresses corresponding to the second time interval is divided by the total uplink data volume to determine a second quotient; based on the first characteristic value, second characteristic value, first quotient, second quotient, and the total number of service ports corresponding to each node, outliers corresponding to each node are determined; wherein, the outliers corresponding to each node are positively correlated with the corresponding first characteristic value, second characteristic value, first quotient, and second quotient, and the outliers corresponding to each node are negatively correlated with the corresponding total number of service ports; based on the outliers of each node, outliers of the target network are determined; The detection determination module is used to determine the detection result of the target network based on the probability value of the impact of the target network anomaly and the anomaly value of the target network.

7. A network anomaly detection device, characterized in that, include: The processor, memory, communication interface, and communication bus are provided, wherein the processor, memory, and communication interface communicate with each other via the communication bus. The memory is used to store at least one executable instruction that causes the processor to execute the network anomaly detection method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The storage medium stores at least one executable instruction, which, when executed on the network anomaly detection device, causes the network anomaly detection device to perform the operation of the network anomaly detection method as described in any one of claims 1-5.

Images