Security situation attack detection methods, devices, equipment, media and products

Abstract

The present disclosure relates to a security situation attack detection method, apparatus, equipment, medium and product, including: inputting the risk value of the network attack to be detected into a threat model to obtain the attack firepower value and full-load attack firepower value of the network attack to be detected; determining the attack mode of the network attack to be detected based on the attack firepower value and the full-load attack firepower value; inputting the attack mode of the network attack to be detected into a pre-trained attack qualitative model, and outputting the qualitative result of the network attack to be detected; wherein the attack qualitative model is trained in the following manner: obtaining the attack modes of multiple known network attacks, forming vectors of the various stages of the attack modes of the multiple known network attacks, and obtaining a training data set; training the training data set through machine learning to obtain an attack qualitative model. The present application trains the attack mode of the attack mode into an attack qualitative model through machine learning, and can quickly qualitatively identify the attack mode of an unknown network attack.

Description

Technical Field

[0001] The present disclosure relates to the field of network security, and in particular to a security situation attack detection method, device, equipment, medium and product. Background Art

[0002] With the advancement of information technology, businesses and individuals are enjoying the convenience it brings. Network technology, as part of information technology, is widely used in our daily lives. The need to intuitively display the real-time security status of the network environment to provide security assurance has become a growing focus of attention, with network security attack detection and learning becoming increasingly important.

[0003] Attack detection currently lacks a comprehensive indicator system. Currently, actual security attack characterization is done through stage statistics or experience. This method, firstly, cannot determine the relevance of stages, and secondly, cannot eliminate the noise of missed and false positives, resulting in poor results. Summary of the Invention

[0004] To overcome the problems existing in the related art, the present disclosure provides a security situation attack detection method, device, equipment, medium and product.

[0005] According to a first aspect of an embodiment of the present disclosure, a security posture attack detection method is provided, comprising:

[0006] Inputting the risk value of the network attack to be detected into the threat model to obtain the attack firepower value and the full-load attack firepower value of the network attack to be detected;

[0007] Determining an attack mode of the to-be-detected network attack based on the attack firepower value and the full-load attack firepower value;

[0008] Inputting the attack pattern of the network attack to be detected into a pre-trained attack qualitative model, and outputting a qualitative result of the network attack to be detected;

[0009] The attack qualitative model is trained in the following way:

[0010] Acquire attack patterns of multiple known network attacks, form vectors for each stage of the attack patterns of the multiple known network attacks, and acquire a training data set;

[0011] The attack qualitative model is obtained by training the training data set through machine learning.

[0012] In some embodiments, before inputting the risk value of the network attack to be detected into the threat model and obtaining the attack firepower value and the full-load attack firepower value of the network attack to be detected, the method further includes:

[0013] Determining whether the network attack to be detected meets the fourth-level indicators;

[0014] When the network attack to be detected meets the four-level indicators, obtaining a risk value of the network attack to be detected;

[0015] When the network attack to be detected does not meet the four-level indicators, the qualitative result of the network attack to be detected is output as no attack.

[0016] Furthermore, determining whether the network attack to be detected meets the fourth level indicators includes:

[0017] Inputting the network attack to be detected into the threat model and outputting indicator results;

[0018] Based on the indicator results, it is determined whether the network attack to be detected meets the fourth level indicator.

[0019] In some embodiments, obtaining the attack qualitative model by training the training dataset through machine learning includes:

[0020] Initializing the initial weight distribution of training samples in the training data set;

[0021] Weighting the training samples in the training data set and performing machine training to obtain multiple weak classifiers;

[0022] The multiple weak classifiers are integrated based on the Adaboost algorithm to obtain the attack qualitative model.

[0023] According to a second aspect of an embodiment of the present disclosure, there is provided a security posture attack detection device, comprising:

[0024] A first input module is configured to input a risk value of a network attack to be detected into a threat model, and obtain an attack firepower value and a full-load attack firepower value of the network attack to be detected;

[0025] A first determining module determines an attack mode of the to-be-detected network attack based on the attack firepower value and the full-load attack firepower value;

[0026] A qualitative module, which inputs the attack pattern of the network attack to be detected into a pre-trained attack qualitative model and outputs a qualitative result of the network attack to be detected;

[0027] The attack qualitative model is trained in the following way:

[0028] Acquire attack patterns of multiple known network attacks, form vectors for each stage of the attack patterns of the multiple known network attacks, and acquire a training data set;

[0029] The attack qualitative model is obtained by training the training data set through machine learning.

[0030] In some embodiments, it further includes:

[0031] The second determination module is used to determine whether the network attack to be detected meets the four-level indicators; when the network attack to be detected meets the four-level indicators, obtain the risk value of the network attack to be detected; when the network attack to be detected does not meet the four-level indicators, output the qualitative result of the network attack to be detected as no attack.

[0032] Furthermore, the second determining module is further configured to:

[0033] Inputting the network attack to be detected into the threat model and outputting indicator results;

[0034] Based on the indicator results, it is determined whether the network attack to be detected meets the fourth level indicator.

[0035] An embodiment of the third aspect of the present application provides an electronic device, including a processor and a memory, wherein the memory stores at least one instruction, at least one program, code set or instruction set, and the instruction, the program, the code set or the instruction set is loaded and executed by the processor to implement the steps of the security posture attack detection method provided by the embodiment of the first aspect of the present application.

[0036] An embodiment of the fourth aspect of the present application provides a non-temporary computer-readable storage medium. When the instructions in the storage medium are executed by the processor of the mobile terminal, the mobile terminal is able to execute the steps of the security posture attack detection method provided by the embodiment of the first aspect of the present application.

[0037] An embodiment of the fifth aspect of the present application provides a computer program product. When the instructions in the computer program product are executed by the processor of the mobile terminal, the mobile terminal is enabled to execute the steps of the security posture attack detection method provided by the embodiment of the first aspect of the present application.

[0038] The technical solutions provided by the embodiments of the present disclosure may have the following beneficial effects: By calculating the firepower value of the network attack to be detected, the present application determines the attack pattern to be detected, thereby avoiding the noise caused by false positives and false negatives in event reports. The attack qualitative model obtained by training the attack patterns formed through machine learning methods can qualitatively characterize both known and unknown attack patterns, with high fault tolerance.

[0039] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0041] Figure 1 The figure is a flowchart of a security situation attack detection method according to an exemplary embodiment.

[0042] Figure 2 The present invention is a block diagram showing a security situation attack detection device according to an exemplary embodiment.

[0043] Figure 3 The figure shows the internal structure of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0044] Exemplary embodiments will be described in detail herein, examples of which are illustrated in the accompanying drawings. In the following description, when referring to the drawings, like numbers in different figures represent like or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all possible embodiments consistent with the present invention. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present invention, as detailed in the appended claims.

[0045] Figure 1 FIG. 1 is a flow chart showing a method for detecting security posture attacks according to an exemplary embodiment. Figure 1 As shown, the following steps are included:

[0046] In step S101, the risk value of the network attack to be detected is input into the threat model to obtain the attack firepower value and the full-load attack firepower value of the network attack to be detected.

[0047] Specifically, the threat model is obtained in the following ways:

[0048] 1. Use clustering algorithms to cluster network attack samples, including the following process steps

[0049] Algorithm Flow

[0050] (1) Initialization. k=0, t=0, C * =inf Select the farthest k points as the initial cluster centers.

[0051] (2) Cluster the samples. For a fixed cluster center Calculate the Euclidean distance from each sample to the cluster center and assign each sample to the cluster closest to it.

[0052] (3) Calculate the new class center. Calculate the mean of the samples of the new class as the new class center

[0053] (4) If the iteration converges or meets the stopping condition, compare C * , C (t) , if C * >C (t) , then C * =C (t) , k=k+1; if C * <=C (t) , then k=k+1.

[0054] (5) If K meets certain conditions, output C * , otherwise go to (2).

[0055] Specific operations, log information, and network traffic information include at least one or more of the following: external network IP, internal network IP, attack IP, time, log type, security type, risk level, description, and traffic tuple information (source port, destination port, packet length, protocol, and self-encoded segmented PAYLOAD). These dimensions are then constructed into the corresponding data:

[0056]

[0057] Then, clustering is performed according to the method in [(1)-(5), Algorithm Flow], so that the logs and traffic to be learned are divided into different types. This is cluster learning.

[0058] 2. Use the KNN classification model to classify the above categories

[0059] The above clustering algorithm has actually classified the four types of indicators. Because the first, second and third types of indicators are relatively simple, and the third and fourth types of indicators are in a containment and being contained relationship, the three types of indicators are constructed as known feature classes, and then classified by the KNN method. In this way, the attribution of the third and fourth types of indicators can be determined.

[0060] Specific process

[0061] (1) Initially, the three types of indicator data that have been repeatedly verified are combined into feature class D, which is divided into 30 classes (0-30).

[0062] The distance metric is Euclidean distance

[0063] The K value was selected as 3 using the cross-validation method.

[0064] (2) According to the above distance metric, find the K points closest to the data to be classified x in the feature class D to form a neighborhood, which is recorded as N k (x).

[0065] (3) Specific categories can be determined by majority vote

[0066]

[0067] Therefore, the attribution of each of the four categories of indicators was determined.

[0068] The pattern recognition algorithm essentially assigns a name to each of the four assigned indicators. For the description field, a recurrent neural network is first used to segment the description field. The probability of each segment is then calculated. The segment with the highest probability, followed by a sequence number, becomes the indicator name. For missing description fields, the first k bytes of the payload are used to construct a segment. The probability of each segment is then calculated. The segment with the highest probability, followed by a sequence number, becomes the indicator name. The four levels of indicators include the first, second, third, and fourth categories. Category I, category II, and category III indicators include: computer virus events, worm events, Trojan horse events, botnet events, hybrid attack program events, webpage embedded malicious code events, and other harmful program events. The four categories of indicators include category I, category II, and category III. Clustering learning models alone cannot determine the specific sample categories of network security dimensions.

[0069] The training process is as follows

[0070] (1) Take logs and traffic as input to extract dimensions and construct data D.

[0071] (2) Then perform clustering algorithm on D and divide it into D k (k∈N).

[0072] (3) Then for each D k (k∈N), the KNN classification model is used to determine the attribution problem.

[0073] (4) Then determine the indicator name through the indicator name recognition algorithm.

[0074] (5) This completes the construction of the four-level indicator system of the threat model.

[0075] Through the training samples and four-level indicator system obtained above, the threat model is obtained through machine algorithms.

[0076] This application obtains the attack firepower value and full-load attack firepower value of the network attack to be detected by inputting the risk value of the network attack to be detected into the threat model. The dimensions of the four-level indicators related to the first stage are (a1, a2, a3, a4, a5, a6), and the corresponding reported risk values ​​are (3, 3, 5, 5, 7, 10). The firepower value is calculated by inputting the threat model to assume V = 0.2. Similarly, the highest risk value corresponding to the four-level indicators related to the first stage (10, 10, 10, 10, 10, 10) is input into the threat model to calculate the full-load attack firepower value, assuming V_max = 0.4.

[0077] In some embodiments, before inputting the risk value of the network attack to be detected into the threat model and obtaining the attack firepower value and the full-load attack firepower value of the network attack to be detected, the method further includes:

[0078] Determining whether the network attack to be detected meets the fourth-level indicators;

[0079] When the network attack to be detected meets the four-level indicators, obtaining a risk value of the network attack to be detected;

[0080] When the network attack to be detected does not meet the four-level indicators, the qualitative result of the network attack to be detected is output as no attack.

[0081] Specifically, if it is determined that the network attack to be detected does not meet the fourth-level indicators, it indicates that the network attack to be detected is not aggressive. When the network attack to be detected meets the fourth-level indicators, it indicates that the network attack to be detected may be aggressive and further detection of the network attack to be detected is required.

[0082] In some embodiments, determining whether the to-be-detected network attack meets the fourth-level indicator includes:

[0083] Inputting the network attack to be detected into the threat model and outputting indicator results;

[0084] Based on the indicator results, it is determined whether the network attack to be detected meets the fourth level indicator.

[0085] Specifically, by inputting the network attack to be detected into the above threat model, it can be determined whether the network attack to be detected meets the fourth-level indicators.

[0086] In step S102, the attack mode of the to-be-detected network attack is determined based on the attack firepower value and the full-load attack firepower value.

[0087] Specifically, in combination with the specific embodiment, the firepower value is assumed to be V = 0.2, and the load attack firepower value is assumed to be V_max = 0.4, and then the ratio of the two is calculated. The mode value of the first stage is 1, indicating that this stage exists in this attack. The attack is divided into 6 stages. The other stages are calculated according to the above process. Finally, different attack modes are obtained. For example, (1, 2, 3, 4, 5) represents that the mode values ​​of the 5 stages are all 1, and the sixth stage is missing. (1, 2, 3, 4, 5, 6) represents that the mode values ​​of the 6 stages are all 1. Among them, (1) represents a mode, (1, 2) represents a mode, (1, 2, 3) also represents a mode, (1, 2, 3, 4) also represents a mode, (1, 2, 3, 4, 5) represents a mode, (1, 2, 3, 4, 5) represents a mode, (1, 2, 3, 4, 5, 6) represents a mode, (2, 3, 4) also represents a mode, etc. The attack mode of the network attack to be detected can be determined.

[0088] In step S103, the attack pattern of the network attack to be detected is input into a pre-trained attack qualitative model, and a qualitative result of the network attack to be detected is output. The attack qualitative model is trained by obtaining attack patterns of multiple known network attacks, forming vectors for each stage of the attack patterns of the multiple known network attacks, and obtaining a training dataset; and then training the training dataset through machine learning to obtain the attack qualitative model.

[0089] Specifically, the attack pattern of the network attack to be detected is obtained in the above manner and input into the attack qualitative model to obtain the qualitative result of the network attack to be detected.

[0090] The attack qualitative model forms vectors based on various stages of attack patterns of multiple known network attacks to obtain a training data set; and the attack qualitative model is obtained by training the training data set through machine learning.

[0091] In some embodiments, the attack qualitative model is obtained by training the training data set through machine learning, including: initializing the starting weight distribution of training samples in the training data set; assigning weights to the training samples in the training data set and performing machine training to obtain multiple weak classifiers; and integrating the multiple weak classifiers based on the Adaboost algorithm to obtain the attack qualitative model.

[0092] The specific process is as follows:

[0093] (A) Initial weight distribution of initial training data

[0094]

[0095] i: number of samples, from 1 to N means there are N samples

[0096] w 1i : Initialize the weight size of each training sample

[0097] D1: Initial weight distribution of training samples

[0098] (B) For m weak classifiers m=1,2,…M

[0099] 1. In the weight D m Download the training data set and get the weak classifier

[0100] G m (x):X→{-1,1}

[0101] X: training sample

[0102] G m (x): mth weak classifier

[0103] 2. Calculate G m The training error

[0104]

[0105] y i : The true value of the i-th sample is 0 or 1

[0106] I(G m (x i )≠y i ): The value is 1 if the condition in the brackets is met, otherwise it is 0

[0107] w mi : represents the weight of the i-th sample in the m-th round

[0108] e m : Error of the classifier

[0109] From the formula, we can get G m The error rate e on the training data set m Is G m The sum of the weights of misclassified samples.

[0110] 3. Calculate G m The weight coefficient

[0111]

[0112] α m : Represents the importance of the classifier in the final classifier

[0113] From the above formula, we can see that When α m ≥0, and α m With the e m It increases as decreases, which means that the weak classifier with smaller classification error rate plays a greater role in the final classifier.

[0114] 4. Update the weight distribution of the training dataset

[0115] D m+1 =(w m+1,1 ,…,w m+1,i ,…,w m+1,N )

[0116]

[0117]

[0118] w m+1 : represents the weight of the i-th sample in the m+1th round. The calculation rules are listed in the following formula. When the predicted classification value is equal to the true value, the weight is updated according to (a). Otherwise, it is updated according to (b). From the formula, it can be seen that after the weight of the incorrectly classified sample is updated, w m+1,i >w m,i That is, the weight increases, so in the next round of classifiers, the focus will be on samples that are misclassified.

[0119]

[0120] D m+1 : represents the weight distribution of all samples in the m+1th round

[0121] Z m Is the normalization factor to do normalization

[0122] 5. Construct a linear combination of weak classifiers

[0123]

[0124] From the above formula, we can see that each weak classifier G m Multiply by the corresponding weight coefficient α m The linear combination f(x) of the weak classifiers is obtained by adding them together.

[0125] 6. Get the final classifier

[0126]

[0127] Where sign(x) is the sign function, which returns 1 for positive numbers and -1 for negative numbers.

[0128] The training dataset is trained using the aforementioned method, and multiple weak classifiers are linearly combined to generate a final strong classifier, ultimately obtaining a qualitative attack model. The training data in this qualitative attack model represents the six stages of an attack, meaning each sample contains six features, and the label data for each sample is divided into two categories: 1 for an attack and 0 for not an attack.

[0129] Figure 2 FIG. 1 is a block diagram of a security posture attack detection device according to an exemplary embodiment. Figure 2 The device includes a first input module 201, a first determination module 202 and a qualitative module 203.

[0130] The first input module 201 is used to input the risk value of the network attack to be detected into the threat model to obtain the attack firepower value and the full-load attack firepower value of the network attack to be detected;

[0131] A first determining module 202 determines an attack mode of the to-be-detected network attack based on the attack firepower value and the full-load attack firepower value;

[0132] The qualitative module 203 inputs the attack pattern of the network attack to be detected into the pre-trained attack qualitative model and outputs the qualitative result of the network attack to be detected;

[0133] The attack qualitative model is trained in the following way:

[0134] Acquire attack patterns of multiple known network attacks, form vectors for each stage of the attack patterns of the multiple known network attacks, and acquire a training data set;

[0135] The attack qualitative model is obtained by training the training data set through machine learning.

[0136] In some embodiments, the further comprising:

[0137] The second determination module is used to determine whether the network attack to be detected meets the four-level indicators; when the network attack to be detected meets the four-level indicators, obtain the risk value of the network attack to be detected; when the network attack to be detected does not meet the four-level indicators, output the qualitative result of the network attack to be detected as no attack.

[0138] In some embodiments, the second determining module is further configured to:

[0139] Inputting the network attack to be detected into the threat model and outputting indicator results;

[0140] Based on the indicator results, it is determined whether the network attack to be detected meets the fourth level indicator.

[0141] Regarding the apparatus in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0142] In one embodiment, an electronic device is provided. The electronic device may be a terminal, and its internal structure diagram may be as follows: Figure 3As shown. The electronic device includes a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. The processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a security situation attack detection method is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad provided on the computer device housing, or an external keyboard, touchpad or mouse.

[0143] Those skilled in the art will understand that Figure 3 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0144] In one embodiment, the security situation attack detection device provided by the present application can be implemented in the form of a computer program. Figure 3 The memory of the electronic device can store various program modules that constitute the security situation attack detection device.

[0145] The memory of the electronic device stores at least one instruction, at least one program, code set, or instruction set, and the instruction, program, code set, or instruction set is loaded and executed by the processor to implement the security posture attack detection method according to any one of the above embodiments. For example, the security posture attack detection method includes: inputting the risk value of the network attack to be detected into a threat model, obtaining the attack firepower value and full-load attack firepower value of the network attack to be detected; determining the attack mode of the network attack to be detected based on the attack firepower value and the full-load attack firepower value; inputting the attack mode of the network attack to be detected into a pre-trained attack qualitative model, and outputting the qualitative result of the network attack to be detected.

[0146] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented: inputting the risk value of the network attack to be detected into a threat model, obtaining the attack firepower value and the full-load attack firepower value of the network attack to be detected; determining the attack mode of the network attack to be detected based on the attack firepower value and the full-load attack firepower value; inputting the attack mode of the network attack to be detected into a pre-trained attack qualitative model, and outputting the qualitative result of the network attack to be detected.

[0147] In one embodiment, a computer program product is provided. When the instructions in the computer program product are executed by a processor of a mobile terminal, the mobile terminal is enabled to perform the following steps: inputting the risk value of a network attack to be detected into a threat model, obtaining an attack firepower value and a full-load attack firepower value of the network attack to be detected; determining an attack mode of the network attack to be detected based on the attack firepower value and the full-load attack firepower value; inputting the attack mode of the network attack to be detected into a pre-trained attack qualitative model, and outputting a qualitative result of the network attack to be detected.

[0148] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static random access memory (SRAM) and dynamic random access memory (DRAM).

[0149] The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0150] The above embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art could make various modifications and improvements without departing from the spirit of the present application, all of which fall within the scope of protection of the present application. Therefore, the scope of protection of the present patent application shall be determined by the appended claims.

Claims

1. A security situation attack detection method, characterized in that: include: Obtaining an attack firepower value and a full-load attack firepower value of the network attack to be detected according to the risk value of the network attack to be detected; Determining an attack mode of the to-be-detected network attack based on the attack firepower value and the full-load attack firepower value; Inputting the attack pattern of the network attack to be detected into a pre-trained attack qualitative model, and outputting a qualitative result of the network attack to be detected; The attack qualitative model is obtained by training in the following way: Acquire attack patterns of multiple known network attacks, form vectors for each stage of the attack patterns of the multiple known network attacks, and acquire a training data set; Training the training data set through machine learning to obtain the attack qualitative model; The step of obtaining the attack firepower value and the full-load attack firepower value of the network attack to be detected based on the risk value of the network attack to be detected includes: Obtaining an attack firepower value of the network attack to be detected according to the risk value of the network attack to be detected and a first correspondence relationship, wherein the first correspondence relationship includes a plurality of risk values ​​and an attack firepower value of the network attack to be detected corresponding to each risk value; Obtaining a full-load attack firepower value of the network attack to be detected according to the risk value of the network attack to be detected and a second corresponding relationship, wherein the second corresponding relationship includes a plurality of risk values ​​and a full-load attack firepower value of the network attack to be detected corresponding to each risk value; The determining of the attack mode of the to-be-detected network attack based on the attack firepower value and the full-load attack firepower value includes: Comparing the firepower value with the full-load attack firepower value to obtain a mode value; Obtaining the attack mode according to the mode value and the corresponding relationship between the mode value and the attack mode; Before obtaining the attack firepower value and the full-load attack firepower value of the network attack to be detected according to the risk value of the network attack to be detected, the method further includes: Inputting the network attack to be detected into the threat model and outputting indicator results; Determining whether the network attack to be detected meets the fourth-level indicators based on the indicator results; When the network attack to be detected meets the four-level indicators, obtaining a risk value of the network attack to be detected; When the network attack to be detected does not meet the four-level indicators, outputting the qualitative result of the network attack to be detected as no attack; The method further includes a threat model training process: Take logs and traffic as input to extract dimensions and construct data D; Perform clustering algorithm on D and divide it into multiple ; The KNN classification model is used to determine each of the the issue of ownership; The indicator name is determined through the indicator name recognition algorithm to obtain a four-level indicator system; The network attack samples and the four-level indicator system are trained through a machine algorithm to obtain the threat model.

2. The security situation attack detection method according to claim 1, characterized in that: The attack qualitative model is obtained by training the training data set through machine learning, including: Initializing the initial weight distribution of training samples in the training data set; Weighting the training samples in the training data set and performing machine training to obtain multiple weak classifiers; The multiple weak classifiers are integrated based on the Adaboost algorithm to obtain the attack qualitative model.

3. A security situation attack detection device, characterized in that: include: A first input module is configured to obtain an attack firepower value and a full-load attack firepower value of the network attack to be detected according to a risk value of the network attack to be detected; A first determining module determines an attack mode of the to-be-detected network attack based on the attack firepower value and the full-load attack firepower value; A qualitative module, which inputs the attack pattern of the network attack to be detected into a pre-trained attack qualitative model and outputs a qualitative result of the network attack to be detected; The attack qualitative model is trained in the following way: Acquire attack patterns of multiple known network attacks, form vectors for each stage of the attack patterns of the multiple known network attacks, and acquire a training data set; Training the training data set through machine learning to obtain the attack qualitative model; The first input module is specifically configured to obtain an attack firepower value of the network attack to be detected based on the risk value of the network attack to be detected and a first corresponding relationship, wherein the first corresponding relationship includes multiple risk values ​​and an attack firepower value of the network attack to be detected corresponding to each risk value; Obtaining a full-load attack firepower value of the network attack to be detected according to the risk value of the network attack to be detected and a second corresponding relationship, wherein the second corresponding relationship includes a plurality of risk values ​​and a full-load attack firepower value of the network attack to be detected corresponding to each risk value; The first determining module is specifically configured to compare the firepower value with the full-load attack firepower value to obtain a mode value; Obtaining the attack mode according to the mode value and the corresponding relationship between the mode value and the attack mode; Wherein, the device further comprises: A second determination module is configured to input the network attack to be detected into a threat model and output an indicator result; Determining whether the network attack to be detected meets the fourth-level indicators based on the indicator results; When the network attack to be detected meets the four-level indicators, obtaining a risk value of the network attack to be detected; When the network attack to be detected does not meet the four-level indicators, outputting the qualitative result of the network attack to be detected as no attack; The training process of the threat model is as follows: Take logs and traffic as input to extract dimensions and construct data D; Perform clustering algorithm on D and divide it into multiple ; The KNN classification model is used to determine each of the the issue of ownership; The indicator name is determined through the indicator name recognition algorithm to obtain a four-level indicator system; The network attack samples and the four-level indicator system are trained through a machine algorithm to obtain the threat model.

4. An electronic device, characterized in that: It includes a processor and a memory, wherein the memory stores at least one instruction, at least one program, code set or instruction set, and the instruction, the program, the code set or the instruction set is loaded and executed by the processor to implement the security situation attack detection method according to any one of claims 1-2.

5. A non-transitory computer-readable storage medium, characterized in that When the instructions in the storage medium are executed by the processor of the mobile terminal, the mobile terminal is enabled to execute the security posture attack detection method according to any one of claims 1-2.

6. A computer program product, characterized in that When the instructions in the computer program product are executed by a processor of a mobile terminal, the mobile terminal is enabled to execute the security posture attack detection method according to any one of claims 1 to 2.

Images