A method and system for identifying malicious IP address blocks using a combination of active and passive methods.

Abstract

The application provides a kind of malicious IP address block identification method and system combined with active and passive.The malicious IP address block identification method combined with active and passive includes the following steps: S1, collect active and passive data, IP address block division module extracts the associated entity, open port / protocol, application details, encryption information, device characteristics and other information of active and passive data, extracts the statistical characteristics of IP address block active and passive data, and uses service stability algorithm to divide the IP with high service similarity into an IP address block;S2, the heterogeneous relationship identification module constructs the heterogeneous relationship of IP address block.The malicious IP address block identification method combined with active and passive provided by the application, compared with the identification method without using the heterogeneous relationship between nodes, only using the heterogeneous relationship between nodes, only using the communication mode of node, under the test of real world constructed data set, the average detection performance of the malicious IP address block identification method based on active and passive data can be improved by 15 to 20 percentage points.

Description

Technical Field

[0001] This invention relates to the field of network security, and in particular to a method and system for identifying malicious IP address blocks that combines active and passive methods. Background Technology

[0002] With the depletion of IPv4 address resources, IP address block leasing services offered by cloud hosting providers are becoming increasingly common. Users lease these IP address blocks to provide similar services, but this has also led to a series of problems, such as malicious users increasingly leasing IP address blocks from reputable hosting providers to host malicious content. This trend results in the abuse and migration of IP address blocks: malicious users often frequently change the hosted IP address within an IP block to evade traditional IP blacklist detection methods. This frequent intra-block migration makes traditional IP blacklist detection ineffective and untimely. Furthermore, it renders coarse-grained AS-level malicious IP address block detection insufficient: existing malicious IP address block identification methods typically employ coarse-grained Autonomous System (AS) level identification, failing to effectively distinguish which IP address blocks from reputable hosting providers are being abused. Effectively identifying malicious IP address blocks from cloud hosting providers has become a challenge for law enforcement. Since users typically use leased IP address blocks to provide similar services, this paper considers designing a method that combines both active and passive IP data to comprehensively characterize the services on IP address blocks, effectively segmenting IP address blocks and identifying IP address blocks hosting malicious services.

[0003] Currently, methods for identifying malicious IPs mainly fall into three categories: IP blacklist-based methods, AS / hosting provider reputation-based methods, and IP address block reputation-based methods. IP blacklist-based methods primarily utilize traffic characteristics and behavioral logs generated by IPs to identify abnormal IPs through classification or clustering. However, these methods often add IPs to the blacklist only after malicious activity has already occurred, resulting in a certain degree of lag. AS / hosting provider reputation-based methods primarily use metadata from all IPs within an AS or hosting provider to calculate the overall maliciousness score of the AS or hosting provider, blacklisting all IPs from low-reputation AS / hosting providers for strict monitoring. This method cannot address the issue of abuse of certain IP address blocks from high-reputation hosting providers. IP address block reputation-based methods assess the reputation of consecutive IP address blocks consisting of IPs hosting similar services or performing similar behaviors. This method can both promptly identify and resolve IPs potentially involved in malicious activity and identify some abused IPs from high-reputation hosting providers. However, existing methods identify IP blocks by using special fields or fixed sizes, which cannot adapt to the dynamic changes of IP blocks and cannot accurately represent them. In terms of IP block malice assessment, they characterize IP block features through single-dimensional data and lack consideration of the correlation between IP blocks, making them easy to circumvent.

[0004] Therefore, it is necessary to provide a method and system for identifying malicious IP address blocks that combines active and passive methods to solve the above-mentioned technical problems. Summary of the Invention

[0005] This invention provides a method and system for identifying malicious IP address blocks that combines active and passive methods, thus solving the problems in the background art.

[0006] To solve the above-mentioned technical problems, the active-passive combined malicious IP address block identification method provided by the present invention includes the following steps:

[0007] S1. Collect active and passive data. The IP address block segmentation module extracts information such as associated entities, open ports / protocols, application details, encryption information, and device characteristics of the active and passive data. It also extracts the statistical characteristics of the active and passive data of the IP address block and uses the service stability algorithm to segment consecutive IPs with high service similarity into one IP address block.

[0008] S2. The heterogeneous relationship identification module constructs the heterogeneous relationships of IP address blocks and uses a graph node classification algorithm to output the probability that the IP address block is a malicious IP address block.

[0009] S3. The communication pattern recognition module uses passive traffic data of IP address blocks to establish communication relationships within IP address blocks and uses a subgraph classification algorithm to identify malicious IP address blocks.

[0010] S4. The fusion identification module combines the outputs of the above two modules to calculate and finally output whether the IP address block is a malicious IP address block.

[0011] A malicious IP address block identification system combining active and passive methods includes: an IP address block segmentation module, a heterogeneous relationship identification module, a communication pattern identification module, and a fusion identification module.

[0012] Preferably, the core of the IP address block partitioning module is to extract multi-dimensional features of the active and passive data of IP and output the partitioning method of IP address blocks.

[0013] Preferably, the specific working content of the IP address block division module is as follows:

[0014] 1) Extract five categories of features from the IP: associated entities, open ports / protocols, application details, encrypted information, and sessions, totaling 120 features, some of which are shown in Table 1. These include: i) the number of all and deduplicated associated domain names of the IP, and the number of associated IPs; character features of all associated domain names of the IP, such as the number of special characters, numbers, and meaningful words in the domain name; ii) the number of open ports of the IP, and the average number of application protocols open per port; iii) the title and icon of the website associated with the IP; iv) SSL / TLS handshake messages, the Subject Alternative Name (SAN) field in the Certificate, and the certificate's effective and expiration times; v) the number of sessions of the IP observed through passive traffic.

[0015] 2) Based on the above data, using the IP address block identification algorithm based on service stability, determine a partitioning method that maximizes the sum of stability of the partitioned IP address blocks.

[0016] 3) IP address block stability is determined based on the contribution of each IP address within the block to the overall stability of the IP address block. The contribution of each IP address to the stability of the IP address block is calculated using both set similarity and numerical similarity.

[0017] 4) Set similarity primarily measures the similarity of text sets between two IPs within the same IP address block, such as the title set of a webpage or the set of encrypted handshake information. For example, if IP_i and IP_j carry service sets service_set(IP_i) and service_set(IP_j) respectively, the numerical statistical characteristics of the service sets are service_val(IP_i) and service_val(IP_j). Set similarity is obtained using Jaccard_sim(service_set(IP_i), service_set(IP_j)) and Edit_sim(service_set(IP_i), service_set(IP_j)).

[0018] 5) Numerical similarity primarily measures the similarity of numerical statistical characteristics between two IPs within the same IP address block, such as the port open protocol ratio. Numerical similarity is obtained through Cos_sim(service_val(IP_i), service_val(IP_j)).

[0019] 6) When the information content of an IP is below the threshold α, the stability contribution of that IP is 0, indicating that whether or not the IP is assigned to a certain IP address block has no impact. When the information content of an IP is above the threshold α, it is determined whether the set similarity and numerical similarity between that IP and the other IPs in the IP block are higher than the threshold β. If the similarity is higher than the threshold β, it means that assigning the IP to a certain IP address block brings a positive contribution; otherwise, it means that it brings a negative contribution. By combining the contribution values ​​of each IP assigned to a certain IP address block, an optimal allocation is determined that maximizes the sum of the stability of all IP blocks.

[0020] Preferably, the core of the heterogeneous relationship identification module is to extract the statistical features and heterogeneous graph relationships of IP active and passive data, and output the probability that the IP address block is malicious.

[0021] Preferably, the specific working content of the heterogeneous relationship identification module is as follows:

[0022] 1) Construct a heterogeneous graph using active and passive IP data. This graph includes four node types (IP address block nodes, server IP nodes, client IP nodes, and domain name nodes) and three edge types (IP address blocks containing server IPs, server IPs carrying domain names, and communication between server IPs and client IPs). Figure 2 As shown.

[0023] 2) Using the active and passive statistical features obtained from the IP address block partitioning module as node features, a heterogeneous graph node classification algorithm is used to predict the probability that an IP address block node is malicious. The specific process of graph node classification is as follows: i) For each node, calculate the mean features of its first-level and second-level neighbors; ii) Fuse the features of the current node with the features of its first-level and second-level neighbors as a new embedding representation of the current node; iii) Perform supervised learning on the nodes after embedding representation, using cross-entropy as the loss function to update the parameters of the backpropagation algorithm; iv) Select different parameters and repeat the above steps 1000 times, selecting the parameters with the best stable performance as the model parameters; v) Perform label propagation to predict the category of unlabeled IP block nodes.

[0024] Preferably, the core of the communication pattern recognition module is to extract each subgraph centered on the IP address block node, and output the probability that the IP address block is malicious by using active and passive data statistical features and adding graph structure-related features.

[0025] Preferably, the specific working content of the communication pattern recognition module is as follows:

[0026] 1) Extract each communication subgraph centered on the IP address block node from the heterogeneous graph obtained from the heterogeneous relationship identification module, and transform the heterogeneous communication subgraph into a homogeneous graph.

[0027] 2) Extract graph structure features such as out-degree and in-degree from the subgraph, and combine them with the statistical features of the nodes. Using a graph classification algorithm, learn the representation of the communication subgraph for each IP address block as the communication pattern of the IP address block. The specific process of graph classification is as follows: i) For each node, calculate the mean features of its first-level and second-level neighbors; ii) Fuse the features of the current node with the features of its first- and second-level neighbors as a new embedding representation of the current node; iii) Aggregate the features of all nodes and edges in the subgraph that have undergone embedding representation as the embedding representation of the subgraph; iv) Perform supervised learning on the subgraph after embedding representation, using cross-entropy as the loss function to update the parameters of the backpropagation algorithm; v) Repeat the above steps 1000 times with different parameters, and select the parameters with the best stable performance as the model parameters; vi) Perform label propagation to predict the category of the unlabeled subgraph.

[0028] Preferably, the fusion identification module utilizes the embedded representation outputs of the heterogeneous relationship identification module and the communication pattern identification module, assigns different weights to the embedded representations of the two modules, fuses the IP block node embedded representation learned by the heterogeneous relationship identification module and the IP block communication subgraph embedded representation learned by the communication pattern identification module, inputs it into the classifier, uses cross-entropy as the loss function, performs parameter updates for the backpropagation algorithm, selects the parameters with the most stable and optimal performance as the model parameters, and finally calculates the probability that the IP address block is a malicious IP address block and outputs the result.

[0029] Preferably, the fusion identification module includes a statistics unit, a classification unit, and a storage unit. The statistics unit is used to count malicious IP addresses and obtain malicious IP address information. The classification unit is used to classify the malicious IP addresses to obtain multiple IP address segments. The storage unit is used to store the malicious IP address segments in a malicious address segment database.

[0030] Compared with related technologies, the active-passive combined malicious IP address block identification method and system provided by the present invention has the following beneficial effects:

[0031] This invention provides a method and system for identifying malicious IP address blocks that combines active and passive methods. Compared with identification methods that do not use heterogeneous relationships between nodes, only use heterogeneous relationships between nodes, or only use node communication modes, the average detection performance of the malicious IP address block identification method based on active and passive data can be improved by 15 to 20 percentage points when tested on a dataset constructed in the real world. Attached Figure Description

[0032] Figure 1 A schematic diagram of the structure of the first embodiment of the active-passive combined malicious IP address block identification method and system provided by the present invention;

[0033] Figure 2 A chart illustrating key features of the IP address block partitioning module in the active-passive combined malicious IP address block identification method and system provided by this invention.

[0034] Figure 3 The heterogeneous graph of the heterogeneous relationship identification module of the active-passive combined malicious IP address block identification method and system provided by the present invention;

[0035] Figure 4 This is a schematic diagram of the structure of the second embodiment of the active-passive combined malicious IP address block identification method and system provided by the present invention. Detailed Implementation

[0036] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0037] First Embodiment

[0038] Please refer to the following: Figure 1 , Figure 2 , Figure 3 ,in, Figure 1 A schematic diagram of the structure of the first embodiment of the active-passive combined malicious IP address block identification method and system provided by the present invention; Figure 2 A chart illustrating key features of the IP address block partitioning module in the active-passive combined malicious IP address block identification method and system provided by this invention. Figure 3 This invention provides a method and system for identifying malicious IP address blocks using a combination of active and passive methods, along with a heterogeneity graph for identifying heterogeneous relationships. The method includes the following steps:

[0039] S1. Collect active and passive data. The IP address block segmentation module extracts information such as associated entities, open ports / protocols, application details, encryption information, and device characteristics of the active and passive data. It also extracts the statistical characteristics of the active and passive data of the IP address block and uses the service stability algorithm to segment consecutive IPs with high service similarity into one IP address block.

[0040] S2. The heterogeneous relationship identification module constructs the heterogeneous relationships of IP address blocks and uses a graph node classification algorithm to output the probability that the IP address block is a malicious IP address block.

[0041] S3. The communication pattern recognition module uses passive traffic data of IP address blocks to establish communication relationships within IP address blocks and uses a subgraph classification algorithm to identify malicious IP address blocks.

[0042] S4. The fusion identification module combines the outputs of the above two modules to calculate and finally output whether the IP address block is a malicious IP address block.

[0043] The core of the malicious IP address block identification method based on active and passive data is to comprehensively characterize the services on an IP address using both active and passive data. IP address blocks are then segmented based on service similarity, and the method is constructed by combining the overall active and passive metadata and communication patterns of these blocks. Based on this, the design of this method mainly includes the following aspects:

[0044] 1) Design basis of IP address block partitioning method: Users who lease IP address blocks will provide similar services. The services on a single IP will change dynamically, but the set of services on an IP address block will remain relatively stable. Services can be characterized by open ports, associated entities, application details, encryption information, device characteristics, etc. in IP active and passive data. Combining different dimensions of IP active and passive data can effectively characterize the similarity between IPs, thereby dividing similar consecutive IPs into IP address blocks.

[0045] 2) Design Basis of the IP Address Block Heterogeneity Relationship Identification Method: Other IP address blocks that frequently communicate with client IPs that are malicious IP address blocks are usually also malicious IP address blocks. Similarly, new IP address blocks appearing after a period of time on domains hosted by malicious IP address blocks are also malicious IP address blocks. Different types of IP address blocks differ in their active and passive data, and these two types of data complement each other. Extracting the corresponding active and passive data statistical features of each IP address block can characterize it. By using the active and passive metadata statistical features as IP address block features and leveraging the heterogeneity relationships between IP address blocks, malicious IP address blocks can be effectively identified.

[0046] 3) Design basis of IP address block communication pattern recognition method: Different types of IP address blocks have different passive observation communication patterns. For example, the communication pattern between the IP address block and the client in SSH attack presents a star pattern pointing to different client IPs, indicating that different IPs in the IP block are trying to connect to different hosts.

[0047] A malicious IP address block identification system combining active and passive methods includes: an IP address block segmentation module, a heterogeneous relationship identification module, a communication pattern identification module, and a fusion identification module.

[0048] The core of the IP address block partitioning module is to extract multi-dimensional features of active and passive IP data and output the partitioning method of IP address blocks.

[0049] The specific working content of the IP address block division module is as follows:

[0050] 1) Extract five categories of features from the IP: associated entities, open ports / protocols, application details, encrypted information, and sessions, totaling 120 features, some of which are shown in Table 1. These include: i) the number of all and deduplicated associated domain names of the IP, and the number of associated IPs; character features of all associated domain names of the IP, such as the number of special characters, numbers, and meaningful words in the domain name; ii) the number of open ports of the IP, and the average number of application protocols open per port; iii) the title and icon of the website associated with the IP; iv) SSL / TLS handshake messages, the Subject Alternative Name (SAN) field in the Certificate, and the certificate's effective and expiration times; v) the number of sessions of the IP observed through passive traffic.

[0051] 2) Based on the above data, using the IP address block identification algorithm based on service stability, determine a partitioning method that maximizes the sum of stability of the partitioned IP address blocks.

[0052] 3) IP address block stability is determined based on the contribution of each IP address within the block to the overall stability of the IP address block. The contribution of each IP address to the stability of the IP address block is calculated using both set similarity and numerical similarity.

[0053] 4) Set similarity primarily measures the similarity of text sets between two IPs within the same IP address block, such as the title set of a webpage or the set of encrypted handshake information. For example, if IP_i and IP_j carry service sets service_set(IP_i) and service_set(IP_j) respectively, the numerical statistical characteristics of the service sets are service_val(IP_i) and service_val(IP_j). Set similarity is obtained using Jaccard_sim(service_set(IP_i), service_set(IP_j)) and Edit_sim(service_set(IP_i), service_set(IP_j)).

[0054] 5) Numerical similarity primarily measures the similarity of numerical statistical characteristics between two IPs within the same IP address block, such as the port open protocol ratio. Numerical similarity is obtained through Cos_sim(service_val(IP_i), service_val(IP_j)).

[0055] 6) When the information content of an IP is below the threshold α, the stability contribution of that IP is 0, indicating that whether or not the IP is assigned to a certain IP address block has no impact. When the information content of an IP is above the threshold α, it is determined whether the set similarity and numerical similarity between that IP and the other IPs in the IP block are higher than the threshold β. If the similarity is higher than the threshold β, it means that assigning the IP to a certain IP address block brings a positive contribution; otherwise, it means that it brings a negative contribution. By combining the contribution values ​​of each IP assigned to a certain IP address block, an optimal allocation is determined that maximizes the sum of the stability of all IP blocks.

[0056] The core of the heterogeneous relationship identification module is to extract the statistical features and heterogeneous graph relationships of IP active and passive data, and output the probability that the IP address block is malicious.

[0057] The specific working content of the heterogeneous relationship identification module is as follows:

[0058] 1) Construct a heterogeneous graph using active and passive IP data. This graph includes four node types (IP address block nodes, server IP nodes, client IP nodes, and domain name nodes) and three edge types (IP address blocks containing server IPs, server IPs carrying domain names, and communication between server IPs and client IPs). Figure 2 As shown.

[0059] 2) Using the active and passive statistical features obtained from the IP address block partitioning module as node features, a heterogeneous graph node classification algorithm is used to predict the probability that an IP address block node is malicious. The specific process of graph node classification is as follows: i) For each node, calculate the mean features of its first-level and second-level neighbors; ii) Fuse the features of the current node with the features of its first-level and second-level neighbors as a new embedding representation of the current node; iii) Perform supervised learning on the nodes after embedding representation, using cross-entropy as the loss function to update the parameters of the backpropagation algorithm; iv) Select different parameters and repeat the above steps 1000 times, selecting the parameters with the best stable performance as the model parameters; v) Perform label propagation to predict the category of unlabeled IP block nodes.

[0060] The core of the communication pattern recognition module is to extract each subgraph centered on the IP address block node, and output the probability that the IP address block is malicious by using active and passive data statistical features and adding graph structure-related features.

[0061] The specific working function of the communication pattern recognition module is as follows:

[0062] 1) Extract each communication subgraph centered on the IP address block node from the heterogeneous graph obtained from the heterogeneous relationship identification module, and transform the heterogeneous communication subgraph into a homogeneous graph.

[0063] 2) Extract graph structure features such as out-degree and in-degree from the subgraph, and combine them with the statistical features of the nodes. Using a graph classification algorithm, learn the representation of the communication subgraph for each IP address block as the communication pattern of the IP address block. The specific process of graph classification is as follows: i) For each node, calculate the mean features of its first-level and second-level neighbors; ii) Fuse the features of the current node with the features of its first- and second-level neighbors as a new embedding representation of the current node; iii) Aggregate the features of all nodes and edges in the subgraph that have undergone embedding representation as the embedding representation of the subgraph; iv) Perform supervised learning on the subgraph after embedding representation, using cross-entropy as the loss function to update the parameters of the backpropagation algorithm; v) Repeat the above steps 1000 times with different parameters, and select the parameters with the best stable performance as the model parameters; vi) Perform label propagation to predict the category of the unlabeled subgraph.

[0064] The fusion identification module utilizes the embedded representations output from the heterogeneous relationship identification module and the communication pattern identification module, assigning different weights to the embedded representations of the two modules. It integrates the IP block node embedded representation learned by the heterogeneous relationship identification module and the IP block communication subgraph embedded representation learned by the communication pattern identification module, inputs them into the classifier, uses cross-entropy as the loss function, performs backpropagation algorithm parameter updates, selects the parameters with stable and optimal performance as model parameters, and finally calculates the probability that the IP address block is a malicious IP address block, outputting the result.

[0065] Compared with related technologies, the active-passive combined malicious IP address block identification method and system provided by the present invention has the following beneficial effects:

[0066] Compared with identification methods that do not employ heterogeneous relationships between nodes, employ only heterogeneous relationships between nodes, and employ only node communication patterns, the average detection performance of the malicious IP address block identification method based on active and passive data can be improved by 15 to 20 percentage points when tested on a real-world constructed dataset.

[0067] Second Embodiment

[0068] Please refer to the following: Figure 4 Based on the active-passive combined malicious IP address block identification method and system provided in the first embodiment of this application, the second embodiment of this application proposes another active-passive combined malicious IP address block identification method and system. The second embodiment is merely a preferred embodiment of the first embodiment, and the implementation of the second embodiment will not affect the separate implementation of the first embodiment.

[0069] Specifically, the difference between the active and passive combined malicious IP address block identification method and system provided in the second embodiment of this application is that the fusion identification module includes a statistics unit, a classification unit, and a storage unit. The statistics unit is used to count malicious IP addresses and obtain malicious IP address information; the classification unit is used to classify the malicious IP addresses to obtain multiple IP address segments; and the storage unit is used to store the malicious IP address segments in a malicious address segment database.

[0070] Compared with related technologies, the active-passive combined malicious IP address block identification method and system provided by the present invention has the following beneficial effects:

[0071] It enables malicious query detection of any IP address with high detection efficiency, is suitable for high-concurrency IP address detection, and can perform statistical classification, storing the malicious IP address ranges in a malicious address range database for easy later tracing, making the identification of network attacks more accurate.

[0072] The above description is merely an embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent structural or procedural transformations made based on the content of the present invention specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A method for identifying a malicious IP address block by combining active and passive methods, characterized in that, The method comprises the following steps: S1, collecting active and passive data, the IP address block division module extracts the associated entities, open ports / protocols, application details, encryption information, and device feature information of the active and passive data, extracts the statistical characteristics of the IP address block active and passive data, and divides the IP with high service similarity into an IP address block by using a service stability algorithm; S2, the heterogeneous relationship identification module constructs the heterogeneous relationship of the IP address block, and outputs the probability of the IP address block being a malicious IP address block by using a graph node classification algorithm; S3, the communication mode identification module establishes the communication relationship within the IP address block by using the passive flow data of the IP address block, and identifies the malicious IP address block by using a subgraph classification algorithm; S4, the fusion identification module comprehensively calculates the outputs of the two modules to finally output whether the IP address block is a malicious IP address block; The fusion identification module uses the embedding representation outputs of the heterogeneous relationship identification module and the communication mode identification module, assigns different weights to the embedding representations of the two modules, fuses the IP block node embedding representation learned by the heterogeneous relationship identification module and the IP block communication subgraph embedding representation learned by the communication mode identification module, inputs them into a classifier, uses cross entropy as a loss function, performs parameter update by using a back propagation algorithm, selects the optimal parameters with stable effects as model parameters, finally calculates the probability of the IP address block being a malicious IP address block, and outputs the result.

2. A system for identifying a malicious IP address block based on a combination of active and passive methods according to claim 1, characterized in that, It comprises: an IP address block division module, a heterogeneous relationship identification module, a communication mode identification module, and a fusion identification module.

3. The system of claim 2, wherein, The core of the IP address block division module is to extract the multi-dimensional characteristics of the active and passive data of the IP, and output the division mode of the IP address block.

4. The system of claim 3, wherein, The specific working content of the IP address block division module is as follows: 1) Extract five types of features of IP associated entities, open ports / protocols, application details, encryption information, and sessions, a total of 120; including: i) the number of all and de-duplicated associated domain names of the IP, the number of associated IPs; the character features of all associated domain names of the IP, the number of special characters in the domain name, the number of digits, and the number of meaningful words; ii) the number of open ports of the IP, the average number of application protocols opened per port; iii) the Title and Icon of the associated Web site of the IP; iv) the SSL / TLS handshake message, the Subject Alternative Name field in the Certificate, the certificate validity time and the expiration time; v) the number of sessions observed by the passive flow to the IP; 2) Based on the above data, an IP address block identification algorithm based on service stability is used to determine a division mode to maximize the stability sum of the IP address block obtained by division; 3) The stability of the IP address block is derived according to the stability contribution of each IP to the IP address block; the stability contribution of each IP to the IP address block is calculated by set similarity and numerical similarity. 4) Set similarity measures the similarity of the text set of two IPs in the same IP address block, the Title set of Web pages, the set of encrypted handshake information; the service set carried on IP_i and IP_j respectively is service_set(IP_i) and service_set(IP_j), and the numerical statistical characteristics of the service set are service_val(IP_i) and service_val(IP_j); the set similarity is obtained through Jaccard_sim(service_set(IP_i), service_set(IP_j)) and Edit_sim(service_set(IP_i), service_set(IP_j)); 5) Numerical similarity measures the similarity of the numerical statistical characteristics of two IPs in the same IP address block, the port opening protocol ratio; the numerical similarity is obtained through Cos_sim(service_val(IP_i), service_val(IP_j)); 6) When the information amount of an IP is lower than the threshold value a, the stability contribution of the IP is 0, which indicates that whether the IP is divided into a certain IP address block has no influence; when the information amount of an IP is higher than the threshold value a, it is judged whether the set similarity and the numerical similarity of the IP and the remaining IPs in the IP block are higher than the threshold value b, if the similarity is higher than the threshold value b, it is indicated that dividing the IP into a certain IP address block brings positive contribution, otherwise, it is indicated that it brings negative contribution; the contribution value of each IP divided into a certain IP address block is integrated to determine an optimal division to make the sum of the stability of all IP blocks highest.

5. The system of claim 2, wherein, The core of the heterogeneous relationship identification module is to extract the statistical characteristics of IP active and passive data and the heterogeneous graph relationship, and output the probability that the IP address block is malicious.

6. The system of claim 5, wherein, The specific working content of the heterogeneous relationship identification module is as follows: 1) A heterogeneous graph is constructed by using IP active and passive data, and the heterogeneous graph contains four kinds of node types and three kinds of edge types; 2) The active and passive statistical characteristics obtained by the IP address block division module are used as node characteristics, and the probability that the IP address block node is malicious is predicted by using the heterogeneous graph node classification algorithm; the specific process of graph node classification is as follows: i) for each node, the feature mean of the first-level neighbor node and the second-level neighbor node of the node is calculated respectively; ii) the features of the current node and the first-level and second-level neighbor nodes are fused as the new embedding representation of the current node; iii) the nodes after embedding representation are subjected to supervised learning, cross entropy is selected as the loss function, and the parameter update of the back propagation algorithm is performed; iv) different parameters are selected, the above steps are repeated for 1000 times, and the optimal parameters with stable effect are selected as the model parameters; v) label propagation is performed to predict the category of the unmarked IP block node.

7. The system of claim 2, wherein, The core of the communication mode identification module is to extract each subgraph centered on the IP address block node, and output the probability that the IP address block is malicious by using the active and passive data statistical characteristics and adding the graph structure related characteristics.

8. The system of claim 7, wherein, The specific working content of the communication mode identification module is as follows: 1) extract each IP address block node-centered communication subgraph from the heterogeneous graph obtained from the heterogeneous relationship identification module, and convert the heterogeneous communication subgraph into a homogeneous graph; 2) extract the out-degree and in-degree graph structure features of the subgraph, and combine the statistical features of the nodes; learn the representation of each IP address block communication subgraph as the communication mode of the IP address block using a graph classification algorithm; the specific process of the graph classification is as follows: i) for each node, calculate the feature mean of the first-level neighbor nodes and the second-level neighbor nodes of the node, respectively; ii) fuse the features of the current node and the first-level and second-level neighbor nodes as the new embedded representation of the current node; iii) aggregate the node and edge features of all the embedded nodes in the subgraph as the embedded representation of the subgraph; iv) perform supervised learning on the embedded subgraph, use cross-entropy as the loss function, and perform parameter update through the back propagation algorithm; v) select different parameters, repeat the above steps for 1000 times, and select the optimal parameters with stable effect as the model parameters; vi) perform label propagation to predict the category of the unlabeled subgraph.

9. The system of claim 2, wherein, The fusion identification module includes a statistical unit, a classification unit and a storage unit, the statistical unit is used for counting malicious IP addresses and obtaining malicious IP address information; the classification unit is used for classifying the malicious IP addresses by addresses to obtain a plurality of IP address segments, and the storage unit is used for storing the malicious IP address segments in a malicious address segment database.

Images