Network attack trace analysis method and related apparatus

Abstract

Embodiments of the present application provide a network attack tracing analysis method and related device, which relate to the network security technical field, and are used to perform homology tracing analysis on a network attack object, determine a network attack organization, ensure network security, and reduce losses. In the method, a target feature value of a feature field is extracted from network traffic data of a to-be-identified object, the to-be-identified object is a first source device whose access behavior satisfies a network attack behavior condition, and the feature field at least includes a transport layer field and an application layer field; based on a field type of the feature field, a similarity recognition mode matched with the feature field is determined; based on the similarity recognition mode, a similarity between the target feature value and a historical feature value is determined, the historical feature value is obtained from a knowledge base constructed according to a historical network attack object based on the feature field; the historical network attack object is a second source device that has a network attack behavior; and based on the similarity, a network attack organization to which the to-be-identified object belongs is determined.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method and related apparatus for tracing and analyzing network attacks. Background Technology

[0002] With the development of network technology, various types of cyberattacks are emerging in an endless stream. Furthermore, with the continuous updating and evolution of network attack and defense technologies, cyberattacks are increasingly originating from organized actions, exhibiting a trend towards high targeting, high complexity, and high organization. For example, cyberattack targets may launch a series of organized, similar attacks using different Internet Protocol (IP) protocols or by masquerading as different IP addresses, in order to steal information from target devices, infiltrate or alter network information, and thus directly influence the thinking of network users. After a successful cyberattack, it often causes significant losses to the attacked target. Therefore, to counter such organized cyberattacks, it is necessary to conduct source tracing analysis to determine which cyberattack organization the target belongs to, and then develop defense strategies targeting the attack methods used by that organization to ensure the network security of the attacked target.

[0003] In existing technologies, the main methods used for source attribution analysis of network attack targets include: analysis based on audit log data, analysis based on attack samples, and analysis using deep learning. However, audit log analysis struggles to obtain key identity information of network attack targets and the overall network state, ultimately leading to inaccurate source attribution analysis results. Attack sample analysis is susceptible to errors when different network attack groups use the same attack samples, resulting in incorrect target segmentation and affecting the accuracy of source attribution analysis. Deep learning typically uses raw traffic data directly as network input; to maintain a fixed input length, traffic data is often padded with zeros or truncated, affecting feature extraction or causing missing information, ultimately leading to inaccurate source attribution analysis results. Furthermore, this impacts network security and causes losses to the attacked targets.

[0004] Therefore, how to accurately conduct source tracing analysis on network attack targets, identify the network attack organizations to which the network attack targets belong, ensure network security, and reduce losses are technical problems that need to be solved. Summary of the Invention

[0005] This application provides a network attack tracing and analysis method and related apparatus to accurately perform source tracing analysis on network attack targets, that is, to determine the network attack organization to which the network attack target belongs, thereby ensuring network security and reducing losses.

[0006] In a first aspect, embodiments of this application provide a method for tracing and analyzing network attacks, the method comprising:

[0007] Extract target feature values ​​from the network traffic data of the target object; wherein the target object is the first source device whose access behavior meets the conditions of network attack behavior; the feature fields include at least: transport layer fields and application layer fields;

[0008] Based on the field type of the feature field, determine the similarity recognition method that matches the feature field;

[0009] Based on similarity recognition, the similarity between target feature values ​​and historical feature values ​​is determined; where historical feature values ​​are obtained from a knowledge base built based on historical network attack targets, which are second-source devices that have engaged in network attack behavior;

[0010] Based on similarity, the network attack organization to which the object to be identified belongs is determined.

[0011] Secondly, embodiments of this application provide a network attack tracing and analysis device, the device comprising:

[0012] The extraction unit is used to extract target feature values ​​of feature fields from the network traffic data of the object to be identified; wherein the object to be identified is the first source device whose access behavior meets the conditions of network attack behavior; the feature fields include at least: transport layer fields and application layer fields;

[0013] The first determining unit is used to determine the similarity recognition method matching the feature field based on the field type of the feature field;

[0014] The second determining unit is used to determine the similarity between the target feature value and the historical feature value based on the similarity recognition method; wherein the historical feature value is obtained from a knowledge base constructed based on the feature field and the historical network attack object is a second source device that has network attack behavior;

[0015] The third determining unit is used to determine the network attack organization to which the object to be identified belongs based on similarity.

[0016] In one possible implementation, before the extraction unit extracts the feature values ​​of the feature fields from the network traffic data of the object to be identified, the extraction unit is also used for:

[0017] When the target device determines that the object to be identified is engaging in network attack behavior, the first traffic data sent is acquired; the first traffic data includes at least: the port of the target address accessed by the object to be identified;

[0018] Based on the port information of the target address, a probe data packet is constructed and sent to the object to be identified in order to obtain the second traffic data fed back by the object to be identified; the second traffic data includes at least: operation service related information;

[0019] The first and second traffic data are used as network traffic data.

[0020] In one possible implementation, the first determining unit is specifically used for:

[0021] If the field type is string, the similarity recognition method is determined based on the string format;

[0022] If the field type is a list type, the similarity recognition method is: based on the intersection between the target feature value and the historical feature value, and the union between the target feature value and the historical feature value;

[0023] If the field type is numeric, the similarity recognition method is based on the numerical comparison between the target feature value and the historical feature values.

[0024] In one possible implementation, the first determining unit is specifically used for:

[0025] If the string format is a numeric string, the similarity identification method is: character edit distance;

[0026] If the string format is a sequence of text, the similarity recognition method is: character sequence matching;

[0027] If the string format is content text, the similarity recognition method is: cosine similarity based on TF-IDF.

[0028] In one possible implementation, the second determining unit is specifically used for:

[0029] Identify the number of null values ​​among the target feature values ​​and historical feature values ​​to obtain the quantity identification result;

[0030] If the quantity recognition result indicates that neither the target feature value nor the historical feature value is empty, then the similarity between the target feature value and the historical feature value is determined by combining the similarity recognition method.

[0031] In one possible implementation, if the quantity recognition result indicates that both the target feature value and the historical feature value are null, then the similarity between the target feature value and the historical feature value is determined to be 1.

[0032] If the quantity recognition result indicates that there is a null value between the target feature value and the historical feature value, then the similarity between the target feature value and the historical feature value is determined to be 0.

[0033] In one possible implementation, the third determining unit is specifically used for:

[0034] The similarity scores corresponding to each feature field are weighted and summed to determine the overall similarity between the object to be identified and the historical network attack objects;

[0035] The overall similarity is standardized to obtain the target similarity, and the similarity value of the target similarity is within a specified range;

[0036] Based on target similarity, the network attack organization to which the object to be identified belongs is determined.

[0037] In one possible implementation, the third determining unit is specifically used for:

[0038] Based on target similarity, when determining whether the object to be identified joins a preset network attack organization, the modularity gain generated for the preset network attack organization;

[0039] When there is a positive gain in each modular gain, the preset network attack organization corresponding to the maximum positive gain is taken as the network attack organization to which the object to be identified belongs.

[0040] When all module degree gains are negative, a network attack organization is created based on the object to be identified.

[0041] Thirdly, embodiments of this application provide an electronic device, including: a memory and a processor, wherein the memory is used to store a computer program; and the processor is used to execute the computer program to implement the network attack tracing and analysis steps provided in embodiments of this application.

[0042] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the network attack tracing and analysis method provided in embodiments of this application.

[0043] Fifthly, embodiments of this application provide a computer program product, which includes a computer program stored in a computer-readable storage medium; when the processor of an electronic device reads the computer program from the computer-readable storage medium, the processor executes the computer program, causing the electronic device to perform the steps of the network attack tracing and analysis method provided in embodiments of this application.

[0044] The beneficial effects of this application are as follows:

[0045] This application provides a method, apparatus, device, and storage medium for identifying network attack sources, relating to the field of network security technology. In this application embodiment, target feature values ​​of feature fields are first extracted from the network traffic data of the object to be identified. These feature fields include at least transport layer fields and application layer fields. Based on the feature values ​​of the transport layer fields and application layer fields, a source attribution analysis is performed on the object to be identified. Compared to audit log analysis, this method can obtain key identity information of the object to be identified and reveal the global state of the network, thus overcoming the limitations of the limited information provided by audit log analysis. Therefore, when performing source attribution analysis based on richer information, the results are more accurate.

[0046] After obtaining the target feature values ​​of the feature fields, a similarity recognition method is determined based on the field type of the feature fields. Based on this similarity recognition method, the similarity between the target feature value and historical feature values ​​is determined. The object to be identified is the first source device whose access behavior meets the conditions for network attack behavior. The historical feature values ​​are obtained from a knowledge base built based on historical network attack objects, which are the second source devices that exhibited network attack behavior. Based on the similarity, the network attack organization to which the object to be identified belongs is determined. Through similarity recognition and correlation analysis of multiple feature fields, the network attack organization to which the object to be identified belongs is determined, potential network attack objects are identified, the attack source is located, and the identity of the network attack object is revealed, thus achieving network attack object tracing.

[0047] Meanwhile, compared with attack sample-based analysis, the source tracing analysis method provided in this application is based on network traffic data, rather than on the attack tools and attack samples used by the network attack target. This effectively avoids the problem of inaccurate source tracing analysis results caused by different attack organizations using the same attack tools or attack samples. Compared with deep learning methods, it does not require model training, reduces computation, improves efficiency, and directly analyzes the similarity obtained by calculating the feature values ​​of multiple feature fields. It does not require feature extraction, and there is no problem of inaccurate source tracing analysis results caused by inaccurate information extracted during the feature extraction process. It also avoids the problem of insufficient supporting evidence in the source tracing analysis process due to the opaque decision-making process caused by the black-box nature of the model algorithm, resulting in a lack of interpretability and stability of the results.

[0048] In summary, the network attack tracing method provided in this application can accurately perform source tracing analysis on network attack targets, determine the network attack organization to which the network attack target belongs, ensure network security, and reduce losses. Attached Figure Description

[0049] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0050] Figure 1 This is a schematic diagram of an application scenario provided by an embodiment of this application;

[0051] Figure 2 A flowchart of a network attack tracing and analysis method provided in this application embodiment;

[0052] Figure 3 This application provides a schematic diagram of network traffic data captured using the Wireshark tool, as an embodiment of the present application.

[0053] Figure 4 A flowchart illustrating a specific implementation method for network attack tracing and analysis provided in this application embodiment;

[0054] Figure 5 This application provides a schematic diagram illustrating a specific implementation of network attack tracing and analysis.

[0055] Figure 6 A structural diagram of a network attack tracing and analysis device provided in this application embodiment;

[0056] Figure 7 This is a structural diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0057] To make the objectives, technical solutions, and beneficial effects of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0058] The following explanations of some terms used in the embodiments of this application are provided to facilitate understanding by those skilled in the art.

[0059] Grouping analysis, which analyzes whether different cyberattack targets are organized and originate from the same cyberattack target or organization, is a necessary step in cyberattack attribution. Due to the covert and anonymous nature of cyberattacks, few cyberattack targets can directly reveal their identity through behavioral characteristics or other clues. Therefore, grouping analysis is an important research direction for locating attack sources and revealing the identity of cyberattack targets.

[0060] Community detection refers to the process of identifying closely related groups of nodes—i.e., communities—within a given network using algorithms and analytical methods. Community detection can reveal hidden organizational structures, social groups, and information flow patterns within a network, helping us to better understand and analyze complex networks.

[0061] The basic unit of network traffic data is the data packet, which contains the data field to be transmitted and some control information fields, such as HTTP and banner. It can identify basic information about the source device and service, software developers, and the network access status of the source device, providing an effective way to identify and trace the source of network attacks.

[0062] The word “exemplary” as used below means “serving as an example, embodiment, or illustration.” Any embodiment illustrated as an “exemplary” need not be construed as superior to or better than other embodiments.

[0063] The terms "first" and "second" used in this document are for descriptive purposes only and should not be construed as indicating relative importance or implying the number of technical features indicated. Thus, features defined as "first" and "second" may explicitly or implicitly include one or more features. In the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0064] The internet is becoming increasingly important in human production and daily life, which brings with it the need for internet attack and defense technologies. These technologies include internet attacks and internet defenses. Internet attacks are primarily aimed at stealing and exploiting sensitive information for personal gain, while internet defenses aim to prevent internet attacks and thus avoid losses.

[0065] With the continuous updating and evolution of network attack and defense technologies, network attacks are increasingly originating from organized behaviors, exhibiting a trend of high targeting, high complexity, and high organization. For example, network attack targets can launch a series of organized, similar network attack behaviors using different IPs or disguised as different IPs to steal sensitive and confidential information, infiltrate or alter the information carried by the network, thereby directly changing the thinking of the network audience. This poses a serious threat and causes losses to the target; such targets include, but are not limited to, network infrastructure and large enterprises related to energy, electricity, and finance.

[0066] Network defense not only needs to prevent highly disguised and concealed network attacks and identify the unique "identity" of network attack IPs, but also needs to conduct source tracing analysis to deal with the endless stream of other network attacks in order to "know yourself and know your enemy".

[0067] Therefore, for such organized cyberattacks, how to conduct origin tracing analysis and promptly identify potential cyberattack targets are the main research issues. Currently, three methods have been proposed for origin tracing analysis, but each of these methods has its own limitations, as detailed below:

[0068] Method 1: Conduct source tracing analysis based on audit log data to determine the network attack organization to which the network attack target belongs.

[0069] When cyber attackers launch attacks over a network, they leave unique identity and behavioral characteristics in network traffic data, providing a basis for identifying and tracing the attackers. Therefore, source attribution analysis can be performed based on audit logs. However, the information obtained from audit logs is limited and difficult to distinguish between deliberately disguised cyber attackers. For example, network access status information of source devices can be extracted from audit logs, such as network traffic logs captured by gateway devices like Intrusion Detection Systems (IDS). Log systems primarily assist security administrators in source attribution by recording information about hardware, software, and system problems, as well as monitoring events occurring within the system. This passive method of capturing network traffic data often fails to obtain crucial information about source devices and is insufficient to obtain a comprehensive understanding of the network's overall state. As cyberattack organizations increasingly focus on anonymity and deliberate disguise, traditional audit logs alone are insufficient for effectively distinguishing cyber attackers, resulting in low accuracy.

[0070] Method 2: Conduct source tracing analysis based on attack samples to determine the network attack organization to which the network attack target belongs.

[0071] When performing source attribution analysis based on attack samples, attack code is extracted from the samples. Starting with this code, features such as code structure and API calls are extracted, focusing primarily on family-based origins of attack samples. This relies on prior threat intelligence tags for source attribution analysis of attack sample families. However, this approach overlooks the issue of different cyberattack groups using the same attack code. This can lead to situations where cyberattack targets from different groups using the same attack code are grouped under the same organization. Therefore, source attribution analysis of cyberattack targets is not accurate enough and makes it difficult to effectively identify cyberattack targets.

[0072] Method 3: Use deep learning to perform source attribution analysis to determine the network attack organization to which the network attack target belongs.

[0073] With the development of deep learning, more and more people in the industry are using deep learning models (such as convolutional neural networks) to perform source tracing analysis on the features of attack data. These methods typically use raw traffic data directly as network input. To fix the input length, the traffic data is padded with zeros or truncated, which affects feature extraction or leads to missing information, resulting in inaccurate source tracing analysis results. Furthermore, the black-box nature of the model makes the decision-making process opaque, leading to insufficient supporting evidence for source tracing analysis and a lack of interpretability and stability in the decision results.

[0074] Therefore, it is still necessary to explore a network attack attribution analysis method with high accuracy, interpretability and robustness, so as to achieve attribution analysis of network attack targets, further ensure network security and reduce losses.

[0075] In view of this, embodiments of this application provide a network attack tracing and analysis method and related apparatus, which are applied in the field of network security technology, to accurately perform source tracing analysis on network attack targets, that is, to determine the network attack organization to which the network attack target belongs, to ensure network security and reduce losses.

[0076] In this embodiment, target feature values ​​of feature fields are first extracted from the network traffic data of the object to be identified. These feature fields include at least transport layer fields and application layer fields. Based on the feature values ​​of the transport layer fields and application layer fields, a source attribution analysis is performed on the object to be identified. Compared to audit log analysis, this method can obtain key identity information of the object to be identified and the global state of the network, thus overcoming the limitations of the limited information provided by audit log analysis. Therefore, when performing source attribution analysis based on richer information, the results are more accurate.

[0077] After obtaining the target feature values ​​of the feature fields, a similarity recognition method is determined based on the field type of the feature fields. Based on this similarity recognition method, the similarity between the target feature value and historical feature values ​​is determined. The object to be identified is the first source device whose access behavior meets the conditions for network attack behavior. The historical feature values ​​are obtained from a knowledge base built based on historical network attack objects, which are the second source devices that exhibited network attack behavior. Based on the similarity, the network attack organization to which the object to be identified belongs is determined. Through similarity recognition and correlation analysis of multiple feature fields, the network attack organization to which the object to be identified belongs is determined, potential network attack objects are identified, the attack source is located, and the identity of the network attack object is revealed, thus achieving network attack object tracing.

[0078] Meanwhile, compared with attack sample-based analysis, the source tracing analysis method provided in this application is based on network traffic data, rather than on the attack tools and attack samples used by the network attack target. This effectively avoids the problem of inaccurate source tracing analysis results caused by different attack organizations using the same attack tools or attack samples. Compared with deep learning methods, it does not require model training, reduces computation, improves efficiency, and directly analyzes the similarity obtained by calculating the feature values ​​of multiple feature fields. It does not require feature extraction, and there is no problem of inaccurate source tracing analysis results caused by inaccurate information extracted during the feature extraction process. It also avoids the problem of insufficient supporting evidence in the source tracing analysis process due to the opaque decision-making process caused by the black-box nature of the model algorithm, resulting in a lack of interpretability and stability of the results.

[0079] The application scenarios described below are briefly explained. It should be noted that these scenarios are for illustrative purposes only and are not intended to limit the scope of this application. In actual implementation, the technical solutions provided by the embodiments of this application can be flexibly applied based on actual needs.

[0080] See Figure 1 , Figure 1 This is a schematic diagram of an application scenario provided by an embodiment of this application. The application scenario includes: a source device 110, a target device 120, and an identification device 130; and the source device 110, the target device 120, and the identification device 130 can communicate with each other through a communication network.

[0081] In one alternative implementation, the communication network can be a wired network or a wireless network. Therefore, the source device 110 and the target device 120 can be directly or indirectly connected via wired or wireless communication. For example, the source device 110 can be indirectly connected to the target device 120 via a wireless access point, or the source device 110 can be directly connected to the target device 120 via the Internet; this application does not impose any limitations on this. The connection methods between the target device 120 and the identification device 130, and between the identification device 130 and the source device 110, are the same as the connection methods between the source device 110 and the target device 120, and will not be described in detail here.

[0082] Among them, the source device 110 can be a terminal device, including but not limited to mobile phones, tablets, laptops, desktop computers, e-book readers, smart voice interaction devices, smart home appliances, vehicle terminals, and other devices.

[0083] The target device 120 and the identification device 130 can be servers; the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0084] In one possible implementation, source device 110 sends access data to target device 120. When target device 120 determines that source device 110 is engaging in network attack behavior based on the access data, target device 120 sends first traffic data to identification device 130. The first traffic data includes at least the port information of the target address accessed by the source device. Based on the port information of the target address, identification device 130 sends probe packets to source device 110 to obtain second traffic data fed back by source device 110. The second traffic data includes at least operation service-related information. This approach of combining active and passive probing to obtain traffic data, compared to passive network traffic data capture, can obtain key information about the source device, reveal the global state of the network, and provide richer information for the source tracing analysis, ensuring the accuracy of the analysis.

[0085] After acquiring the first and second traffic data, the identification device 130 performs network traffic analysis on the first and second traffic data, extracting target feature values ​​from feature fields. These feature fields include at least transport layer fields and application layer fields. Network traffic analysis is a technique for monitoring and analyzing data flow on a network. It covers the entire process from packet capture to traffic analysis. By monitoring and analyzing network traffic, in-depth insights into network activity can be obtained, including who is accessing what, from where, and what protocols are used. This information is crucial for detecting abnormal activity and potential attacks.

[0086] After the identification device 130 acquires the target feature value of the feature field, it determines the similarity identification method matching the feature field based on the field type. Based on the similarity identification method, it determines the similarity between the target feature value and historical feature values, and further determines the network attack organization to which the object to be identified belongs based on the similarity. Different similarity identification methods are used for different feature fields to obtain the correlation between the object to be identified and historical network attack objects, and further determine the network attack organization to which the object to be identified belongs based on the correlation. The feature field-based similarity identification method proposed in this application can uncover fine-grained correlations between network attack objects hidden behind attack samples, is not affected by homologous attack samples, and has high robustness for network attack tracing analysis. Simultaneously, by analyzing the feature fields in network traffic data to classify network attack organizations, it can effectively distinguish network attack organizations and provide interpretable evidence for network attack organization tracing.

[0087] Therefore, this application provides a network attack tracing analysis method with high accuracy, interpretability, and robustness, which realizes the source tracing analysis of network attack targets, assists security managers in identifying the identity of network attack targets and uncovering potential network attack targets, further improves the efficiency of tracing work, ensures network security, and reduces losses.

[0088] It should be noted that the above application scenarios are shown only to facilitate understanding of the spirit and principles of this application, and the implementation of this application is not limited in any way.

[0089] To further illustrate the technical solutions provided in the embodiments of this application, the network attack tracing and analysis method provided in the exemplary implementation of this application is described below with reference to the accompanying drawings.

[0090] Considering that network attack targets inevitably leave traces in network traffic when launching attacks, it becomes possible to identify and trace network attacks based on network traffic data. Therefore, embodiments of this application provide a method for network attack tracing and analysis based on network traffic data.

[0091] See Figure 2 , Figure 2 A flowchart of a network attack tracing and analysis method provided in this application embodiment includes the following steps:

[0092] Step S200: Extract target feature values ​​of feature fields from the network traffic data of the object to be identified; wherein, the object to be identified is the first source device whose access behavior meets the conditions of network attack behavior; the feature fields include at least: transport layer fields and application layer fields.

[0093] Since network attack attribution analysis is based on network traffic data, the first step is to acquire the network traffic data of the target object. However, considering that in related technologies, analysis based on audit log data passively acquires network traffic data, which often fails to provide crucial information about the target object or the primary source device, making it difficult to obtain a global network status and leading to inaccurate attribution analysis results. Therefore, this application proposes a method combining active probing and passive capture to acquire network traffic data, and further performs network traffic analysis on the acquired data to extract target feature values ​​from feature fields. It should be noted that network traffic analysis is a technique for monitoring and analyzing data flow on a network. It covers the entire process from packet capture to traffic analysis. By monitoring and analyzing network traffic, in-depth insights into network activity can be obtained, including who is accessing what, from where, and what protocols are used. This information is crucial for detecting abnormal activity and potential network attacks.

[0094] In this embodiment of the application, before extracting the feature values ​​of the feature fields from the network traffic data of the object to be identified, the first traffic data sent by the target device when it determines that the object to be identified is engaged in network attack behavior is obtained; the first traffic data includes at least: port information of the target address accessed by the object to be identified; based on the port information of the target address, a probe data packet is constructed and sent to the object to be identified to obtain the second traffic data fed back by the object to be identified; the second traffic data includes at least: operation service related information; the first traffic data and the second traffic data are used as network traffic data.

[0095] In one possible implementation, network traffic data is collected passively, and the Wireshark tool is used to capture and filter transport layer network traffic data online. Alternatively, regular expressions can be used for filtering and selection to extract transport layer network traffic data from the collected data. Transport layer network traffic data includes various protocol information from the transport layer, such as field information transmitted in IP, Transmission Control Protocol (TCP), and Internet Control Message Protocol (ICMP) packets. See [link to relevant documentation]. Figure 3 , Figure 3 This is a schematic diagram of network traffic data information captured using the Wireshark tool, provided as an embodiment of this application; therefore, the traffic behavior characteristics of the object to be identified can be obtained from the network traffic data of the transport layer, that is, the target feature value of the transport layer field can be obtained.

[0096] In one possible implementation, the zgrab2 scanner actively sends constructed probe packets to the target device to perform active scanning. It then obtains application-layer network traffic data from the network traffic data returned by the target device (including protocol content at each layer, retransmission time, etc.). The application-layer network traffic data includes application-layer information transmitted by the source device, such as version information and certificates, banner information, configuration information of various operation services, and user-named fields. Therefore, the application-layer feature field values ​​of the object to be identified can be obtained from the application-layer network traffic data, i.e., the target feature values ​​of the application-layer fields can be obtained.

[0097] Ultimately, the system can analyze characteristic fields (such as banners) in application layer protocol data packets (Hypertext Transfer Protocol, HTTP, File Transfer Protocol, FTP, Simple Mail Transfer Protocol, SMTP) and transport layer protocol data packets (IP, TCP, ICMP, etc.) of network traffic data.

[0098] In this application, in order to obtain more comprehensive information, a combination of active detection and passive capture is used to acquire network traffic data. Through traffic analysis, target feature fields of the object to be identified or the first source device are obtained from multiple feature fields to determine the key information of the source device identity. This can effectively extract the behavioral and identity features of the object to be identified, and further ensure the accuracy of the analysis results.

[0099] In one possible implementation, network traffic data of the object to be identified is input into an IP identity fingerprint collector. By statistically analyzing the frequency, maximum value, and whether the data is empty of different fields in the same source IP traffic data, target feature values ​​for multiple feature fields are obtained. After obtaining the target feature values ​​of the feature fields, the feature fields and target feature values ​​of the object to be identified are stored in a knowledge base, specifically in a knowledge base of related attack assets based on IP indexes. This further enables attacker asset profiling. When the target feature values ​​of the object to be identified are needed, they can be directly retrieved from the knowledge base for subsequent source tracing analysis of the object to be identified.

[0100] It should be noted that IP fingerprinting is a technology that uniquely identifies an IP address by analyzing the source host's data transmission behavior, device information, operating system, and software version on the network. Fingerprints, due to their immutability, uniqueness, and convenience, can be uniquely identified.

[0101] Step S201: Based on the field type of the feature field, determine the similarity recognition method that matches the feature field.

[0102] In this application embodiment, a similarity recognition method is proposed to obtain the association between the object to be identified and other network attack objects. Furthermore, to ensure the accuracy of similarity recognition, a method is proposed to select different similarity recognition methods based on the field type of the target feature value of the feature field. Specifically, the field types mainly include three types: string type, list type, and numeric type; therefore, different similarity recognition methods are selected for string type, list type, and numeric type.

[0103] In one possible implementation, if the field type is string, the similarity assessment method is determined based on the string format. For example, when the field type is string, different string formats correspond to different similarity assessment methods. Specifically, when the string format is a numeric string, the similarity assessment method is character edit distance; when the string format is sequential text, the similarity assessment method is character sequence matching; when the string format is content text, the similarity assessment method is cosine similarity based on Term Frequency-Inverse Document Frequency (TF-IDF). For instance, if the version content string format is a numeric string, character edit distance will be used to determine similarity; if the response content string is content text, cosine similarity based on TF-IDF will be used to determine similarity.

[0104] The following sections will provide detailed explanations of character edit distance, character sequence matching, and cosine similarity based on TF-IDF.

[0105] I. Character edit distance, also known as Levenshtein distance, refers to the minimum number of edit operations required to transform one string into another. Permitted edit operations include replacing one character with another, inserting a character, and deleting a character.

[0106] For example, the edit distance between two strings can be determined using the following formula:

[0107]

[0108] Among them, lev a,b (i,j) represents the edit distance value between string a and string b, that is, the similarity between string a and string b. i represents the i-th character of string a and j represents the j-th character of string b. Both i and j are greater than or equal to 1.

[0109] II. Character sequence matching is used to calculate the degree of matching between two text sequences and quantize the result to the range [0,1]. When the two text sequences are completely identical, the degree of matching is 1, which means they are completely similar. When the two text sequences have no identical segments, the degree of matching is 0, which means they are completely dissimilar.

[0110] For example, first, the sum of the lengths T of all matching segments in the two text sequences is determined, in units of the number of characters. That is, T equals the number of identical characters, not twice the number of characters. Then, based on the sum of the lengths of the matching segments and the lengths of text sequence a and text sequence b, the sequence matching result is determined, specifically the similarity between the lengths of text sequence a and text sequence b. Specifically, the sequence matching result is: Sim = 2 * T / (len(a) + len(b)). When text sequence a and text sequence b are identical, the similarity Sim is 1; when there are no identical segments between text sequence a and text sequence b, the similarity Sim is 0.

[0111] III. Cosine similarity based on TF-IDF is one method for calculating text similarity. First, the TF-IDF algorithm is used to vectorize the two texts into feature vectors. Then, the similarity between the two feature vectors is calculated using the cosine formula. TF-IDF is used to evaluate the importance of words to a sample or sample set, and mainly consists of two parts: Term Frequency (TF) and Inverse Document Frequency (IDF). TF is represented as:

[0112]

[0113] Where, n i,j Indicates the term t i In the content text d j The number of times it appears in ∑ k n k,j Indicates the term t i Total number of times it appears in all content text, TF i,j Indicates the term t i In the content text d j The frequency of occurrence of words in a sentence is considered. However, in real-world text analysis scenarios, some frequently occurring general words may not be very useful for expressing the theme; instead, less frequent words are more likely to express the theme. Therefore, simply using TF for text representation is not appropriate; it is also necessary to calculate IDF. The calculation process of IDF is as follows:

[0114]

[0115] Where |D| represents the number of all content texts, |j:t i ∈d j | indicates that the term t is present i To calculate the number of text items, the denominator needs to be incremented by one to prevent it from being zero. The final TF-IDF result is: TF-IDF = TF * IDF

[0116] By calculating the TF-IDF values ​​of all terms in the content text composed of the feature fields of the object to be identified, and the TF-IDF values ​​of all terms in the content text composed of the feature fields of the historical network attack object, we can obtain the text semantic vector A of the content text composed of the feature fields of the object to be identified and the text semantic vector B of the content text composed of the feature fields of the historical network attack object. Furthermore, the cosine similarity algorithm can be used to calculate the similarity between the two text semantic vectors A and B to determine the similarity between the object to be identified and the historical network attack object in the content text composed of the same feature fields. For example, the similarity identification method is as follows:

[0117] Among them, A i and B i These represent the components of text semantic vector A and text semantic vector B, respectively. The larger the value of cos(θ), the more similar A and B are. Cosine similarity is derived from the cosine of the angle between the two vectors, which reflects the difference in direction between the two text semantic vectors.

[0118] In one possible implementation, if the field type is a list, the similarity recognition method is based on the intersection of the target feature value and the historical feature value, and the union of the target feature value and the historical feature value.

[0119] For example, the Jaccard coefficient is used to calculate the similarity between two lists. By comparing whether the elements in the lists are equal, the intersection and union of list A and list B are obtained respectively. The Jaccard coefficient can be expressed as the ratio of the size of the intersection of list A and list B to the size of the size of the union of list A and list B. The calculation formula is as follows:

[0120]

[0121] Where J(A,B) is the Jaccard similarity value between list A and list B. When both list A and list B are empty, the value of J(A,B) is recorded as 1.

[0122] In one possible implementation, if the field type is numeric, the similarity recognition method is based on a numerical comparison between the target feature value and historical feature values.

[0123] Numerical data types generally have a limited number of characteristic values; therefore, this invention determines their similarity value by directly judging whether they are equal. The calculation method is as follows:

[0124]

[0125] Sim(A,B) is the similarity value between numerical values ​​A and B. If numerical values ​​A and B are equal, the similarity value is 1; otherwise, the similarity value is 0.

[0126] Step S202: Based on the similarity recognition method, determine the similarity between the target feature value and the historical feature value; wherein, the historical feature value is obtained from the knowledge base constructed based on the feature field and the historical network attack object is a second source device that has network attack behavior.

[0127] After obtaining different similarity recognition methods for different target feature values, the similarity between the corresponding target feature value and the historical feature value is determined based on the similarity recognition method. The historical feature value and the target feature value belong to the same feature field, and the historical feature value is the feature value of the feature field extracted after analyzing the network traffic data of historical network attack targets. It should be noted that the method for determining the similarity between the target feature value and the historical feature value can be found in step S201, and will not be repeated here.

[0128] In one possible implementation, when determining the similarity between the target feature value and the historical feature value based on the similarity recognition method, regardless of which similarity recognition method is used, the number of null values ​​in the target feature value and the historical feature value is first identified to obtain the quantity recognition result, and then the determination of whether to use the determined similarity recognition method is made based on the quantity recognition result.

[0129] For example, if the quantity recognition result indicates that neither the target feature value nor the historical feature value is null, then the similarity between the target feature value and the historical feature value is determined by combining the similarity recognition method. If the quantity recognition result indicates that both the target feature value and the historical feature value are null, then the similarity between the target feature value and the historical feature value is determined to be 1. If the quantity recognition result indicates that either the target feature value or the historical feature value is null, then the similarity between the target feature value and the historical feature value is determined to be 0. This avoids the problem of inaccurate similarity recognition results caused by misalignment of feature fields.

[0130] Step S203: Based on similarity, determine the network attack organization to which the object to be identified belongs.

[0131] In one possible implementation, see steps A1 to A3 for a detailed explanation of how to determine the network attack organization to which the object to be identified belongs based on similarity.

[0132] Step A1: The similarity scores corresponding to each feature field are weighted and summed to determine the overall similarity between the object to be identified and the historical network attack object;

[0133] For example, the overall similarity is:

[0134] Similarity = ∑w i v i

[0135] Where i represents the i-th feature field, v is the similarity value between the object to be identified and the historical network attack object corresponding to feature field i, w represents the weight of feature field i, and Similarity represents the comprehensive similarity between the object to be identified and the historical network attack object calculated after weighted integration.

[0136] It should be noted that the weight w can be preset and dynamically adjusted according to actual conditions; the importance ratio of different feature fields to the overall similarity is also calculated using the Gini index, and different weight values ​​w are set for different feature fields. i Furthermore, based on the ability of feature fields to represent the uniqueness of the object to be identified, personalized feature fields can be assigned relatively higher weight values ​​through custom methods, thereby improving interpretability.

[0137] Step A2: Standardize the comprehensive similarity to obtain the target similarity, where the similarity value of the target similarity is within a specified range;

[0138] Because different similarity recognition methods and weight values ​​are used for different feature fields during the similarity recognition stage, the distribution of similarity intervals obtained for different feature fields may be inconsistent. This results in an overly dense distribution of comprehensive similarity, making it difficult to accurately classify subsequent homology tracing analysis. Therefore, it is necessary to consider scaling and reprojecting the comprehensive similarity. Thus, this embodiment of the invention adds a step of standardizing the comprehensive similarity after obtaining it. Based on the already calculated comprehensive similarity, by standardizing all comprehensive similarities (e.g., deviation standardization), the comprehensive similarity is reprojected into the [0,1] interval to obtain the target similarity corresponding to each comprehensive similarity.

[0139] For each overall similarity score, the minimum value is projected to 0, and the maximum value is projected to 1. The standardization process is calculated as follows:

[0140]

[0141] Where, x i Represents the overall similarity to be standardized, {x j} represents a sequence containing all comprehensive similarities, and {x} j The sequence length is n, y i ∈[0,1] represents the pair of x i The transformed target similarity is obtained by standardizing the comprehensive similarity in the comprehensive similarity sequence, resulting in the target similarity corresponding to each comprehensive similarity in the sequence, where the target similarities are y1, y2, ..., y3. n .

[0142] In one possible implementation, to facilitate the determination of the network attack organization to which the object to be identified belongs based on target similarity, after obtaining the target similarity, all the obtained target similarities are stored in a pre-built similarity value database to manage the target similarities in a unified manner, thereby facilitating the subsequent identification of the network attack organization.

[0143] Step A3: Based on target similarity, determine the network attack organization to which the object to be identified belongs.

[0144] In one possible implementation, when determining the network attack organization to which the object to be identified belongs based on target similarity, when determining the object to be identified to join a preset network attack organization based on target similarity, the modularity gain generated for the preset network attack organization is used; when there is a positive gain among the modularity gains, the preset network attack organization corresponding to the largest positive gain is taken as the network attack organization to which the object to be identified belongs; when all modularity gains are negative gains, a network attack organization is created for the object to be identified.

[0145] In this embodiment, a community detection algorithm is used to perform source tracing analysis on the objects to be identified. For example, to analyze the source tracing of the objects to be identified and to classify network attack organizations, the Louvain algorithm and the Leiden algorithm are selected as community segmentation algorithms for source tracing analysis. Specifically, the features of each object are considered as nodes in a community network. For instance, an object to be identified is a node in the community network, and a historical network attack object is another node in the community network. The weights of the edges in the community network represent the target similarity of the features of the two objects, and source tracing analysis is performed on this community network.

[0146] The Louvain algorithm and the Leiden algorithm will be explained in detail below.

[0147] Louvain algorithm

[0148] Louvain achieves clustering by progressively merging nodes, which can quickly and effectively identify hierarchical community structures, thereby dividing large networks into communities. Modularity (denoted as Q) is a key parameter of the algorithm.

[0149] Q is calculated as follows:

[0150]

[0151] In the formula, A ij Let k be the edge weight between any nodes i and j, i.e., the target similarity generated through steps A1-A2. i With k j Let be the sum of the weights of the edges connecting nodes i and j to all their adjacent nodes, respectively, and m represent the total number of edges in the network. Indicates the average edge weight. This represents the difference between the actual structure of the network and the expected structure when randomly combined. c represents the community, c i and c j Let represent the communities where nodes i and j belong, respectively. The function δ indicates that they belong to the same community. When δ = 1, it means that nodes i and j are in the same community. When δ = 0, it means that nodes i and j are not in the same community.

[0152] When dividing a community, the community's modularity needs to be recalculated each time a new node joins a community. The modularity increment (Delta Modularity, denoted as ΔQ) is used to measure the change in community modularity. The calculation method is as follows:

[0153]

[0154] Where ∑in represents the sum of edge weights within the community after a new node joins the community, ∑tot represents the sum of edge weights connected to the community, and k i,in This represents the sum of weights when node i joins community c. The calculation stops when the value of Q no longer changes, indicating that all nodes have been grouped into a giant cluster or that the existing clusters cannot be further merged.

[0155] Therefore, based on the target similarity stored in the constructed similarity value database, there will be an edge between every pair of nodes. When there are enough nodes, this will make the community network graph too large and complex, which is not conducive to community partitioning. Therefore, in order to improve the efficiency of community organization partitioning, this application embodiment sets an edge weight threshold of 0 < θ < 1 to restrict whether a certain edge is loaded into the community network graph. This threshold can be adjusted according to actual needs, and the determination process is shown in the following formula:

[0156]

[0157] Among them, y i Let D(y) be the target similarity value stored in the similarity value database corresponding to the current edge. i The function is used to determine whether the current edge participates in the division of the IP community organization, and finally uses the Louvain algorithm to perform source tracing analysis of IPs.

[0158] Leiden Algorithm

[0159] The community partitioning result obtained using the Louvain algorithm may suffer from poor community connectivity or even complete disconnection. In such cases, the Leiden algorithm can be used for optimization. The Leiden algorithm is also a community detection algorithm that aims to maximize the modularity of the graph. The Leiden algorithm is more efficient than the Louvain algorithm and guarantees that all communities are connected. It recursively merges communities into a single node by greedily optimizing modularity and repeating the process in the compressed graph. It addresses the shortcomings of the Louvain algorithm by periodically and randomly decomposing communities into smaller, well-connected communities.

[0160] The concept of modularity is introduced in the Louvain algorithm. The Leiden algorithm uses an extended modularity formula to handle communities of varying densities:

[0161]

[0162] γ>0 is a resolution parameter that adjusts the connection density within and between communities. When γ>1, more, smaller, and more tightly connected communities will form; when γ<1, fewer, larger, but less tightly connected communities will form.

[0163] Using the above method, the target can be accurately assigned to a network attack organization. If no network attack organization matches the target, a new network attack organization is created for the target and added to the community network.

[0164] See Figure 4 , Figure 4 A flowchart illustrating a specific implementation method for network attack tracing and analysis provided in this application includes the following steps:

[0165] Step S400: A combination of active detection and passive capture is used to obtain network traffic data of the object to be identified.

[0166] It should be noted that the object to be identified is the first source device whose access behavior meets the conditions for network attack behavior, that is, the object to be identified has network attack behavior, or the object to be identified is a suspicious object with network attack behavior.

[0167] Step S401: Extract target feature values ​​from the network traffic data of the object to be identified; the feature fields include at least: transport layer fields and application layer fields.

[0168] Step S402: Based on the field type of the feature field, determine the similarity recognition method for feature field matching; the field type includes at least: string type, list type and numeric type.

[0169] Step S403: For each feature field, based on the determined similarity recognition method, determine the similarity between the target feature value and the historical feature value; the historical feature value is obtained from the knowledge base constructed based on the feature field according to the historical network attack object, which is a second source device that has network attack behavior.

[0170] Step S404: The similarity scores corresponding to each feature field are weighted and summed to determine the overall similarity between the object to be identified and the historical network attack object.

[0171] Step S405: Standardize the comprehensive similarity to obtain the target similarity, where the similarity value of the target similarity is within a specified range.

[0172] Step S406: Based on the target similarity, determine whether there is a historical network attack target that is from the same source as the target to be identified. If so, proceed to step S407; otherwise, proceed to step S408.

[0173] Step S407: Output historical network attack targets from the same source.

[0174] Step S408: Based on target similarity and combined with community detection algorithm, determine whether the object to be identified belongs to an existing network attack organization. If so, proceed to step S409; otherwise, proceed to step S410.

[0175] Step S409: Add the object to be identified to its network attack organization.

[0176] Step S410: Save the object to be identified as a new network attack organization.

[0177] For example, the target feature values ​​of the object to be identified can be used as new information about the network attack organization.

[0178] For ease of understanding, Figure 4 Based on this, a schematic diagram illustrating the specific implementation of network attack attribution analysis is provided. See details below. Figure 5 .

[0179] In this application, firstly, target feature values ​​of feature fields are extracted from the network traffic data of the object to be identified. These feature fields include at least transport layer fields and application layer fields. Then, based on the field type of the feature fields, a similarity recognition method matching the feature fields is determined. Based on this similarity recognition method, the similarity between the target feature value and historical feature values ​​is determined. The object to be identified is the first source device whose access behavior meets the conditions for network attack behavior. The historical feature values ​​are obtained from a knowledge base built based on historical network attack objects, which are the second source devices exhibiting network attack behavior. Finally, based on the similarity, the network attack organization to which the object to be identified belongs is determined. By using similarity recognition and correlation analysis of multiple feature fields, the network attack organization to which the object to be identified belongs is determined, potential network attack objects are identified, the attack source is located, and the identity of the network attack object is revealed, thus achieving network attack object tracing.

[0180] Meanwhile, based on the feature values ​​of the transport layer fields and application layer fields, a source tracing analysis is performed on the objects to be identified. Compared with audit log analysis, this method can obtain key identity information of the objects to be identified and obtain the global state of the network, making up for the limited information provided by audit log analysis and ensuring that the source tracing analysis results are more accurate. Compared with attack sample analysis, source tracing analysis is based on network traffic data, rather than on the attack tools and attack samples used by the network attack objects. This effectively avoids the problem of inaccurate source tracing analysis results caused by different attack organizations using the same attack tools or attack samples. Compared with deep learning methods, it does not require model training, reduces computation, improves efficiency, and directly analyzes the similarity obtained by calculating the feature values ​​of multiple feature fields. There is no need for feature extraction, so there is no problem of inaccurate source tracing analysis results caused by inaccurate information extracted during the feature extraction process. It also avoids the problem of insufficient supporting evidence and lack of interpretability and stability of the source tracing analysis process due to the opaque decision-making process caused by the black-box nature of the model algorithm.

[0181] Furthermore, it should be noted that in the specific embodiments of this application, user-related data is involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0182] Furthermore, although the operations of the method of this application are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0183] Based on the same inventive concept, this application also provides a network attack tracing and analysis device 600, see [link to relevant documentation]. Figure 6 The network attack attribution analysis device 600 includes:

[0184] Extraction unit 601 is used to extract target feature values ​​of feature fields from the network traffic data of the object to be identified; wherein the object to be identified is a first source device whose access behavior meets the conditions of network attack behavior; the feature fields include at least: transport layer fields and application layer fields;

[0185] The first determining unit 602 is used to determine the similarity recognition method matching the feature field based on the field type of the feature field;

[0186] The second determining unit 603 is used to determine the similarity between the target feature value and the historical feature value based on the similarity recognition method; wherein the historical feature value is obtained from a knowledge base constructed based on the feature field and the historical network attack object is a second source device that has network attack behavior.

[0187] The third determining unit 604 is used to determine the network attack organization to which the object to be identified belongs based on similarity.

[0188] In one possible implementation, before the extraction unit extracts the feature values ​​of the feature fields from the network traffic data of the object to be identified, the extraction unit 601 is further configured to:

[0189] The first traffic data sent by the target device when it determines that the target object is engaging in network attack behavior; the first traffic data includes at least: port information of the target address accessed by the target object;

[0190] Based on the port information of the target address, a probe data packet is constructed and sent to the object to be identified in order to obtain the second traffic data fed back by the object to be identified; the second traffic data includes at least: operation service related information;

[0191] The first and second traffic data are used as network traffic data.

[0192] In one possible implementation, the first determining unit 602 is specifically used for:

[0193] If the field type is string, the similarity recognition method is determined based on the string format;

[0194] If the field type is a list type, the similarity recognition method is: based on the intersection between the target feature value and the historical feature value, and the union between the target feature value and the historical feature value;

[0195] If the field type is numeric, the similarity recognition method is based on the numerical comparison between the target feature value and the historical feature values.

[0196] In one possible implementation, the first determining unit 602 is specifically used for:

[0197] If the string format is a numeric string, the similarity identification method is: character edit distance;

[0198] If the string format is a sequence of text, the similarity recognition method is: character sequence matching;

[0199] If the string format is content text, the similarity recognition method is: cosine similarity based on TF-IDF.

[0200] In one possible implementation, the second determining unit 603 is specifically used for:

[0201] Identify the number of null values ​​among the target feature values ​​and historical feature values ​​to obtain the quantity identification result;

[0202] If the quantity recognition result indicates that neither the target feature value nor the historical feature value is empty, then the similarity between the target feature value and the historical feature value is determined by combining the similarity recognition method.

[0203] In one possible implementation, if the quantity recognition result indicates that both the target feature value and the historical feature value are null, then the similarity between the target feature value and the historical feature value is determined to be 1.

[0204] If the quantity recognition result indicates that there is a null value between the target feature value and the historical feature value, then the similarity between the target feature value and the historical feature value is determined to be 0.

[0205] In one possible implementation, the third determining unit 604 is specifically used for:

[0206] The similarity scores corresponding to each feature field are weighted and summed to determine the overall similarity between the object to be identified and the historical network attack objects;

[0207] The overall similarity is standardized to obtain the target similarity, and the similarity value of the target similarity is within a specified range;

[0208] Based on target similarity, the network attack organization to which the object to be identified belongs is determined.

[0209] In one possible implementation, the third determining unit 604 is specifically used for:

[0210] Based on target similarity, when determining whether the object to be identified joins a preset network attack organization, the modularity gain generated for the preset network attack organization;

[0211] When there is a positive gain in each modular gain, the preset network attack organization corresponding to the maximum positive gain is taken as the network attack organization to which the object to be identified belongs.

[0212] When all module degree gains are negative, a network attack organization is created based on the object to be identified.

[0213] It should be noted that although several units (or modules) of the device have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In practice, based on the embodiments of this application, the features and functions of two or more units (or modules) described above can be embodied in one unit (or module). Conversely, the features and functions of one unit (or module) described above can be further divided and embodied by multiple units (or modules). Of course, in implementing this application, the functions of each unit (or module) can also be implemented in one or more software or hardware components.

[0214] In this application embodiment, the term "unit" (or "module") refers to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functions of that module or unit.

[0215] After introducing the network attack tracing and analysis method and apparatus of exemplary embodiments of this application, another exemplary embodiment of this application, an electronic device, will be introduced next.

[0216] Those skilled in the art will understand that aspects of this application can be implemented as systems, methods, or program products. Therefore, aspects of this application can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, collectively referred to herein as a "circuit," "module," or "system."

[0217] In one possible implementation, the electronic device provided in this application embodiment may include at least a processor and a memory. The memory stores a computer program, which, when executed by the processor, causes the processor to perform any step in the network attack tracing and analysis method of various exemplary embodiments in this application.

[0218] In this embodiment, the mechanism of the electronic device can be as follows: Figure 7 As shown, it includes a memory 701, a communication module 703, and one or more processors 702.

[0219] The memory 701 is used to store computer programs executed by the processor 702. The memory 701 may mainly include a program storage area and a data storage area. The program storage area may store the operating system and programs required to run instant messaging functions, etc.; the data storage area may store various instant messaging information and operation instruction sets, etc.

[0220] Memory 701 may be volatile memory, such as random-access memory (RAM); memory 701 may also be non-volatile memory, such as read-only memory, flash memory, hard disk drive (HDD), or solid-state drive (SSD); or memory 701 may be any other medium capable of carrying or storing a desired computer program having the form of instructions or data structures and accessible by a computer, but is not limited thereto. Memory 701 may be a combination of the above-described memories.

[0221] The processor 702 may include one or more central processing units (CPUs) or digital processing units, etc. The processor 702 is used to implement the aforementioned network attack attribution analysis method when it calls the computer program stored in the memory 701.

[0222] The communication module 703 is used to communicate with terminal devices and other servers.

[0223] This application embodiment does not limit the specific connection medium between the memory 701, communication module 703, and processor 702 described above. This application embodiment... Figure 7 The memory 701 and the processor 702 are connected via a bus 704, and the bus 704 is in Figure 7 The diagram uses thick lines to describe the connections between other components; these are for illustrative purposes only and should not be considered limiting. The 704 bus can be divided into address bus, data bus, control bus, etc. For ease of description, Figure 7 It is described using only a thick line, but does not indicate that there is only one bus or one type of bus.

[0224] The memory 701 stores a computer storage medium containing computer-executable instructions for implementing the network attack tracing and analysis method of this application embodiment. The processor 702 is used to execute the network attack tracing and analysis method described above.

[0225] In some possible implementations, aspects of the network attack tracing and analysis method provided in this application can also be implemented in the form of a program product, which includes a computer program. When the program product is run on an electronic device, the computer program is used to cause the electronic device to perform the steps in the network attack tracing and analysis method based on various exemplary embodiments of this application described above.

[0226] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0227] The program product of the embodiments of this application may employ a portable compact disc read-only memory (CD-ROM) and include a computer program, and may run on a computing device. However, the program product of this application is not limited thereto. In this document, the readable storage medium may be any tangible medium that includes or stores a program that may be used by or in conjunction with a command execution system, apparatus, or device.

[0228] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying a readable computer program. This propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting a program for use by or in conjunction with a command execution system, apparatus, or device.

[0229] The computer program included on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0230] Computer programs for performing the operations of this application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The computer program can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0231] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) that include a computer-usable computer program.

[0232] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products based on embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable device, generate instructions for implementing the flowchart. Figure 1 One or more processes and / or boxes Figure 1 A device that specifies a function in one or more boxes.

[0233] These computer program commands may also be stored in a computer-readable storage medium that can direct a computer or other programmable device to function in a particular manner, such that the commands stored in the computer-readable storage medium produce an article of manufacture including command means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function is specified in one or more boxes.

[0234] These computer program instructions can also be loaded onto a computer or other programmable device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions that execute on the computer or other programmable device for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps that specify the function are in one or more boxes.

[0235] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0236] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A network attack attribution analysis method, characterized in that, The method includes: From the network traffic data of the object to be identified, target feature values ​​of feature fields are extracted; wherein, the object to be identified is a first source device whose access behavior meets the conditions of network attack behavior; the feature fields include at least: transport layer fields and application layer fields; Based on the field type of the feature field, determine the similarity recognition method that matches the feature field; Based on the similarity recognition method, the similarity between the target feature value and the historical feature value is determined; wherein, the historical feature value is obtained from a knowledge base constructed based on the feature field and the historical network attack object is a second source device that has engaged in network attack behavior; Based on the similarity, the network attack organization to which the object to be identified belongs is determined; The step of determining the similarity recognition method based on the field type of the feature field includes: If the field type is a string, the similarity recognition method is determined based on the string format; If the field type is a list type, the similarity recognition method is: constructed based on the intersection between the target feature value and the historical feature value, and the union between the target feature value and the historical feature value; If the field type is a numeric type, then the similarity recognition method is constructed based on the numerical comparison between the target feature value and the historical feature value.

2. The method as described in claim 1, characterized in that, Before extracting feature values ​​of feature fields from the network traffic data of the object to be identified, the process also includes: When the target device determines that the access behavior of the object to be identified meets the conditions for network attack behavior, it sends first traffic data; the first traffic data includes at least: port information of the target address accessed by the object to be identified; Based on the port information of the target address, a probe data packet is constructed and sent to the object to be identified to obtain second traffic data fed back by the object to be identified; the second traffic data includes at least: operation service related information; The first traffic data and the second traffic data are used as the network traffic data.

3. The method as described in claim 1, characterized in that, The method for determining the similarity recognition based on string format includes: If the string format is a numeric string, then the similarity recognition method is: character edit distance; If the string format is a sequence of text, then the similarity recognition method is: character sequence matching; If the string format is content text, then the similarity recognition method is: cosine similarity based on TF-IDF.

4. The method as described in claim 1, characterized in that, The step of determining the similarity between the target feature value and historical feature values ​​based on the similarity recognition method includes: Identify the number of null values ​​in the target feature value and the historical feature value to obtain the quantity identification result; If the quantity recognition result indicates that neither the target feature value nor the historical feature value is empty, then the similarity between the target feature value and the historical feature value is determined by combining the similarity recognition method.

5. The method as described in claim 4, characterized in that, The method further includes: If the quantity recognition result indicates that both the target feature value and the historical feature value are empty, then the similarity between the target feature value and the historical feature value is determined to be 1. If the quantity recognition result indicates that there is a null value between the target feature value and the historical feature value, then the similarity between the target feature value and the historical feature value is determined to be 0.

6. The method according to any one of claims 1-5, characterized in that, The step of determining the network attack organization to which the object to be identified belongs based on the similarity also includes: The similarity scores corresponding to each feature field are weighted and summed to determine the overall similarity between the object to be identified and the historical network attack object. The comprehensive similarity is standardized to obtain the target similarity, and the similarity value of the target similarity is within a specified interval; Based on the target similarity, the network attack organization to which the object to be identified belongs is determined.

7. The method as described in claim 6, characterized in that, The step of determining the network attack organization to which the object to be identified belongs based on the target similarity includes: Based on the target similarity, determine the modularity gain generated for the preset network attack organization when the object to be identified joins the preset network attack organization; When there is a positive gain among the various modular gains, the preset network attack organization corresponding to the maximum positive gain is taken as the network attack organization to which the object to be identified belongs; When the gain of each module is negative, a network attack organization is created based on the object to be identified.

8. A network attack tracing and analysis device, characterized in that, The device includes: An extraction unit is used to extract target feature values ​​of feature fields from the network traffic data of an object to be identified; wherein, the object to be identified is a first source device whose access behavior meets the conditions for network attack behavior; the feature fields include at least: transport layer fields and application layer fields; The first determining unit is used to determine a similarity recognition method that matches the feature field based on the field type of the feature field; The second determining unit determines the similarity between the target feature value and the historical feature value based on the similarity recognition method; wherein the historical feature value is obtained from a knowledge base constructed based on the feature field and the historical network attack object is a second source device that has engaged in network attack behavior; The third determining unit is used to determine the network attack organization to which the object to be identified belongs based on the similarity. Specifically, the first determining unit is used for: If the field type is a string, the similarity recognition method is determined based on the string format; If the field type is a list type, the similarity recognition method is: constructed based on the intersection between the target feature value and the historical feature value, and the union between the target feature value and the historical feature value; If the field type is a numeric type, then the similarity recognition method is constructed based on the numerical comparison between the target feature value and the historical feature value.

9. An electronic device, characterized in that, The electronic device includes: a processor and a memory, wherein: The memory is used to store computer programs; The processor is configured to execute the computer program to implement the method described in any one of claims 1-7.

Images