Information detection method and device, equipment and storage medium

Abstract

The application relates to the technical field of network security, and provides an intelligence detection method, device and equipment and a storage medium. The intelligence detection method can comprise the following steps: obtaining a to-be-detected log of a network device; matching the to-be-detected log with an intelligence library, and if matching, determining attack feature information from the to-be-detected log; the intelligence library stores intelligence related to network attacks; expanding the attack feature information to obtain target attack feature information after expansion; and determining intelligence of attack behavior information in the to-be-detected log according to the target attack feature information. The method can improve the accuracy and detection efficiency of the intelligence of the to-be-detected log.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to an intelligence detection method and device, equipment and a storage medium. BACKGROUND

[0002] With the rapid development of computer and Internet technology, network security problems also constantly occur. Attackers can perform various attack behaviors on network devices, and the related attack information of various attack behaviors can appear in network data streams in various styles. Therefore, it is necessary to detect the intelligence of attack information from the network data stream to maintain network security.

[0003] In related technologies, in order to detect threat attack information from network data streams, manual assistance is often required, that is, an operator is required to judge the intelligence accuracy of attack information, so that the detection efficiency is low. If the manual assistance is removed, the intelligence accuracy is low. Therefore, the related technologies cannot balance the intelligence accuracy and detection efficiency of attack information. SUMMARY

[0004] The purpose of the embodiments of the present application is to provide an intelligence detection method, device, equipment and storage medium to improve the above technical problems.

[0005] To achieve the above purpose, the present application provides the following technical solutions:

[0006] In a first aspect, the embodiments of the present application provide an intelligence detection method, comprising: obtaining a to-be-detected log of a network device; matching the to-be-detected log with an intelligence library, if matching, determining attack feature information from the to-be-detected log; the intelligence library stores intelligence related to network attacks; expanding the attack feature information to obtain target attack feature information after expansion; determining the intelligence of attack behavior information in the to-be-detected log according to the target attack feature information. In this way, the known attack feature information in the to-be-detected log is first detected based on the intelligence library, and then the target attack feature information with unknown information is detected, thereby realizing progressive intelligence detection, gradually optimizing the detection result, and improving the accuracy of intelligence detection for the to-be-detected log. In addition, the operator can not participate in the entire detection process, thereby improving the detection efficiency. Therefore, the accuracy and detection efficiency of the to-be-detected log can be considered.

[0007] Optionally, the logs to be detected include alarm logs and original logs; the original logs are logs directly generated by the network device, and the alarm logs are logs obtained by processing the original logs by the network device; and the matching of the logs to be detected with the intelligence database, if matched, determining attack feature information from the logs to be detected, includes: matching the alarm logs with intelligence in a first intelligence database, if matched, determining corresponding attack feature information from the alarm logs; matching the original logs with intelligence in a second intelligence database, if matched, determining corresponding attack feature information from the original logs; and the second intelligence database is different from the first intelligence database. In this way, the alarm logs and the original logs are jointly used, the input data and the output data of the network device can be more comprehensively covered, the data range of detection is improved, and thus the detection accuracy is improved. In addition, the original logs and the alarm logs are processed by using different intelligence databases, so that the original logs and the alarm logs can be adaptively matched respectively, so as to speed up the matching rate and improve the detection efficiency.

[0008] Optionally, the first intelligence database includes a whitelist intelligence database, a first compromised intelligence database and / or a first IP credit intelligence database; the whitelist intelligence database stores intelligence of whitelist devices, the first compromised intelligence database stores intelligence of compromised objects, and the first IP credit intelligence database stores intelligence of IP credit loss; and the matching of the alarm logs with intelligence in the first intelligence database, if matched, determining corresponding attack feature information from the alarm logs, includes: matching the alarm logs with the whitelist intelligence database, if not matched with the whitelist intelligence database, matching the alarm logs with the first compromised intelligence database and / or the first IP credit intelligence database, if matched with the first compromised intelligence database and / or the first IP credit intelligence database, extracting the attack feature information from the alarm logs; wherein if the matching result of the alarm logs with the whitelist intelligence database indicates that there is no whitelist device information in the alarm logs, it is determined that the alarm logs are not matched with the whitelist intelligence database; if the matching result of the alarm logs with the first compromised intelligence database indicates that there is information of compromised objects in the alarm logs, it is determined that the alarm logs are matched with the first intelligence database; and if the matching result of the alarm logs with the first IP credit intelligence database indicates that there is information of untrustworthy IP in the alarm logs, it is determined that the alarm logs are matched with the first intelligence database. In this implementation, the alarm logs can be diversified detected by using the above whitelist intelligence database, the first compromised intelligence database and the first IP credit intelligence database, so as to improve the intelligence accuracy for the alarm logs.

[0009] Optionally, the second information base comprises a custom information base, a second compromised information base and / or a second IP reputation information base; the custom information base stores custom information, the second compromised information base stores information of compromised objects, and the second IP reputation information base stores information of IP reputation compromise; and the matching of the original log with information in the second information base, if matched, determines corresponding attack feature information from the original log, comprises: matching the original log with the custom information base, if the matching result shows that there is information of suspected attack on the device in the original log, it is determined that the original log is matched with information in the second information base; and / or matching the original log with the second compromised information base, if the matching result shows that there is information of compromised objects in the original log, it is determined that the original log is matched with information in the second information base; and / or matching the original log with the second IP reputation information base, if the matching result shows that there is information of compromised IP in the original log, it is determined that the original log is matched with information in the second information base. In this way, the original log can be diversifiedly detected by the custom information base, the second compromised information base and the second IP reputation information base, and the accuracy of information for the original log is improved.

[0010] Optionally, the determining of the information of attack behavior in the to-be-detected log according to the target attack feature information comprises: extracting a feature from the target attack feature information; and detecting the feature using a rule set, if the detection result shows that the feature conforms to a rule in the rule set, it is determined that there is attack behavior information in the to-be-detected log. In this way, the feature in the target attack feature information can be accurately and quickly detected by the expert knowledge in the rule set, thereby improving the accuracy and detection efficiency of the information for the to-be-detected log.

[0011] Optionally, the determining of the information of attack behavior in the to-be-detected log according to the target attack feature information further comprises: in the case that the feature does not conform to any rule in the rule set, determining a confidence that there is attack behavior information in the to-be-detected log based on the target attack feature information by using a machine learning model; and determining whether there is attack behavior information in the to-be-detected log according to the confidence. In this way, in the case that the target attack feature information does not conform to any rule in the rule set, whether there is attack behavior information in the to-be-detected log can be determined by the machine learning model, the machine learning model has good generalization ability and can capture new or variant threats that cannot be covered by rules. Therefore, the target attack feature information can be more comprehensively detected, and the process does not require human assistance, thereby improving the detection efficiency and detection accuracy.

[0012] Optionally, the determining whether the attack behavior information exists in the to-be-detected log according to the confidence degree comprises: if the confidence degree is greater than an upper confidence degree threshold, determining that the attack behavior information exists in the to-be-detected log; if the confidence degree is less than a lower confidence degree threshold, determining that the attack behavior information does not exist in the to-be-detected log; and if the confidence degree is between the upper confidence degree threshold and the lower confidence degree threshold, determining that the attack behavior information is suspected to exist in the to-be-detected log.

[0013] In a second aspect, an intelligence detection apparatus is provided, comprising: an obtaining module configured to obtain a to-be-detected log of a network device; a matching module configured to match the to-be-detected log with an intelligence library, and if matching, determine attack feature information from the to-be-detected log; the intelligence library stores intelligence related to network attacks; an expanding module configured to expand the attack feature information to obtain expanded target attack feature information; and a determining module configured to determine intelligence of attack behavior information in the to-be-detected log according to the target attack feature information. In this way, the accuracy of intelligence of the to-be-detected log and the detection efficiency can be taken into account.

[0014] In a third aspect, an electronic device is provided, comprising: a memory and a processor, the memory stores computer program instructions, and the computer program instructions are read and run by the processor to execute the method provided in the possible implementation manner of the first aspect.

[0015] In a fourth aspect, a computer readable storage medium is provided, the computer readable storage medium stores computer program instructions, and the computer program instructions are read and run by a processor to execute the method provided in the possible implementation manner of the first aspect.

[0016] In a fifth aspect, a computer program product is provided, comprising computer program instructions, and the computer program instructions are read and run by a processor to execute the method provided in the possible implementation manner of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope, and for the ordinary person skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0018] Figure 1 A flowchart of an intelligence detection method provided by the embodiments of the present application;

[0019] Figure 2 A structural block diagram of an intelligence detection device provided by an embodiment of the present application is provided.

[0020] Figure 3 A structural schematic diagram of an electronic device for performing an intelligence detection method provided by an embodiment of the present application is provided. DETAILED DESCRIPTION

[0021] The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0022] The term “comprising” or “including” or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or further includes elements inherent to such a process, method, article or device. Without more limitations, the element defined by the phrase “comprising a” does not exclude the presence of additional identical elements in the process, method, article or device including the element.

[0023] The terms “first”, “second” and the like are only used to distinguish one entity or operation from another entity or operation, and cannot be understood as indicating or implying relative importance, nor can it be understood as requiring or implying any such actual relationship or order between the entities or operations.

[0024] Please refer to Figure 1 , which shows a flowchart of an intelligence detection method provided by an embodiment of the present application. It should be noted that the above intelligence detection method can be applied to a server, a server cluster or a cloud platform capable of information processing. For the convenience of writing, the following of the present application takes the application to the cloud platform as an example.

[0025] As Figure 1 shown, the intelligence detection method can include the following steps 101 to 104:

[0026] Step 101, obtaining a log to be detected of a network device;

[0027] The above network device can be a network security device, or a device protected by the network security device. Herein, no limitation is made. The above network security device may, for example, include a firewall, an intrusion detection system (IDS), an intrusion prevention system (IPS), etc.

[0028] The to-be-detected log is a log related to the network device. For example, the to-be-detected log can include a security log, an access log, a diagnostic log, and the like of the network device.

[0029] In some application scenarios, after obtaining the to-be-detected log, the cloud platform can further perform preprocessing operations such as uniform formatting, defining uniform meanings, and the like on the to-be-detected log, so as to speed up the subsequent detection process.

[0030] In step 102, the to-be-detected log is matched with the intelligence library, and if matched, attack feature information is determined from the to-be-detected log; the intelligence library stores intelligence related to network attacks;

[0031] The intelligence related to network attacks stored in the intelligence library can include, for example, intelligence of real existing attack information, intelligence of suspected existing attack information, and intelligence of non-existing attack information, and the like. For example, the intelligence can include that a malicious field B exists in a query statement A, IP (Internet Protocol, IP for short) address information of an attacker, domain name information of the attacker, and the like.

[0032] In some application scenarios, when the cloud platform matches the to-be-detected log with the intelligence library, the to-be-detected log can be compared with the intelligence stored in the intelligence library. If the information in the to-be-detected log exists in the intelligence library, it can be determined that the two are matched.

[0033] In the case where the to-be-detected log is matched with the intelligence library, the cloud platform can determine attack feature information from the to-be-detected log. The attack feature information is feature information left by an attack behavior. For example, the attack feature information can include related feature information of an IOC (Indicator of Compromise, IOC for short), malicious activity indicators, security event indicators, attack methods and techniques, attack impact ranges, and the like. Further, the attack feature information can include, for example, a server IP address of an attacker, a website for spreading malicious information, a file hash value of a malicious file, a registry key value, digital certificate information, and the like.

[0034] In step 103, the attack feature information is expanded to obtain extended target attack feature information.

[0035] In some application scenarios, when the attack feature information is expanded, the cloud platform can associate the attack feature information with other information related thereto, so as to obtain target attack feature information with more content, and identify attack behavior information in a deeper level. For example, the attack feature information is associated with relevant sample information, a Payload (attack payload) of an original log, metadata (such as log source, log generation time, etc.) in a log to be detected, a security report of a network device and a report generation time, a task code involved, a URL (Uniform Resource Locator, URL for short), and other information. For another example, if the attack feature information is an IP address of an attacker's server, the IP address is associated with identity information of a user using the server. The other information associated with the attack feature information can not be from the current log to be detected, that is, unknown information for the current log to be detected.

[0036] In step 104, intelligence of attack behavior information in the log to be detected is determined according to the target attack feature information.

[0037] The intelligence of attack behavior information may, for example, include intelligence such as whether attack behavior information exists, IP information of an attacker, and attack means.

[0038] In some application scenarios, intelligence of attack behavior information in a log to be detected may be determined, for example, by detecting whether the target attack feature information conforms to a rule in a rule set. Alternatively, the target attack feature information is input into a machine learning model, so as to determine intelligence of attack behavior information in the log to be detected by using the machine learning model.

[0039] In the implementation manner, intelligence of a log to be detected can be preliminarily determined by matching the log to be detected with an intelligence library, and intelligence of the log to be detected is further detected by using target attack feature information corresponding to the log to be detected, so as to further determine intelligence of the log to be detected. The detection based on the intelligence library is mainly directed to known attack feature information in the log to be detected, and the attack feature information is further expanded to include more unknown information, so that the target attack feature information including the unknown information can be further detected, so as to gradually optimize the detection result and improve the accuracy of intelligence of the log to be detected. In addition, an operator can not participate in the entire detection process, so as to improve the detection efficiency. Therefore, the implementation manner takes into account the accuracy of intelligence of a log to be detected and detection efficiency.

[0040] In some optional implementation manners, the log to be detected includes an alarm log and an original log. The original log is a log directly generated by a network device, and the alarm log is a log obtained by processing the original log by the network device.

[0041] In some application scenarios, if the network device is a network security device, the original log is original data input by the protected device into the network security device, and the alarm log is data obtained after the network security device processes the input original data.

[0042] In other application scenarios, if the network device is a protected device, the original log is original data recorded by the protected device itself, and the alarm log is data obtained after the protected device processes the original data.

[0043] That is, the original log is original data that has not been processed by the network device, and the alarm log is data processed by the network device.

[0044] Thus, the matching of the to-be-detected log with the intelligence library in step 102 described above, if matched, determines attack feature information from the to-be-detected log, including the following sub-steps:

[0045] Sub-step 1021, matching the alarm log with intelligence in the first intelligence library, if matched, determining corresponding attack feature information from the alarm log;

[0046] Sub-step 1022, matching the original log with intelligence in the second intelligence library, if matched, determining corresponding attack feature information from the original log.

[0047] That is, the above-mentioned intelligence library can include a first intelligence library and a second intelligence library. Intelligence in the first intelligence library is used to detect whether there is attack behavior information in the alarm log, and intelligence in the second intelligence library is used to detect whether there is attack behavior information in the original log. Intelligence in the first intelligence library can be completely different or partially different from intelligence in the second intelligence library.

[0048] Further, since the alarm log is a log output by the network device, its information content is usually less than that of the original log. Therefore, the two intelligence libraries can select different matching strategies according to the corresponding logs. For example, in order to improve the matching efficiency, the first intelligence library can be used for precise matching of the alarm log, and the second intelligence library can be used for fuzzy matching of the original log. Or, the first intelligence library is used to more accurately match the alarm log and less fuzzy match, and the second intelligence library is used to more fuzzy match the original log and less accurate match, which is not specifically limited here.

[0049] The process of the precise matching can be determining whether a certain information item extracted from the alarm log is consistent with the intelligence in the first intelligence library. If consistent, it is determined that the two are matched, otherwise, it is determined that the two are not matched. The process of the fuzzy matching can be whether the original log contains the intelligence in the second intelligence library. If yes, it is determined that the two are matched, otherwise, it is determined that the two are not matched.

[0050] In the present implementation, the alarm log and the original log are jointly used, which can more comprehensively cover the input data and the output data of the network device, improve the data range of detection, and thus improve the accuracy of detection. In addition, since the original log and the alarm log are processed by using different intelligence libraries, the original log and the alarm log can be adaptively matched respectively, so as to accelerate the matching rate and improve the detection efficiency.

[0051] In some optional implementations, the first intelligence library includes a white list intelligence library, a first compromised intelligence library, and / or a first IP reputation intelligence library. The white list intelligence library stores intelligence of white list devices, the first compromised intelligence library stores intelligence of compromised objects, and the first IP reputation intelligence library stores intelligence of IP reputation untrustworthiness.

[0052] The white list device is a trusted device which does not perform attack behavior. Therefore, the intelligence of the white list device stored in the white list intelligence library is the intelligence of the trusted device, which can include, for example, IP address, domain name and other information of the trusted device. If the alarm log matches the white list intelligence library, it can be determined that there is no attack behavior information in the alarm log, so that it is not necessary to determine attack feature information from the alarm log. If the alarm log does not match the white list intelligence library, it can be determined that there is attack behavior information in the alarm log with high probability.

[0053] The intelligence stored in the first compromised intelligence library can include, for example, compromised object information such as compromised domain name and compromised IP. It should be noted that if a device that is originally normal or originally trusted has been controlled or utilized by an attacker to perform malicious activities, the intelligence of the device is stored in the first compromised intelligence library. Therefore, if the alarm log matches the first compromised intelligence library, it means that there is attack behavior information in the alarm log with high probability.

[0054] The intelligence stored in the first IP reputation intelligence library is the information of low reputation of IP addresses of devices. Therefore, the devices corresponding to these IP addresses will perform attack behavior with high probability. Therefore, if the alarm log matches the first IP reputation intelligence library, it means that there is attack behavior information in the alarm log with high probability.

[0055] Therefore, in the present embodiment, the alarm log can be detected in a diversified manner by the whitelist information base, the first compromised information base and the first IP reputation information base, so as to improve the information accuracy for the alarm log.

[0056] Therefore, the matching of the alarm log with the information in the first information base in step 1021, if matched, determines the corresponding attack feature information from the alarm log, including: matching the alarm log with the whitelist information base, if not matched with the whitelist information base, matching the alarm log with the first compromised information base and / or the first IP reputation information base, if matched with the first compromised information base and / or the first IP reputation information base, extracting the attack feature information from the alarm log; wherein, if the matching result of the alarm log with the whitelist information base indicates that there is no whitelist device information in the alarm log, it is determined that the alarm log is not matched with the whitelist information base; if the matching result of the alarm log with the first compromised information base indicates that there is compromised object information in the alarm log, it is determined that the alarm log is matched with the first information base; if the matching result of the alarm log with the first IP reputation information base indicates that there is untrustworthy IP information in the alarm log, it is determined that the alarm log is matched with the first information base.

[0057] It should be noted that since the whitelist information base stores the information of the whitelist device, it can be accurately identified, and the compromised object information in the first compromised information base and the IP information stored in the first IP reputation information base can also be accurately identified. Therefore, the cloud platform can use an accurate matching strategy for matching to improve the detection efficiency.

[0058] In some optional embodiments, the second information base includes a custom information base, a second compromised information base and / or a second IP reputation information base; the custom information base stores custom information, the second compromised information base stores compromised object information; and the second IP reputation information base stores IP reputation untrustworthy information.

[0059] The custom information can be information autonomously collected by an operator, and the specific information content thereof can be determined by the operator, and the present application does not limit the information content thereof.

[0060] The functions and stored information of the second compromised information base and the second IP reputation information base are the same as or similar to the foregoing, and will not be described herein.

[0061] Further, the matching of the original log with the intelligence in the second intelligence database in step 1022, if matched, determines the corresponding attack feature information from the original log, including: matching the original log with the self-defined intelligence database, if the matching result shows that there is information about the suspected attack on the device in the original log, it is determined that the original log matches the intelligence in the second intelligence database; and / or matching the original log with the second compromised intelligence database, if the matching result shows that there is information about the compromised object in the original log, it is determined that the original log matches the intelligence in the second intelligence database; and / or matching the original log with the second IP reputation intelligence database, if the matching result shows that there is information about the untrustworthy IP in the original log, it is determined that the original log matches the intelligence in the second intelligence database.

[0062] In the present implementation, the original log can be diversified detected by the self-defined intelligence database, the second compromised intelligence database and the second IP reputation intelligence database, and the intelligence accuracy for the original log is improved.

[0063] It should be noted that the first intelligence database and the second intelligence database can include, in addition to the sub-intelligence databases currently included, for example, an intelligence database storing device information that has been recorded by a trusted agency or an intelligence database storing other information that can prove that the device is trusted. Thus, the cloud platform can also use other intelligence databases to detect the alarm log or the original log to further improve the detection accuracy.

[0064] In some optional implementations, the intelligence of the attack behavior information in the log to be detected according to the target attack feature information in step 104 includes the following sub-steps:

[0065] Sub-step 1041, extracting features from the target attack feature information;

[0066] The extracted features can include, for example, IP address information, domain name, file hash value, timestamp, behavior pattern, associated label, etc.

[0067] Sub-step 1042, detecting the features using a rule set, if the detection result shows that the features meet the rules in the rule set, it is determined that there is attack behavior information in the log to be detected.

[0068] The rule set stores a plurality of different rules, which can include, for example:

[0069] a) traffic rules;

[0070] b) whether the IP / domain (domain name) has relevant malicious behavior, malicious label, etc. in the recent period;

[0071] c) whether associated with malicious samples;

[0072] d) whether malicious instructions are contained in the payload (attack payload);

[0073] e) whether malicious samples are contained in the payload;

[0074] f) the current IP / domain.

[0075] The above rules can be formed according to the experience of network security experts, historical data, etc.

[0076] In some application scenarios, the cloud platform can also add the target attack feature information obtained after extension to the label of the associated information. For example, if the security report information (e.g., including the specific content of the security report and the report generation time, etc.) is associated, a security report label can be automatically generated. If the URL related information is associated, a URL label can be automatically generated. Therefore, the above rule set can also include rules for detecting labels.

[0077] Therefore, the cloud platform can use the corresponding rules to detect the extracted features. If the features meet the rules, it can be determined that there is attack behavior information in the to-be-detected log.

[0078] For example, if the extracted feature is IP information, it has had malicious behavior in the near future, which indicates that the extracted feature meets rule b).

[0079] In the present implementation, the features in the target attack feature information can be accurately and quickly detected by the expert knowledge in the rule set, thereby improving the accuracy and detection efficiency of the intelligence for the to-be-detected log.

[0080] In some application scenarios, after the above step sub-step 1041, the extracted features can also be extended, and then the extended features are matched with the rule set. The process of extending the features here can be similar to the process of extending the attack feature information described above, which will not be described here.

[0081] In some optional implementations, the determination of the attack behavior information intelligence in the to-be-detected log according to the target attack feature information in the above step 104 also includes:

[0082] Sub-step 1043, in the case where the features do not meet any rule in the rule set, the confidence level of the existence of attack behavior information in the to-be-detected log is determined based on the target attack feature information by using a machine learning model.

[0083] The above machine learning model can include, for example, decision trees, random forests, neural networks, etc.

[0084] In some application scenarios, the cloud platform can use sample features or sample attack feature information as input of the machine learning model, train the machine learning model by taking the confidence of the information about whether there is attack behavior information as expected output of the machine learning model, and obtain the converged machine learning model.

[0085] Then, the extracted features or target attack feature information can be input into the converged machine learning model to obtain the confidence of the attack behavior information in the to-be-detected log.

[0086] In substep 1044, it is determined whether there is attack behavior information in the to-be-detected log according to the confidence.

[0087] In some optional implementations, if the confidence is greater than the upper confidence threshold, it is determined that there is attack behavior information in the to-be-detected log; if the confidence is less than the lower confidence threshold, it is determined that there is no attack behavior information in the to-be-detected log; and if the confidence is between the upper confidence threshold and the lower confidence threshold, it is determined that there is suspected attack behavior information in the to-be-detected log. The suspected attack behavior information may, for example, include data with the automatic field being false.

[0088] In some optional implementations, if the confidence is greater than the confidence threshold, it is determined that there is attack behavior information in the to-be-detected log; and if the confidence is less than the confidence threshold, it is determined that there is no attack behavior information in the to-be-detected log.

[0089] In some application scenarios, if it is determined that there is attack behavior information, information such as the identity of the attacker, the time when the attack behavior information is found, the attack type, the confidence, the threat level, and the like is added in the information about the attack behavior information.

[0090] In this implementation, the machine learning model can be used to determine whether there is attack behavior information in the to-be-detected log when the target attack feature information does not conform to any rule in the rule set, the machine learning model has good generalization ability, and can capture new or variant threats that cannot be covered by rules. Therefore, the target attack feature information can be more comprehensively detected, and the process does not require human assistance, thereby improving the detection efficiency and accuracy.

[0091] In some application scenarios, when the cloud platform determines that there is suspected attack behavior information in the to-be-detected log, it can send a prompt to the operator to enable the operator to accurately determine whether there is attack behavior information in the to-be-detected log. Here, only human assistance is required to research and judge the to-be-detected log with suspected attack behavior information, compared with most related technologies that require human assistance, the purpose of improving the detection efficiency is achieved.

[0092] It should be noted that in some application scenarios, if the feature matches the rules in the rule set, the target attack feature information can also be processed using a machine learning model to combine the confidence output by the machine learning model and the rule matching result to jointly determine whether there is attack behavior information in the log to be detected, thereby improving the accuracy of the detection result. For example, since the rules in the rule set are sorted according to expert knowledge, they have high accuracy, so if the feature matches the rules and the confidence output by the machine learning model indicates that there is suspected attack behavior information in the log to be detected, the log to be detected is determined to have attack behavior information according to the rules in the rule set. For another example, if the feature does not match the rules, but the confidence output by the machine learning model indicates that there is attack behavior information in the log to be detected, it is further determined by a human.

[0093] In some application scenarios, the cloud platform can integrate the above rule set in the rule engine, and integrate the machine learning model as an intelligence judgment engine. That is, the intelligence judgment engine can include a feature extraction module, a rule engine module, and a machine learning module, and the internal implementation process is the same as the corresponding part described above.

[0094] In addition, the intelligence judgment engine can include, in addition to the above modules, for example, a data access module, a data preprocessing module, a comprehensive processing module, and an intelligence release module. The data access module is configured to receive target attack feature information. The data preprocessing module is configured to perform preprocessing operations such as data cleaning and unified format on the target attack feature information. The comprehensive processing module is configured to determine whether there is attack behavior information in the log to be detected by combining the output results of the rule engine module and the machine learning module. The intelligence release module is configured to output intelligence.

[0095] In this way, the cloud platform can use the intelligence judgment engine to automatically detect target attack feature information, thereby automatically outputting corresponding intelligence, improving the detection efficiency and accuracy.

[0096] Figure 2 A structural block diagram of an intelligence detection apparatus provided by an embodiment of the present application is shown, which can be used to execute the intelligence detection method provided by the embodiment of the present application. Referring to Figure 2The information detection apparatus comprises an acquisition module 201, a matching module 202, an expansion module 203 and a determination module 204. The acquisition module 201 is configured to acquire a log to be detected of a network device. The matching module 202 is configured to match the log to be detected with an information base. If matching, attack feature information is determined from the log to be detected. The information base stores information related to network attacks. The expansion module 203 is configured to expand the attack feature information to obtain target attack feature information after expansion. The determination module 204 is configured to determine information of attack behaviors in the log to be detected according to the target attack feature information.

[0097] Optionally, the log to be detected comprises an alarm log and an original log. The original log is a log directly generated by the network device. The alarm log is a log obtained by processing the original log by the network device. The matching module 202 is further configured to match the alarm log with information in a first information base. If matching, corresponding attack feature information is determined from the alarm log. The matching module 202 is further configured to match the original log with information in a second information base. If matching, corresponding attack feature information is determined from the original log. The second information base is different from the first information base.

[0098] Optionally, the first information base comprises a white list information base, a first compromised information base and / or a first IP credit information base. The white list information base stores information of white list devices. The first compromised information base stores information of compromised objects. The first IP credit information base stores information of IP credit unfaithfulness. The matching module 202 is further configured to match the alarm log with the white list information base. If not matching with the white list information base, the matching module 202 is further configured to match the alarm log with the first compromised information base and / or the first IP credit information base. If matching with the first compromised information base and / or the first IP credit information base, the attack feature information is extracted from the alarm log. If the matching result of the alarm log with the white list information base indicates that there is no white list device information in the alarm log, it is determined that the alarm log does not match with the white list information base. If the matching result of the alarm log with the first compromised information base indicates that there is information of compromised objects in the alarm log, it is determined that the alarm log matches with the first information base. If the matching result of the alarm log with the first IP credit information base indicates that there is information of unfaithful IP in the alarm log, it is determined that the alarm log matches with the first information base.

[0099] Optionally, the second information base comprises a custom information base, a second compromised information base and / or a second IP reputation information base; the custom information base stores custom information, the second compromised information base stores information of compromised objects, and the second IP reputation information base stores information of IP reputation compromise; and the matching module 202 is further configured to: match the original log with the custom information base, and if the matching result indicates that there is information of suspected attack on the device in the original log, determine that the original log matches the information in the second information base; and / or match the original log with the second compromised information base, and if the matching result indicates that there is information of compromised objects in the original log, determine that the original log matches the information in the second information base; and / or match the original log with the second IP reputation information base, and if the matching result indicates that there is information of compromised IP in the original log, determine that the original log matches the information in the second information base.

[0100] Optionally, the determining module 204 is further configured to: extract a feature from the target attack feature information; and detect the feature using a rule set, and if the detection result indicates that the feature conforms to a rule in the rule set, determine that there is attack behavior information in the log to be detected.

[0101] Optionally, the determining module 204 is further configured to: if the feature does not conform to any rule in the rule set, determine a confidence level of attack behavior information in the log to be detected based on the target attack feature information by using a machine learning model; and determine whether there is attack behavior information in the log to be detected according to the confidence level.

[0102] Optionally, the determining module 204 is further configured to: if the confidence level is greater than an upper confidence threshold, determine that there is attack behavior information in the log to be detected; if the confidence level is less than a lower confidence threshold, determine that there is no attack behavior information in the log to be detected; and if the confidence level is between the upper confidence threshold and the lower confidence threshold, determine that there is suspected attack behavior information in the log to be detected.

[0103] The information detection apparatus provided by the embodiments of the present application, the implementation principle and the technical effects thereof have been introduced in the foregoing method embodiments. For brevity, the part of the apparatus embodiments not mentioned can be referred to the corresponding content in the method embodiments.

[0104] Figure 3 A structural schematic diagram of an electronic device for performing the information detection method provided by the embodiments of the present application is shown. Referring to Figure 3The electronic device includes a processor 301, a memory 302, and a communication unit 303, which are interconnected and communicate with each other through a communication bus 304 and / or other forms of connection mechanisms (not shown).

[0105] The processor 301 includes one or more (only one is shown in the figure), which can be an integrated circuit chip with a signal processing capability. The processor 301 described above can be a general-purpose processor, including a central processing unit (CPU), a micro controller unit (MCU), a network processor (NP), or other conventional processors; it can also be a special-purpose processor, including a graphics processing unit (GPU), a neural-network processing unit (NPU), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component. When the processor 301 is multiple, some of them can be general-purpose processors, and the others can be special-purpose processors.

[0106] The memory 302 includes one or more (only one is shown in the figure), which can be, but is not limited to, a random access memory (RAM), a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), etc. The processor 301 and other possible components can access, read and / or write data in the memory 302.

[0107] In particular, one or more computer program instructions can be stored in the memory 302, and the processor 301 can read and run the computer program instructions to implement the intelligence detection method provided by the embodiments of the present application.

[0108] The communication unit 303 includes one or more (only one is shown in the figure), which can be used for direct or indirect communication with other devices to interact with data. The communication unit 303 can include a wired communication unit and / or a wireless communication unit.

[0109] It can be understood that Figure 3 The structure shown is only schematic, and the electronic device can also include more or less components than Figure 3 shown in the figure, or have a different configuration from Figure 3 shown in the figure. Figure 3 The components shown in the figure can be implemented in hardware, software or a combination thereof. The electronic device can be a physical device, such as a PC, a notebook, a tablet, a mobile phone, a server, an embedded device, etc., or a virtual device, such as a virtual machine, a virtualization container, etc. Moreover, the electronic device is not limited to a single device, but can also be a combination of multiple devices or a cluster of a large number of devices.

[0110] The embodiments of the present application also provide a computer readable storage medium, which stores computer program instructions, and the computer program instructions are read and run by the processor of the computer to execute the intelligence detection method provided by the embodiments of the present application. For example, the computer readable storage medium can be implemented as Figure 3 the memory 302 in the electronic device in the figure.

[0111] The embodiments of the present application also provide a computer program product, which includes computer program instructions, and the computer program instructions are read and run by the processor of the computer to execute the intelligence detection method provided by the embodiments of the present application.

[0112] The above is only an embodiment of the present application and is not used to limit the protection scope of the present application. For the operator in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, scheme combination, improvement, etc. within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. An information detection method characterized by comprising: The method comprises the following steps: obtaining a log to be detected of a network device; matching the log to be detected with an intelligence database, and if matching, determining attack feature information from the log to be detected; the intelligence database stores intelligence related to network attacks; extending the attack feature information to obtain extended target attack feature information; determining intelligence of attack behavior information in the log to be detected according to the target attack feature information; wherein the log to be detected comprises an alarm log and an original log; the original log is a log directly generated by the network device, and the alarm log is a log obtained by processing the original log by the network device; and the matching of the log to be detected with the intelligence database, and if matching, the determination of the attack feature information from the log to be detected, comprises: precise matching of the alarm log with intelligence in a first intelligence database, and if matching, the determination of corresponding attack feature information from the alarm log; fuzzy matching of the original log with intelligence in a second intelligence database, and if matching, the determination of corresponding attack feature information from the original log; the second intelligence database is different from the first intelligence database; the extension of the attack feature information to obtain the extended target attack feature information, comprises: associating the attack feature information with other information related thereto to obtain the extended target attack feature information, wherein the other information comprises at least one of the following: associated sample information, attack payload of the original log, metadata in the log to be detected, security report of the network device, report generation time, task code involved, uniform resource locator, and user's identity information.

2. The intelligence detection method according to claim 1, wherein the first intelligence database comprises a whitelist intelligence database, a first compromised intelligence database, and / or a first IP reputation intelligence database; the whitelist intelligence database stores intelligence of whitelisted devices, the first compromised intelligence database stores intelligence of compromised objects, and the first IP reputation intelligence database stores intelligence of IP reputation and credit loss; and the matching of the alarm log with intelligence in the first intelligence database, and if matching, the determination of corresponding attack feature information from the alarm log, comprises: matching the alarm log with the whitelist intelligence database, and if not matching with the whitelist intelligence database, matching the alarm log with the first compromised intelligence database and / or the first IP reputation intelligence database, and if matching with the first compromised intelligence database and / or the first IP reputation intelligence database, extracting the attack feature information from the alarm log; wherein if the matching result of the alarm log with the whitelist intelligence database indicates that there is no whitelisted device information in the alarm log, it is determined that the alarm log does not match with the whitelist intelligence database; if the matching result of the alarm log with the first compromised intelligence database indicates that there is information of a compromised object in the alarm log, it is determined that the alarm log matches with the first intelligence database. If the matching result of the alarm log and the first IP reputation database indicates that there is information of a dishonest IP in the alarm log, it is determined that the alarm log matches the first database.

3. The intelligence detection method according to claim 1, wherein The second database includes a self-defined database, a second compromised database, and / or a second IP reputation database; the self-defined database stores self-defined information; the second compromised database stores information of compromised objects; The second IP reputation database stores information of IP reputation dishonesty; And The matching of the original log and the information in the second database includes: The matching of the original log and the self-defined database; if the matching result indicates that there is information of a device suspected to be attacked in the original log, it is determined that the original log matches the information in the second database; and / or The matching of the original log and the second compromised database; if the matching result indicates that there is information of a compromised object in the original log, it is determined that the original log matches the information in the second database; and / or The matching of the original log and the second IP reputation database; if the matching result indicates that there is information of a dishonest IP in the original log, it is determined that the original log matches the information in the second database.

4. The method according to any one of claims 1 to 3, wherein The determination of the information of attack behavior in the to-be-detected log according to the target attack feature information includes: extracting a feature from the target attack feature information; using a rule set to detect the feature; if the detection result indicates that the feature conforms to a rule in the rule set, it is determined that there is attack behavior information in the to-be-detected log.

5. The intelligence detection method according to claim 4, wherein The determination of the information of attack behavior in the to-be-detected log according to the target attack feature information further includes: In the case that the feature does not conform to any rule in the rule set, a machine learning model is used to determine a confidence degree that there is attack behavior information in the to-be-detected log based on the target attack feature information; determining whether there is attack behavior information in the to-be-detected log according to the confidence degree.

6. The intelligence detection method of claim 5, wherein, The determination of whether there is attack behavior information in the to-be-detected log according to the confidence degree includes: if the confidence degree is greater than an upper confidence threshold, it is determined that there is attack behavior information in the to-be-detected log; if the confidence degree is less than a lower confidence threshold, it is determined that there is no attack behavior information in the to-be-detected log; if the confidence degree is between the upper confidence threshold and the lower confidence threshold, it is determined that there is suspected attack behavior information in the to-be-detected log.

7. An intelligence detection apparatus, characterized by comprising: It includes: an acquisition module configured to acquire a to-be-detected log of a network device; a matching module configured to match the to-be-detected log with a database; if matched, attack feature information is determined from the to-be-detected log; the database stores information related to network attacks; an expansion module configured to expand the attack feature information to obtain target attack feature information after expansion; a determination module configured to determine information of attack behavior in the to-be-detected log according to the target attack feature information. The to-be-detected log includes an alarm log and an original log; the original log is a log directly generated by the network device, and the alarm log is a log obtained by processing the original log by the network device; and The matching module is specifically configured to perform accurate matching on the alarm log and intelligence in a first intelligence base, and if matching is performed, corresponding attack feature information is determined from the alarm log; and perform fuzzy matching on the original log and intelligence in a second intelligence base, and if matching is performed, corresponding attack feature information is determined from the original log; the second intelligence base is different from the first intelligence base; The expansion module is specifically configured to associate the attack feature information with other information related to the attack feature information to obtain expanded target attack feature information, wherein the other information includes at least one of the following: associated related sample information, attack load of the original log, metadata in the to-be-detected log, security report of the network device, report generation time, task code involved, uniform resource locator, and user identity information.

8. An electronic device, comprising: The computer readable storage medium stores computer program instructions, and the computer program instructions are read and run by the processor to execute the method in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer program instructions, and the computer program instructions are read and run by the processor to execute the method in any one of claims 1-6.

10. A computer program product comprising computer program instructions, characterised in that, The computer program instructions are read and run by the processor to execute the method in any one of claims 1-6.

Images