A network malicious attack protection method, system, electronic device and storage medium

Abstract

The present invention discloses a network malicious attack protection method, system, electronic device and storage medium, including: collecting historical access request data in the network; retrieving and analyzing the historical access request data through Elasticsearch to obtain malicious IP addresses and IP analysis information of the malicious IP addresses; automatically arranging IP blocking tasks according to malicious IP addresses through a SOAR system, and determining step blocking and unblocking strategies according to the IP analysis information; performing attack protection responses to malicious IP attack behaviors through a SOAR system according to IP blocking tasks and step blocking and unblocking strategies. The present invention improves the efficiency and accuracy of network malicious attack protection, enhances the adaptability and flexibility of processing strategies, thereby enhancing network security, and can be widely used in the field of network security technology.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, system, electronic device and storage medium for protecting against malicious network attacks. Background Art

[0002] A cyberattack is an act of accessing a network, computer system or digital device in an unauthorized manner to intentionally steal, expose, tamper with, disable or destroy data, applications or other assets. High-risk IP attacks are a common form of cyberattacks, which use a certain IP address to launch malicious cyber attacks, which may cause system damage, data leakage or service interruption.

[0003] Existing IP blocking methods are mainly based on current security incident threat intelligence and risk calculation thresholds, which may lead to inefficient blocking and mis-blocking. Especially in large-scale network environments, there may be a large number of IP blocking requests that need to be processed, and the pattern of network attacks may also become more complex, which makes it difficult for existing IP blocking methods to meet actual needs. In addition, although existing IP risk processing methods attempt to use the target link component analysis model to determine the processing strategy, this method still relies on preset risk thresholds and similar IP addresses, which may limit the adaptability and flexibility of the processing strategy. For example, for newly emerging network attack patterns, existing methods may not be able to adjust the processing strategy in a timely manner, which may lead to increased network security risks.

[0004] Terminology explanation:

[0005] High-risk IP attack: A network security threat in which an IP address is used to launch a malicious network attack that may cause system damage, data leakage or service interruption. Such attacks usually involve a large number of data packet transmissions and complex attack patterns.

[0006] Provincial exit gateway: It is a network communication node located in the inter-provincial network connection and is responsible for processing and forwarding network data packets. It plays an important role in network topology, especially in large-scale and complex network environments.

[0007] Mobile base station: A key device in a wireless communication network that provides wireless signal coverage and communicates with mobile devices. A base station can handle voice, data, and other types of wireless communications.

[0008] IDC room exit: It is a network exit point of the Internet Data Center, responsible for processing and forwarding network traffic from within the data center. It plays a key role in the network architecture of the data center.

[0009] IP blocking: It is a network security strategy that blocks network access to specific IP addresses to prevent possible malicious behavior or attacks. IP blocking can be based on a variety of different criteria, such as IP address, geographic location, behavior patterns, etc.

[0010] Cloud provider: A company or organization that provides cloud services (such as storage, computing, database, etc.). Cloud providers enable users to avoid directly purchasing and maintaining hardware and software by providing resources that can be used on demand.

[0011] Ladder blocking and unblocking: This is a progressive network security strategy that gradually increases the blocking time of specific IP addresses based on the frequency and severity of malicious behavior. This strategy is designed to effectively respond to persistent malicious behavior while minimizing the impact on normal users.

[0012] Historical access record: This is the historical data of network access, which can be used to track and analyze network behavior. Historical access records usually include information such as access time, source IP address, and accessed resources, and are an important basis for network behavior analysis and network security decision-making.

[0013] Elasticsearch: This is an open source search and analysis engine that can handle complex search requirements and large amounts of data. Elasticsearch uses an inverted index structure and supports full-text search, structured search, and distributed search.

[0014] SOAR (Security Orchestration, Automation, and Response system): This is a security tool that can automatically perform security tasks and respond to security incidents. The SOAR system integrates various security tools and services to achieve rapid response and processing of security incidents. Summary of the invention

[0015] The purpose of the present invention is to solve one of the technical problems existing in the prior art to at least a certain extent.

[0016] To this end, an object of an embodiment of the present invention is to provide a method for protecting against network malicious attacks, which improves the efficiency and accuracy of protecting against network malicious attacks, thereby enhancing network security.

[0017] Another object of an embodiment of the present invention is to provide a network malicious attack protection system.

[0018] In order to achieve the above technical objectives, the technical solutions adopted by the embodiments of the present invention include:

[0019] In a first aspect, an embodiment of the present invention provides a method for protecting against malicious network attacks, comprising the following steps:

[0020] Collect historical access request data in the network;

[0021] Retrieving and analyzing the historical access request data through Elasticsearch to obtain malicious IP addresses and IP analysis information of the malicious IP addresses;

[0022] Automatically arrange IP blocking tasks according to the malicious IP addresses through the SOAR system, and determine the step-by-step blocking and unblocking strategies based on the IP analysis information;

[0023] The SOAR system performs attack protection responses to malicious IP attack behaviors according to the IP blocking tasks and the step-by-step blocking and unblocking strategies.

[0024] Furthermore, in one embodiment of the present invention, the step of collecting historical access request data in the network specifically includes:

[0025] Use Logstash to collect syslog outbound data from security devices and access request data logs from gateways;

[0026] Outputting the syslog outgoing data and the access request data log as the historical access request data to Kafka;

[0027] The syslog outgoing data and the access request data log are both configured with tags, and the tags are used to distinguish the source of the data.

[0028] Further, in one embodiment of the present invention, the step of retrieving and analyzing the historical access request data through Elasticsearch to obtain the malicious IP address and the IP analysis information of the malicious IP address specifically includes:

[0029] Constructing a query request through the query DSL of Elasticsearch, wherein the query request is used to find the target IP address in the historical access request data;

[0030] Retrieving all access records of the target IP address according to the query request, and counting the target access records in which the target status code appears, and then determining the ratio of the target access record to the total access records to determine the proportion of abnormal status codes;

[0031] When the proportion of the abnormal status code is greater than or equal to a preset first threshold, the target IP address is determined to be a malicious IP address, and the IP analysis information of the malicious IP address is determined, the IP analysis information including the IP location, inter-provincial exit gateway, mobile base station, IDC computer room exit and the proportion of the abnormal status code.

[0032] Further, in one embodiment of the present invention, the step of automatically arranging the IP blocking task according to the malicious IP address through the SOAR system specifically includes:

[0033] The SOAR system generates multiple IP blocking subtasks according to the malicious IP address, and the IP blocking subtasks include a blocking object identification task, a blacklist and whitelist judgment task, a CDN judgment task, an inter-provincial exit gateway identification task, a mobile base station identification task, an IDC room exit identification task, a business IP judgment task, a decision-making blocking device task, a blocking instruction issuance task, a delayed automatic unblocking task, and a blocking list maintenance task;

[0034] Arranging a task script for the IP blocking subtask to generate the IP blocking task;

[0035] Determine a workflow engine for the IP blocking task, and execute the IP blocking task through the workflow engine.

[0036] Further, in one embodiment of the present invention, the step of determining the step-by-step blocking and unblocking strategy according to the IP analysis information specifically includes:

[0037] Determine whether the IP address of the malicious IP address is located abroad;

[0038] When the IP address of the malicious IP address is located abroad, the step-by-step blocking and unblocking strategy of the malicious IP address is determined as follows: the malicious IP address is blocked for a preset first period of time and added to a temporary blacklist; if the malicious IP address conducts a network attack again, the malicious IP address is blocked for a preset second period of time and added to a malicious list; if the malicious IP address conducts a network attack for the third time, the malicious IP address is permanently blocked;

[0039] When the IP address of the malicious IP address is located in China, determine a first proportion of the ES request status code of the malicious IP address and a second proportion of the Waf interception status code, and calculate a blocking coefficient of the malicious IP address according to the first proportion, the second proportion and a preset weighting coefficient, and then determine whether the blocking coefficient is greater than or equal to a preset second threshold;

[0040] When the blocking coefficient is greater than or equal to the second threshold, the step-by-step blocking and unblocking strategy for the malicious IP address is determined to be to block the malicious IP address for a preset first period of time and add it to a temporary blacklist; if the malicious IP address launches a network attack again, the malicious IP address will be blocked for a preset second period of time and will be added to the malicious list; if the malicious IP address launches a network attack for the third time, the malicious IP address will be permanently blocked.

[0041] Further, in one embodiment of the present invention, the step of performing attack protection response to malicious IP attacks by the SOAR system according to the IP blocking task and the step blocking and unblocking strategy is specifically as follows:

[0042] The SOAR system automatically identifies malicious IP attack behaviors according to the IP blocking task, generates corresponding security event alerts and displays them;

[0043] A security response operation is automatically generated according to the step-by-step blocking and unblocking strategy, and the security response operation is executed.

[0044] Furthermore, in one embodiment of the present invention, the network malicious attack protection method further includes the following steps:

[0045] A response process record of the attack protection response is generated by the SOAR system, and a network malicious attack trend analysis is performed based on the response process record to obtain a system optimization strategy.

[0046] In a second aspect, an embodiment of the present invention provides a network malicious attack protection system, including:

[0047] A data collection module, used to collect historical access request data in the network;

[0048] A data retrieval module, used to retrieve and analyze the historical access request data through Elasticsearch to obtain malicious IP addresses and IP analysis information of the malicious IP addresses;

[0049] A task scheduling and strategy determination module, which is used to automatically schedule IP blocking tasks according to the malicious IP addresses through the SOAR system, and determine the step-by-step blocking and unblocking strategies according to the IP analysis information;

[0050] The attack protection response module is used to perform attack protection response to malicious IP attack behaviors through the SOAR system according to the IP blocking task and the step blocking and unblocking strategy.

[0051] In a third aspect, an embodiment of the present invention provides an electronic device, comprising a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory, wherein the program, when executed by the processor, implements the network malicious attack protection method as described in the first aspect above.

[0052] In a fourth aspect, an embodiment of the present invention further provides a storage medium, which is a computer-readable storage medium used for computer-readable storage, and the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the network malicious attack protection method as described in the first aspect above.

[0053] The advantages and beneficial effects of the present invention will be partly given in the following description, partly become apparent from the following description, or be understood through the practice of the present invention:

[0054] The embodiment of the present invention collects historical access request data in the network, retrieves and analyzes the historical access request data through Elasticsearch, obtains malicious IP addresses and IP analysis information of malicious IP addresses, automatically arranges IP blocking tasks according to malicious IP addresses through the SOAR system, and determines the step-by-step blocking and unblocking strategies according to the IP analysis information, and performs attack protection responses to malicious IP attack behaviors through the SOAR system according to the IP blocking tasks and the step-by-step blocking and unblocking strategies. The embodiment of the present invention can more effectively process IP blocking requests by using historical big data request retrieval and SOAR automated orchestration tool systems, and can more flexibly respond to different network attack modes by using step-by-step blocking and unblocking strategies, thereby improving the efficiency and accuracy of network malicious attack protection, enhancing the adaptability and flexibility of processing strategies, and thus enhancing network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the technical solution in the embodiments of the present invention, the following introduction is made to the drawings required for use in the embodiments of the present invention. It should be understood that the drawings introduced below are only for the convenience of clearly describing some embodiments of the technical solution of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0056] Figure 1 A flowchart of a method for protecting against malicious network attacks provided by an embodiment of the present invention;

[0057] Figure 2 A flow chart of step S101 provided in an embodiment of the present invention;

[0058] Figure 3 A flow chart of step S102 provided in an embodiment of the present invention;

[0059] Figure 4 A flow chart of step S103 provided in an embodiment of the present invention;

[0060] Figure 5 Another flow chart of step S103 provided in an embodiment of the present invention;

[0061] Figure 6 A flow chart of step S104 provided in an embodiment of the present invention;

[0062] Figure 7 Another step flow chart of a method for protecting against malicious network attacks provided by an embodiment of the present invention;

[0063] Figure 8 A schematic diagram of the structure of a network malicious attack protection system provided by an embodiment of the present invention;

[0064] Fig. 9 A schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present invention;

[0065] Fig.10 A schematic diagram of the structure of a storage medium provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0066] Embodiments of the present invention are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be understood as limitations on the present application. It should be noted that, although the functional module division is performed in the system schematic diagram and the logical order is shown in the flow chart, in some cases, the steps shown or described may be performed in a different order from the module division in the system schematic diagram or the flow chart. For the step numbers in the following embodiments, they are only set for the convenience of explanation, and the order between the steps is not limited in any way. The execution order of each step in the embodiment can be adaptively adjusted according to the understanding of those skilled in the art.

[0067] In the description of the present invention, the meaning of "a plurality" is two or more. If there is a description of the first or the second, it is only for the purpose of distinguishing the technical features, and it cannot be understood as indicating or implying the relative importance or implicitly indicating the number of the indicated technical features or implicitly indicating the order of the indicated technical features. In addition, unless otherwise defined, all technical and scientific terms used in this document have the same meaning as those commonly understood by technicians in the technical field of this application. The terms used in this document are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0068] The network malicious attack protection method provided in the embodiment of the present application can be applied to the terminal, can also be applied to the server side, and can also be software running in the terminal or the server side. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc.; the server side can be configured as an independent physical server, or a server cluster or distributed system composed of multiple physical servers, and can also be configured as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application that implements the network malicious attack protection method, etc., but is not limited to the above forms.

[0069] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0070] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of these data will comply with the relevant laws, regulations, and standards of the relevant countries and regions. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0071] like Figure 1 FIG. 1 is a flowchart of a method for protecting against malicious network attacks according to an embodiment of the present invention. Figure 1 The embodiment of the present invention provides a network malicious attack protection method, which specifically includes the following steps:

[0072] S101. Collect historical access request data in the network.

[0073] Specifically, the system will collect historical access request data in the network, which will be used for subsequent data analysis and determination of blocking strategies.

[0074] like Figure 2 FIG. 1 is a flow chart of step S101 provided in an embodiment of the present invention, referring to FIG. Figure 2 As an optional implementation, the step of collecting historical access request data in the network specifically includes:

[0075] S1011. Collect syslog outbound data from security devices and access request data logs from gateways through Logstash.

[0076] S1012, outputting syslog outgoing data and access request data log as historical access request data to Kafka;

[0077] Among them, syslog outgoing data and access request data logs are configured with tags, which are used to distinguish the source of data.

[0078] Specifically, an embodiment of the present invention adopts a data collection method based on Logstash. Logstash is an open source, server-side data processing pipeline that can collect data from multiple sources at the same time, then perform various transformations and processing on the data, and finally send the data to the selected repository. The system collects syslog outbound data in security devices and all access request data logs in the gateway through Logstash. The gateway throughput (Throughput) is about 150,000 requests / minute (peak value). To achieve this step, the Logstash configuration file is set to collect input data from these sources, and then output the collected data to Kafka, which is an open source platform for building real-time data pipelines and streaming applications. In this way, the system can collect and process a large amount of network access request data in real time.

[0079] In addition, in order to distinguish different data sources, the system configures the log outbound function on the security device, and uses tags to distinguish different devices. The security device only counts the alarm log, and the log volume is about 50,000 per minute. In this way, the system can perform more sophisticated data processing and analysis based on the different data sources. This step provides an important data basis for subsequent data retrieval and analysis, as well as the determination of blocking strategies. By collecting and processing historical access request data, the system can more accurately identify possible malicious IP addresses, thereby improving the efficiency and accuracy of network malicious attack protection.

[0080] S102. Retrieve and analyze historical access request data through Elasticsearch to obtain malicious IP addresses and IP analysis information of malicious IP addresses.

[0081] Specifically, Elasticsearch is used to retrieve and analyze historical access request data to identify and analyze possible malicious IP addresses.

[0082] like Figure 3 FIG. 1 is a flow chart of step S102 provided in an embodiment of the present invention, referring to FIG. Figure 3 As an optional implementation, the step of retrieving and analyzing historical access request data through Elasticsearch to obtain malicious IP addresses and IP analysis information of malicious IP addresses specifically includes:

[0083] S1021. Construct a query request through the query DSL of Elasticsearch, where the query request is used to find the target IP address in the historical access request data;

[0084] S1022, retrieve all access records of the target IP address according to the query request, and count the target access records in which the target status code appears, and then determine the ratio of the target access record to all access records to determine the proportion of abnormal status codes;

[0085] S1023. When the proportion of abnormal status codes is greater than or equal to a preset first threshold, the target IP address is determined to be a malicious IP address, and the IP analysis information of the malicious IP address is determined. The IP analysis information includes the IP location, inter-provincial exit gateway, mobile base station, IDC computer room exit, and the proportion of abnormal status codes.

[0086] Specifically, the embodiment of the present invention adopts a big data log query method based on Elasticsearch, and uses Elasticsearch's query DSL (Domain Specific Language) to construct a query request. The main goal of this query request is to find a specific IP address (i.e., "clientIP") in the historical access request data. By optimizing the query statement, the query time is significantly reduced, from the default query time of eight to ten thousand milliseconds for a gateway with a throughput of 150,000 / minute and a security device log of 50,000 / minute within a month to tens of milliseconds. The system queries all access records of a certain IP through the Elasticsearch gateway, counts the HTTP status code, and counts the proportion of all status codes of 200, 404, and 413 (malicious access interception), and returns ten non-repeating URI record values. This method allows the system to analyze network access request data more accurately, thereby more accurately identifying possible malicious IP addresses, and assisting researchers in making judgments on IP hazards.

[0087] Assume that the number of all access records of a certain IP is N, and the number of records with status code 200 is N 200 , the number of records with status code 404 is N 404 , then the proportion of records with status code 200 is P 200 and the percentage of records with status code 404 404 It can be calculated by the following formula:

[0088]

[0089]

[0090] The default query statement may take from 8,000 to more than 10,000 milliseconds, or even tens of thousands of milliseconds, which is unacceptable in a production environment. In addition, in an increasingly complex network environment, it cannot keep up with a large number of malicious IP address attacks such as attacks by numerous IP proxy pools. In order to further improve query performance, the embodiment of the present invention adopts the following optimization strategy:

[0091] 1. Index optimization: The system ensures that the index structure (mappings) is correct and uses the correct type. For example, IP addresses use the IP type, HTTP status codes use the short type, and URIs use the keyword type.

[0092] 2. Use filter instead of query: When full-text search or scoring is not required, the system uses filter for query because filter is cached, which can improve query performance.

[0093] 3. Control the number of documents returned: When you only care about the aggregation results and do not need to return all documents, the system sets "size":0, which can further improve query performance.

[0094] 4. Set time range: Add a time range filter to limit the time range of the search. In this filter, a time range (i.e. "from" and "to") is specified. This time range is relative to the current time (i.e. "now-30m" to "now"), which can set access request data within the past 30 minutes.

[0095] 5. Use aggregation ("aggs") to count the number of occurrences of various gateway states ("GWstatus"). The results of this aggregation can help understand the behavior pattern of the target IP address. For example, if most of the requests from a certain IP address return an error status code, then this IP address may be malicious.

[0096] The above optimization strategies are not fixed, but can be adjusted according to actual conditions. For example, according to the amount of data and query load, the system can reasonably set the number of shards and replicas; according to the workload, the system can adjust the resource configuration of the Elasticsearch cluster (such as CPU, memory, disk space, and I / O); the system can also use Elasticsearch's monitoring tools to monitor cluster and query performance, and use the profile API to debug queries. Through the above methods, the system can significantly improve query performance while ensuring query accuracy, thereby improving the efficiency and accuracy of network malicious attack protection. After performance optimization, the query time of IP addresses was reduced to tens of milliseconds.

[0097] S103. Automatically arrange IP blocking tasks according to malicious IP addresses through the SOAR system, and determine the step-by-step blocking and unblocking strategies based on the IP analysis information.

[0098] Specifically, the system will use the SOAR system for automated orchestration and response to achieve more efficient and accurate IP blocking; at the same time, the system will implement corresponding step-by-step blocking and unblocking strategies based on the results of retrieval and analysis to improve the accuracy and flexibility of the blocking.

[0099] like Figure 4 FIG. 1 is a flow chart of step S103 provided in an embodiment of the present invention, referring to FIG. Figure 4 As an optional implementation, the SOAR system can be used to automatically schedule IP blocking tasks based on malicious IP addresses, which specifically includes:

[0100] S1031. Generate multiple IP blocking subtasks based on malicious IP addresses through the SOAR system. The IP blocking subtasks include identifying the blocking object task, judging the blacklist and whitelist task, judging the CDN task, identifying the inter-provincial egress gateway task, identifying the mobile base station task, identifying the IDC room egress task, judging the business IP task, deciding on the blocking device task, issuing the blocking instruction task, delaying the automatic unblocking task, and maintaining the blocking list task;

[0101] S1032, arranging task scripts for IP blocking subtasks to generate IP blocking tasks;

[0102] S1033, determining a workflow engine for the IP blocking task, and executing the IP blocking task through the workflow engine.

[0103] Specifically, the embodiment of the present invention adopts a security orchestration, automation and response (SOAR) system for automated orchestration and response, and significantly improves the efficiency and accuracy of network malicious attack protection by introducing automation technology. By using the SOAR system, the system can detect and contain attacks within 5 minutes, which is 10 times faster than the traditional manual method (which takes 50 minutes). Similarly, the SOAR system only takes 30 seconds to block IP with one click, while the manual method takes 5 to 10 minutes. These data clearly show the advantages of the SOAR system in improving response speed and reducing manual intervention. The SOAR system greatly improves operational efficiency by automating multiple collaborative tasks, such as identifying blocked objects, judging black and white lists, judging CDN, inter-provincial export gateways, mobile base stations, IDC computer room exports, etc., judging business IP, deciding to block equipment, issuing blocking instructions, delaying automatic unblocking, and maintaining blocking lists. At the same time, the SOAR system also provides operation process records and trend statistical analysis, which provides important data support for network security analysis and decision-making.

[0104] By introducing the SOAR system, the system can achieve 7x24 hours of automated disposal, greatly improving the efficiency and accuracy of network malicious attack protection. This is an important innovation, because when facing the automated and intelligent network weapon combat platform, the traditional manual response team often faces problems such as flooding of alarms, slow response, complex operation, difficult communication, lack of skills for novices, insufficient experience, heavy workload, and low efficiency. By introducing the SOAR system, these problems have been effectively solved.

[0105] like Figure 5 FIG. 1 is another flow chart of step S103 provided in an embodiment of the present invention, referring to FIG. Figure 5 As an optional implementation, the step of determining the step-by-step blocking and unblocking strategy based on the IP analysis information specifically includes:

[0106] S1034, determining whether the IP address of the malicious IP address is located abroad;

[0107] S1035, when the IP address of the malicious IP address is located abroad, determining a step-by-step blocking and unblocking strategy for the malicious IP address: blocking the malicious IP address for a preset first period of time and adding it to a temporary blacklist; if the malicious IP address conducts a network attack again, blocking the malicious IP address for a preset second period of time and adding it to a malicious list; if the malicious IP address conducts a network attack for the third time, permanently blocking the malicious IP address;

[0108] S1036: When the IP address of the malicious IP address is located in China, determine a first proportion of ES request status codes and a second proportion of Waf interception status codes of the malicious IP address, and calculate a blocking coefficient of the malicious IP address according to the first proportion, the second proportion, and a preset weighting coefficient, and then determine whether the blocking coefficient is greater than or equal to a preset second threshold;

[0109] S1037. When the blocking coefficient is greater than or equal to the second threshold, determine the step-by-step blocking and unblocking strategy for the malicious IP address: block the malicious IP address for a preset first period of time and add it to a temporary blacklist; if the malicious IP address launches a network attack again, block the malicious IP address for a preset second period of time and add it to the malicious list; if the malicious IP address launches a network attack for the third time, permanently block the malicious IP address.

[0110] Specifically, the embodiment of the present invention implements corresponding step-by-step blocking and unblocking strategies based on the results of retrieval and analysis, such as excessively high proportion of abnormal status codes, abnormal requested URIs, etc. Different blocking strategies are implemented according to different IP host situations, such as foreign IPs, inter-provincial export gateways, mobile base stations, IDC computer room exports, etc. This flexible blocking strategy can improve the accuracy and flexibility of blocking, avoid unnecessary impact on the business, and achieve safe and seamless embedding.

[0111] The ban coefficient can be calculated by the following formula:

[0112] S=A·P ES +B·P Waf

[0113] Among them, S represents the ban coefficient, P ES The first percentage of ES request status codes representing malicious IP addresses, P Waf Indicates the second proportion of Waf interception status codes of malicious IP addresses. A and B represent preset weight coefficients.

[0114] S104. Perform attack protection response to malicious IP attack behaviors through the SOAR system according to IP blocking tasks and step-by-step blocking and unblocking strategies.

[0115] like Figure 6 FIG. 1 is a flow chart of step S104 provided in an embodiment of the present invention, referring to FIG. Figure 6 As an optional implementation method, the SOAR system performs attack protection response to malicious IP attacks according to IP blocking tasks and step-by-step blocking and unblocking strategies, which is specifically as follows:

[0116] S1041. Automatically identify malicious IP attack behaviors based on IP blocking tasks through the SOAR system, generate corresponding security event alerts and display them;

[0117] S1042. Automatically generate a security response operation according to the step-by-step blocking and unblocking strategy, and execute the security response operation.

[0118] Specifically, the SOAR system can automatically orchestrate the security incident handling process, automatically identify and classify security incidents through preset security rules and policies, assign incidents to corresponding processing processes, and automatically handle them according to preset steps. This orchestration capability can greatly improve the response speed and processing efficiency of security incidents. The SOAR system can automatically generate and execute corresponding security response operations based on preset security rules and policies, such as isolating the network, isolating the host, and starting log auditing. This automated response capability can quickly respond to security incidents and reduce the time and cost of manual intervention.

[0119] like Figure 7 FIG. 1 is another flow chart of a method for protecting against malicious network attacks according to an embodiment of the present invention. Figure 7 As an optional implementation, the network malicious attack protection method further includes the following steps:

[0120] S105. Generate a response process record of the attack protection response through the SOAR system, and perform network malicious attack trend analysis based on the response process record to obtain a system optimization strategy.

[0121] The above is an explanation of the method steps of the embodiment of the present invention. It can be understood that the embodiment of the present invention can more effectively process IP blocking requests by using historical big data request retrieval and SOAR automated orchestration tool system, and can more flexibly respond to different network attack modes by using step-by-step blocking and unblocking strategies, thereby improving the efficiency and accuracy of network malicious attack protection, enhancing the adaptability and flexibility of processing strategies, and thus enhancing network security.

[0122] Compared with the prior art, the embodiments of the present invention also have the following advantages:

[0123] 1. Use SOAR system for automated orchestration and response: This method changes the traditional manual operation mode and greatly improves the efficiency and accuracy of network malicious attack protection. Specifically, the SOAR system can detect and contain attacks within 5 minutes, which is 10 times faster than the traditional manual method (which takes 50 minutes). Similarly, the SOAR system only takes 30 seconds to block an IP with one click, while the manual method takes 5 to 10 minutes. In addition, the SOAR system can also achieve 7x24 hours of automated disposal and fully complete multiple collaborative tasks, which is impossible with traditional manual operation methods.

[0124] 2. Implement a step-by-step blocking and unblocking strategy: Based on the results of retrieval and analysis, implement the corresponding step-by-step blocking and unblocking strategy. This flexible blocking strategy can improve the accuracy and flexibility of blocking, avoid unnecessary impact on the business, and achieve safe and seamless embedding. This is incomparable to the traditional one-size-fits-all blocking strategy.

[0125] 3. Malicious attack detection based on historical big data request retrieval: The patented technology foundation uses historical big data for malicious attack detection, which can more accurately identify malicious IP addresses, thereby improving the efficiency and accuracy of network malicious attack protection. This is incomparable to traditional methods based on real-time data detection.

[0126] 4. Provide operation process records and trend statistical analysis: It can help system administrators better understand the operating status of the system, so as to more accurately identify possible problems and optimization solutions. This is incomparable to traditional methods that cannot provide detailed operation records and statistical analysis.

[0127] like Figure 8 FIG. 1 is a schematic diagram of the structure of a video face swapping system provided by an embodiment of the present invention, referring to FIG. Figure 8The embodiment of the present invention provides a network malicious attack protection system, including:

[0128] A data collection module, used to collect historical access request data in the network;

[0129] The data retrieval module is used to retrieve and analyze historical access request data through Elasticsearch to obtain malicious IP addresses and IP analysis information of malicious IP addresses;

[0130] Task scheduling and policy determination module, which is used to automatically schedule IP blocking tasks based on malicious IP addresses through the SOAR system, and determine the step-by-step blocking and unblocking strategies based on IP analysis information;

[0131] The attack protection response module is used to respond to malicious IP attack behaviors through the SOAR system according to IP blocking tasks and step-by-step blocking and unblocking strategies.

[0132] The contents of the above method embodiments are all applicable to the present system embodiments. The functions specifically implemented by the present system embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0133] The embodiment of the present invention also provides an electronic device, the electronic device comprising: a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory, and the program is executed by the processor to realize the above-mentioned network malicious attack protection method. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0134] like Fig. 9 FIG. 1 is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present invention. Fig. 9 , an embodiment of the present invention provides an electronic device, including:

[0135] The processor 901 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention;

[0136] The memory 902 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 902, and the processor 901 calls and executes the network malicious attack protection method of the embodiment of the present invention;

[0137] Input / output interface 903, used to implement information input and output;

[0138] Communication interface 904, used to realize communication interaction between the device and other devices, which can be realized by wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WIFI, Bluetooth, etc.);

[0139] A bus 905 that transmits information between the various components of the device (e.g., the processor 901, the memory 902, the input / output interface 903, and the communication interface 904);

[0140] The processor 901 , the memory 902 , the input / output interface 903 and the communication interface 904 are connected to each other in communication within the device via a bus 905 .

[0141] like Fig.10 FIG. 1 is a schematic diagram of the structure of a storage medium provided in an embodiment of the present invention, referring to FIG. Fig.10 The embodiment of the present invention also provides a storage medium, which is a computer-readable storage medium used for computer-readable storage. The storage medium stores one or more programs 1001, and the one or more programs 1001 can be executed by one or more processors to implement the above-mentioned network malicious attack protection method.

[0142] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0143] The embodiment of the present invention also discloses a computer program product or a computer program, wherein the computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes Figure 1 The method shown.

[0144] In some selectable embodiments, the function / operation mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the function / operation involved, the two boxes shown in succession can actually be executed substantially simultaneously or the above-mentioned boxes can sometimes be executed in reverse order. In addition, the embodiment presented and described in the flow chart of the present invention is provided by way of example, for the purpose of providing a more comprehensive understanding of technology. The disclosed method is not limited to the operation and logic flow presented herein. Selectable embodiments are expected, wherein the order of various operations is changed and the sub-operation of a part for which is described as a larger operation is performed independently.

[0145] In addition, although the present invention is described in the context of functional modules, it should be understood that, unless otherwise specified to the contrary, one or more of the above-mentioned functions and / or features can be integrated into a single physical device and / or software module, or one or more functions and / or features can be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the present invention. More specifically, in view of the properties, functions and internal relationships of the various functional modules in the device disclosed herein, the actual implementation of the module will be understood within the conventional skills of the engineer. Therefore, those skilled in the art can implement the present invention set forth in the claims without excessive experimentation using ordinary techniques. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present invention, which is determined by the full scope of the appended claims and their equivalents.

[0146] If the above functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the above methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0147] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0148] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and editable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the above-mentioned program is printed, since the above-mentioned program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or processing in other suitable ways as necessary, and then stored in a computer memory.

[0149] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0150] In the above description of this specification, the description with reference to the terms "one embodiment / example", "another embodiment / example" or "certain embodiments / examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0151] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

[0152] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the above embodiments. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of this application.

Claims

1. A method for protecting against malicious network attacks, characterized in that: The following steps are involved: Collect historical access request data in the network; Retrieving and analyzing the historical access request data through Elasticsearch to obtain malicious IP addresses and IP analysis information of the malicious IP addresses; Automatically arrange IP blocking tasks according to the malicious IP addresses through the SOAR system, and determine the step-by-step blocking and unblocking strategies based on the IP analysis information; Performing attack protection response to malicious IP attack behaviors through the SOAR system according to the IP blocking task and the step-by-step blocking and unblocking strategy; The step of determining the step-by-step blocking and unblocking strategy according to the IP analysis information specifically includes: Determine whether the IP address of the malicious IP address is located abroad; When the IP address of the malicious IP address is located abroad, the step-by-step blocking and unblocking strategy of the malicious IP address is determined as follows: the malicious IP address is blocked for a preset first period of time and added to a temporary blacklist; if the malicious IP address conducts a network attack again, the malicious IP address is blocked for a preset second period of time and added to a malicious list; if the malicious IP address conducts a network attack for the third time, the malicious IP address is permanently blocked; When the IP address of the malicious IP address is located in China, determine a first proportion of the ES request status code of the malicious IP address and a second proportion of the Waf interception status code, and calculate a blocking coefficient of the malicious IP address according to the first proportion, the second proportion and a preset weighting coefficient, and then determine whether the blocking coefficient is greater than or equal to a preset second threshold; When the blocking coefficient is greater than or equal to the second threshold, the step-by-step blocking and unblocking strategy for the malicious IP address is determined to be to block the malicious IP address for a preset first period of time and add it to a temporary blacklist; if the malicious IP address launches a network attack again, the malicious IP address will be blocked for a preset second period of time and will be added to the malicious list; if the malicious IP address launches a network attack for the third time, the malicious IP address will be permanently blocked.

2. A network malicious attack protection method according to claim 1, characterized in that: The step of collecting historical access request data in the network specifically includes: Use Logstash to collect syslog outbound data from security devices and access request data logs from gateways; Outputting the syslog outgoing data and the access request data log as the historical access request data to Kafka; The syslog outgoing data and the access request data log are both configured with tags, and the tags are used to distinguish the source of the data.

3. A network malicious attack protection method according to claim 1, characterized in that: The step of retrieving and analyzing the historical access request data through Elasticsearch to obtain the malicious IP address and the IP analysis information of the malicious IP address specifically includes: Constructing a query request through the query DSL of Elasticsearch, wherein the query request is used to find the target IP address in the historical access request data; Retrieving all access records of the target IP address according to the query request, and counting the target access records in which the target status code appears, and then determining the ratio of the target access record to the total access records to determine the proportion of abnormal status codes; When the proportion of the abnormal status code is greater than or equal to a preset first threshold, the target IP address is determined to be a malicious IP address, and the IP analysis information of the malicious IP address is determined, the IP analysis information including the IP location, inter-provincial exit gateway, mobile base station, IDC computer room exit and the proportion of the abnormal status code.

4. A network malicious attack protection method according to claim 1, characterized in that: The step of automatically arranging IP blocking tasks according to the malicious IP addresses through the SOAR system specifically includes: The SOAR system generates multiple IP blocking subtasks according to the malicious IP address, and the IP blocking subtasks include a blocking object identification task, a blacklist and whitelist judgment task, a CDN judgment task, an inter-provincial exit gateway identification task, a mobile base station identification task, an IDC room exit identification task, a business IP judgment task, a decision-making blocking device task, a blocking instruction issuance task, a delayed automatic unblocking task, and a blocking list maintenance task; Arranging a task script for the IP blocking subtask to generate the IP blocking task; Determine a workflow engine for the IP blocking task, and execute the IP blocking task through the workflow engine.

5. A network malicious attack protection method according to claim 1, characterized in that: The step of performing attack protection response to malicious IP attacks by the SOAR system according to the IP blocking task and the step blocking and unblocking strategy is specifically as follows: The SOAR system automatically identifies malicious IP attack behaviors according to the IP blocking task, generates corresponding security event alerts and displays them; A security response operation is automatically generated according to the step-by-step blocking and unblocking strategy, and the security response operation is executed.

6. A network malicious attack protection method according to any one of claims 1 to 5, characterized in that: The network malicious attack protection method also includes the following steps: A response process record of the attack protection response is generated by the SOAR system, and a network malicious attack trend analysis is performed based on the response process record to obtain a system optimization strategy.

7. A network malicious attack protection system, characterized in that: include: A data collection module, used to collect historical access request data in the network; A data retrieval module, used to retrieve and analyze the historical access request data through Elasticsearch to obtain malicious IP addresses and IP analysis information of the malicious IP addresses; A task scheduling and strategy determination module, which is used to automatically schedule IP blocking tasks according to the malicious IP addresses through the SOAR system, and determine the step-by-step blocking and unblocking strategies according to the IP analysis information; An attack protection response module, used to perform attack protection response to malicious IP attack behaviors through the SOAR system according to the IP blocking task and the step blocking and unblocking strategy; Determining the step-by-step blocking and unblocking strategy based on the IP analysis information specifically includes: Determine whether the IP address of the malicious IP address is located abroad; When the IP address of the malicious IP address is located abroad, the step-by-step blocking and unblocking strategy of the malicious IP address is determined as follows: the malicious IP address is blocked for a preset first period of time and added to a temporary blacklist; if the malicious IP address conducts a network attack again, the malicious IP address is blocked for a preset second period of time and added to a malicious list; if the malicious IP address conducts a network attack for the third time, the malicious IP address is permanently blocked; When the IP address of the malicious IP address is located in China, determine a first proportion of the ES request status code of the malicious IP address and a second proportion of the Waf interception status code, and calculate a blocking coefficient of the malicious IP address according to the first proportion, the second proportion and a preset weighting coefficient, and then determine whether the blocking coefficient is greater than or equal to a preset second threshold; When the blocking coefficient is greater than or equal to the second threshold, the step-by-step blocking and unblocking strategy for the malicious IP address is determined to be to block the malicious IP address for a preset first period of time and add it to a temporary blacklist; if the malicious IP address launches a network attack again, the malicious IP address will be blocked for a preset second period of time and will be added to the malicious list; if the malicious IP address launches a network attack for the third time, the malicious IP address will be permanently blocked.

8. An electronic device, characterized in that: The electronic device includes a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory. When the program is executed by the processor, the steps of the network malicious attack protection method as described in any one of claims 1 to 6 are realized.

9. A storage medium, the storage medium being a computer-readable storage medium, used for computer-readable storage, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the network malicious attack protection method as described in any one of claims 1 to 6.

Images