Network security detection method and device, electronic equipment and computer readable medium

Abstract

The application discloses a network security detection method and device, electronic equipment and computer readable medium, relates to the technical field of computers, and the method comprises the following steps: in response to a network security detection request, acquiring a corresponding terminal identifier, and then acquiring corresponding network environment data according to the terminal identifier; based on the network environment data, performing matching with a known threat signature library, in response to a matching failure, calling an intelligent agent to extract network threat features in the network environment data; inputting the network threat features into a threat detection model to determine the probability of each network threat category corresponding to the network threat features based on the decision tree in the threat detection model; based on the probability, determining the target network threat category corresponding to the network threat features; triggering the corresponding early warning mechanism according to the target network threat category to send alarm information to the target management node. Through the combination of the known threat signature library and the intelligent agent for network threat detection, the efficiency and accuracy of network security detection can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a network security detection method and device, electronic equipment and computer readable medium. BACKGROUND

[0002] At present, with the rapid development of information technology, network security problems are increasingly prominent. Traditional network security detection methods are mostly based on fixed rules and models, which are difficult to cope with the changing network threats. For example, traditional network security detection methods are mainly based on firewall, intrusion detection system (IDS) and intrusion prevention system (IPS) and other technologies. Firewall prevents unauthorized access and data transmission by setting access control rules. IDS detects potential intrusion behavior by monitoring network traffic and system logs. IPS combines the detection function of IDS and the defense function of firewall, and can take defensive measures when detecting intrusion behavior. However, these traditional methods gradually show their limitations when facing increasingly complex and variable network threats. They can only detect known threats, and are difficult to cope with new unknown threats. In addition, due to the static rules and pattern matching, these methods are not ideal in dealing with complex attack methods and metamorphic technology, and the network security detection accuracy is low. SUMMARY

[0003] Therefore, the embodiments of the present application provide a network security detection method, device, electronic equipment and computer readable medium, which can solve the problem of low network security detection accuracy.

[0004] To achieve the above-mentioned purpose, according to an aspect of the embodiments of the present application, a network security detection method is provided, comprising: in response to a network security detection request, obtaining a corresponding terminal identifier, and then obtaining corresponding network environment data according to the terminal identifier; based on the network environment data, performing matching with a known threat signature library, in response to the matching failure, calling an intelligent agent to extract network threat features in the network environment data; inputting the network threat features into a threat detection model to determine the probability of each network threat category corresponding to the network threat features based on the decision tree in the threat detection model; based on the probability, determining the target network threat category corresponding to the network threat features; triggering the corresponding early warning mechanism according to the target network threat category to send alarm information to the target management node.

[0005] Optionally, the network security detection method further comprises: obtaining feedback information of the target management node, in response to the feedback information containing a negative identification of the target network threat category, updating the threat detection model based on the feedback information.

[0006] Optionally, the matching with the known threat signature library based on the network environment data comprises: performing similarity matching between the network environment data and threat description data corresponding to each threat in the known threat signature library, and determining that the matching fails if each similarity obtained is lower than a preset threshold.

[0007] Optionally, the target network threat category corresponding to the network threat feature is determined based on the probability, which comprises: determining the network threat category corresponding to the probability higher than the preset threshold as the target network threat category.

[0008] Optionally, the corresponding early warning mechanism is triggered according to the target network threat category, which comprises: determining a warning level corresponding to the target network threat category, and triggering the corresponding early warning mechanism based on the warning level.

[0009] Optionally, before the alarm information is sent to the target management node, the method further comprises: automatically executing an emergency strategy corresponding to the target network threat category, obtaining emergency processing result data, and generating the alarm information according to the terminal identifier, the target network threat category and the emergency processing result data.

[0010] In addition, the application also provides a network security detection device, which comprises: an acquisition unit configured to acquire a corresponding terminal identifier in response to a network security detection request, and then acquire corresponding network environment data according to the terminal identifier; a matching unit configured to perform matching with a known threat signature library based on the network environment data, and call an intelligent agent to extract a network threat feature in the network environment data in response to a matching failure; a probability determination unit configured to input the network threat feature into a threat detection model, so as to determine a probability that the network threat feature corresponds to each network threat category based on a decision tree in the threat detection model; a category determination unit configured to determine a target network threat category corresponding to the network threat feature based on the probability; and a sending unit configured to trigger a corresponding early warning mechanism according to the target network threat category, and send alarm information to a target management node.

[0011] Optionally, the network security detection device further comprises an updating unit configured to: acquire feedback information of the target management node, and update the threat detection model based on the feedback information in response to the feedback information containing a negative identifier for the target network threat category.

[0012] Optionally, the matching unit is further configured to: perform similarity matching between the network environment data and threat description data corresponding to each threat in the known threat signature library, and determine that the matching fails if each similarity obtained is lower than a preset threshold.

[0013] Optionally, the category determination unit is further configured to: determine the network threat category corresponding to the probability higher than the preset threshold as the target network threat category.

[0014] Optionally, the sending unit is further configured to determine a warning level corresponding to the target network threat category, and trigger a corresponding warning mechanism based on the warning level.

[0015] Optionally, the network security detection apparatus further comprises an emergency unit configured to automatically execute an emergency strategy corresponding to the target network threat category, and obtain emergency processing result data, and generate alarm information according to the terminal identifier, the target network threat category and the emergency processing result data.

[0016] In addition, the present application also provides a network security detection electronic device, comprising: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the network security detection method as described above.

[0017] In addition, the present application also provides a computer readable medium having a computer program stored thereon, the program being executed by a processor to implement the network security detection method as described above.

[0018] To achieve the above object, according to another aspect of the embodiments of the present application, a computer program product is provided.

[0019] The computer program product of the embodiments of the present application comprises a computer program, which is executed by a processor to implement the network security detection method provided by the embodiments of the present application.

[0020] The above-mentioned embodiment of the application has the following advantages or beneficial effects: the present application obtains the corresponding terminal identifier in response to the network security detection request, and then obtains the corresponding network environment data according to the terminal identifier; based on the network environment data, the matching with the known threat signature library is performed, in response to the matching failure, the agent is called to extract the network threat features in the network environment data; the network threat features are input into the threat detection model to determine the probability of each network threat category corresponding to the network threat features based on the decision tree in the threat detection model; based on the probability, the target network threat category corresponding to the network threat features is determined; according to the target network threat category, the corresponding warning mechanism is triggered to send the alarm information to the target management node. By combining the known threat signature library and the agent for network threat detection, the efficiency and accuracy of network security detection can be improved.

[0021] The further effects of the above-mentioned non-conventional optional mode will be described in the following combined with the specific embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0022] The accompanying drawings for a better understanding of the present application, and do not constitute an undue limitation on the present application. Among them:

[0023] Figure 1 is a schematic diagram of the main flow of a network security detection method according to an embodiment of the present application;

[0024] Figure 2 is a schematic diagram of the main flow of a network security detection method according to an embodiment of the present application;

[0025] Figure 3 is a schematic diagram of the main flow of a network security detection method according to an embodiment of the present application;

[0026] Figure 4 is a schematic diagram of the main units of a network security detection apparatus according to an embodiment of the present application;

[0027] Figure 5 is an exemplary system architecture diagram to which embodiments of the present application can be applied;

[0028] Figure 6 is a structural schematic diagram of a computer system of a terminal device or a server suitable for use to implement embodiments of the present application. DETAILED DESCRIPTION

[0029] Exemplary embodiments of the present application are described below with reference to the accompanying drawings, which include various details of the embodiments of the present application to assist in understanding, which should be considered in a descriptive sense only. It will thus be appreciated that various modifications and changes can be made to the embodiments described here without departing from the scope and spirit of the present application. Also, for the sake of brevity and clarity, descriptions of well-known functions and constructions are omitted from the following description. It should be noted that the acquisition, transmission, storage, use, processing, etc. of data in the technical solutions of the present application comply with relevant provisions of national laws and regulations. It should be noted that in the embodiments of the present application, some industry existing solutions, components, models, etc. may be mentioned, which should be considered as exemplary, and the purpose is only to illustrate the feasibility of the implementation of the technical solutions of the present application, but it does not mean that the applicant has or will necessarily use the solution. In the technical solutions of the present application, the collection, analysis, use, transmission, storage, etc. of user personal information comply with relevant laws and regulations, are used for legal and reasonable purposes, are not shared, leaked or sold outside these legal uses, and are subject to supervision and management by regulatory authorities. Necessary measures are taken to prevent illegal access to such user personal information data, to ensure that personnel with access to personal information data comply with relevant laws and regulations, and to ensure the security of user personal information. Once these user personal information data are no longer needed, the risk should be minimized by limiting or even prohibiting data collection and / or deleting data.

[0030] When in use, including in certain related applications, user privacy is protected by de-identifying data, such as by removing specific identifiers, controlling the amount or specificity of data stored, controlling how data is stored, and / or other methods of de-identification.

[0031] Figure 1 is a schematic diagram of the main flow of a network security detection method according to an embodiment of the present application, as shown, the network security detection method mainly includes the following steps S101 to S105. Figure 1

[0032] Step S101, in response to a network security detection request, the corresponding terminal identifier is obtained, and then the corresponding network environment data is obtained according to the terminal identifier.

[0033] In this embodiment, the execution subject of the network security detection method (for example, it can be a server) can receive the network security detection request through wired connection or wireless connection. The execution subject can obtain the terminal identifier carried in the request when receiving the network security detection request. The terminal identifier is used to represent the number or name of the terminal that needs to be detected for network security. The execution subject can obtain the network environment data within a preset period from the terminal corresponding to the terminal identifier after obtaining the terminal identifier. The preset period can be the past few days or the past few weeks, and the present application embodiment does not make specific limitation to the preset period. The network environment data can include network traffic data, device state data and user behavior data, and the present application embodiment does not make specific limitation to the network environment data.

[0034] Step S102, based on the network environment data, perform matching with the known threat signature library, and in response to the matching failure, call the agent to extract the network threat features in the network environment data.

[0035] After the execution subject obtains the network environment data, it can first match with each known threat in the known threat signature library to find out whether there is a known threat that can be directly matched, so as to speed up the network security detection response speed. If the matching fails in the known signature library, i.e. there is no known threat in the known signature library that can be directly matched with the network environment data, the execution subject can call the agent to extract the network threat features in the network environment data based on the preset dimension, wherein the preset dimension can be the dimension that the agent learns to accurately identify the network threat features, for example, it can include access control dimension, malicious software dimension, information leakage dimension, vulnerability exploitation dimension, data tampering and hijacking dimension, wireless network attack dimension, etc., and the present application embodiment does not make specific limitation to the preset dimension.

[0036] ​Step S103, input the network threat feature into the threat detection model to determine the probability that the network threat feature corresponds to each network threat category based on the decision tree in the threat detection model.

[0037] There can be multiple decision trees in the threat detection model, and each decision tree can be used to determine the probability that the input network threat feature corresponds to the network threat category corresponding to the decision tree.

[0038] Step S104, determine the target network threat category corresponding to the network threat feature based on the probability.

[0039] Specifically, based on the probability, the target network threat category corresponding to the network threat feature is determined, including: determining the network threat category corresponding to the probability higher than the preset threshold as the target network threat category.

[0040] The execution subject can determine the network threat category corresponding to one or more probabilities higher than the preset threshold in the probabilities output by each decision tree as the target network threat category. That is, the number of target network threat categories can be one or more, and the number of target network threat categories is not limited in the embodiments of the present application. Thus, the accuracy of the determined target network threat category is ensured.

[0041] Step S105, trigger the corresponding early warning mechanism according to the target network threat category to send alarm information to the target management node.

[0042] Specifically, the corresponding early warning mechanism is triggered according to the target network threat category, including: determining the early warning level corresponding to the target network threat category, and triggering the corresponding early warning mechanism based on the early warning level.

[0043] The target network threat category is matched with the key-value pair data in the preset network threat category-early warning level key-value pair database. In the network threat category-early warning level key-value pair database, the network threat category is the key, and the early warning level is the value. The value corresponding to the target network threat category in the matched key-value pair data is determined as the early warning level corresponding to the target threat category. Further, the corresponding early warning mechanism is determined based on the determined early warning level corresponding to the target network threat category, and the corresponding early warning mechanism is triggered to perform early warning, reminding the corresponding processing node to timely perform network threat processing according to the early warning to ensure network security.

[0044] The embodiment obtains the terminal identifier corresponding to the network security detection request, and then obtains the network environment data corresponding to the terminal identifier. Based on the network environment data, the matching with the known threat signature library is performed. In response to the matching failure, the agent is called to extract the network threat features in the network environment data. The network threat features are input into the threat detection model to determine the probability of each network threat category corresponding to the network threat features based on the decision tree in the threat detection model. Based on the probability, the target network threat category corresponding to the network threat features is determined. The corresponding early warning mechanism is triggered according to the target network threat category to send the alarm information to the target management node. The network threat detection is performed by combining the known threat signature library and the agent, which can improve the efficiency and accuracy of network security detection.

[0045] Figure 2 The main flowchart of the network security detection method according to an embodiment of the application is shown in FIG. 1. Figure 2 As shown in FIG. 1, the network security detection method mainly includes the following steps S201 to S206.

[0046] Step S201, in response to a network security detection request, a terminal identifier corresponding to the network security detection request is obtained, and then network environment data corresponding to the terminal identifier is obtained.

[0047] The network security detection request can be triggered at a regular time or manually triggered by a user. The application does not make specific limitations on the triggering time of the network security detection request. After receiving the triggered network security detection request, the execution subject can obtain the terminal identifier carried in the request, and obtain the corresponding network environment data according to the terminal identifier. The network environment data can include network traffic data, device state data, software application data, and user behavior data.

[0048] Step S202, based on the network environment data, the matching with the known threat signature library is performed, and in response to the matching failure, the agent is called to extract the network threat features in the network environment data.

[0049] The network environment data is directly matched with the data in the known threat signature library. Specifically, the network environment data can be converted into a vector and matched with the data in the known signature library for cosine similarity. When the obtained cosine similarity is less than a preset threshold, it indicates that the matching fails, and the execution subject can continue to call the agent to extract the network threat features in the network environment data. For example, the network threat features can include access control features, malicious software features, information leakage features, vulnerability exploitation features, data tampering and hijacking features, wireless network attack features, etc. The application does not make specific limitations on the network threat features.

[0050] Step S203, input the network threat feature into the threat detection model to determine the probability that the network threat feature corresponds to each network threat category based on the decision tree in the threat detection model.

[0051] Each decision tree in the threat detection model respectively makes an evaluation decision on the input network threat feature to obtain the probability that the network threat feature corresponds to the network threat category corresponding to each decision tree.

[0052] Step S204, determine the target network threat category corresponding to the network threat feature based on the probability.

[0053] Each probability is compared with a preset threshold, and the network threat category corresponding to the probability greater than the preset threshold is determined as the target network threat category, so that the target network threat category corresponding to the obtained network environment data can be determined based on the threat detection model, making the determination of the target network threat category corresponding to the network environment data more comprehensive and accurate.

[0054] Step S205, trigger the corresponding early warning mechanism according to the target network threat category to send alarm information to the target management node.

[0055] Specifically, before sending the alarm information to the target management node, the method further comprises: automatically executing an emergency strategy corresponding to the target network threat category, and obtaining emergency processing result data, and generating the alarm information according to the terminal identifier, the target network threat category and the emergency processing result data.

[0056] If the target network threat category has a related emergency strategy in the emergency strategy database, the subject can automatically execute the emergency strategy corresponding to the target network threat category after determining the target network threat category, and obtain emergency processing result data, wherein the emergency processing result data can include target network threat processing success data or partial processing success data, and the subject can generate alarm information according to the terminal identifier, the target network threat category and the emergency processing result data after obtaining the emergency processing result data. The alarm information can be voice alarm information or text alarm information, and the form of the alarm information is not limited in the embodiments of the present application.

[0057] Step S206, obtain feedback information of the target management node, and update the threat detection model based on the feedback information in response to the feedback information containing a negative identification of the target network threat category.

[0058] The target management node can be an offline network threat processing node. After receiving the alarm information, the target management node can review the terminal identifier, the target network threat type, and the emergency processing result data in the alarm information, and generate feedback information based on the review result, and send the feedback information to the execution subject. After receiving the feedback information from the target management node, the execution subject analyzes the feedback information to determine whether the feedback information contains a negative identifier. If the feedback information contains a negative identifier, it means that the alarm information is incorrect. The execution subject can obtain correction data associated with the negative identifier, and update the threat detection model based on the correction data, so that the probability of each decision tree in the updated threat detection model corresponding to each network threat type is more accurate when determining the network threat features.

[0059] Figure 3 Figure 1 is a schematic diagram of the main process of a network security detection method according to an embodiment of the present application. As shown in Figure 1, the network security detection method mainly includes the following steps S301 to S306. Figure 3

[0060] Step S301, in response to a network security detection request, a corresponding terminal identifier is obtained, and then network environment data corresponding to the terminal identifier is obtained.

[0061] Step S302, the network environment data is matched with the threat description data corresponding to each threat in the known threat signature library. If each similarity obtained is lower than a preset threshold, it is determined that the matching fails.

[0062] The execution subject can input the network environment data into the word segmentation model to perform word segmentation processing based on each word segmentation dimension corresponding to the word segmentation model, to obtain each word segmentation. Each word segmentation obtained is matched with the threat description data corresponding to each threat in the known threat signature library. For example, the threat description data can include malicious software installation, data tampering and hijacking, vulnerability exploitation, information leakage, wireless network attack, etc. The embodiments of the present application do not make specific limitations on the threat description data. The execution subject can obtain each similarity obtained after similarity matching. If each similarity obtained is lower than a preset threshold, it is determined that the network environment data fails to match the threat description data corresponding to each threat in the known threat signature library.

[0063] Step S303, in response to the matching failure, an intelligent agent is called to extract network threat features in the network environment data.

[0064] For example, the intelligent agent can be an AI Agent. The network threat features can include access control features, malicious software features, information leakage features, vulnerability exploitation features, data tampering and hijacking features, wireless network attack features, etc. The embodiments of the present application do not make specific limitations on the network threat features.​

[0065] In step S304, the network threat feature is input into the threat detection model to determine the probability that the network threat feature corresponds to each network threat category based on the decision tree in the threat detection model.

[0066] The threat detection model detects and identifies the security threat in the network environment based on the analysis result of the agent AI Agent, i.e., the network threat feature. By comprehensively using various algorithms and models, the network threat feature extracted by the AI Agent is further processed and analyzed to determine the probability that the network threat feature corresponds to each network threat category, so as to improve the accuracy and efficiency of network threat detection.

[0067] In step S305, the target network threat category corresponding to the network threat feature is determined based on the probability.

[0068] The probabilities are compared with the preset threshold, and the network threat category corresponding to the probability greater than the preset threshold is determined as the target network threat category, so that the target network threat category corresponding to the obtained network environment data can be determined based on the threat detection model, and the determination of the target network threat category corresponding to the network environment data is more comprehensive and accurate.

[0069] In step S306, the corresponding early warning mechanism is triggered according to the target network threat category to send alarm information to the target management node.

[0070] If the target network threat category does not have a related emergency strategy in the emergency strategy database, the alarm information can be generated directly according to the terminal identifier and the target network threat category to effectively avoid network security incidents. The alarm information can be voice alarm information or text alarm information, and the form of the alarm information is not limited in the embodiments of the present application.

[0071] AI Agent: AI Agent (Intelligent Agent, also known as Artificial Intelligence Assistant) is an intelligent agent with autonomous decision-making ability, environmental perception ability and reaction ability in the field of artificial intelligence. It represents the advanced form of artificial intelligence technology in specific application scenarios, and can provide intelligent decision support and automated services for users based on complex data analysis and pattern recognition. The implementation of AI Agent relies on advanced artificial intelligence technologies such as deep learning and machine learning, and through a large amount of data training and optimization, AI Agent can gradually improve its performance in specific tasks, thereby providing more accurate and efficient services for users. Network security: Through necessary measures, prevent attacks, intrusions, interference, destruction and illegal use of networks, and accidental incidents, so that the network is in a stable and reliable running state, and the ability to protect the integrity, confidentiality and availability of network data. In today's increasingly information-based society, network security has become an important part of national security, involving politics, economy, culture, society, ecology, national defense and other fields, and is one of the most complex, realistic and severe non-traditional security issues facing China. Security testing: an important link to ensure the security of systems, networks or applications, its main purpose is to find, evaluate and respond to potential security risks through a series of technologies and processes. For example, network security testing can involve multiple levels, including hardware, software, network, etc.

[0072] Network security testing includes the following types: vulnerability scanning, intrusion detection, malware detection and configuration audit.

[0073] Vulnerability scanning: using specific tools and technologies to conduct comprehensive security vulnerability detection on systems, networks or applications. These tools can be based on known vulnerability databases to automatically detect potential security risks such as unpatched software vulnerabilities, configuration errors, etc.

[0074] Intrusion detection: by monitoring network traffic and system logs, detecting abnormal behavior or potential attack activities. Intrusion detection systems can analyze data in real time to detect potential intrusion activities and issue alerts in a timely manner.

[0075] Malware detection: using anti-virus software, anti-spyware tools, etc. to detect and remove malicious software such as viruses, Trojans, spyware, etc. from the system.

[0076] Configuration audit: checks the configuration settings of systems and applications to ensure they meet security best practices and do not expose sensitive information or unnecessary services. Security incident response: after a security incident occurs, respond quickly, including collecting evidence, analyzing attack paths, restoring systems, etc. to minimize losses and prevent further attacks.

[0077] The embodiments of the present application perform network security detection based on an intelligent agent (AI Agent). By utilizing the autonomous learning and intelligent analysis capabilities of the AI Agent, intelligent, efficient, and accurate security detection of the network environment is achieved. Not only can the characteristics of network threats be adaptively learned, but new unknown threats can also be detected and addressed in real time, thereby overcoming the limitations of traditional methods and existing solutions and improving the efficiency and accuracy of network security protection. By utilizing the autonomous learning and intelligent analysis capabilities of the AI Agent, intelligent, efficient, and accurate security detection of the network environment is achieved. Through adaptive learning and intelligent analysis, the AI Agent can update its threat identification capabilities in real time and effectively address new unknown threats. At the same time, the flexibility and adaptability of the AI Agent also enable it to better adapt to changing network environments, improving the accuracy and efficiency of detection. In addition, the embodiments of the present application also improve the processing capacity of large-scale network data to ensure that high-efficiency and accurate detection capabilities are maintained even in the face of a surge in data volume. The embodiments of the present application can achieve more intelligent, efficient, and accurate network security detection to address the ever-changing network security threats.

[0078] In the embodiments of the present application, first, by introducing the autonomous learning and intelligent analysis capabilities of the intelligent agent (AI Agent), the characteristics of network threats can be adaptively learned, and effective detection of unknown threats can be achieved. Second, the comprehensive use of multiple algorithms and models improves the accuracy and efficiency of detection. Finally, the automated functions of the early warning and response module can reduce the workload of administrators and improve the efficiency of network security management. The AI Agent can learn and identify the characteristics of network threats through analysis of a large amount of network data. This process relies on advanced artificial intelligence technologies such as deep learning and machine learning, enabling the AI Agent to gradually optimize its threat identification capabilities and adapt to changing network environments.

[0079] In the embodiments of the present application, the execution subject can include a data collection module, an AI Agent module, a threat detection module, and an early warning and response module.

[0080] The data collection module is used to collect various types of data in the network environment in real time, including network traffic, device status, user behavior, etc., providing a rich data source for subsequent threat detection. The network environment can include one or more of WeChat, mini programs, websites, and APPs, and the embodiments of the present application do not make specific limitations on the network environment.

[0081] The AI Agent module uses AI Agents trained through deep learning and machine learning to intelligently analyze various types of data collected by the data collection module and identify potential network security threats.

[0082] The threat detection module detects and identifies security threats in the network environment based on the analysis results of the AI Agent module. This module further processes and analyzes the features extracted by the AI Agent module by comprehensively using various algorithms and models to improve the accuracy and efficiency of detection.

[0083] Meanwhile, when the threat detection module detects network security threats, the early warning and response module can trigger the early warning mechanism and send alarm information to the administrator, and automatically take corresponding measures according to the preset response strategy (i.e. emergency strategy), such as isolating the threat source and blocking the attack path, to minimize losses.

[0084] Based on the agent (AI Agent), the network security detection provides a more intelligent, efficient and accurate network security detection scheme for the network security field, which can realize adaptive learning, intelligent analysis and real-time detection of network security. By using the autonomous learning and intelligent analysis capabilities of the AI Agent, intelligent, efficient and accurate security detection of the network environment is realized, which helps to improve the security of the network environment and reduce network security risks.

[0085] Figure 4 is a schematic diagram of the main units of the network security detection device according to the embodiments of the present application. As shown in Figure 4 The network security detection device 400 includes an acquisition unit 401, a matching unit 402, a probability determination unit 403, a category determination unit 404 and a sending unit 405.

[0086] The acquisition unit 401 is configured to acquire the corresponding terminal identifier in response to the network security detection request, and then acquire the corresponding network environment data according to the terminal identifier.

[0087] The matching unit 402 is configured to perform matching with the known threat signature library based on the network environment data, and in response to a failed match, call the agent to extract network threat features in the network environment data.

[0088] The probability determination unit 403 is configured to input the network threat features into the threat detection model to determine the probability of the network threat features corresponding to each network threat category based on the decision tree in the threat detection model.

[0089] The category determination unit 404 is configured to determine the target network threat category corresponding to the network threat features based on the probability.

[0090] The sending unit 405 is configured to trigger the corresponding early warning mechanism according to the target network threat category to send alarm information to the target management node.

[0091] In some embodiments, the network security detection device further comprisesFigure 4 The update unit, not shown, is configured to: obtain feedback information from the target management node; and update the threat detection model based on the feedback information in response to the feedback information containing a negative identifier for the target network threat type.

[0092] In some embodiments, the matching unit 402 is further configured to: perform similarity matching between network environment data and threat description data corresponding to each threat in the known threat signature database; if the obtained similarity scores are all lower than a preset threshold, then the matching is determined to have failed.

[0093] In some embodiments, the type determination unit 404 is further configured to determine the network threat type corresponding to a probability higher than a preset threshold as the target network threat type.

[0094] In some embodiments, the sending unit 405 is further configured to: determine the warning level corresponding to the target network threat type, and trigger the corresponding warning mechanism based on the warning level.

[0095] In some embodiments, the network security detection device also includes Figure 4 The emergency response unit, not shown, is configured to: automatically execute emergency strategies corresponding to the type of target network threat, acquire emergency response result data, and generate alarm information based on the terminal identifier, the type of target network threat, and the emergency response result data.

[0096] It should be noted that the network security detection method and network security detection device in this application are related in terms of specific implementation content, so the repeated content will not be described again.

[0097] Figure 5 An exemplary system architecture 500 is shown that can be applied to the network security detection method or network security detection device of the embodiments of this application.

[0098] like Figure 5 As shown, system architecture 500 may include terminal devices 501, 502, and 503, a network 504, and a server 505. Network 504 serves as the medium for providing communication links between terminal devices 501, 502, and 503 and server 505. Network 504 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0099] Users can use terminal devices 501, 502, and 503 to interact with server 505 via network 504 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 501, 502, and 503, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0100] The terminal devices 501, 502, and 503 can be various electronic devices with a network security processing screen and supporting webpage browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0101] The server 505 can be a server providing various services, for example, a background management server supporting a network security detection request submitted by a user using a terminal device 501, 502, 503 (only as an example). The background management server can acquire a corresponding terminal identifier in response to a network security detection request, and then acquire corresponding network environment data according to the terminal identifier; perform matching with a known threat signature library based on the network environment data, and in response to a matching failure, call an agent to extract a network threat feature in the network environment data; input the network threat feature into a threat detection model to determine a probability that the network threat feature corresponds to each network threat category based on a decision tree in the threat detection model; determine a target network threat category corresponding to the network threat feature based on the probability; trigger a corresponding early warning mechanism according to the target network threat category to send alarm information to a target management node. By combining the known threat signature library with the agent for network threat detection, the efficiency and accuracy of network security detection can be improved.

[0102] It should be noted that the network security detection method provided by the embodiments of the present application is generally executed by the server 505, and correspondingly, the network security detection apparatus is generally arranged in the server 505.

[0103] It should be understood that Figure 5 The number of terminal devices, networks, and servers in the above description is only illustrative. According to the implementation needs, there can be any number of terminal devices, networks, and servers.

[0104] Reference will be made to Figure 6 which shows a structural schematic diagram of a computer system 600 suitable for implementing a terminal device of the embodiments of the present application. Figure 6 The terminal device shown is only an example and should not impose any limitation on the functions and use range of the embodiments of the present application.

[0105] As shown in Figure 6 , the computer system 600 includes a central processing unit (CPU) 601 which can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 602 or programs loaded from a storage portion 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the computer system 600 are also stored. The CPU 601, the ROM 602, and the RAM 603 are connected to each other through a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0106] The following components are connected to the I / O interface 605: an input part 606 including a keyboard, a mouse, etc.; an output part 607 including a display such as a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage part 608 including a hard disk, etc.; and a communication part 609 including a network interface card such as a LAN card, a modem, etc. The communication part 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as necessary. A removable medium 611 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc. is attached to the drive 610 as necessary, so that a computer program read out therefrom is installed in the storage part 608 as necessary.

[0107] In particular, according to the embodiments of the present application, the processes described above with reference to the flowcharts can be implemented as a computer software program. For example, the embodiments of the present application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program codes for executing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network by the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the central processing unit (CPU) 601, the above-described functions defined in the system of the present application are executed.

[0108] Note that the computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium or a combination thereof. The computer-readable storage medium can include, for example, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the computer-readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present application, the computer-readable storage medium can be any tangible medium that contains or stores a program used by an instruction execution system, apparatus, or device to function according to the program. In the present application, the computer-readable signal medium can include a computer-readable storage medium or any computer-readable medium that transmits, propagates, or transfers programs used by an instruction execution system, apparatus, or device to function according to the programs. The program code contained in the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wireline, optical fiber, RF, etc., or any suitable combination of the foregoing.

[0109] The flow diagrams and block diagrams in the accompanying drawings illustrate possible architectures, functions, and operations of systems, methods, and computer program products according to various embodiments of the present application. In this regard, each block in the flow diagrams or block diagrams can represent a module, a segment, or a portion of code, which comprises one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and / or flow diagrams, and combinations thereof, can be implemented by special purpose hardware-based systems that perform the specified functions or operations, or combinations of special purpose hardware and computer instructions.

[0110] The units described in the embodiments of the present application can be implemented in the form of software, or can be implemented in the form of hardware. The described units can also be arranged in a processor, for example, can be described as: a processor includes an acquisition unit, a matching unit, a probability determination unit, a category determination unit and a sending unit. In some cases, the names of these units do not constitute a limitation on the units themselves.

[0111] As another aspect, the present application also provides a computer readable medium, which can be included in the device described in the above embodiments, or can exist independently without being assembled into the device. The above computer readable medium carries one or more programs, when the one or more programs are executed by the device, the device acquires the corresponding terminal identifier in response to the network security detection request, and then acquires the corresponding network environment data according to the terminal identifier; performs matching with the known threat signature library based on the network environment data, in response to the matching failure, calls the agent to extract the network threat features in the network environment data; inputs the network threat features into the threat detection model to determine the probability of the network threat features corresponding to each network threat category based on the decision tree in the threat detection model; determines the target network threat category corresponding to the network threat features based on the probability; triggers the corresponding early warning mechanism according to the target network threat category to send the alarm information to the target management node.

[0112] The computer program product of the present application includes a computer program, which, when executed by a processor, implements the network security detection method in the embodiments of the present application.

[0113] According to the technical scheme of the embodiments of the present application, the known threat signature library is combined with the agent to perform network threat detection, which can improve the efficiency and accuracy of network security detection.

[0114] The above specific embodiments do not constitute a limitation on the protection scope of the present application. Those skilled in the art should understand that various modifications, combinations, sub-combinations and substitutions can occur depending on design requirements and other factors. Any modification, equivalent replacement and improvement made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A network security detection method characterized by, The method comprises: In response to a network security detection request, a corresponding terminal identifier is obtained, and then corresponding network environment data is obtained according to the terminal identifier; Based on the network environment data, matching with a known threat signature library is performed, and in response to a matching failure, an intelligent agent is called to extract network threat features in the network environment data; The network threat features are input into a threat detection model to determine, based on a decision tree in the threat detection model, a probability that the network threat features correspond to each network threat category; Based on the probability, a target network threat category corresponding to the network threat features is determined; According to the target network threat category, a corresponding early warning mechanism is triggered to send alarm information to a target management node.

2. The method of claim 1, wherein, The method further comprises: Obtaining feedback information of the target management node, and in response to the feedback information containing a negative identification of the target network threat category, updating the threat detection model based on the feedback information.

3. The method of claim 1, wherein, The matching based on the network environment data with the known threat signature library comprises: The network environment data is matched with threat description data corresponding to each threat in the known threat signature library in terms of similarity, and if each obtained similarity is lower than a preset threshold, it is determined that the matching fails.

4. The method of claim 1, wherein, The determination of the target network threat category corresponding to the network threat features based on the probability comprises: Network threat categories corresponding to probabilities higher than a preset threshold are determined as the target network threat category.

5. The method of claim 1, wherein, The triggering of the corresponding early warning mechanism according to the target network threat category comprises: A warning level corresponding to the target network threat category is determined, and the corresponding early warning mechanism is triggered based on the warning level.

6. The method of claim 1, wherein, Before the sending of the alarm information to the target management node, the method further comprises: An emergency strategy corresponding to the target network threat category is automatically executed, emergency processing result data is obtained, and alarm information is generated according to the terminal identifier, the target network threat category, and the emergency processing result data.

7. A network security detection apparatus characterized by comprising: The method comprises: An obtaining unit is configured to, in response to a network security detection request, obtain a corresponding terminal identifier, and then obtain corresponding network environment data according to the terminal identifier; A matching unit is configured to, based on the network environment data, perform matching with a known threat signature library, and in response to a matching failure, call an intelligent agent to extract network threat features in the network environment data; A probability determination unit is configured to input the network threat features into a threat detection model to determine, based on a decision tree in the threat detection model, a probability that the network threat features correspond to each network threat category; A category determination unit is configured to, based on the probability, determine a target network threat category corresponding to the network threat features; A sending unit is configured to, according to the target network threat category, trigger a corresponding early warning mechanism to send alarm information to a target management node.

8. The apparatus of claim 7, wherein, The apparatus further comprises an updating unit configured to: Obtain feedback information of the target management node, and in response to the feedback information containing a negative identification of the target network threat category, update the threat detection model based on the feedback information.

9. The apparatus of claim 7, wherein, The matching unit is further configured to: The network environment data is matched with threat description data corresponding to each threat in a known threat signature library, and if each similarity obtained is lower than a preset threshold, it is determined that the matching fails.

10. The apparatus of claim 7, wherein, The category determining unit is further configured to: Determine a network threat category corresponding to a probability higher than a preset threshold as a target network threat category.

11. The apparatus of claim 7, wherein, The sending unit is further configured to: Determine a pre-warning level corresponding to the target network threat category, and trigger a corresponding pre-warning mechanism based on the pre-warning level.

12. The apparatus of claim 7, wherein, The apparatus further includes an emergency unit configured to: Automatically execute an emergency strategy corresponding to the target network threat category, obtain emergency processing result data, and generate alarm information according to the terminal identifier, the target network threat category, and the emergency processing result data.

13. A network security detection electronic device, comprising: comprising: one or more processors; a memory device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1-6.

14. A computer readable medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the method according to any one of claims 1-6.

15. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the method according to any one of claims 1-6.

Images