Network security detection method and device, computer device, storage medium and product

Abstract

The embodiment of the application discloses a network security detection method and device, computer equipment, a storage medium and a product, access information of a target network is acquired, behavior feature extraction is performed on the access information, access behavior feature information of the target network is obtained, a security detection strategy of a target detection stage in a detection strategy sequence is generated according to the access feature information, log feature information of network security detection of the target network by the security detection strategy of the target detection stage is predicted, the security detection strategy of each detection stage is generated according to the association relationship between the detection stages in the detection strategy sequence, and network security detection is performed on the target network based on the security detection strategy corresponding to each detection stage in the detection strategy sequence, and a detection result is obtained. The embodiment of the application can automatically generate the security detection strategy of each detection stage, and improves the security detection effect and detection efficiency of network security.

Description

Technical Field

[0001] This application relates to the field of communication technology, specifically to a network security detection method, apparatus, computer equipment, storage medium, and product, wherein the storage medium is a computer-readable storage medium, and the product is a computer program product. Background Technology

[0002] Cyberattacks, also known as cyber-intrusion attacks, exploit vulnerabilities and security flaws in network information systems to attack network systems and resources, damage, expose, and modify computers and computer networks, disable computer and network software or services, and obtain or access data on any computer without authorization. Cyberattacks can cause network devices or systems to malfunction and lead to the leakage of user information. Cyberattacks have a significant impact on the information security of network devices, network systems, and users; therefore, it is essential to detect vulnerabilities and security flaws in network devices or systems. Summary of the Invention

[0003] This application provides a network security detection method, apparatus, computer equipment, storage medium, and product, which can improve the effectiveness of network security detection.

[0004] This application provides a network security detection method, including: Obtain access information of the target network, extract behavioral features from the access information, and obtain access behavior feature information of the target network; The security detection strategy for the target detection stage in the detection strategy sequence is generated based on the access feature information. The detection strategy sequence is used to perform network security detection on the target network. The target detection stage is any one of the detection stages in the detection strategy sequence. Predict log feature information for network security detection of the target network using the security detection strategy of the target detection phase; Based on the log feature information and the correlation between the target detection stage and the detection stages in the detection strategy sequence, a security detection strategy is generated for each detection stage. The target network is subjected to network security detection based on the security detection strategy corresponding to each detection stage in the detection strategy sequence, and the detection results are obtained.

[0005] Accordingly, this application also provides a network security detection device, comprising: The acquisition unit is used to acquire access information of the target network, extract behavioral features from the access information, and obtain access behavior feature information of the target network. The first generation unit is configured to generate a security detection strategy for the target detection stage in the detection strategy sequence based on the access feature information. The detection strategy sequence is used to perform network security detection on the target network, and the target detection stage is any one of the detection stages in the detection strategy sequence. The prediction unit is used to predict log feature information of the network security detection of the target network using the security detection strategy of the target detection stage; The second generation unit is used to generate a security detection strategy for each detection stage based on the log feature information and the correlation between the target detection stage and the detection stages in the detection strategy sequence. The detection unit is used to perform network security detection on the target network based on the security detection strategy corresponding to each detection stage in the detection strategy sequence, and obtain the detection result.

[0006] In one embodiment, the detection unit is configured to include: The first security detection subunit is used to perform security detection on the target network sequentially based on the security detection strategy corresponding to each detection stage in the detection strategy sequence, so as to obtain the initial detection result of the target network for each security detection stage. An adjustment subunit is used to adjust the security detection strategy for the detection stage where the initial detection result meets preset conditions, thereby obtaining the adjusted security detection strategy. The second security detection subunit is used to perform network security detection on the target network based on the adjusted security detection strategy, and obtain the detection result of the target network.

[0007] In one embodiment, the second generating unit includes: The first information prediction subunit is used to predict the log feature information of the associated detection stage in the detection strategy sequence that is associated with the target detection stage, based on the log feature information of the target detection stage. The first strategy generation subunit is used to generate the security detection strategy for the association detection stage based on the log feature information of the association detection stage. The second information prediction subunit is used to update the target detection stage by the association detection stage, update the log feature information of the association detection stage to the log feature information of the target detection stage, and return to execute the step of predicting the log feature information of the association detection stage associated with the target detection stage in the detection strategy sequence based on the log feature information of the stage log data. The resulting sub-unit is used to obtain the security detection strategy for each detection stage when the associated detection stage is the termination detection stage.

[0008] In one embodiment, the network security detection device further includes: The data acquisition unit is used to acquire the detection results of each detection stage from the detection results, and the number of network security detections performed on the target network in each detection stage; The vulnerability determination unit is used to determine the security vulnerabilities of the target network based on the detection results and the number of detections corresponding to each detection stage.

[0009] In one embodiment, the second generating unit includes: The second strategy generation subunit is used to generate an initial security detection strategy for each detection stage based on the log feature information and the correlation between the target detection stage and the detection stages in the detection strategy sequence. The adversarial processing subunit is used to generate adversarial strategies for the initial security detection strategy at each detection stage, thereby obtaining the adversarial detection strategy for each detection stage. The strategy determination subunit is used to take the initial detection strategy and adversarial detection strategy corresponding to each detection stage as the security detection strategy for each detection stage.

[0010] In one embodiment, the second generating unit includes: The log information generation subunit is used to generate log feature information for each detection stage by using a trained security policy generation model based on the log feature information and the correlation between the target detection stage and the detection stages in the detection policy sequence. The third strategy generation subunit is used to generate a security detection strategy for each detection stage by using the log feature information of the trained security strategy generation model for each detection stage.

[0011] In one embodiment, the network security detection device further includes: The sample acquisition unit is used to acquire access information samples, log data samples, and corresponding policy tags; The feature extraction unit is used to extract features from the access information sample and the corresponding log data sample through a security policy generation model to obtain access feature information of the access information sample and log feature information of the log data sample. The strategy prediction unit is used to predict the security detection strategy for each detection step in the detection strategy sequence based on the access feature information of the access information sample and the log feature information of the log data sample. The training unit is used to train the security policy generation model based on the predicted security detection policy and the policy label, so as to obtain the trained security policy generation model.

[0012] In one embodiment, the acquisition unit includes: The information acquisition subunit is used to acquire the access address information of the target network; The acquisition subunit is used to acquire and process information through the access address information to obtain the access information of the target network.

[0013] Accordingly, this application also provides a computer device including a memory and a processor; the memory stores a computer program, and the processor is used to run the computer program in the memory to execute any of the network security detection methods provided in this application.

[0014] Accordingly, embodiments of this application also provide a computer-readable storage medium for storing a computer program, which is loaded by a processor to execute any of the network security detection methods provided in embodiments of this application.

[0015] Accordingly, this application also provides a computer program product, including a computer program, which, when executed by a processor, implements any of the network security detection methods provided in this application.

[0016] This application embodiment obtains access information of the target network, extracts behavioral features from the access information to obtain access behavior feature information of the target network; generates a security detection strategy for the target detection stage in the detection strategy sequence based on the access feature information, the detection strategy sequence is used to perform network security detection on the target network, and the target detection stage is any detection stage in the detection strategy sequence; predicts log feature information for performing network security detection on the target network using the security detection strategy of the target detection stage; generates a security detection strategy for each detection stage based on the log feature information and the correlation between the target detection stage and the detection stages in the detection strategy sequence; and performs network security detection on the target network based on the security detection strategy corresponding to each detection stage in the detection strategy sequence to obtain the detection result.

[0017] This application embodiment can first determine the detection strategy in the target detection stage based on the access information of the target network, then predict the log feature information of the log data generated by the target network for network security detection using the detection strategy, and then predict the log feature information of other detection stages based on the log features of the target detection stage according to the correlation between the detection stages in the detection strategy sequence. Finally, a corresponding detection strategy is generated based on the log feature information of each detection stage. This realizes the generation of detection strategies for each detection stage in the detection strategy sequence for network security detection of the target network based on the access information of the target network. Based on the detection strategy of each detection stage, comprehensive network security detection of the target network can be performed, improving the network security detection effect. Moreover, it eliminates the need for manual design of detection strategies, thereby improving the efficiency of network security detection. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a scenario diagram of the network security detection method provided in the embodiments of this application; Figure 2 This is a flowchart of the network security detection method provided in the embodiments of this application; Figure 3 This is a schematic diagram of the detection strategy sequence provided in the embodiments of this application; Figure 4 This is another flowchart of the network security detection method provided in the embodiments of this application; Figure 5 This is a schematic diagram of the network security detection system provided in an embodiment of this application; Figure 6 This is a schematic diagram of the network security detection device provided in the embodiments of this application; Figure 7 This is a schematic diagram of the structure of the computer device provided in the embodiments of this application. Detailed Implementation

[0020] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0021] This application provides a network security detection method, apparatus, computer device, and computer-readable storage medium. The network security detection apparatus can be integrated into a computer device, which may be a server or a terminal, etc.

[0022] The terminal may include mobile phones, wearable smart devices, tablets, laptops, personal computers (PCs), and in-vehicle computers, etc.

[0023] The server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms.

[0024] For example, such as Figure 1 As shown, the computer device acquires access information from the target network, extracts behavioral features from the access information, and obtains access behavior feature information of the target network. Based on the access feature information, it generates a security detection strategy for the target detection stage in the detection strategy sequence. The detection strategy sequence is used to perform network security detection on the target network, and the target detection stage is any detection stage in the detection strategy sequence. It predicts the log feature information for performing network security detection on the target network using the security detection strategy of the target detection stage. Based on the log feature information and the correlation between the target detection stage and the detection stages in the detection strategy sequence, it generates a security detection strategy for each detection stage. Based on the security detection strategy corresponding to each detection stage in the detection strategy sequence, it performs network security detection on the target network and obtains the detection result.

[0025] This application embodiment can first determine the detection strategy in the target detection stage based on the access information of the target network, then predict the log feature information of the log data generated by the target network for network security detection using the detection strategy, and then predict the log feature information of other detection stages based on the log features of the target detection stage according to the correlation between the detection stages in the detection strategy sequence. Finally, a corresponding detection strategy is generated based on the log feature information of each detection stage. This realizes the generation of detection strategies for each detection stage in the detection strategy sequence for network security detection of the target network based on the access information of the target network. Based on the detection strategy of each detection stage, comprehensive network security detection of the target network can be performed, improving the network security detection effect. Moreover, it eliminates the need for manual design of detection strategies, thereby improving the efficiency of network security detection.

[0026] The following sections provide detailed descriptions of each example. It should be noted that the order in which the embodiments are described is not intended to limit the preferred order of the embodiments.

[0027] This embodiment will be described from the perspective of a network security detection device, which can be integrated into a computer device, such as a server or a terminal.

[0028] This application provides a network security detection method, such as... Figure 2 As shown, the specific process of this network security detection method can be as follows: 101. Obtain access information of the target network, extract behavioral features from the access information, and obtain access behavior feature information of the target network.

[0029] The target network can be network devices and network systems. For example, network devices can be devices that access the network, such as servers, terminals, and other computer devices. Network systems can be computer systems such as Web Application Firewall (WAF).

[0030] The access information may include information required to access the target network, such as IP address, domain name, subdomain, port, and page data of the accessed page, so that the target network can be accessed based on the access information.

[0031] The access behavior feature information may include information that characterizes the access method of accessing the target network. For example, the access behavior feature information may indicate that it is necessary to log in to the target network with an account and corresponding password in order to pass the authentication of the target network and access the target network.

[0032] For example, one can obtain access information of a target network, and then extract behavioral features from that access information to obtain access behavior feature information representing the access method of the network.

[0033] Optionally, embodiments of this application may provide a security detection client, which displays a security detection page. Users can input the domain name or IP address of the target network to be detected in the security detection client. The domain name or IP address of the target network can also be obtained through other means. Then, based on the domain name and IP address input by the user, the access information of the corresponding target network is obtained. In one embodiment, the step "obtaining access information of the target network" includes: Obtain the access address information of the target network; By collecting and processing access address information, access information of the target network can be obtained.

[0034] The access address information can be information that identifies the target network, such as the target network's domain name or IP address.

[0035] After obtaining the access address information of the target network, access information of the target network can be collected based on the access address information. For example, the target network's website can be accessed based on the access address information to obtain access information such as web page data and IP address.

[0036] 102. Generate a security detection strategy for the target detection stage in the detection strategy sequence based on the access feature information. The detection strategy sequence is used to perform network security detection on the target network, and the target detection stage is any detection stage in the detection strategy sequence.

[0037] The detection strategy sequence may include at least two detection phases, each detection phase corresponding to at least one security detection strategy. The security detection strategy may include multiple instructions for performing security detection on the target network, and executing the instructions can perform network security detection on the target network.

[0038] Cyberattacks can access and acquire data from a target network without authorization. With the evolution of cyberattacks, they are no longer limited to general destructive behavior but employ multi-target, multi-stage attack methods (such as attack chains) to create a persistent attack stronghold. A detection strategy sequence can be designed based on the multi-target, multi-stage characteristics of an attack chain, containing at least one detection stage. The detection stages in the sequence can correspond to the attack stages in the attack chain, and the detection strategies within each stage can correspond to the attack strategies within the attack stages. By simulating the attack chain through each security detection strategy in the sequence, a cyberattack can be launched against the target network.

[0039] The detection strategy sequence can be used to simulate network attacks on the target network, attempting to perform operations such as accessing the target network and obtaining data from the target network without authorization. Based on the results, it can be determined whether the target network has vulnerabilities or security flaws that could lead to unauthorized access, file deployment, and data acquisition from the target network.

[0040] Access characteristic information indicates the way the target network is accessed, such as accessing it through account and password login. Therefore, based on the access characteristic information, the detection strategy in the target detection stage can be generated in the detection strategy sequence for network security detection of the target network.

[0041] 103. Predict log feature information for network security detection of target networks using security detection strategies in the target detection phase.

[0042] Cyberattacks can include message tampering, forgery, and denial-of-service attacks. Message tampering refers to altering or deleting parts of a legitimate message, delaying or reordering it, typically to create an unauthorized effect. For example, modifying data in a transmitted message to change "Allow A to perform an operation" to "Allow B to perform an operation." Forgery refers to an entity (person or system) sending data containing the identity information of another entity, impersonating that entity to deceitfully obtain the rights and privileges of legitimate users. Denial-of-service (DoS) attacks cause an unconditional interruption of the normal use or management of communication equipment.

[0043] During a cyberattack, network access and data are typically obtained by sending requests, commands, data, and files to the target network. Therefore, the target network's logs record relevant operational data during the cyberattack, such as received data, sent data, and command lines and parameters used by processes during runtime.

[0044] When performing network security testing on a target network, the target network's logs will record relevant operational data during the security testing process. Based on the security testing strategy for the target network, the log characteristics of the log data generated by the target network can be predicted.

[0045] 104. Based on log feature information and the correlation between the target detection stage and the detection stage in the detection strategy sequence, generate a security detection strategy for each detection stage.

[0046] The relationships can include the execution order between detection stages and the relationships between the detection objects corresponding to each detection stage (such as servers and server clusters).

[0047] For example, a security detection strategy for each detection stage can be generated based on the correlation between detection stages in the detection strategy sequence and log feature information.

[0048] Since a network attack is launched through an attack chain, attacks are launched sequentially to the network according to the attack stages in the attack chain. These attack stages have a temporal sequence, and the network generates logs corresponding to each attack stage. Therefore, the logs generated by the network also have a temporal sequence. When performing security detection on a target network, network security detection is performed sequentially on the target network according to the detection policies corresponding to the detection stages in the detection policy sequence. The logs generated by the target network also have a temporal sequence. Therefore, the correlation between detection stages can be used to generate log feature information for each detection stage. Then, based on the log feature information, the security detection policy corresponding to each detection stage can be determined. That is, in one embodiment, the step "predicting and generating a security detection policy for each detection stage based on the log feature information and the correlation between the target detection stage and the detection stages in the detection policy sequence" includes: Based on the log feature information of the target detection stage, predict the log feature information of the associated detection stage in the detection strategy sequence that is related to the target detection stage; Based on the log feature information of the correlation detection phase, generate a security detection strategy for the correlation detection phase. The association detection phase updates the target detection phase, updates the log feature information of the association detection phase to the log feature information of the target detection phase, and returns the execution based on the log feature information of the phase log data to predict the log feature information of the association detection phase associated with the target detection phase in the detection strategy sequence.

[0049] When the associated detection phase is the termination detection phase, the security detection strategy for each detection phase is obtained.

[0050] Among them, the associated detection stage can be a detection stage adjacent to the target detection stage in the detection strategy sequence, such as the previous or next detection stage of the target detection stage, or other detection stages that are associated with the target detection stage.

[0051] For example, the temporal characteristics of logs can be utilized to generate log feature information for the associated detection stage based on the log feature information of the target detection stage. Since there is a mapping relationship between the security detection strategy and the target network's logs, the security detection strategy for the associated detection stage can be obtained by mapping based on the log feature information of the associated detection stage. Similarly, log feature information for the detection stages associated with the associated detection stage can be generated based on the log feature information of the associated detection stage, and then the corresponding detection strategy can be determined. Therefore, the security detection strategy for each detection stage in the detection strategy sequence can be obtained.

[0052] The target network is subjected to network security detection sequentially according to the detection strategies corresponding to the detection stages in the detection strategy sequence. The logs generated by the target network have temporal characteristics. In one embodiment, a recurrent neural network (RNN) or a long short-term memory (LSTM) network can be used to utilize the temporal characteristics of the logs. Based on the log feature information corresponding to the target detection stage, the log feature information of the adjacent detection stage (the previous detection stage or the next detection stage) can be predicted, and the corresponding security detection strategy can be predicted based on the log feature information of the adjacent detection stage. In this way, the detection strategy for each detection stage in the strategy sequence can be obtained. That is, in one embodiment, the step "generating a security detection strategy for each detection stage based on the log feature information and the correlation between the target detection stage and the detection stages in the detection strategy sequence" can specifically include: The trained security policy generation model generates log feature information for each detection stage based on log feature information and the correlation between the target detection stage and the detection stage in the detection policy sequence. The security detection strategy for each detection stage is generated by using the log feature information of the security policy generation model after training.

[0053] The post-trained security policy generation model can include a feature extraction layer and a fully connected layer network, where the feature extraction layer can include an RNN network or an LSTM network.

[0054] For example, the access information of the target network can be input into the trained security policy generation model. The trained security policy generation model can extract behavioral features from the access information to obtain the access behavior feature information of the target network. Then, the log feature information of the target detection stage can be predicted based on the access behavior feature information. Based on the log feature information of the target detection stage, the log feature information of the associated detection stage can be generated. By analogy, the detection policy of each detection stage in the policy sequence can be obtained.

[0055] The post-trained security policy generation model can be a model trained using training samples to learn the temporal characteristics of logs and the relationship between log feature information and detection strategies. Before generating log feature information for each detection stage using the post-trained security policy generation model, model training can be performed first. That is, in one embodiment, before the step "generating log feature information for each detection stage based on log feature information and the correlation between the target detection stage and the detection stages in the detection strategy sequence using the post-trained security policy generation model", the network security detection method provided in this application embodiment may further include: Obtain access information samples, log data samples, and corresponding policy tags; The security policy generation model is used to extract features from the access information samples and the corresponding log data samples to obtain the access feature information of the access information samples and the log feature information of the log data samples. Based on the access feature information of the access information sample and the log feature information of the log data sample, predict the security detection strategy for each detection step in the detection strategy sequence. Based on the predicted security detection strategies and strategy labels, the security strategy generation model is trained to obtain the trained security strategy generation model.

[0056] For example, logs generated by network devices or systems during network attacks can be used as log data samples, access information of the network devices or systems can be used as access information samples, and the log sample data can be labeled with corresponding policy tags. The policy tags can indicate the attack strategy that the log sample data generated by the network devices or systems is subjected to.

[0057] A network attack is launched on a network device or network system based on the attack strategy corresponding to each stage of the attack chain. The network device or network system will generate corresponding logs, and the script of the attack strategy can be determined based on the logs.

[0058] During the training process, the attack chain can be regarded as the detection strategy sequence, the attack phase as the detection phase, and the attack strategy as the detection strategy. The security policy generation model is trained until the preset training conditions are met, and the trained security policy generation model is obtained.

[0059] Preset training conditions could include, for example, reaching a preset number of iterations, or achieving a preset accuracy in the prediction of the security policy generation model after training.

[0060] Optionally, multiple variants of security detection strategies can be generated based on the Generative Adversarial Network (GAN) to perform comprehensive network security detection on the target network. Specifically, in one embodiment, the step "generating a security detection strategy for each detection stage based on log feature information and the correlation between the target detection stage and the detection stages in the detection strategy sequence" can include: Based on log feature information and the correlation between the target detection stage and the detection stages in the detection strategy sequence, an initial security detection strategy is generated for each detection stage. The initial security detection strategy for each detection stage is processed to generate an adversarial strategy, resulting in an adversarial detection strategy for each detection stage. The initial detection strategy and the adversarial detection strategy corresponding to each detection stage are used as the security detection strategy for each detection stage.

[0061] For example, the specific process of "generating the initial security detection strategy for each detection stage based on log feature information and the correlation between the target detection stage and the detection stage in the detection strategy sequence" can be found in the relevant content above and will not be repeated here.

[0062] Then, a Generative Adversarial Network (GAN) is used to generate at least one adversarial detection strategy for each detection stage based on the initial security detection strategy for each detection stage.

[0063] The initial detection strategy and the adversarial detection strategy corresponding to each detection stage are used as the security detection strategy for each detection stage.

[0064] 105. Based on the security detection strategy corresponding to each detection stage in the detection strategy sequence, perform network security detection on the target network and obtain the detection results.

[0065] For example, the security detection strategy in each detection stage of the detection strategy sequence can be executed to perform network security detection on the target network and obtain the network security detection results of the target network.

[0066] To improve the effectiveness of network security detection, the security detection strategy can be adjusted based on the detection results of each detection stage, and the target network can be subjected to network security detection based on the adjusted security detection strategy. Specifically, in one embodiment, the step "perform network security detection on the target network based on the security detection strategy corresponding to each detection stage in the detection strategy sequence, and obtain the detection results" can include: Based on the security detection strategy corresponding to each detection stage in the detection strategy sequence, the target network is sequentially subjected to security detection to obtain the initial detection results of the target network for each security detection stage. The security detection strategy for the detection stage where the initial detection results meet the preset conditions is adjusted to obtain the adjusted security detection strategy. Based on the adjusted security detection strategy, network security detection is performed on the target network to obtain the detection results.

[0067] For example, the detection results can include the target network's response information. Based on the detection results, it can be determined whether the attack on the target network based on the security detection strategy was successful. If the attack fails, the security detection strategy is adjusted to obtain the adjusted security detection strategy.

[0068] Security detection strategies can also include strategy parameters, which can be parameters required to execute the security detection strategy, such as Trojan programs. When an attack fails, the Trojan program can be replaced to adjust the security detection strategy.

[0069] The target network is subjected to network security testing based on the adjusted security testing strategy, and the test results of the target network are obtained.

[0070] The detection results of the target network are obtained based on the initial detection results corresponding to the detection phase of a successful attack and the detection results corresponding to the detection phase of a failed attack.

[0071] The detection results can include whether the attack was successful at each detection stage.

[0072] The security vulnerabilities of the target network can be determined based on the detection results. Specifically, after the step "perform network security detection on the target network based on the security detection strategy corresponding to each detection stage in the detection strategy sequence, and obtain the detection results" in one embodiment, the network security detection method provided in this application embodiment may further include: The results of each detection stage are obtained from the detection results, and the number of network security detections performed on the target network in each detection stage are recorded. Based on the detection results and number of detections at each detection stage, the security vulnerabilities of the target network are identified.

[0073] For example, in processing and recording detection results, the number of detections in each detection stage can also be recorded. If a network security detection is performed on the target network once using the security detection policy and once using the adjusted security detection policy in a detection stage, then the number of detections in that detection stage is 2.

[0074] Different detection stages correspond to different levels of security for the target network device, such as access security, data security, and device security. For example, in one embodiment, the detection strategy sequence may be as follows: Figure 3 As shown, the detection strategy sequence can include the reconnaissance phase, intrusion phase, diffusion phase, persistence phase, data collection phase, and cleanup phase. The security detection strategy corresponding to the reconnaissance phase could be to perform port scanning on the target network to discover backend websites associated with those ports. After identifying the backend websites, the intrusion phase begins. The security detection strategy corresponding to the intrusion phase could be to scan the website, discover vulnerabilities, exploit these vulnerabilities to log in and access the server, then scan for backend upload vulnerabilities on the server, upload malware to the server to gain server privileges. After gaining server privileges, the diffusion phase can begin, where privileges on other servers associated with the server can be obtained. The persistence phase can obtain persistent privileges by writing the account information to the server. After obtaining persistent privileges, the data collection phase begins, where data can be retrieved from the server's database. Finally, the cleanup phase removes the malware files and accounts uploaded to the server to prevent the attack from being detected.

[0075] Based on the security detection process described above, the reconnaissance phase identifies the corresponding backend website by port number, so the reconnaissance phase corresponds to the access security level of the target network. The intrusion phase performs network security detection on the target network by checking whether the server can be accessed, so the intrusion phase corresponds to the device security level. The data collection phase performs network security detection on the target network by checking whether the database data can be obtained, so the data collection phase corresponds to the data security level.

[0076] Security vulnerabilities in the target network can be identified at the security level of the detection process where the number of detections is less than a preset number.

[0077] As can be seen from the above, this embodiment of the application obtains access information of the target network, extracts behavioral features from the access information to obtain access behavior feature information of the target network; generates a security detection strategy for the target detection stage in the detection strategy sequence based on the access feature information, the detection strategy sequence is used to perform network security detection on the target network, and the target detection stage is any detection stage in the detection strategy sequence; predicts log feature information for performing network security detection on the target network using the security detection strategy of the target detection stage; generates a security detection strategy for each detection stage based on the log feature information and the correlation between the target detection stage and the detection stages in the detection strategy sequence; and performs network security detection on the target network based on the security detection strategy corresponding to each detection stage in the detection strategy sequence to obtain the detection result.

[0078] This application embodiment can first determine the detection strategy in the target detection stage based on the access information of the target network, then predict the log feature information of the log data generated by the target network for network security detection using the detection strategy, and then predict the log feature information of other detection stages based on the log features of the target detection stage according to the correlation between the detection stages in the detection strategy sequence. Finally, a corresponding detection strategy is generated based on the log feature information of each detection stage. This realizes the generation of detection strategies for each detection stage in the detection strategy sequence for network security detection of the target network based on the access information of the target network. Based on the detection strategy of each detection stage, comprehensive network security detection of the target network can be performed, improving the network security detection effect. Moreover, it eliminates the need for manual design of detection strategies, thereby improving the efficiency of network security detection.

[0079] Based on the above embodiments, the following examples will provide further detailed explanations.

[0080] This embodiment will be described from the perspective of a network security detection device, which can be integrated into a computer device, such as a server or a terminal.

[0081] This application provides a network security detection method, such as... Figure 4 As shown, the specific process of this network security detection method can be as follows: 201. The server obtains access information of the target network and extracts behavioral features from the access information using a trained security policy generation model to obtain access behavior feature information of the target network.

[0082] For example, a server can obtain access information of a target network, and then extract behavioral features from that access information to obtain access behavior feature information that represents the access method of the network.

[0083] Optionally, embodiments of this application may provide a security detection client and display a security detection page on the terminal. Users can enter the domain name or IP address of the target network to be network security detected in the security detection client. The server accesses the target network's website based on the domain name or IP address and obtains the target network's web page data and access information such as the IP address.

[0084] 202. The server generates security detection strategies for the target detection stage in the detection strategy sequence based on access feature information using a trained security policy generation model.

[0085] Access characteristic information indicates the way the target network is accessed, such as accessing it through account and password login. Therefore, the server can generate the target detection phase of the network security detection strategy sequence based on the access characteristic information.

[0086] 203. The server uses the security policy generated by training to predict the log feature information of the target network during the target detection stage.

[0087] The post-trained security policy generation model can be a model trained with training samples to learn the temporal characteristics of logs and the relationship between log feature information and detection strategies. The post-trained security policy generation model can include a feature extraction layer and a fully connected layer network, where the feature extraction layer can include an RNN network or an LSTM network.

[0088] The access information of the target network is input into the trained security policy generation model. The RNN or LSTM network of the trained security policy generation model is used to extract behavioral features from the access information to obtain the access behavior feature information of the target network. Then, the log feature information of the target detection stage is predicted based on the access behavior feature information.

[0089] 204. The server generates a security policy model after training, and predicts the log feature information of adjacent detection stages based on the log feature information and the temporal characteristics of the logs in the target detection stage.

[0090] The server uses the RNN or LSTM network of the security policy generation model, trained after training, to utilize the temporal characteristics of the logs. Based on the log feature information corresponding to the target detection stage, it predicts the log feature information of the adjacent detection stage (the next detection stage, which can be the first detection stage in the detection policy sequence).

[0091] 205. The server updates the target detection stage with the log feature information of the adjacent detection stages, updates the log feature information of the target detection stage with the log feature information of the adjacent detection stages, and returns to execute step 204.

[0092] For the same reason that log feature information for adjacent detection stages is generated based on log feature information for the target detection stage, the server can generate log feature information for the next detection stage based on log feature information for adjacent detection stages, i.e., step 205, and so on, to obtain the detection strategy for each detection stage in the strategy sequence.

[0093] 206. When the adjacent detection phase is the termination detection phase, the server predicts the detection strategy for each detection phase in the detection strategy sequence based on the log feature information of each detection phase in the detection strategy sequence.

[0094] When the adjacent detection phase is the terminating detection phase (the last detection phase in the detection strategy sequence), the server predicts the detection strategy for each detection phase in the detection strategy sequence through the fully connected layer of the trained security policy generation model based on the log feature information of each detection phase in the detection strategy sequence.

[0095] 207. The server uses the detection strategy of each detection stage in the detection strategy sequence to perform network security detection on the target network and obtain the security detection result of the target network.

[0096] For example, the security detection strategy in each detection stage of the detection strategy sequence can be executed to perform network security detection on the target network and obtain the network security detection results of the target network.

[0097] In one embodiment, the network security detection method provided in this application can be executed by a network security detection system, and the structural diagram of the network security detection system can be shown as follows. Figure 5As shown, a network security detection system can include a front-end interaction (UI) layer, a presentation layer, a business layer, a database, and a runtime environment. The front-end UI can include display pages (such as the security detection page of the security detection client). Display pages can be created using HTML, CSS, jQuery, and images. The presentation layer can render the security detection page through a template engine rendering module and send requests to the business layer in response to user actions.

[0098] The business layer may include a model usage interface, an attack module, a system settings module, an attack report module, a system log module, and an attack parameter module. The model usage interface is used to access the model required by the network security detection method provided in this application embodiment. The attack module is used to execute the network security detection method provided in this application embodiment to perform network security detection on the target network. The attack parameter module allows users to select the attack parameters required for the security detection strategy. The database can be used to store data obtained from the target network, etc. The network security detection method provided in this application embodiment runs on a cloud host (cloud server), a dedicated server, or a third-party virtual server.

[0099] As can be seen from the above, in this embodiment, the server obtains access information of the target network and extracts behavioral features from the access information using a trained security policy generation model to obtain access behavior feature information of the target network; the trained security policy generation model generates a security detection policy for the target detection stage in the detection policy sequence based on the access feature information; the trained security policy generation model predicts log feature information for network security detection of the target network using the security detection policy of the target detection stage; the trained security policy generation model predicts log feature information of adjacent detection stages of the target detection stage based on the log feature information of the target detection stage and the temporal characteristics of the logs; the adjacent detection stages are updated to the target detection stage, the log feature information of the adjacent detection stages is updated to the log feature information of the target detection stage, and the execution step 204 is returned; when the adjacent detection stage is a termination detection stage, the server predicts the detection policy for each detection stage in the detection policy sequence based on the log feature information of each detection stage in the detection policy sequence; the detection policy of each detection stage in the detection policy sequence is used to perform network security detection on the target network to obtain the security detection result of the target network.

[0100] This application embodiment can first determine the detection strategy in the target detection stage based on the access information of the target network, then predict the log feature information of the log data generated by the target network for network security detection using the detection strategy, then predict the log feature information of other detection stages based on the log features of the target detection stage according to the correlation between detection stages in the detection strategy sequence, and finally generate the corresponding detection strategy based on the log feature information of each detection stage. This realizes the generation of detection strategies for each detection stage in the detection strategy sequence for network security detection of the target network based on the access information of the target network. Based on the detection strategy of each detection stage, comprehensive network security detection of the target network can be performed, improving the network security detection effect, and eliminating the need for manual design of detection strategies, thereby improving the efficiency of network security detection.

[0101] To facilitate better implementation of the network security detection method provided in this application embodiment, a network security detection device is also provided in one embodiment. The meanings of the terms used are the same as in the network security detection method described above, and specific implementation details can be found in the description of the method embodiment.

[0102] This network security detection device can be integrated into computer equipment, such as... Figure 6 As shown, the network security detection device may include: an acquisition unit 301, a first generation unit 302, a prediction unit 303, a second generation unit 304, and a detection unit 305, as detailed below: (1) Acquisition unit 301: used to acquire access information of the target network, extract behavioral features from the access information, and obtain access behavior feature information of the target network.

[0103] In one embodiment, the acquisition unit may include an information acquisition subunit and a collection subunit, specifically: Information acquisition subunit: used to acquire access address information of the target network; Acquisition Subunit: Used to collect and process information through access address information to obtain access information of the target network.

[0104] (2) First generation unit 302: used to generate a security detection strategy for the target detection stage in the detection strategy sequence based on access feature information. The detection strategy sequence is used to perform network security detection on the target network. The target detection stage is any detection stage in the detection strategy sequence.

[0105] (3) Prediction unit 303: used to predict log feature information of network security detection of target network using security detection strategy in target detection phase.

[0106] (4) Second generation unit 304: used to generate a security detection strategy for each detection stage based on log feature information and the correlation between the target detection stage and the detection stage in the detection strategy sequence.

[0107] In one embodiment, the second generation unit 304 may include a first information prediction subunit, a first strategy generation subunit, a second information prediction subunit, and an acquisition subunit, specifically: The first information prediction subunit is used to predict the log feature information of the associated detection stage in the detection strategy sequence based on the log feature information of the target detection stage. The first strategy generation subunit is used to generate a security detection strategy for the association detection stage based on the log feature information of the association detection stage. The second information prediction subunit is used to update the target detection stage from the association detection stage, update the log feature information of the association detection stage to the log feature information of the target detection stage, and return the execution based on the log feature information of the stage log data to predict the log feature information of the association detection stage associated with the target detection stage in the detection strategy sequence. Obtain sub-units: used to obtain the security detection strategy for each detection stage when the associated detection stage is the termination detection stage.

[0108] In one embodiment, the second generation unit may include a second policy generation subunit, an adversarial processing subunit, and a policy determination subunit, specifically: The second strategy generation subunit is used to generate the initial security detection strategy for each detection stage based on log feature information and the correlation between the target detection stage and the detection stages in the detection strategy sequence. Adversarial processing subunit: used to generate adversarial strategies for the initial security detection strategy of each detection stage, so as to obtain the adversarial detection strategy for each detection stage; Strategy determination subunit: Used to determine the initial detection strategy and adversarial detection strategy corresponding to each detection stage as the security detection strategy for each detection stage.

[0109] In one embodiment, the second generation unit may include a log information generation subunit and a third strategy generation subunit, specifically: Log information generation subunit: used to generate log feature information for each detection stage based on log feature information and the correlation between the target detection stage and the detection stage in the detection strategy sequence, using the trained security policy generation model; The third strategy generation subunit is used to generate a security detection strategy for each detection stage by using the log feature information of the security strategy generation model after training.

[0110] (5) Detection unit 305: used to perform network security detection on the target network based on the security detection strategy corresponding to each detection stage in the detection strategy sequence, and obtain the detection result.

[0111] In one embodiment, the detection unit 305 may include a first security detection subunit, an adjustment subunit, and a second security detection subunit, specifically: The first security detection subunit is used to perform security detection on the target network sequentially based on the security detection strategy corresponding to each detection stage in the detection strategy sequence, and obtain the initial detection result of the target network for each security detection stage. Adjustment subunit: Used to adjust the security detection strategy in the detection stage where the initial detection results meet the preset conditions, so as to obtain the adjusted security detection strategy; The second security detection subunit is used to perform network security detection on the target network based on the adjusted security detection strategy and obtain the detection results of the target network.

[0112] In one embodiment, the network security detection device may further include a data acquisition unit and a vulnerability determination unit, specifically: Data acquisition unit: used to acquire the detection results of each detection stage from the detection results, and the number of network security detections performed on the target network in each detection stage; Vulnerability identification unit: Used to identify security vulnerabilities in the target network based on the detection results and number of detections at each detection stage.

[0113] In one embodiment, the network security detection device may further include a sample acquisition unit, a feature extraction unit, a policy prediction unit, and a training unit, specifically: Sample acquisition unit: used to acquire access information samples, log data samples, and corresponding policy tags; Feature extraction unit: used to extract features from access information samples and corresponding log data samples through a security policy generation model, to obtain access feature information of access information samples and log feature information of log data samples; Strategy prediction unit: used to predict the security detection strategy for each detection step in the detection strategy sequence based on the access feature information of the access information sample and the log feature information of the log data sample. Training unit: Used to train the security policy generation model based on the predicted security detection policy and policy label, to obtain the trained security policy generation model.

[0114] As can be seen from the above, the network security detection device in this embodiment of the application obtains access information of the target network through the acquisition unit 301, extracts behavioral features from the access information, and obtains access behavior feature information of the target network; the first generation unit 302 generates a security detection strategy for the target detection stage in the detection strategy sequence based on the access feature information. The detection strategy sequence is used to perform network security detection on the target network, and the target detection stage is any detection stage in the detection strategy sequence; the prediction unit 303 predicts the log feature information for performing network security detection on the target network using the security detection strategy of the target detection stage; the second generation unit 304 generates a security detection strategy for each detection stage based on the log feature information and the correlation between the target detection stage and the detection stages in the detection strategy sequence; the detection unit 305 performs network security detection on the target network based on the security detection strategy corresponding to each detection stage in the detection strategy sequence and obtains the detection result.

[0115] This application embodiment can first determine the detection strategy in the target detection stage based on the access information of the target network, then predict the log feature information of the log data generated by the target network for network security detection using the detection strategy, and then predict the log feature information of other detection stages based on the log features of the target detection stage according to the correlation between the detection stages in the detection strategy sequence. Finally, a corresponding detection strategy is generated based on the log feature information of each detection stage. This realizes the generation of detection strategies for each detection stage in the detection strategy sequence for network security detection of the target network based on the access information of the target network. Based on the detection strategy of each detection stage, comprehensive network security detection of the target network can be performed, improving the network security detection effect. Moreover, it eliminates the need for manual design of detection strategies, thereby improving the efficiency of network security detection.

[0116] This application also provides a computer device, which can be a terminal or a server, such as... Figure 7 As shown, it illustrates a structural schematic diagram of the computer device involved in the embodiments of this application, specifically: The computer device may include components such as a processor 1001 with one or more processing cores, a memory 1002 with one or more computer-readable storage media, a power supply 1003, and an input unit 1004. Those skilled in the art will understand that... Figure 7 The computer device structure shown does not constitute a limitation on the computer device and may include more or fewer components than shown, or combine certain components, or have different component arrangements. Wherein: The processor 1001 is the control center of the computer device. It connects various parts of the computer device via various interfaces and lines. By running or executing software programs and / or modules stored in the memory 1002, and by calling data stored in the memory 1002, it performs various functions of the computer device and processes data, thereby performing overall detection of the computer device. Optionally, the processor 1001 may include one or more processing cores; preferably, the processor 1001 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and computer programs, and the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into the processor 1001.

[0117] The memory 1002 can be used to store software programs and modules. The processor 1001 executes various functional applications and data processing by running the software programs and modules stored in the memory 1002. The memory 1002 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, computer programs required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 1002 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, the memory 1002 may also include a memory controller to provide the processor 1001 with access to the memory 1002.

[0118] The computer equipment also includes a power supply 1003 that supplies power to the various components. Preferably, the power supply 1003 can be logically connected to the processor 1001 through a power management system, thereby enabling functions such as charging, discharging, and power consumption management through the power management system. The power supply 1003 may also include one or more DC or AC power supplies, recharging systems, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components.

[0119] The computer device may also include an input unit 1004, which can be used to receive input digital or character information and generate keyboard, mouse, joystick, optical or trackball signal inputs related to user settings and function control.

[0120] Although not shown, the computer device may also include a display unit, etc., which will not be described in detail here. Specifically, in this embodiment, the processor 1001 in the computer device loads the executable files corresponding to the processes of one or more computer programs into the memory 1002 according to the following instructions, and the processor 1001 runs the computer programs stored in the memory 1002 to realize various functions, as follows: By acquiring access information from the target network, behavioral features are extracted from the access information to obtain access behavior feature information of the target network. The security detection strategy for the target detection stage in the detection strategy sequence is generated based on the access feature information. The detection strategy sequence is used to perform network security detection on the target network, and the target detection stage is any detection stage in the detection strategy sequence. Predict log feature information for network security detection of target networks using security detection strategies in the target detection phase; Based on log feature information and the correlation between the target detection stage and the detection stage in the detection strategy sequence, a security detection strategy is generated for each detection stage. The network security detection of the target network is performed based on the security detection strategy corresponding to each detection stage in the detection strategy sequence, and the detection results are obtained.

[0121] For details on the implementation of each of the above operations, please refer to the previous examples, which will not be repeated here.

[0122] As can be seen from the above, the computer device in this application embodiment can obtain access information of the target network, extract behavioral features from the access information to obtain access behavior feature information of the target network; generate a security detection strategy for the target detection stage in the detection strategy sequence based on the access feature information, the detection strategy sequence is used to perform network security detection on the target network, and the target detection stage is any detection stage in the detection strategy sequence; predict log feature information for performing network security detection on the target network using the security detection strategy of the target detection stage; generate a security detection strategy for each detection stage based on the log feature information and the correlation between the target detection stage and the detection stages in the detection strategy sequence; and perform network security detection on the target network based on the security detection strategy corresponding to each detection stage in the detection strategy sequence to obtain the detection result.

[0123] This application embodiment can first determine the detection strategy in the target detection stage based on the access information of the target network, then predict the log feature information of the log data generated by the target network for network security detection using the detection strategy, and then predict the log feature information of other detection stages based on the log features of the target detection stage according to the correlation between the detection stages in the detection strategy sequence. Finally, a corresponding detection strategy is generated based on the log feature information of each detection stage. This realizes the generation of detection strategies for each detection stage in the detection strategy sequence for network security detection of the target network based on the access information of the target network. Based on the detection strategy of each detection stage, comprehensive network security detection of the target network can be performed, improving the network security detection effect. Moreover, it eliminates the need for manual design of detection strategies, thereby improving the efficiency of network security detection.

[0124] According to one aspect of this application, a computer program product is provided, comprising a computer program containing computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in the various optional implementations of the above embodiments.

[0125] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be performed by a computer program, or by a computer program controlling related hardware. The computer program can be stored in a computer-readable storage medium and loaded and executed by a processor.

[0126] Therefore, embodiments of this application provide a computer-readable storage medium storing a computer program that can be loaded by a processor to execute any of the network security detection methods provided in embodiments of this application.

[0127] For details on the implementation of each of the above operations, please refer to the previous examples, which will not be repeated here.

[0128] The computer-readable storage medium may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0129] Since the computer program stored in the computer-readable storage medium can execute any of the network security detection methods provided in the embodiments of this application, it can achieve the beneficial effects that any of the network security detection methods provided in the embodiments of this application can achieve, as detailed in the preceding embodiments, and will not be repeated here.

[0130] The foregoing has provided a detailed description of a network security detection method, apparatus, computer device, and computer-readable storage medium provided in the embodiments of this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A network security detection method, characterized in that, include: Obtain access information of the target network, extract behavioral features from the access information, and obtain access behavior feature information of the target network; Based on the access behavior feature information, a security detection strategy is generated for the target detection stage in the detection strategy sequence. The detection strategy sequence is used to perform network security detection on the target network. The target detection stage is any one of the detection stages in the detection strategy sequence. Predict log feature information for network security detection of the target network using the security detection strategy of the target detection phase; Based on the log feature information and the correlation between the target detection stage and the detection stages in the detection strategy sequence, a security detection strategy is generated for each detection stage, including: predicting the log feature information of associated detection stages in the detection strategy sequence that are associated with the target detection stage based on the log feature information of the target detection stage; generating a security detection strategy for the associated detection stage based on the log feature information of the associated detection stage; updating the associated detection stage to the target detection stage, updating the log feature information of the associated detection stage to the log feature information of the target detection stage, and returning to execute the step of predicting the log feature information of associated detection stages in the detection strategy sequence that are associated with the target detection stage based on the log feature information of the target detection stage; when the associated detection stage is a terminated detection stage, a security detection strategy for each detection stage is obtained. The target network is subjected to network security detection based on the security detection strategy corresponding to each detection stage in the detection strategy sequence, and the detection results are obtained.

2. The method according to claim 1, characterized in that, The network security detection of the target network is performed based on the security detection strategy corresponding to each detection stage in the detection strategy sequence, and the detection results are obtained, including: Based on the security detection strategy corresponding to each detection stage in the detection strategy sequence, the target network is sequentially subjected to security detection to obtain the initial detection result of the target network for each security detection stage. The security detection strategy for the detection stage where the initial detection results meet the preset conditions is adjusted to obtain the adjusted security detection strategy. Based on the adjusted security detection strategy, network security detection is performed on the target network to obtain the detection results of the target network.

3. The method according to claim 2, characterized in that, After performing network security detection on the target network based on the security detection strategy corresponding to each detection stage in the detection strategy sequence and obtaining the detection result, the method further includes: The detection results for each detection stage are obtained from the detection results, and the number of network security detections performed on the target network in each detection stage are also obtained. Based on the detection results and number of detections at each detection stage, the security vulnerabilities of the target network are determined.

4. The method according to claim 1, characterized in that, The step of generating a security detection strategy for each detection stage based on the log feature information and the correlation between the target detection stage and the detection stages in the detection strategy sequence further includes: Based on the log feature information and the correlation between the target detection stage and the detection stages in the detection strategy sequence, an initial security detection strategy is generated for each detection stage. The initial security detection strategy for each detection stage is processed to generate an adversarial strategy, resulting in an adversarial detection strategy for each detection stage. The initial detection strategy and the adversarial detection strategy corresponding to each detection stage are used as the security detection strategy for each detection stage.

5. The method according to claim 1, characterized in that, The step of generating a security detection strategy for each detection stage based on the log feature information and the correlation between the target detection stage and the detection stages in the detection strategy sequence further includes: The trained security policy generation model generates log feature information for each detection stage based on the log feature information and the correlation between the target detection stage and the detection stages in the detection policy sequence. The security detection strategy for each detection stage is generated by using the log feature information of the model at each detection stage after training the security strategy.

6. The method according to claim 5, characterized in that, Before the method generates log feature information for each detection stage by generating a security policy generation model based on the log feature information and the correlation between the target detection stage and the detection stages in the detection policy sequence, the method further includes: Obtain access information samples, log data samples, and corresponding policy tags; The access information sample and the corresponding log data sample are subjected to feature extraction by a security policy generation model to obtain the access feature information of the access information sample and the log feature information of the log data sample. Based on the access feature information of the access information sample and the log feature information of the log data sample, predict the security detection strategy for each detection step in the detection strategy sequence; Based on the predicted security detection strategy and the strategy label, the security strategy generation model is trained to obtain the trained security strategy generation model.

7. The method according to claim 1, characterized in that, The acquisition of access information to the target network includes: Obtain the access address information of the target network; Information is collected and processed using the access address information to obtain the access information of the target network.

8. A network security detection device, characterized in that, include: The acquisition unit is used to acquire access information of the target network, extract behavioral features from the access information, and obtain access behavior feature information of the target network. The first generation unit is configured to generate a security detection strategy for the target detection stage in the detection strategy sequence based on the access behavior feature information. The detection strategy sequence is used to perform network security detection on the target network, and the target detection stage is any one of the detection stages in the detection strategy sequence. The prediction unit is used to predict log feature information of the network security detection of the target network using the security detection strategy of the target detection stage; The second generation unit is configured to generate a security detection strategy for each detection stage based on the log feature information and the association between the target detection stage and the detection stages in the detection strategy sequence. This includes: predicting the log feature information of associated detection stages in the detection strategy sequence that are associated with the target detection stage based on the log feature information of the target detection stage; generating a security detection strategy for the associated detection stage based on the log feature information of the associated detection stage; updating the associated detection stage to the target detection stage, updating the log feature information of the associated detection stage to the log feature information of the target detection stage, and returning to execute the step of predicting the log feature information of associated detection stages in the detection strategy sequence that are associated with the target detection stage based on the log feature information of the target detection stage; and obtaining a security detection strategy for each detection stage when the associated detection stage is a terminated detection stage. The detection unit is used to perform network security detection on the target network based on the security detection strategy corresponding to each detection stage in the detection strategy sequence, and obtain the detection result.

9. The apparatus according to claim 8, characterized in that, The detection unit includes: The first security detection subunit is used to perform security detection on the target network sequentially based on the security detection strategy corresponding to each detection stage in the detection strategy sequence, so as to obtain the initial detection result of the target network for each security detection stage. An adjustment subunit is used to adjust the security detection strategy for the detection stage where the initial detection result meets preset conditions, thereby obtaining the adjusted security detection strategy. The second security detection subunit is used to perform network security detection on the target network based on the adjusted security detection strategy, and obtain the detection result of the target network.

10. The apparatus according to claim 9, characterized in that, The network security detection device also includes: The data acquisition unit is used to acquire the detection results of each detection stage from the detection results, and the number of network security detections performed on the target network in each detection stage; The vulnerability determination unit is used to determine the security vulnerabilities of the target network based on the detection results and the number of detections corresponding to each detection stage.

11. The apparatus according to claim 8, characterized in that, The second generation unit includes: The second strategy generation subunit is used to generate an initial security detection strategy for each detection stage based on the log feature information and the correlation between the target detection stage and the detection stages in the detection strategy sequence. The adversarial processing subunit is used to generate adversarial strategies for the initial security detection strategy at each detection stage, thereby obtaining the adversarial detection strategy for each detection stage. The strategy determination subunit is used to take the initial detection strategy and adversarial detection strategy corresponding to each detection stage as the security detection strategy for each detection stage.

12. The apparatus according to claim 8, characterized in that, The second generation unit includes: The log information generation subunit is used to generate log feature information for each detection stage by using a trained security policy generation model based on the log feature information and the correlation between the target detection stage and the detection stages in the detection policy sequence. The third strategy generation subunit is used to generate a security detection strategy for each detection stage by using the log feature information of the trained security strategy generation model for each detection stage.

13. The apparatus according to claim 12, characterized in that, The network security detection device also includes: The sample acquisition unit is used to acquire access information samples, log data samples, and corresponding policy tags; The feature extraction unit is used to extract features from the access information sample and the corresponding log data sample through a security policy generation model to obtain access feature information of the access information sample and log feature information of the log data sample. The strategy prediction unit is used to predict the security detection strategy for each detection step in the detection strategy sequence based on the access feature information of the access information sample and the log feature information of the log data sample. The training unit is used to train the security policy generation model based on the predicted security detection policy and the policy label, so as to obtain the trained security policy generation model.

14. The apparatus according to claim 8, characterized in that, The acquisition unit includes: The information acquisition subunit is used to acquire the access address information of the target network; The acquisition subunit is used to acquire and process information through the access address information to obtain the access information of the target network.

15. A computer device, characterized in that, It includes a memory and a processor; the memory stores a computer program, and the processor is used to run the computer program in the memory to perform the network security detection method according to any one of claims 1 to 7.

16. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store a computer program, which is loaded by a processor to perform the network security detection method according to any one of claims 1 to 7.

17. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the network security detection method according to any one of claims 1 to 7.

Images