A network attack processing method and device, electronic equipment and storage medium

Abstract

The present disclosure provides a network attack processing method and device, electronic equipment and storage medium, comprising: obtaining traffic data of an application to be detected; obtaining an attack behavior detection model; wherein the attack behavior detection model is a random forest classifier for attack behavior detection constructed based on historical traffic data of a plurality of detected applications; performing attack detection on the traffic data based on the attack behavior detection model to obtain a detection result; and in a case where it is determined based on the detection result that a target attack behavior on the application to be detected is detected, performing risk assessment on the target attack behavior. Loss caused by missed detection of network attack behavior during detection can be avoided. Users can make different responses to network attack behaviors of different risk levels.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of data processing, and in particular to a network attack processing method and device, electronic equipment and storage medium. BACKGROUND

[0002] With the popularity of the Internet, all aspects of our life are increasingly inseparable from the Internet. However, the Internet brings us convenience, but also brings challenges. In the process of using the Internet, a large amount of user information will be saved on the server. If these information is obtained by illegal persons through network attack, it will lead to information leakage, which will bring great loss to individuals or enterprises. For example, Advanced Persistent Threat (APT).

[0003] At present, the main protective measures are as follows: improving the information security awareness of enterprise users to prevent problems from happening; installing a network security early warning system. However, the network security early warning system can only automatically summarize network attack events in the local area network and warn the whole network security according to these data. Since the network attack behavior summarized by the network security early warning system is only the network attack behavior in the local area network, it will lead to too small a range of network attack behaviors that can be identified. Therefore, in the case of not identifying the network attack behavior that is not within its identification range, the problem of system or program information leakage and system or program damage loss may occur. SUMMARY

[0004] The embodiments of the present disclosure at least provide a network attack processing method, device, electronic equipment and storage medium.

[0005] In a first aspect, the embodiments of the present disclosure provide a network attack processing method, comprising:

[0006] obtaining traffic data of a to-be-detected application program; obtaining an attack behavior detection model; wherein the attack behavior detection model is a random forest classifier for attack behavior detection constructed based on historical traffic data of a plurality of detected application programs; performing attack detection on the traffic data based on the attack behavior detection model to obtain a detection result; and in a case where it is determined based on the detection result that a target attack behavior on the to-be-detected application program is detected, performing risk assessment on the target attack behavior.

[0007] In an optional implementation, the attack behavior detection model is trained by: obtaining target attack behavior data of a plurality of attack behaviors intercepted by each detected application; performing feature extraction on the target attack behavior data to obtain attack behavior features; determining a training sample set based on the attack behavior features, and training a random forest classifier to be trained based on the training sample set, to obtain the attack behavior detection model after training.

[0008] In an optional implementation, the attack behavior detection model is trained by: determining a preset decision logic and a preset decision result of the attack behavior features; determining a training sample set based on the attack behavior features, the preset decision logic and the preset decision result; wherein each attack behavior corresponds to a training sample in the training sample set; processing the training sample set by the random forest classifier to be trained to obtain a prediction result; adjusting model parameters of the random forest classifier to be trained based on a difference between the prediction result and the preset decision result, to obtain the attack behavior detection model.

[0009] In an optional implementation, the attack behavior detection model is trained by: determining a preset decision logic and a preset decision result of the attack behavior features; determining a training sample set based on the attack behavior features, the preset decision logic and the preset decision result; wherein each attack behavior corresponds to a training sample in the training sample set; processing the training sample set by the random forest classifier to be trained to obtain a prediction result; adjusting model parameters of the random forest classifier to be trained based on a difference between the prediction result and the preset decision result, to obtain the attack behavior detection model.

[0010] In an optional implementation, in a case where it is determined based on the detection result that a target attack behavior against the application to be detected is detected, a risk assessment is performed on the target attack behavior, including: in a case where it is determined based on the detection result that a target attack behavior against the application to be detected is detected, determining at least one risk assessment indicator of the target attack behavior; performing risk assessment processing on each risk assessment indicator to obtain a sub-assessment result; and determining a risk assessment result of the target attack behavior based on the sub-assessment result.

[0011] In an optional implementation, the risk assessment processing on each risk assessment indicator to obtain a sub-assessment result includes: obtaining keyword information of an attack keyword in the traffic data; determining a risk keyword matched with the attack keyword in a risk keyword database; and performing risk assessment on the keyword information based on a risk level of the risk keyword to obtain a sub-assessment result of the keyword information.

[0012] In an optional implementation, the risk assessment processing is performed on each of the risk assessment indexes to obtain a sub-evaluation result, including: obtaining target address information in the traffic data; the target address information is used to indicate address information of an attack behavior of the to-be-detected application; searching for a risk address matched with the target address information in a risk address database; in a case where the matched risk address is found, determining a sub-evaluation result of the target address information based on a risk level of the matched risk address.

[0013] In an optional implementation, the method further includes: in a case where the matched risk address is not found in the risk address database, determining the target address information as a suspected risk address; obtaining a number of times of accessing the target application program by the suspected risk address in a preset time period; and determining a sub-evaluation result of the suspected risk address according to the number of times of accessing.

[0014] In an optional implementation, the method further includes: in a case where there is a target sub-evaluation result in at least one of the sub-evaluation results, intercepting an attack data packet of an attack behavior in the traffic data; the risk assessment index corresponding to the target sub-evaluation result meets a preset risk level requirement.

[0015] In a second aspect, the embodiments of the present disclosure further provide a network attack processing apparatus, including: an obtaining module configured to obtain traffic data of a to-be-detected application; a constructing module configured to obtain an attack behavior detection model; the attack behavior detection model is a random forest classifier used for attack behavior detection and constructed based on historical traffic data of a plurality of detected applications; a detecting module configured to perform attack detection on the traffic data based on the attack behavior detection model to obtain a detection result; and a risk assessment module configured to perform risk assessment on a target attack behavior of the to-be-detected application in a case where it is determined that the target attack behavior is detected based on the detection result.

[0016] In a third aspect, the embodiments of the present disclosure further provide a non-transitory computer-readable storage medium, the storage medium stores at least one instruction or at least one program, the at least one instruction or the at least one program is loaded and executed by a processor to implement the above method.

[0017] In a fourth aspect, the embodiments of the present disclosure further provide an electronic device, including a processor and a non-transitory computer-readable storage medium.

[0018] The present disclosure has at least the following beneficial effects:

[0019] The present disclosure provides a network attack processing method and device, electronic equipment and storage medium. In the present application, first, the traffic data of the application to be detected is obtained, and the attack behavior detection model is obtained. Then, the attack detection is performed on the traffic data based on the attack behavior detection model, and the detection result is obtained. In the case that the target attack behavior of the application to be detected is detected based on the detection result, the risk assessment of the target attack behavior is performed.

[0020] As described above, since the historical traffic data of the detected application contains the detected network attack behavior, the attack behavior detection model is determined based on the historical traffic data, which can expand the detection range of the attack behavior detection model, thereby improving the detection accuracy of the attack behavior detection model. The random forest classifier is constructed based on the historical traffic data, so that the attack behavior detection model is obtained based on the random forest classifier, which can improve the stability and accuracy of the detection result, avoid overfitting of the attack behavior detection model, and avoid the loss caused by the missed detection of the network attack behavior in the detection process. The risk assessment of the detected network attack behavior can obtain the risk assessment result of the target attack behavior, thereby providing the user with relevant risk decision basis. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present disclosure, and other drawings can be obtained by those skilled in the art without creative labor.

[0022] Figure 1 A network attack processing method flowchart is provided for the embodiments of the present disclosure.

[0023] Figure 2 In the network attack processing method provided by the embodiments of the present disclosure, a flowchart of obtaining an attack behavior detection model is provided.

[0024] Figure 3 A network attack processing system schematic diagram is provided for the embodiments of the present disclosure.

[0025] Figure 4 In the network attack processing method provided by the embodiments of the present disclosure, a schematic diagram of the attack detection module is provided.

[0026] Figure 5 In the network attack processing method provided by the embodiments of the present disclosure, a schematic diagram of the risk assessment module is provided.

[0027] Figure 6A schematic diagram of the risk handling module in the network attack handling method provided in the embodiments of this disclosure;

[0028] Figure 7 This is a schematic diagram of a network attack processing apparatus provided in an embodiment of the present disclosure. Detailed Implementation

[0029] The technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0030] The following describes the method for handling network attacks provided in the embodiments of this disclosure.

[0031] Example 1

[0032] See Figure 1 The diagram shows a flowchart of a method for handling network attacks according to an embodiment of this disclosure. The method includes steps S10 to S40, wherein:

[0033] S10. Obtain traffic data of the application to be tested.

[0034] In embodiments of this disclosure, traffic data can be understood as traffic data generated when a target accesses the application to be detected. The target can be a user or another application.

[0035] The actions performed on the application under test can be user actions on the application under test, or actions performed by other applications on the application under test. These actions include access actions, click actions, and search actions, etc.

[0036] S20. Obtain the attack behavior detection model; wherein, the attack behavior detection model is a random forest classifier built based on historical traffic data of multiple detected applications for attack behavior detection.

[0037] In the embodiments of this disclosure, the detected application can be understood as the application that has been detected as being attacked, and the historical traffic data of the detected application can be understood as the traffic data generated by the attack behavior of the detected application at a historical moment. That is, the historical traffic data can also be referred to as the attack data packet of the network attack event.

[0038] Here, the actions performed on the detected applications can be user actions on the currently detected applications and actions performed by other detected applications on the currently detected applications.

[0039] Herein, the attack data packet of the network attack event comprises event detail information of the network attack event, for example, sending address information and event keyword information of the network attack event.

[0040] Herein, the sending address information of the network attack event is an IP address (Internet Protocol Address) of the network attack event.

[0041] In an embodiment of the present disclosure, the attack behavior detection model is a model for detecting attack behaviors of an application, which is determined based on historical traffic data of the application and a random forest classifier (Random Forest Classifier).

[0042] S30, performing attack detection on the traffic data based on the attack behavior detection model to obtain a detection result.

[0043] In an embodiment of the present disclosure, the traffic data can be input into the attack behavior detection model as an input of the attack behavior detection model, so as to process the traffic data by the attack behavior detection model to obtain a detection result.

[0044] Herein, the detection result can be used to determine whether the to-be-detected application is attacked, and in the case where it is determined that the to-be-detected application is attacked, the related information of the corresponding attack behavior.

[0045] Herein, the traffic data carries time information, wherein the time information is used to indicate the generation time of the traffic data, at this time, the traffic data can be input into the attack behavior detection model in sequence according to the time information of the traffic data for processing to obtain a detection result.

[0046] For example, the traffic data can be traffic data generated when the target to-be-detected application performs a corresponding operation, at this time, the traffic data corresponding to each operation can be input into the attack behavior detection model in sequence according to the operation time of each operation for processing, so as to obtain a detection result of the traffic data of each operation.

[0047] Herein, the detection result of the traffic data of each operation can be used to determine the threat degree of the operation to the to-be-detected application. The threat degree can be used to determine whether the operation is an attack behavior to the to-be-detected application.

[0048] S40, in the case where it is determined based on the detection result that the target attack behavior to the to-be-detected application is detected, performing risk assessment on the target attack behavior.

[0049] In an embodiment of the present disclosure, the target attack behavior can be understood as an operation performed on the application to be detected, the threat degree of which is greater than or equal to a preset threat degree threshold. Here, the preset threat degree threshold can be determined according to actual needs, and the present disclosure does not make specific limitations thereto.

[0050] In an embodiment of the present disclosure, after detecting the target attack behavior on the application to be detected, risk assessment can also be performed based on the target attack behavior. After risk assessment on the target attack behavior, a risk assessment result of the target attack behavior can be obtained, and according to the risk assessment result, a warning strategy can be formulated for the application to be detected. Here, the risk assessment result is used to indicate the possible degree of impact or loss of the target attack behavior on the application to be detected.

[0051] In an embodiment of the present disclosure, first, the traffic data of the application to be detected can be obtained, and an attack behavior detection model can be obtained. Then, attack detection is performed on the traffic data based on the attack behavior detection model to obtain a detection result. In the case where it is determined based on the detection result that a target attack behavior on the application to be detected is detected, risk assessment is performed on the target attack behavior.

[0052] As can be known from the above description, since the historical traffic data of the detected application contains the detected network attack behavior, the attack behavior detection model can be determined based on the historical traffic data, which can expand the detection range of the attack behavior detection model and thus improve the detection accuracy of the attack behavior detection model. The random forest classifier is constructed based on the historical traffic data, so that the attack behavior detection model can be obtained according to the random forest classifier, which can improve the stability and accuracy of the detection result, avoid overfitting of the attack behavior detection model, and also avoid the loss caused by the missed detection of the network attack behavior in the detection process. By performing risk assessment on the detected network attack behavior, a risk assessment result of the target attack behavior can be obtained, thereby providing a related risk decision basis for the user.

[0053] In an optional implementation, the attack behavior detection model is trained in the following manner:

[0054] First, target attack behavior data of a plurality of attack behaviors intercepted by each detected application is obtained;

[0055] Second, feature extraction is performed on the target attack behavior data to obtain attack behavior features;

[0056] Finally, a training sample set is determined based on the attack behavior features, and a random forest classifier to be trained is trained based on the training sample set, and the attack behavior detection model is obtained after training.

[0057] In the embodiments of the present disclosure, the target attack behavior data of the intercepted multiple attack behaviors of the application can be understood as the data in the attack data packet of the network attack event of the detected application.

[0058] The network attack event is an information security event that attacks the detected application by network or other technical means, exploits the configuration defects, protocol defects, program defects or uses brute force attacks, and causes the detected application to be abnormal or causes potential harm to the current running of the detected application. The network attack event includes denial of service attack event, backdoor attack event, vulnerability attack event, network scanning and eavesdropping event, phishing event, interference event and other network attack events.

[0059] In the embodiments of the present disclosure, the target attack behavior data includes keyword information of the target attack behavior and address information of the target attack behavior. The address information is the IP address of the target attack behavior.

[0060] In the embodiments of the present disclosure, the historical traffic data of the detected application can be processed to obtain the target attack behavior data. For example, the historical traffic data can be processed to obtain the target attack behavior data.

[0061] For example, the historical traffic data of the detected application can be processed as follows, including IP address risk filtering processing, IP address deduplication processing, IP address usage range filtering processing, whitelist keyword retention processing and non-network attack event retention processing.

[0062] Here, the IP address risk filtering processing includes deleting the historical traffic data corresponding to the IP address meeting the preset IP address risk condition. The preset IP address risk condition is that the current IP address is a low-risk IP address or a no-risk IP address.

[0063] Here, the IP address deduplication processing includes deduplication processing of historical traffic data with consistent source IP, destination IP, event subclass and time of occurrence.

[0064] Here, the IP address usage range filtering processing includes deleting the historical traffic data with a private network IP address.

[0065] Here, the whitelist keyword retention processing includes retaining the historical traffic data in which the keywords in the keyword information are all in the whitelist keyword database. The whitelist keyword database can be understood as a set of keywords in the historical traffic data that do not produce network attack behavior to the detected application.

[0066] Here, the retaining non-network attack event processing includes retaining historical traffic data that does not have network attack behavior to the detected application.

[0067] In embodiments of the present disclosure, after obtaining the target attack behavior data, feature extraction can be performed on the target attack behavior data, so as to extract attack behavior features. Here, any method of feature extraction on the target attack behavior data can be used, and the present disclosure does not make any limitation thereon, for example, a convolutional neural network can be used to extract features from the target attack behavior data, so as to obtain attack behavior features.

[0068] In embodiments of the present disclosure, the target attack behavior data includes attack means, attack purpose, attack method, and keyword information in the target attack behavior data and address information of sending the target attack behavior.

[0069] In embodiments of the present disclosure, the attack behavior features of each target attack behavior can be determined as a training sample, and then the set of all training samples is used as a training sample set.

[0070] After obtaining the training sample set, the random forest classifier can be trained based on the training sample set, and an attack behavior detection model is obtained after training.

[0071] In the above embodiments, the decision model is trained based on the training sample set determined based on the historical attack behavior of the detected application to obtain the attack behavior detection model, which can improve the accuracy and prediction ability of attack detection. This training method helps to capture and understand potential attack patterns, so that the system has better ability to cope with changing network attack behaviors.

[0072] In an optional embodiment, as shown in Figure 2 the training sample set is determined based on the attack behavior features, and the random forest classifier to be trained is trained based on the training sample set, and an attack behavior detection model is obtained after training, which specifically includes the following steps:

[0073] S11, determining a preset decision logic and a preset decision result of the attack behavior features;

[0074] S12, determining a training sample set based on the attack behavior features, the preset decision logic and the preset decision result; wherein each attack behavior corresponds to a training sample in the training sample set;

[0075] S13, processing the training sample set by the random forest classifier to be trained to obtain a prediction result;

[0076] S14, adjusting a model parameter of the random forest classifier to be trained based on a difference between the prediction result and the preset decision result, to obtain an attack behavior detection model.

[0077] Here, the same attack behavior can implement attacks on different application programs through multiple attack logics, and each attack logic is a preset decision logic. That is, each attack behavior feature can correspond to one or more preset decision logics.

[0078] Here, the preset decision logic can be understood as a rule or judgment logic for attack behavior feature attack detection.

[0079] Here, since the same attack behavior may produce one or more different attack results when attacking different application programs, the same attack behavior feature corresponds to one or more different attack results. Each attack result is a preset decision result.

[0080] Here, the preset decision result of the same attack behavior feature can be obtained through one or more preset decision logics.

[0081] In an embodiment of the present disclosure, the attack behavior feature of the same attack behavior, one preset decision logic of the attack behavior feature, and the preset decision result corresponding to the preset decision logic are taken as a training sample.

[0082] In an embodiment of the present disclosure, after the training sample set is determined, the training sample set can be processed by the random forest classifier to be trained, so as to obtain a prediction result.

[0083] In an embodiment of the present disclosure, based on the difference between the prediction result and the preset decision result, the model parameter of the random forest classifier to be trained is adjusted until the prediction result output by the random forest classifier meets the preset accuracy requirement.

[0084] For example, based on the difference between the prediction result and the preset decision result, the function value of the loss function can be determined, and then the model parameter of the random forest classifier to be trained is adjusted according to the function value until the prediction result of the adjusted random forest classifier meets the preset accuracy requirement.

[0085] Here, the preset accuracy requirement can be set according to actual needs, and the present disclosure does not make specific limitations.

[0086] In the above embodiment, since the trained attack behavior detection model is equivalent to multiple decision trees, the multiple decision trees not only have good stability and accuracy, but also can avoid the overfitting problem of the attack behavior detection model.

[0087] In an optional embodiment, attack detection is performed on the traffic data based on the attack behavior detection model to obtain a detection result, specifically including the following steps:

[0088] The traffic data is processed by the attack behavior detection model to obtain data warning information of the traffic data; wherein the data warning information is used to indicate at least one of the following: data reliability, data alarm level, attack chain stage of the attack behavior;

[0089] Based on the data warning information, a detection result of the traffic data is determined.

[0090] In an embodiment of the present disclosure, the traffic data of the application to be detected can be sequentially input into the attack behavior detection model according to the time sequence of the traffic data for processing.

[0091] In an embodiment of the present disclosure, the data warning information output by the attack behavior detection model includes at least one of the following: data reliability, data alarm level, and attack chain stage of the attack behavior.

[0092] Here, for different data reliabilities, different data reliability categories can be set, and the data reliability category values corresponding to different data reliability categories are all different. The higher the data reliability, the greater the data reliability value. For example, as shown in Table 1, the data reliability is divided into three categories: high, medium, and low. Among them, when the data reliability category is high, the corresponding data reliability value is 1; when the data reliability category is medium, the corresponding data reliability value is 0.6; and when the data reliability category is low, the corresponding data reliability value is 0.3.

[0093] Here, for different data alarm levels, different data alarm level categories can be set, and the data alarm level values corresponding to different data alarm level categories are all different. The higher the data alarm level, the greater the danger degree. For example, as shown in Table 1, the data alarm level is divided into three categories: high, medium, and low. Among them, when the data alarm level category is high, the corresponding data alarm level value is 1; when the data alarm level category is medium, the corresponding data alarm level value is 0.6; and when the data alarm level category is low, the corresponding data alarm level value is 0.2.

[0094] Here, the attack chain stage of the attack behavior includes multiple stages. The more serious the intrusion of the attack behavior into the application system to be detected, the higher the attack chain stage value of the attack behavior. The attack chain stage values of attack behaviors at different attack chain stages are not the same. For example, as shown in Table 1, the attack chain stage of the attack behavior includes scanning detection, penetration attack, intrusion attack, privilege escalation, malicious behavior, and completion of the attack task. Among them, the attack chain stage value corresponding to the scanning detection is 0.2, the attack chain stage value corresponding to the penetration attack is 0.8, the attack chain stage value corresponding to the intrusion attack is 0.9, the attack chain stage value corresponding to the privilege escalation is 1, the attack chain stage value corresponding to the malicious behavior is 1, and the attack chain stage value corresponding to the completion of the attack task is 1.

[0095] Data alert information Classification Numerical value Data reliability High 1 Data reliability Medium 0.6 Data reliability Low 0.3 Data alert level High 1 Data alert level Medium 0.6 Data alert level Low 0.2 Attack chain phase Scan probing 0.2 Attack chain phase Penetration attack 0.8 Attack chain phase Compromise intrusion 0.9 Attack chain phase Privilege escalation 1 Attack chain phase Malicious behavior 1 Attack chain phase Attack completion 1

[0096] Table 1

[0097] In an embodiment of the present disclosure, after obtaining the data reliability, the data alarm level, and the attack chain stage of the attack behavior, the above information can be used as data warning information, or the data reliability, the data alarm level, and the attack chain stage of the attack behavior can be processed to obtain the data warning information.

[0098] Here, the way of processing the data reliability, the data alarm level, and the attack chain stage of the attack behavior can be multiplying the data reliability value, the data alarm level value, and the attack chain stage value of the attack behavior to obtain the data warning information. The greater the data warning information of the detection result, the more dangerous the network attack behavior corresponding to the current detection result, and the more accurate the current detection result.

[0099] In an embodiment of the present disclosure, the detection result includes that the behavior currently detected on the application program to be detected is an attack behavior and that the behavior currently detected on the application program to be detected is not an attack behavior.

[0100] In an embodiment of the present disclosure, based on the data warning information, determining the detection result of the traffic data can be understood as follows: if the data warning information satisfies a preset data warning information condition, the detection result is determined as that the behavior currently detected on the application program to be detected is an attack behavior; otherwise, the detection result is determined as that the behavior currently detected on the application program to be detected is not an attack behavior.

[0101] Here, the preset data warning information condition can be set according to actual needs, which is not limited in the present disclosure.

[0102] In the above embodiments, through the processing of the attack behavior detection model, the warning information can be obtained, which not only includes the data reliability and the data alarm level, but also includes the description of the attack chain stage, so that the network attack can be deeply understood and defended at an early stage of the attack.

[0103] In an optional embodiment, in a case where it is determined based on the detection result that the target attack behavior against the to-be-detected application program is detected, the target attack behavior is subjected to risk assessment, specifically including the following steps:

[0104] In a case where it is determined based on the detection result that the target attack behavior against the to-be-detected application program is detected, at least one risk assessment indicator of the target attack behavior is determined;

[0105] The risk assessment processing is performed on each risk assessment indicator to obtain a sub-assessment result;

[0106] The risk assessment result of the target attack behavior is determined based on the sub-assessment result.

[0107] In an embodiment of the present disclosure, the risk assessment of the target attack behavior can be performed through one or more risk assessment indicators. For example, if the risk assessment result of the target attack behavior is determined through the sub-assessment results of multiple risk assessment indicators, the sub-assessment result with the highest risk level among the multiple sub-assessment results is used as the risk assessment result of the target attack behavior.

[0108] Here, the risk assessment processing of one risk assessment indicator of the target attack behavior will obtain one sub-assessment result. The risk assessment processing can be performed on multiple risk assessment indicators of the target attack behavior to obtain multiple sub-assessment indicators.

[0109] Here, the risk assessment processing processes of different risk assessment indicators of the target attack behavior are not completely the same.

[0110] Here, the risk assessment processing of different risk assessment indicators of the target attack behavior can be performed in parallel, or the priority of different risk assessment indicators of the target attack behavior is determined, and the risk assessment processing of the risk assessment indicators of the target attack behavior is performed in the order of the priority.

[0111] Here, if the priority of different risk assessment indicators of the target attack behavior is determined, and the risk assessment processing of the risk assessment indicators of the target attack behavior is performed in the order of the priority, when the detected sub-assessment result meets the preset risk assessment result requirement, the risk assessment processing of the risk assessment indicators with lower priority of the risk assessment indicators of the target attack behavior corresponding to the sub-assessment result is no longer performed.

[0112] In the above embodiments, for each detected target attack behavior, detailed risk assessment can be performed to better predict and prevent possible risks from occurring. By performing assessment on each risk assessment indicator, the potential impact of the target attack behavior can be comprehensively understood as much as possible.

[0113] In an optional embodiment, the risk assessment processing is performed on each risk assessment indicator to obtain a sub-evaluation result, and specifically includes the following steps:

[0114] Obtaining keyword information of the attack keyword in the traffic data;

[0115] Determining a risk keyword matched with the attack keyword in a risk keyword database;

[0116] Performing risk assessment on the keyword information based on the risk level of the risk keyword to obtain a sub-evaluation result of the keyword information.

[0117] In an embodiment of the present disclosure, the risk assessment indicator is keyword information of an attack keyword of data of a target attack behavior.

[0118] In an embodiment of the present disclosure, the risk keyword database includes keyword information of historical traffic data of a detected application and a risk level corresponding to the keyword information.

[0119] Here, the risk keyword database can be understood as a detection dictionary database. The detection dictionary database includes a vulnerability database, a threat intelligence library, and a rule library of network attack events, etc.

[0120] In an embodiment of the present disclosure, performing risk assessment on the keyword information based on the risk level of the risk keyword can be understood as obtaining a risk level corresponding to each keyword information.

[0121] Here, the risk level corresponding to the keyword information with the largest risk level in the keyword information is taken as the sub-evaluation result.

[0122] In the above embodiment, the attack keyword is obtained and searched in the risk keyword database, which can accurately and quickly identify potential network attack behaviors, and the risk level of the risk keyword is used for evaluation, so that the risk control is more accurate.

[0123] In an optional embodiment, the risk assessment processing is performed on each risk assessment indicator to obtain a sub-evaluation result, and specifically includes the following steps:

[0124] Obtaining target address information in the traffic data; wherein the target address information is used to indicate address information of an attack behavior of a to-be-detected application;

[0125] Searching for a risk address matched with the target address information in a risk address database;

[0126] In the case of finding the matched risk address, determining a sub-evaluation result of the target address information based on a risk level of the matched risk address.

[0127] In the embodiments of the present disclosure, the target address information can be understood as an IP address of a sending target attack behavior.

[0128] In the embodiments of the present disclosure, the risk address database includes a risk address of historical traffic data of the detected application program and a risk level corresponding to the risk address.

[0129] In the embodiments of the present disclosure, the sub-evaluation result of the target address information based on the risk level of the matched risk address can be understood as obtaining the risk level corresponding to the target address information. The risk level corresponding to the target address information is taken as the sub-evaluation result.

[0130] In the above embodiments, by means of the use of the risk address database, the address information in the network traffic can be risk-evaluated, so as to more accurately and effectively prevent network attacks, especially attack behaviors from risk addresses.

[0131] In an optional embodiment, the method further comprises:

[0132] In the case that the matched risk address is not found in the risk address database, the target address information is determined as a suspected risk address;

[0133] Obtaining the access frequency of the suspected risk address to the target application program in a preset time period;

[0134] According to the access frequency, a sub-evaluation result of the suspected risk address is determined.

[0135] In the embodiments of the present disclosure, the matched risk address not found in the risk address database can be understood as that the target address information is not confirmed as a risk address at a historical time.

[0136] Here, the target address information not confirmed as a risk address at a historical time can be understood as that the target address information may not have generated a network attack behavior at the historical time.

[0137] In the embodiments of the present disclosure, the preset time period can be set according to actual needs, and the present disclosure does not make specific limitations thereon.

[0138] In the embodiments of the present disclosure, according to the access frequency, the sub-evaluation result of the suspected risk address can be understood as that when the access frequency exceeds a preset frequency threshold, the sub-evaluation result of the suspected risk address has a high risk level; and when the access frequency does not exceed the preset frequency threshold, the sub-evaluation result of the suspected risk address has a low risk level.

[0139] Here, the preset frequency threshold can be set according to actual needs, and the present disclosure does not make specific limitations thereon.

[0140] In the above embodiment, even if a matching address is not found in the risk address database, the method can discover possible risks from the perspective of access frequency, further improving the ability of risk detection and processing.

[0141] In an optional embodiment, the method further comprises:

[0142] In a case where it is determined that the target sub-evaluation result exists in the at least one sub-evaluation result, intercepting attack data packets of the attack behavior in the traffic data; wherein the risk evaluation index corresponding to the target sub-evaluation result meets the preset risk level requirement.

[0143] Here, the preset risk level requirement can be set according to actual needs, and the present disclosure does not make specific limitations thereon.

[0144] In the above embodiment, by intercepting attack data packets when it is determined that a sub-evaluation result meeting the preset risk level requirement exists, a customized defense strategy can be implemented, so that specific high-risk behaviors can be accurately targeted, false positives can be reduced, and the efficiency of the entire network security system can be improved.

[0145] Referring to Figure 3 The network attack processing system provided by the embodiment includes a risk keyword database module 21, an attack detection module 22, a risk evaluation module 23, and a risk processing module 24.

[0146] The keyword database module is configured to provide a risk keyword database.

[0147] In the embodiments of the present disclosure, the risk keyword database includes keyword information of historical traffic data of detected application programs and risk levels corresponding to the keyword information.

[0148] Here, the risk keyword database can be understood as a detection dictionary database. The detection dictionary database includes a vulnerability database, a threat intelligence library, and a rule library of network attack events, etc.

[0149] The attack detection module is configured to obtain target attack behavior data of a plurality of attack behaviors of each detected application program, perform feature extraction on the target attack behavior data to obtain attack behavior features, determine a training sample set based on the attack behavior features, train a random forest classifier to be trained based on the training sample set, obtain the attack behavior detection model after training, perform attack detection on the traffic data based on the attack behavior detection model, and obtain a detection result.

[0150] In the embodiments of the present disclosure, referring to Figure 4 The attack detection module includes a feature extraction unit, a feature training unit, and a model establishing unit.

[0151] The feature extraction unit is configured to obtain target attack behavior data of the intercepted attack behaviors of each detected application, and perform feature extraction on the target attack behavior data to obtain attack behavior features.

[0152] The feature training unit is configured to determine a training sample set based on the attack behavior features.

[0153] The model establishing unit is configured to train a random forest classifier to be trained based on the training sample set, and obtain the attack behavior detection model after the training, and perform attack detection on the traffic data based on the attack behavior detection model to obtain a detection result.

[0154] The risk assessment module is configured to perform risk assessment on the target attack behavior in a case where it is determined based on the detection result that the target attack behavior on the application to be detected is detected.

[0155] In an embodiment of the present disclosure, referring to FIG. 1, Figure 5 The risk assessment module includes a keyword risk assessment unit and an address risk assessment unit.

[0156] The keyword risk assessment unit is configured to obtain keyword information of an attack keyword in the traffic data, determine a risk keyword matched with the attack keyword in a risk keyword database, and perform risk assessment on the keyword information based on a risk level of the risk keyword to obtain a sub-evaluation result of the keyword information.

[0157] The address risk assessment unit is configured to obtain target address information in the traffic data, find a risk address matched with the target address information in a risk address database, and determine a sub-evaluation result of the target address information based on a risk level of the matched risk address in a case where the matched risk address is found.

[0158] The risk processing module is configured to intercept attack data packets of the attack behavior in the traffic data in a case where it is determined that there is a target sub-evaluation result in at least one sub-evaluation result.

[0159] In an embodiment of the present disclosure, referring to FIG. 1, Figure 6 The risk processing module includes a keyword filtering unit and an address blocking unit.

[0160] The keyword filtering unit is configured to intercept attack data packets of the attack behavior in the traffic data in a case where it is determined that there is a target sub-evaluation result in the sub-evaluation result of the keyword information.

[0161] The address blocking unit is configured to intercept attack data packets of the attack behavior in the traffic data in a case where it is determined that there is a target sub-evaluation result in the sub-evaluation result of the target address information.

[0162] In the above embodiment, the risk keyword database module, the attack detection module, the risk assessment module and the risk processing module are used to obtain the risk assessment result of the detected network attack event of the to-be-detected application program. The risk assessment result of the detected network attack event can solve the problem of inconsistent network attack event handling logic caused by inconsistent network attack event determination level standards, thereby providing the user with relevant risk decision basis.

[0163] Referring to Figure 7 As shown in FIG. 1, the device includes an acquisition module 31, a construction module 32, a detection module 33 and a risk assessment module 34.

[0164] The acquisition module is configured to acquire traffic data of a to-be-detected application program.

[0165] The construction module is configured to acquire an attack behavior detection model, wherein the attack behavior detection model is a random forest classifier for attack behavior detection, which is constructed based on historical traffic data of a plurality of detected application programs.

[0166] The detection module is configured to perform attack detection on the traffic data based on the attack behavior detection model to obtain a detection result.

[0167] The risk assessment module is configured to, in a case where it is determined based on the detection result that a target attack behavior of the to-be-detected application program is detected, perform risk assessment on the target attack behavior.

[0168] In a possible implementation, the construction module is further configured to acquire target attack behavior data of a plurality of attack behaviors intercepted by each detected application program, perform feature extraction on the target attack behavior data to obtain attack behavior features, determine a training sample set based on the attack behavior features, and train a to-be-trained random forest classifier based on the training sample set to obtain the attack behavior detection model.

[0169] In a possible implementation, the construction module is further configured to determine a preset decision logic and a preset decision result of the attack behavior features, determine a training sample set based on the attack behavior features, the preset decision logic and the preset decision result, wherein each attack behavior corresponds to a training sample in the training sample set, process the training sample set by using the to-be-trained random forest classifier to obtain a prediction result, and adjust model parameters of the to-be-trained random forest classifier based on a difference between the prediction result and the preset decision result to obtain the attack behavior detection model.

[0170] In a possible implementation, the detection module is further configured to process the traffic data by using the attack behavior detection model to obtain data warning information of the traffic data; the data warning information is used to indicate at least one of the following: data reliability, data warning level, attack chain stage of the attack behavior; and the detection result of the traffic data is determined based on the data warning information.

[0171] In a possible implementation, the risk assessment module is further configured to, in a case where it is determined that the target attack behavior of the to-be-detected application is detected based on the detection result, determine at least one risk assessment indicator of the target attack behavior; perform risk assessment processing on each risk assessment indicator to obtain a sub-assessment result; and determine a risk assessment result of the target attack behavior based on the sub-assessment result.

[0172] In a possible implementation, the risk assessment module is further configured to obtain keyword information of an attack keyword in the traffic data; determine a risk keyword matched with the attack keyword in the risk keyword database; and perform risk assessment on the keyword information based on a risk level of the risk keyword to obtain a sub-assessment result of the keyword information.

[0173] In a possible implementation, the risk assessment module is further configured to obtain target address information in the traffic data; the target address information is used to indicate address information of the attack behavior of the to-be-detected application; find a risk address matched with the target address information in the risk address database; and in a case where the matched risk address is found, determine a sub-assessment result of the target address information based on a risk level of the matched risk address.

[0174] In a possible implementation, the risk assessment module is further configured to, in a case where the matched risk address is not found in the risk address database, determine the target address information as a suspected risk address; obtain a number of times of accessing the target application by the suspected risk address within a preset time period; and determine a sub-assessment result of the suspected risk address according to the number of times of accessing.

[0175] As can be seen from the above description, since the historical traffic data of the detected application contains the detected network attack behavior, the attack behavior detection model is determined based on the historical traffic data, which can expand the detection range of the attack behavior detection model, thereby improving the detection accuracy of the attack behavior detection model. The random forest classifier is constructed based on the historical traffic data, so that the attack behavior detection model is obtained according to the random forest classifier, which can improve the stability and accuracy of the detection result, avoid overfitting of the attack behavior detection model, and avoid loss caused by missing detection of the network attack behavior in the detection process. The risk assessment result of the target attack behavior is obtained by performing risk assessment on the detected network attack behavior, thereby providing a related risk decision basis for the user.

[0176] The embodiment of the present disclosure further provides a non-transitory computer readable storage medium, which can be arranged in an electronic device to save at least one instruction or at least one program related to a method in the method embodiment, and the at least one instruction or the at least one program is loaded and executed by the processor to realize the method provided by the above embodiment.

[0177] The embodiment of the present disclosure further provides an electronic device, comprising a processor and the aforementioned non-transitory computer readable storage medium.

[0178] The embodiment of the present disclosure further provides a computer program product, which comprises program code, and when the program product is run on an electronic device, the program code is used to make the electronic device execute the steps in the method according to various exemplary embodiments of the present disclosure described in the specification.

[0179] The computer program product can be specifically implemented by means of hardware, software or combination thereof. In an optional embodiment, the computer program product is embodied as a computer storage medium, and in another optional embodiment, the computer program product is embodied as a software product, such as a software development kit (SDK) and the like.

[0180] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described system and device can refer to the corresponding process in the foregoing method embodiments, which will not be repeated here. In the several embodiments provided by the present disclosure, it should be understood that the disclosed system, device and method can be implemented by other ways. The device embodiments described above are only schematic, for example, the division of the units is only a logical function division, and there can be another division way in actual implementation, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some communication interfaces, devices or units, and can be electrical, mechanical or other forms.

[0181] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on a plurality of network units. According to actual needs, some or all of the units can be selected to achieve the purpose of the embodiment.

[0182] In addition, each functional unit in each embodiment of the present disclosure can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit.

[0183] If the functions are implemented in the form of software functional units and sold or used as independent products, the functions can be stored in a nonvolatile computer readable storage medium executable by a processor. Based on such understanding, the technical solutions of the present disclosure can be embodied in the form of a software product, and the computer software product is stored in a storage medium, and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods in the embodiments of the present disclosure. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and various media that can store program codes.

[0184] Although some specific embodiments of the present disclosure have been described in detail by examples, those skilled in the art should understand that the above examples are only for illustration, and are not intended to limit the scope of the present disclosure. Those skilled in the art should also understand that various modifications can be made to the embodiments without departing from the scope and spirit of the present disclosure. The scope of the present disclosure is defined by the appended claims.

Claims

1. A method of handling a network attack, characterized by, The method comprises: acquiring traffic data of an application to be detected; acquiring an attack behavior detection model, wherein the attack behavior detection model is a random forest classifier for attack behavior detection constructed based on historical traffic data of a plurality of detected applications; performing attack detection on the traffic data based on the attack behavior detection model to obtain a detection result; in a case where it is determined based on the detection result that a target attack behavior on the application to be detected is detected, performing risk assessment on the target attack behavior; in a case where it is determined based on the detection result that a target attack behavior on the application to be detected is detected, determining at least one risk assessment indicator of the target attack behavior; performing risk assessment processing on each of the risk assessment indicators to obtain a sub-assessment result; determining a risk assessment result of the target attack behavior based on the sub-assessment result; acquiring target address information in the traffic data, wherein the target address information is used to indicate address information of the attack behavior of the application to be detected; finding a risk address matched with the target address information in a risk address database; in a case where the matched risk address is found, determining a sub-assessment result of the target address information based on a risk level of the matched risk address; in a case where the matched risk address is not found in the risk address database, determining the target address information as a suspected risk address; acquiring a number of access times of the suspected risk address to a target application within a preset time period; determining a sub-assessment result of the suspected risk address according to the number of access times.

2. The method of claim 1, wherein, The attack behavior detection model is trained in the following manner: acquiring target attack behavior data of a plurality of attack behaviors intercepted by each detected application; performing feature extraction on the target attack behavior data to obtain attack behavior features; determining a training sample set based on the attack behavior features, and training a random forest classifier to be trained based on the training sample set, to obtain the attack behavior detection model after training.

3. The method of claim 2, wherein, The attack behavior detection model is trained in the following manner: determining a preset decision logic and a preset decision result of the attack behavior features; determining a training sample set based on the attack behavior features, the preset decision logic and the preset decision result, wherein each attack behavior corresponds to one training sample in the training sample set; processing the training sample set by the random forest classifier to be trained to obtain a prediction result; adjusting model parameters of the random forest classifier to be trained based on a difference between the prediction result and the preset decision result, to obtain the attack behavior detection model.

4. The method of claim 1, wherein, The attack behavior detection model is trained in the following manner: The attack behavior detection model is used for processing the traffic data, and data warning information of the traffic data is obtained; wherein the data warning information is used for indicating at least one of the following: data reliability, data alarm level, attack chain stage of the attack behavior; Based on the data warning information, the detection result of the traffic data is determined.

5. The method of claim 1, wherein, The risk assessment processing of each risk assessment indicator is performed to obtain a sub-evaluation result, including: Obtaining keyword information of an attack keyword in the traffic data; Determining a risk keyword matched with the attack keyword in a risk keyword database; Based on the risk level of the risk keyword, the keyword information is risk assessed to obtain a sub-evaluation result of the keyword information.

6. The method of claim 1, wherein, The method further includes: In a case where at least one of the sub-evaluation results is a target sub-evaluation result, an attack data packet of the attack behavior in the traffic data is intercepted; wherein the risk assessment indicator corresponding to the target sub-evaluation result meets a preset risk level requirement.

7. A network attack handling apparatus characterized by comprising: The device includes: An acquisition module is configured to acquire traffic data of an application program to be detected; A construction module is configured to acquire an attack behavior detection model; wherein the attack behavior detection model is a random forest classifier for attack behavior detection, which is constructed based on historical traffic data of a plurality of detected application programs; A detection module is configured to perform attack detection on the traffic data based on the attack behavior detection model to obtain a detection result; A risk assessment module is configured to, in a case where it is determined based on the detection result that a target attack behavior against the application program to be detected is detected, perform risk assessment on the target attack behavior; The risk assessment module is further configured to, in a case where it is determined based on the detection result that the target attack behavior against the application program to be detected is detected, determine at least one risk assessment indicator of the target attack behavior; perform risk assessment processing on each risk assessment indicator to obtain a sub-evaluation result; determine a risk assessment result of the target attack behavior based on the sub-evaluation result; acquire target address information in the traffic data; wherein the target address information is used for indicating address information of the attack behavior of the application program to be detected; find a risk address matched with the target address information in a risk address database; in a case where the matched risk address is found, determine a sub-evaluation result of the target address information based on a risk level of the matched risk address; in a case where the matched risk address is not found in the risk address database, determine the target address information as a suspected risk address; acquire a number of times of accessing a target application program by the suspected risk address within a preset time period; and determine a sub-evaluation result of the suspected risk address according to the number of times of accessing.

8. A non-transitory computer-readable storage medium, comprising: The storage medium stores at least one instruction or at least one program, which is loaded and executed by the processor to implement the method of any one of claims 1-6.

9. An electronic device, comprising: The storage medium includes a processor and a non-transitory computer readable storage medium of claim 8.

Images