Botnet detection method, device, equipment, storage medium and program product

Abstract

The application discloses a botnet detection method, device and equipment, a storage medium and a program product, relates to the technical field of network security, and discloses a botnet detection method, which comprises the following steps: acquiring a plurality of network alarm records of a target network group; constructing a first directed graph according to the plurality of network alarm records; calculating the attack similarity between the out-edge of a target node of any edge of the directed graph and the edge; retaining a target edge and nodes associated with the target edge in the first directed graph, wherein the attack similarity is greater than a preset attack similarity, obtaining a second directed graph; and calculating the botnet probability corresponding to each connected subgraph in the second directed graph, to obtain a botnet detection result. The application can improve the accuracy of botnet detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a botnet detection method and device, equipment, a storage medium and a program product. BACKGROUND

[0002] Currently, in order to prevent hackers from launching distributed denial of service attacks, stealing user data and private information by using botnets, and causing website or server paralysis and property loss, the related technology mainly detects botnets based on network traffic anomalies or network behavior feature anomalies.

[0003] Among them, when detecting by using network traffic, some normal network traffic patterns may be similar to botnet activities, for example, the communication mode of some software updates or remote management tools, which is easy to misjudge as botnet activities, thereby causing low detection accuracy of botnets. SUMMARY

[0004] The main purpose of the present application is to provide a botnet detection method, device, equipment, storage medium and program product, aiming at solving the technical problem of low detection accuracy of botnets.

[0005] To achieve the above purpose, the present application provides a botnet detection method, comprising:

[0006] obtaining a plurality of network alarm records of a target network group;

[0007] constructing a first directed graph according to the plurality of network alarm records; wherein the nodes of the first directed graph are communication objects in the network alarm records, and an edge between the corresponding two nodes is generated when there is at least one network alarm record between any two communication objects;

[0008] calculating the attack similarity between the out-edge of the target node of the edge and the edge for any edge of the first directed graph;

[0009] retaining the target edge and the nodes associated with the target edge in the first directed graph whose attack similarity is greater than a preset attack similarity, to obtain a second directed graph;

[0010] calculating the botnet probability corresponding to each connected subgraph in the second directed graph respectively to obtain a botnet detection result.

[0011] In an embodiment, the step of calculating the botnet probability corresponding to each connected subgraph in the second directed graph respectively to obtain a botnet detection result comprises:

[0012] obtaining the similar attack content of the connected subgraph according to the total number of attack paths in the connected subgraph;

[0013] According to a numerical relationship between the total number of nodes in the connected subgraph and the total number of target edges, a network group connectivity of the connected subgraph is obtained;

[0014] According to a numerical relationship between the number of attack types in the connected subgraph and the total number of target edges, a network group attack complexity of the connected subgraph is obtained; wherein the attack type to which each target edge belongs is obtained according to the alarm type in the corresponding network alarm record;

[0015] According to a numerical relationship between the number of alarm records in the connected subgraph and the total number of target edges, a network group attack fluctuation degree of the connected subgraph is obtained;

[0016] According to the similar attack content, the network group connectivity, the network group attack complexity, and the network group attack fluctuation degree, a botnet probability is calculated, and a botnet detection result is obtained.

[0017] In an embodiment, the similar attack content is obtained by using Formula One, and Formula One includes: S1=log 10 (x1+1), wherein S1 represents the similar attack content, and x1 represents the total number of attack paths; and / or

[0018] The network group connectivity is obtained by using Formula Two, and Formula Two includes: wherein S2 represents the network group connectivity, x2 represents the total number of nodes, and x3 represents the total number of target edges; and / or

[0019] The network group attack complexity is obtained by using Formula Three, and Formula Three includes: wherein S3 represents the network group attack complexity, and x4 represents the number of attack types; and / or

[0020] The network group attack fluctuation degree is obtained by using Formula Four, and Formula Four includes: wherein S4 represents the network group attack fluctuation degree, and x5 represents the number of alarm records.

[0021] In an embodiment, according to the similar attack content, the network group connectivity, the network group attack complexity, and the network group attack fluctuation degree, the botnet probability is calculated, and the step of obtaining the botnet detection result includes:

[0022] The ratio of the number of features greater than the preset threshold to the total number of features in the similar attack content, the network group connectivity, the network group attack complexity, and the network group attack fluctuation degree is taken as the probability of the botnet;

[0023] If the probability is not less than the preset probability, it is determined that the botnet detection result of the target network group is a botnet.

[0024] In an embodiment, the step of calculating, for any edge of the first directed graph, the attack similarity between the out-edge of the target node of the edge and the edge comprises:

[0025] According to the plurality of network alarm records, all first alarm names corresponding to the edge and all second alarm names corresponding to the out-edge of the target node of the edge are obtained;

[0026] According to the similarity between all first alarm names and all second alarm names, the attack similarity between the out-edge and the edge is obtained.

[0027] In an embodiment, the step of obtaining the attack similarity between the out-edge and the edge according to the similarity between all first alarm names and all second alarm names comprises:

[0028] All first alarm names are taken as a first alarm name set, and all second alarm names are taken as a second alarm name set;

[0029] The first alarm name set and the second alarm name set are taken as a union set to obtain a reference name set;

[0030] According to whether each element in the reference name set exists in the first alarm name set, a first vector is generated in the space vector corresponding to the reference name set;

[0031] According to whether each element in the reference name set exists in the second alarm name set, a second vector is generated in the space vector corresponding to the reference name set;

[0032] The cosine similarity of the first vector and the second vector is calculated, and the cosine similarity is taken as the attack similarity.

[0033] In addition, in order to achieve the above-mentioned purpose, the application further provides a botnet detection device, the botnet detection device comprises:

[0034] The acquisition module is configured to acquire a plurality of network alarm records of a target network group;

[0035] The construction module is configured to construct a first directed graph according to the plurality of network alarm records; wherein the nodes of the first directed graph are communication objects in the network alarm records, and when there is at least one network alarm record between any two communication objects, an edge between the two nodes corresponding to the two communication objects is generated;

[0036] The first calculation module is configured to calculate, for any edge of the first directed graph, the attack similarity between the out-edge of the target node of the edge and the edge;

[0037] The retention module is configured to retain the target edge and the nodes associated with the target edge in the first directed graph, wherein the attack similarity of the target edge is greater than a preset attack similarity, to obtain a second directed graph;

[0038] The second calculation module is configured to calculate a botnet probability corresponding to each connected subgraph in the second directed graph, and obtain a botnet detection result.

[0039] In addition, to achieve the above object, the application further provides a botnet detection device, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the computer program is configured to implement the steps of the botnet detection method.

[0040] In addition, to achieve the above object, the application further provides a storage medium, which is a computer readable storage medium, and the storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the botnet detection method.

[0041] In addition, to achieve the above object, the application further provides a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement the steps of the botnet detection method.

[0042] The one or more technical solutions provided in the application have at least the following technical effects:

[0043] In the application, a plurality of network alarm records of a target network group are obtained, a first directed graph is constructed according to the plurality of network alarm records, wherein the nodes of the first directed graph are communication objects in the network alarm records, and an edge between two nodes corresponding to any two communication objects is generated when there is at least one network alarm record between the two communication objects; for any edge of the first directed graph, an attack similarity between the out-edge of the target node of the edge and the edge is calculated; target edges with an attack similarity greater than a preset attack similarity and nodes associated with the target edges in the first directed graph are retained to obtain a second directed graph; a botnet probability corresponding to each connected subgraph in the second directed graph is calculated to obtain a botnet detection result.

[0044] Compared with the detection of botnets by using traffic in the related art, in the process of detecting botnets, the application can use network alarm records with higher data value to construct a first directed graph, then calculate the attack similarity between the out-edge of the target node of the first directed graph and the edge, and divide the network group containing the botnet from other groups by removing the edges with an attack similarity less than a preset attack similarity and the associated nodes in the first directed graph, thereby reducing the interference of feature dimensions and improving the accuracy of botnet detection. BRIEF DESCRIPTION OF DRAWINGS

[0045] The accompanying drawings, which are incorporated into and form part of the specification, illustrate embodiments consistent with the application and, together with the specification, serve to explain the principles of the application.

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the drawings needed to be used in the embodiments or the related art description will be briefly introduced as follows. Obviously, those skilled in the art can obtain other drawings from these drawings without any creative effort.

[0047] Figure 1 A flowchart provided by the botnet detection method embodiment one of the present application;

[0048] Figure 2 A schematic diagram of the present application for the existence of network alarm records between two communication objects;

[0049] Figure 3 A schematic diagram of the present application for the edge of the target node of the edge;

[0050] Figure 4 A module structure schematic diagram of the botnet detection device of the present application embodiment;

[0051] Figure 5 A device structure schematic diagram of the hardware running environment involved in the botnet detection method in the present application embodiment.

[0052] The purpose of the present application, the functional characteristics and the advantages will be further described with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION

[0053] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application, and are not used to limit the present application.

[0054] In order to better understand the technical solutions of the present application, the specific embodiments will be described in detail with reference to the drawings and the accompanying drawings.

[0055] The main solution of the present application embodiment is: obtaining a plurality of network alarm records of a target network group; constructing a first directed graph according to the plurality of network alarm records; wherein the nodes of the first directed graph are the communication objects in the network alarm records, and at least one network alarm record exists between any two communication objects to generate an edge between the corresponding two nodes; for any edge of the first directed graph, calculating the attack similarity between the out-edge of the target node of the edge and the edge; retaining the target edge in the first directed graph whose attack similarity is greater than the preset attack similarity and the nodes associated with the target edge, obtaining a second directed graph; calculating the botnet probability corresponding to each connected subgraph in the second directed graph respectively, and obtaining the botnet detection result.

[0056] A botnet is a group of malicious computers controlled by hackers. These computers are unknowingly infected with malicious programs and become tools for hackers. Computers infected with malicious programs perform operations such as automatic networking, sending SMS, and deleting communication records without the user's consent, causing many inconveniences to the user.

[0057] In addition, hackers can also use computers infected with malicious programs to launch distributed denial of service attacks, causing websites or servers to crash and affecting normal network operation. At the same time, hackers can also use computers infected with malicious programs to steal user data and private information, even perform credential stuffing and account takeover, thereby stealing users' property and privacy.

[0058] Currently, to prevent hackers from using botnets to launch distributed denial of service attacks, steal user data and private information, cause websites or servers to crash and property loss, the relevant technology mainly detects botnets based on network traffic anomalies or network behavior feature anomalies.

[0059] Among them, when using network traffic for detection, the following defects mainly exist:

[0060] 1. When using network traffic for detection, training data needs to be obtained from historical security data, so that the accuracy of detecting botnets mainly depends on the accuracy of security logs in the data. When there are botnet behaviors that are not recognized by security devices, it is not possible to detect botnet behaviors that are not recognized by security devices, and there is a high possibility of false negatives;

[0061] 2. When using the time difference between two adjacent requests to calculate the request interval similarity and using the request interval similarity as the main basis for botnet judgment, since traffic behaviors with similar request frequencies can be generated by other machines, not just botnets, the false positive rate of botnets is high;

[0062] 3. When using clustering of network traffic to detect botnets, although some botnets can be detected, for highly concealed botnet attacks, attackers can use compromised hosts to simulate normal network traffic, so it is difficult to accurately distinguish botnets from normal networks using simple clustering algorithms;

[0063] Therefore, when using network traffic to detect botnets, due to the inability to identify botnet behaviors and the inability to distinguish between normal network traffic and abnormal network traffic, the accuracy of botnet detection is low.

[0064] The application provides a solution. Compared with the detection of botnets by using traffic in the related art, in the process of detecting botnets, the embodiment can use network alarm records with higher data value to construct a first directed graph, and then calculate the attack similarity between the edges and out edges of the target nodes in the first directed graph. By removing the edges and related nodes in the first directed graph with an attack similarity less than a preset attack similarity through the attack similarity, the network community containing the botnet is divided from other communities, the interference of the feature dimension is reduced, and the accuracy of the detection of the botnet is improved.

[0065] It should be noted that the execution subject of the embodiment can be a botnet detection device. The execution subject of the embodiment can be a computing service device with data processing, network communication and program running functions, for example, a tablet computer, a personal computer, a mobile phone or the like, or an electronic device capable of realizing the above functions. In the following, the botnet detection device is taken as an example to describe the embodiment and each of the following embodiments.

[0066] Based on this, the application embodiment provides a botnet detection method. Referring to Figure 1 , Figure 1 The flowchart of the first embodiment of the botnet detection method of the application is shown in FIG. 1.

[0067] In the embodiment, the botnet detection method includes steps S10-S50.

[0068] In step S10, a plurality of network alarm records of a target network community are obtained.

[0069] In the embodiment, each network alarm record can include at least one of an alarm occurrence start time, an alarm occurrence end time, a source IP (Internet Protocol), a target IP, a source port, a target port, a source host home resource pool, a target host home resource pool, an alarm name, alarm payload data and an IP internal and external network identifier.

[0070] Specifically, the botnet detection device can be communicatively connected with a plurality of security devices, such as a network terminal appliance (NTA), an intrusion detection system (IDS), an intrusion prevention system (IPS), a web application firewall (WAF), and the like. The botnet detection device can receive network alarm data periodically sent by the security network device. After receiving the network alarm data, the botnet detection device can extract a plurality of valid alarm information from the network alarm data, and take each piece of extracted valid alarm information as a network alarm record.

[0071] After obtaining a plurality of network alarm records, in order to facilitate the management of the network alarm records, the plurality of network alarm records can be grouped according to source IP and target IP to obtain a plurality of network alarm record groups. For each network alarm record group, a de-duplication processing is performed on the alarm name to obtain a de-duplicated alarm name, and the alarm type is counted according to the de-duplicated alarm name. After the de-duplication processing on the alarm name, the number of alarm records of the network alarm record group is counted to obtain an alarm record number. After obtaining the alarm record number, the earliest alarm start time and the latest alarm end time are determined, and the de-duplication processing is performed on the alarm load data and the IP internal and external network identifier to obtain de-duplicated alarm load data and de-duplicated IP internal and external network identifier.

[0072] For each network alarm information group, the above operations are performed to obtain the de-duplicated alarm name, the alarm type, the alarm record number, the earliest alarm start time, the latest alarm end time, the de-duplicated alarm load data, and the de-duplicated IP internal and external network identifier corresponding to each source IP and target IP. After that, the de-duplicated alarm name, the alarm type, the alarm record number, the earliest alarm start time, the latest alarm end time, the de-duplicated alarm load data, and the de-duplicated IP internal and external network identifier can be stored as an alarm data table, so as to facilitate the management of the network alarm records.

[0073] It should be noted that, since different security devices have different naming methods for alarm events, in order to improve the efficiency of botnet detection using network alarm records in the subsequent process, after extracting valid alarm information from network alarm data, the valid alarm information can be standardized according to a unified standard to process different source data into the same data format and unify the field naming.

[0074] Step S20, constructing a first directed graph according to a plurality of network alarm records.

[0075] The nodes of the first directed graph are the communication objects in the network alarm records, and an edge is generated between the nodes corresponding to any two communication objects when there is at least one network alarm record between the two communication objects.

[0076] Specifically, in constructing the first directed graph by using the plurality of network alarm records, in order to quickly determine the number of nodes in the directed graph, the source IP, the source IP belonging resource pool and the source port in the network alarm record can be spliced to obtain a first spliced string, and the first spliced string can be hashed to obtain a first identifier corresponding to the first communication object. Correspondingly, the target IP, the target IP belonging resource pool and the target port in the network alarm record can be spliced to obtain a second spliced string, and the second spliced string can be hashed to obtain a second identifier corresponding to the second communication object. The number of identifiers of the first identifier and the second identifier is counted, and the number of identifiers is taken as the number of nodes in the first directed graph.

[0077] It should be noted that in the plurality of network alarm records, there can be multiple network alarm records for the same attack event in the same communication object, and in order to avoid multiple same nodes in the directed graph, the plurality of network alarm records can be de-duplicated to obtain de-duplicated network alarm records when constructing the first directed graph by using the plurality of network alarm records. Finally, the source IP, the source IP belonging resource pool and the source port in the de-duplicated network alarm records are used to obtain the first identifier, and the de-duplicated target IP, the target IP belonging resource pool and the target port are used to obtain the second identifier.

[0078] After determining the number of nodes in the first directed graph, the first communication object corresponding to the first identifier and the second communication object corresponding to the second identifier can be taken as the nodes in the first directed graph, and the first identifier and the second identifier can be taken as the node names of the corresponding nodes, that is, the communication objects in the network alarm records are taken as the nodes in the first directed graph. After obtaining the initial directed graph, when there is at least one network alarm record between any two communication objects, an edge between the nodes corresponding to the two communication objects is generated to connect the two corresponding nodes to obtain the first directed graph. The network alarm records between any two communication objects can be as shown in Figure 2 IP1 is the first communication object and IP2 is the second communication object.

[0079] After obtaining the first directed graph, the source IP, the target IP and the IP internal and external network identifier can be taken as the node attributes and stored in the corresponding nodes, and the alarm name, the alarm type, the alarm record number, the earliest alarm start time, the latest alarm end time and the de-duplicated alarm load data can be taken as the edge attributes and stored in the corresponding edges.

[0080] Step S30, for any edge of the first directed graph, calculate the attack similarity between the out-edge of the target node of the edge and the edge.

[0081] Specifically, after obtaining the first directed graph, for any edge in the first directed graph, determine the target node of the edge. After determining the target node, count the out-degree of the target node, i.e., the number of edges of the target node pointing to other nodes, and take the edges of the target node pointing to other nodes as out-edges. When the out-degree is 0, it is determined that the target node does not point to other nodes, and accordingly, when the out-degree is not 0, it is determined that the target node points to at least one other node, such as when the out-degree is 2, it is determined that the number of other nodes pointed to by the target node is 2, i.e., the number of out-edges is 2.

[0082] It should be noted that when calculating the attack similarity between the edge and the out-edge, the attributes of the edge and the attributes of the out-edge can be used to calculate the attack similarity between the out-edge and the edge. Based on the foregoing, both the edge and the out-edge have multiple attributes, and when calculating the attack similarity between the out-edge and the edge based on the attributes of the edge and the out-edge, further, as an optional implementation, step S30 specifically includes:

[0083] Step S31, according to the plurality of network alarm records, obtaining all first alarm names corresponding to the edge and all second alarm names corresponding to the out-edge of the target node of the edge.

[0084] Step S32, according to the similarity between all first alarm names and all second alarm names, obtaining the attack similarity between the out-edge and the edge.

[0085] Specifically, after constructing the first directed graph using the plurality of network alarm records, for any node in the first directed graph, when the node has an edge pointing to other nodes, then determine the target network alarm records corresponding to the two nodes connected by the edge, and construct the mapping relationship between the target network alarm records and the edge, so that subsequently, based on the mapping relationship, all network alarm records corresponding to the edge and all network alarm records corresponding to the out-edge can be obtained from the plurality of network alarm records, and all first alarm names can be extracted from all network alarm records corresponding to the edge, and all second alarm names can be extracted from all network alarm records corresponding to the out-edge.

[0086] It should be noted that when the attack similarity between the edge and the out edge is calculated by using all the first alarm names and all the second alarm names, when the first alarm name and the second alarm name are the same, they are in the same dimension, at this time, it can be directly calculated, and when the first alarm name and the second alarm name are different, since different alarm names are in different dimensions, therefore, the similarity between the edge and the out edge cannot be directly calculated by using the first alarm name and the second alarm name. Therefore, when the attack similarity between the edge and the out edge is calculated by using all the first alarm names and all the second alarm names, in order to unify the calculation dimension, further, as an optional implementation manner, the step S32 specifically comprises:

[0087] The step S321 comprises: taking all the first alarm names as a first alarm name set, and taking all the second alarm names as a second alarm name set.

[0088] The step S322 comprises: taking the union of the first alarm name set and the second alarm name set to obtain a reference name set.

[0089] The step S323 comprises: generating a first vector in the space vector corresponding to the reference name set according to whether each element in the reference name set exists in the first alarm name set.

[0090] The step S324 comprises: generating a second vector in the space vector corresponding to the reference name set according to whether each element in the reference name set exists in the second alarm name set.

[0091] The step S325 comprises: calculating the cosine similarity of the first vector and the second vector, and taking the cosine similarity as the attack similarity.

[0092] Specifically, after obtaining all the first alarm names and all the second alarm names, all the first alarm names can be taken as a first alarm name set, all the second alarm names can be taken as a second alarm name set, and the union of the first alarm name set and the second alarm name set can be taken to obtain a reference name set. After obtaining the reference name set, a first vector can be generated in the space vector corresponding to the reference name set according to whether each element in the reference name set exists in the first alarm name set. Correspondingly, a second vector can be generated in the space vector corresponding to the reference name set according to whether each element in the reference name set exists in the second alarm name set. Finally, the cosine similarity between the first vector and the second vector is calculated, and the cosine similarity is taken as the attack similarity.

[0093] In order to better understand the embodiment, a specific example is provided as follows.

[0094] Specifically, referring to Figure 3As shown, assuming the target node is the b node, the edge of the b node is E1, the out-edge of the b node is E2, all the first alarm names corresponding to the edge E1 are a, b, and c, and the first alarm name set is determined as {a, b, c}, and all the second alarm names corresponding to the out-edge E2 are c, d, and e, and the second alarm name set is determined as {c, d, e}.

[0095] The union set of the first alarm name set and the second alarm name set is obtained as the reference name set {a, b, c, d, e}. After obtaining the reference name set, it can be determined that the elements a, b, and c in the reference name set exist in the first alarm name set, and thus the first vector V1 = [1, 1, 1, 0, 0] in the vector space corresponding to the reference name set is generated. Correspondingly, for the second alarm name set, it can be determined that the elements c, d, and e in the reference name set exist in the second alarm name set, and thus the second vector V2 = [0, 0, 1, 1, 1] in the vector space corresponding to the reference name set is generated.

[0096] After obtaining the first vector and the second vector, the cosine similarity between the first vector and the second vector can be calculated as cos(V1, V2) = 0.33, that is, the attack similarity between the edge E1 and the out-edge E2 can be obtained as 0.33.

[0097] Step S40, retaining the target edge with an attack similarity greater than a preset attack similarity and the nodes associated with the target edge in the first directed graph, and obtaining a second directed graph.

[0098] In this embodiment, the second directed graph can include a plurality of connected subgraphs, and the connected subgraph can be a relationship graph in which at least one edge exists between any two nodes.

[0099] Specifically, based on the foregoing, after the attack similarity between the edge and the out-edge is calculated, when the attack similarity is greater than the preset attack similarity, the out-edge is determined as the edge, the out-edge of the next target node is determined, and the step S30 is repeatedly executed until the attack similarity is less than the preset attack similarity or the target node of the edge has no out-edge.

[0100] After the attack similarity between any edge and its corresponding out-edge is calculated, the edge with an attack similarity greater than a preset attack similarity is determined as a target edge, and the target edge and the nodes associated with the target edge are retained to obtain a second directed graph.

[0101] In the embodiment, the target edges and the nodes related to the target edges in the first directed graph whose attack similarity is greater than the preset attack similarity are reserved to obtain a second directed graph, so that the target edges and the nodes related to the target edges in the second directed graph can constitute a deep attack path with similar attack methods, and when there is any common node between two similar attack paths, the two similar attack paths are considered to belong to the same attack range, that is, by removing the connected subgraphs in the first directed graph which do not contain similar attack paths, the groups containing botnets are distinguished from other groups, the feature dimension interference is reduced, the accuracy of detection of the botnets is improved, and thus the false positive rate of the detection result is reduced.

[0102] In step S50, the botnet probability corresponding to each connected subgraph is calculated to obtain a botnet detection result.

[0103] When the botnet probability of each connected subgraph in the second directed graph is calculated, in order to improve the accuracy of the calculation result, the botnet probability can be calculated by using the feature combination of the botnet, that is, the similar attack content, the network group connectivity, the network group attack complexity and the network group attack fluctuation degree are taken as an integral feature, and the botnet probability is calculated by using the similar attack content, the network group connectivity, the network group attack complexity and the network group attack fluctuation degree. Further, as an optional implementation, step S50 specifically includes:

[0104] In step S51, the similar attack content of the connected subgraph is obtained according to the total number of attack paths in the connected subgraph.

[0105] In step S52, the network group connectivity of the connected subgraph is obtained according to the numerical relationship between the total number of nodes in the connected subgraph and the total number of target edges.

[0106] In step S53, the network group attack complexity of the connected subgraph is obtained according to the numerical relationship between the number of attack types in the connected subgraph and the total number of target edges.

[0107] In the embodiment, the similar attack content can be a linear transformation of the number of attack paths contained in the connected subgraph. The network group connectivity can be the comparison degree of the nodes and edges contained in the connected subgraph. The network group attack complexity can be the complexity degree of the attack types in the connected subgraph. The network group attack fluctuation degree can be the distribution of the number of alarm records contained in the connected subgraph.

[0108] In step S54, the network group attack fluctuation degree of the connected subgraph is obtained according to the numerical relationship between the number of alarm records in the connected subgraph and the total number of target edges.

[0109] In the embodiment, the similar attack content can be a linear transformation of the number of attack paths contained in the connected subgraph. The network group connectivity can be the comparison degree of the nodes and edges contained in the connected subgraph. The network group attack complexity can be the complexity degree of the attack types in the connected subgraph. The network group attack fluctuation degree can be the distribution of the number of alarm records contained in the connected subgraph.

[0110] Specifically, in the same connected subgraph, after determining the total number of attack paths, the total number of nodes, the total number of edges, the number of attack types and the number of alarm records in the connected subgraph, the similarity attack content can be calculated by using Formula One, Formula One includes: S1 = log 10 (x1+1), wherein S1 represents the similarity attack content, and x1 represents the total number of attack paths. Correspondingly, the network group connectivity is obtained by using Formula Two, Formula Two includes: wherein S2 represents the network group connectivity, x2 represents the total number of nodes, and x3 represents the total number of target edges; the network group attack complexity is obtained by using Formula Three, Formula Three includes: wherein S3 represents the network group attack complexity, and x4 represents the number of attack types; the network group attack fluctuation degree is obtained by using Formula Four, Formula Four includes: wherein S4 represents the network group attack fluctuation degree, and x5 represents the number of alarm records.

[0111] Step S55, according to the similarity attack content, the network group connectivity, the network group attack complexity and the network group attack fluctuation degree, the zombie network probability is calculated, and the zombie network detection result is obtained.

[0112] When the similarity attack content, the network group connectivity, the network group attack complexity and the network group attack fluctuation degree are used to calculate the zombie network probability, in order to link the existence of the zombie network with the attack behavior, so that the security maintenance personnel can better understand the threat degree in the network, further, as an optional implementation manner, step S55 specifically includes:

[0113] Step S551, the ratio of the number of features greater than the preset threshold to the total number of features in the similarity attack content, the network group connectivity, the network group attack complexity and the network group attack fluctuation degree is taken as the probability of the zombie network.

[0114] Step S552, if the probability is not less than the preset probability, it is determined that the zombie network detection result of the target network group is the zombie network.

[0115] Specifically, after calculating the similarity attack content, the network group connectivity, the network group attack complexity and the network group attack fluctuation degree based on the foregoing steps, the similarity attack content, the network group connectivity, the network group attack complexity and the network group attack fluctuation degree can be compared with the preset threshold respectively, and the number of features greater than the preset threshold is counted, and finally the ratio of the number of features to the total number of features is taken as the probability of the zombie network.

[0116] In order to better understand the present embodiment, a specific example is provided as follows.

[0117] Specifically, for a certain connected subgraph, based on the foregoing steps, S1=0.6, S2=0.7, S3=0.55, S4=0.2 are calculated, and when the preset threshold is 0.5, it can be determined that the number of features greater than the preset threshold among the similar attack content, the network group connectivity, the network group attack complexity and the network group attack fluctuation degree is 3, and the total number of features is 4. According to the ratio of the number of features to the total number of features, it can be obtained that the probability of the connected subgraph being a botnet is 0.75.

[0118] In this embodiment, the similar attack content, the network group connectivity, the network group attack complexity and the network group attack fluctuation degree are features constructed around the characteristics of botnets. When calculating the probability of a botnet, the above features are calculated as a whole to calculate the probability of a botnet, which can more easily find botnet groups in the space formed by the combination of features, so as to avoid the situation that the detection result is inaccurate due to the addition or reduction of features, thereby reducing the false positive rate of the detection result. At the same time, the ratio of the number of features greater than the preset threshold to the total number of features is used as the probability of a botnet, which can link the existence of a botnet to attack behavior and quantify it as a probability value, which can help security maintenance personnel better understand the threat level in the network and prioritize high-risk situations.

[0119] It should be noted that for general security protection scenarios, when a connected subgraph is evaluated as a botnet with a probability of 100%, it can be determined that there is a botnet host group in the target network group.

[0120] In this embodiment, compared with the detection of botnets by using traffic in the related art, in the process of detecting a botnet, the network alarm records with higher data value are used to construct a first directed graph, and then the attack similarity between the edges and the out-edges of the target nodes in the first directed graph is calculated. By removing the edges and related nodes in the first directed graph with an attack similarity less than a preset attack similarity, the network group containing a botnet is divided from other groups, the interference of feature dimensions is reduced, and the accuracy of detection of a botnet is improved.

[0121] It should be noted that the above examples are only used to understand the present application and do not limit the botnet detection method of the present application. Based on this technical concept, more forms of simple transformation are within the protection scope of the present application.

[0122] The present application also provides a botnet detection device, which is described in detail in Figure 4 The botnet detection device comprises:

[0123] The acquisition module 10 is configured to acquire a plurality of network alarm records of a target network group.

[0124] The constructing module 20 is configured to construct a first directed graph according to the plurality of network alarm records, wherein a node of the first directed graph is a communication object in the network alarm records, and an edge between two nodes corresponding to any two communication objects is generated when there is at least one network alarm record between the two communication objects.

[0125] The first calculating module 30 is configured to calculate, for any edge of the first directed graph, an attack similarity between an out-edge of a target node of the edge and the edge.

[0126] The retaining module 40 is configured to retain a target edge and nodes associated with the target edge in the first directed graph, wherein the target edge is an edge with an attack similarity greater than a preset attack similarity, to obtain a second directed graph.

[0127] The second calculating module 50 is configured to calculate a botnet probability corresponding to each connected subgraph in the second directed graph, to obtain a botnet detection result.

[0128] The botnet detection device provided in the present application adopts the botnet detection method in the above embodiments, and can solve the technical problem of low accuracy of botnet detection. Compared with the related art, the botnet detection device provided in the present application has the same beneficial effects as the botnet detection method provided in the above embodiments, and other technical features in the botnet detection device are the same as the features disclosed in the above embodiments, which will not be repeated here.

[0129] The present application provides a botnet detection device, which comprises at least one processor and a memory in communication connection with the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the botnet detection method in Embodiment I.

[0130] Reference will now be made to the following description Figure 5 which shows a structural schematic diagram of a botnet detection device suitable for implementing the embodiments of the present application. The botnet detection device in the embodiments of the present application can include, but is not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (Personal Digital Assistant), PADs (Portable Application Description), PMPs (Portable Media Player), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), and the like, and fixed terminals such as digital TVs, desktop computers, and the like. Figure 5 The botnet detection device shown is merely an example, and should not impose any limitation on the functions and use range of the embodiments of the present application.

[0131] As shown in Figure 5 The botnet detection device can include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.) that can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 1002 or programs loaded from a storage device 1003 into a random access memory (RAM) 1004. Various programs and data required for the operation of the botnet detection device are also stored in the RAM 1004. The processing device 1001, the ROM 1002, and the RAM 1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; the storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the botnet detection device to communicate wirelessly or wired with other devices to exchange data. Although the botnet detection device with various systems is shown in the figure, it should be understood that all the shown systems are not required to be implemented or possessed. More or less systems can be alternatively implemented or possessed.

[0132] In particular, according to embodiments of the present disclosure, the processes described above with reference to the flowcharts can be implemented as a computer software program. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network through the communication device, or installed from the storage device 1003, or installed from the ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the methods of embodiments of the present disclosure are performed.

[0133] The botnet detection device provided by the present disclosure adopts the botnet detection method in the above embodiments, and can solve the technical problem of low accuracy of botnet detection. Compared with the related art, the botnet detection device provided by the present disclosure has the same beneficial effects as the botnet detection method provided by the above embodiments, and other technical features in the botnet detection device are the same as the features disclosed in the previous embodiment method, which will not be repeated here.

[0134] It should be understood that various parts of the present application can be implemented in hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0135] The above description is merely illustrative of the application and not restrictive thereof; the scope of the application should be determined solely by the appended claims.

[0136] The application provides a computer readable storage medium having stored thereon computer readable program instructions (i.e., computer programs) for performing the botnet detection method in the above embodiments.

[0137] The computer readable storage medium provided by the application may, for example, be a U disk, but is not limited to an electric, magnetic, optical, electromagnetic, infrared, or semiconductor system, system or device, or any combination of the above. More specific examples of the computer readable storage medium can include, but are not limited to, an electric connection with one or more conductive wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present embodiment, the computer readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system or device. The program code contained on the computer readable storage medium can be transmitted by any suitable medium, including but not limited to an electric wire, an optical cable, an RF (Radio Frequency), etc., or any suitable combination of the above.

[0138] The above computer readable storage medium can be contained in a botnet detection device; or can exist separately without being assembled into a botnet detection device.

[0139] The computer readable storage medium described above carries one or more programs, when the one or more programs are executed by the botnet detection device, the botnet detection device: obtains a plurality of network alarm records of a target network group; constructs a first directed graph according to the plurality of network alarm records; wherein the nodes of the first directed graph are communication objects in the network alarm records, and an edge between the nodes corresponding to any two communication objects is generated when there is at least one network alarm record between the two communication objects; for any edge of the first directed graph, the attack similarity between the out-edge of the target node of the edge and the edge is calculated; the target edge and the nodes associated with the target edge in the first directed graph whose attack similarity is greater than a preset attack similarity are retained, and a second directed graph is obtained; the botnet probability corresponding to each connected subgraph in the second directed graph is calculated, and a botnet detection result is obtained.

[0140] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0141] The flow diagrams and the block diagrams in the drawings are illustrations of architectures, functionalities, and operations of possible implementations of systems, methods, and computer program products according to various embodiments of the present application. In this regard, each block in the flow diagrams or block diagrams can represent a module, a segment, or a portion of code, which comprises one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or the blocks may

[0142] The modules described in the embodiments of the present application can be implemented in the form of software or in the form of hardware. In some cases, the name of the module does not constitute a limitation on the module itself.

[0143] The readable storage medium provided by the present application is a computer readable storage medium, which stores computer readable program instructions (i.e., a computer program) for executing the above-mentioned botnet detection method, and can solve the technical problem of low detection accuracy of the botnet. Compared with the related art, the computer readable storage medium provided by the present application has the same beneficial effects as the botnet detection method provided by the above-mentioned embodiments, and will not be described here.

[0144] The present application also provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the botnet detection method as described above.

[0145] The computer program product provided by the present application can solve the technical problem of low detection accuracy of the botnet. Compared with the related art, the computer program product provided by the present application has the same beneficial effects as the botnet detection method provided by the above-mentioned embodiments, and will not be described here.

[0146] The above only describes some embodiments of the present application, and does not limit the patent scope of the present application. Any equivalent structural transformation, direct / indirect application in other related technical fields based on the technical concept of the present application, and the content of the specification and drawings are included in the patent protection scope of the present application.

Claims

1. A botnet detection method, characterized by, The method comprises: obtaining a plurality of network alarm records of a target network group; constructing a first directed graph according to the plurality of network alarm records; wherein the nodes of the first directed graph are communication objects in the network alarm records, and an edge between two nodes corresponding to any two communication objects is generated when there is at least one network alarm record between the two communication objects; calculating, for any edge of the first directed graph, an attack similarity between the out-edge of the target node of the edge and the edge; retaining the target edges and the nodes associated with the target edges in the first directed graph whose attack similarity is greater than a preset attack similarity, to obtain a second directed graph; calculating a botnet probability corresponding to each connected subgraph in the second directed graph, to obtain a botnet detection result.

2. The method of claim 1, wherein, The step of calculating a botnet probability corresponding to each connected subgraph in the second directed graph, to obtain a botnet detection result, comprises: obtaining a similar attack content of the connected subgraph according to the total number of attack paths in the connected subgraph; obtaining a network group connectivity of the connected subgraph according to the numerical relationship between the total number of nodes in the connected subgraph and the total number of target edges; obtaining a network group attack complexity of the connected subgraph according to the numerical relationship between the number of attack types in the connected subgraph and the total number of target edges; wherein the attack type to which each target edge belongs is obtained according to the alarm type in the corresponding network alarm record; obtaining a network group attack fluctuation degree of the connected subgraph according to the numerical relationship between the number of alarm records in the connected subgraph and the total number of target edges; calculating a botnet probability according to the similar attack content, the network group connectivity, the network group attack complexity, and the network group attack fluctuation degree, to obtain a botnet detection result.

3. The method of claim 2, wherein, The similar attack content is obtained by using Formula One, and Formula One includes: S1=log 10 (x1+1), wherein S1 represents the similar attack content, and x1 represents the total number of attack paths; and / or The network group connectivity is obtained by using Formula Two, and Formula Two includes: wherein S2 represents the network group connectivity, x2 represents the total number of nodes, and x3 represents the total number of target edges; and / or The network group attack complexity is obtained by using Formula Three, and Formula Three comprises: wherein S3 represents the network group attack complexity, and x4 represents the number of attack types; and / or The network group attack fluctuation degree is obtained by using Formula Four, and Formula Four includes: Wherein, S4 represents the network group attack fluctuation degree, and x5 represents the number of alarm records.

4. The method of claim 2, wherein, The step of calculating a botnet probability according to the similar attack content, the network group connectivity, the network group attack complexity, and the network group attack fluctuation degree, to obtain a botnet detection result, comprises: taking the ratio of the number of features greater than a preset threshold to the total number of features in the similar attack content, the network group connectivity, the network group attack complexity, and the network group attack fluctuation degree as the probability of the botnet; if the probability is not less than a preset probability, determining that the botnet detection result of the target network group is a botnet.

5. The method of claim 1, wherein, The step of calculating, for any edge of the first directed graph, an attack similarity between the out-edge of the target node of the edge and the edge, comprises: obtaining all first alarm names corresponding to the edge and all second alarm names corresponding to the out-edge of the target node of the edge according to the plurality of network alarm records; obtaining the attack similarity between the out-edge and the edge according to the similarity between the first alarm names and the second alarm names.

6. The method of claim 5, wherein, The step of obtaining the attack similarity between the out-edge and the edge according to the similarity between the first alarm names and the second alarm names, comprises: all the first alarm names are taken as a first alarm name set, and all the second alarm names are taken as a second alarm name set; a union set of the first alarm name set and the second alarm name set is obtained as a reference name set; a first vector is generated in a space vector corresponding to the reference name set according to whether each element in the reference name set exists in the first alarm name set; a second vector is generated in the space vector corresponding to the reference name set according to whether each element in the reference name set exists in the second alarm name set; a cosine similarity of the first vector and the second vector is calculated, and the cosine similarity is taken as the attack similarity.

7. A botnet detection apparatus characterized by comprising: The apparatus comprises: an acquisition module configured to acquire a plurality of network alarm records of a target network group; a construction module configured to construct a first directed graph according to the plurality of network alarm records, wherein a node of the first directed graph is a communication object in the network alarm record, and an edge between two nodes corresponding to any two communication objects is generated when there is at least one network alarm record between the two communication objects; a first calculation module configured to calculate, for any edge of the first directed graph, an attack similarity between an out-edge of a target node of the edge and the edge; a retention module configured to retain a target edge and a node associated with the target edge in the first directed graph, wherein the attack similarity of the target edge is greater than a preset attack similarity, to obtain a second directed graph; a second calculation module configured to calculate a botnet probability corresponding to each connected subgraph in the second directed graph respectively to obtain a botnet detection result.

8. A botnet detection device, characterized by, The device comprises a memory, a processor, and a computer program stored on the memory and executable on the processor, and the computer program is configured to implement the steps of the botnet detection method according to any one of claims 1 to 6.

9. A storage medium, characterized by The storage medium is a computer-readable storage medium, and the storage medium stores a computer program, and the computer program is executed by the processor to implement the steps of the botnet detection method according to any one of claims 1 to 6.

10. A computer program product, characterised in that, The computer program product comprises a computer program, and the computer program is executed by the processor to implement the steps of the botnet detection method according to any one of claims 1 to 6.

Images