Network anomaly monitoring method, device and electronic equipment

Abstract

The embodiment of the present application provides a network anomaly monitoring method, device and electronic device, which includes: matching the time series characteristics of the first flow to be tested with the sample time characteristics; the first flow to be tested is the flow generated by the tested IP communicating with the malicious port; the sample time characteristics are the characteristics extracted from the first sample flow generated during the penetration test of the malicious sample IP; matching the spatial sequence characteristics of the second flow to be tested with the sample space characteristics; the second flow to be tested is the flow generated by the communication between the tested IP and multiple suspicious malicious devices; the sample space characteristics are the characteristics extracted from the second sample flow corresponding to the sample malicious device, and the sample malicious device is the one-hop neighbor device corresponding to the victim sample of the malicious sample IP; determining whether the tested IP has an anomaly based on the matching result. By combining the strong characteristics of temporal logical correlation and spatial logical correlation for feature matching, the ability to identify complex attack patterns is enhanced.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network security technology, and in particular to a network anomaly monitoring method, device, and electronic device. Background Art

[0002] Cloud service providers generate huge amounts of network traffic. To ensure the continuity and security of network services, network traffic needs to be monitored, such as to identify network attacks.

[0003] In related technologies, network attack behavior monitoring is performed based on netflow (a data exchange method) features extracted through sample analysis.

[0004] However, Netflow does not carry the payload of its communication, and the extracted features are weak features. The ability to identify complex attack patterns is poor, and the accuracy and recall rate of feature matching are low, making it difficult to provide comprehensive security protection for cloud service providers. Summary of the Invention

[0005] The embodiments of the present application provide a network anomaly monitoring method, apparatus, and electronic device to improve the accuracy and recall rate of feature matching in network anomaly monitoring.

[0006] In a first aspect, an embodiment of the present application provides a first network anomaly monitoring method, the method comprising:

[0007] Matching the time series characteristics of the first flow to be tested with the sample time characteristics; wherein the first flow to be tested is the flow generated by the protocol of the interconnected network to be tested (Internet Protocol, IP) in the malicious port communication; the sample time characteristics are the characteristics extracted from the first sample flow generated during the malicious sample IP penetration test; and

[0008] Matching the spatial sequence features of the second traffic to be tested with the sample spatial features; wherein the second traffic to be tested is the traffic generated by the communication between the IP to be tested and multiple suspected malicious devices; the sample spatial features are features extracted from the second sample traffic corresponding to the sample malicious device, and the sample malicious device is a one-hop neighbor device corresponding to the victim sample of the malicious sample IP;

[0009] Determine whether the IP to be tested is abnormal based on the matching result.

[0010] In the above scheme, since the penetration test process will enter different stages over time and will generate logically related traffic over time, multiple related weak features are extracted from the time dimension, and the obtained time series features are strong features (temporal logical correlation); since the network behaviors generated by different devices in the same malicious organization penetration scenario are similar, multiple device-related weak features are extracted from the spatial dimension, and the obtained spatial sequence features are strong features (spatial logical correlation); combining these two aspects for feature matching solves the limitations of feature extraction based on single device and single sample, enhances the ability to identify complex attack patterns, and improves the recognition accuracy and recall rate of abnormal IPs, thereby providing comprehensive security protection for cloud service providers.

[0011] In some optional implementations, determining whether the IP to be tested is abnormal based on the matching result includes:

[0012] If the similarity between the time series feature and the sample time feature reaches a first similarity threshold, and the similarity between the space series feature and the sample space feature reaches a second similarity threshold, the IP to be tested is determined to be an abnormal attack IP.

[0013] In some optional implementations, before matching the time series feature of the first flow to be measured with the sample time feature, the method further includes:

[0014] Perform asset mapping of network IPs to determine whitelisted IPs within the network IPs;

[0015] Performing availability testing on the whitelisted IPs to determine stable IPs in the whitelisted IPs;

[0016] The other IPs among the IPs to be tested, except the stable IP, are determined as the IPs to be tested.

[0017] In some optional implementations, performing availability detection on the whitelist IPs to determine stable IPs in the whitelist IPs includes:

[0018] For any whitelist IP, if the whitelist IP passes the communication diversity test, the device interactivity test, the communication integrity test, and the communication compliance test, the whitelist IP is determined as a stable IP.

[0019] In some optional implementations, device interactivity detection is performed in the following manner:

[0020] Determine the ratio between question data and answer data of the whitelisted IP on the service port during the current monitoring period;

[0021] If the deviation between the ratio in the current monitoring period and the historical question-answer ratio is less than the first deviation, it is determined that the whitelist IP has passed the interactivity test; wherein, the historical question-answer ratio is the ratio between the question data and the answer data of the whitelist IP on the service port in the historical period.

[0022] In some optional implementations, communication compliance detection is performed in the following manner:

[0023] Determine the complexity of the answer data packets to the target questions on the service port of the whitelisted IP in the current monitoring period;

[0024] If the deviation between the complexity of the current monitoring period and the historical complexity is less than the second deviation, it is determined that the whitelist IP has passed the communication compliance test; wherein, the historical complexity is the complexity corresponding to the answer data packet of the whitelist IP to the target question on the service port during the historical period.

[0025] Some optional implementations further include:

[0026] For any IP to be tested, if the IP to be tested fails the uncommon port test, the autocorrelation test, the invalidity test, and the convergence test, the IP to be tested is determined as the first scanning IP; and

[0027] Based on the five-tuple rule, a second scanning IP among the IPs to be tested is determined.

[0028] In some optional implementations, autocorrelation detection is performed in the following manner:

[0029] Use multiple step sizes to segment the traffic of the IP to be tested, and obtain segmentation data corresponding to each step size;

[0030] If the autocorrelation values ​​of the segmented data corresponding to each step size do not reach the preset threshold, it is determined that the IP to be tested passes the autocorrelation test.

[0031] In a second aspect, an embodiment of the present application provides a first network anomaly monitoring device, the device comprising:

[0032] A feature matching module is used to match the time series feature of the first flow to be tested with the sample time feature; wherein the first flow to be tested is the flow generated by the tested IP communicating on the malicious port; the sample time feature is a feature extracted from the first sample flow generated during the malicious sample IP penetration test; and

[0033] The feature matching module is further configured to match the spatial sequence features of the second flow to be tested with the sample spatial features; wherein the second flow to be tested is the flow generated by the communication between the IP to be tested and multiple suspected malicious devices; the sample spatial features are features extracted from the second sample flow corresponding to the sample malicious device, and the sample malicious device is a one-hop neighbor device corresponding to the victim sample of the malicious sample IP;

[0034] The feature matching module is further used to determine whether the IP to be tested has an abnormality based on the matching result.

[0035] In some optional implementations, the feature matching module is specifically configured to:

[0036] If the similarity between the time series feature and the sample time feature reaches a first similarity threshold, and the similarity between the space series feature and the sample space feature reaches a second similarity threshold, the IP to be tested is determined to be an abnormal attack IP.

[0037] Some optional implementations further include a service discovery module for:

[0038] Before the feature matching module matches the time series feature of the first flow to be measured with the sample time feature, performing asset mapping on the network IP to determine the whitelist IP in the network IP;

[0039] Performing availability testing on the whitelisted IPs to determine stable IPs in the whitelisted IPs;

[0040] The other IPs among the IPs to be tested, except the stable IP, are determined as the IPs to be tested.

[0041] In some optional implementations, the service discovery module is specifically configured to:

[0042] For any whitelist IP, if the whitelist IP passes the communication diversity test, the device interactivity test, the communication integrity test, and the communication compliance test, the whitelist IP is determined as a stable IP.

[0043] In some optional implementations, the service discovery module performs device interactivity detection in the following manner:

[0044] Determine the ratio between question data and answer data of the whitelisted IP on the service port during the current monitoring period;

[0045] If the deviation between the ratio in the current monitoring period and the historical question-answer ratio is less than the first deviation, it is determined that the whitelist IP has passed the interactivity test; wherein, the historical question-answer ratio is the ratio between the question data and the answer data of the whitelist IP on the service port in the historical period.

[0046] In some optional implementations, the service discovery module performs communication compliance detection in the following manner:

[0047] Determine the complexity of the answer data packets to the target questions on the service port of the whitelisted IP in the current monitoring period;

[0048] If the deviation between the complexity of the current monitoring period and the historical complexity is less than the second deviation, it is determined that the whitelist IP has passed the communication compliance test; wherein, the historical complexity is the complexity corresponding to the answer data packet of the whitelist IP to the target question on the service port during the historical period.

[0049] Some optional implementations further include a scanning discovery module for:

[0050] For any IP to be tested, if the IP to be tested fails the uncommon port test, the autocorrelation test, the invalidity test, and the convergence test, the IP to be tested is determined as the first scanning IP; and

[0051] Based on the five-tuple rule, a second scanning IP among the IPs to be tested is determined.

[0052] In some optional implementations, the scanning discovery module performs autocorrelation detection in the following manner:

[0053] Use multiple step sizes to segment the traffic of the IP to be tested, and obtain segmentation data corresponding to each step size;

[0054] If the autocorrelation values ​​of the segmented data corresponding to each step size do not reach the preset threshold, it is determined that the IP to be tested passes the autocorrelation test.

[0055] In a third aspect, an embodiment of the present application provides an electronic device comprising at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes any network anomaly monitoring method described in the first aspect.

[0056] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium storing a computer program executable by a processor. When the program runs on the processor, the processor executes the network anomaly monitoring method described in any one of the first aspects above. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0058] Figure 1 A flowchart of a first network anomaly monitoring method provided in an embodiment of the present application;

[0059] Figure 2 A schematic diagram of sample time feature extraction provided in an embodiment of the present application;

[0060] Figure 3 Schematic diagram of sample space feature extraction provided in an embodiment of the present application;

[0061] Figure 4 A flowchart of a second network anomaly monitoring method provided in an embodiment of the present application;

[0062] Figure 5 A schematic diagram of device interactivity detection provided in an embodiment of the present application;

[0063] Figure 6 A schematic diagram of communication compliance detection provided in an embodiment of the present application;

[0064] Figure 7 A flowchart of a third network anomaly monitoring method provided in an embodiment of the present application;

[0065] Figure 8 A schematic diagram of autocorrelation detection provided in an embodiment of the present application;

[0066] Figure 9 A schematic diagram of the structure of a network anomaly monitoring device provided in an embodiment of the present application;

[0067] Figure 10 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0068] To make the objectives, technical solutions, and advantages of this application more clear, this application will be further described in detail below with reference to the accompanying drawings. It is obvious that the embodiments described are only part of the embodiments of this application, not all of them. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0069] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature specified as "first" or "second" may explicitly or implicitly include one or more of such features. Throughout this application, unless otherwise specified, "plurality" means two or more.

[0070] In the description of this application, it should be noted that, unless otherwise specified or limited, the term "connection" should be understood in a broad sense. For example, it can mean direct connection, indirect connection through an intermediate medium, or internal communication between two devices. Those skilled in the art will understand the specific meaning of the above terms in this application based on specific circumstances.

[0071] Cloud service providers generate a huge amount of network traffic. In order to ensure the continuity and security of network services, it is necessary to monitor network traffic, such as identifying network attacks.

[0072] In related technologies, network attack behavior monitoring is performed based on netflow features extracted through sample analysis.

[0073] However, Netflow does not carry the payload of its communication, and the extracted features are weak features. They have poor recognition capabilities for complex attack patterns, such as distributed penetration attacks and advanced persistent threats (APTs). The accuracy and recall rates of feature matching are low, making it difficult to provide comprehensive security protection for cloud service providers.

[0074] In view of this, an embodiment of the present application proposes a network anomaly monitoring method, device and electronic device, the method including: matching the time series characteristics of the first flow to be tested with the sample time characteristics; wherein, the first flow to be tested is the flow generated by the IP to be tested communicating with the malicious port; the sample time characteristics are the characteristics extracted from the first sample flow generated during the malicious sample IP penetration test; and, matching the spatial sequence characteristics of the second flow to be tested with the sample space characteristics; wherein, the second flow to be tested is the flow generated by the communication between the IP to be tested and multiple suspicious malicious devices; the sample space characteristics are the characteristics extracted from the second sample flow corresponding to the sample malicious device, and the sample malicious device is the one-hop neighbor device corresponding to the victim sample of the malicious sample IP; determining whether the IP to be tested has an anomaly based on the matching result.

[0075] In the above scheme, because the penetration testing process enters different stages over time and generates logically related traffic over time, multiple related weak features are extracted from the time dimension, resulting in strong time series features (temporal logical correlation). Because the network behavior generated by different devices in the same malicious organization penetration scenario is similar, multiple device-related weak features are extracted from the spatial dimension, resulting in strong spatial series features (spatial logical correlation). Combining these two aspects for feature matching overcomes the limitations of feature extraction based on single devices and single samples, enhances the ability to identify complex attack patterns, and improves the accuracy and recall rate of identifying abnormal IP addresses, thereby providing comprehensive security protection for cloud service providers. It can be widely used in key business scenarios such as threat intelligence production, damaged asset forensics, and attack asset and organization monitoring, effectively improving the intelligence level of network security protection, achieving a left shift in security protection, and enhancing the security monitoring and protection capabilities of critical infrastructure.

[0076] The following will be combined with the accompanying drawings and specific embodiments to explain in detail the technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

[0077] Figure 1 The flowchart of the first network anomaly monitoring method provided in the embodiment of the present application is as follows: Figure 1 As shown, the following steps are included:

[0078] Step S101: matching the time series characteristics of the first flow to be measured with the sample time characteristics; and matching the space series characteristics of the second flow to be measured with the sample space characteristics.

[0079] The first flow to be tested is the flow generated by the tested IP communicating on the malicious port;

[0080] The sample time feature is a feature extracted from the first sample traffic generated during the malicious sample IP penetration test;

[0081] The second traffic to be tested is the traffic generated by the communication between the IP to be tested and multiple suspicious malicious devices;

[0082] The sample space feature is a feature extracted from the second sample traffic corresponding to the sample malicious device, and the sample malicious device is a one-hop neighbor device corresponding to the victim sample of the malicious sample IP.

[0083] As mentioned above, NetFlow does not carry the payload of its communication, and the extracted features are weak features. The recognition accuracy based on weak features is low. If multiple weak features with logical correlation are combined into a strong feature, the recognition accuracy will be improved.

[0084] During implementation, since the penetration test process will enter different stages over time and will generate logically related traffic over time, multiple related weak features are extracted from the time dimension, and the obtained time series features are strong features (time logical correlation).

[0085] See Figure 2 As shown in the figure, during the penetration test process, there will be stages such as initial access, first activation of malicious samples, and exfiltration behavior. Different stages will generate traffic associated with the stage, and the first sample traffic (such as Figure 2 Therefore, for malicious sample IP, it is necessary to extract features from the traffic generated during the penetration test to obtain sample time features;

[0086] Similarly, if the device is attacked during use, it will also produce characteristics of different stages similar to the above-mentioned penetration test; based on this, the traffic generated by the tested IP communicating on the malicious port is extracted to obtain time series characteristics, and the time series characteristics of the first tested traffic are matched with the sample time characteristics.

[0087] In practice, because different devices in the same malicious group's infiltration scenario exhibit similar network behavior, the control server always deploys the same control service to manage the controlled machines infected with the same malware. Although malicious groups may use different control servers for concealment, as long as the deployed services are the same, their behavior should be consistent. Therefore, we extract weak features related to multiple devices from the spatial dimension, and the resulting spatial sequence features are strong features (spatial logical correlation).

[0088] See Figure 3 As shown, the victim sample communicates on the malicious port. In order to implement the control service, it needs to interact with neighbor device 1, neighbor device 2, ..., neighbor device n (one-hop neighbor device), generating the second sample traffic. The second sample traffic is Fourier transformed to obtain the sample space characteristics;

[0089] Similarly, during the use of the device, if it is attacked, it will also interact with malicious devices with the same or similar functions. Based on this, feature extraction is performed on the traffic generated by the communication between the IP to be tested and multiple suspicious malicious devices to obtain spatial sequence features, which are then matched with the sample spatial features.

[0090] Step S102: Determine whether the IP to be tested has any abnormality based on the matching result.

[0091] Since both time series features and spatial sequence features are strong features, combining these two aspects for feature matching enhances the ability to identify complex attack patterns.

[0092] In the above scheme, since the penetration test process will enter different stages over time and will generate logically related traffic over time, multiple related weak features are extracted from the time dimension, and the obtained time series features are strong features (temporal logical correlation); since the network behaviors generated by different devices in the same malicious organization penetration scenario are similar, multiple device-related weak features are extracted from the spatial dimension, and the obtained spatial sequence features are strong features (spatial logical correlation); combining these two aspects for feature matching solves the limitations of feature extraction based on single device and single sample, enhances the ability to identify complex attack patterns, and improves the recognition accuracy and recall rate of abnormal IPs, thereby providing comprehensive security protection for cloud service providers.

[0093] In some optional implementations, the above step S102 may be implemented by, but not limited to, the following methods:

[0094] If the similarity between the time series feature and the sample time feature reaches a first similarity threshold, and the similarity between the space series feature and the sample space feature reaches a second similarity threshold, the IP to be tested is determined to be an abnormal attack IP.

[0095] As mentioned above, if the device is attacked during use, it will also produce characteristics of different stages similar to those of penetration testing; if the device is attacked during use, it will also interact with malicious devices with the same or similar functions.

[0096] Based on this, by determining the similarity between the time series features and the sample time features, the similarity characterizes the abnormality degree of the IP to be tested from the time dimension; by determining the similarity between the spatial sequence features and the sample space features, the similarity characterizes the abnormality degree of the IP to be tested from the spatial dimension; if both similarities are high, then the IP to be tested is likely to have undergone an abnormal attack.

[0097] Figure 4 A flow chart of a second network anomaly monitoring method provided in an embodiment of the present application is shown as follows: Figure 4 As shown, the following steps are included:

[0098] Step S401: perform asset mapping on the network IPs to determine the whitelist IPs in the network IPs.

[0099] In order to improve the efficiency of network anomaly detection and make monitoring more targeted, it is necessary to filter out normally used devices before monitoring, and produce whitelist IPs by means of asset mapping (such as white domain name matching, port scanning, certificate identification, web content identification, etc.).

[0100] Step S402: performing availability detection on the whitelist IPs to determine stable IPs in the whitelist IPs.

[0101] During implementation, the above whitelisted IP addresses may not be used normally, such as during the debugging phase or when a failure occurs. In this case, it is necessary to monitor the whitelisted IP addresses.

[0102] Based on this, this embodiment needs to further perform availability detection on the whitelist IPs to determine stable IPs in the whitelist IPs.

[0103] Step S403: Determine the other IPs among the IPs to be tested except the stable IP as the IPs to be tested.

[0104] During implementation, only the whitelisted IPs in normal use do not need to be monitored, and all other IPs must be monitored; based on this, the IPs other than the stable IPs among the IPs to be tested are identified as the IPs to be tested.

[0105] Step S404: matching the time series characteristics of the first flow to be measured with the sample time characteristics; and matching the space series characteristics of the second flow to be measured with the sample space characteristics.

[0106] Step S405: Determine whether the IP to be tested has any abnormality based on the matching result.

[0107] The specific implementation of steps S404 to S405 can refer to other embodiments and will not be repeated here.

[0108] The above solution, after determining the whitelist IP, performs availability detection on the whitelist IP, filters out IPs that are not normally used, and forms a more accurate and effective whitelist.

[0109] In some optional implementations, the above step S302 may be implemented by, but not limited to, the following methods:

[0110] For any whitelist IP, if the whitelist IP passes the communication diversity test, the device interactivity test, the communication integrity test, and the communication compliance test, the whitelist IP is determined as a stable IP.

[0111] When the service is in a stable state, it is usually not accessed by only a few fixed IP addresses. Based on this, diversity monitoring is required, such as confirming that the number of accessed IP addresses is greater than the preset number;

[0112] When the service is in a stable state, the question-and-answer communication interaction on its service port should also remain stable. Based on this, it is necessary to perform interactivity judgment and coarse-grained filtering based on all input and output data.

[0113] When the service is in a stable state, the traffic needs to be complete. Based on this, the integrity is judged based on the flag and the communication packet size;

[0114] When the service is in a stable state, the complexity of the answer packets to the same question is similar. Based on this, communication compliance detection is required.

[0115] In some optional implementations, device interactivity detection is performed in the following manner:

[0116] Determine the ratio between question data and answer data of the whitelisted IP on the service port during the current monitoring period;

[0117] If the deviation between the ratio in the current monitoring period and the historical question-answer ratio is less than the first deviation, it is determined that the whitelist IP has passed the interactivity test; wherein, the historical question-answer ratio is the ratio between the question data and the answer data of the whitelist IP on the service port in the historical period.

[0118] During implementation, when the service is in a stable state, the question-answer communication interaction on its service port should remain stable. Over a sufficiently long period of time, if the service itself does not generate updates, the ratio of its question data to its answer data should remain consistent.

[0119] Based on this, this embodiment compares the question-answer ratio of the current monitoring period with the question-answer ratio of the historical period. If the deviation is small, it is considered that the interactivity is stable and the service is stable.

[0120] See Figure 5 As shown, each natural day can be regarded as a cycle, and the deviation between the question-answer ratio of cycle t and cycle t-1 can be determined.

[0121] In some optional implementations, communication compliance detection is performed in the following manner:

[0122] Determine the complexity of the answer data packets to the target questions on the service port of the whitelisted IP in the current monitoring period;

[0123] If the deviation between the complexity of the current monitoring period and the historical complexity is less than the second deviation, it is determined that the whitelist IP has passed the communication compliance test; wherein, the historical complexity is the complexity corresponding to the answer data packet of the whitelist IP to the target question on the service port during the historical period.

[0124] If the service itself does not generate updates, the size and complexity (information entropy) of the answer packet for the same question on its service port should remain consistent at different time scales;

[0125] Based on this, this embodiment compares the complexity of the answer package for the same question in the current monitoring period with that in the historical period. If the deviation is small, it is considered that the communication compliance is met and the service is stable.

[0126] See Figure 6 As shown, each natural day can be regarded as a cycle, and the complexity of the answer data for the target question data in cycle t and cycle t-1 can be determined respectively, and the deviation between the two complexity levels can be further determined.

[0127] Figure 7 A flow chart of a third network anomaly monitoring method provided in an embodiment of the present application is shown as follows: Figure 7 As shown, the following steps are included:

[0128] Step S701: perform asset mapping on the network IPs to determine the whitelist IPs in the network IPs.

[0129] Step S702: Perform availability detection on the whitelist IPs to determine stable IPs in the whitelist IPs.

[0130] Step S703: Determine the other IPs among the IPs to be tested except the stable IP as the IPs to be tested.

[0131] Step S704: Matching the time series characteristics of the first flow to be measured with the sample time characteristics; and matching the space series characteristics of the second flow to be measured with the sample space characteristics.

[0132] Step S705: Determine whether the IP to be tested has any abnormality based on the matching result.

[0133] The specific implementation of steps S701 to S705 can refer to other embodiments and will not be repeated here.

[0134] Step S706: For any IP to be tested, if the IP to be tested fails the uncommon port detection, autocorrelation detection, invalidity detection and convergence detection, the IP to be tested is determined as the first scanning IP; and based on the five-tuple rule, the second scanning IP in the IP to be tested is determined.

[0135] In addition to abnormal attack behaviors, abnormal scanning behaviors may also occur on the network. Based on this, this embodiment simultaneously performs feature matching and scanning behavior discovery to prevent subsequent possible network penetration by detecting abnormal or malicious scanning behaviors.

[0136] During implementation, based on the quintuple and utilizing the link relationship to generate scanning discovery rules, only simple scanning behaviors can be identified. The ability to identify highly concealed and highly random scanning behaviors is relatively poor, such as the inability to cover scanning behaviors with random IPs and random ports.

[0137] Based on this, this embodiment adopts two methods to monitor the scanning behavior.

[0138] For example, invalid data streams are identified using information such as Transmission Control Protocol (TCP) communication markers. If a high proportion of unused ports, self-correlation, a high proportion of invalid communications, and convergent communication content are included, it is considered to be the first scanning IP.

[0139] If there are a large number of different IPs for the same remote port, or a large number of different ports for the same remote IP, it is considered to be the second scanning IP.

[0140] This embodiment does not specifically limit the order of the above steps S704 to S705 and step S706.

[0141] The above scheme strengthens the recognition of highly concealed and highly random scanning behaviors, such as random out-of-order scanning, by considering the screening of unused ports, identification of autocorrelated communications, identification of invalid communications, and identification of communication convergence during the scanning process, thereby improving the recall rate of scanning behaviors.

[0142] In some optional implementations, autocorrelation detection is performed in the following manner:

[0143] Use multiple step sizes to segment the traffic of the IP to be tested, and obtain segmentation data corresponding to each step size;

[0144] If the autocorrelation values ​​of the segmented data corresponding to each step size do not reach the preset threshold, it is determined that the IP to be tested passes the autocorrelation test.

[0145] In practice, highly concealed penetration tests are typically conducted using random ports, random IP addresses, random data, and random event intervals. However, this process is not completely random. Typically, the infiltrator will randomize data based on a fixed value and a fixed interval, resulting in autocorrelated data.

[0146] Based on this, this embodiment sets multiple different step sizes, each used to segment and group the same traffic segment. At the same step size, the information entropy and Fourier frequency domain maximum of the traffic data included in each step are calculated. Based on this data, the autocorrelation value is calculated using the autocorrelation function. If the autocorrelation value reaches a threshold at a certain step size, the communication of this IP is considered to have autocorrelation.

[0147] See Figure 8 As shown, for traffic of a sufficiently long time, the traffic is cut and grouped with the first step length and the second step length, and the autocorrelation value corresponding to the first step length and the autocorrelation value corresponding to the second step length are calculated respectively. If any autocorrelation value reaches the preset threshold, the IP to be tested fails the autocorrelation test.

[0148] like Figure 9 As shown, an embodiment of the present application provides a network anomaly monitoring device 900, which includes:

[0149] A feature matching module 901 is configured to match the time series features of the first flow to be tested with the sample time features; wherein the first flow to be tested is the flow generated by the tested IP communicating on the malicious port; the sample time features are features extracted from the first sample flow generated during the malicious sample IP penetration test; and

[0150] The feature matching module 901 is further configured to match the spatial sequence features of the second flow to be tested with the sample spatial features; wherein the second flow to be tested is the flow generated by the communication between the IP to be tested and multiple suspected malicious devices; the sample spatial features are features extracted from the second sample flow corresponding to the sample malicious device, and the sample malicious device is a one-hop neighbor device corresponding to the victim sample of the malicious sample IP;

[0151] The feature matching module 901 is further configured to determine whether the IP to be tested has an abnormality based on the matching result.

[0152] In some optional implementations, the feature matching module 901 is specifically configured to:

[0153] If the similarity between the time series feature and the sample time feature reaches a first similarity threshold, and the similarity between the space series feature and the sample space feature reaches a second similarity threshold, the IP to be tested is determined to be an abnormal attack IP.

[0154] Some optional implementations further include a service discovery module 902 for:

[0155] Before the feature matching module matches the time series feature of the first flow to be measured with the sample time feature, performing asset mapping on the network IP to determine the whitelist IP in the network IP;

[0156] Performing availability testing on the whitelisted IPs to determine stable IPs in the whitelisted IPs;

[0157] The other IPs among the IPs to be tested, except the stable IP, are determined as the IPs to be tested.

[0158] In some optional implementations, the service discovery module 902 is specifically configured to:

[0159] For any whitelist IP, if the whitelist IP passes the communication diversity test, the device interactivity test, the communication integrity test, and the communication compliance test, the whitelist IP is determined as a stable IP.

[0160] In some optional implementations, the service discovery module 902 performs device interactivity detection in the following manner:

[0161] Determine the ratio between question data and answer data of the whitelisted IP on the service port during the current monitoring period;

[0162] If the deviation between the ratio in the current monitoring period and the historical question-answer ratio is less than the first deviation, it is determined that the whitelist IP has passed the interactivity test; wherein, the historical question-answer ratio is the ratio between the question data and the answer data of the whitelist IP on the service port in the historical period.

[0163] In some optional implementations, the service discovery module 902 performs communication compliance detection in the following manner:

[0164] Determine the complexity of the answer data packets to the target questions on the service port of the whitelisted IP in the current monitoring period;

[0165] If the deviation between the complexity of the current monitoring period and the historical complexity is less than the second deviation, it is determined that the whitelist IP has passed the communication compliance test; wherein, the historical complexity is the complexity corresponding to the answer data packet of the whitelist IP to the target question on the service port during the historical period.

[0166] Some optional implementations further include a scanning discovery module 903, which is used to:

[0167] For any IP to be tested, if the IP to be tested fails the uncommon port test, the autocorrelation test, the invalidity test, and the convergence test, the IP to be tested is determined as the first scanning IP; and

[0168] Based on the five-tuple rule, a second scanning IP among the IPs to be tested is determined.

[0169] In some optional implementations, the scanning discovery module 903 performs autocorrelation detection in the following manner:

[0170] Use multiple step sizes to segment the traffic of the IP to be tested, and obtain segmentation data corresponding to each step size;

[0171] If the autocorrelation values ​​of the segmented data corresponding to each step size do not reach the preset threshold, it is determined that the IP to be tested passes the autocorrelation test.

[0172] Since the device is the device in the method in the embodiment of the present application, and the principle of solving the problem by the device is similar to that of the method, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0173] Based on the same technical concept, the embodiment of the present application further provides an electronic device 1000, such as Figure 10 As shown, it includes at least one processor 1001 and a memory 1002 connected to the at least one processor. The specific connection medium between the processor 1001 and the memory 1002 is not limited in the embodiment of the present application. Figure 10 For example, the processor 1001 and the memory 1002 are connected via a bus 1003. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 10 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0174] Among them, the processor 1001 is the control center of the electronic device. It can use various interfaces and lines to connect various parts of the electronic device, and realize data processing by running or executing instructions stored in the memory 1002 and calling data stored in the memory 1002. Optionally, the processor 1001 may include one or more processing units. The processor 1001 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, etc., and the modem processor mainly processes the issuance of instructions. It is understandable that the above-mentioned modem processor may not be integrated into the processor 1001. In some embodiments, the processor 1001 and the memory 1002 may be implemented on the same chip. In some embodiments, they may also be implemented separately on independent chips.

[0175] The processor 1001 can be a general-purpose processor, such as a CPU, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiment of the network anomaly monitoring method can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor.

[0176] Memory 1002 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. Memory 1002 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. Memory 1002 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 1002 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0177] In an embodiment of the present application, the memory 1002 stores a computer program. When the program is executed by the processor 1001, the processor 1001 executes:

[0178] Matching the time series characteristics of the first flow to be tested with the sample time characteristics; wherein the first flow to be tested is the flow generated by the tested IP communicating with the malicious port; the sample time characteristics are the characteristics extracted from the first sample flow generated during the malicious sample IP penetration test; and

[0179] Matching the spatial sequence features of the second traffic to be tested with the sample spatial features; wherein the second traffic to be tested is the traffic generated by the communication between the IP to be tested and multiple suspected malicious devices; the sample spatial features are features extracted from the second sample traffic corresponding to the sample malicious device, and the sample malicious device is a one-hop neighbor device corresponding to the victim sample of the malicious sample IP;

[0180] Determine whether the IP to be tested is abnormal based on the matching result.

[0181] In some optional implementations, the processor 1001 specifically performs:

[0182] If the similarity between the time series feature and the sample time feature reaches a first similarity threshold, and the similarity between the space series feature and the sample space feature reaches a second similarity threshold, the IP to be tested is determined to be an abnormal attack IP.

[0183] In some optional implementations, before matching the time series feature of the first flow to be measured with the sample time feature, the processor 1001 further executes:

[0184] Perform asset mapping of network IPs to determine whitelisted IPs within the network IPs;

[0185] Performing availability testing on the whitelisted IPs to determine stable IPs in the whitelisted IPs;

[0186] The other IPs among the IPs to be tested, except the stable IP, are determined as the IPs to be tested.

[0187] In some optional implementations, the processor 1001 specifically performs:

[0188] For any whitelist IP, if the whitelist IP passes the communication diversity test, the device interactivity test, the communication integrity test, and the communication compliance test, the whitelist IP is determined as a stable IP.

[0189] In some optional implementations, the processor 1001 performs device interactivity detection in the following manner:

[0190] Determine the ratio between question data and answer data of the whitelisted IP on the service port during the current monitoring period;

[0191] If the deviation between the ratio in the current monitoring period and the historical question-answer ratio is less than the first deviation, it is determined that the whitelist IP has passed the interactivity test; wherein, the historical question-answer ratio is the ratio between the question data and the answer data of the whitelist IP on the service port in the historical period.

[0192] In some optional implementations, the processor 1001 performs communication compliance detection in the following manner:

[0193] Determine the complexity of the answer data packets to the target questions on the service port of the whitelisted IP in the current monitoring period;

[0194] If the deviation between the complexity of the current monitoring period and the historical complexity is less than the second deviation, it is determined that the whitelist IP has passed the communication compliance test; wherein, the historical complexity is the complexity corresponding to the answer data packet of the whitelist IP to the target question on the service port during the historical period.

[0195] In some optional implementations, the processor 1001 further executes:

[0196] For any IP to be tested, if the IP to be tested fails the uncommon port test, the autocorrelation test, the invalidity test, and the convergence test, the IP to be tested is determined as the first scanning IP; and

[0197] Based on the five-tuple rule, a second scanning IP among the IPs to be tested is determined.

[0198] In some optional implementations, the processor 1001 performs autocorrelation detection in the following manner:

[0199] Use multiple step sizes to segment the traffic of the IP to be tested, and obtain segmentation data corresponding to each step size;

[0200] If the autocorrelation values ​​of the segmented data corresponding to each step size do not reach the preset threshold, it is determined that the IP to be tested passes the autocorrelation test.

[0201] Since the electronic device is the electronic device in the method in the embodiment of the present application, and the principle of solving the problem by the electronic device is similar to that of the method, the implementation of the electronic device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0202] Based on the same technical concept, an embodiment of the present application also provides a computer-readable storage medium, which stores a computer program executable by a processor. When the program runs on the processor, the processor executes the steps of the above-mentioned network anomaly monitoring method.

[0203] In some optional embodiments, various aspects of the network anomaly monitoring method provided by the present application can also be implemented in the form of a program product, which contains computer-executable instructions. When the program product is run on a computer device, the computer-executable instructions are used to enable the computer device to execute the steps of the network anomaly monitoring method according to various exemplary embodiments of the present application described above in this specification.

[0204] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0205] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0206] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0207] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0208] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0209] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A network anomaly monitoring method, characterized in that: The method includes: Matching the time series characteristics of the first flow to be tested with the sample time characteristics; wherein the first flow to be tested is the flow generated by the tested IP communicating with the malicious port; the sample time characteristics are the characteristics extracted from the first sample flow generated during the malicious sample IP penetration test; and Matching the spatial sequence features of the second traffic to be tested with the sample spatial features; wherein the second traffic to be tested is the traffic generated by the communication between the IP to be tested and multiple suspected malicious devices; the sample spatial features are features extracted from the second sample traffic corresponding to the sample malicious device, and the sample malicious device is a one-hop neighbor device corresponding to the victim sample of the malicious sample IP; Determine whether the IP to be tested is abnormal based on the matching result.

2. The method according to claim 1, wherein Determine whether the IP to be tested is abnormal based on the matching result, including: If the similarity between the time series feature and the sample time feature reaches a first similarity threshold, and the similarity between the space series feature and the sample space feature reaches a second similarity threshold, the IP to be tested is determined to be an abnormal attack IP.

3. The method according to claim 1, wherein Before matching the time series feature of the first flow to be measured with the sample time feature, the following steps are also included: Perform asset mapping of network IPs and determine whitelist IPs in the network IPs; Performing availability testing on the whitelisted IPs to determine stable IPs in the whitelisted IPs; The other IPs among the IPs to be tested, except the stable IP, are determined as the IPs to be tested.

4. The method according to claim 3, wherein Performing availability testing on the whitelisted IPs to determine stable IPs in the whitelisted IPs includes: For any whitelist IP, if the whitelist IP passes the communication diversity test, the device interactivity test, the communication integrity test, and the communication compliance test, the whitelist IP is determined as a stable IP.

5. The method according to claim 4, wherein Device interactivity testing is performed in the following ways: Determine the ratio between question data and answer data of the whitelisted IP on the service port during the current monitoring period; If the deviation between the ratio in the current monitoring period and the historical question-answer ratio is less than the first deviation, it is determined that the whitelist IP has passed the interactivity test; wherein, the historical question-answer ratio is the ratio between the question data and the answer data of the whitelist IP on the service port in the historical period.

6. The method according to claim 4, wherein Communication compliance testing is performed through the following methods: Determine the complexity of the answer data packets to the target questions on the service port of the whitelisted IP in the current monitoring period; If the deviation between the complexity of the current monitoring period and the historical complexity is less than the second deviation, it is determined that the whitelist IP has passed the communication compliance test; wherein, the historical complexity is the complexity corresponding to the answer data packet of the whitelist IP to the target question on the service port during the historical period.

7. The method according to any one of claims 1 to 6, wherein: Also includes: For any IP to be tested, if the IP to be tested fails the uncommon port test, the autocorrelation test, the invalidity test, and the convergence test, the IP to be tested is determined as the first scanning IP; and Based on the five-tuple rule, a second scanning IP among the IPs to be tested is determined.

8. The method according to claim 7, wherein Autocorrelation is tested in the following way: Use multiple step sizes to segment the traffic of the IP to be tested, and obtain segmentation data corresponding to each step size; If the autocorrelation values ​​of the segmented data corresponding to each step size do not reach the preset threshold, it is determined that the IP to be tested passes the autocorrelation test.

9. A network anomaly monitoring device, characterized in that: The device includes: A feature matching module is used to match the time series feature of the first flow to be tested with the sample time feature; wherein the first flow to be tested is the flow generated by the tested IP communicating on the malicious port; the sample time feature is a feature extracted from the first sample flow generated during the malicious sample IP penetration test; and The feature matching module is further configured to match the spatial sequence features of the second flow to be tested with the sample spatial features; wherein the second flow to be tested is the flow generated by the communication between the IP to be tested and multiple suspected malicious devices; the sample spatial features are features extracted from the second sample flow corresponding to the sample malicious device, and the sample malicious device is a one-hop neighbor device corresponding to the victim sample of the malicious sample IP; The feature matching module is further used to determine whether the IP to be tested has an abnormality based on the matching result.

10. An electronic device, characterized in that: The system comprises at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes the method according to any one of claims 1 to 8.

Images