Attack organization and distributed mapping behavior identification method, equipment and medium

Abstract

The embodiment of the present invention discloses a method, device and medium for identifying attack organizations and distributed mapping behaviors. The method includes: obtaining multiple attack flows; clustering the multiple attack flows using a streaming clustering method, wherein the same cluster represents similar attack methods, and each cluster represents a different attack method; classifying at least one attack address of the attack flow source in each cluster into one category; taking each attack address as a transaction data item and each type of attack address as an item set, executing an association rule algorithm to obtain at least one strong association rule composed of attack addresses, wherein the probability that each attack address within each strong association rule adopts a similar attack method is greater than a confidence threshold; merging the attack addresses belonging to the same network segment between each strong association rule, and taking each merged strong association rule as each attack organization. This embodiment can identify multiple attackers belonging to the same attack organization.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of network security technology, and in particular to a method, device and medium for identifying attack organizations and distributed mapping behaviors. Background Art

[0002] With the rapid development of technologies such as 5G and cloud computing and the widespread interconnection of the Internet of Things, more and more basic information exposure points and surfaces have been exposed. Attackers usually use illegal measurement and mapping to attack the exposed surfaces, resulting in the leakage of key basic information.

[0003] Attackers usually use a variety of methods to attack the target network, such as one-to-one, one-to-many, and many-to-many. Among them, one-to-one means that the attacker only attacks a certain destination port of the destination host, one-to-many means that the attacker attacks multiple target hosts, and many-to-many means that the attacker uses multiple means or multiple attackers from an attack organization attack multiple target hosts. Among these three methods, many-to-many attack means are usually difficult to detect. The commonly used method is to cluster similar attack traffic to find attackers who may belong to the same organization, or to identify attack behaviors by formulating rules. The principle is to discover attack behaviors based on string matching technology.

[0004] Existing clustering algorithms such as k-centers have a problem, that is, the number of cluster categories is difficult to determine. In addition, clustering algorithms can only merge a type of mapping behaviors that use the same mapping means, but attackers belonging to the same organization usually use multiple attack methods. Using a single clustering algorithm cannot identify organizations that use multiple attack methods. In addition, the attack behaviors of multiple attack organizations may have the same attack methods. Using a clustering algorithm will classify attackers in this case into the same organization, which is inconsistent with the actual situation. The rule matching method also has its limitations. The rule matching method can only identify existing attack behaviors, and cannot detect emerging attack methods and cannot adapt to actual needs. Summary of the invention

[0005] The embodiments of the present invention provide a method, device and medium for identifying attack organizations and distributed mapping behaviors to solve the above technical problems.

[0006] In a first aspect, an embodiment of the present invention provides an attack organization identification method, including:

[0007] Obtain multiple attack traffic;

[0008] A stream clustering method is used to cluster the multiple attack flows, wherein the same cluster represents similar attack means, and each cluster represents a different attack means;

[0009] Classify at least one attack address of the attack traffic source in each cluster into one category;

[0010] Taking each attack address as a transaction data item and each type of attack address as an item set, an association rule algorithm is executed to obtain at least one strong association rule composed of the attack addresses, wherein the probability that each attack address within each strong association rule adopts similar attack means is greater than a confidence threshold;

[0011] The attack addresses belonging to the same network segment among the strong association rules are merged, and the merged strong association rules are used as attack organizations respectively.

[0012] In a second aspect, an embodiment of the present invention provides a distributed surveying and mapping behavior recognition method, including:

[0013] Using the above attack organization identification method, multiple attack organizations are identified;

[0014] Attack traffic from the same attack organization is extracted from each cluster to jointly constitute the distributed mapping behavior of the same attack organization.

[0015] In a third aspect, an embodiment of the present invention further provides an electronic device, the electronic device comprising:

[0016] one or more processors;

[0017] a memory for storing one or more programs,

[0018] When the one or more programs are executed by the one or more processors, the one or more processors implement the attack organization identification method described in any embodiment.

[0019] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the attack organization identification method described in any embodiment.

[0020] In summary, the embodiment of the present invention provides a method for identifying attack organizations and distributed mapping behaviors, the purpose of which is to discover and aggregate unknown attack behaviors and identify multiple attackers belonging to the same attack organization. This embodiment is based on a streaming clustering algorithm and an association rule algorithm to quickly discover multiple attackers belonging to the same organization, solving the problem that traditional solutions cannot discover multiple attackers when using distributed attacks. Among them, the streaming clustering algorithm not only solves the problem that clustering parameters are difficult to determine by specifying a clustering similarity threshold, but also aggregates attack behaviors that may belong to the same attack organization. Since attackers may use a variety of attack methods, multiple attackers will be divided into different categories during clustering, and the association rule algorithm can aggregate multiple attackers belonging to the same organization by mining frequent item sets, avoiding the classification of attackers from the same organization into different categories; in addition, since different organizations may use similar attack methods, multiple attackers from different organizations will be classified into the same category during clustering. In this embodiment, the confidence of the association rule is used to distinguish attackers who do not belong to the same organization, reducing the prevention of false alarms of attack organizations. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0022] Figure 1 is a flow chart of an attack organization identification method provided by an embodiment of the present invention;

[0023] Figure 2 This is a hexadecimal original traffic diagram provided by an embodiment of the present invention;

[0024] Figure 3 Yes Figure 2 The diagram of textual attack traffic after payload extraction from the original traffic shown;

[0025] Figure 4 Yes Figure 3 The schematic diagram of the result after text traffic clustering is shown;

[0026] Figure 5 Yes Figure 4 The schematic diagram of IP address classification obtained by tracing back the traffic clustering results shown;

[0027] Figure 6 yes Figure 5 Schematic diagram of possible problems in each IP address classification;

[0028] Figure 7 is a schematic diagram of constructing an FP tree provided by an embodiment of the present invention;

[0029] Figure 8 is another schematic diagram of constructing an FP tree provided by an embodiment of the present invention;

[0030] Fig. 9 The FP_Growth method of this embodiment is used to Figure 5 Schematic diagram of frequent item sets obtained after processing each IP address classification shown;

[0031] Fig.10 is a flow chart of a distributed surveying and mapping behavior recognition method provided by an embodiment of the present invention;

[0032] Fig.11 is a flow chart of another distributed surveying and mapping behavior recognition method provided by an embodiment of the present invention;

[0033] Fig.12 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be described clearly and completely below. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work belong to the scope of protection of the present invention.

[0035] In the description of the present invention, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc., indicating the orientation or positional relationship, are based on the orientation or positional relationship shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", and "third" are used for descriptive purposes only, and cannot be understood as indicating or implying relative importance.

[0036] In the description of the present invention, it is also necessary to explain that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0037] Figure 1 This is a flow chart of an attack organization identification method provided by an embodiment of the present invention. The method is applicable to identifying the attack organization behind a large amount of attack traffic and is executed by an electronic device.

[0038] like Figure 1 As shown, the method specifically includes:

[0039] S110. Obtain multiple attack flows.

[0040] This embodiment first obtains multiple network flows with attack behaviors as data sources for identifying attack organizations and distributed mapping behaviors. Optionally, a network honeypot can be used to capture multiple original attack flows; then, the payload of each original attack flow is extracted to obtain each textualized attack flow.

[0041] Specifically, the payload in the original traffic is the main content of the data packet, which carries the actual information to be transmitted. Attackers can modify the payload information for vulnerability exploitation and detection, which can cause system crashes, data leakage, remote control and other attack behaviors. The payload extraction in this step refers to converting the payload in the collected original traffic into a readable text form, such as converting it into text form through base64 decoding. Figure 2 is a hexadecimal original traffic diagram provided by an embodiment of the present invention. Figure 3 It is the textual attack traffic (i.e. the extracted payload).

[0042] S120: clustering the plurality of attack flows using a stream clustering method, wherein the same cluster represents similar attack means, and each cluster represents a different attack means.

[0043] Since the payloads sent by the attack behaviors of the same attack organization are usually highly similar, this step clusters the payloads of the attack traffic by a streaming clustering method, and classifies the attack behaviors with high similarity into the same category. Optionally, a payload similarity threshold a can be set in the clustering to classify payloads with a similarity higher than 1-a into the same category, preferably, a=0.1.

[0044] In a specific implementation, the above streaming clustering method may include the following steps:

[0045] Step 1: vectorize the multiple attack flows respectively. Specifically, the text flow parsed after the above payload extraction is used as the input of streaming clustering. Since the text cannot be directly clustered by similarity, the text flow is first converted into a word vector form. Optionally, a bag of words model or a TF-IDF model is used to convert the text into a word vector form.

[0046] Step 2: For any flow vector, calculate the similarity between the flow vector and the centroid vectors of each existing cluster. In the streaming clustering method, the vectors corresponding to each flow are classified one by one. Before classification, the centroid vectors of each existing cluster (for example, the average value of all flow vectors in the cluster) are calculated based on all flow vectors in the classified clusters. Then, for the flow vector to be classified, the distance between the flow vector and the centroid vectors of each existing cluster is calculated one by one.

[0047] Step 3: If the similarity between the traffic vector and an existing cluster is greater than a set threshold (i.e., greater than 1-a above), the traffic vector is added to the cluster. If there are multiple such clusters, the traffic vector is added to the cluster that is closest. If the similarity between the traffic vector and each existing cluster is less than a set threshold, the traffic vector is used as a new cluster.

[0048] By performing the operations of step 2 and step 3 on all traffic vectors to be classified, clustering of all traffic can be completed. Figure 4 Yes Figure 3 The result of text traffic clustering is shown in Figure 1. From the above operation steps, it can be seen that the streaming clustering method performs clustering based entirely on the traffic information itself, without the need to pre-set the number of clusters, and will not produce incorrect classifications due to inappropriate number of clusters, thus improving the accuracy of attack method clustering.

[0049] S130: Classify at least one attack address of the attack traffic source in each cluster into one category.

[0050] In S120, the loads with high similarity are classified into the same category. In this step, the network addresses with the loads are classified into one category according to the classification result, so as to achieve the preliminary classification of the attack organization. In a specific implementation, this preliminary classification may include the following steps:

[0051] Step 1: Map each attack flow in each cluster to at least one attack address that has sent each attack flow, and obtain each new cluster about the attack address. Exemplarily, for the first attack flow in cluster 1, find all IP addresses that have sent this attack flow, and add all these IP addresses to the new cluster 1 about the IP address; for the second attack flow in cluster 1, find all IP addresses that have sent this attack flow, and add these IP addresses to the new cluster 1 about the IP address. By traversing each attack flow in each cluster in this way, multiple new clusters about IP addresses can be obtained.

[0052] Step 2: Remove the repeated attack addresses in each new cluster to obtain the final attack address classification. Specifically, for the above new clusters of IP addresses, if there are repeated IP addresses in the cluster (for example, the IP address has sent multiple attack flows in the same cluster), the repeated IP addresses can be removed to obtain the final attack address classification. Figure 5 The example shows Figure 4 The final classification of IP addresses obtained by tracing back.

[0053] S140. Taking each attack address as a transaction data item and each type of attack address as an item set, an association rule algorithm is executed to obtain at least one strong association rule composed of the attack addresses, wherein the probability that the attack addresses within the same strong association rule adopt similar attack methods is greater than a confidence threshold.

[0054] In S130, the network addresses of payloads with high similarity are classified into the same category, but different attack organizations may use similar payloads (i.e., attack methods), and the payloads sent by each attack organization are not unique. Therefore, how to aggregate multiple IPs of multiple payloads and distinguish different mapping organizations with similar payloads is the focus of this embodiment.

[0055] Specifically, Figure 6 The example shows several problems that may exist in each IP address classification. In order to solve these problems, this embodiment takes into account that although the payloads sent by the attack means of different attack organizations may overlap, the overlap of multiple attack payloads belonging to the same attack organization is often higher than the overlap of payloads sent by different attack organizations. Therefore, an association rule algorithm is introduced to mine association rules through frequent item sets, and strong association rules that meet the confidence requirements are screened out through confidence. Each strong association rule represents multiple attackers with strong network co-occurrence, and the possibility of belonging to the same attack organization is extremely high. Among them, network co-occurrence refers to the probability or possibility of multiple network addresses launching network attacks using similar attack means.

[0056] In a specific implementation, the FP_Growth method can be used to mine strong association rules, which specifically includes the following steps:

[0057] Step 1: Take each attack address as a transaction data item, each type of attack address as an item set, and the sum of each type of attack address as a transaction database, and calculate the number of times each attack address appears in all item sets. Specifically, take each IP address involved in S130 as a transaction data item in the transaction database, take each classification of the IP address as a transaction data item set (referred to as an item set), and all item sets constitute the transaction database. Traverse the transaction database, calculate the number of times each IP address appears in the transaction database, and use it as the basis for constructing a frequent pattern tree (FP tree).

[0058] Step 2: Sort the attack addresses in descending order of the number of occurrences. Assume that the sorted IP address sequence is IP1, IP2, IP3, ..., IPn (n>5).

[0059] Step three, take each type of attack address as the item set in the transaction database, take the attack addresses in each item set as tree nodes, and add them to the frequent pattern tree in the sorted order. Specifically, first create a root node for the FP tree, then take each type of attack address as an item set, traverse the item sets, and perform the following operations for each item set: rearrange the IP addresses in the current item set according to the order in step two, add the rearranged IP addresses step by step as child nodes of the root node, and increase the child node weight by 1, which represents the number of times the IP address corresponding to the child node appears. Exemplarily, if the first item set includes IP addresses IP3, IP1, IPn, arrange these IP addresses as IP1, IP3, IPn; add the rearranged IP1, IP3, IPn step by step as the first-level child node, second-level child node and third-level child node of the root node), and increase the child node weight of IP1, IP3, IPn by 1, such as Figure 7 Then, obtain the next transaction set, and rearrange the IP addresses in the next transaction set according to the order in step 2. For example, if the next transaction set includes IP addresses IP2, IP1, and IP4, then arrange these IP addresses as IP1, IP2, and IP4; add the rearranged IP1, IP2, and IP4 to the existing FP tree in sequence, and add 1 to the weights of IP1, IP2, and IP4, to obtain Figure 8 The FP tree shown in the figure is shown in the figure. This process is repeated until all item sets are traversed. The remaining details are the same as the general steps for generating FP trees in the FP_Growth algorithm and will not be repeated here. Each branch in the final FP tree represents the co-occurrence pattern of each IP address, that is, which IP addresses are prone to similar attack methods.

[0060] Step 4: Mining at least one frequent item set in the frequent pattern tree, each frequent item set consisting of at least one attack address whose co-occurrence times are greater than a set threshold. This step takes the data structure of the FP tree as input, and by setting a co-occurrence threshold, mining the item sets with higher co-occurrence times in the frequent pattern tree as frequent item sets, which is equivalent to further screening co-occurrence patterns with higher frequencies based on each branch of the FP number. Optionally, the set threshold can be 10.

[0061] Step 5. Based on the at least one frequent item set, strong association rules between transaction data items are mined, wherein each strong association rule is composed of at least one attack address whose association probability is greater than a confidence threshold. In this embodiment, the association rule can be understood as generalizing the co-occurrence pattern represented by the frequent item set to various known or unknown environments, predicting a set of attack addresses that may use similar attack methods in any environment, and the confidence of the association rule can be understood as the probability or possibility that the attack addresses in the set adopt similar attack methods. In this embodiment, by setting a confidence threshold, strong association rules with a confidence higher than the threshold are mined. The frequency and probability of IP addresses in the same strong association rule using similar attack methods are higher, and they are more likely to belong to the same attack organization.

[0062] The details not described in the above steps are the general steps of the FP_Growth algorithm and will not be repeated here. Figure 5 The item set data, co-occurrence threshold and confidence threshold shown in the figure are input into the FP_Growth algorithm function together to obtain strong association rules that meet the threshold requirements. Fig. 9 The FP_Growth method of this embodiment is shown as an example. Figure 5 After processing the various sets shown in the figure, three strong association rules are obtained. It should be emphasized that, in terms of attack means, the strong association rules here constrain the similarity of attack means, but not the number of attack means, that is, it is believed that the attack address in the same strong association rule can use multiple similar attack means, which is more in line with reality; while in the classification of S130 (corresponding to cluster classification), the classification result believes that the same type of attack address only corresponds to one similar attack means, which is inconsistent with reality. This is also an important difference between the two classifications.

[0063] S150: Merge the attack addresses belonging to the same network segment among the strong association rules, and use the merged strong association rules as attack organizations.

[0064] Combination Fig. 9 , in the strong association rules obtained in S140, the same C-segment address may appear. Considering that the possibility that the same attack organization belongs to the same C-segment is very high, this step merges attackers with multiple IPs that have high correlation and belong to the same C-segment into one organization. Optionally, if two strong association rules respectively include two attack addresses belonging to the same C-segment, the attack address in the latter strong association rule of the two attack addresses can be added to the former strong association rule. After all the above situations are merged, the final strong association rules can be obtained. In these rules, the probability of the IP address in each rule initiating a distributed unified attack behavior is very high, and there is no situation of splitting the same C-segment, so it can be identified as an attack organization.

[0065] Furthermore, the ASN organization information and RDNS information of the IP address usually contain some information about the attacker. For example, multiple attackers belonging to the same organization usually have the same RDNS suffix and ASN organization suffix. Therefore, after obtaining each attack organization, the RDNS information and / or ASN information of each attack address in any merged strong association rule can be further parsed; if the RDNS information and / or ASN information of each attack address are consistent, the identity of the attack organization can be identified based on the consistent RDNS information and / or ASN information; if they are inconsistent, it may be because the RDNS information and / or ASN information of some IP addresses cannot be parsed, or the attack organization adopts a cloud platform architecture, which makes the RDNS information and / or ASN information of each IP address different. This information can be used as intelligence information of the attack organization and used in subsequent operations.

[0066] In order to verify the effectiveness of the above method, this embodiment also deployed collection nodes to collect attack traffic for two months, and captured 477 IP addresses of the Censys platform and 56 IP addresses of Shodan. After processing the above attack traffic and IP addresses using the method of this embodiment, 470 IPs out of the 477 IPs of the Censys platform were classified into one category, and the other 7 IPs were classified into another category, with a classification accuracy of about 98%, and all IPs of Shodan were classified into the same category.

[0067] Based on the same inventive concept, Fig.10 is a flow chart of a distributed mapping behavior recognition method provided by an embodiment of the present invention. Fig.10 As shown, the method comprises the following steps:

[0068] S210: Use the attack organization identification method described in any of the above embodiments to identify multiple attack organizations.

[0069] S20. Extract attack traffic from the same attack organization from each cluster to jointly constitute a distributed mapping behavior of the same attack organization.

[0070] This method uses the same method as any of the above embodiments to identify multiple attack organizations. These attack organizations are the main bodies that generate multi-point distributed mapping behaviors. The network behaviors of these attack organizations can be further observed, or the distributed mapping behaviors of each attack organization can be extracted from the existing traffic to clarify their behavior patterns. Fig.11 The flowchart shown can be understood.

[0071] In summary, the embodiment of the present invention provides a method for identifying attack organizations and distributed mapping behaviors, the purpose of which is to discover and aggregate unknown attack behaviors and identify multiple attackers belonging to the same attack organization. Based on the streaming clustering algorithm and the association rule algorithm, this embodiment quickly discovers multiple attackers belonging to the same organization, solving the problem that the traditional solution cannot discover multiple attackers using distributed attacks. Among them, the streaming clustering algorithm not only solves the problem that clustering parameters are difficult to determine by specifying the clustering similarity threshold, but also aggregates attack behaviors that may belong to the same attack organization. Since attackers use a variety of attack methods, multiple attackers will be divided into different categories during clustering, and the association rule algorithm can aggregate multiple attackers belonging to the same organization by mining frequent item sets, avoiding the classification of attackers from the same organization into different categories; in addition, since different organizations use similar attack methods, multiple attackers from different organizations are classified into the same category during clustering. In this embodiment, the confidence of the association rule is used to distinguish attackers who do not belong to the same organization, reducing the prevention of false alarms of attack organizations. In addition, this embodiment also introduces rdns information and asn organization information to identify the identity of the same attack organization or provide more intelligence information, thereby improving the availability of the identification results.

[0072] Fig.12 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention is shown in FIG. Fig.12 As shown, the device includes a processor 60, a memory 61, an input device 62 and an output device 63; the number of processors 60 in the device can be one or more. Fig.12 A processor 60 is taken as an example; the processor 60, the memory 61, the input device 62 and the output device 63 in the device can be connected by a bus or other means. Fig.12 The example of connecting through bus is taken in the following.

[0073] The memory 61 is a computer-readable storage medium that can be used to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the attack organization identification method in the embodiment of the present invention. The processor 60 executes various functional applications and data processing of the device by running the software programs, instructions and modules stored in the memory 61, that is, implementing the above-mentioned attack organization identification method.

[0074] The memory 61 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and at least one application required for a function; the data storage area may store data created according to the use of the terminal, etc. In addition, the memory 61 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 61 may further include a memory remotely arranged relative to the processor 60, and these remote memories may be connected to the device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0075] The input device 62 may be used to receive input digital or character information and generate key signal input related to user settings and function control of the device. The output device 63 may include a display device such as a display screen.

[0076] An embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the attack organization identification method of any embodiment is implemented.

[0077] The computer storage medium of the embodiment of the present invention can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, a device or a device or used in combination with it.

[0078] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0079] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0080] Computer program code for performing the operations of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as C or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0081] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the technical solutions of the embodiments of the present invention.

Claims

1. A method for identifying an attacking organization, characterized in that: include: Obtain multiple attack traffic; A stream clustering method is used to cluster the multiple attack flows, wherein the same cluster represents similar attack means, and each cluster represents a different attack means; Classify at least one attack address of the attack traffic source in each cluster into one category; Taking each attack address as a transaction data item and each type of attack address as an item set, the association rule algorithm is executed to obtain at least one strong association rule composed of the attack addresses, wherein the probability that the attack addresses within the same strong association rule adopt similar attack methods is greater than the confidence threshold; Merge the attack addresses belonging to the same network segment among the strong association rules, and use the merged strong association rules as attack organizations respectively; The method uses each attack address as a transaction data item and each type of attack address as an item set to execute an association rule algorithm to obtain at least one strong association rule composed of the attack addresses, including: Take each attack address as a transaction data item, take each type of attack address as an item set, and calculate the number of times each attack address appears in all item sets; Sort the attack addresses in descending order of the number of occurrences; The attack addresses in each set are used as tree nodes and added to the frequent pattern tree in the sorted order. The frequent pattern tree can reflect the patterns of similar attack methods used between the attack addresses; Mining at least one frequent item set in the frequent pattern tree, each frequent item set consisting of at least one attack address with a co-occurrence number greater than a set threshold; According to the at least one frequent item set, strong association rules between transaction data items are mined, wherein each strong association rule is composed of at least one attack address whose association probability is greater than a confidence threshold.

2. The method according to claim 1, characterized in that The obtaining of multiple attack flows includes: Use network honeypots to capture multiple original attack flows; The payload of each original attack flow is extracted to obtain each text-based attack flow.

3. The method according to claim 1, characterized in that: The adopting of the stream clustering method to cluster the plurality of attack flows comprises: Vectorizing the multiple attack flows respectively; For any flow vector, calculate the similarity between the flow vector and the centroid vectors of each existing cluster; If the similarity between the traffic vector and an existing cluster is greater than a set threshold, adding the traffic vector to the existing cluster; If the similarity between the traffic vector and each existing cluster is less than a set threshold, the traffic vector is taken as a new cluster.

4. The method according to claim 1, characterized in that The at least one attack address of the attack traffic source in each cluster is divided into a category, including: Mapping each attack flow in each cluster to at least one attack address that has sent each attack flow, to obtain each new cluster about the attack address; Remove the repeated attack addresses within each new cluster to obtain the final attack address classification.

5. The method according to claim 1, characterized in that: The attack addresses belonging to the same network segment among the strong association rules are merged, and the merged strong association rules are used as attack organizations respectively, including: If two strong association rules respectively include two attack addresses belonging to the same C segment, the attack address belonging to the latter strong association rule among the two attack addresses is added to the former strong association rule.

6. The method according to claim 1, characterized in that After the combined strong correlation rules are used as attack organizations respectively, the method further includes: Analyze the rdns information and / or asn information of each attack address in any merged strong association rule; If the rdns information and / or asn information of each attack address is consistent, the identity of the attack organization is identified based on the consistent rdns information and / or asn information; Otherwise, the attack organization is marked as partially unresolvable RDN information and / or ASN information, or cloud platform architecture.

7. A distributed mapping behavior recognition method, characterized in that: include: Using the method as described in any one of claims 1 to 6, identifying multiple attack organizations; Attack traffic from the same attack organization is extracted from each cluster to jointly constitute the distributed mapping behavior of the same attack organization.

8. An electronic device, characterized in that: include: one or more processors; a memory for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the attack organization identification method described in any one of claims 1-6, or the distributed mapping behavior identification method described in claim 7.

9. A computer-readable storage medium, characterized in that: A computer program is stored thereon, which, when executed by a processor, implements the attack organization identification method described in any one of claims 1 to 6, or the distributed mapping behavior identification method described in claim 7.

Images