Network anomaly detection method, device, equipment and storage medium

Abstract

The application discloses a network anomaly detection method and device, equipment and storage medium, relates to the network security monitoring technical field, discloses a network anomaly detection method, comprising: determining whether the real-time network data flowing through the switch exists abnormity;If it is determined that the real-time network data exists abnormity, then the real-time network data is input to the preset detection model, the abnormal type and the abnormal point of the real-time network data are determined, and the preset detection model is obtained by training the isolation forest model using the historical network data of IPv6 and IPv4;Based on the abnormal type and the abnormal point, the attack mode existing in the real-time network data is identified. That is, the preset detection model obtained by training the isolation forest model according to the historical network data of IPv4 and IPv6 is used to detect the real-time network data, so as to identify the abnormal point in the IPv4 and / or IPv6 network environment at one time, realize comprehensive monitoring of network security, and improve the detection effect of network security.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security monitoring, and particularly relates to a network anomaly detection method and device, equipment and a storage medium. BACKGROUND

[0002] With the rapid development of network technology, IPv4 (Internet Protocol Version 4) address resources have been basically exhausted, but IPv6 (Internet Protocol Version 6) is still being gradually promoted and improved. In order to smoothly transition network technology from IPv4 to IPv6, a dual-stack network architecture is usually adopted to support IPv4 and IPv6 protocols at the same time.

[0003] However, the implementation of a dual-stack network environment increases complexity, monitoring difficulty and security risks. The commonly used network anomaly detection method currently relies on fixed rules or single data stream analysis, and mainly focuses on IPv4, ignoring the existence and characteristics of IPv6. Therefore, in a dual-stack network environment, network security cannot be comprehensively monitored and evaluated, resulting in poor detection effect of network security.

[0004] The above content is only used to assist in understanding the technical solutions of the present application and does not represent the acknowledgement of the above content as prior art. SUMMARY

[0005] The main purpose of the present application is to provide a network anomaly detection method, which aims to solve the technical problem that network security cannot be comprehensively monitored and evaluated in a dual-stack network environment, resulting in poor detection effect of network security.

[0006] To achieve the above purpose, the present application provides a network anomaly detection method, which comprises:

[0007] determining whether real-time network data flowing through a switch is abnormal;

[0008] if it is determined that the real-time network data is abnormal, inputting the real-time network data into a preset detection model to determine the abnormal type and abnormal point of the real-time network data, wherein the preset detection model is obtained by training an isolation forest model using historical network data of IPv6 and IPv4;

[0009] identifying an attack mode existing in the real-time network data based on the abnormal type and the abnormal point.

[0010] In an embodiment, the step of determining whether real-time network data flowing through a switch is abnormal comprises:

[0011] capturing real-time network data flowing through a switch;

[0012] performing TCP classification on the real-time network data, and dividing the real-time network data into IPv4 data and / or IPv6 data;

[0013] comparing the IPv4 data and / or the IPv6 data with a preset baseline model to determine whether there is an anomaly in the IPv4 data and / or the IPv6 data, wherein the preset baseline model is obtained by training a clustering model based on historical IPv4 data and historical IPv6 data flowing through the switch.

[0014] In an embodiment, the step of comparing the IPv4 data and / or the IPv6 data with the preset baseline model to determine whether there is an anomaly in the IPv4 data and / or the IPv6 data includes:

[0015] if the real-time network data contains the IPv4 data and the IPv6 data, extracting basic features from the IPv4 data and the IPv6 data based on the preset baseline model, and extracting extension header features from the IPv6 data;

[0016] comparing the normal features in the preset baseline model with the basic features and the extension header features respectively to determine whether there is an anomaly in the IPv4 data and / or the IPv6 data.

[0017] In an embodiment, the step of comparing the IPv4 data and / or the IPv6 data with the preset baseline model to determine whether there is an anomaly in the IPv4 data and / or the IPv6 data includes:

[0018] if the real-time network data contains the IPv4 data and the IPv6 data, extracting basic features from the IPv4 data and the IPv6 data based on the preset baseline model, and extracting extension header features from the IPv6 data;

[0019] comparing the normal features in the preset baseline model with the basic features and the extension header features respectively to determine whether there is an anomaly in the IPv4 data and / or the IPv6 data.

[0020] In an embodiment, the step of identifying the attack mode existing in the real-time network data based on the anomaly type and the anomaly point includes:

[0021] performing content analysis and behavior analysis on the abnormal data corresponding to the anomaly point based on a preset DPI to determine the traffic mode of the IPv4 data and the IPv6 data;

[0022] comparing the traffic pattern with a preset baseline pattern to identify an attack pattern of the real-time network data.

[0023] In an embodiment, the method further comprises, before the step of determining whether the real-time network data captured from the switch has an anomaly, the steps of:

[0024] obtaining historical network data from the switch;

[0025] extracting basic features of historical IPv6 data and historical IPv4 data and unique features of the IPv6 data from the historical network data;

[0026] identifying unique abnormal properties of the historical IPv6 data from the unique features;

[0027] training an isolation forest model based on the unique abnormal properties and the basic features to obtain a preset detection model.

[0028] In an embodiment, the step of identifying the unique abnormal properties of the historical IPv6 data from the unique features comprises:

[0029] identifying an extension header type, an extension header order, an address structure, and an allocation pattern of the historical IPv6 data from the unique features;

[0030] identifying an abnormal type from the extension header type, an abnormal order from the extension header order, an abnormal address from the address structure, and an abnormal pattern from the allocation pattern;

[0031] obtaining the unique abnormal properties of the historical IPv6 data based on the abnormal type, the abnormal order, the abnormal address, and the abnormal pattern.

[0032] In addition, to achieve the above object, the application further provides a network anomaly detection device, which comprises:

[0033] a judging module configured to determine whether real-time network data captured from a switch has an anomaly;

[0034] a detecting module configured to, if it is determined that the real-time network data has an anomaly, input the real-time network data into a preset detection model to determine an abnormal type and an abnormal point of the real-time network data, wherein the preset detection model is obtained by training an isolation forest model using historical network data of IPv6 and IPv4;

[0035] an identifying module configured to identify an attack pattern existing in the real-time network data based on the abnormal type and the abnormal point.

[0036] In addition, to achieve the above object, the present application further provides a network anomaly detection device, comprising a memory, a processor and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the network anomaly detection method as described above.

[0037] In addition, to achieve the above object, the present application further provides a storage medium, which is a computer readable storage medium, and the storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the network anomaly detection method as described above.

[0038] In addition, to achieve the above object, the present application further provides a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement the steps of the network anomaly detection method as described above.

[0039] The one or more technical solutions provided by the present application have at least the following technical effects:

[0040] The present application captures real-time network data flowing through to detect anomalies in real-time network data, and determines whether there is an anomaly in real-time network data. If there is an anomaly in real-time network data, it means that there is a security threat in real-time network data. In order to process IPv4 data and IPv6 data in parallel, a preset detection model obtained by training an isolation forest model according to historical network data of IPv4 and IPv6 is used to detect real-time network data, so that abnormal points in IPv4 network environment and / or abnormal points in IPv6 network environment can be identified through one detection, avoiding that the anomaly detection of the network is concentrated in the IPv4 network environment, thereby avoiding neglecting the existence and characteristics of IPv6. Further, the attack mode existing in the real-time network data is identified through the anomaly type and the abnormal point, the network security is comprehensively monitored and evaluated, and the detection effect of the network security is improved. BRIEF DESCRIPTION OF DRAWINGS

[0041] The accompanying drawings, which are incorporated into and form part of the specification, illustrate embodiments consistent with the present application and, together with the specification, serve to explain the principles of the application.

[0042] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, for those skilled in the art, other drawings can also be obtained without creative labor based on these drawings.

[0043] Figure 1 The flowchart provided by the network anomaly detection method embodiment one of the present application;

[0044] Figure 2 A flowchart provided for the second embodiment of the network anomaly detection method of the present application;

[0045] Figure 3 A flowchart provided for the third embodiment of the network anomaly detection method of the present application

[0046] Figure 4 A brief flowchart of the network anomaly detection method provided for the embodiments of the present application;

[0047] Figure 5 A network architecture diagram of the network anomaly detection system of the embodiments of the present application;

[0048] Figure 6 A module structure diagram of the network anomaly detection device of the embodiments of the present application;

[0049] Figure 7 A device structure diagram of the hardware running environment involved in the network anomaly detection method in the embodiments of the present application.

[0050] The object implementation, functional features and advantages of the present application will be further explained with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION

[0051] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application, and are not used to limit the present application.

[0052] In order to better understand the technical solutions of the present application, the following will be described in detail in combination with the drawings of the specification and specific embodiments.

[0053] The main solution of the embodiments of the present application is that the network server determines whether the real-time network data flowing through the switch is abnormal after capturing the real-time network data; if it is determined that the real-time network data is abnormal, the real-time network data is input into a preset detection model to determine the abnormal type and abnormal point of the real-time network data, the preset detection model is obtained by training an isolation forest model using historical network data of IPv6 and IPv4; and the attack mode existing in the real-time network data is identified based on the abnormal type and the abnormal point.

[0054] In the present embodiment, the network server is described as the execution subject for convenience of description.

[0055] Since the implementation of the dual stack network environment in the prior art increases complexity, monitoring difficulty and security risks, the current commonly used network anomaly detection method relies on fixed rules or single data flow analysis, and mainly focuses on IPv4, ignoring the existence and characteristics of IPv6, so it cannot comprehensively monitor and evaluate network security in the dual stack network environment, resulting in poor detection effect of network security.

[0056] The present application provides a solution by capturing real-time network data flowing through to detect anomalies in real-time network data, determine whether real-time network data is abnormal, and if real-time network data is abnormal, it means that real-time network data is a security threat. In order to be able to process IPv4 data and IPv6 data in parallel, a preset detection model obtained by training an isolation forest model according to historical network data of IPv4 and IPv6 is used to detect real-time network data, so that abnormal points in IPv4 network environment and / or abnormal points in IPv6 network environment can be identified through one detection, avoiding the concentration of network anomaly detection in IPv4 network environment, and further avoiding the neglect of the existence and characteristics of IPv6. Further, the attack mode existing in real-time network data is further identified through the anomaly type and the anomaly point, realizing comprehensive monitoring and evaluation of network security, and further improving the detection effect of network security.

[0057] It should be noted that the execution subject of the present embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device, a network server, etc. capable of realizing the above functions. The following takes a network server as an example to describe the present embodiment and the following embodiments.

[0058] Based on this, the present application provides a network anomaly detection method, which refers to Figure 1 , Figure 1 The flowchart of the first embodiment of the network anomaly detection method of the present application is shown in the figure.

[0059] In the present embodiment, the network anomaly detection method comprises steps S10-S40:

[0060] Step S10, determine whether the real-time network data flowing through the switch is abnormal;

[0061] It should be noted that the switch can be a network device for forwarding electrical (optical) signals, providing exclusive electrical signal paths for any two network nodes connected to the switch. Real-time network data can be real-time traffic of a source port in a network architecture.

[0062] In addition, it should be noted that the source port is the port number used by the sender of the data packet in network communication.

[0063] It can be understood that, since the switch user exchanges data of any two network nodes, and since detecting the anomaly of real-time network data increases the time for the data receiving end to receive the real-time network data, and further increases the delay of data transmission, in order to avoid increasing the delay of each network data during transmission, after capturing the real-time network data flowing through the switch, the real-time network data can be first judged for anomaly, and when there is no anomaly in the real-time network data, the real-time network data is directly released to ensure the real-time performance of normal network data.

[0064] It can be understood that, since the real-time network data can be IPv4 data or IPv6 data, or simultaneously includes IPv4 data and IPv6 data, in order to be able to judge the anomaly in IPv4 data and IPv6 data, therefore, judging whether the real-time network data is abnormal is to judge IPv4 data and IPv6 data in parallel, avoiding the detection of network security being concentrated on the detection of IPv4 data, thereby neglecting the detection of IPv6 data.

[0065] In specific implementation, the real-time traffic (real-time network data) flowing through the switch or router can be captured by a traffic capture device, and after capturing the real-time network data, an identification model capable of identifying anomalies in IPv4 data and anomalies in IPv6 data is used to judge the real-time network data, so that anomalies in IPv4 data can be accurately identified, and anomalies in IPv6 data can also be accurately identified.

[0066] Step S20, if it is determined that the real-time network data has an anomaly, the real-time network data is input to a preset detection model to determine the anomaly type and anomaly point of the real-time network data, the preset detection model is obtained by training an isolation forest model using historical network data of IPv6 and IPv4;

[0067] It should be noted that the anomaly point can include source / destination address, port, protocol type, traffic size, packet length, and extension header, etc. The anomaly type can be traffic anomaly, extension header usage, and address anomaly, etc. The isolation forest can be an unsupervised learning algorithm for anomaly detection, that is, the structure of the tree is used to identify anomaly data points that are more easily isolated compared to normal data to obtain detection results more quickly. That is, the isolation forest model can be obtained by training a clustering model using anomaly data points of historical network data of IPv4 and IPv6.

[0068] Understandably, detection models employing isolated forests and online learning mechanisms can adapt to changes in network behavior and attack patterns in a timely manner, improving the accuracy and timeliness of anomaly detection. In particular, IPv6 possesses unique security threats, including the detection of attack methods such as extension header exploitation and address spoofing, thus enhancing the system's ability to defend against new types of attacks.

[0069] Step S30: Identify the attack patterns present in the real-time network data based on the anomaly type and the anomaly point.

[0070] It should be noted that the attack mode can be a denial-of-service attack, a man-in-the-middle attack, an SQL injection attack, a cross-site scripting attack, or a supply chain attack, and it can also be an unknown attack mode.

[0071] Understandably, once the anomaly type is determined, the form of the attack can be identified. Furthermore, by combining the anomaly points, the attack patterns present in real-time network data can be accurately determined, thereby increasing the accuracy of attack pattern identification.

[0072] Furthermore, to increase the accuracy of attack pattern identification, step S30 may also include:

[0073] Based on a preset DPI, content and behavior analysis are performed on the abnormal data corresponding to the anomalies to determine the traffic patterns of the IPv4 data and the IPv6 data.

[0074] The traffic pattern is compared with a preset baseline pattern to identify the attack pattern of the real-time network data.

[0075] It should be noted that the preset DPI (Deep Packet Inspection) is a method for identifying, controlling, and managing non-standard protocols, viruses, spam, and packets with intrusive intent in data packets through in-depth analysis of the application layer of data packets, thereby filtering the data packets.

[0076] Understandably, by setting the DPI, it is possible to deeply analyze the content of data packets; provide accurate cross-protocol attack detection; and analyze encapsulation and conversion mechanisms to detect attack types. It can identify and respond to cross-protocol attacks, such as IPv6 to IPv4 attacks, making security protection more comprehensive. The system can flexibly implement traffic isolation, block attack sources, or adjust access control measures based on different abnormal events.

[0077] In a specific implementation, when the attack is a cross-script attack, the preset DPI is used as a traffic monitoring tool to analyze the data content of the anomaly detection data, a behavior-based anomaly detection system is used to analyze the traffic pattern, the normal IPv4 and IPv6 traffic patterns are determined, and a baseline is established for comparison, signature matching is used to identify the attack pattern for known cross-protocol attacks, and anomaly detection is used to analyze the traffic anomaly for unknown attacks, and a predefined response operation is triggered according to the detected anomaly event, and the corresponding response actions of the response operation include traffic isolation, blocking of the attack source, and adjustment of the access control list.

[0078] The embodiment provides a network anomaly detection method, which captures real-time network data flowing through, performs anomaly detection on the real-time network data, judges whether the real-time network data is abnormal, and judges that the real-time network data is a security threat when the real-time network data is abnormal. In order to be able to process IPv4 data and IPv6 data in parallel, a preset detection model obtained by training an isolation forest model according to historical network data of IPv4 and IPv6 is used to detect the real-time network data, so as to identify an abnormal point in an IPv4 network environment and / or an abnormal point in an IPv6 network environment through one detection, avoid that anomaly detection of the network is concentrated in the IPv4 network environment, and further avoid neglecting the existence and characteristics of the IPv6. Further, an attack mode existing in the real-time network data is further identified through the anomaly type and the abnormal point, comprehensive monitoring and evaluation of network security are realized, and the detection effect of the network security is improved.

[0079] Based on the first embodiment of the application, in the second embodiment of the application, the same or similar contents as the above-mentioned first embodiment can be referred to the above introduction, and the subsequent will not be described in detail. On this basis, please refer to Figure 2 , step S10 includes steps S11-S13:

[0080] Step S11, capturing real-time network data flowing through the switch;

[0081] In a specific implementation, a SPAN (Switched Port Analyzer) port can be configured on a switch or a router in a network architecture, the traffic of a source port to be monitored is copied to a specified mirror port, the network traffic is mirrored to a pre-deployed capture device, and a capture parameter is set to capture network data in real time.

[0082] The capture device is a network probe that can support IPv6 and IPv4, and the probe is deployed at the entrance and exit of the network to ensure that all necessary traffic is captured. The SPAN port can copy or mirror the data traffic of a specified port (controlled port) to another port (monitored port) for in-depth network analysis and monitoring.

[0083] Step S12, performing TCP classification on the real-time network data, and dividing the real-time network data into IPv4 data and / or IPv6 data.

[0084] It should be noted that TCP (Transmission Control Protocol) is a connection-oriented, reliable, byte stream-based transport layer communication protocol. The TCP type can be IPv4 data type, IPv6 data type, and IPv4 and IPv6 dual stack type, etc.

[0085] It can be understood that after obtaining the real-time network data by using the capture device, in order to detect the real-time network data in a targeted manner and reduce the complexity of the real-time network data anomaly detection, the TCP type contained in the real-time network data can be analyzed first to determine the IPv4 data and the IPv6 data in the real-time network data.

[0086] Step S13, comparing the IPv4 data and / or the IPv6 data based on a preset baseline model to determine whether there is an anomaly in the IPv4 data and / or the IPv6 data, wherein the preset baseline model is obtained by training a clustering model based on historical IPv4 data and historical IPv6 data flowing through the switch.

[0087] It should be noted that the preset baseline model can be a clustering model containing normal network data characteristics obtained by training using historical IPv4 data and historical IPv6 data.

[0088] It can be understood that an accurate network behavior baseline model is established, including special consideration of IPv6 traffic. Statistical and behavioral analysis techniques are used to define normal behavior patterns. Real-time traffic monitoring to quickly identify deviations from the baseline model; application of deep packet inspection and time series analysis to monitor traffic dynamics.

[0089] In specific implementation, network traffic can be compared with the baseline model in real time to identify abnormal behavior, and deep packet inspection and time series analysis are applied to monitor the dynamics of network traffic.

[0090] Optionally, the establishment of the preset baseline model can specifically be modeling the normal network behavior using historical network data to form a baseline.

[0091] In a specific implementation, a time range for collecting data is determined, and historical network data in the time range is acquired, for example, network data from 9:000 to 17:00 on weekdays, and features such as packet size, flow duration, traffic direction, or port number are extracted from the historical network data, and after data cleaning, clustering is used to establish a baseline model, and the model is trained to identify normal traffic patterns.

[0092] It should be noted that the clustering modeling can be K-means clustering modeling, in which the number of clusters k is determined, the historical network data is divided into multiple clusters, each cluster represents a normal behavior pattern, the clustering result is analyzed, and the center of each cluster is identified and labeled as a representative of normal behavior, and the center of each cluster and its radius (distance to the farthest point in the cluster) define the range of normal behavior, and the baseline is formed and the model is established.

[0093] It should be noted that analyzing the clustering result can be analyzing by calculating the mean and calculating the standard deviation, calculating the mean of each feature as the center point of normal behavior, and evaluating the dispersion of the data to assist in setting the threshold of normal behavior. Then, MDS is applied for multi-dimensional scaling analysis to reduce the high-dimensional feature space to two or three dimensions, and in the low-dimensional space, a closely clustered point group is identified, representing a normal behavior pattern.

[0094] Further, step S13 can further include:

[0095] If the IPv4 data and the IPv6 data exist in the real-time network data, basic features are extracted from the IPv4 data and the IPv6 data based on a preset baseline model, and extension header features are extracted from the IPv6 data.

[0096] Based on the comparison between the normal features in the preset baseline model and the basic features and the extension header features, respectively, it is determined whether there is an anomaly in the IPv4 data and / or the IPv6 data.

[0097] It should be noted that the extension header features can be features such as the type and order of the extension header. The basic features can be source / destination address, port, protocol type, traffic size, and packet length.

[0098] It can be understood that in order to accurately detect anomalies in IPv6 data, and because IPv6 data has exclusive features that IPv4 data does not have, when extracting features from real-time network data, not only basic features are extracted, but also extension header features are extracted from IPv6 data when IPv6 data exists in real-time network data.

[0099] In a specific implementation, the preset baseline model extracts the basic features from the IPv4 data and the IPv6 data and the extension header features of the IPv6 data. The preset baseline model compares the extracted basic features with the normal basic features obtained through training to determine whether the basic features are abnormal. The preset baseline model also compares the extension header features with the standard extension header features obtained through training to determine whether the extension header features are abnormal.

[0100] In a specific implementation, when using tcpdump to capture packets, the command is set as: tcpdump -i any -n -n -v -w capture.pcap. The capture.pcap file contains the packets transmitted on the network. Then, the capture.pcap file is read using tcpdump, and the key features are extracted: tcpdump -n -n -v -r capture.pcap. Finally, a script is used to extract the required features: source / destination address, port, protocol type, traffic size, packet length. The source / destination address is the address after the ˋIPˋ field; the port is the number after the ˋIPˋ address for TCP or UDP traffic; the protocol type is usually displayed in the ˋProtoˋ field; the traffic size is the ˋPayload lengthˋ in IPv6, which represents the length of the user data excluding the 40-byte fixed-length IPv6 header; and the packet length is the ˋlengthˋ field in the tcpdump output. When using tcpdump, manually view the output of each IPv6 packet to identify and track each extension header; find the ˋNext Headerˋ field, which indicates the type of the next header; follow each extension header according to the ˋNext Headerˋ field until reaching the transport layer.

[0101] Optionally, to enable network engineers to analyze network data, Wireshark can be used as a graphical interface for analysis.

[0102] Specifically, when using Wireshark as a graphical interface for analysis, the operation steps are as follows:

[0103] 1. Open Wireshark, select ˋFileˋ > ˋOpenˋ, and then select the ˋ.pcapˋ file.

[0104] 2. Use the filter of Wireshark to view TCP packets:

[0105] 3. Select the packet of interest to view the detailed information pane.

[0106] 4. Look for source / destination addresses, ports, and other related information in the "IP" or "IPv6" and "TCP" or "UDP" layers.

[0107] 5. Export specific fields: Select "File" > "Export Packet Decryption" > "For CSV"; In the Export dialog, select the fields you need.

[0108] Based on the first embodiment and the second embodiment of the present application, in the third embodiment of the present application, the same or similar contents as the above embodiments can be referred to the above description, and the subsequent will not be described in detail. On this basis, please refer to Figure 3 , before step S10, the network anomaly detection method further comprises steps S01-S104:

[0109] Step S01, obtaining historical network data flowing through the switch;

[0110] Step S02, extracting the basic features of historical IPv6 data and historical IPv4 data and the unique features of IPv6 data from the historical network data;

[0111] Step S03, identifying the unique abnormal properties of the historical IPv6 data from the unique features;

[0112] Step S04, training an isolation forest model based on the unique abnormal properties and the basic features to obtain a preset detection model.

[0113] It should be noted that the unique features include extension header features and address features. The abnormal properties can be the type and order of the extension header, and the composition and allocation mode of the address.

[0114] It can be understood that the detection model is trained using the isolation forest, which continuously learns and updates the detection model online, adapts to the changes of network behavior, and detects the attack means of IPv6 based on the IPv6 address allocation and authentication mechanism, wherein the attack means of IPv6-specific extension header utilization and address spoofing are detected.

[0115] In specific implementation, since the abnormal points are generally rare and different, the abnormal points are more easily isolated. Therefore, the detection model can be trained using the isolation forest. That is, during training, the features related to network data are selected and extracted: source / destination addresses, ports, protocol types, traffic sizes, and packet lengths. Then, the historical network data (containing normal and abnormal traffic samples) is used to train the isolation forest model. In the isolation forest, the number of trees and the size of the sub-sample are key parameters, and the optimal parameters are selected through cross-validation. The isolation forest model after model training can be used to evaluate the abnormality degree of network data.

[0116] Further, step S3 can further include:

[0117] identifying the extension header type, the extension header order, the address constitution and the allocation mode of the historical IPv6 data from the unique characteristics;

[0118] identifying the abnormal type from the extension header type, the abnormal order from the extension header order, the abnormal address from the address constitution and the abnormal mode from the allocation mode;

[0119] obtaining the unique abnormal attributes of the historical IPv6 based on the abnormal type, the abnormal order, the abnormal address and the abnormal mode.

[0120] It can be understood that in order to accurately identify the abnormalities in the IPv6 data, it is necessary to extract the extension header type, the extension header order, the address constitution and the allocation mode in the IPv6 data to accurately determine the characteristics of the IPv6 data, so that the detection model trained based on the historical IPv6 data can accurately identify the attack data of the IPv6 data type in the real-time network data.

[0121] For the purpose of understanding the implementation process of the network anomaly detection method obtained after combining the above-mentioned embodiment one, an example is provided as follows: Figure 4 , Figure 4 A brief flowchart of a network anomaly detection method is provided, and specifically:

[0122] Step S1: deploying a dual-stack traffic capture device in the network using a network probe supporting IPv6 and IPv4, capturing all data packets entering and exiting the network, and classifying different protocol types;

[0123] Step S2: extracting key features of the data packets and analyzing extension header information of the IPv6 data packets; wherein the extracted key features include source / destination address, port, protocol type, traffic size, packet length;

[0124] Step S3: modeling the normal behavior of the network using historical data to form a baseline, identifying the normal mode of network behavior through statistics; comparing the network traffic with the baseline model in real time to identify abnormal behavior, and applying deep packet inspection and time series analysis to monitor the dynamics of network traffic;

[0125] Step S4: training a detection model using isolation forest, continuously learning and updating the detection model online to adapt to changes in network behavior, and detecting IPv6 attack methods based on IPv6 address allocation and authentication mechanisms, wherein the detection is performed on IPv6-specific extension header utilization and address spoofing attack methods;

[0126] Step S5, based on real-time flow monitoring analysis IPv4 and IPv6 traffic to determine whether there is a cross-protocol attack, when the cross-protocol attack is identified, the dynamic access control and flow filtering strategy is executed, the system triggers the predefined response operation according to the detected abnormal event, the corresponding response action of the response operation includes: traffic isolation, blocking attack source and adjusting access control list.

[0127] Step S6, the performance of the detection system is continuously monitored, and the software patch and threat intelligence database of the system are regularly updated to adapt to new threats and attack means.

[0128] Optionally, when establishing the update strategy, in order to better regularly update the software patch and threat intelligence database of the system, the strategy including frequency, responsibility allocation and rollback plan is determined to update, including update frequency (the update frequency of the software patch and the threat intelligence database can be daily, weekly or monthly), responsible personnel (designated team or individual responsible for monitoring update notification, performing update operation and verifying update result), test and verification (test in a isolated test environment before updating) and rollback plan.

[0129] It should be noted that the above examples are only for understanding the present application and do not constitute a limitation on the network anomaly detection method of the present application, and more forms of simple transformation based on this technical concept are within the protection scope of the present application.

[0130] The present application also provides a network anomaly detection system, referring to Figure 5 , the network anomaly detection system comprises a network server, a switch and a capture device;

[0131] The network server is used to implement the above method steps;

[0132] The switch is used to exchange network data of any two network nodes;

[0133] The capture device can be a module arranged in the network server to capture network flow through the switch, and the capture device supports IPv4 and IPv6 type data at the same time, so as to ensure that all IPv4 and IPv6 type data can be captured.

[0134] The present application also provides a network anomaly detection device, referring to Figure 6 , the network anomaly detection device comprises:

[0135] The judgment module 10 is used to judge whether the real-time network data flowing through the switch is abnormal;

[0136] The detection module 20 is configured to input the real-time network data into a preset detection model to determine an abnormal type and an abnormal point of the real-time network data if it is determined that the real-time network data is abnormal, wherein the preset detection model is obtained by training an isolation forest model based on historical network data of IPv6 and IPv4.

[0137] The identification module 30 is configured to identify an attack mode existing in the real-time network data based on the abnormal type and the abnormal point.

[0138] Optionally, the judgment module 10 is further configured to capture real-time network data flowing through a switch, perform TCP classification on the real-time network data, divide the real-time network data into IPv4 data and / or IPv6 data, compare the IPv4 data and / or the IPv6 data based on a preset baseline model to determine whether there is an abnormality in the IPv4 data and / or the IPv6 data, and obtain the preset baseline model by training a clustering model based on historical IPv4 data and historical IPv6 data flowing through the switch.

[0139] Optionally, the judgment module 10 is further configured to extract basic features from the IPv4 data and the IPv6 data based on a preset baseline model if the real-time network data includes the IPv4 data and the IPv6 data, and extract extension header features from the IPv6 data; compare the basic features and the extension header features with normal features in the preset baseline model respectively to determine whether there is an abnormality in the IPv4 data and / or the IPv6 data.

[0140] Optionally, the identification module 30 is further configured to perform content analysis and behavior analysis on abnormal data corresponding to the abnormal point based on a preset DPI, determine a traffic mode of the IPv4 data and the IPv6 data, compare the traffic mode with a preset baseline mode, and identify an attack mode of the real-time network data.

[0141] Optionally, the judgment module 10 is further configured to obtain historical network data flowing through the switch, extract basic features of historical IPv6 data and historical IPv4 data and unique features of IPv6 data from the historical network data, identify unique abnormal attributes of the historical IPv6 data from the unique features, and train an isolation forest model based on the unique abnormal attributes and the basic features to obtain a preset detection model.

[0142] Optionally, the judging module 10 is further configured to identify an extension header type, an extension header sequence, an address structure and an allocation mode of the historical IPv6 data from the unique features; identify an abnormal type from the extension header type, identify an abnormal sequence from the extension header sequence, identify an abnormal address from the address structure, and identify an abnormal mode from the allocation mode; and obtain unique abnormal attributes of the historical IPv6 based on the abnormal type, the abnormal sequence, the abnormal address and the abnormal mode.

[0143] The network anomaly detection device provided in the present application adopts the network anomaly detection method in the above embodiments, and can solve the technical problem that network security cannot be comprehensively monitored and evaluated in a dual stack network environment, resulting in poor detection effect of network security. Compared with the prior art, the network anomaly detection device provided in the present application has the same beneficial effects as the network anomaly detection method provided in the above embodiments, and other technical features in the network anomaly detection device are the same as the features disclosed in the above embodiments, which will not be repeated here.

[0144] The present application provides a network anomaly detection device, which comprises at least one processor and a memory connected with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the network anomaly detection method in the above embodiment one.

[0145] Reference will be made to the following description Figure 7 which shows a structural schematic diagram of a network anomaly detection device suitable for implementing the embodiments of the present application. The network anomaly detection device in the embodiments of the present application can include but is not limited to mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (Personal Digital Assistant), PADs (Portable Application Description), PMPs (Portable Media Player), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), and the like, and fixed terminals such as digital TVs, desktop computers, and the like. Figure 7 The network anomaly detection device shown is only an example, and should not bring any limitation to the functions and use range of the embodiments of the present application.

[0146] As Figure 7As shown, the network anomaly detection device can include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.) that can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 1002 or loaded from a storage device 1003 into a random access memory (RAM) 1004. Various programs and data required for the operation of the network anomaly detection device are also stored in the RAM 1004. The processing device 1001, the ROM 1002, and the RAM 1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; the storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the network anomaly detection device to communicate wirelessly or wired with other devices to exchange data. Although the network anomaly detection device with various systems is shown in the figure, it should be understood that all the shown systems are not required to be implemented or possessed. More or less systems can be alternatively implemented or possessed.

[0147] In particular, according to embodiments of the present disclosure, the processes described above with reference to the flowcharts can be implemented as a computer software program. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network by a communication device, or installed from the storage device 1003, or installed from the ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the methods of the embodiments of the present disclosure are performed.

[0148] The network anomaly detection device provided by the present disclosure adopts the network anomaly detection method in the above-mentioned embodiments, and can solve the technical problem that network security cannot be comprehensively monitored and evaluated in a dual-stack network environment, resulting in poor detection effect of network security. Compared with the prior art, the network anomaly detection device provided by the present disclosure has the same beneficial effects as the network anomaly detection method provided by the above-mentioned embodiments, and other technical features in the network anomaly detection device are the same as the features disclosed in the previous embodiment method, which will not be repeated here.

[0149] It should be understood that various aspects of the disclosure can be implemented in hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any appropriate manner in any one or more embodiments or examples.

[0150] The above description is merely illustrative of the application and is not intended to limit the scope of the application. Any variations and modifications that can be made by any person skilled in the art within the spirit and scope of the application are intended to be encompassed by the application. Therefore, the scope of the application should be determined by the appended claims.

[0151] The application provides a computer readable storage medium having stored thereon computer readable program instructions (i.e., a computer program) for performing the network anomaly detection method in the above embodiments.

[0152] The computer readable storage medium provided by the application may, for example, be a U disk, but is not limited to an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, system, or device, or any combination thereof. More specific examples of the computer readable storage medium can include, but are not limited to, an electrical connection having one or more conductive wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any appropriate combination of the above. In the present embodiment, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer readable storage medium can be transmitted in any appropriate medium, including but not limited to an electrical wire, an optical cable, an RF (Radio Frequency) cable, etc., or any appropriate combination thereof.

[0153] The above computer readable storage medium can be included in the network anomaly detection device, or can exist separately without being assembled into the network anomaly detection device.

[0154] The computer readable storage medium described above carries one or more programs, when the one or more programs are executed by the network anomaly detection device, the network anomaly detection device is caused to: determine whether real-time network data flowing through the switch is abnormal; if it is determined that the real-time network data is abnormal, input the real-time network data into a preset detection model to determine an abnormal type and an abnormal point of the real-time network data, the preset detection model being obtained by training an isolation forest model using historical network data of IPv6 and IPv4; and identify an attack mode existing in the real-time network data based on the abnormal type and the abnormal point.

[0155] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0156] The computer program instructions can also be loaded onto a computer or other programmable information processing apparatus to cause a series of operations to be performed on the computer or other programmable information processing apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable information processing apparatus implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0157] The modules described in the embodiments of the present application can be implemented in the form of software or in the form of hardware. In some cases, the name of the module does not constitute a limitation on the module itself.

[0158] The readable storage medium provided by the present application is a computer readable storage medium, which stores computer readable program instructions (i.e., a computer program) for executing the network anomaly detection method described above, and can solve the technical problem that network security cannot be comprehensively monitored and evaluated in a dual stack network environment, resulting in poor detection effect of network security. Compared with the prior art, the computer readable storage medium provided by the present application has the same beneficial effects as the network anomaly detection method provided by the above embodiments, and will not be described here.

[0159] The present application also provides a computer program product comprising a computer program, which, when executed by a processor, implements the steps of the network anomaly detection method as described above.

[0160] The computer program product provided by the present application can solve the technical problem that network security cannot be comprehensively monitored and evaluated in a dual stack network environment, resulting in poor detection effect of network security. Compared with the prior art, the computer program product provided by the present application has the same beneficial effects as the network anomaly detection method provided by the above embodiments, and will not be described here.

[0161] The above only describes some embodiments of the present application, and does not limit the patent scope of the present application. Any equivalent structural transformation, direct / indirect application in other related technical fields based on the technical concept of the present application, and the contents of the present application specification and drawings are included in the patent protection scope of the present application.

Claims

1. A network anomaly detection method, characterized by, The method comprises: acquiring historical network data flowing through the switch; extracting basic features of historical IPv6 data and historical IPv4 data and unique features of IPv6 data from the historical network data; wherein the step of extracting basic features of historical IPv6 data and historical IPv4 data and unique features of IPv6 data from the historical network data comprises: identifying extension header types, extension header sequences, address structures and allocation modes of the historical IPv6 data from the unique features; identifying abnormal types from the extension header types, abnormal sequences from the extension header sequences, abnormal addresses from the address structures, and abnormal modes from the allocation modes; obtaining unique abnormal attributes of the historical IPv6 data based on the abnormal types, the abnormal sequences, the abnormal addresses and the abnormal modes; identifying the unique abnormal attributes of the historical IPv6 data from the unique features; training an isolation forest model based on the unique abnormal attributes and the basic features to obtain a preset detection model; determining whether real-time network data flowing through the switch is abnormal; if it is determined that the real-time network data is abnormal, inputting the real-time network data into the preset detection model to determine an abnormal type and an abnormal point of the real-time network data, wherein the preset detection model is obtained by training an isolation forest model based on historical IPv6 and IPv4 network data; identifying an attack mode existing in the real-time network data based on the abnormal type and the abnormal point.

2. The method of claim 1, wherein, The step of determining whether real-time network data flowing through the switch is abnormal comprises: capturing real-time network data flowing through the switch; performing TCP classification on the real-time network data to divide the real-time network data into IPv4 data and / or IPv6 data; comparing the IPv4 data and / or the IPv6 data based on a preset baseline model to determine whether there is an abnormality in the IPv4 data and / or the IPv6 data, wherein the preset baseline model is obtained by training a clustering model based on historical IPv4 data and historical IPv6 data flowing through the switch.

3. The method of claim 2, wherein, The step of comparing the IPv4 data and / or the IPv6 data based on the preset baseline model to determine whether there is an abnormality in the IPv4 data and / or the IPv6 data comprises: if the IPv4 data and the IPv6 data exist in the real-time network data, extracting basic features from the IPv4 data and the IPv6 data based on a preset baseline model, and extracting extension header features from the IPv6 data; comparing the basic features and the extension header features with normal features in the preset baseline model respectively to determine whether there is an abnormality in the IPv4 data and / or the IPv6 data.

4. The method of any one of claims 1 to 3, wherein, The step of identifying an attack mode existing in the real-time network data based on the abnormal type and the abnormal point comprises: The preset DPI is used for content analysis and behavior analysis on the abnormal data corresponding to the abnormal point, to determine a traffic mode of the IPv4 data and the IPv6 data; The traffic mode is compared with a preset baseline mode to identify an attack mode of the real-time network data.

5. A network anomaly detection apparatus characterized by comprising: The device comprises: a judgment module configured to judge whether the real-time network data flowing through the switch is abnormal; and / or, the judgment module is further configured to: acquire historical network data flowing through the switch; extract basic features of historical IPv6 data and historical IPv4 data and unique features of the IPv6 data from the historical network data, identify unique abnormal attributes of the historical IPv6 data from the unique features, train an isolation forest model based on the unique abnormal attributes and the basic features, and obtain a preset detection model; and / or, the judgment module is further configured to: identify an extension header type, an extension header sequence, an address structure, and an allocation mode of the historical IPv6 data from the unique features, identify an abnormal type from the extension header type, identify an abnormal sequence from the extension header sequence, identify an abnormal address from the address structure, and identify an abnormal mode from the allocation mode, and obtain the unique abnormal attributes of the historical IPv6 data based on the abnormal type, the abnormal sequence, the abnormal address, and the abnormal mode; a detection module configured to input the real-time network data into the preset detection model to determine an abnormal type and an abnormal point of the real-time network data if it is determined that the real-time network data is abnormal, the preset detection model being obtained by training an isolation forest model using historical network data of IPv6 and IPv4; an identification module configured to identify an attack mode existing in the real-time network data based on the abnormal type and the abnormal point.

6. A network anomaly detection device, characterized by, The device comprises a memory, a processor, and a computer program stored on the memory and executable on the processor, and the computer program is configured to implement the steps of the network anomaly detection method according to any one of claims 1 to 4.

7. A storage medium, characterized by The storage medium is a computer-readable storage medium, and the storage medium stores a computer program, and the computer program is executed by the processor to implement the steps of the network anomaly detection method according to any one of claims 1 to 4.

8. A computer program product, characterised in that, The computer program product comprises a computer program, and the computer program is executed by the processor to implement the steps of the network anomaly detection method according to any one of claims 1 to 4.

Images