Network protocol IP address blocking processing method and apparatus, and electronic device

Abstract

The invention provides a network protocol IP address blocking processing method and device and electronic equipment, and relates to the technical field of network security. The method comprises the following steps: determining occurrence probabilities of network attacks belonging to different alarm levels by adopting a naive Bayes threat analysis model under the condition of determining that the network attacks exist in a network system accessed to a plugging processing system; under the condition that the alarm level corresponding to the maximum occurrence probability is a target alarm level, determining a target firewall for executing IP address blocking based on an attack source IP address and an attack destination IP address corresponding to the network attack, and generating a corresponding target blocking instruction based on the attack source IP address and a blocking instruction generation template of the target firewall; and the target blocking instruction is sent to the target firewall, and the target blocking instruction is used for the target firewall to carry out blocking processing on the attack source IP address, so that blocking processing can be carried out on the IP address with high efficiency and high accuracy, and the security of the network is effectively improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device and electronic device for blocking a network protocol IP address. Background Art

[0002] Firewall policy blocking is an important means to ensure network security. It mainly blocks Internet Protocol (IP) addresses, which can effectively reduce the occupation of network resources by malicious traffic and reduce the risk of network attacks, so as to achieve the purpose of protecting network security.

[0003] At present, when blocking IP addresses, it is usually the operation and maintenance engineers who determine the risk level of the IP addresses and manually edit the policy scripts to implement the blocking of IP addresses. However, during the period of re-security or network protection, the manual method cannot achieve the high efficiency and high accuracy of blocking requirements, and may even cause network interruption, and fail to achieve the security purpose of immediate blocking.

[0004] Therefore, how to efficiently and accurately block IP addresses to improve network security is a technical problem that technical personnel in this field urgently need to solve. Summary of the invention

[0005] The present application provides a method, device and electronic device for blocking a network protocol IP address, which can block the IP address with high efficiency and accuracy, thereby effectively improving the security of the network.

[0006] The present application provides a method for blocking an IP address of a network protocol, which is applied to an electronic device, wherein a blocking processing system is integrated in the electronic device, and the method includes: In the case where it is determined that a network system connected to the blocking processing system has a network attack, a naive Bayes threat analysis model is used to determine the probability of the network attack belonging to different alarm levels; In the case where the alarm level corresponding to the maximum probability of occurrence is the target alarm level, based on the attack source IP address and the attack destination IP address corresponding to the network attack, a target firewall for performing IP address blocking is determined, and a blocking instruction generation template is generated based on the attack source IP address and the target firewall to generate a corresponding target blocking instruction; The target blocking instruction is sent to the target firewall, where the target blocking instruction is used by the target firewall to block the attack source IP address.

[0007] According to a method for blocking a network protocol IP address provided by the present application, the naive Bayes threat analysis model is used to determine the probability of occurrence of the network attack belonging to different warning levels, including: For each alarm level, the naive Bayes threat analysis model is used to determine, based on the characteristics of multiple preset network attacks, the relationship between the network attack types corresponding to each of the preset network attacks and the alarm level, a first probability of the occurrence of the alarm level, a second probability of the occurrence of the network attack at the alarm level, a third probability of the occurrence of the network attack type corresponding to the network attack at the alarm level, a fourth probability of the occurrence of the network attack, and a fifth probability of the occurrence of the network attack type; Based on the first probability, the second probability, the third probability, the fourth probability and the fifth probability, a probability of occurrence of the network attack belonging to a warning level is determined.

[0008] According to a method for blocking a network protocol IP address provided by the present application, determining the probability of the network attack belonging to the warning level based on the first probability, the second probability, the third probability, the fourth probability and the fifth probability includes: determining a first product of the first probability, the second probability, and the third probability; determining a second product of the fourth probability and the fifth probability; Based on the ratio of the first product to the second product, a probability of occurrence of the network attack belonging to an alarm level is determined.

[0009] According to a method for blocking a network protocol IP address provided by the present application, the blocking instruction generation template based on the attack source IP address and the target firewall generates a corresponding target blocking instruction, including: Based on the historical blocking processing data of the blocking processing system, determining whether the network attack is a network attack that is blocked for the first time; In the case where it is determined that the network attack is not the first time that the network attack is blocked, based on the maximum occurrence probability and the target historical blocking processing data of the network system, determine the target blocking duration corresponding to the network attack; The target blocking instruction is generated based on the target blocking duration, the attack source IP address and the blocking instruction generation template.

[0010] According to a blocking processing method for a network protocol IP address provided by the present application, the target historical blocking processing data includes the source alarm level of the network attack, the number of historical blocking processing times, the security level, the location of the attack source IP address and the historical average blocking duration; The determining, based on the maximum occurrence probability and the target historical blocking processing data of the network system, the target blocking duration corresponding to the network attack includes: Determine a first weight corresponding to the network attack based on the source alarm level, the number of historical blocking processes, the security level, the location of the attack source IP address, and the historical average blocking duration; Based on the maximum occurrence probability, determining a second weight corresponding to the network attack; The target blocking duration is determined based on the first weight, the second weight, and a basic blocking duration.

[0011] According to a method for blocking a network protocol IP address provided by the present application, determining the target blocking duration based on the first weight, the second weight and the basic blocking duration includes: determining a weight sum of the first weight and the second weight; The product of the weight sum and the basic blocking duration is determined as the target blocking duration.

[0012] The present application also provides a blocking processing device for an Internet Protocol (IP) address, which is applied to an electronic device, wherein a blocking processing system is integrated in the electronic device, and the device comprises: A first processing unit is used to determine the probability of the network attack belonging to different alarm levels by using a naive Bayes threat analysis model when it is determined that the network system connected to the blocking processing system has a network attack; A second processing unit is used to determine a target firewall for performing IP address blocking based on an attack source IP address and an attack destination IP address corresponding to the network attack when the alarm level corresponding to the maximum probability of occurrence is a target alarm level, and to generate a corresponding target blocking instruction based on a blocking instruction generation template of the attack source IP address and the target firewall; A sending unit is used to send the target blocking instruction to the target firewall, and the target blocking instruction is used by the target firewall to block the attack source IP address.

[0013] The present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method for blocking the network protocol IP address as described in any one of the above is implemented.

[0014] The present application also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the blocking processing method of the network protocol IP address as described in any one of the above is implemented.

[0015] The present application also provides a computer program product, including a computer program, which, when executed by a processor, implements any of the above-described methods for blocking a network protocol IP address.

[0016] The method, device and electronic device for blocking the network protocol IP address provided by the present application use a naive Bayes threat analysis model to determine the probability of network attacks belonging to different alarm levels when it is determined that a network system connected to the blocking processing system has a network attack; when the alarm level corresponding to the maximum probability of occurrence is the target alarm level, based on the attack source IP address and the attack destination IP address corresponding to the network attack, a target firewall for performing IP address blocking is determined, and a blocking instruction generation template is generated based on the attack source IP address and the target firewall to generate a corresponding target blocking instruction; the target blocking instruction is sent to the target firewall, and the target blocking instruction is The target firewall is used to block the attack source IP address. In this way, the naive Bayes threat analysis model is adopted to automatically determine the probability of network attacks belonging to different alarm levels, and a template is generated based on the attack source IP address and the blocking instruction of the target firewall to automatically generate the corresponding target blocking instruction for blocking the attack source IP address, thereby realizing the automatic blocking of IP addresses. Compared with the prior art that requires operation and maintenance engineers to judge the risk level of IP addresses and manually edit policy scripts to achieve IP address blocking, it can block IP addresses efficiently and accurately, thereby effectively improving the security of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the present application or the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0018] Figure 1 A flowchart of a method for blocking a network protocol IP address provided in an embodiment of the present application.

[0019] Figure 2 A flowchart for determining the occurrence probability of network attacks belonging to different alarm levels is provided in an embodiment of the present application.

[0020] Figure 3 A schematic diagram of a flow chart for generating corresponding target blocking instructions provided in an embodiment of the present application.

[0021] Figure 4A schematic diagram of a framework for determining a target blocking duration provided in an embodiment of the present application.

[0022] Figure 5 A schematic diagram of the structure of a blocking processing device for a network protocol IP address provided in an embodiment of the present application.

[0023] Figure 6 A schematic diagram of the physical structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be clearly and completely described below in conjunction with the drawings in this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0025] In the embodiments of the present application, "at least one" means one or more, and "more" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. In the text description of the present application, the character " / " generally indicates that the associated objects before and after are in an "or" relationship.

[0026] The technical solution provided by the embodiment of the present application can be adapted to the scenario of ensuring network security. In recent years, with the continuous growth of enterprise infrastructure and user scale, major enterprises and operators are also facing challenges such as frequent large-scale DDos attacks on core network facilities and the spread of bad network content. In order to effectively ensure network security, firewall policy blocking is an important means, mainly through blocking IP addresses.

[0027] At present, when blocking IP addresses, it is usually the operation and maintenance engineers who determine the risk level of the IP addresses and manually edit the policy scripts to implement the blocking of IP addresses. However, during the period of re-security or network protection, the manual method cannot achieve the high efficiency and high accuracy of blocking requirements, and may even cause network interruption, and fail to achieve the security purpose of immediate blocking.

[0028] Therefore, how to efficiently and accurately block IP addresses to improve network security is a technical problem that technical personnel in this field urgently need to solve.

[0029] In order to efficiently and accurately block IP addresses to improve network security, the present application provides a method for blocking network protocol IP addresses. The following specific embodiments will be used to describe the method for blocking network protocol IP addresses provided by the present application in detail. It is understood that the following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0030] Figure 1 A flowchart of a method for blocking an IP address of a network protocol provided in an embodiment of the present application is applied to an electronic device, in which a blocking processing system is integrated. For example, see Figure 1 As shown, the blocking processing method of the network protocol IP address may include: S101. When it is determined that a network system connected to the blocking processing system is subject to a network attack, a naive Bayes threat analysis model is used to determine the probability of the network attack belonging to different alarm levels.

[0031] For example, when it is determined that a network attack has occurred in a network system, the security log of the network system can be extracted, and the security log can be cleaned, deduplicated, and standardized to remove noise and unnecessary information, and extract key fields, including event type, threat level, source IP address, target IP address, protocol type, source port number, and destination port number, so as to determine the threat level corresponding to the network attack, i.e., the alarm level, based on the extracted key fields.

[0032] For example, different warning levels may include: a low warning level, a medium warning level, and a high warning level, which may be set according to actual needs.

[0033] Taking the example that different alarm levels may include: low alarm level, medium alarm level and high alarm level, in an embodiment of the present application, when determining the alarm level of a network attack, a naive Bayes threat analysis model can be used to automatically determine the probability of occurrence of a network attack belonging to a low alarm level, a medium alarm level, and a high alarm level, and compare the sizes of these three occurrence probabilities, and determine the alarm level corresponding to the maximum occurrence probability as the alarm level of the network attack.

[0034] Assuming that for a network attack with a low warning level, no IP address blocking is required, while for a network attack with a medium warning level or a high warning level, IP address blocking is required. Therefore, after determining the warning level of the network attack, the warning level corresponding to the maximum probability of occurrence is further determined, that is, whether the warning level of the network attack is the target warning level. For example, the target warning level is the medium warning level or the high warning level, and when it is determined that the warning level of the network attack is the target warning level, the following S102 is executed: S102. When the alarm level corresponding to the maximum probability of occurrence is the target alarm level, based on the attack source IP address and the attack destination IP address corresponding to the network attack, determine the target firewall for performing IP address blocking, and generate a template for blocking instructions based on the attack source IP address and the target firewall to generate the corresponding target blocking instructions.

[0035] For example, when determining the target firewall for performing IP address blocking based on the attack source IP address and the attack destination IP address corresponding to the network attack, the risk access path of the attack source IP address and the attack destination IP address can be retrieved, and at least one firewall that needs to issue a blocking instruction is determined through path retrieval. The at least one firewall that needs to issue a blocking instruction is the target firewall.

[0036] After the target firewall is determined, the adaptation instruction information library of the target firewall can be retrieved, the blocking instruction generation template of the target firewall can be called, and the corresponding target blocking instruction can be jointly generated based on the attack source IP address and the blocking instruction generation template of the target firewall.

[0037] S103: Send a target blocking instruction to the target firewall, where the target blocking instruction is used by the target firewall to block the attack source IP address.

[0038] It can be seen that in the embodiment of the present application, when it is determined that there is a network attack on the network system connected to the blocking processing system, the naive Bayes threat analysis model is used to determine the probability of the network attack belonging to different alarm levels; when the alarm level corresponding to the maximum probability of occurrence is the target alarm level, based on the attack source IP address and the attack destination IP address corresponding to the network attack, the target firewall for performing IP address blocking is determined, and a blocking instruction generation template is generated based on the attack source IP address and the target firewall to generate a corresponding target blocking instruction; the target blocking instruction is sent to the target firewall, and the target blocking instruction is used by the target firewall to The attack source IP address is blocked. In this way, the naive Bayes threat analysis model is used to automatically determine the probability of network attacks belonging to different alarm levels, and a template is generated based on the attack source IP address and the blocking instruction of the target firewall. The corresponding target blocking instruction is automatically generated to block the attack source IP address, thereby realizing automatic blocking of IP addresses. Compared with the existing technology that requires operation and maintenance engineers to judge the risk level of IP addresses and manually edit policy scripts to achieve IP address blocking, it can block IP addresses efficiently and accurately, thereby effectively improving the security of the network.

[0039] Based on the above Figure 1 In the embodiment shown, in the above S101, when the naive Bayesian threat analysis model is used to determine the probability of network attacks belonging to different warning levels, refer to the following Figure 2 The embodiment shown.

[0040] Figure 2 A flow chart of determining the probability of occurrence of network attacks belonging to different warning levels provided in an embodiment of the present application may include: S201. For each alarm level, a naive Bayes threat analysis model is used to determine, based on the characteristics of multiple preset network attacks, the relationship between the network attack types corresponding to the preset network attacks and the alarm levels, a first probability of the occurrence of the alarm level, a second probability of the occurrence of the network attack at the alarm level, a third probability of the occurrence of the network attack type corresponding to the network attack at the alarm level, a fourth probability of the occurrence of the network attack, and a fifth probability of the occurrence of the network attack type.

[0041] For example, in the embodiment of the present application, assuming that the characteristics of multiple preset network attacks include scanning, vulnerability exploitation, webpage tampering, virus propagation, terminal compromise, large traffic, frp proxy, and data leakage, the relationship between the characteristics of multiple preset network attacks, the network attack types corresponding to each preset network attack, and the alarm level can be seen in the following Table 1: Table 1

[0042] The Naive Bayesian threat analysis model is a set of supervised learning algorithms based on the Bayesian theorem, which naively assumes that each pair of features is independent of each other. Given a category x and a related feature vector from y1 to yn, the Bayesian theorem states the following relationship: [Px|y1,…,yn=PxP(y1,…,yn|x)P(y1,…,yn)]

[0043] Using the naive assumption that each pair of features is independent of each other: [P(yi|x,y1,…,yi-1,yi+1,…yn)=P(yi|x)]

[0044] For all i, the above relationship can be simplified to: [Px|y1,…,yn=P(x)i=1nP(yi|x)P(y1,…,yn)]

[0045] Since P(y1,…,yn) is a constant in the given input, the following classification rule can be used: [Px|y1,…,yn∝P(x)inP(yi|x)]

[0046] [x=argmaxyP(x)i=1nP(yi|x)]

[0047] Use Maximum A Posteriori (MAP) to estimate P(y) and P(yi|x); the former is the relative frequency of category x in the training set.

[0048] Assuming that the network attack is a type of WEB attack with web page tampering characteristics, when determining the probability of the network attack at a certain alarm level, the naive Bayes threat analysis model can be used to calculate the probability of the network attack at each alarm level:

[0049] Among them, P(Y|X) represents the probability of occurrence of Y attack type under X feature, P(y) represents the probability of occurrence of the feature of Y attack type, and P(x|y) represents the probability of occurrence of X feature under Y attack type. It can be obtained:

[0050] According to the assumption of naive Bayes conditional independence, the two features of "webpage tampering" and "web attack" are independent. Therefore, the above formula can be transformed into:

[0051] Combined with the above description, taking the alarm level as a high alarm level as an example, it can be determined that the first probability of the high alarm level occurring is P (high level) = =0.63%, the second probability of web page tampering at a high warning level P (web page tampering | high level) = =1, the third probability of Web attack occurring at high warning level P(Web attack|high level) = =0.33%, the fourth probability of web page tampering P (web page tampering) = =0.13%, the fifth probability of a Web attack occurring P(Web attack) = 3 / 8 = 0.38%.

[0052] Taking the medium alarm level as an example, we can determine the first probability of the medium alarm level occurring P (medium) = =0.25%, the second probability of web page tampering at the medium warning level P (web page tampering | medium) = , the third probability of a Web attack occurring at a medium warning level P(Web attack|medium) = =0.33%, the fourth probability of web page tampering P (web page tampering) = =0.13%, the fifth probability of Web attack P (Web attack) = =0.38%.

[0053] Taking the medium alarm level as an example, we can determine the first probability of the low alarm level occurring P (low level) = , the second probability of web page tampering at a low warning level P (web page tampering | low level) = =1, the third probability of Web attack occurring at low warning level P(Web attack|low level) = =0.33%, the fourth probability of web page tampering P (web page tampering) = =0.13%, the fifth probability of Web attack P (Web attack) = =0.38%.

[0054] S202: Determine the probability of occurrence of a network attack at an alarm level based on the first probability, the second probability, the third probability, the fourth probability and the fifth probability.

[0055] For example, in an embodiment of the present application, when determining the probability of a network attack belonging to an alarm level based on a first probability, a second probability, a third probability, a fourth probability, and a fifth probability, the first product of the first probability, the second probability, and the third probability can be determined; and the second product of the fourth probability and the fifth probability can be determined; and then based on the ratio of the first product to the second product, the probability of a network attack belonging to an alarm level is determined.

[0056] Taking the high warning level as an example, based on the first probability, the second probability, the third probability, the fourth probability and the fifth probability, when determining that the probability of webpage tampering belongs to the high warning level, the probability of P (high level | webpage tampering × DDOS attack) can be calculated. , it is determined that the probability of web page tampering belonging to the high warning level is about 24%.

[0057] Taking the medium alarm level as an example, based on the first probability, the second probability, the third probability, the fourth probability and the fifth probability, when determining the probability of webpage tampering belonging to the medium alarm level, the probability of P (medium level | webpage tampering × DDOS attack) can be calculated. , it is determined that the probability of web page tampering belonging to the medium warning level is 0%.

[0058] Taking the low warning level as an example, based on the first probability, the second probability, the third probability, the fourth probability and the fifth probability, when determining that the probability of webpage tampering belongs to the low warning level, the probability of P (intermediate | webpage tampering × DDOS attack) can be calculated. , it is determined that the probability of web page tampering belonging to the low warning level is 0%.

[0059] In combination with the above description, the Naive Bayesian threat analysis model can be used to automatically determine the probability of web page tampering belonging to different alarm levels. By comparison, it can be seen that the probability of web page tampering belonging to the high alarm level is the highest. The high alarm level corresponding to the maximum probability is the alarm level of the web page tampering; and further based on the attack source IP address and the target firewall blocking instruction generation template, the corresponding target blocking instruction is automatically generated for blocking the attack source IP address, thereby realizing the automatic blocking of the IP address. Compared with the prior art that requires operation and maintenance engineers to judge the risk level of the IP address and manually edit the policy script to realize the blocking of the IP address, the IP address can be blocked efficiently and accurately, thereby effectively improving the security of the network.

[0060] Based on any of the above embodiments, in the above S102, when generating a template for a blocking instruction based on the attack source IP address and the target firewall and generating a corresponding target blocking instruction, refer to the following Figure 3 The embodiment shown.

[0061] Figure 3 A schematic diagram of a process for generating a corresponding target blocking instruction provided in an embodiment of the present application, the method may include: S301. Determine whether the network attack is the first network attack to be blocked based on the historical blocking processing data of the blocking processing system.

[0062] Among them, the historical blocking and processing data is the relevant data of network attacks that have been blocked and processed before.

[0063] When determining whether a network attack is the first time to be blocked based on the historical blocking processing data of the blocking processing system, if the network attack is the first time to be blocked, there is no need to set the blocking duration, and a template can be directly generated based on the attack source IP address and the blocking instruction to generate a target blocking instruction for blocking the attack source IP address; on the contrary, if the network attack is not the first time to be blocked, the target blocking duration corresponding to the network attack can be determined based on the maximum occurrence probability and the target historical blocking processing data of the network system to generate a target blocking instruction for blocking the attack source IP address, that is, execute the following S302, so that when generating the target blocking instruction, by distinguishing between the network attack that is the first time to be blocked and the network attack that is not the first time to be blocked, it is possible to flexibly implement blocking processing for different IP addresses, thereby improving the flexibility of IP address blocking processing, meeting the enterprise's differentiated handling capabilities for different security levels, scenarios, and events of the same attack source IP, and ensuring user network information security.

[0064] S302: When it is determined that the network attack is not the first time to be blocked, the target blocking duration corresponding to the network attack is determined based on the maximum occurrence probability and the target historical blocking processing data of the network system.

[0065] For example, in an embodiment of the present application, the target historical blocking processing data includes the source alarm level of the network attack, the number of historical blocking processing times, the security level, the attack source IP address location and the historical average blocking time, which can be set according to actual needs.

[0066] Taking the target historical blocking processing data including the source alarm level of the network attack, the number of historical blocking processing times, the security level, the attack source IP address attribution and the historical average blocking duration as an example, for example, in the embodiment of the present application, when determining the target blocking duration corresponding to the network attack based on the maximum occurrence probability and the target historical blocking processing data of the network system, refer to Figure 4 As shown, Figure 4 A framework diagram for determining a target blocking duration provided in an embodiment of the present application can determine a first weight corresponding to a network attack based on the source alarm level, the number of historical blocking processes, the security level, the location of the attack source IP address, and the historical average blocking duration; and determine a second weight corresponding to the network attack based on the maximum probability of occurrence; and then determine the target blocking duration based on the first weight, the second weight, and the basic blocking duration.

[0067] Among them, the value of the basic blocking time can be set according to actual needs. Here, the embodiment of the present application does not make further restrictions on the specific value of the basic blocking time.

[0068] For example, when determining the first weight corresponding to the network attack based on the source alarm level, historical blocking processing times, security level, attack source IP address location and historical average blocking duration, the sum of the weights corresponding to the source alarm level, historical blocking processing times, security level, attack source IP address location and historical average blocking duration can be determined, and the sum of the weights can be determined as the first weight corresponding to the network attack.

[0069] For example, when determining the second weight corresponding to the network attack based on the maximum probability of occurrence, the probability can be converted in percentage, and the maximum probability of occurrence can be converted into the corresponding weight, which is the second weight. For example, the probability of web page tampering belonging to the high warning level is about 24%, so through conversion, the second weight corresponding to the web page tampering can be obtained as 24 points.

[0070] For example, in an embodiment of the present application, when determining the target blocking duration based on the first weight, the second weight and the basic blocking duration, the sum of the weights of the first weight and the second weight can be determined first, and the sum of the weights can be recorded as the threat level, and the product of the threat level and the basic blocking duration can be determined as the target blocking duration.

[0071] Assuming that the first weight is 38 points based on the source alarm level, historical blocking processing times, security level, attack source IP address location and historical average blocking time, and the second weight is 24 points based on the maximum probability of occurrence, and the basic blocking time is 30 minutes, then the target blocking time corresponding to the network attack is: (38+24)*30=1860 minutes=31 hours, that is, the target blocking time is 31 hours.

[0072] S303: Generate a target blocking instruction based on the target blocking duration, the attack source IP address and the blocking instruction generation template.

[0073] It can be seen that when it is determined that the network attack is not the first time to be blocked, the target blocking duration corresponding to the network attack can be determined based on the maximum occurrence probability and the target historical blocking processing data of the network system; and a template is generated based on the target blocking duration, the attack source IP address and the blocking instruction to generate the target blocking instruction. In this way, the target blocking duration corresponding to the network attack is determined in combination with the target historical blocking processing data, and the corresponding target blocking instruction is automatically generated, thereby realizing the automatic blocking processing of the IP address. Compared with the prior art that requires operation and maintenance engineers to judge the risk level of the IP address and manually edit the policy script to realize the blocking processing of the IP address, it can block the IP address efficiently and accurately, thereby effectively improving the security of the network.

[0074] In addition, after the IP address of the network attack is blocked, the relevant attack characteristics and key information of the network attack can also be recorded. Among them, key information such as the attack source IP address, number of attacks, attack time, blocking processing action, security level, blocking duration, etc. are stored as learning samples for optimizing the naive Bayesian threat analysis model. Based on the optimized naive Bayesian threat analysis model, the target blocking duration is dynamically adjusted. The lower the threat weight, the shorter the corresponding target blocking duration. Conversely, the higher the threat weight, the longer the corresponding target blocking duration.

[0075] The following is a description of the blocking processing device for the network protocol IP address provided in the present application. The blocking processing device for the network protocol IP address described below and the blocking processing method for the network protocol IP address described above can be referenced to each other.

[0076] Figure 5 A schematic diagram of a blocking processing device for a network protocol IP address provided in an embodiment of the present application is applied to an electronic device, in which a blocking processing system is integrated. For example, see Figure 5 As shown, the blocking processing device 50 for the network protocol IP address may include: The first processing unit 501 is used to determine the probability of the network attack belonging to different alarm levels by using a naive Bayes threat analysis model when it is determined that the network system connected to the blocking processing system has a network attack; The second processing unit 502 is used to determine a target firewall for performing IP address blocking based on the attack source IP address and the attack destination IP address corresponding to the network attack when the alarm level corresponding to the maximum occurrence probability is the target alarm level, and generate a corresponding target blocking instruction based on the attack source IP address and the blocking instruction generation template of the target firewall; The sending unit 503 is used to send the target blocking instruction to the target firewall, where the target blocking instruction is used by the target firewall to block the attack source IP address.

[0077] For example, in the embodiment of the present application, the first processing unit 501 is used to determine the probability of occurrence of the network attack belonging to different warning levels by using a naive Bayes threat analysis model, including: For each alarm level, the naive Bayes threat analysis model is used to determine, based on the characteristics of multiple preset network attacks, the relationship between the network attack types corresponding to each of the preset network attacks and the alarm level, a first probability of the occurrence of the alarm level, a second probability of the occurrence of the network attack at the alarm level, a third probability of the occurrence of the network attack type corresponding to the network attack at the alarm level, a fourth probability of the occurrence of the network attack, and a fifth probability of the occurrence of the network attack type; Based on the first probability, the second probability, the third probability, the fourth probability and the fifth probability, a probability of occurrence of the network attack belonging to a warning level is determined.

[0078] For example, in the embodiment of the present application, the first processing unit 501 is used to determine the probability of the network attack belonging to the warning level based on the first probability, the second probability, the third probability, the fourth probability and the fifth probability, including: determining a first product of the first probability, the second probability, and the third probability; determining a second product of the fourth probability and the fifth probability; Based on the ratio of the first product to the second product, a probability of occurrence of the network attack belonging to an alarm level is determined.

[0079] For example, in the embodiment of the present application, the second processing unit 502 is used to generate a corresponding target blocking instruction based on the attack source IP address and the blocking instruction generation template of the target firewall, including: Based on the historical blocking processing data of the blocking processing system, determining whether the network attack is a network attack that is blocked for the first time; In the case where it is determined that the network attack is not the first time that the network attack is blocked, based on the maximum occurrence probability and the target historical blocking processing data of the network system, determine the target blocking duration corresponding to the network attack; The target blocking instruction is generated based on the target blocking duration, the attack source IP address and the blocking instruction generation template.

[0080] For example, in an embodiment of the present application, the target historical blocking processing data includes the source alarm level of the network attack, the number of historical blocking processing times, the security level, the IP address of the attack source and the historical average blocking duration; The second processing unit 502 is configured to determine the target blocking duration corresponding to the network attack based on the maximum occurrence probability and the target historical blocking processing data of the network system, including: Determine a first weight corresponding to the network attack based on the source alarm level, the number of historical blocking processes, the security level, the location of the attack source IP address, and the historical average blocking duration; Based on the maximum occurrence probability, determining a second weight corresponding to the network attack; The target blocking duration is determined based on the first weight, the second weight, and a basic blocking duration.

[0081] For example, in the embodiment of the present application, the second processing unit 502 is used to determine the target blocking duration based on the first weight, the second weight and the basic blocking duration, including: determining a weight sum of the first weight and the second weight; The product of the weight sum and the basic blocking duration is determined as the target blocking duration.

[0082] The network protocol IP address blocking processing device 50 provided in the embodiment of the present application can execute the technical solution of the network protocol IP address blocking processing method in any of the above-mentioned embodiments. Its implementation principle and beneficial effects are similar to the implementation principle and beneficial effects of the network protocol IP address blocking processing method. Please refer to the implementation principle and beneficial effects of the network protocol IP address blocking processing method, which will not be repeated here.

[0083] Figure 6 A schematic diagram of the physical structure of an electronic device provided in an embodiment of the present application, such as Figure 6 As shown, the electronic device may include: a processor 610, a communication interface 620, a memory 630 and a communication bus 640, wherein the processor 610, the communication interface 620 and the memory 630 communicate with each other through the communication bus 640. The processor 610 may call the logic instructions in the memory 630 to execute a blocking processing method for a network protocol IP address, the method comprising: in the case of determining that a network system connected to the blocking processing system has a network attack, using a naive Bayesian threat analysis model to determine the probability of the network attack belonging to different alarm levels; in the case that the alarm level corresponding to the maximum occurrence probability is the target alarm level, based on the attack source IP address and the attack destination IP address corresponding to the network attack, determining a target firewall for performing IP address blocking, and generating a corresponding target blocking instruction based on the attack source IP address and the blocking instruction generation template of the target firewall; sending the target blocking instruction to the target firewall, the target blocking instruction is used by the target firewall to block the attack source IP address.

[0084] In addition, the logic instructions in the above-mentioned memory 630 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0085] On the other hand, the present application also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the blocking processing method of the network protocol IP address provided by the above-mentioned methods, the method including: when it is determined that there is a network attack on the network system connected to the blocking processing system, using a naive Bayes threat analysis model to determine the probability of the network attack belonging to different alarm levels; when the alarm level corresponding to the maximum occurrence probability is the target alarm level, based on the attack source IP address and the attack destination IP address corresponding to the network attack, determine the target firewall for performing IP address blocking, and generate a blocking instruction template based on the attack source IP address and the target firewall to generate a corresponding target blocking instruction; send the target blocking instruction to the target firewall, and the target blocking instruction is used by the target firewall to block the attack source IP address.

[0086] On the other hand, the present application also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a blocking processing method for executing the network protocol IP address provided by the above-mentioned methods, the method comprising: in a case where it is determined that a network attack exists in a network system connected to the blocking processing system, using a naive Bayes threat analysis model to determine the probability of occurrence of the network attack belonging to different alarm levels; in a case where the alarm level corresponding to the maximum occurrence probability is the target alarm level, based on the attack source IP address and the attack destination IP address corresponding to the network attack, determining a target firewall for performing IP address blocking, and generating a blocking instruction template based on the attack source IP address and the target firewall to generate a corresponding target blocking instruction; sending the target blocking instruction to the target firewall, the target blocking instruction being used by the target firewall to perform blocking processing on the attack source IP address.

[0087] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0088] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0089] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for blocking an IP address of a network protocol, characterized in that: Applied to electronic equipment, the electronic equipment is integrated with a blocking processing system, and the method comprises: In the case where it is determined that a network system connected to the blocking processing system has a network attack, a naive Bayes threat analysis model is used to determine the probability of the network attack belonging to different alarm levels; In the case where the alarm level corresponding to the maximum probability of occurrence is the target alarm level, based on the attack source IP address and the attack destination IP address corresponding to the network attack, a target firewall for performing IP address blocking is determined, and a blocking instruction generation template is generated based on the attack source IP address and the target firewall to generate a corresponding target blocking instruction; The target blocking instruction is sent to the target firewall, where the target blocking instruction is used by the target firewall to block the attack source IP address.

2. The method for blocking an IP address according to claim 1, characterized in that: The naive Bayes threat analysis model is used to determine the probability of occurrence of the network attack belonging to different warning levels, including: For each alarm level, the naive Bayes threat analysis model is used to determine, based on the characteristics of multiple preset network attacks, the relationship between the network attack types corresponding to each of the preset network attacks and the alarm level, a first probability of the occurrence of the alarm level, a second probability of the occurrence of the network attack at the alarm level, a third probability of the occurrence of the network attack type corresponding to the network attack at the alarm level, a fourth probability of the occurrence of the network attack, and a fifth probability of the occurrence of the network attack type; Based on the first probability, the second probability, the third probability, the fourth probability and the fifth probability, a probability of occurrence of the network attack belonging to a warning level is determined.

3. The method for blocking an IP address according to claim 2, characterized in that: The determining, based on the first probability, the second probability, the third probability, the fourth probability, and the fifth probability, the probability of occurrence of the network attack belonging to the warning level includes: determining a first product of the first probability, the second probability, and the third probability; determining a second product of the fourth probability and the fifth probability; Based on the ratio of the first product to the second product, a probability of occurrence of the network attack belonging to an alarm level is determined.

4. The method for blocking an IP address according to any one of claims 1 to 3, characterized in that: The blocking instruction generation template based on the attack source IP address and the target firewall generates a corresponding target blocking instruction, including: Based on the historical blocking processing data of the blocking processing system, determining whether the network attack is a network attack that is blocked for the first time; In the case where it is determined that the network attack is not the first time that the network attack is blocked, based on the maximum occurrence probability and the target historical blocking processing data of the network system, determine the target blocking duration corresponding to the network attack; The target blocking instruction is generated based on the target blocking duration, the attack source IP address and the blocking instruction generation template.

5. The method for blocking an IP address according to claim 4, characterized in that: The target historical blocking processing data includes the source alarm level of the network attack, the number of historical blocking processing times, the security level, the IP address of the attack source and the historical average blocking duration; The determining, based on the maximum occurrence probability and the target historical blocking processing data of the network system, the target blocking duration corresponding to the network attack includes: Determine a first weight corresponding to the network attack based on the source alarm level, the number of historical blocking processes, the security level, the location of the attack source IP address, and the historical average blocking duration; Based on the maximum occurrence probability, determining a second weight corresponding to the network attack; The target blocking duration is determined based on the first weight, the second weight, and a basic blocking duration.

6. The method for blocking an IP address according to claim 5, characterized in that: The determining the target blocking duration based on the first weight, the second weight and the basic blocking duration includes: determining a weight sum of the first weight and the second weight; The product of the weight sum and the basic blocking duration is determined as the target blocking duration.

7. A blocking processing device for an Internet Protocol (IP) address, characterized in that: Applied to electronic equipment, the electronic equipment is integrated with a blocking processing system, and the device comprises: A first processing unit is used to determine the probability of the network attack belonging to different alarm levels by using a naive Bayes threat analysis model when it is determined that the network system connected to the blocking processing system has a network attack; A second processing unit is used to determine a target firewall for performing IP address blocking based on an attack source IP address and an attack destination IP address corresponding to the network attack when the alarm level corresponding to the maximum probability of occurrence is a target alarm level, and to generate a corresponding target blocking instruction based on a blocking instruction generation template of the attack source IP address and the target firewall; A sending unit is used to send the target blocking instruction to the target firewall, and the target blocking instruction is used by the target firewall to block the attack source IP address.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method for blocking the network protocol IP address as described in any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for blocking an Internet protocol IP address as described in any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method for blocking an Internet protocol IP address as described in any one of claims 1 to 6 is implemented.

Images