Neighbor IP determination method and device, electronic equipment and storage medium

Abstract

The invention discloses a neighbor IP determination method and device, electronic equipment and a storage medium, and belongs to the technical field of network security. In the method, each known malicious IP corresponding to the same attack source is taken as a reference IP, and a network flow of the reference IP in a collection time period is divided into a front network flow, a middle network flow and a rear network flow in a time window adding mode; if the state of the rear network flow is different from that of the front network flow and the state of the rear network flow is the same as that of the rear network flow of the reference IP in the previous collection time period, remote IPs corresponding to the middle network flow and the middle network flow of the reference IP in the previous collection time period are determined to be suspected cause IPs, and if the number of times that any remote IP is determined to be the suspected cause IP exceeds a first preset number of times, the remote IP is determined to be the suspected cause IP. If not, the remote IP can be determined to be the cause IP causing the state transmission change of the reference IP, and then the remote IP is determined to be the neighbor IP of the reference IP, so that the range of the neighbor IP with unknown security is narrowed.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, electronic device and storage medium for determining a neighbor IP. Background Art

[0002] Recently, there are more and more types of cyber attacks, and the complexity and secrecy of the attacks are getting higher and higher. Take Advanced Persistent Threat (APT) as an example. APT is a cyber attack strategy that is usually adopted by state-sponsored hackers or other highly organized criminal groups. APT attacks are characterized by high complexity and secrecy, and attackers have sufficient resources and time to plan and execute attacks.

[0003] In the related technology, when multiple malicious IPs corresponding to an attack source are known, the information interaction between each malicious IP and other IPs is relied on to identify the multi-layer neighbor IPs of the malicious IP, and then the known safe IP set and the known malicious IP set are used to remove the known safe IPs and the known malicious IPs from the multi-layer neighbor IPs to obtain the neighbor IPs of the malicious IP whose security is unknown. Then, the network topology diagram is constructed with all the neighbor IPs whose security is unknown, and then the unknown malicious IP corresponding to the attack source is found from the topology diagram. However, this method has certain limitations and false positives, because some services, such as public services, may be mistakenly identified as malicious IPs due to their extensive connectivity, resulting in inaccurate analysis results. Summary of the invention

[0004] The embodiments of the present application provide a method, device, electronic device and storage medium for determining a neighbor IP, so as to solve the problem of high false alarm rate when searching for a neighbor IP of a malicious IP whose security is unknown in the related art.

[0005] In a first aspect, an embodiment of the present application provides a method for determining a neighbor IP, including:

[0006] Obtain multiple known malicious IPs corresponding to the same attack source, take each known malicious IP as a reference IP, and obtain the network flow of the reference IP within a collection time period;

[0007] By adding a time window, the network flow is divided into a front network flow, a middle network flow and a rear network flow;

[0008] If it is determined that the state of the rear network flow is different from that of the front network flow, and the state of the rear network flow is the same as that of the rear network flow of the reference IP in the previous collection time period, the remote IP corresponding to both the middle network flow and the middle network flow of the reference IP in the previous collection time period is determined as the suspected cause IP that is suspected of causing the state transmission change of the reference IP;

[0009] If any remote IP is determined as a suspected cause IP more than a first preset number of times, the remote IP is determined to be the cause IP causing the state transmission change of the reference IP, and the remote IP is determined as a neighbor IP of the reference IP.

[0010] In some embodiments, it also includes:

[0011] If it is determined that the state of the subsequent network flow is the same as that of the previous network flow, the remote IP corresponding to the intermediate network flow and the reference IP in the intermediate network flow of the previous collection time period is determined as a non-suspected cause IP;

[0012] If the number of times any remote IP is determined as a non-suspected IP exceeds a second preset number, the remote IP is determined as a safe IP.

[0013] In some embodiments, the state of any network flow includes parameter values ​​of multiple network parameters, and whether the state of the subsequent network flow is different from the state of the previous network flow is determined according to the following steps:

[0014] Floating the parameter value of each network parameter of the previous network flow to obtain the parameter value range of the network parameter;

[0015] Determine the network parameter types that do not fall within the corresponding parameter value range among the parameter values ​​of the subsequent network flow;

[0016] If the number of network parameter types is greater than a specified number, it is determined that the state of the subsequent network flow is different from that of the previous network flow; otherwise, it is determined that the state of the subsequent network flow is the same as that of the previous network flow.

[0017] In some embodiments, it also includes:

[0018] Selecting a flow to be queried from the network flows;

[0019] Taking the flow characterization data of the flow to be queried as an event and the flow characterization data of N flows in the network flow that are located before the flow to be queried as conditional events, querying the probability of occurrence of the event under the conditional event from a priori probability table, wherein the priori probability table is pre-established based on the historical network flow of the reference IP, and N is an integer greater than zero;

[0020] If the occurrence probability is less than a preset value, or no occurrence probability is found, the flow to be queried is determined to be a low-probability flow, and the remote IP corresponding to the flow to be queried is determined as a neighbor IP of the reference IP.

[0021] In some embodiments, it also includes:

[0022] Take each neighbor IP determined in this round as a new reference IP, and execute the step of obtaining the network flow of the reference IP within a collection time period until the M-layer neighbor IPs of the known malicious IP are determined, where M is an integer greater than 1.

[0023] In some embodiments, it also includes:

[0024] Calculate the centrality score of each neighbor IP in the network through at least one centrality algorithm;

[0025] Eliminate safe IPs from neighboring IPs whose centrality scores are higher than the preset score to obtain abnormal IPs;

[0026] The abnormal IP is determined as an unknown malicious IP corresponding to the attack source, and a malicious label is added to the unknown malicious IP according to the centrality score of the abnormal IP.

[0027] In a second aspect, an embodiment of the present application provides a device for determining a neighbor IP, including:

[0028] An acquisition module is used to acquire multiple known malicious IPs corresponding to the same attack source, take each known malicious IP as a reference IP, and acquire the network flow of the reference IP within a collection time period;

[0029] A division module, used for dividing the network flow into a front network flow, a middle network flow and a rear network flow by adding a time window;

[0030] A first determination module is used for, if it is determined that the state of the rear network flow is different from that of the front network flow, and the state of the rear network flow of the reference IP in the previous collection time period is the same, then determining the remote IP corresponding to both the middle network flow and the middle network flow of the reference IP in the previous collection time period as the suspected cause IP that is suspected of causing the state transmission change of the reference IP;

[0031] The second determination module is used to determine that any remote IP is the cause IP that causes the state transmission change of the reference IP if the number of times any remote IP is determined as the suspected cause IP exceeds a first preset number, and determine the remote IP as a neighbor IP of the reference IP.

[0032] In a third aspect, an embodiment of the present application provides an electronic device, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein:

[0033] The memory stores a computer program that can be executed by at least one processor. The computer program is executed by the at least one processor so that the at least one processor can execute the above-mentioned method for determining a neighbor IP.

[0034] In a fourth aspect, an embodiment of the present application provides a storage medium. When a computer program in the storage medium is executed by a processor of an electronic device, the electronic device can execute the above-mentioned method for determining a neighbor IP.

[0035] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which implements the above-mentioned method for determining a neighbor IP when executed by a processor.

[0036] In an embodiment of the present application, each known malicious IP corresponding to the same attack source is used as a reference IP, and the network flow of the reference IP within a collection time period is divided into a front network flow, a middle network flow, and a rear network flow by adding a time window. If the state of the rear network flow is different from that of the front network flow, and the state of the rear network flow is the same as that of the rear network flow of the reference IP in the previous collection time period, then the remote IP corresponding to both the middle network flow and the middle network flow of the reference IP in the previous collection time period is determined as the suspected cause IP that is suspected of causing the state sending change of the reference IP. If any remote IP is determined as the suspected cause IP more than a first preset number of times, then this remote IP can be determined as the cause IP that causes the state sending change of the reference IP, and then the remote IP can be determined as the neighbor IP of the reference IP. In this way, the remote IP that causes the malicious IP to change its state to the same state several times is determined to be the cause IP that causes the malicious IP to send changes in its state. Since the relationship between the malicious IP and the cause IP conforms to the communication characteristics between the control device and the controlled device, and there is no such communication characteristic between the public service and the controlled device, this method can reduce the probability of misjudging the IP corresponding to the public service as a neighbor IP of unknown security, thereby narrowing the range of neighbor IPs of unknown security and reducing the difficulty of subsequently discovering the unknown malicious IP corresponding to the attack source from within the range. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0038] Figure 1 A schematic diagram of a process for discovering unknown malicious IPs through multiple known malicious IPs provided in an embodiment of the present application;

[0039] Figure 2 A schematic diagram of a principle of determining a neighbor IP in a related technology;

[0040] Figure 3 A schematic diagram of a process for determining a neighbor IP in a related technology;

[0041] Figure 4A schematic diagram of the principle of communication causality provided in an embodiment of the present application;

[0042] Figure 5 A schematic diagram of communication status change provided in an embodiment of the present application;

[0043] Figure 6 A schematic diagram of a communication causal relationship determination process provided in an embodiment of the present application;

[0044] Figure 7 A schematic diagram of a secure IP determination process provided in an embodiment of the present application;

[0045] Figure 8 A flowchart of a causal adjacency discovery method provided in an embodiment of the present application;

[0046] Fig. 9 A schematic diagram of the principle of a low-probability adjacency discovery method provided in an embodiment of the present application;

[0047] Fig.10 A schematic diagram of a conditional probability calculation process provided in an embodiment of the present application;

[0048] Fig.11 A schematic diagram of a process flow of a low-probability neighbor discovery method provided in an embodiment of the present application;

[0049] Fig.12 A flowchart of a method for determining a neighbor IP provided in an embodiment of the present application;

[0050] Fig.13 A flowchart of another method for determining a neighbor IP provided in an embodiment of the present application;

[0051] Fig.14 A schematic diagram of the structure of a device for determining a neighbor IP provided in an embodiment of the present application;

[0052] Fig.15 A schematic diagram of the hardware structure of an electronic device for implementing a method for determining a neighbor IP address provided in an embodiment of the present application. DETAILED DESCRIPTION

[0053] In order to solve the problem of high false alarm rate when searching for neighbor IPs of malicious IPs whose security is unknown in the related art, the embodiments of the present application provide a method, device, electronic device and storage medium for determining a neighbor IP.

[0054] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application may be combined with each other if there is no conflict.

[0055] First of all, it should be noted that in the embodiment of the present application, the protocol for interconnection between networks (Internet Protocol, IP) corresponds to a network device (also called a node), and analyzing the relationship between IPs is equivalent to analyzing the relationship between network devices.

[0056] In order to facilitate the understanding of this application, the technical terms involved in this application are:

[0057] APT is a cyber attack strategy usually adopted by state-sponsored hackers or other highly organized criminal groups. APT attacks are characterized by high sophistication and secrecy. Attackers have ample resources and time to plan and execute attacks. The main purpose of such attacks is to steal information, destroy critical infrastructure or conduct long-term surveillance on targets.

[0058] NetFlow is used to reflect the communication between an IP and other IPs within a certain period of time. The main fields include in_bytes, in_pkts, tcp_flag, protocol, etc. Among them, in_bytes and in_pkts record the total number of data bytes and the number of data packets passing through a specific network interface respectively, which are used to monitor network bandwidth usage and traffic patterns; tcp_flag can reflect the status of flags in the TCP flow, such as SYN, ACK, etc., which are used to diagnose TCP connection problems and security risks; protocol can identify the type of protocol used by the IP layer, such as TCP, UDP, which is used to help analyze the network traffic distribution of different protocols. In this application, these fields are used to perform statistical calculations on the status of network flows.

[0059] The adjacency relationship refers to the relationship between two vertices in the graph. From the perspective of full traffic, it refers to the connection relationship between IPs. The adjacency discovery method refers to the method of discovering and determining whether there is an adjacency relationship between two IPs.

[0060] Hash, hash functions are a fundamental building block in cryptography that produce a fixed-size output (often called a hash value) from input data of any size. Each different input produces a unique output, which makes hash functions ideal for verifying the integrity of data, because even a small change to the input data will produce a completely different hash value. Hashes are also used to store passwords securely, because only the hash of the password is stored, not the password itself, so that even if the database is cracked, the password cannot be easily leaked.

[0061] See also Figure 1 , Figure 1A schematic diagram of a process for discovering unknown malicious IPs through multiple known malicious IPs provided in an embodiment of the present application mainly includes: obtaining multiple known malicious IPs corresponding to the same attack source, applying an adjacency discovery method to these multiple known malicious IPs, discovering multiple layers of neighbor IPs with unknown security, determining the centrality of these neighbor IPs with unknown security through a centrality algorithm, eliminating safe IPs based on the centrality of these neighbor IPs, obtaining abnormal IPs, and producing new intelligence based on the abnormal IPs.

[0062] These stages are introduced below.

[0063] 1. Obtain multiple known malicious IP addresses corresponding to the same attack source.

[0064] In this stage, we can use manual tracing analysis to select multiple malicious IPs from the same attack source from the identified malicious activities as input parameters. For example, these multiple malicious IPs may be associated with multiple device members of the same APT organization, multiple command and control (CC) servers associated with the same variant virus, or multiple IP addresses resolved from the same malicious domain name. Combining theoretical and experimental results, using multiple related malicious IPs as input can significantly improve the accuracy of intelligence production.

[0065] 2. Apply the neighbor discovery method to these multiple known malicious IPs to discover neighbor IPs with unknown multi-layer security.

[0066] Adopting the neighbor discovery method, the security of each malicious IP is unknown. Based on the discovered neighbor IP, further cycle discovers more neighbor IPs. Since the devices corresponding to the neighbor IPs have a certain probability of including victim devices, malicious springboard devices, malicious core control devices, etc., after multiple cycles of discovery, deep neighbor IPs can be obtained, increasing the number of perpetrator devices and victim devices.

[0067] 3. Determine the centrality of these neighbor IPs whose security is unknown through the centrality algorithm.

[0068] Apply the centrality algorithm to calculate the centrality score of each neighbor IP among these neighbor IPs with unknown security. The centrality score is used to characterize the importance of this neighbor IP in the network. Centrality algorithms include degree centrality, closeness centrality, betweenness centrality and vector centrality.

[0069] Various centrality algorithms are introduced below.

[0070] Degree centrality: measures the importance of a node in the network by calculating the number of edges connected to a node (corresponding to a neighbor IP). In APT discovery, nodes with high centrality may be targets of attackers because they are directly connected to multiple other nodes in the network, through which attackers can spread malware or conduct data theft. In addition, after an APT attack, the peripheral springboards of the APT organization also have degree centrality.

[0071] Proximity to the center: In this approach, the "distance" between two nodes is not just based on their physical location or path length in the network, but is further defined by the similarity of the communication flow patterns between them. Such similarity is evaluated based on factors such as the size, type, frequency, and duration of the traffic, which can more accurately identify important nodes in the network and understand their role in network communications. Incorporating NetFlow similarity into the analysis of proximity to the center provides a new perspective for network security analysis. When the victim or APT organization's equipment is known, the suspected device can be quickly given through the proximity center for subsequent analysis.

[0072] Intermediary center: It reflects the frequency of a node appearing on all shortest paths in the network. The higher the intermediary center value of a node, the stronger the bridging effect of the node in the network. For APT attacks, nodes with high intermediary center values ​​may be key nodes used by attackers to spread malware or steal data, or they may be intermediate jump point devices such as VPNs.

[0073] Vector centrality: not only the number of direct connections to a node is considered, but also the quality of these connections. If a node is connected to multiple highly central nodes, its vector centrality is also high. In the APT protection scenario, a node with a high vector centrality value may point to a node that is connected to multiple key assets or sensitive areas, which is the focus of monitoring and protection. At the same time, in the APT intrusion scenario, nodes with vector centrality are often the core equipment stage of the APT organization. Using core equipment for tracing can often achieve good results.

[0074] In the subsequent key node identification and extraction stage, different malicious labels can be given to the discovered unknown malicious IPs according to different centrality scores.

[0075] 4. Eliminate safe IPs based on the centrality of these neighbor IPs and obtain abnormal IPs.

[0076] From the neighbor IPs with high centrality (i.e., the centrality score is higher than the preset score), the abnormal IPs are screened out. The screening method should take into account that the IPs with high centrality scores may also be normal public service IPs, so it is necessary to design a method to filter out these public service IPs to improve accuracy. For example, the asset mapping method is used to remove safe IPs from the neighbor IPs with centrality scores higher than the preset score, thereby obtaining abnormal IPs.

[0077] 5. Generate new intelligence based on abnormal IP.

[0078] When the input is multiple related known malicious IPs, the abnormal IPs after screening are newly discovered unknown malicious IPs, which are likely to be the core nodes of malicious organizations. In addition, according to the centrality score of the abnormal IPs, the newly discovered unknown malicious IPs can be labeled, such as whether they are malicious, the malicious organization they belong to, etc., and the intrusion indicators (Indicators of Compromise, IOC) of the assets corresponding to these unknown malicious IPs can be extracted and added to the illegal list and entered into the threat intelligence library.

[0079] Next, three neighbor discovery methods in the embodiments of the present application are introduced.

[0080] Method 1: Traditional method.

[0081] In traditional solutions, when defining neighbor IPs, select IPs that frequently interact with malicious IPs within a certain period of time, and ensure that these IPs are neither known malicious IPs nor known safe IPs such as public service IPs.

[0082] like Figure 2 As shown, the traditional method observes whether IP1 and IP2 have multiple complete communications to determine whether the two IPs are neighbors. When the number of complete communication flows is not greater than the preset threshold, it can be determined that the two IPs are not neighbors. When the number of complete communication flows is greater than the preset threshold, it can be determined whether the two IPs are neighbors with the help of known intelligence (referring to the known safe list set and malicious list set). The accuracy of this method depends entirely on the accuracy of the known intelligence that has excluded public services. The method itself has no way to limit and filter public services.

[0083] See also Figure 3 , Figure 3 The conventional method is shown in the flowchart, comprising the following steps:

[0084] (1) Within a given time, select a malicious IP and perform a NetFlow query on it.

[0085] (2) Based on the query results, determine the number of flows that the malicious IP communicates with each remote IP.

[0086] (3) Determine whether the number of flows corresponding to each remote IP is greater than a preset threshold. If not, the remote IP is considered to be a non-neighboring IP and is discarded. If so, the remote IP is considered to be a suspected neighbor IP of the malicious IP.

[0087] (4) Use open source intelligence (i.e., safe list set and malicious list set) to filter each suspected neighbor IP. If it is found to be a safe public service (i.e., it successfully matches the IOC of any asset in the safe list set), the suspected neighbor IP is determined to be a safe IP and discarded. If it is found to be a known malicious IP (i.e., it successfully matches the IOC of any asset in the malicious list set), the suspected neighbor IP is determined to be a malicious IP and discarded. Here, both safe IPs and malicious IPs are filtered out.

[0088] (5) If the open source intelligence does not provide the security of the suspected neighbor IP (i.e., the suspected neighbor IP is an IP that has not been filtered out), the suspected neighbor IP is regarded as a neighbor IP with unknown security.

[0089] Method 2: Causal adjacency discovery method.

[0090] Considering that the traditional method will take some public service IPs whose intelligence is not identified (i.e., the security is unknown) as neighbor IPs, since the public service IP itself also has centrality, this will cause false alarms in the subsequent process. Taking into account different time periods, the same controlled device (corresponding to a malicious IP) always responds to the instructions of the same control device, thereby producing the same state change. Even if the public service is accessed multiple times by the controlled device, the state will not change. That is, there are certain communication characteristics between the control device and the controlled device, while there are no such communication characteristics between the public service and the controlled device. Based on this, the embodiment of the present application utilizes the communication causal relationship between malicious IPs to design neighbor determination rules.

[0091] First, let’s introduce what communication causality is.

[0092] like Figure 4 As shown in the figure, as the result IP in the causal relationship, such as IP1, changes from state 1 to state 3 at the previous time point, and changes from state 2 to state 3 at the next time point, that is, IP1 changes from different states to the same state at different time points. If the same remote IP such as IP2 appears in this process, then this remote IP is considered to be the cause IP that causes the state of IP1 to change, and this cause IP is defined as the neighbor IP. Among them, the state of IP1 can be reflected by the NetFlow state of IP1.

[0093] It should be noted that the communication causal relationship is explained here by taking the cause IP corresponding to the controlling device and the effect IP corresponding to the controlled device as an example. In fact, the cause IP can also correspond to the controlled device. In this case, the effect IP corresponds to the controlled device which is further controlled by the controlled device.

[0094] Then, the identification process of communication causality is introduced.

[0095] In the process of determining the causative IP, the sliding time window method can be used to locate the suspected causative IP, such as Figure 5 As shown in the figure, using the set time window, the NetFlow of the selected IP (or reference IP) is subjected to sliding sampling, and the data of a certain time period before and after the window is obtained. The states of the data of the two time periods before and after the time window are calculated respectively, which are recorded as state X and state Y. When state X and state Y are two different states, it can be considered that the state of the selected IP has changed: from state X to state Y. The remote IP in the sliding window at this time is obtained and defined as the suspected cause IP.

[0096] In order to improve the accuracy, the cause IP can be determined multiple times. Assume that the traffic after the time window is the rear traffic (i.e., the rear network flow), the traffic in the time window is the middle traffic (i.e., the middle network flow), and the traffic before the time window is the front traffic (i.e., the front network flow). Figure 6 As shown in the figure, the states of the previous traffic and the following traffic in the previous network flow are different, and the states of the previous traffic and the following traffic in the current network flow are also different, and the states of the following traffic in the previous network flow and the current network flow are the same, that is, NetFlow on the selected IP, at different times, any previous traffic becomes a following traffic with the same state, then the same suspected cause IP that appears in its window at this time can be obtained, and this same suspected cause IP is determined as the cause IP. That is, a suspected cause IP appears twice and is determined to be the cause IP.

[0097] Using the above method, while producing malicious intelligence, it can also produce safe IP intelligence, such as Figure 7 As shown in the figure, the states of the previous flow and the following flow are the same, and the states of the previous flow and the following flow are also the same in the current flow, that is, the NetFlow on the selected IP, at different times, the flow state has not changed, then the same IP that appears in the window at this time can be obtained, and the same IP can be determined as a safe IP. That is, after multiple communications, if a remote IP always appears repeatedly in the window, and each appearance cannot cause the state of the previous flow and the following flow to change, then this IP can be determined as a safe IP, and there is no need to pay attention to the safe IP in the future.

[0098] like Figure 8 As shown, the above causal adjacency discovery method includes the following steps:

[0099] (1) Perform NetFlow query on the selected IP within a given time.

[0100] (2) Select a time point and divide all NetFlow into two parts: the former is the historical traffic (which can be regarded as the network flow in the previous collection time period), and the latter is the new traffic (which can be regarded as the network flow in the current time period).

[0101] (3) Define a time window with time T as the length. Slide on the historical traffic and the new traffic respectively. Each traffic will be divided into three parts by the time window. The traffic before the time window is called the front traffic (i.e., the front network flow), the traffic in the time window is called the window traffic (i.e., the middle network flow), and the traffic after the time window is called the back traffic (i.e., the back network flow).

[0102] (4) Calculate the state of the previous flow and the state of the subsequent flow in the historical flow and the new flow respectively. The state calculation method is as follows: for any flow whose state is to be calculated, periodically obtain its data in the in_bytes dimension, the in_pkts dimension, the remote port dimension, and the remote IP dimension, thereby obtaining the data sequence in the in_bytes dimension, the data sequence in the in_pkts dimension, the data sequence in the remote port dimension, and the data sequence in the remote IP dimension. Then, for the data sequence in the in_bytes dimension and the data sequence in the in_pkts dimension, the information entropy, the information amount, the mean, the variance, the maximum value, and the minimum value can be calculated respectively, and the information entropy of the data sequence in the remote port dimension and the data sequence in the remote IP dimension can be calculated respectively. All calculation results are placed in the same array to obtain a state array, and the state array is used to describe the state of the flow.

[0103] (5) Determine whether the flow states before and after the historical flow and the new flow have changed. The judgment process is as follows: take the previous flow state array, perform a percentage float on the data in the array to obtain the threshold range, that is, add or subtract x% of the value on the basis of the original value, and determine whether the value of the subsequent flow state array is within this threshold range. When the number of data exceeding the threshold accounts for more than the specified number, it is considered that the previous flow state is different from the subsequent flow state, that is, the state has changed after the time window T.

[0104] (6) Find the suspected causative IP. During the window sliding process, as described in step (5), determine whether the states of each of the previous and subsequent flows of the historical flow and the new flow have changed. When the state changes, compare whether the subsequent flow states of the historical flow and the new flow are the same. The state comparison method is the same as steps (4) and (5). When the same subsequent state is found in the historical flow and the new flow, the remote IP corresponding to the flows in both time windows is determined as the suspected causative IP.

[0105] (7) Locating neighbor IPs. Based on step (6), if a remote IP is determined to be a suspected cause IP multiple times (e.g., twice), then the remote IP can be considered to be the cause IP, that is, if a remote IP is determined to be a suspected cause IP more than a first preset number of times, then the remote IP is determined to be the cause IP, and then the cause IP can be determined to be a neighbor IP of the selected IP.

[0106] (8) Find a safe IP. Based on step (5), when the current and subsequent states do not change, record all remote IPs within the time window and determine these remote IPs as suspected safe IPs. When a remote IP is determined as a suspected safe IP multiple times (such as twice), the remote IP is considered to be a safe IP. That is, if the number of times a remote IP is determined as a suspected safe IP exceeds a second preset number, the remote IP is determined to be a safe IP.

[0107] Method three: low probability neighbor discovery method.

[0108] Considering that some APT organizations increase the attack time interval in order to increase the stealth of the penetration process, and use segmented and time-divided penetration methods to penetrate, observing this penetration method from the perspective of FLOW will reveal obvious traces.

[0109] Compared with the historical daily work traffic, the traffic generated by this covert method always has a small probability of appearing in the historical traffic of a network device. Fig. 9 As shown in the figure, suppose there are two suspected victims: suspected victim 1 and suspected victim 2. From the access situation on day L, suspected victim 1 accessed public services every day except the second day, and accessed a malicious device on the fourth day. Therefore, for suspected victim 1, accessing public services is a high-probability event, and accessing malicious devices is a low-probability event. Similarly, from the access situation on day L, suspected victim 2 accessed public services every day except the fourth day, and accessed a malicious device and an unknown device with unknown security on the Lth day. Therefore, for suspected victim 2, accessing public services is also a high-probability event, and accessing malicious devices and unknown devices are low-probability events. In the scenario where suspected victims are used as input, the low-probability event of accessing malicious devices is convergent; while the low-probability event of accessing unknown devices is not convergent.

[0110] It should be noted that Fig. 9 The example is introduced with a suspected victim as input. In practical applications, Fig. 9 The victim can also be used as input, the principle is the same as above. Fig. 9 The perpetrator can also be used as input. In this case, the high-probability event refers to the interaction between the perpetrator and the victim who has been controlled, and the low-probability event refers to the interaction between the perpetrator and the victim who is about to be controlled.

[0111] Based on the above premise, the inventors have designed a method for discovering neighbor IP based on probability. The algorithm principle is as follows: Fig.10 As shown, the historical traffic of a network device some time ago is assumed to be daily, credible behavioral traffic. In work and life scenarios, historical traffic is always repetitive, that is, the security traffic generated in work and life is always generated with high probability and with certain user intrinsic logical relationships. Therefore, this method uses historical traffic as an anchor point and the first N flows of the selected flow of historical traffic as conditions, extracts the (in_bytes+in_pkts+tcp_flag+protocol) data of each flow, calculates its conditional probability, and thereby evaluates the conditional probability of new traffic. Subsequently, when the conditional probability of the new traffic of this network device is too low, the IP corresponding to the network device and the remote IP corresponding to the new traffic are defined as neighbors.

[0112] like Fig.11 As shown, the above-mentioned low-probability neighbor discovery method includes the following steps:

[0113] (1) Perform NetFlow query on the selected IP within a given time to obtain historical traffic.

[0114] (2) Method 1: Count the conditional probability of (IP+port) for each flow in the historical traffic. The probability condition is the (IP+port) data of the first N flows of the selected flow. Method 2: Count the conditional probability of (in_bytes+in_pkts+tcp_flag+protocol) for each flow in the historical traffic. The probability condition is the (in_bytes+in_pkts+tcp_flag+protocol) data of the first N flows of the selected flow. In addition, when calculating the conditional probability, (IP+port) and (in_bytes+in_pkts+tcp_flag+protocol) can be hash mapped to ensure uniqueness. Generally, any method can be used to calculate the conditional probability.

[0115] It is worth noting that the order in which the conditional events occur is not considered during the calculation process. In this method, the frequency of occurrence of the flow representation data within a given time is the prior probability of the data. The probability obtained using the conditional probability formula is the prior conditional probability.

[0116] (3) The prior conditional probabilities calculated by method 1 and method 2 are stored in a table. The format stored in the table is (prior conditional probability|event|conditional event). Among them, the event is the selected flow, the conditional event is the first N flows of the selected flow, and the prior conditional probability is the calculation result of step (2).

[0117] (4) Look up the new traffic of the selected IP to determine its probability of occurrence. The lookup process is as follows: select a flow from the new traffic and select the first N flows of this flow.

[0118] When the conditional probability is calculated using method 1, a hash mapping is performed on the (IP+port) of all selected flows to obtain the query keyword of (event|conditional event), where the event is the selected traffic, and the conditional event is the first N flows of the selected flow. The prior conditional probability is queried using (event|conditional event) as the index. When the prior conditional probability is less than a certain threshold, or the prior probability is not found, it is considered that a low-probability event has occurred, and the flow to be queried is determined to be a low-probability flow.

[0119] When the second method is used to calculate the conditional probability, a hash mapping is performed on (in_bytes+in_pkts+tcp_flag+protocol) of all selected flows to obtain the query keyword of (event|conditional event), where the event is the selected flow and the conditional event is the first N flows of the selected flow. The prior conditional probability is queried with (event|conditional event) as the index. When the prior conditional probability is less than a certain threshold or the prior probability is not found, it is considered that a low-probability event has occurred and the flow to be queried is determined to be a low-probability flow.

[0120] (5) The remote IP of the low-probability flow is determined as the neighbor IP of the selected IP.

[0121] In actual applications, the open source IOC intelligence of the target APT organization is obtained, and NetFlow queries are performed with 17 known malicious IPs as input. The above method is then implemented based on the query results. In the causal adjacency discovery method, the floating threshold of the before and after traffic state values ​​is set to 0.33. In the low-probability adjacency discovery method, the prior condition probability threshold is set to 0.075. 144 (including historical) unknown malicious IPs belonging to the target APT organization are obtained, and these unknown malicious IPs are verified with an accuracy rate of 98%.

[0122] In the embodiments of this application, the causal adjacency discovery method and the low-probability adjacency discovery method can better distinguish the traffic of malicious IPs and public service IPs, solve the false alarm problem caused by only focusing on the degree link in the traditional solution, and improve the average accuracy by more than 8%. In addition, the traditional method cannot identify safe niche public services only by relying on the communication relationship topology. This application can well supplement this missing ability through causal relationships.

[0123] Fig.12 A flowchart of a method for determining a neighbor IP provided in an embodiment of the present application, the method comprising the following steps.

[0124] In step 1201, multiple known malicious IPs corresponding to the same attack source are obtained, and each known malicious IP is used as a reference IP.

[0125] Among them, multiple known malicious IPs corresponding to the same attack source are associated with each other, for example, multiple device members associated with the same APT organization, multiple command and control servers associated with the same variant virus, and resolved from the same malicious domain name.

[0126] In step 1202, the network flow of the reference IP within a collection time period is divided into a front network flow, a middle network flow and a rear network flow by adding a time window.

[0127] The network flow of the reference IP in a collection time period is actually a flow sequence, which contains multiple flows. When adding a time window to the network flow, any flow that exists in the time period from the start time to the end time of the time window can be considered as a middle network flow. The flow before the middle network flow is the front network flow, and the flow after the middle network flow is the back network flow.

[0128] In step 1203, if it is determined that the state of the rear network flow is different from that of the front network flow, and the state of the rear network flow is the same as that of the reference IP in the previous collection time period, then the remote IP corresponding to the middle network flow and the reference IP in the previous collection time period is determined as the suspected cause IP that is suspected of causing the change in the state of the reference IP.

[0129] In specific implementation, for any of the subsequent network flows or the previous network flows, the state of the flow can be determined by the relevant data of the flow. For example, the data of the flow in_bytes dimension, the data of the in_pkts dimension, the data of the remote port dimension, and the data of the remote IP dimension are periodically obtained to obtain the data sequence of the in_bytes dimension, the data sequence of the in_pkts dimension, the data sequence of the remote port dimension, and the data sequence of the remote IP dimension. Then, the information entropy, information volume, mean, variance, maximum value, and minimum value of the data sequence of the in_bytes dimension and the data sequence of the in_pkts dimension can be calculated respectively, and the information entropy of the data sequence of the remote port dimension and the data sequence of the remote IP dimension can be calculated respectively, and all the calculation results are placed in the same array to obtain a state array, and the state array is used to describe the state of this flow.

[0130] Furthermore, whether the status of the latter network flow is different from that of the former network flow can be determined according to the following steps:

[0131] The parameter value of each network parameter of the previous network flow is floated, that is, each calculation result in the state array is floated to obtain the parameter value range of the network parameter. Then, the types of network parameters that do not fall into the corresponding parameter value range in the parameter values ​​of the subsequent network flow can be determined. If the types of network parameters are greater than the specified number, it is determined that the state of the subsequent network flow is different from that of the previous network flow. If the types of network parameters are not greater than the specified number, it is determined that the state of the subsequent network flow is the same as that of the previous network flow.

[0132] In step 1204, if any remote IP is determined as a suspected causal IP more than a first preset number of times, the remote IP is determined to be the causal IP causing the state transmission change of the reference IP, and the remote IP is determined as a neighbor IP of the reference IP.

[0133] The first preset number is, for example, 2, 3, 4, etc.

[0134] Through the above method, what is determined is the first layer neighbor IP of each known malicious IP. In practical application, multiple layers of neighbor IP can also be determined to expand the neighbor range. In this case, the above process can also include the following process.

[0135] In step 1205, it is determined whether M-layer neighbor IP discovery has been performed on the known malicious IP. If not, the process proceeds to step 1206. If yes, the process proceeds to step 1207, where M is an integer greater than 1.

[0136] Among them, M is 2, 3, 4, 5, etc.

[0137] In actual applications, for known malicious IPs, the first-layer neighbor IP determined by the above method is the IP affected by the known malicious IP, the second-layer neighbor IP determined by the above method is the IP that affects the first-layer neighbor IP, the third-layer neighbor IP determined by the above method is the IP affected by the second-layer neighbor IP, the fourth-layer neighbor IP determined by the above method is the IP that affects the third-layer neighbor IP, and so on. This is in line with the chain attack characteristics of network attacks, while public services do not have such chain attack characteristics. Therefore, this method can well exclude the IP of public services and avoid determining the IP of public services as neighbor IPs.

[0138] In step 1206, each neighbor IP determined in this round is used as a new reference IP, and the process returns to step 1202.

[0139] Among them, each neighbor IP determined in this round is the new neighbor IP determined in this round.

[0140] In step 1207, stop this process.

[0141] That is, stop searching for the M+1th layer neighbor IPs of each known malicious IP.

[0142] Fig.13 A flowchart of another method for determining a neighbor IP provided in an embodiment of the present application, the method comprising the following steps.

[0143] In step 1301, multiple known malicious IPs corresponding to the same attack source are obtained, and each known malicious IP is used as a reference IP.

[0144] In step 1302, the network flow of the reference IP within a collection time period is obtained.

[0145] In step 1303, the network flow is divided into a front network flow, a middle network flow and a rear network flow by adding a time window.

[0146] In step 1304, if it is determined that the state of the rear network flow is different from that of the front network flow, and the state of the rear network flow is the same as that of the reference IP in the previous collection time period, then the remote IP corresponding to the middle network flow and the reference IP in the previous collection time period is determined as the suspected cause IP that is suspected of causing the change in the state of the reference IP.

[0147] In step 1305, if any remote IP is determined as a suspected causal IP more than a first preset number of times, the remote IP is determined to be the causal IP causing the state transmission change of the reference IP, and the remote IP is determined as a neighbor IP of the reference IP.

[0148] In the above process, step 1303 to step 1305 are to discover neighbor IPs with the help of causal adjacency discovery method. In some embodiments, the neighbor IPs can also be discovered in combination with the low-probability neighbor discovery method to increase the number of neighbor IPs. Therefore, the above process can also include the following steps.

[0149] In step 1306, a flow to be queried is selected from the network flows.

[0150] In step 1307, the flow characterization data of the flow to be queried is taken as an event, and the flow characterization data of N flows in the network flow that are located before the flow to be queried is taken as a conditional event, and the probability of occurrence of the event under the conditional event is queried from the prior probability table. The prior probability table is pre-established based on the historical network flow of the reference IP, and N is an integer greater than zero.

[0151] Among them, the flow characterization data of any flow includes IP+port data, in_bytes+in_pkts+tcp_flag+protocol data, etc.

[0152] In specific implementation, for the historical network flow of the reference IP, the frequency of occurrence of each historical flow (i.e., historical traffic) in the historical network flow when the previous N historical flows appeared can be counted according to the flow characterization data, and the occurrence frequency is used as the occurrence probability of this historical flow (i.e., the above-mentioned prior conditional probability). The probability information of each historical flow is saved in the form of (prior conditional probability|event|conditional event) to obtain a prior probability table.

[0153] Subsequently, the flow representation data of the flow to be queried is taken as an event, and the flow representation data of N flows in the network flow preceding the flow to be queried is taken as a conditional event, and the probability of occurrence of the event under the conditional event is queried from the prior probability table.

[0154] In step 1308, if the occurrence probability is less than a preset value, or the occurrence probability is not found, the flow to be queried is determined to be a low-probability flow, and the remote IP corresponding to the flow to be queried is determined as the neighbor IP of the reference IP.

[0155] In step 1309, it is determined whether M-layer neighbor IP discovery has been performed on the known malicious IP. If not, the process proceeds to step 1310. If yes, the process proceeds to step 1311, where M is an integer greater than 1.

[0156] In step 1310, each neighbor IP determined in this round is used as a new reference IP, and step 1302 is executed.

[0157] In step 1311, stop this process.

[0158] It should be noted that in the above process, there is no strict sequential relationship between step 1303-step 1305 and step 1306-step 1308, and step 1303-step 1305 can be before step 1306-step 1308, step 1303-step 1305 can be after step 1306-step 1308, or step 1303-step 1305 and step 1306-step 1308 can be executed in parallel.

[0159] In the embodiment of the present application, for the neighbor IPs determined by steps 1303-1305, the first-layer neighbor IP is the IP affected by the known malicious IP, the second-layer neighbor IP is the IP that affects the first-layer neighbor IP, the third-layer neighbor IP is the IP affected by the second-layer neighbor IP, the fourth-layer neighbor IP is the IP that affects the third-layer neighbor IP, and so on. This conforms to the chain attack characteristics of network attacks, while public services do not have such chain attack characteristics. Therefore, the IP of the public service can be well excluded and the IP of the public service can be avoided from being determined as the neighbor IP.

[0160] As for the neighbor IPs determined in 1306-step 1308, when the known malicious IP corresponds to the IP of the control device, the first-layer neighbor IP is the possible IP to be controlled by the controlled device, the second-layer neighbor IP is the IP that may control the first-layer neighbor IP, the third-layer neighbor IP is the possible IP to be controlled by the second-layer neighbor IP, the fourth-layer neighbor IP is the IP that may control the third-layer neighbor IP, and so on, which is consistent with the identity cycle characteristics of the alternating appearance of attackers and victims in network attacks; when the known malicious IP corresponds to the IP of the controlled device, the first-layer neighbor IP is the IP that may control the controlled device, the second-layer neighbor IP is the possible IP to be controlled by the first-layer neighbor IP, the third-layer neighbor IP is the IP that may control the second-layer neighbor IP, and the fourth-layer neighbor IP is the possible IP to be controlled by the third-layer neighbor IP, and so on, which is also consistent with the identity cycle characteristics of the alternating appearance of attackers and victims in network attacks. Public services do not have this identity cycle characteristic, so the IP of public services can also be well excluded to avoid determining the IP of public services as neighbor IPs.

[0161] In the above Fig.12 or Fig.13 In the process shown, after determining the M-layer neighbor IPs of each known malicious IP, at least one centrality algorithm can be used to calculate the centrality score of each neighbor IP (including the first layer to the lower M-layer neighbor IPs) in the network, and the safe IPs are removed from the neighbor IPs with centrality scores higher than the preset score to obtain abnormal IPs, and then the abnormal IPs are determined as unknown malicious IPs corresponding to the attack source, and malicious labels are added to the unknown malicious IPs according to the centrality scores of the abnormal IPs. Among them, the malicious labels include whether it is a malicious device, the corresponding attack source information, what the centrality is, etc.

[0162] Since the method of the embodiment of the present application can determine a relatively accurate neighbor IP and greatly reduce the number of neighbor IPs, the difficulty of ultimately determining the unknown malicious IP is relatively low, and the accuracy of the determined unknown malicious IP is relatively high.

[0163] Based on the same technical concept, an embodiment of the present application also provides a device for determining a neighbor IP. The principle of solving the problem by the device for determining a neighbor IP is similar to that of the above-mentioned method for determining a neighbor IP. Therefore, the implementation of the device for determining a neighbor IP can refer to the implementation of the method for determining a neighbor IP, and the repeated parts will not be repeated.

[0164] Fig.14 A schematic diagram of the structure of a device for determining a neighbor IP provided in an embodiment of the present application:

[0165] The acquisition module 1401 is used to acquire multiple known malicious IPs corresponding to the same attack source, take each known malicious IP as a reference IP, and acquire the network flow of the reference IP within a collection time period;

[0166] A division module 1402, configured to divide the network flow into a front network flow, a middle network flow and a rear network flow by adding a time window;

[0167] The first determination module 1403 is used to, if it is determined that the state of the rear network flow is different from that of the front network flow, and the state of the rear network flow of the reference IP in the previous collection time period is the same, determine the remote IP corresponding to both the middle network flow and the middle network flow of the reference IP in the previous collection time period as the suspected cause IP that is suspected of causing the state transmission change of the reference IP;

[0168] The second determination module 1404 is used to determine that any remote IP is the causal IP that causes the state transmission change of the reference IP if the number of times any remote IP is determined as the suspected causal IP exceeds the first preset number, and determine the remote IP as the neighbor IP of the reference IP.

[0169] In some embodiments, the first determination module 1403 is further configured to determine the remote IP corresponding to both the intermediate network flow and the reference IP in the intermediate network flow of the previous collection time period as a non-suspected cause IP if it is determined that the state of the subsequent network flow is the same as that of the previous network flow;

[0170] The second determination module 1404 is further configured to determine any remote IP as a safe IP if the number of times that any remote IP is determined as a non-suspected IP exceeds a second preset number of times.

[0171] In some embodiments, the state of any network flow includes parameter values ​​of multiple network parameters, and the first determining module 1403 is specifically configured to determine whether the state of the subsequent network flow is different from the state of the previous network flow according to the following steps:

[0172] Floating the parameter value of each network parameter of the previous network flow to obtain the parameter value range of the network parameter;

[0173] Determine the network parameter types that do not fall within the corresponding parameter value range among the parameter values ​​of the subsequent network flow;

[0174] If the number of network parameter types is greater than a specified number, it is determined that the state of the subsequent network flow is different from that of the previous network flow; otherwise, it is determined that the state of the subsequent network flow is the same as that of the previous network flow.

[0175] In some embodiments, the acquisition module 1401 is further used to select a flow to be queried from the network flow;

[0176] The first determination module 1403 is further configured to query the probability of occurrence of the event under the conditional event from a priori probability table, taking the flow characterization data of the flow to be queried as an event and the flow characterization data of N flows in the network flow that are located before the flow to be queried as a conditional event, wherein the priori probability table is pre-established based on the historical network flow of the reference IP, and N is an integer greater than zero;

[0177] The second determination module 1404 is further used to determine that the flow to be queried is a low-probability flow if the occurrence probability is less than a preset value, or no occurrence probability is found, and determine the remote IP corresponding to the flow to be queried as the neighbor IP of the reference IP.

[0178] In some embodiments, a control module 1405 is further included for:

[0179] Take each neighbor IP determined in this round as a new reference IP, and execute the step of obtaining the network flow of the reference IP within a collection time period until the M-layer neighbor IPs of the known malicious IP are determined, where M is an integer greater than 1.

[0180] In some embodiments, the processing module 1406 is further included, which is used to:

[0181] Calculate the centrality score of each neighbor IP in the network through at least one centrality algorithm;

[0182] Eliminate safe IPs from neighboring IPs whose centrality scores are higher than the preset score to obtain abnormal IPs;

[0183] The abnormal IP is determined as an unknown malicious IP corresponding to the attack source, and a malicious label is added to the unknown malicious IP according to the centrality score of the abnormal IP.

[0184] The division of modules in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, the functional modules in the embodiments of the present application may be integrated in a processor, or may exist physically separately, or two or more modules may be integrated in one module. The coupling between the modules may be achieved through some interfaces, which are usually electrical communication interfaces, but it is not excluded that they may be mechanical interfaces or other forms of interfaces. Therefore, the modules described as separate components may or may not be physically separated, and may be located in one place or distributed to different locations of the same or different devices. The above-mentioned integrated modules may be implemented in the form of hardware or in the form of software functional modules.

[0185] After introducing the neighbor IP determination method and device according to the exemplary embodiment of the present application, next, an electronic device according to another exemplary embodiment of the present application is introduced.

[0186] Refer to the following Fig.15 The electronic device 150 implemented according to this embodiment of the present application is described. Fig.15 The electronic device 150 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0187] like Fig.15 As shown, the electronic device 150 is in the form of a general electronic device. The components of the electronic device 150 may include but are not limited to: at least one processor 151, at least one memory 152, and a bus 153 connecting different system components (including the memory 152 and the processor 151).

[0188] Bus 153 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a processor, or a local bus using any of a variety of bus architectures.

[0189] The memory 152 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 1521 and / or a cache memory 1522 , and may further include a read-only memory (ROM) 1523 .

[0190] The memory 152 may also include a program / utility 1525 having a set (at least one) of program modules 1524, such program modules 1524 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0191] The electronic device 150 may also communicate with one or more external devices 154 (e.g., keyboards, pointing devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 150, and / or may communicate with any device that enables the electronic device 150 to communicate with one or more other electronic devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 155. Furthermore, the electronic device 150 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 156. As shown, the network adapter 156 communicates with other modules for the electronic device 150 via a bus 153. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 150, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0192] In an exemplary embodiment, a storage medium is also provided, and when a computer program in the storage medium is executed by a processor of an electronic device, the electronic device can perform any of the above-mentioned neighbor IP determination methods. Optionally, the storage medium can be a non-temporary computer-readable storage medium, for example, the non-temporary computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0193] In an exemplary embodiment, the electronic device of the present application may include at least one processor and a memory communicatively connected to the at least one processor, wherein the memory stores a computer program executable by the at least one processor, and when the computer program is executed by the at least one processor, the at least one processor may execute the steps of any neighbor IP determination method provided in the embodiments of the present application.

[0194] In an exemplary embodiment, a computer program product is also provided. When the computer program product is executed by an electronic device, the electronic device can implement any exemplary method provided in the present application.

[0195] Furthermore, the computer program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a RAM, a ROM, an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a compact disk read only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0196] The program product for determining neighbor IP in the embodiment of the present application can adopt CD-ROM and include program code, and can be run on a computing device. However, the program product of the present application is not limited to this. In this document, the readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, an apparatus or a device or used in combination with it.

[0197] The readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein the readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0198] The program code contained on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, radio frequency (RF), etc., or any suitable combination of the foregoing.

[0199] Program code for performing the operations of the present application may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device via any type of network such as a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0200] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0201] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0202] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0203] The present application is described with reference to the flowcharts and / or block diagrams of the methods, apparatus (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0204] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0205] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0206] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0207] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application also includes these modifications and variations.

Claims

1. A method for determining a neighbor IP, characterized in that: include: Obtain multiple known malicious IPs corresponding to the same attack source, take each known malicious IP as a reference IP, and obtain the network flow of the reference IP within a collection time period; By adding a time window, the network flow is divided into a front network flow, a middle network flow and a rear network flow; If it is determined that the state of the rear network flow is different from that of the front network flow, and the state of the rear network flow is the same as that of the rear network flow of the reference IP in the previous collection time period, the remote IP corresponding to both the middle network flow and the middle network flow of the reference IP in the previous collection time period is determined as the suspected cause IP that is suspected of causing the state transmission change of the reference IP; If any remote IP is determined as a suspected cause IP more than a first preset number of times, the remote IP is determined to be the cause IP causing the state transmission change of the reference IP, and the remote IP is determined as a neighbor IP of the reference IP.

2. The method according to claim 1, characterized in that Also includes: If it is determined that the state of the subsequent network flow is the same as that of the previous network flow, the remote IP corresponding to the intermediate network flow and the reference IP in the intermediate network flow of the previous collection time period is determined as a non-suspected cause IP; If the number of times that any remote IP is determined as a non-suspected IP exceeds a second preset number, the remote IP is determined as a safe IP.

3. The method according to claim 1 or 2, characterized in that The state of any network flow includes parameter values ​​of multiple network parameters, and whether the state of the subsequent network flow is different from that of the previous network flow is determined according to the following steps: Floating the parameter value of each network parameter of the previous network flow to obtain the parameter value range of the network parameter; Determine the network parameter types that do not fall within the corresponding parameter value range among the parameter values ​​of the subsequent network flow; If the number of network parameter types is greater than a specified number, it is determined that the state of the subsequent network flow is different from that of the previous network flow; otherwise, it is determined that the state of the subsequent network flow is the same as that of the previous network flow.

4. The method according to claim 1, characterized in that Also includes: Selecting a flow to be queried from the network flows; Taking the flow characterization data of the flow to be queried as an event and the flow characterization data of N flows in the network flow that are located before the flow to be queried as conditional events, querying the probability of occurrence of the event under the conditional event from a priori probability table, wherein the priori probability table is pre-established based on the historical network flow of the reference IP, and N is an integer greater than zero; If the occurrence probability is less than a preset value, or no occurrence probability is found, the flow to be queried is determined to be a low-probability flow, and the remote IP corresponding to the flow to be queried is determined as a neighbor IP of the reference IP.

5. The method according to claim 1, 2 or 4, characterized in that: Also includes: Take each neighbor IP determined in this round as a new reference IP, and execute the step of obtaining the network flow of the reference IP within a collection time period until the M-layer neighbor IPs of the known malicious IP are determined, where M is an integer greater than 1.

6. The method according to claim 5, characterized in that Also includes: Calculate the centrality score of each neighbor IP in the network through at least one centrality algorithm; Eliminate safe IPs from neighboring IPs whose centrality scores are higher than the preset score to obtain abnormal IPs; The abnormal IP is determined as an unknown malicious IP corresponding to the attack source, and a malicious label is added to the unknown malicious IP according to the centrality score of the abnormal IP.

7. A device for determining a neighbor IP, characterized in that: include: An acquisition module is used to acquire multiple known malicious IPs corresponding to the same attack source, take each known malicious IP as a reference IP, and acquire the network flow of the reference IP within a collection time period; A division module, used for dividing the network flow into a front network flow, a middle network flow and a rear network flow by adding a time window; A first determination module is used for, if it is determined that the state of the rear network flow is different from that of the front network flow, and the state of the rear network flow of the reference IP in the previous collection time period is the same, then determining the remote IP corresponding to both the middle network flow and the middle network flow of the reference IP in the previous collection time period as the suspected cause IP that is suspected of causing the state transmission change of the reference IP; The second determination module is used to determine that any remote IP is the cause IP that causes the state transmission change of the reference IP if the number of times any remote IP is determined as the suspected cause IP exceeds a first preset number, and determine the remote IP as a neighbor IP of the reference IP.

8. An electronic device, characterized in that: include: at least one processor, and a memory communicatively connected to the at least one processor, wherein: The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the method according to any one of claims 1 to 6.

9. A storage medium, characterized in that: When the computer program in the storage medium is executed by a processor of an electronic device, the electronic device can execute the method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The method comprises a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images