Method, device, electronic device and storage medium for determining neighbor IP

Abstract

The present application discloses a method, device, electronic device and storage medium for determining a neighbor IP, belonging to the field of network security technology. In this method, each known malicious IP corresponding to the same attack source is used as a reference IP, and the network flow of the reference IP within a collection time period is divided into a front network flow, a middle network flow and a back network flow by adding a time window. If the state of the back network flow is different from that of the front network flow, and the state of the back network flow is the same as that of the back network flow of the reference IP in the previous collection time period, the remote IP corresponding to both the middle network flow and the middle network flow of the reference IP in the previous collection time period is determined as a suspected cause IP. If the number of times any remote IP is determined as a suspected cause IP exceeds a first preset number, the remote IP can be determined as the cause IP that causes the state of the reference IP to change, and the remote IP can be determined as a neighbor IP of the reference IP to narrow the range of neighbor IPs with unknown security.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, electronic device, and storage medium for determining a neighbor IP address. Background Art

[0002] Recently, cyberattacks have become increasingly diverse, with increasing sophistication and stealth. Take Advanced Persistent Threat (APT) as an example. APT is a cyberattack tactic characterized by high sophistication and stealth, allowing attackers to plan and execute attacks with ample resources and time.

[0003] Related technologies, when multiple malicious IPs corresponding to a known attack source are known, rely on the information exchange between each malicious IP and other IPs to identify the malicious IP's multi-layer neighbor IPs. Then, using a set of known safe IPs and a set of known malicious IPs, the known safe IPs and known malicious IPs are removed from the multi-layer neighbor IPs to obtain the malicious IP's neighbor IPs whose security is unknown. Then, a network topology diagram is constructed using all the neighbor IPs whose security is unknown. The unknown malicious IP corresponding to the attack source is then searched for in the topology diagram. However, this method has certain limitations and false positives, as some services, such as public services, may be mistakenly identified as malicious IPs due to their extensive connectivity, resulting in inaccurate analysis results. Summary of the Invention

[0004] The embodiments of the present application provide a method, device, electronic device and storage medium for determining a neighbor IP, so as to solve the problem of high false alarm rate when searching for a neighbor IP of a malicious IP whose security is unknown in the related art.

[0005] In a first aspect, an embodiment of the present application provides a method for determining a neighbor IP address, including:

[0006] Obtain multiple known malicious IP addresses corresponding to the same attack source, use each known malicious IP address as a reference IP address, and obtain the network flow of the reference IP address within a collection time period.

[0007] By adding a time window, the network flow is divided into a front network flow, a middle network flow and a back network flow;

[0008] If it is determined that the state of the subsequent network flow is different from that of the preceding network flow, and the state of the subsequent network flow is the same as that of the subsequent network flow of the reference IP in the previous collection time period, the remote IP corresponding to both the intermediate network flow and the intermediate network flow of the reference IP in the previous collection time period is determined as the suspected cause IP that is suspected of causing the state change of the reference IP;

[0009] If any remote IP is determined to be a suspected cause IP more than a first preset number of times, the remote IP is determined to be the cause IP causing the state transmission change of the reference IP, and the remote IP is determined to be a neighbor IP of the reference IP.

[0010] In some embodiments, further comprising:

[0011] If it is determined that the state of the subsequent network flow is the same as that of the previous network flow, the remote IP corresponding to the intermediate network flow and the reference IP in the intermediate network flow of the previous collection time period is determined as a non-suspected cause IP;

[0012] If the number of times that any remote IP is determined to be a non-suspected IP exceeds a second preset number, the remote IP is determined to be a safe IP.

[0013] In some embodiments, the state of any network flow includes parameter values ​​of multiple network parameters, and whether the state of the subsequent network flow is different from the state of the previous network flow is determined according to the following steps:

[0014] Floating the parameter value of each network parameter of the previous network flow to obtain a parameter value range of the network parameter;

[0015] Determining the network parameter types that do not fall within the corresponding parameter value range among the parameter values ​​of the subsequent network flow;

[0016] If the number of network parameter types is greater than a specified number, it is determined that the state of the subsequent network flow is different from that of the previous network flow; otherwise, it is determined that the state of the subsequent network flow is the same as that of the previous network flow.

[0017] In some embodiments, further comprising:

[0018] Selecting a flow to be queried from the network flows;

[0019] Taking the flow characterization data of the flow to be queried as an event and the flow characterization data of N flows in the network flow that are located before the flow to be queried as conditional events, querying the probability of occurrence of the event under the conditional event from a priori probability table, wherein the priori probability table is pre-established based on the historical network flow of the reference IP, and N is an integer greater than zero;

[0020] If the occurrence probability is less than a preset value, or no occurrence probability is found, the flow to be queried is determined to be a low-probability flow, and the remote IP corresponding to the flow to be queried is determined as a neighbor IP of the reference IP.

[0021] In some embodiments, further comprising:

[0022] Each neighbor IP determined in this round is used as a new reference IP, and the step of obtaining the network flow of the reference IP within a collection time period is executed until the M-layer neighbor IPs of the known malicious IP are determined, where M is an integer greater than 1.

[0023] In some embodiments, it further includes:

[0024] Calculate the centrality score of each neighbor IP in the network through at least one centrality algorithm;

[0025] Eliminate safe IPs from neighboring IPs whose centrality scores are higher than the preset score to obtain abnormal IPs;

[0026] The abnormal IP is determined to be an unknown malicious IP corresponding to the attack source, and a malicious label is added to the unknown malicious IP according to the centrality score of the abnormal IP.

[0027] In a second aspect, an embodiment of the present application provides a device for determining a neighbor IP address, including:

[0028] An acquisition module is used to acquire multiple known malicious IP addresses corresponding to the same attack source, use each known malicious IP address as a reference IP address, and acquire the network flow of the reference IP address within a collection time period.

[0029] A division module, configured to divide the network flow into a front network flow, a middle network flow, and a rear network flow by adding a time window;

[0030] A first determining module is configured to, if it is determined that the state of the subsequent network flow is different from that of the preceding network flow, and the state of the subsequent network flow is the same as that of the subsequent network flow of the reference IP in the previous collection time period, determine the remote IP corresponding to both the intermediate network flow and the intermediate network flow of the reference IP in the previous collection time period as the suspected cause IP that is suspected of causing the state change of the reference IP;

[0031] The second determination module is used to determine that any remote IP is the cause IP that causes the state transmission change of the reference IP if the number of times any remote IP is determined as the suspected cause IP exceeds a first preset number, and determine the remote IP as a neighbor IP of the reference IP.

[0032] In a third aspect, an embodiment of the present application provides an electronic device, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein:

[0033] The memory stores a computer program that can be executed by at least one processor. The computer program is executed by the at least one processor to enable the at least one processor to perform the above-mentioned method for determining a neighbor IP.

[0034] In a fourth aspect, an embodiment of the present application provides a storage medium. When a computer program in the storage medium is executed by a processor of an electronic device, the electronic device can execute the above-mentioned method for determining a neighbor IP.

[0035] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which implements the above-mentioned method for determining a neighbor IP when executed by a processor.

[0036] In an embodiment of the present application, each known malicious IP corresponding to the same attack source is used as a reference IP, and the network flow of the reference IP within a collection time period is divided into a front network flow, a middle network flow, and a back network flow by adding a time window. If the state of the back network flow is different from that of the front network flow, and the state of the back network flow is the same as that of the back network flow of the reference IP in the previous collection time period, then the remote IP corresponding to both the middle network flow and the middle network flow of the reference IP in the previous collection time period is determined as the suspected cause IP that is suspected of causing the change in the state of the reference IP. If the number of times any remote IP is determined as the suspected cause IP exceeds a first preset number, then this remote IP can be determined as the cause IP that causes the change in the state of the reference IP, and then the remote IP can be determined as the neighbor IP of the reference IP. In this way, the remote IP that has caused the malicious IP to change its state to the same state several times is determined to be the cause IP that caused the malicious IP to send changes in state. Since the relationship between the malicious IP and the cause IP conforms to the communication characteristics between the control device and the controlled device, and there is no such communication characteristic between the public service and the controlled device, this method can reduce the probability of misjudging the IP corresponding to the public service as a neighbor IP of unknown security, thereby narrowing the range of neighbor IPs of unknown security and reducing the difficulty of subsequently discovering the unknown malicious IP corresponding to the attack source from this range. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0038] Figure 1 A schematic diagram of a process for discovering unknown malicious IPs through multiple known malicious IPs provided in an embodiment of the present application;

[0039] Figure 2 A schematic diagram of a related art method for determining neighbor IP addresses;

[0040] Figure 3 A schematic diagram of a process for determining a neighbor's IP address in a related art;

[0041] Figure 4A schematic diagram of the principle of communication causality provided in an embodiment of the present application;

[0042] Figure 5 A schematic diagram of a communication status change provided in an embodiment of the present application;

[0043] Figure 6 A schematic diagram of a communication causal relationship determination process provided in an embodiment of the present application;

[0044] Figure 7 A schematic diagram of a secure IP determination process provided in an embodiment of the present application;

[0045] Figure 8 A flowchart of a causal adjacency discovery method provided in an embodiment of the present application;

[0046] Figure 9 A schematic diagram illustrating the principle of a low-probability neighbor discovery method provided in an embodiment of the present application;

[0047] Figure 10 A schematic diagram of a conditional probability calculation process provided in an embodiment of the present application;

[0048] Figure 11 A flowchart of a low-probability neighbor discovery method provided in an embodiment of the present application;

[0049] Figure 12 A flowchart of a method for determining a neighbor IP address provided in an embodiment of the present application;

[0050] Figure 13 A flowchart of another method for determining a neighbor IP address provided in an embodiment of the present application;

[0051] Figure 14 A schematic diagram of the structure of a device for determining a neighbor IP address provided in an embodiment of the present application;

[0052] Figure 15 A schematic diagram of the hardware structure of an electronic device for implementing a method for determining neighbor IP addresses provided in an embodiment of the present application. DETAILED DESCRIPTION

[0053] In order to solve the problem of high false alarm rate in related technologies when searching for neighboring IPs of malicious IPs whose security is unknown, the embodiments of the present application provide a method, device, electronic device and storage medium for determining neighboring IPs.

[0054] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application can be combined with each other if there is no conflict.

[0055] First, it should be noted that in the embodiment of the present application, the protocol (Internet Protocol, IP) for interconnection between networks corresponds to a network device (also called a node), and analyzing the relationship between IPs is equivalent to analyzing the relationship between network devices.

[0056] To facilitate understanding of this application, the technical terms involved in this application are:

[0057] APT, a cyberattack strategy, is often adopted by state-sponsored hackers or other highly organized criminal groups. APT attacks are characterized by high sophistication and secrecy. Attackers have ample resources and time to plan and execute attacks. The main purpose of such attacks is to steal information, destroy critical infrastructure, or conduct long-term surveillance of targets.

[0058] NetFlow is used to reflect the communication status of an IP with other IPs within a certain period of time. The main fields include in_bytes, in_pkts, tcp_flag, protocol, etc. Among them, in_bytes and in_pkts record the total number of data bytes and the number of packets passing through a specific network interface respectively, which are used to monitor network bandwidth usage and traffic patterns; tcp_flag can reflect the status of flag bits in the TCP flow, such as SYN, ACK, etc., which are used to diagnose TCP connection problems and security risks; protocol can identify the protocol type used by the IP layer, such as TCP, UDP, which is used to help analyze the network traffic distribution of different protocols. In this application, these fields are used to perform statistical calculations on the status of network flows.

[0059] An adjacency relationship refers to the relationship between two vertices in a graph. From a full traffic perspective, it refers to the connection relationship between IP addresses. An adjacency discovery method refers to the method of discovering and determining whether an adjacency relationship exists between two IP addresses.

[0060] Hash functions are fundamental building blocks in cryptography, producing a fixed-size output (often called a hash value) from input data of any size. Each different input produces a unique output, making hash functions ideal for verifying data integrity, as changing even a small portion of the input data will produce a completely different hash value. Hashes are also used to securely store passwords, as only the hash of the password is stored, rather than the password itself. This prevents the password from being compromised even if the database is compromised.

[0061] See also Figure 1 , Figure 1A schematic diagram of a process for discovering unknown malicious IPs through multiple known malicious IPs provided in an embodiment of the present application mainly includes: obtaining multiple known malicious IPs corresponding to the same attack source, applying an adjacency discovery method to these multiple known malicious IPs, discovering multiple layers of neighboring IPs with unknown security, determining the centrality of these neighboring IPs with unknown security through a centrality algorithm, eliminating safe IPs based on the centrality of these neighboring IPs, obtaining abnormal IPs, and generating new intelligence based on the abnormal IPs.

[0062] These stages are introduced below.

[0063] 1. Obtain multiple known malicious IP addresses corresponding to the same attack source.

[0064] This phase involves manual source tracing and analysis, selecting multiple malicious IP addresses from the same attack source from identified malicious activities as input parameters. For example, these multiple malicious IP addresses might be associated with multiple devices belonging to the same APT organization, multiple command and control (CC) servers associated with the same virus variant, or multiple IP addresses resolved from the same malicious domain name. Combining theoretical and experimental results, using multiple related malicious IP addresses as input can significantly improve the accuracy of intelligence production.

[0065] 2. Apply neighbor discovery method to these multiple known malicious IPs to discover neighbor IPs with unknown multi-layer security.

[0066] Adopting a neighbor discovery method, we identify each malicious IP's neighboring IP addresses whose security is unknown. Based on these discovered neighbor IP addresses, we then iterate to discover more neighbor IP addresses. Since the devices corresponding to neighbor IP addresses are likely to include victim devices, malicious jump point devices, and malicious core control devices, repeated discovery cycles reveal deeper neighbor IP addresses, increasing the number of perpetrator and victim devices.

[0067] 3. Determine the centrality of these neighbor IPs whose security is unknown through the centrality algorithm.

[0068] Apply the centrality algorithm to calculate the centrality score of each neighbor IP among these neighbor IPs with unknown security. The centrality score is used to characterize the importance of this neighbor IP in the network. Centrality algorithms include degree centrality, closeness centrality, betweenness centrality and vector centrality.

[0069] The following introduces various centrality algorithms.

[0070] Degree centrality: This measure measures a node's importance in the network by counting the number of edges connected to it (corresponding to a neighboring IP address). In APT attacks, nodes with high degree centrality are likely targets for attackers because they are directly connected to multiple other nodes in the network, allowing attackers to spread malware or steal data through these nodes. Furthermore, after an APT attack, the APT organization's external hubs also exhibit degree centrality.

[0071] Proximity Centrality: In this approach, the "distance" between two nodes is defined not simply by their physical location or path length within the network, but by the similarity of their communication flow patterns. This similarity is assessed based on factors such as traffic size, type, frequency, and duration, enabling more precise identification of important nodes within the network and understanding their role in network communications. Incorporating NetFlow similarity into proximity centrality analysis provides a new perspective for network security analysis. When a victim or APT group's devices are known, proximity centrality can be used to quickly identify suspected devices for subsequent analysis.

[0072] Betweenness Centrality: This value reflects the frequency with which a node appears on all shortest paths in a network. A higher value indicates a stronger bridging role for the node within the network. For APT attacks, nodes with high betweenness centrality values ​​may be key nodes used by attackers to spread malware or steal data, or they may be intermediate jump points such as VPNs.

[0073] Vector centrality: This factor considers not only the number of direct connections a node has, but also the quality of those connections. A node connected to multiple nodes with high centrality also has a high vector centrality. In APT protection scenarios, a node with a high vector centrality value may indicate a node connected to multiple critical assets or sensitive areas, making it a key focus for monitoring and protection. Furthermore, in APT intrusion scenarios, nodes with vector centrality are often core devices within the APT organization, and using core devices for tracing often yields excellent results.

[0074] In the subsequent key node identification and extraction stage, different malicious labels can be assigned to the discovered unknown malicious IPs based on different centrality scores.

[0075] 4. Eliminate safe IPs based on the centrality of these neighboring IPs to obtain abnormal IPs.

[0076] Screen out anomalous IPs from neighboring IPs with high centrality (i.e., centrality scores above a preset score). This screening method should take into account that IPs with high centrality scores may also be legitimate public service IPs. Therefore, methods should be devised to filter out these public service IPs to improve accuracy. For example, using asset mapping methods, we can remove safe IPs from neighboring IPs with centrality scores above a preset score to identify anomalous IPs.

[0077] 5. Generate new intelligence based on abnormal IP addresses.

[0078] When the input is multiple related known malicious IPs, the abnormal IPs that are screened out are newly discovered unknown malicious IPs. These unknown malicious IPs are highly likely to be core nodes of malicious organizations. Furthermore, based on the centrality score of the abnormal IPs, the newly discovered unknown malicious IPs can be labeled with information such as whether they are malicious and the malicious organization they belong to. Indicators of Compromise (IOCs) can also be extracted from the assets corresponding to these unknown malicious IPs, added to the illegal list, and recorded in the threat intelligence library.

[0079] Next, three neighbor discovery methods in the embodiments of the present application are introduced.

[0080] Method 1: Traditional method.

[0081] In traditional solutions, when defining neighbor IPs, select IPs that frequently interact with malicious IPs within a certain period of time, and ensure that these IPs are neither known malicious IPs nor known safe IPs such as public service IPs.

[0082] like Figure 2 As shown, the traditional method observes whether IP1 and IP2 have multiple complete communications to determine whether the two IPs are neighbors. If the number of complete communication flows is less than a preset threshold, the two IPs are considered non-neighbors. If the number of complete communication flows is greater than the preset threshold, known intelligence (known safe and malicious lists) can be used to determine whether the two IPs are neighbors. The accuracy of this method relies entirely on the accuracy of known intelligence excluding public services, and the method itself cannot limit or filter public services.

[0083] See also Figure 3 , Figure 3 The flow chart of the traditional method includes the following steps:

[0084] (1) Within a given time, select a malicious IP and perform NetFlow query on it.

[0085] (2) Based on the query results, determine the number of flows that the malicious IP communicates with each remote IP.

[0086] (3) Determine whether the number of flows corresponding to each remote IP is greater than a preset threshold. If not, the remote IP is considered to be a non-neighbor IP and is discarded. If so, the remote IP is considered to be a suspected neighbor IP of a malicious IP.

[0087] (4) Use open source intelligence (i.e., the safe list set and the malicious list set) to filter each suspected neighbor IP. If it is found to be a safe public service (i.e., it successfully matches the IOC of any asset in the safe list set), the suspected neighbor IP is determined to be a safe IP and discarded. If it is found to be a known malicious IP (i.e., it successfully matches the IOC of any asset in the malicious list set), the suspected neighbor IP is determined to be a malicious IP and discarded. Here, both safe IPs and malicious IPs are filtered out.

[0088] (5) If the open source intelligence does not provide the security of the suspected neighbor IP (i.e., the suspected neighbor IP is an IP that has not been filtered out), the suspected neighbor IP is regarded as a neighbor IP with unknown security.

[0089] Method 2: Causal adjacency discovery method.

[0090] Taking into account that the traditional method will take some public service IPs whose intelligence is not identified (i.e., the security is unknown) as neighbor IPs, since the public service IP itself also has centrality, this will lead to false alarms in the subsequent process. Taking into account different time periods, the same controlled device (corresponding to a malicious IP) always responds to the instructions of the same control device, thereby producing the same state change. Even if the public service is accessed multiple times by the controlled device, the state will not change. That is, there are certain communication characteristics between the control device and the controlled device, while there are no such communication characteristics between the public service and the controlled device. Based on this, the embodiment of the present application utilizes the communication causal relationship between malicious IPs to design a neighbor determination rule.

[0091] First, let’s introduce what communication causality is.

[0092] like Figure 4 As shown in the figure, IP1, the effect IP in the causal relationship, changes from state 1 to state 3 at the previous time point and from state 2 to state 3 at the next time point. That is, IP1 changes from different states to the same state at different time points. If the same remote IP, such as IP2, appears during this process, this remote IP is considered the cause IP that caused IP1's state change, and this cause IP is defined as the neighbor IP. The state of IP1 can be reflected in its NetFlow status.

[0093] It should be noted that the communication causal relationship is explained here by taking the cause IP corresponding to the controlling device and the effect IP corresponding to the controlled device as an example. In fact, the cause IP can also correspond to the controlled device. In this case, the effect IP corresponds to the controlled device that is further controlled by the controlled device.

[0094] Then, the identification process of communication causality is introduced.

[0095] In the process of determining the culprit IP, the sliding time window method can be used to locate the suspected culprit IP, such as Figure 5 As shown in the figure, using the set time window, sliding sampling is performed on the NetFlow of the selected IP (or reference IP), and data for a certain period of time before and after the window is obtained. The states of the data in the two time periods before and after the time window are calculated respectively, and recorded as state X and state Y. When state X and state Y are two different states, it can be considered that the state of the selected IP has changed: from state X to state Y. The remote IP in the sliding window at this time is obtained and defined as the suspected IP.

[0096] In order to improve the accuracy, the IP address can be determined multiple times. Assume that the traffic after the time window is the rear traffic (i.e., the rear network flow), the traffic in the time window is the middle traffic (i.e., the middle network flow), and the traffic before the time window is the front traffic (i.e., the front network flow). Figure 6 As shown, the states of the preceding and succeeding flows in the previous network flow are different, and the states of the preceding and succeeding flows in the current network flow are also different, while the states of the succeeding flows in the previous and current network flows are the same. That is, in NetFlow on a selected IP, if any preceding flow becomes a succeeding flow with the same state at different times, the same suspected causal IP address that appears in the window at that time can be obtained and determined to be the causal IP address. In other words, if a suspected causal IP address appears twice, it is determined to be the causal IP address.

[0097] By using the above method, while generating malicious intelligence, it can also generate safe IP intelligence, such as Figure 7 As shown, the states of the preceding and succeeding flows in the previous network flow are identical, and the states of the preceding and succeeding flows in the current network flow are also identical. That is, if the NetFlow data for a selected IP address shows no change in flow state at different times, then the same IP address that appears consistently within the window can be identified as a safe IP address. This means that after multiple communications, if a remote IP address consistently appears within the window, and each occurrence fails to cause a change in the states of the preceding and succeeding flows, then this IP address can be identified as a safe IP address and no further attention is needed.

[0098] like Figure 8 As shown, the above causal adjacency discovery method includes the following steps:

[0099] (1) Perform NetFlow query on the selected IP within a given time.

[0100] (2) Select a time point and divide all NetFlow into two parts: the former part is the historical traffic (which can be regarded as the network flow in the previous collection time period), and the latter part is the new traffic (which can be regarded as the network flow in the current time period).

[0101] (3) Define a time window with time T as the length. Slide on the historical traffic and the new traffic respectively. Each traffic will be divided into three parts by the time window. The traffic before the time window is called the front traffic (i.e., the front network flow), the traffic within the time window is called the window traffic (i.e., the middle network flow), and the traffic after the time window is called the back traffic (i.e., the back network flow).

[0102] (4) Calculate the state of the previous flow and the state of the subsequent flow in the historical flow and the new flow respectively. The state calculation method is as follows: for any flow whose state is to be calculated, periodically obtain its data in the in_bytes dimension, in_pkts dimension, remote port dimension, and remote IP dimension, thereby obtaining the data sequence in the in_bytes dimension, in_pkts dimension, remote port dimension, and remote IP dimension. Then, for the data sequence in the in_bytes dimension and the data sequence in the in_pkts dimension, the information entropy, information volume, mean, variance, maximum value, and minimum value can be calculated respectively. The information entropy of the data sequence in the remote port dimension and the data sequence in the remote IP dimension can also be calculated respectively. All calculation results are placed in the same array to obtain the state array. The state array is used to describe the state of the flow.

[0103] (5) Determine whether the flow states before and after the historical flow and the new flow have changed. The judgment process is as follows: take the previous flow state array, perform a percentage float on the data in the array to obtain the threshold range, that is, add or subtract x% of the value on the basis of the original value, and determine whether the value of the subsequent flow state array is within this threshold range. When the number of data exceeding the threshold is greater than the specified number, it is considered that the previous flow state is different from the subsequent flow state, that is, the state has changed after the time window T.

[0104] (6) Find the suspected causative IP. During the window sliding process, as described in step (5), determine whether the state of each of the previous and subsequent flows of the historical flow and the new flow has changed. When the state changes, compare whether the subsequent flow state of the historical flow and the new flow is the same. The state comparison method is the same as steps (4) and (5). When the same subsequent state is found in the historical flow and the new flow, the remote IP corresponding to the flow in both time windows is determined as the suspected causative IP.

[0105] (7) Locating neighbor IPs. Based on step (6), if a remote IP is determined to be a suspected causal IP multiple times (e.g., twice), then the remote IP can be considered to be the causal IP. That is, if the number of times a remote IP is determined to be a suspected causal IP exceeds a first preset number, then the remote IP is determined to be the causal IP, and then the causal IP can be determined to be a neighbor IP of the selected IP.

[0106] (8) Finding a safe IP. Based on step (5), when the current and subsequent states do not change, all remote IPs within the time window are recorded and identified as suspected safe IPs. When a remote IP is identified as a suspected safe IP multiple times (e.g., twice), the remote IP is considered to be a safe IP. That is, if the number of times a remote IP is identified as a suspected safe IP exceeds a second preset number, the remote IP is determined to be a safe IP.

[0107] Method 3: Low-probability neighbor discovery method.

[0108] Considering that some APT organizations increase the attack time interval in order to increase the stealth of the infiltration process, and use segmented and time-divided infiltration methods to infiltrate, observing this infiltration method from the perspective of FLOW will reveal obvious traces.

[0109] Compared to historical daily work traffic, the traffic generated by this covert method always has a low probability of appearing in the historical traffic of a network device. Figure 9 As shown in the figure, assume there are two suspected victims: suspected victim 1 and suspected victim 2. Based on their access patterns on day L, suspected victim 1 accessed public services every day except the second day, and accessed a malicious device on the fourth day. Therefore, for suspected victim 1, accessing public services is a high-probability event, while accessing a malicious device is a low-probability event. Similarly, based on their access patterns on day L, suspected victim 2 accessed public services every day except the fourth day, and accessed a malicious device and an unknown device of unknown security on day L. Therefore, for suspected victim 2, accessing public services is also a high-probability event, while accessing malicious and unknown devices is a low-probability event. In the scenario where suspected victims are used as input, the low-probability event of accessing a malicious device is convergent, while the low-probability event of accessing an unknown device is non-convergent.

[0110] It should be noted that Figure 9 The example is introduced with the suspected victim as input. In actual application, Figure 9 The victim can also be used as input, and the principle is the same as above. Figure 9 The perpetrator can also be used as input. In this case, the high-probability event refers to the interaction between the perpetrator and the victim who has been controlled, and the low-probability event refers to the interaction between the perpetrator and the victim who is about to be controlled.

[0111] Based on the above premise, the inventors designed a method for discovering neighbor IP based on probability. The algorithm principle is as follows: Figure 10 As shown, the historical traffic of a network device some time ago is assumed to be daily, credible behavioral traffic. In work and life scenarios, historical traffic is always repetitive, that is, the security traffic generated in work and life is always generated with high probability and with a certain user-intrinsic logical relationship. Therefore, this method uses historical traffic as an anchor point and the first N flows of the selected flow in the historical traffic as conditions to extract the (in_bytes+in_pkts+tcp_flag+protocol) data of each flow, calculate its conditional probability, and thereby evaluate the conditional probability of the new traffic. Subsequently, when the conditional probability of the new traffic of this network device is too low, the IP corresponding to the network device and the remote IP corresponding to the new traffic are defined as neighbors.

[0112] like Figure 11 As shown, the above-mentioned low-probability neighbor discovery method includes the following steps:

[0113] (1) Perform NetFlow query on the selected IP within a given time period to obtain historical traffic.

[0114] (2) Method 1: Calculate the conditional probability of the occurrence of (IP+port) for each flow in the historical traffic. The probability condition is the (IP+port) data of the first N flows of the selected flow. Method 2: Calculate the conditional probability of the occurrence of (in_bytes+in_pkts+tcp_flag+protocol) for each flow in the historical traffic. The probability condition is the (in_bytes+in_pkts+tcp_flag+protocol) data of the first N flows of the selected flow. In addition, when calculating the conditional probability, (IP+port) and (in_bytes+in_pkts+tcp_flag+protocol) can be hashed to ensure uniqueness. Generally, any method can be used to calculate the conditional probability.

[0115] It's important to note that the order in which the conditional events occur is not considered during the calculation. In this method, the frequency of occurrence of the stream representation data within a given time period is the prior probability of that data. The probability obtained using the conditional probability formula is the prior conditional probability.

[0116] (3) The prior conditional probabilities calculated by method 1 and method 2 are stored in a table. The format stored in the table is (prior conditional probability | event | conditional event). Among them, the event is the selected flow, the conditional event is the first N flows of the selected flow, and the prior conditional probability is the calculation result of step (2).

[0117] (4) Look up the new traffic of the selected IP to determine its occurrence probability. The lookup process is as follows: select a flow from the new traffic and select the first N flows of this flow.

[0118] When using method 1 to calculate the conditional probability, hash mapping is performed on the (IP+port) of all selected flows to obtain the query keyword (event|conditional event), where the event is the selected traffic and the conditional event is the first N flows of the selected flow. The prior conditional probability is queried using (event|conditional event) as the index. When the prior conditional probability is less than a certain threshold, or the prior probability is not found, it is considered that a low-probability event has occurred, and the flow to be queried is determined to be a low-probability flow.

[0119] When using method 2 to calculate the conditional probability, hash mapping is performed on (in_bytes+in_pkts+tcp_flag+protocol) of all selected flows to obtain the query keyword (event|conditional event), where the event is the selected flow and the conditional event is the first N flows of the selected flow. The prior conditional probability is queried using (event|conditional event) as the index. When the prior conditional probability is less than a certain threshold, or the prior probability is not found, it is considered that a low-probability event has occurred, and the flow to be queried is determined to be a low-probability flow.

[0120] (5) The remote IP of the low-probability flow is determined as the neighbor IP of the selected IP.

[0121] In actual applications, open source IOC intelligence of the target APT organization is obtained, and NetFlow queries are performed with 17 known malicious IPs as input. The above method is then implemented based on the query results. In the causal adjacency discovery method, the floating threshold of the before and after traffic state values ​​is set to 0.33. In the low-probability adjacency discovery method, the prior condition probability threshold is set to 0.075. 144 (including historical) unknown malicious IPs belonging to the target APT organization are obtained, and these unknown malicious IPs are verified with an accuracy rate of 98%.

[0122] In the embodiments of this application, the causal adjacency discovery method and the low-probability adjacency discovery method can better distinguish traffic from malicious IPs and public service IPs, solving the false positive problem caused by focusing only on degree links in traditional solutions, and improving the average accuracy rate by more than 8%. In addition, traditional methods are unable to identify safe niche public services based solely on communication relationship topology. This application can effectively supplement this missing capability through causal relationships.

[0123] Figure 12 A flowchart of a method for determining a neighbor IP provided in an embodiment of the present application, the method comprising the following steps.

[0124] In step 1201, multiple known malicious IP addresses corresponding to the same attack source are obtained, and each known malicious IP address is used as a reference IP address.

[0125] Among them, multiple known malicious IPs corresponding to the same attack source are associated with each other, for example, multiple device members associated with the same APT organization, multiple command and control servers associated with the same variant virus, and resolved from the same malicious domain name.

[0126] In step 1202, the network flow of the reference IP within a collection time period is divided into a front network flow, a middle network flow, and a back network flow by adding a time window.

[0127] The network flow of a reference IP within a collection time period is actually a flow sequence consisting of multiple flows. When a time window is added to the network flow, any flow that exists between the start and end of the time window is considered a middle network flow. The flow preceding the middle network flow is the front network flow, and the flow following the middle network flow is the back network flow.

[0128] In step 1203, if it is determined that the state of the rear network flow is different from that of the front network flow, and the state of the rear network flow is the same as that of the reference IP in the previous collection time period, then the remote IP corresponding to the middle network flow and the middle network flow of the reference IP in the previous collection time period is determined as the suspected cause IP that is suspected of causing the change in the state of the reference IP.

[0129] In a specific implementation, for any of the subsequent or preceding network flows, the flow state can be determined using the flow's relevant data. For example, data in the in_bytes dimension, in_pkts dimension, remote port dimension, and remote IP dimension of the flow are periodically acquired to obtain data sequences in the in_bytes dimension, in_pkts dimension, remote port dimension, and remote IP dimension. Then, the information entropy, information volume, mean, variance, maximum value, and minimum value of the in_bytes and in_pkts dimension data sequences can be calculated, respectively. The information entropy of the remote port and remote IP dimension data sequences can also be calculated. All calculation results are placed in the same array to obtain a state array, which is used to describe the flow state.

[0130] Furthermore, you can determine whether the status of the subsequent network flow is different from that of the previous network flow by following the steps below:

[0131] The parameter value of each network parameter of the previous network flow is floated, that is, the calculation results in the state array are floated to obtain the parameter value range of the network parameter. Then, the types of network parameters that do not fall into the corresponding parameter value range in the parameter values ​​of the subsequent network flow can be determined. If the number of network parameter types is greater than the specified number, it is determined that the state of the subsequent network flow is different from that of the previous network flow. If the number of network parameter types is not greater than the specified number, it is determined that the state of the subsequent network flow is the same as that of the previous network flow.

[0132] In step 1204, if any remote IP is determined to be a suspected cause IP more than a first preset number of times, the remote IP is determined to be the cause IP causing the state transmission change of the reference IP, and the remote IP is determined to be a neighbor IP of the reference IP.

[0133] The first preset number is, for example, 2, 3, or 4.

[0134] Through the above method, the first layer of neighbor IPs of each known malicious IP are determined. In actual application, multiple layers of neighbor IPs can also be determined to expand the neighbor range. In this case, the above process can also include the following process.

[0135] In step 1205, it is determined whether M-layer neighbor IP discovery has been performed on the known malicious IP. If not, the process proceeds to step 1206. If so, the process proceeds to step 1207, where M is an integer greater than 1.

[0136] Among them, M is such as 2, 3, 4, 5, etc.

[0137] In actual applications, for known malicious IPs, the first-layer neighbor IP determined by the above method is the IP affected by the known malicious IP, the second-layer neighbor IP determined by the above method is the IP that affects the first-layer neighbor IP, the third-layer neighbor IP determined by the above method is the IP affected by the second-layer neighbor IP, the fourth-layer neighbor IP determined by the above method is the IP that affects the third-layer neighbor IP, and so on. This is in line with the chain attack characteristics of network attacks, while public services do not have this chain attack characteristic. Therefore, this method can effectively exclude the IP of public services and avoid determining the IP of public services as neighbor IPs.

[0138] In step 1206 , each neighbor IP determined in this round is used as a new reference IP, and the process returns to step 1202 .

[0139] Among them, each neighbor IP determined in this round is the new neighbor IP determined in this round.

[0140] In step 1207, stop this process.

[0141] That is, stop searching for the M+1th layer neighbor IPs of each known malicious IP.

[0142] Figure 13 A flowchart of another method for determining a neighbor IP provided in an embodiment of the present application, the method comprising the following steps.

[0143] In step 1301, multiple known malicious IP addresses corresponding to the same attack source are obtained, and each known malicious IP address is used as a reference IP address.

[0144] In step 1302, the network flow of the reference IP within a collection time period is obtained.

[0145] In step 1303, the network flow is divided into a front network flow, a middle network flow, and a back network flow by adding a time window.

[0146] In step 1304, if it is determined that the state of the rear network flow is different from that of the front network flow, and the state of the rear network flow is the same as that of the reference IP in the previous collection time period, then the remote IP corresponding to the middle network flow and the middle network flow of the reference IP in the previous collection time period is determined as the suspected cause IP that is suspected of causing the change in the state of the reference IP.

[0147] In step 1305, if any remote IP is determined to be a suspected cause IP more than a first preset number of times, the remote IP is determined to be the cause IP causing the state transmission change of the reference IP, and the remote IP is determined to be a neighbor IP of the reference IP.

[0148] In the above process, steps 1303 to 1305 are to discover neighbor IPs with the help of the causal adjacency discovery method. In some embodiments, the neighbor IPs can also be discovered in combination with the low-probability adjacency discovery method to increase the number of neighbor IPs. Therefore, the above process can also include the following steps.

[0149] In step 1306 , a flow to be queried is selected from the network flows.

[0150] In step 1307, the flow characterization data of the flow to be queried is taken as an event and the flow characterization data of N flows in the network flow that are located before the flow to be queried are taken as conditional events. The probability of occurrence of the event under the conditional event is queried from the prior probability table. The prior probability table is pre-established based on the historical network flow of the reference IP, and N is an integer greater than zero.

[0151] The flow representation data of any flow includes IP+port data, in_bytes+in_pkts+tcp_flag+protocol data, etc.

[0152] During specific implementation, for the historical network flow of the reference IP, the frequency of occurrence of each historical flow (i.e., historical traffic) in the historical network flow when the previous N historical flows appeared can be counted according to the flow representation data, and the occurrence frequency is used as the probability of occurrence of this historical flow (i.e., the above-mentioned prior conditional probability). The probability information of each historical flow is saved in the form of (prior conditional probability | event | conditional event) to obtain a priori probability table.

[0153] Subsequently, the flow representation data of the flow to be queried is used as the event and the flow representation data of the N flows preceding the flow to be queried in the network flow are used as the conditional event. The probability of occurrence of the event under the conditional event can be queried from the prior probability table.

[0154] In step 1308, if the occurrence probability is less than the preset value, or no occurrence probability is found, the flow to be queried is determined to be a low-probability flow, and the remote IP corresponding to the flow to be queried is determined as the neighbor IP of the reference IP.

[0155] In step 1309, it is determined whether M-layer neighbor IP discovery has been performed on the known malicious IP. If not, the process proceeds to step 1310. If so, the process proceeds to step 1311, where M is an integer greater than 1.

[0156] In step 1310 , each neighbor IP determined in this round is used as a new reference IP, and step 1302 is executed.

[0157] In step 1311, stop this process.

[0158] It should be noted that, in the above process, there is no strict sequential relationship between step 1303-step 1305 and step 1306-step 1308. Step 1303-step 1305 can be performed before step 1306-step 1308, step 1303-step 1305 can be performed after step 1306-step 1308, or step 1303-step 1305 and step 1306-step 1308 can be performed in parallel.

[0159] In the embodiment of the present application, for the neighbor IPs determined in steps 1303-1305, the first-layer neighbor IP is the IP affected by the known malicious IP, the second-layer neighbor IP is the IP that affects the first-layer neighbor IP, the third-layer neighbor IP is the IP affected by the second-layer neighbor IP, the fourth-layer neighbor IP is the IP that affects the third-layer neighbor IP, and so on. This is in line with the chain attack characteristics of network attacks, while public services do not have such chain attack characteristics. Therefore, the IP of public services can be well excluded and the IP of public services can be avoided from being determined as the neighbor IP.

[0160] Regarding the neighbor IPs determined from 1306 to 1308, when the known malicious IP corresponds to the IP of a control device, the first-layer neighbor IP is the IP that is likely to be controlled by the controlled device, the second-layer neighbor IP is the IP that is likely to control the first-layer neighbor IP, the third-layer neighbor IP is the IP that is likely to be controlled by the second-layer neighbor IP, the fourth-layer neighbor IP is the IP that is likely to control the third-layer neighbor IP, and so on. This is consistent with the alternating identity cycle characteristic of attackers and victims in network attacks. When the known malicious IP corresponds to the IP of a controlled device, the first-layer neighbor IP is the IP that is likely to control the controlled device, the second-layer neighbor IP is the IP that is likely to be controlled by the first-layer neighbor IP, the third-layer neighbor IP is the IP that is likely to control the second-layer neighbor IP, and the fourth-layer neighbor IP is the IP that is likely to be controlled by the third-layer neighbor IP, and so on. This is also consistent with the alternating identity cycle characteristic of attackers and victims in network attacks. Public services do not have this identity cycle characteristic, so public service IPs can be effectively excluded and prevented from being identified as neighbor IPs.

[0161] In the above Figure 12 or Figure 13 In the process shown, after determining the M-layer neighbor IPs of each known malicious IP, at least one centrality algorithm is used to calculate the centrality score of each neighbor IP (including neighbor IPs from the first layer to the lower M layers) in the network. Safe IPs are then removed from neighbor IPs with centrality scores higher than a preset score to obtain abnormal IPs. These abnormal IPs are then identified as unknown malicious IPs corresponding to the attack source. Based on the abnormal IP centrality score, a malicious label is added to the unknown malicious IP. The malicious label includes whether it is a malicious device, the corresponding attack source information, and the centrality level.

[0162] Since the method of the embodiment of the present application can determine a relatively accurate neighbor IP and greatly reduce the number of neighbor IPs, the difficulty of ultimately determining the unknown malicious IP is relatively low, and the accuracy of the determined unknown malicious IP is relatively high.

[0163] Based on the same technical concept, an embodiment of the present application also provides a device for determining a neighbor IP. The principle of solving the problem by the device for determining a neighbor IP is similar to that of the above-mentioned method for determining a neighbor IP. Therefore, the implementation of the device for determining a neighbor IP can refer to the implementation of the method for determining a neighbor IP, and the repeated parts will not be repeated.

[0164] Figure 14 A schematic diagram of the structure of a device for determining a neighbor IP address provided in an embodiment of the present application:

[0165] An acquisition module 1401 is configured to acquire multiple known malicious IP addresses corresponding to the same attack source, use each known malicious IP address as a reference IP address, and acquire network flows of the reference IP addresses within a collection time period.

[0166] A division module 1402 is configured to divide the network flow into a front network flow, a middle network flow, and a back network flow by adding a time window;

[0167] A first determining module 1403 is configured to, if it is determined that the state of the subsequent network flow is different from that of the preceding network flow, and the state of the subsequent network flow is the same as that of the subsequent network flow of the reference IP in the previous collection time period, determine the remote IP corresponding to both the intermediate network flow and the intermediate network flow of the reference IP in the previous collection time period as the suspected causal IP that is suspected of causing the state change of the reference IP;

[0168] The second determination module 1404 is used to determine that any remote IP is the cause IP that causes the state transmission change of the reference IP if the number of times any remote IP is determined as the suspected cause IP exceeds the first preset number, and determine the remote IP as the neighbor IP of the reference IP.

[0169] In some embodiments, the first determining module 1403 is further configured to, if it is determined that the state of the subsequent network flow is the same as that of the preceding network flow, determine the remote IP corresponding to both the intermediate network flow and the reference IP in the intermediate network flow of the previous collection time period as a non-suspected cause IP;

[0170] The second determining module 1404 is further configured to determine any remote IP as a safe IP if the number of times any remote IP is determined as a non-suspected IP exceeds a second preset number.

[0171] In some embodiments, the state of any network flow includes parameter values ​​of multiple network parameters, and the first determining module 1403 is specifically configured to determine whether the state of the subsequent network flow is different from the state of the previous network flow according to the following steps:

[0172] Floating the parameter value of each network parameter of the previous network flow to obtain a parameter value range of the network parameter;

[0173] Determining the network parameter types that do not fall within the corresponding parameter value range among the parameter values ​​of the subsequent network flow;

[0174] If the number of network parameter types is greater than a specified number, it is determined that the state of the subsequent network flow is different from that of the previous network flow; otherwise, it is determined that the state of the subsequent network flow is the same as that of the previous network flow.

[0175] In some embodiments, the acquisition module 1401 is further configured to select a flow to be queried from the network flow;

[0176] The first determining module 1403 is further configured to query the probability of occurrence of the event under the conditional event from a priori probability table, using the flow representation data of the flow to be queried as an event and the flow representation data of N flows in the network flow preceding the flow to be queried as conditional events, wherein the priori probability table is pre-established based on the historical network flow of the reference IP, and N is an integer greater than zero;

[0177] The second determination module 1404 is further configured to determine that the flow to be queried is a low-probability flow if the occurrence probability is less than a preset value, or no occurrence probability is found, and determine the remote IP corresponding to the flow to be queried as the neighbor IP of the reference IP.

[0178] In some embodiments, the system further includes a control module 1405 for:

[0179] Each neighbor IP determined in this round is used as a new reference IP, and the step of obtaining the network flow of the reference IP within a collection time period is executed until the M-layer neighbor IPs of the known malicious IP are determined, where M is an integer greater than 1.

[0180] In some embodiments, the system further includes a processing module 1406 for:

[0181] Calculate the centrality score of each neighbor IP in the network through at least one centrality algorithm;

[0182] Eliminate safe IPs from neighboring IPs whose centrality scores are higher than the preset score to obtain abnormal IPs;

[0183] The abnormal IP is determined to be an unknown malicious IP corresponding to the attack source, and a malicious label is added to the unknown malicious IP according to the centrality score of the abnormal IP.

[0184] The division of modules in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, the functional modules in the embodiments of the present application may be integrated into one processor, or may exist physically separately, or two or more modules may be integrated into one module. The coupling between the modules can be achieved through some interfaces, which are usually electrical communication interfaces, but it is not ruled out that they may be mechanical interfaces or other forms of interfaces. Therefore, the modules described as separate components may or may not be physically separated, and may be located in one place or distributed to different locations of the same or different devices. The above-mentioned integrated modules can be implemented in the form of hardware or in the form of software functional modules.

[0185] After introducing the neighbor IP determination method and apparatus according to an exemplary embodiment of the present application, an electronic device according to another exemplary embodiment of the present application is introduced next.

[0186] Refer to the following Figure 15 The electronic device 150 implemented according to this embodiment of the present application is described. Figure 15 The electronic device 150 shown is merely an example and should not limit the functions and scope of use of the embodiments of the present application.

[0187] like Figure 15 As shown, the electronic device 150 is a general electronic device. Components of the electronic device 150 may include, but are not limited to, the at least one processor 151, the at least one memory 152, and a bus 153 connecting different system components (including the memory 152 and the processor 151).

[0188] Bus 153 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, and a processor or local bus using any of a variety of bus architectures.

[0189] The memory 152 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 1521 and / or a cache memory 1522 , and may further include a read-only memory (ROM) 1523 .

[0190] The memory 152 may also include a program / utility 1525 having a set (at least one) of program modules 1524, such program modules 1524 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0191] The electronic device 150 may also communicate with one or more external devices 154 (e.g., a keyboard, pointing device, etc.), one or more devices that enable a user to interact with the electronic device 150, and / or any device that enables the electronic device 150 to communicate with one or more other electronic devices (e.g., a router, a modem, etc.). Such communication may occur via an input / output (I / O) interface 155. Furthermore, the electronic device 150 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network such as the Internet) via a network adapter 156. As shown, the network adapter 156 communicates with other modules of the electronic device 150 via a bus 153. It should be understood that, although not shown, other hardware and / or software modules may be used in conjunction with the electronic device 150, including but not limited to microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0192] In an exemplary embodiment, a storage medium is also provided. When a computer program in the storage medium is executed by a processor of an electronic device, the electronic device can perform any of the above-mentioned methods for determining a neighbor IP address. Optionally, the storage medium can be a non-transitory computer-readable storage medium, such as a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, or optical data storage device.

[0193] In an exemplary embodiment, the electronic device of the present application may include at least one processor and a memory communicatively connected to the at least one processor, wherein the memory stores a computer program that can be executed by the at least one processor, and when the computer program is executed by the at least one processor, the at least one processor can execute the steps of any neighbor IP determination method provided in the embodiments of the present application.

[0194] In an exemplary embodiment, a computer program product is further provided. When the computer program product is executed by an electronic device, the electronic device can implement any exemplary method provided in this application.

[0195] Furthermore, the computer program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or component, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, RAM, ROM, an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0196] In the embodiment of the present application, the program product for determining neighbor IP addresses may be a CD-ROM and include program code, and may be run on a computing device. However, the program product of the present application is not limited thereto. In this document, a readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0197] A readable signal medium may include a data signal transmitted in baseband or as part of a carrier wave, which carries readable program code. Such a transmitted data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium that can transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0198] The program code contained on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, radio frequency (RF), etc., or any suitable combination of the foregoing.

[0199] The program code for performing the operations of the present application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, such as a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0200] It should be noted that although several units or subunits of the device are mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, depending on the embodiment of the application, the features and functions of two or more units described above can be embodied in a single unit. Conversely, the features and functions of a single unit described above can be further divided and embodied by multiple units.

[0201] Furthermore, although the operations of the method of the present application are described in a particular order in the accompanying drawings, this does not require or imply that the operations must be performed in this particular order, or that all illustrated operations must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0202] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0203] The present application is described with reference to the flowcharts and / or block diagrams of the methods, apparatus (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0204] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0205] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0206] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0207] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application also includes these modifications and variations.

Claims

1. A method for determining a neighbor IP, characterized in that: include: Obtain multiple known malicious IP addresses corresponding to the same attack source, use each known malicious IP address as a reference IP address, and obtain the network flow of the reference IP address within a collection time period. By adding a time window, the network flow is divided into a front network flow, a middle network flow and a back network flow; If it is determined that the state of the subsequent network flow is different from that of the preceding network flow, and the state of the subsequent network flow is the same as that of the subsequent network flow of the reference IP in the previous collection time period, the remote IP corresponding to both the intermediate network flow and the intermediate network flow of the reference IP in the previous collection time period is determined as the suspected cause IP that is suspected of causing the state change of the reference IP; If any remote IP is determined to be a suspected cause IP more than a first preset number of times, the remote IP is determined to be the cause IP causing the state transmission change of the reference IP, and the remote IP is determined to be a neighbor IP of the reference IP.

2. The method according to claim 1, wherein Also includes: If it is determined that the state of the subsequent network flow is the same as that of the previous network flow, the remote IP corresponding to the intermediate network flow and the reference IP in the intermediate network flow of the previous collection time period is determined as a non-suspected cause IP; If the number of times that any remote IP is determined to be a non-suspected IP exceeds a second preset number, the remote IP is determined to be a safe IP.

3. The method according to claim 1 or 2, wherein: The state of any network flow includes parameter values ​​of various network parameters. The following steps are used to determine whether the state of the subsequent network flow is different from that of the previous network flow: Floating the parameter value of each network parameter of the previous network flow to obtain a parameter value range of the network parameter; Determining the network parameter types that do not fall within the corresponding parameter value range among the parameter values ​​of the subsequent network flow; If the number of network parameter types is greater than a specified number, it is determined that the state of the subsequent network flow is different from that of the previous network flow; otherwise, it is determined that the state of the subsequent network flow is the same as that of the previous network flow.

4. The method according to claim 1, wherein Also includes: Selecting a flow to be queried from the network flows; Taking the flow characterization data of the flow to be queried as an event and the flow characterization data of N flows in the network flow that are located before the flow to be queried as conditional events, querying the probability of occurrence of the event under the conditional event from a priori probability table, wherein the priori probability table is pre-established based on the historical network flow of the reference IP, and N is an integer greater than zero; If the occurrence probability is less than a preset value, or no occurrence probability is found, the flow to be queried is determined to be a low-probability flow, and the remote IP corresponding to the flow to be queried is determined as a neighbor IP of the reference IP.

5. The method according to claim 1, 2 or 4, characterized in that Also includes: Each neighbor IP determined in this round is used as a new reference IP, and the step of obtaining the network flow of the reference IP within a collection time period is executed until the M-layer neighbor IPs of the known malicious IP are determined, where M is an integer greater than 1.

6. The method according to claim 5, wherein Also includes: Calculate the centrality score of each neighbor IP in the network through at least one centrality algorithm; Eliminate safe IPs from neighboring IPs whose centrality scores are higher than the preset score to obtain abnormal IPs; The abnormal IP is determined to be an unknown malicious IP corresponding to the attack source, and a malicious label is added to the unknown malicious IP according to the centrality score of the abnormal IP.

7. A device for determining neighbor IP, characterized in that: include: An acquisition module is used to acquire multiple known malicious IP addresses corresponding to the same attack source, use each known malicious IP address as a reference IP address, and acquire the network flow of the reference IP address within a collection time period. A division module, configured to divide the network flow into a front network flow, a middle network flow, and a rear network flow by adding a time window; A first determining module is configured to, if it is determined that the state of the subsequent network flow is different from that of the preceding network flow, and the state of the subsequent network flow is the same as that of the subsequent network flow of the reference IP in the previous collection time period, determine the remote IP corresponding to both the intermediate network flow and the intermediate network flow of the reference IP in the previous collection time period as the suspected cause IP that is suspected of causing the state change of the reference IP; The second determination module is used to determine that any remote IP is the cause IP that causes the state transmission change of the reference IP if the number of times any remote IP is determined as the suspected cause IP exceeds a first preset number, and determine the remote IP as a neighbor IP of the reference IP.

8. An electronic device, characterized in that: include: at least one processor, and a memory communicatively coupled to the at least one processor, wherein: The memory stores a computer program executable by the at least one processor. The computer program is executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 6.

9. A storage medium, characterized in that: When the computer program in the storage medium is executed by a processor of an electronic device, the electronic device can perform the method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The method comprises a computer program, which implements the method according to any one of claims 1 to 6 when executed by a processor.

Images