Data detection method and device

Abstract

The invention provides a data detection method and device, is applied to the technical field of network security, and is used for improving the accuracy of malicious behavior detection. The method comprises the following steps: acquiring at least one target address from at least one piece of network flow data of a to-be-detected IP; acquiring first network traffic data of any target address in the at least one target address; acquiring second network flow data communicating with any target address from the at least one piece of network flow data; screening out third network flow data comprising an effective load and the IP to be detected being a source IP from the at least one network flow data; calculating a first abnormal evaluation value of the to-be-detected IP according to the first network flow data and the second network flow data, and / or calculating a second abnormal evaluation value of the to-be-detected IP according to the first network flow and the third network flow; and according to the first anomaly evaluation value and / or the second anomaly evaluation value, calculating the maliciousness degree of the to-be-detected IP, and according to the maliciousness degree, determining whether to execute an alarm on the to-be-detected IP.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a data detection method and device. Background Art

[0002] In today's highly connected world, network security has become a major challenge for enterprises and organizations. As the complexity and diversity of network attacks grow, traditional signature-based security threat detection methods are difficult to meet the requirements of security detection, face many limitations, and are insufficient in identifying abnormal traffic and complex attack patterns.

[0003] Therefore, how to improve the accuracy of malicious behavior detection is an urgent problem to be solved. Summary of the invention

[0004] The present application provides a data detection method and device for improving the accuracy of malicious behavior detection.

[0005] In a first aspect, an embodiment of the present application provides a data detection method, which can be applied to any electronic device with processing capabilities, and the method includes:

[0006] Acquire at least one target address from at least one network flow data of the IP to be detected, wherein the at least one network flow data is network flow data of the communication between the IP to be detected and the at least one target address, and each network flow data includes a target address;

[0007] Obtaining first network traffic data of any target address among at least one target address; the first network traffic data is network traffic data of any target address communicating with a second IP; the second IP is different from the IP to be detected;

[0008] Acquire second network traffic data communicating with any target address from at least one network traffic data;

[0009] Filtering out third network traffic data including a valid load and the IP to be detected being a source IP from at least one network traffic data, wherein the valid load is used to indicate that the third network traffic data includes actual service data to be transmitted;

[0010] Calculate a first abnormality assessment value of the IP to be detected based on the first network traffic data and the second network traffic data according to a first preset rule, and / or calculate a second abnormality assessment value of the IP to be detected based on the first network traffic and the third network traffic according to a second preset rule;

[0011] According to the first abnormality evaluation value and / or the second abnormality evaluation value, the maliciousness of the IP to be detected is calculated according to the third preset rule, and the maliciousness is used to indicate the degree of communication abnormality of the IP to be detected; according to the maliciousness, it is determined whether to execute an alarm for the IP to be detected.

[0012] In this solution, the first network traffic data is used to indicate the normal communication mode between any target address and other IPs, and the second network traffic data is used to indicate the communication mode between any target address and the IP to be detected. The first abnormal evaluation value calculated by the first network traffic data and the second network traffic data can indicate whether the communication mode between the IP to be detected and the any target address is abnormal, and can accurately identify the difference between the communication behavior of the IP to be detected and the communication behavior of the normal IP, thereby improving the accuracy of malicious behavior detection; the third network traffic data is used to indicate the network traffic data sent by the IP to be detected. Since normal users often access complex external services due to complex life or office needs when using devices in daily life, that is, the similarity between each network traffic data should not be large, and most of the access targets (that is, at least one target address) should be whitelisted public service devices. Therefore, the second abnormal evaluation value calculated based on the first network traffic data and the second network traffic data can more accurately reflect whether the control and command behaviors of the IP to be detected are abnormal; in addition, combining the two abnormal evaluation values ​​to calculate the maliciousness of the IP to be detected can further improve the accuracy of malicious behavior detection.

[0013] Optionally, calculating a first abnormality assessment value of the IP to be detected according to the first network traffic data and the second network traffic data according to a first preset rule includes:

[0014] Respectively obtain a first indicator set and a second indicator set of the first network traffic data and the second network traffic data, the first indicator set is used to indicate the communication mode between any target address and the second IP, and the second indicator set is used to indicate the communication mode between any target address and the IP to be detected; calculate the correlation between the first indicator set and the second indicator set according to the first preset rule; obtain the correlation between the first indicator set of each target address in at least one target address and the second indicator set corresponding to the target address, and determine the number of target addresses whose correlation is less than a first threshold; the number of target addresses whose correlation is less than the first target address is the first abnormality assessment value;

[0015] The maliciousness of the IP to be detected is calculated according to the first abnormality evaluation value and the third preset rule, including: calculating the ratio of the first abnormality evaluation value to the number of at least one network traffic data to obtain the maliciousness of the IP to be detected.

[0016] Optionally, the correlation is a confidence level; obtaining the correlation between the first network flow data and the second network flow data of each target address in at least one target address, and determining the number of target addresses whose correlation is less than a first threshold, comprising: calculating, according to a first formula, the confidence level of the second indicator set appearing under the premise that the first indicator set exists, and determining the number of target addresses whose confidence level is less than the first threshold; the first formula is as follows:

[0017]

[0018] Among them, EFN represents the number of target addresses whose confidence is less than the first threshold; N represents the number of at least one target address; P function represents the confidence of the second indicator set under the premise of the existence of the first indicator set; Flowdata i Indicates the second indicator set corresponding to the i-th target address; DstIP i ,Dstport i AF respectively represent the IP address and port of the i-th target address, and are used to indicate the first indicator set of the i-th target address; p The function indicates that when the confidence is less than the first threshold, the output value of the function is 1, otherwise, the output value is 0.

[0019] Optionally, respectively obtaining a first indicator set and a second indicator set of the first network traffic data and the second network traffic data includes: respectively obtaining at least one of the data packet size, the number of data packets, the timestamp, the TCP flag and the protocol type included in the first network traffic data and the second network traffic data; calculating the correlation between the first indicator set and the second indicator set according to a first preset rule, including: calculating the maximum value, minimum value, mean value, variance and information entropy of each indicator in the first indicator set; calculating the maximum value, minimum value, mean value, variance and information entropy of each indicator in the second indicator set; calculating the confidence of the corresponding indicator in the second indicator set under the premise that each indicator in the first indicator set exists, based on the maximum value, minimum value, mean value, variance and information entropy of each indicator in the first indicator set and the maximum value, minimum value, mean value, variance and information entropy of the corresponding indicator in the second indicator set; determining the confidence of the second indicator set under the premise that the first indicator set exists, based on the confidence of each corresponding indicator in the second indicator set.

[0020] Optionally, a second anomaly assessment value of the IP to be detected is calculated according to the first network traffic and the third network traffic data in accordance with a second preset rule, including: obtaining the number of different IPs communicating with each target address from the first network traffic data of each target address in at least one target address; determining the number of target addresses whose number of different communicating IPs is greater than a second threshold; calculating according to the second formula the ratio of the sum of the similarities between pairwise network traffic data in the third network traffic data to the number of target addresses whose number of different communicating IPs is greater than the second threshold; the ratio is the second anomaly assessment value; according to the second anomaly assessment value, the maliciousness of the IP to be detected is calculated according to the third preset rule, including: calculating the ratio of the second anomaly assessment value to the number of at least one network traffic data to obtain the maliciousness of the IP to be detected.

[0021] Optionally, the second formula is as follows:

[0022]

[0023] in, represents the sum of similarities between two network traffic data in the third network traffic data; N1 represents the number of network traffic data in the third network traffic data; DstIP i ,DstIP j They represent the i-th target address and the j-th target address respectively; the SC function is a similarity calculation function, which means calculating the similarity between the network flow data between the IP to be detected and the i-th target address and the network flow data between the IP to be detected and the j-th target address; Indicates the number of target addresses for which the number of different IPs in communication is greater than the second threshold; N2 indicates the number of at least one target address; FLOW function indicates obtaining the first network flow data of the i-th target address; DstIP i ,DstPort i Respectively represent the IP address and port of the i-th target address, used to indicate the i-th target address; AF srcip It means that if the number of different IPs communicating with the i-th target address is greater than the second threshold, the output value is 1, otherwise, the output value is 0.

[0024] Optionally, the maliciousness of the IP to be detected is calculated according to the first anomaly assessment value and the second anomaly assessment value according to a third preset rule, including: calculating the product of the first anomaly assessment value and the second anomaly assessment value, and dividing it by the square of the number of at least one network traffic data to obtain the maliciousness of the IP to be detected.

[0025] Optionally, each network traffic data in at least one network traffic data includes a data packet size and a TCP flag, and the TCP flag includes: a synchronization flag, an end flag, and a reset flag; the method also includes: determining from at least one network traffic data the number A of network traffic data including a greater number of synchronization flags than the number of end flags; determining from at least one network traffic data the number B of network traffic data including a reset flag; determining from at least one network traffic data the number C of network traffic data including a data packet size less than a third threshold value; calculating the product of A, B, and C to obtain a third anomaly assessment value; calculating the maliciousness of the IP to be detected according to the first anomaly assessment value and / or the second anomaly assessment value according to a third preset rule, and also includes: calculating the maliciousness of the IP to be detected according to the first anomaly assessment value and / or the second anomaly assessment value, and the third anomaly assessment value according to a third preset rule.

[0026] Optionally, the maliciousness of the IP to be detected is calculated according to the first abnormality assessment value and / or the second abnormality assessment value, and the third abnormality assessment value according to a third preset rule, including: calculating the product of the first abnormality assessment value and the third abnormality assessment value, and dividing it by the square of the number of at least one network traffic data to obtain the maliciousness of the IP to be detected; or, calculating the product of the second abnormality assessment value and the third abnormality assessment value, and dividing it by the square of the number of at least one network traffic data to obtain the maliciousness of the IP to be detected; or, calculating the product of the first abnormality assessment value, the second abnormality assessment value and the third abnormality assessment value, and dividing it by the cube of the number of at least one network traffic data to obtain the maliciousness of the IP to be detected.

[0027] In a second aspect, an embodiment of the present application provides a data detection device, including:

[0028] The acquisition module is used to: acquire at least one target address from at least one network flow data of the IP to be detected, wherein at least one network flow data is network flow data of the communication between the IP to be detected and at least one target address, and each network flow data includes a target address; acquire first network flow data of any target address among the at least one target address; the first network flow data is network flow data of the communication between any target address and a second IP; the second IP is different from the IP to be detected; acquire second network flow data of the communication with any target address from at least one network flow data; filter out third network flow data including a valid load and the IP to be detected as a source IP from at least one network flow data, wherein the valid load is used to indicate that the third network flow data includes actual business data to be transmitted;

[0029] The processing module is used to: calculate a first abnormality evaluation value of the IP to be detected according to the first network flow data and the second network flow data according to a first preset rule, and / or calculate a second abnormality evaluation value of the IP to be detected according to the first network flow and the third network flow according to a second preset rule; calculate the maliciousness of the IP to be detected according to the first abnormality evaluation value and / or the second abnormality evaluation value according to a third preset rule, wherein the maliciousness is used to indicate the degree of communication abnormality of the IP to be detected;

[0030] The alarm module is used to determine whether to issue an alarm to the IP to be detected based on the maliciousness.

[0031] Optionally, when the processing module calculates the first anomaly assessment value of the IP to be detected according to the first network traffic data and the second network traffic data according to the first preset rule, the acquisition module is also used to: respectively obtain the first indicator set and the second indicator set of the first network traffic data and the second network traffic data, the first indicator set is used to indicate the communication method between any target address and the second IP, and the second indicator set is used to indicate the communication method between any target address and the IP to be detected; the processing module is also used to: calculate the correlation between the first indicator set and the second indicator set according to the first preset rule; obtain the correlation between the first indicator set of each target address in at least one target address and the second indicator set corresponding to the target address, and determine the number of target addresses whose correlation is less than the first threshold; the number of target addresses whose correlation is less than the first target address is the first anomaly assessment value; when the processing module calculates the maliciousness of the IP to be detected according to the first anomaly assessment value according to the third preset rule, it is used to: calculate the ratio of the first anomaly assessment value to the number of at least one network traffic data to obtain the maliciousness of the IP to be detected.

[0032] Optionally, the correlation is a confidence level; when the processing module obtains the correlation between the first network flow data and the second network flow data of each target address in at least one target address and determines the number of target addresses whose correlation is less than a first threshold, it is used to: calculate the confidence level of the second indicator set appearing under the premise that the first indicator set exists according to the first formula, and determine the number of target addresses whose confidence level is less than the first threshold; the first formula is as follows:

[0033]

[0034] Among them, EFN represents the number of target addresses whose confidence is less than the first threshold; N represents the number of at least one target address; P function represents the confidence of the second indicator set under the premise of the existence of the first indicator set; Flowdata i Indicates the second indicator set corresponding to the i-th target address; DstIP i ,Dstport i AF respectively represent the IP address and port of the i-th target address, and are used to indicate the first indicator set of the i-th target address; p The function indicates that when the confidence is less than the first threshold, the output value of the function is 1, otherwise, the output value is 0.

[0035] Optionally, when the acquisition module respectively acquires the first indicator set and the second indicator set of the first network traffic data and the second network traffic data, it is used to: respectively acquire at least one of the data packet size, the number of data packets, the timestamp, the TCP flag and the protocol type included in the first network traffic data and the second network traffic data; when the processing module calculates the correlation between the first indicator set and the second indicator set according to the first preset rule, it is used to: calculate the maximum value, minimum value, mean value, variance and information entropy of each indicator in the first indicator set; calculate the maximum value, minimum value, mean value, variance and information entropy of each indicator in the second indicator set; calculate the confidence of the corresponding indicator in the second indicator set under the premise that each indicator in the first indicator set exists, based on the maximum value, minimum value, mean value, variance and information entropy of each indicator in the first indicator set and the maximum value, minimum value, mean value, variance and information entropy of the corresponding indicator in the second indicator set; determine the confidence of the second indicator set under the premise that the first indicator set exists, based on the confidence of each corresponding indicator in the second indicator set.

[0036] Optionally, when the processing module calculates the second anomaly evaluation value of the IP to be detected according to the first network traffic and the third network traffic data according to the second preset rule, it is used to: obtain the number of different IPs communicating with each target address from the first network traffic data of each target address in at least one target address; determine the number of target addresses whose number of different communicating IPs is greater than the second threshold; calculate the ratio of the sum of the similarities between each pair of network traffic data in the third network traffic data to the number of target addresses whose number of different communicating IPs is greater than the second threshold according to the second formula; the ratio is the second anomaly evaluation value; when the processing module calculates the maliciousness of the IP to be detected according to the second anomaly evaluation value and the third preset rule, it is used to: calculate the ratio of the second anomaly evaluation value to the number of at least one network traffic data to obtain the maliciousness of the IP to be detected.

[0037] Optionally, the second formula is as follows:

[0038]

[0039] in, represents the sum of similarities between two network traffic data in the third network traffic data; N1 represents the number of network traffic data in the third network traffic data; DstIP i ,DstIP j They represent the i-th target address and the j-th target address respectively; the SC function is a similarity calculation function, which means calculating the similarity between the network flow data between the IP to be detected and the i-th target address and the network flow data between the IP to be detected and the j-th target address; Indicates the number of target addresses for which the number of different IPs in communication is greater than the second threshold; N2 indicates the number of at least one target address; FLOW function indicates obtaining the first network flow data of the i-th target address; DstIP i ,DstPort i Respectively represent the IP address and port of the i-th target address, used to indicate the i-th target address; AF srcip It means that if the number of different IPs communicating with the i-th target address is greater than the second threshold, the output value is 1, otherwise, the output value is 0.

[0040] Optionally, when the processing module calculates the maliciousness of the IP to be detected according to the first anomaly assessment value and the second anomaly assessment value and according to a third preset rule, it is used to: calculate the product of the first anomaly assessment value and the second anomaly assessment value, and divide it by the square of the number of at least one network traffic data to obtain the maliciousness of the IP to be detected.

[0041] Optionally, each network traffic data in at least one network traffic data includes a data packet size and a TCP flag, and the TCP flag includes: a synchronization flag, an end flag, and a reset flag; the processing module is also used to: determine from at least one network traffic data, the number A of network traffic data including a greater number of synchronization flags than the number of end flags; determine from at least one network traffic data, the number B of network traffic data including a reset flag; determine from at least one network traffic data, the number C of network traffic data including a data packet size less than a third threshold value; calculate the product of A, B, and C to obtain a third anomaly assessment value; when the processing module calculates the maliciousness of the IP to be detected according to the first anomaly assessment value and / or the second anomaly assessment value and according to a third preset rule, it is also used to: calculate the maliciousness of the IP to be detected according to the first anomaly assessment value and / or the second anomaly assessment value, and the third anomaly assessment value according to a third preset rule.

[0042] Optionally, when calculating the maliciousness of the IP to be detected according to the first abnormality assessment value and / or the second abnormality assessment value, and the third abnormality assessment value according to the third preset rule, the processing module is used to: calculate the product of the first abnormality assessment value and the third abnormality assessment value, and divide it by the square of the number of at least one network traffic data to obtain the maliciousness of the IP to be detected; or, calculate the product of the second abnormality assessment value and the third abnormality assessment value, and divide it by the square of the number of at least one network traffic data to obtain the maliciousness of the IP to be detected; or, calculate the product of the first abnormality assessment value, the second abnormality assessment value and the third abnormality assessment value, and divide it by the cube of the number of at least one network traffic data to obtain the maliciousness of the IP to be detected.

[0043] In a third aspect, an embodiment of the present application provides an electronic device, comprising at least one processor, wherein the at least one processor is used to execute a computer program stored in a memory so that a method as in the first aspect or any optional implementation of the first aspect is implemented.

[0044] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which is used to store instructions. When the instructions are executed, the method in the first aspect or any optional implementation of the first aspect is implemented.

[0045] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program code, which, when executed on a computer, enables the method in the first aspect or any optional implementation of the first aspect to be implemented.

[0046] The technical effects or advantages of one or more technical solutions provided in the second, third, fourth and fifth aspects of the embodiments of the present application can be correspondingly explained by the technical effects or advantages of one or more corresponding technical solutions provided in the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 A flow chart of a data detection method provided in an embodiment of the present application;

[0048] Figure 2 A flow chart of a method for calculating a first abnormal value provided in an embodiment of the present application;

[0049] Figure 3 An example diagram of a communication method provided in an embodiment of the present application;

[0050] Figure 4 A flow chart of a method for calculating a second outlier value provided in an embodiment of the present application;

[0051] Figure 5 An example diagram of a device access behavior provided in an embodiment of the present application;

[0052] Figure 6 A flow chart of a method for calculating a third outlier value provided in an embodiment of the present application;

[0053] Figure 7 An example diagram of a communication interaction provided in an embodiment of the present application;

[0054] Figure 8 A structural diagram of a data detection device provided in an embodiment of the present application;

[0055] Fig. 9 A structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0056] In the technical solution of this application, the collection, dissemination, and use of data are in compliance with the requirements of relevant national laws and regulations.

[0057] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0058] The technical solution of the present application is described in detail below through the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present application and the specific features in the embodiments are detailed descriptions of the technical solution of the present application, rather than limitations on the technical solution of the present application. In the absence of conflict, the embodiments of the present application and the technical features in the embodiments can be combined with each other.

[0059] It should be understood that "multiple" in the description of the embodiment of the present application refers to two or more. "First", "second" etc. in the embodiment of the present application are used to distinguish different objects, rather than to describe a specific order. The term "and / or" in the embodiment of the present application is merely a kind of association relationship describing associated objects, indicating that three relationships may exist, for example, A and / or B, which may represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the term "includes" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. The module in the embodiment of the present application refers to a part with independent functions in a software system.

[0060] For ease of understanding, the following is an introduction to some of the professional terms involved in the embodiments of this application:

[0061] 1. CC (Command and Control), also known as C2, stands for command and control. The CC server is a server used to process command and control logic. CC behavior is the behavior of information interaction with the CC server and actual command and control communication.

[0062] 2. Netflow is a tool for monitoring network traffic, which is used on devices such as routers and switches. It is mainly used to collect the number and information of IP packets entering and leaving the network interface. By analyzing this information, the source, destination, protocol and port used, type of network service, and cause of network congestion of the IP packet can be obtained. The network traffic data in the embodiment of the present application can be obtained by Netflow monitoring, and the network traffic data includes: source IP address, destination IP address, source port, destination port, protocol type, data packet size, transmission rate and other information.

[0063] 3. Transmission Control Protocol (TCP) flags, used to control the behavior of TCP messages, each flag occupies 1 bit. TCP flags include: Synchronous flag SYN (synchronous) is used to establish a connection, indicating the initiation of a new connection request; Acknowledgement flag ACK (acknowledgement) indicates confirmation of receipt of the other party's message; Push flag PSH (push): indicates a push operation, and the data is delivered to the application as soon as it reaches the receiver; Finish flag FIN (finish): indicates the end of a connection; Reset flag RST (reset): used to reset the connection; Urgent flag URG (urgent): indicates urgent data, which should be processed first.

[0064] 4. Payload refers to the actual business data contained in a data packet or message. In network communications, a complete data packet consists of multiple parts, including a header and a payload. The payload is the main content of the data packet, carrying the actual information to be transmitted, which can be the web page content in an HTTP request, the content text and attachments of an email, etc.

[0065] In today's highly connected world, network security has become a major challenge for enterprises and organizations. Traditional network security threat detection methods mainly rely on signature-based detection technology, which identifies and blocks attacks by matching known threat features. However, with the increasing complexity and diversity of network attacks, signature-based detection methods face many limitations, especially in dealing with emerging and location threats. Specifically, traditional methods rely on static signature library detection, which is difficult to cope with rapidly changing attack methods and new threats; when analyzing network traffic, they usually only focus on specific features of data packets, such as protocol type or port number, and lack in-depth analysis of the dynamic characteristics of network traffic and multi-dimensional communication patterns; there are deficiencies in identifying invalid communications, which may lead to a high false alarm rate and affect detection efficiency; when identifying CC behavior, traditional methods rely on simple heuristic rules and cannot fully utilize the similarity of communication patterns to evaluate maliciousness; traditional methods usually only focus on the local communication mode of the current device to be tested, and fail to comprehensively consider the communication mode of remote devices, resulting in an incomplete understanding of the overall network environment and threat assessment.

[0066] In view of this, an embodiment of the present application provides a data detection method, which obtains at least one target address from at least one network traffic data of an IP to be detected, and obtains first network traffic data of any target address of the at least one target address; obtains second network traffic data that communicates with the any target address from at least one network traffic data; obtains a first abnormal value based on the first network traffic data and the second network traffic data, and the first abnormal value is used to determine whether the communication behavior of the IP to be detected is abnormal; and screens out third network traffic data including a valid load and the IP to be detected as the source IP from at least one network traffic data, and obtains a second abnormal value based on the first network traffic data and the third network traffic data, and the second abnormal value is used to determine whether the control and command behavior of the IP to be detected is abnormal; combining the two abnormal values ​​to evaluate the maliciousness of the IP to be detected can further improve the accuracy of malicious behavior detection.

[0067] It can be understood that the data detection method provided in the embodiments of the present application can be applied to any data detection scenario, including but not limited to the above-mentioned detection of malicious behavior in an enterprise network.

[0068] See also Figure 1 , is a flow chart of a data detection method provided in an embodiment of the present application, which can be applied to any electronic device with processing capabilities, such as a computer, a mobile phone, a tablet, etc. The method includes steps S101 to S107:

[0069] S101. Obtain at least one target address from at least one network flow data of an IP to be detected.

[0070] Among them, at least one network flow data is network flow data of communication between the IP to be detected and at least one target address, and each network flow data includes a target address.

[0071] Exemplarily, at least one target address can be a source address or a destination address. Each target address includes a remote IP and a port, which can be used to indicate a process or service in the network. Usually in network traffic data, a remote IP and a port are used to indicate the target address.

[0072] It can be understood that at least one network traffic data can be all network traffic data of the IP to be detected within a certain time period, such as all network traffic data from the last execution of the data detection method to the current execution of the data detection method; or if it is detected that the IP to be detected communicates frequently within a certain time period, all network traffic data within the time period when the IP to be detected frequently communicates can be obtained; the above are only some possible examples, and the network traffic data to be obtained can be determined based on actual conditions.

[0073] S102: Obtain first network traffic data of any target address among at least one target address.

[0074] The first network traffic data is the network traffic data of any target address communicating with the second IP; the second IP is different from the IP to be detected.

[0075] It can be understood that the first network traffic data is all network traffic data of any target address communicating with other IPs except the IP to be detected.

[0076] S103: Obtain second network traffic data communicating with any target address from at least one network traffic data.

[0077] It can be understood that the second network traffic data is all network traffic data of the communication between the IP to be detected and any target address.

[0078] S104. Filter out third network traffic data including a valid payload and with the IP to be detected as the source IP from at least one network traffic data.

[0079] The effective load is used to indicate that the third network traffic data includes actual business data to be transmitted.

[0080] It can be understood that the third network traffic data is the network traffic data containing actual business data sent by the IP to be detected.

[0081] S105. Calculate a first abnormality evaluation value of the IP to be detected based on the first network traffic data and the second network traffic data according to a first preset rule, and / or calculate a second abnormality evaluation value of the IP to be detected based on the first network traffic data and the third network traffic data according to a second preset rule.

[0082] For ease of understanding, the following describes how to calculate the first abnormality evaluation value and the second abnormality evaluation value through steps S105A and S105B, respectively.

[0083] S105A. Calculate a first abnormality assessment value of the IP to be detected based on the first network traffic data and the second network traffic data according to a first preset rule.

[0084] In one possible embodiment, see Figure 2 , the specific implementation method of calculating the first abnormal evaluation value of the IP to be detected is as follows:

[0085] S201. Obtain a first indicator set and a second indicator set of first network traffic data and second network traffic data respectively.

[0086] The first indicator set is used to indicate the communication mode between any target address and the second IP, and the second indicator set is used to indicate the communication mode between any target address and the IP to be detected;

[0087] In a possible example, at least one of a data packet size, a number of data packets, a timestamp, a TCP flag, and a protocol type included in the first network traffic data and the second network traffic data is obtained respectively;

[0088] That is, the first indicator set includes at least one item of the packet size, number of packets, timestamp, TCP flag and protocol type of each network traffic data in the first network traffic data; the second indicator set includes at least one item of the packet size, number of packets, timestamp, TCP flag and protocol type of each network traffic data in the second network traffic data, and the data items contained in the first indicator set and the second indicator set are the same.

[0089] S202, calculating the correlation between the first indicator set and the second indicator set according to the first preset rule;

[0090] In a possible example, the maximum value, minimum value, mean value, variance and information entropy of each indicator in the first indicator set are calculated; the maximum value, minimum value, mean value, variance and information entropy of each indicator in the second indicator set are calculated;

[0091] The correlation between the first indicator set and the second indicator set is calculated based on the maximum value, minimum value, mean value, variance and information entropy of each indicator in the first indicator set and the maximum value, minimum value, mean value, variance and information entropy of the corresponding indicator in the second indicator set.

[0092] It can be understood that one or more of the maximum value, minimum value, mean value, variance and information entropy of each indicator can be selected for calculation according to actual needs, and other statistical values ​​of each indicator can be selected for calculation according to actual needs; the embodiments of the present application are not limited to this.

[0093] S203. Obtain the correlation between a first indicator set of each target address in at least one target address and a second indicator set corresponding to the target address, and determine the number of target addresses whose correlation is less than a first threshold; the number of target addresses whose correlation is less than the first threshold is a first abnormality assessment value.

[0094] Exemplarily, for each of at least one target address, the above method can be used to obtain a first indicator set of the first network traffic data of each target address and a second indicator set of the second network traffic data of the target address and the IP communication to be detected, and the correlation between each first indicator set and the corresponding second indicator set can be calculated.

[0095] See also Figure 3 , is an example of a communication method provided in an embodiment of the present application. The service port can be understood as at least one target address, and the user can understand it as an IP communicating with the at least one target address. The first indicator set is used to indicate the communication method between each target address and other IPs (i.e., the second IP) other than the IP to be detected, i.e., the normal communication method, such as Figure 3 The second indicator set is used to indicate the communication mode between each target address and the IP to be detected. By calculating the correlation between the first indicator set and the second indicator set, the correlation between the communication mode between the IP to be detected and each target address and the normal communication mode can be determined. If the correlation is less than the first threshold, it can be determined that the communication mode between the IP to be detected and the target address is abnormal, such as Figure 3 Communication mode 3. The first threshold can be set according to actual conditions.

[0096] In a possible example, since the UDP protocol is suitable for applications that require fast transmission and do not require reliability assurance, such as video streaming and online games, normal users usually use the UDP protocol to access public service ports. This communication method is statistically manifested as regular and expected low-frequency, high-success rate connections. Malicious users often use the TCP protocol to perform port scans. The TCP protocol is a connection-oriented protocol that is suitable for data transmission that requires high reliability. Malicious users frequently try to connect to multiple ports to find open services. This communication method is statistically manifested as high-frequency, low-success rate connection attempts, which is significantly different from the access pattern of normal users. Therefore, the first abnormal value can be determined by analyzing the difference between the communication method between the IP to be detected and at least one target address and the normal communication method between at least one target address and other IPs.

[0097] In a possible embodiment, the correlation is a confidence level; obtaining the correlation between the first network flow data and the second network flow data of each target address in at least one target address, and determining the number of target addresses whose correlation is less than a first threshold, includes: calculating the confidence level of the second indicator set appearing under the premise that the first indicator set exists according to a first formula, and determining the number of target addresses whose confidence level is less than the first threshold; the first formula is as follows:

[0098]

[0099] Among them, EFN represents the number of target addresses whose confidence is less than the first threshold; N represents the number of at least one target address; P function represents the confidence of the second indicator set under the premise of the existence of the first indicator set; Flowdata i Indicates the second indicator set corresponding to the i-th target address; DstIP i ,Dstport i AF respectively represent the IP address and port of the i-th target address, and are used to indicate the first indicator set of the i-th target address; p The function indicates that when the confidence is less than the first threshold, the output value of the function is 1, otherwise, the output value is 0.

[0100] It can be understood that by using the conditional probability function and the activation function (i.e., AF p Function), when it is detected that the confidence between the normal communication mode and the communication mode between the IP to be detected and the i-th target address is lower than the first threshold, the communication mode between the IP to be detected and the i-th target address is considered abnormal, and the number of abnormal communication modes is accumulated.

[0101] The above is only a method for calculating the correlation between the first network traffic data and the second network traffic data provided in an embodiment of the present application. In actual applications, other methods for calculating the correlation can also be selected, and the embodiment of the present application does not limit this.

[0102] S105B. Calculate a second abnormality assessment value of the IP to be detected based on the first network traffic data and the third network traffic data according to a second preset rule.

[0103] In one possible embodiment, see Figure 4 , the specific implementation method of calculating the second abnormal evaluation value of the IP to be detected is as follows:

[0104] S401. Obtain the number of different IPs communicating with each target address from the first network traffic data of each target address in at least one target address, and determine the number of target addresses whose number of different IPs communicating is greater than a second threshold.

[0105] It can be understood that for each of the at least one target address, the first network traffic data of each target address communicating with other IPs (i.e., second IPs) other than the IP to be detected is obtained; the number of different IPs communicated by each target address is counted, and the number of target addresses whose number of different IPs communicated is greater than the second threshold is determined. The second threshold can be set according to actual needs.

[0106] S402. Calculate, according to the second formula, the ratio of the sum of the similarities between the pairwise network flow data in the third network flow data to the number of target addresses whose number of different communicating IPs is greater than a second threshold.

[0107] In one possible example, the second formula is as follows:

[0108]

[0109] in, represents the sum of similarities between two network traffic data in the third network traffic data; N1 represents the number of network traffic data in the third network traffic data; DstIP i ,DstIP j They represent the i-th target address and the j-th target address respectively; the SC function is a similarity calculation function, which means calculating the similarity between the network flow data between the IP to be detected and the i-th target address and the network flow data between the IP to be detected and the j-th target address; Indicates the number of target addresses for which the number of different IPs in communication is greater than the second threshold; N2 indicates the number of at least one target address; FLOW function indicates obtaining the first network flow data of the i-th target address; DstIP i ,DstPort iRespectively represent the IP address and port of the i-th target address, used to indicate the i-th target address; AF srcip It means that if the number of different IPs communicating with the i-th target address is greater than the second threshold, the output value is 1, otherwise, the output value is 0.

[0110] See also Figure 5 This is an example diagram of a device access behavior provided in an embodiment of the present application. Figure 5 As shown, usually, servers dedicated to control and scanning (such as CC servers and scanning device servers) are not used for regular devices (i.e. Figure 5 This also means that the proportion of whitelisted public service devices in the targets accessed by servers dedicated to control and scanning is relatively low. In addition, CC servers usually communicate frequently with controlled devices, and the content of the communication (i.e. Figure 5 In the process of daily use of devices, normal users have complex life and office needs and access more complex external services, that is, the similarity between the network traffic data of each remote IP and port (that is, the target address) is not large.

[0111] Therefore, by calculating the similarity of pairwise network traffic data in the third network traffic data of the IP to be detected, the greater the similarity, the greater the possibility that the IP to be detected is abnormal; the smaller the number of target addresses whose number of different IPs in communication is greater than the second threshold, the smaller the possibility that the communication object of the IP to be detected is a whitelist public service device; taking these two factors into consideration, calculating the ratio of the sum of the similarities of pairwise network traffic data in the third network traffic data of the IP to be detected to the number of target addresses whose number of different IPs in communication is greater than the second threshold as the second abnormal value, the potential CC behavior (i.e., abnormal behavior) of the IP to be detected can be detected more accurately.

[0112] S106. Calculate the maliciousness of the IP to be detected according to the first anomaly evaluation value and / or the second anomaly evaluation value and according to a third preset rule.

[0113] The maliciousness is used to indicate the degree of communication anomaly of the IP to be detected, including the malicious behavior of the IP to be detected.

[0114] Specifically, the maliciousness of the IP to be detected can be obtained based on the ratio of the first abnormality evaluation value to at least one network traffic data; or the maliciousness of the IP to be detected can be obtained based on the ratio of the second abnormality evaluation value to at least one network traffic data; or the maliciousness of the IP to be detected can be obtained based on the product of the first abnormality evaluation value and the second abnormality evaluation value divided by the square of at least one network traffic data.

[0115] It can be understood that in practical applications, a method for calculating the maliciousness of the IP to be detected can be selected based on factors such as detection accuracy requirements.

[0116] S107: Determine whether to issue an alarm to the IP to be detected according to the maliciousness.

[0117] Exemplarily, if the maliciousness is greater than a preset threshold, an alarm is issued to the IP to be detected. The preset threshold can be set according to the actual situation. The execution of an alarm to the IP to be detected can be sending an alarm message to the management personnel, blocking the request permission of the IP to be detected, etc., which can be set according to the actual situation, and the embodiment of the present application does not limit this.

[0118] In this solution, the first network traffic data is used to indicate the normal communication mode between any target address and other IPs, and the second network traffic data is used to indicate the communication mode between any target address and the IP to be detected. The first abnormal evaluation value calculated by the first network traffic data and the second network traffic data can indicate whether the communication mode between the IP to be detected and the any target address is abnormal, and can accurately identify the difference between the communication behavior of the IP to be detected and the communication behavior of the normal IP, thereby improving the accuracy of malicious behavior detection; the third network traffic data is used to indicate the network traffic data sent by the IP to be detected. Since normal users often access complex external services due to complex life or office needs when using devices in daily life, that is, the similarity between each network traffic data should not be large, and most of the access targets (that is, at least one target address) should be whitelisted public service devices. Therefore, the second abnormal evaluation value calculated based on the first network traffic data and the second network traffic data can more accurately reflect whether the control and command behaviors of the IP to be detected are abnormal; in addition, combining the two abnormal evaluation values ​​to calculate the maliciousness of the IP to be detected can further improve the accuracy of malicious behavior detection.

[0119] In a possible design, the malicious behavior of the IP to be detected can also be detected by analyzing the invalid communication of the IP to be detected. Figure 6 As shown, an embodiment of the present application provides a method for calculating a third outlier value.

[0120] Each of the at least one network flow data includes a data packet size and a TCP flag, and the TCP flag includes: a synchronization flag, an end flag, and a reset flag; the method specifically includes:

[0121] S601, determining the number A of network flow data including a number of synchronization marks greater than the number of end marks from at least one network flow data;

[0122] S602, determining the number B of network traffic data including a reset mark from at least one network traffic data;

[0123] S603, determining the number C of network traffic data whose data packet size is smaller than a third threshold from at least one network traffic data;

[0124] S604: Calculate the product of A, B, and C to obtain a third abnormality assessment value.

[0125] For example, see Figure 7 , is an example diagram of a communication interaction provided by an embodiment of the present application. Figure 7 As shown, high-quality effective TCP communication usually contains a pair of synchronization flags SYN and end flags FIN, the data packet size is large, and the more complex the scenario, the larger the total size of the data packet; actively interrupted or actively rejected communications usually end with a reset flag RST; the client (IP to be detected) actively initiates communication, and when the communication times out or the server (destination address) does not respond, the client will actively end the current communication, so there is only the synchronization flag SYN. ​​Therefore, by analyzing the above statistical quantities A, B, and C, incomplete or interrupted communications can be identified, and then the invalid part of the network traffic data can be determined.

[0126] Optionally, when the detection accuracy requirement is not high, the ratio of the third anomaly assessment value to the quantity of at least one network traffic data may be used as the maliciousness of the IP to be detected.

[0127] In a possible embodiment, the maliciousness of the IP to be detected can also be calculated by combining the first abnormality evaluation value, the second abnormality evaluation value and the third abnormality evaluation value, that is, the above step S106 also includes: according to the first abnormality evaluation value and / or the second abnormality evaluation value, and the third abnormality evaluation value, the maliciousness of the IP to be detected is calculated according to the third preset rule.

[0128] Specifically, the product of the first anomaly assessment value and the third anomaly assessment value is calculated, and the result is divided by the square of the number of at least one network traffic data to obtain the maliciousness of the IP to be detected; or, the product of the second anomaly assessment value and the third anomaly assessment value is calculated, and the result is divided by the square of the number of at least one network traffic data to obtain the maliciousness of the IP to be detected; or, the product of the first anomaly assessment value, the second anomaly assessment value and the third anomaly assessment value is calculated, and the result is divided by the cube of the number of at least one network traffic data to obtain the maliciousness of the IP to be detected.

[0129] In this embodiment, the maliciousness of the IP to be detected is calculated by combining three abnormal values, which covers the identification of CC behavior, the identification of abnormal communication methods and the evaluation of invalid communication volume. Through multi-dimensional analysis, network security threats and malicious behaviors can be identified more accurately, thereby improving the accuracy of malicious behavior detection.

[0130] The method provided by the embodiment of the present application is introduced above, and the device provided by the embodiment of the present application is introduced below.

[0131] Based on the same technical concept, the embodiment of the present application provides a data detection device, which includes a module / unit / means for executing the method executed by the electronic device in the above method embodiment. The module / unit / means can be implemented by software, or by hardware, or the corresponding software can be implemented by hardware.

[0132] For example, Figure 8 As shown, the device 800 includes:

[0133] The acquisition module 801 is used to: acquire at least one target address from at least one network flow data of the IP to be detected, wherein at least one network flow data is network flow data of the IP to be detected communicating with at least one target address, and each network flow data includes a target address; acquire first network flow data of any target address among the at least one target address; the first network flow data is network flow data of any target address communicating with a second IP; the second IP is different from the IP to be detected; acquire second network flow data of the communication with any target address from at least one network flow data; filter out third network flow data including a valid load and the IP to be detected being the source IP from at least one network flow data, wherein the valid load is used to indicate that the third network flow data includes actual business data to be transmitted;

[0134] The processing module 802 is used to: calculate a first abnormality evaluation value of the IP to be detected according to the first network flow data and the second network flow data according to a first preset rule, and / or calculate a second abnormality evaluation value of the IP to be detected according to the first network flow and the third network flow according to a second preset rule; calculate the maliciousness of the IP to be detected according to the first abnormality evaluation value and / or the second abnormality evaluation value according to a third preset rule, wherein the maliciousness is used to indicate the degree of communication abnormality of the IP to be detected;

[0135] The alarm module 803 is used to determine whether to issue an alarm to the IP to be detected according to the maliciousness.

[0136] Optionally, when the processing module 802 calculates the first anomaly assessment value of the IP to be detected according to the first network traffic data and the second network traffic data according to the first preset rule, the acquisition module 801 is also used to: respectively obtain the first indicator set and the second indicator set of the first network traffic data and the second network traffic data, the first indicator set is used to indicate the communication method between any target address and the second IP, and the second indicator set is used to indicate the communication method between any target address and the IP to be detected; the processing module 802 is also used to: calculate the correlation between the first indicator set and the second indicator set according to the first preset rule; obtain the correlation between the first indicator set of each target address in at least one target address and the second indicator set corresponding to the target address, and determine the number of target addresses whose correlation is less than the first threshold; the number of target addresses whose correlation is less than the first target address is the first anomaly assessment value; when the processing module 802 calculates the maliciousness of the IP to be detected according to the first anomaly assessment value according to the third preset rule, it is used to: calculate the ratio of the first anomaly assessment value to the number of at least one network traffic data to obtain the maliciousness of the IP to be detected.

[0137] Optionally, the correlation is a confidence level; when the processing module 802 obtains the correlation between the first network flow data and the second network flow data of each target address in at least one target address and determines the number of target addresses whose correlation is less than a first threshold, it is used to: calculate the confidence level of the second indicator set appearing under the premise that the first indicator set exists according to the first formula, and determine the number of target addresses whose confidence level is less than the first threshold; the first formula is as follows:

[0138]

[0139] Among them, EFN represents the number of target addresses whose confidence is less than the first threshold; N represents the number of at least one target address; P function represents the confidence of the second indicator set under the premise of the existence of the first indicator set; Flowdata i Indicates the second indicator set corresponding to the i-th target address; DstIP i ,Dstport i AF respectively represent the IP address and port of the i-th target address, and are used to indicate the first indicator set of the i-th target address; p The function indicates that when the confidence is less than the first threshold, the output value of the function is 1, otherwise, the output value is 0.

[0140] Optionally, when the acquisition module 801 respectively acquires the first indicator set and the second indicator set of the first network traffic data and the second network traffic data, it is used to: respectively acquire at least one of the data packet size, the number of data packets, the timestamp, the TCP flag and the protocol type included in the first network traffic data and the second network traffic data; when the processing module 802 calculates the correlation between the first indicator set and the second indicator set according to the first preset rule, it is used to: calculate the maximum value, minimum value, mean value, variance and information entropy of each indicator in the first indicator set; calculate the maximum value, minimum value, mean value, variance and information entropy of each indicator in the second indicator set; calculate the confidence of the corresponding indicator in the second indicator set under the premise that each indicator in the first indicator set exists, based on the maximum value, minimum value, mean value, variance and information entropy of each indicator in the first indicator set and the maximum value, minimum value, mean value, variance and information entropy of the corresponding indicator in the second indicator set; determine the confidence of the second indicator set under the premise that the first indicator set exists, based on the confidence of each corresponding indicator in the second indicator set.

[0141] Optionally, when the processing module 802 calculates the second anomaly evaluation value of the IP to be detected according to the first network traffic and the third network traffic data according to the second preset rule, it is used to: obtain the number of different IPs communicating with each target address from the first network traffic data of each target address in at least one target address; determine the number of target addresses whose number of different communicating IPs is greater than the second threshold; calculate the ratio of the sum of the similarities between any two network traffic data in the third network traffic data to the number of target addresses whose number of different communicating IPs is greater than the second threshold according to the second formula; the ratio is the second anomaly evaluation value; when the processing module 802 calculates the maliciousness of the IP to be detected according to the second anomaly evaluation value and the third preset rule, it is used to: calculate the ratio of the second anomaly evaluation value to the number of at least one network traffic data to obtain the maliciousness of the IP to be detected.

[0142] Optionally, the second formula is as follows:

[0143]

[0144] in, represents the sum of similarities between two network traffic data in the third network traffic data; N1 represents the number of network traffic data in the third network traffic data; DstIP i ,DstIP j They represent the i-th target address and the j-th target address respectively; the SC function is a similarity calculation function, which means calculating the similarity between the network flow data between the IP to be detected and the i-th target address and the network flow data between the IP to be detected and the j-th target address; Indicates the number of target addresses for which the number of different IPs in communication is greater than the second threshold; N2 indicates the number of at least one target address; FLOW function indicates obtaining the first network flow data of the i-th target address; DstIP i ,DstPort i Respectively represent the IP address and port of the i-th target address, used to indicate the i-th target address; AF srcip It means that if the number of different IPs communicating with the i-th target address is greater than the second threshold, the output value is 1, otherwise, the output value is 0.

[0145] Optionally, when calculating the maliciousness of the IP to be detected according to the first anomaly assessment value and the second anomaly assessment value and in accordance with a third preset rule, the processing module 802 is used to: calculate the product of the first anomaly assessment value and the second anomaly assessment value, and divide it by the square of the number of at least one network traffic data to obtain the maliciousness of the IP to be detected.

[0146] Optionally, each network traffic data in at least one network traffic data includes a data packet size and a TCP flag, and the TCP flag includes: a synchronization flag, an end flag, and a reset flag; the processing module 802 is also used to: determine the number A of network traffic data including a greater number of synchronization flags than the number of end flags from at least one network traffic data; determine the number B of network traffic data including a reset flag from at least one network traffic data; determine the number C of network traffic data including a data packet size less than a third threshold from at least one network traffic data; calculate the product of A, B, and C to obtain a third anomaly assessment value; when the processing module 802 calculates the maliciousness of the IP to be detected according to the first anomaly assessment value and / or the second anomaly assessment value and according to the third preset rule, it is also used to: calculate the maliciousness of the IP to be detected according to the first anomaly assessment value and / or the second anomaly assessment value, and the third anomaly assessment value according to the third preset rule.

[0147] Optionally, when calculating the maliciousness of the IP to be detected according to the first abnormality assessment value and / or the second abnormality assessment value, and the third abnormality assessment value according to the third preset rule, the processing module 802 is used to: calculate the product of the first abnormality assessment value and the third abnormality assessment value, and divide it by the square of the number of at least one network traffic data to obtain the maliciousness of the IP to be detected; or, calculate the product of the second abnormality assessment value and the third abnormality assessment value, and divide it by the square of the number of at least one network traffic data to obtain the maliciousness of the IP to be detected; or, calculate the product of the first abnormality assessment value, the second abnormality assessment value and the third abnormality assessment value, and divide it by the cube of the number of at least one network traffic data to obtain the maliciousness of the IP to be detected.

[0148] It should be understood that all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module and will not be repeated here.

[0149] Based on the same technical concept, see Fig. 9 The embodiment of the present application further provides an electronic device 900, including:

[0150] At least one processor 901; and a communication interface 903 that is communicatively connected to the at least one processor 901; the at least one processor 901 executes instructions stored in the memory 902, so that the electronic device 900 executes the method steps performed by the billboard in the above method embodiment through the communication interface 903.

[0151] Optionally, the memory 902 is located outside the electronic device 900 .

[0152] Optionally, the electronic device 900 includes the memory 902, the memory 902 is connected to the at least one processor 901, and the memory 902 has instructions that can be executed by the at least one processor 901. Fig. 9 The dashed lines indicate that the memory 902 is optional for the electronic device 900 .

[0153] The at least one processor 901 and the memory 902 may be coupled via an interface circuit or may be integrated together, which is not limited here.

[0154] The specific connection medium between the at least one processor 901, the memory 902 and the communication interface 903 is not limited in the embodiment of the present application. Fig. 9 In the embodiment, at least one processor 901, a memory 902 and a communication interface 903 are connected via a bus 904. Fig. 9 The connection between other components is only for schematic illustration and is not intended to be limiting. The bus part may be an address bus, a data bus, a control bus, etc. For ease of representation, Fig. 9 It is represented by only one thick line, but it does not mean that there is only one bus or one type of bus.

[0155] It should be understood that the processor mentioned in the embodiments of the present application can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc. When implemented by software, the processor can be a general-purpose processor implemented by reading software code stored in a memory.

[0156] Exemplarily, the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0157] It should be understood that the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both a volatile memory and a non-volatile memory. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which acts as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct RAM bus random access memory (DRRAM).

[0158] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) can be integrated into the processor.

[0159] It should be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0160] Based on the same technical concept, an embodiment of the present application also provides a computer-readable storage medium, which is used to store instructions. When the instructions are executed, the computer executes the method steps executed by any device in the above method embodiments.

[0161] Based on the same technical concept, an embodiment of the present application also provides a computer program product, including computer program code. When the computer program code is executed on a computer, the method steps executed by any device in the above method embodiment are implemented.

[0162] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0163] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0164] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0165] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0166] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A data detection method, characterized in that: include: Acquire at least one target address from at least one network flow data of the IP to be detected, wherein the at least one network flow data is network flow data of communication between the IP to be detected and the at least one target address, and each of the network flow data includes a target address; Acquire first network traffic data of any target address of the at least one target address; The first network traffic data is the network traffic data of the communication between any target address and the second IP; the second IP is different from the IP to be detected; Acquire second network traffic data communicating with any one of the target addresses from the at least one network traffic data; Filtering out third network traffic data including a valid load and the IP to be detected being a source IP from the at least one network traffic data, wherein the valid load is used to indicate that the third network traffic data includes actual service data to be transmitted; Calculate the first abnormality assessment value of the IP to be detected according to the first network traffic data and the second network traffic data according to a first preset rule, and / or calculate the second abnormality assessment value of the IP to be detected according to the first network traffic and the third network traffic according to a second preset rule; Calculate the maliciousness of the IP to be detected according to the first abnormality evaluation value and / or the second abnormality evaluation value according to a third preset rule, wherein the maliciousness is used to indicate the degree of abnormality of communication of the IP to be detected; Determine whether to issue an alarm to the IP to be detected according to the maliciousness.

2. The method according to claim 1, characterized in that The calculating the first abnormality assessment value of the to-be-detected IP according to the first network traffic data and the second network traffic data according to the first preset rule includes: Respectively obtaining a first indicator set and a second indicator set of the first network traffic data and the second network traffic data, wherein the first indicator set is used to indicate a communication mode between the any target address and the second IP, and the second indicator set is used to indicate a communication mode between the any target address and the IP to be detected; Calculate the correlation between the first indicator set and the second indicator set according to the first preset rule; Obtaining a correlation between a first indicator set of each target address in the at least one target address and a second indicator set corresponding to the target address, and determining the number of target addresses whose correlation is less than a first threshold; the number of target addresses whose correlation is less than the first threshold is the first abnormality assessment value; The calculating the maliciousness of the to-be-detected IP according to the first anomaly evaluation value and a third preset rule includes: The ratio of the first anomaly assessment value to the number of the at least one network traffic data is calculated to obtain the maliciousness of the IP to be detected.

3. The method according to claim 2, characterized in that The correlation degree is a confidence degree; the obtaining of the correlation degree between the first network flow data and the second network flow data of each target address of the at least one target address, and determining the number of target addresses whose correlation degree is less than a first threshold, comprises: According to the first formula, the confidence of the second indicator set appearing under the premise that the first indicator set exists is calculated, and the number of target addresses whose confidence is less than the first threshold is determined; the first formula is as follows: Wherein, EFN represents the number of target addresses whose confidence is less than the first threshold; N represents the number of the at least one target address; P function represents the confidence of the second indicator set appearing under the premise that the first indicator set exists; Flowdata i Indicates the second indicator set corresponding to the i-th target address; DstIP i ,Dstport i AF respectively represent the IP address and port of the i-th target address, and are used to indicate the first indicator set of the i-th target address; p The function indicates that when the confidence level is less than the first threshold, the output value of the function is 1, otherwise, the output value is 0.

4. The method according to claim 3, characterized in that The step of respectively acquiring the first indicator set and the second indicator set of the first network traffic data and the second network traffic data comprises: Respectively obtaining at least one of a data packet size, a number of data packets, a timestamp, a TCP flag, and a protocol type included in the first network traffic data and the second network traffic data; The calculating the correlation between the first indicator set and the second indicator set according to the first preset rule includes: Calculate the maximum value, minimum value, mean value, variance and information entropy of each indicator in the first indicator set; Calculate the maximum value, minimum value, mean value, variance and information entropy of each indicator in the second indicator set; Calculate the confidence level of the corresponding indicator in the second indicator set under the premise that each indicator in the first indicator set exists, based on the maximum value, minimum value, mean value, variance and information entropy of each indicator in the first indicator set and the maximum value, minimum value, mean value, variance and information entropy of the corresponding indicator in the second indicator set; According to the confidence of each corresponding indicator in the second indicator set, it is determined that the confidence of the second indicator set appears under the premise that the first indicator set exists.

5. The method according to claim 1, characterized in that The calculating the second abnormality assessment value of the to-be-detected IP according to the first network traffic data and the third network traffic data according to the second preset rule includes: Acquire the number of different IPs communicating with each of the at least one target address from the first network traffic data of each of the at least one target address; Determine that the number of different IPs of the communication is greater than the number of target addresses of a second threshold; Calculate the ratio of the sum of the similarities between the two network traffic data in the third network traffic data to the number of target addresses whose number of different IPs in the communication is greater than the second threshold value according to the second formula; the ratio is the second abnormality assessment value; The calculating the maliciousness of the to-be-detected IP according to the second anomaly evaluation value and a third preset rule includes: The ratio of the second anomaly assessment value to the number of the at least one network traffic data is calculated to obtain the maliciousness of the IP to be detected.

6. The method according to claim 5, characterized in that The second formula is as follows: in, represents the sum of similarities between two network traffic data in the third network traffic data; N1 represents the number of network traffic data in the third network traffic data; DstIP i ,DstIP j Respectively represent the i-th target address and the j-th target address; the SC function is a similarity calculation function, which represents calculating the similarity between the network flow data between the IP to be detected and the i-th target address and the network flow data between the IP to be detected and the j-th target address; Indicates that the number of different IPs of the communication is greater than the number of target addresses of the second threshold; N2 represents the number of the at least one target address; FLOW function represents obtaining the first network flow data of the i-th target address; DstIP i ,DstPort i AF respectively represent the IP address and port of the i-th target address, and are used to indicate the i-th target address; srcip It means that if the number of different IPs communicating with the i-th target address is greater than the second threshold, the output value is 1, otherwise, the output value is 0.

7. The method according to any one of claims 1 to 6, characterized in that: The calculating the maliciousness of the to-be-detected IP according to the first anomaly evaluation value and the second anomaly evaluation value and according to a third preset rule includes: The product of the first anomaly assessment value and the second anomaly assessment value is calculated and divided by the square of the number of the at least one network traffic data to obtain the maliciousness of the IP to be detected.

8. The method according to claim 7, characterized in that Each of the at least one network flow data includes a data packet size and a TCP flag, wherein the TCP flag includes: a synchronization flag, an end flag, and a reset flag; The method further comprises: Determine, from the at least one network traffic data, a number A of network traffic data including a number of synchronization marks greater than a number of end marks; Determine the number B of network traffic data including a reset flag from the at least one network traffic data; Determine, from the at least one network traffic data, a quantity C of network traffic data having a packet size smaller than a third threshold; Calculating the product of A, B and C to obtain a third abnormality assessment value; The calculating the maliciousness of the to-be-detected IP according to the first anomaly evaluation value and / or the second anomaly evaluation value according to a third preset rule also includes: According to the first anomaly evaluation value and / or the second anomaly value, and the third anomaly evaluation value, the maliciousness of the IP to be detected is calculated according to the third preset rule.

9. The method according to claim 8, characterized in that Calculating the maliciousness of the to-be-detected IP according to the first anomaly evaluation value and / or the second anomaly value, and the third anomaly evaluation value according to the third preset rule, includes: Calculate the product of the first anomaly assessment value and the third anomaly assessment value, and divide the result by the square of the number of the at least one network traffic data to obtain the maliciousness of the IP to be detected; Alternatively, the product of the second anomaly assessment value and the third anomaly assessment value is calculated and divided by the square of the number of the at least one network traffic data to obtain the maliciousness of the IP to be detected; Alternatively, the product of the first anomaly assessment value, the second anomaly assessment value and the third anomaly assessment value is calculated and divided by the cube of the number of the at least one network traffic data to obtain the maliciousness of the IP to be detected.

10. A data detection device, characterized in that: include: An acquisition module is used to: acquire at least one target address from at least one network flow data of an IP to be detected, wherein the at least one network flow data is network flow data of communication between the IP to be detected and the at least one target address, and each of the network flow data includes a target address; acquire first network flow data of any target address among the at least one target address; the first network flow data is network flow data of communication between any target address and a second IP; the second IP is different from the IP to be detected; acquire second network flow data of communication with any target address from the at least one network flow data; filter out third network flow data including a valid load and the IP to be detected being a source IP from the at least one network flow data, wherein the valid load is used to indicate that the third network flow data includes actual business data to be transmitted; A processing module, used to: calculate a first abnormality assessment value of the IP to be detected according to the first network traffic data and the second network traffic data according to a first preset rule, and / or calculate a second abnormality assessment value of the IP to be detected according to the first network traffic and the third network traffic according to a second preset rule; Calculate the maliciousness of the IP to be detected according to the first abnormality evaluation value and / or the second abnormality evaluation value according to a third preset rule, wherein the maliciousness is used to indicate the degree of abnormality of communication of the IP to be detected; The alarm module is used to determine whether to issue an alarm to the IP to be detected according to the maliciousness.

11. An electronic device, characterized in that: include: A memory for storing program instructions; A processor is used to call the program instructions stored in the memory, and execute the steps included in the method according to any one of claims 1 to 9 according to the obtained program instructions.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to have a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a computer, the method according to any one of claims 1 to 9 is implemented.

13. A computer program product, characterized in that The computer program product comprises: a computer program code, and when the computer program code is run on a computer, the computer is enabled to execute the method according to any one of claims 1 to 9.

Images