A network security attack tracing method and system

Abstract

The present application provides a network security attack tracing method and system, which relates to the field of network security technology, including: performing an abnormal analysis of the number of IP accesses, dividing and obtaining multiple first-level abnormal IPs and multiple first-level IP abnormal degrees; retrieving the access timestamp set of multiple first-level abnormal IPs to perform an abnormal analysis of the access density, dividing and obtaining multiple second-level abnormal IPs and multiple second-level time abnormal degrees; retrieving multiple second-level abnormal IPs to perform an abnormal analysis of the URL discreteness, dividing and obtaining multiple third-level abnormal IPs and multiple third-level URL abnormal degrees, calculating and obtaining multiple comprehensive abnormal degrees, and combining multiple third-level abnormal IPs to output tracing results. This application can solve the technical problems that the existing methods usually rely on a single indicator to identify potential attack sources, have low attack tracing accuracy, and cannot effectively identify complex attack behaviors. It can significantly improve the identification accuracy and comprehensiveness of attack sources, and effectively deal with complex and hidden network attacks.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a network security attack tracing method and system. Background Art

[0002] With the continuous advancement of informatization, network systems have become the supporting platform for the core business of various industries. However, the means of network attacks are becoming increasingly complex and diverse, posing a serious threat to the security of systems and data. Network attacks not only include traditional malicious code injection and distributed denial of service attacks, but also covert penetration attacks implemented by means of proxies and springboards. Attackers often evade detection through multiple points and multiple paths, bringing potential risks and security risks to network systems.

[0003] At present, network attack source tracing technology has gradually become a hot topic in network security research. By tracking the attack path and identifying the attack source, network attack source tracing helps the defense system quickly locate the threat source and take effective countermeasures, thereby reducing the losses caused by security incidents. However, traditional attack source tracing methods mainly rely on a single indicator (such as IP address, access frequency, etc.) to identify potential attack sources, which is difficult to deal with complex and changeable attack methods, resulting in significant deficiencies in accuracy and complex attack identification capabilities. Summary of the invention

[0004] The present invention aims to solve the technical problems that existing network security attack tracing methods usually only rely on a single indicator to identify potential attack sources, have low attack tracing accuracy, and cannot effectively identify complex attack behaviors. A network security attack tracing method and system are provided to solve the problem.

[0005] The technical solution of the present invention to solve the above technical problems is as follows:

[0006] In a first aspect, the present application provides a network security attack tracing method, which is implemented through a network security attack tracing system, including: after starting an attack tracing instruction, retrieving network log data within a preset time range in the past to obtain a tracing log; clustering the access IPs in the tracing log to obtain multiple access IPs and multiple IP access times, constructing an IP tracing graph, performing an abnormal analysis of the number of access IPs, and dividing to obtain multiple first-level abnormal IPs and multiple first-level IP abnormal degrees; in the tracing log, retrieving the access timestamp set of the multiple first-level abnormal IPs, performing access density analysis, and constructing an access density tracing graph, performing an abnormal analysis of the access density, and dividing to obtain multiple second-level abnormal IPs and multiple second-level time abnormal degrees; in the tracing log, retrieving the request URL set of the multiple second-level abnormal IPs, performing URL discreteness analysis, and constructing a URL discreteness tracing graph, performing an abnormal analysis of the discreteness, dividing to obtain multiple third-level abnormal IPs and multiple third-level URL abnormal degrees, and calculating to obtain multiple comprehensive abnormalities, and combining the multiple third-level abnormal IPs to output the network security attack tracing result.

[0007] In the second aspect, the present application also provides a network security attack tracing system for executing a network security attack tracing method as described in the first aspect, including: a network log retrieval module, which is used to retrieve network log data within a preset time range in the past after starting the attack tracing instruction, and obtain a tracing log; an access count analysis module, which is used to cluster the access IPs in the tracing log, obtain multiple access IPs and multiple IP access times, construct an IP tracing graph, perform an abnormal analysis of the number of access IPs, and obtain multiple first-level abnormal IPs and multiple first-level IP abnormality degrees; an access density analysis module, which is used to retrieve the access IPs in the tracing log. The access timestamp set of the multiple first-level abnormal IPs is used for access density analysis, and an access density traceability graph is constructed to perform access density anomaly analysis, and multiple second-level abnormal IPs and multiple second-level time anomalies are obtained by division; an access dispersion analysis module is used to retrieve the request URL set of the multiple second-level abnormal IPs in the traceability log, perform URL dispersion analysis, and construct a URL dispersion traceability graph, perform dispersion anomaly analysis, and multiple third-level abnormal IPs and multiple third-level URL anomalies are obtained, and multiple comprehensive anomalies are calculated, and the network security attack tracing results are output in combination with the multiple third-level abnormal IPs.

[0008] In a third aspect, the present application further provides an electronic device, including:

[0009] At least one processor; a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor so that the at least one processor can perform the steps of any one of the methods described in the first aspect above.

[0010] In a fourth aspect, a computer-readable storage medium is provided, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed, the steps of the method described in any one of the first aspects are implemented.

[0011] The beneficial effects of the present invention are:

[0012] After starting the attack tracing instruction, the network log data within the preset time range in the past is retrieved to obtain the tracing log; then the access IP is clustered in the tracing log to obtain multiple access IPs and multiple IP access times, an IP tracing graph is constructed, and the number of access IPs is analyzed abnormally according to the IP tracing graph, and multiple first-level abnormal IPs and multiple first-level IP abnormal degrees are obtained; further, in the tracing log, the access timestamp set of the multiple first-level abnormal IPs is retrieved to perform access density analysis, an access density tracing graph is constructed, and an access density abnormal analysis is performed according to the access density tracing graph, and multiple second-level abnormal IPs and multiple second-level time abnormal degrees are obtained; then, in the tracing log, the request URL set of the multiple second-level abnormal IPs is retrieved to perform URL analysis L dispersion analysis is performed, and a URL dispersion traceability diagram is constructed to perform anomaly analysis of the dispersion, and multiple three-level abnormal IPs and multiple three-level URL anomalies are obtained; then, the first-level IP anomaly, the second-level time anomaly, and the third-level URL anomaly of the multiple three-level abnormal IPs are weightedly calculated to obtain multiple comprehensive anomalies; finally, the multiple three-level abnormal IPs are sorted according to the multiple comprehensive anomalies, and the abnormal IP tracing sorting results are used as the network security attack tracing results; that is to say, through multi-level and multi-dimensional anomaly analysis and attack tracing, the attack IPs with higher risks can be accurately located, the probability of misjudgment and missed judgment can be effectively reduced, and the identification accuracy and comprehensiveness of the attack source can be significantly improved, thereby achieving the technical goal of effectively responding to complex and hidden network attacks and improving the security and protection capabilities of the network system. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 A schematic diagram of a process for tracing the source of a network security attack provided by the present invention;

[0014] Figure 2 A schematic diagram of the structure of a network security attack tracing system provided by the present invention;

[0015] Figure 3A schematic diagram of the structure of an electronic device provided by the present invention;

[0016] Figure 4 A schematic diagram of the structure of a computer-readable storage medium provided by the present invention.

[0017] In the accompanying drawings, the components represented by the reference numerals are described as follows:

[0018] Network log retrieval module 11, access frequency analysis module 12, access density analysis module 13, access dispersion analysis module 14, electronic device 500, memory 510, processor 520, first computer program 511, computer readable storage medium 600, second computer program 611. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0020] In the description of the present invention, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0021] In the description of the present invention, the term "for example" is used to mean "used as an example, illustration or explanation". Any embodiment described as "for example" in the present invention is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is given to enable any technician in the field to implement and use the present invention. In the following description, details are listed for the purpose of explanation. It should be understood that a person of ordinary skill in the art can recognize that the present invention can be implemented without using these specific details. In other examples, well-known structures and processes will not be elaborated in detail to avoid obscuring the description of the present invention with unnecessary details. Therefore, the present invention is not intended to be limited to the embodiments shown, but is consistent with the widest scope consistent with the principles and features disclosed in the present invention.

[0022] Example 1: Please refer to the attached Figure 1 The present application provides a network security attack tracing method, which is applied to a network security attack tracing system and specifically includes the following steps:

[0023] S100: After the attack source tracing instruction is started, network log data within a preset time range in the past is retrieved to obtain a source tracing log.

[0024] Furthermore, step S100 of the present application also includes:

[0025] S110: After starting the attack tracing instruction, retrieve the access IP, access timestamp and request URL of the website within the past preset time range; S120: integrate the access IP, access timestamp and request URL of the website within the preset time range, and perform correlation matching and integration to obtain the tracing log.

[0026] Specifically, when a firewall, intrusion detection system (IDS) or other network security monitoring tools detect abnormal behavior (such as a surge in access frequency, abnormal IP addresses, unauthorized requests, etc.), the system will automatically trigger an alarm to indicate that there may be an attack. At the same time, after receiving the attack alarm, the system will immediately start the attack tracing command and enter the tracing analysis mode. The tracing command includes defining the time range of tracing and the type of log data to be retrieved, so as to fully capture data related to suspicious access behavior. After starting the tracing command, all website access data will be retrieved from the network logs of the past preset time range (such as the past day or hour, which can be set according to the actual scenario), including the access IP, access timestamp and request URL. The access IP refers to recording the IP address of each request initiator in order to identify and track the source of the access; the access timestamp refers to recording all access time points of each access IP, which is used to analyze the access frequency and time density; the request URL refers to recording all request pages or resource interfaces (i.e., requested windows, pages, etc.) of each access IP, which is used to determine the visitor's behavior path and intention.

[0027] Then, the retrieved access IP, access timestamp and request URL are associated, matched and integrated, that is, each access IP is matched with all its access timestamps and corresponding request URLs to form a complete access record. During the matching process, a comprehensive record containing all access timestamps and request URLs is generated for each access IP. This record can fully display the access behavior of each IP, including the time distribution and page path of its access, which is convenient for subsequent behavior pattern analysis. The integrated data is then saved as a traceability log, which records all access IPs and their corresponding access timestamps and request URLs within a preset time range. By constructing a traceability log, the access frequency, time concentration and page request path of each access IP can be fully presented, providing a basis for subsequent access feature analysis.

[0028] S200: Cluster the access IPs in the traceability log to obtain multiple access IPs and multiple IP access times, build an IP traceability graph, perform an abnormal analysis on the number of access IPs, and obtain multiple first-level abnormal IPs and multiple first-level IP abnormality degrees.

[0029] Furthermore, step S200 of the present application also includes:

[0030] S210: Extract all access IPs in the tracing log, obtain the access IP set and cluster the same access IPs to obtain multiple access IP clustering results; S220: Obtain multiple access IPs in the multiple access IP clustering results, and extract the number of access IPs in the multiple access IP clustering results as multiple IP access times; S230: Construct an IP tracing graph based on the multiple access IPs and multiple IP access times; S240: Perform an abnormality analysis of the access IP in the IP tracing graph to obtain multiple IP abnormality degrees, and obtain multiple first-level abnormal IPs according to the multiple IP abnormality degrees.

[0031] Specifically, first, extract all recorded access IP addresses from the source tracing log and build a set containing all access IPs. The set can contain multiple duplicate IP addresses because an IP may appear multiple times in the log. Then cluster the same access IPs according to the access IP set and group the same access IPs into one clustering result. For each independent IP address, count its total number of appearances in the log. In this way, each IP clustering result will contain a unique access IP and its corresponding number of accesses, reflecting the activity frequency of the IP within the selected time range, and obtain multiple access IP clustering results.

[0032] Then, multiple access IPs in the multiple access IP clustering results are obtained, and cluster records of each access IP are extracted from the access IP clustering results, including each unique IP address and the number of times it appears in the traceability log, and the number of times each access IP appears is used as the number of visits of the IP to obtain multiple IP visit times. Then, an IP traceability graph is constructed based on the multiple access IPs and the multiple IP visit times. For example, each access IP is used as a node in the graph, and the size, color or shape of the node can be intuitively represented according to the number of visits of the IP. For example, the IP node with a higher number of visits can be set as a larger node, or represented by a striking color; wherein the IP traceability graph will display the access frequency of different IPs in a graphical manner, and can quickly locate IPs with abnormal access times, and intuitively identify possible attack sources or potential risk IPs. Further, the abnormality analysis of the access IP is performed in the IP traceability graph to obtain multiple IP abnormalities, and the access IPs corresponding to several maximum IP abnormalities among the multiple IP abnormalities are selected as first-level abnormal IPs to obtain multiple first-level abnormal IPs.

[0033] Furthermore, step S240 of the present application also includes:

[0034] S241: Select the first IP access times of the first access IP in the IP traceability graph, and randomly extract multiple random IP access times; S242: Calculate the deviation between the first IP access times and the mean of the multiple random IP access times as the first IP abnormality; S243: Continue to calculate multiple IP abnormalities of other multiple access IPs; S244: Extract the access IPs corresponding to the largest top K / 10 IP abnormalities among the multiple IP abnormalities as multiple first-level abnormal IPs and multiple first-level IP abnormalities.

[0035] Specifically, a first access IP is selected in the IP traceability graph, wherein the first access IP is the access IP that appears for the first time, and the first IP access count of the first access IP is obtained; then multiple access IPs other than the first access IP are randomly selected in the IP traceability graph. For example, the selected number can be set to 20% of the total number of access IPs. For example, if the total number of access IPs is 100, the selected number of access IPs is 20, and multiple random IP access counts of multiple access IPs are obtained.

[0036] Then, the mean of the access times of the multiple random IPs is calculated to obtain the mean of the random access times, and the deviation amplitude between the access times of the first IP and the mean of the random access times is calculated, where the deviation amplitude is the ratio of the difference between the access times of the first IP and the mean of the random access times to the mean of the random access times, where the deviation amplitude may be positive or negative, and the larger the value (positive deviation), the more obvious the access times of the first IP are, indicating a greater abnormality; and the deviation amplitude is set as the abnormality of the first IP. This method can quantify the abnormality of the first IP, provide data support for further analysis and tracing, and help identify potential high-risk access sources.

[0037] Then, the same method for calculating the first IP anomaly degree is used to continue calculating the IP anomaly degrees of other multiple access IPs to obtain multiple IP anomaly degrees; the multiple IP anomaly degrees are further arranged in descending order, that is, the anomaly values ​​are sorted from high to low to obtain an IP anomaly degree sequence, and then the access IPs corresponding to the first K / 10 IP anomaly degrees in the IP anomaly degree sequence are extracted as first-level abnormal IPs, where K is an integer greater than 1, and the value of K can be set according to demand. For example, K is set to 5, that is, the first half of the access IPs are extracted to obtain multiple first-level abnormal IPs, and multiple first-level IP anomaly degrees of multiple first-level abnormal IPs are obtained.

[0038] S300: In the traceability log, retrieve the access timestamp set of the multiple first-level abnormal IPs, perform access density analysis, and construct an access density traceability graph to perform access density anomaly analysis, and divide and obtain multiple second-level abnormal IPs and multiple second-level time anomalies.

[0039] Furthermore, step S300 of the present application also includes:

[0040] S310: In the traceability log, retrieve all access timestamps of the multiple first-level abnormal IPs to obtain multiple access timestamp sets; S320: Calculate the average access time interval in the multiple access timestamp sets to obtain multiple access time intervals, calculate the ratio of the mean of the multiple access time intervals to each access time interval as multiple access densities, and construct an access density traceability graph; S330: Extract the first access density in the access density traceability graph, and randomly extract multiple random access densities; S340: Calculate the deviation amplitude between the first access density and the mean of the multiple random access densities as the first time anomaly; S350: Continue to calculate to obtain multiple time anomalies of the multiple first-level abnormal IPs, extract the first-level abnormal IPs corresponding to the largest top K / 10 time anomalies among the multiple time anomalies, as multiple second-level abnormal IPs and multiple second-level time anomalies.

[0041] Specifically, in the tracing log, all access timestamps of the multiple first-level abnormal IPs are retrieved, where each access timestamp records the access time point of the IP within a specified time range, which is used to analyze the access frequency and density and obtain multiple access timestamp sets.

[0042] Then calculate the average access time interval in the multiple access timestamp sets, that is, arrange the access timestamp sets of each first-level abnormal IP in chronological order, calculate the time intervals between adjacent access timestamps, sum all time intervals and divide them by the number of intervals, obtain the average access time interval of the IP, and obtain multiple access time intervals. Then calculate the mean of multiple access time intervals to obtain the interval mean, and calculate the ratio of the interval mean to each access time interval as the access density of the IP, and obtain multiple access densities, wherein, when the average access time interval of the IP is less than the overall mean, its access density will be larger, indicating that the access behavior is more intensive; on the contrary, a larger average time interval will lead to a smaller density. Finally, an access density traceability diagram is constructed based on multiple first-level abnormal IPs and multiple access densities, that is, each first-level abnormal IP is regarded as a node, and the size or color of the node can represent its access density. The node with a higher density can be highlighted with a more conspicuous logo. Through the access density traceability diagram, the access density of each IP can be intuitively displayed, helping to identify potential attack sources of high-density access.

[0043] Then, the first access density is extracted from the access density traceability graph, where the first access density can be any one of the access density traceability graphs, and multiple random access densities other than the first access density are randomly extracted. Then, the multiple random access densities are averaged to obtain the density mean, and the deviation amplitude between the first access density and the density mean is calculated. The deviation amplitude is the ratio of the density difference between the first access density and the density mean to the density mean, and the deviation amplitude is set as the first time anomaly, where the deviation amplitude (i.e., the first time anomaly) can be positive or negative. A positive value indicates that the first access density is greater than the mean of the random access density, which means that the access behavior of the IP is more intensive and may be abnormal; a negative value indicates that its access density is lower than the mean, and the degree of anomaly is lower.

[0044] Based on the same method of calculating the first time anomaly, continue to calculate and obtain multiple time anomaly degrees of the multiple first-level abnormal IPs; then arrange the multiple time anomaly degrees in descending order, sort the time anomaly degree values ​​from high to low, and obtain a time anomaly degree sequence; and select the first-level abnormal IPs corresponding to the first K / 10 time anomaly degrees from the time anomaly degree sequence as the second-level abnormal IPs, where K is an integer greater than 1, and the value of K can be set according to demand, for example, set K to 5, and obtain multiple second-level abnormal IPs and multiple second-level time anomaly degrees. By calculating the time anomaly degree and screening multiple second-level abnormal IPs according to the time anomaly degree, potential abnormal access behaviors can be analyzed and identified from the access time dimension, which can help the traceability system more accurately capture IPs with high-frequency access in a short period of time, thereby discovering potential attack sources with intensive access behaviors.

[0045] S400: In the tracing log, retrieve the request URL set of the multiple second-level abnormal IPs, perform URL discreteness analysis, and construct a URL discreteness tracing graph, perform discreteness abnormality analysis, divide and obtain multiple third-level abnormal IPs and multiple third-level URL abnormalities, and calculate to obtain multiple comprehensive abnormalities, and output network security attack tracing results in combination with the multiple third-level abnormal IPs.

[0046] Furthermore, step S400 of the present application also includes:

[0047] S410: In the tracing log, retrieve all request URLs of the multiple secondary abnormal IPs to obtain multiple request URL sets; S420: Extract multiple maximum repeated URL numbers in the multiple request URL sets, calculate the ratio of the mean of the multiple maximum repeated URL numbers to each maximum repeated URL number as multiple URL discreteness, and construct a URL discreteness tracing graph; S430: Extract the first URL discreteness in the URL discreteness tracing graph, and randomly extract multiple random URL discretenesses; S440: Calculate the deviation amplitude between the first URL discreteness and the mean of the multiple random URL discretenesses as the first URL abnormality; S450: Continue to calculate to obtain multiple URL abnormality degrees of the multiple secondary abnormal IPs, extract the secondary abnormal IPs corresponding to the largest top K / 10 URL abnormality degrees in the multiple URL abnormality degrees, as multiple third-level abnormal IPs and multiple third-level URL abnormality degrees.

[0048] Specifically, in the tracing log, all request records of each secondary abnormal IP are searched, and the corresponding request URL is extracted. The request URL represents the specific page, interface or resource path accessed by the IP, reflecting its access path and target within the website, and multiple request URL sets are obtained.

[0049] Then, for multiple request URL sets, count the number of visits to each URL, find the URL that appears the most times, that is, record the number of visits to the maximum repeated request URL as the maximum number of repeated URLs for the IP. For example, if a secondary abnormal IP repeatedly requests a certain URL 5 times, and this is the most frequent URL request of the IP, then the maximum number of repeated URLs is 5; multiple maximum numbers of repeated URLs are obtained. Then calculate the mean of the multiple maximum numbers of repeated URLs to obtain the mean of the maximum number of repeated URLs, and calculate the ratio of the mean of the maximum number of repeated URLs to the number of each maximum number of repeated URLs, set the ratio as the URL discreteness, and obtain multiple URL discreteness. Further, construct a URL discreteness traceability graph based on multiple secondary abnormal IPs and multiple URL discreteness, that is, each secondary abnormal IP is taken as a node in the graph, and the size or color of the node is used to represent its URL discreteness. The node with a larger discreteness can be highlighted with a significant color or logo. The URL discreteness traceability graph can intuitively display the access diversity of each secondary abnormal IP, which helps to identify potential abnormal access sources with high discreteness.

[0050] Then, the first URL discreteness is extracted from the URL discreteness traceability graph, wherein the first URL discreteness is any one of the URL discreteness traceability graph, and a plurality of random URL discretenesses other than the first URL discreteness are randomly extracted from the URL discreteness traceability graph. Then, the mean of the plurality of random URL discretenesses is calculated to obtain the random discreteness mean, and the deviation amplitude between the first URL discreteness and the random discreteness mean is calculated, the deviation amplitude is the ratio of the discreteness difference between the first URL discreteness and the random discreteness mean to the random discreteness mean, and the deviation amplitude is used as the first URL abnormality, wherein the deviation amplitude (first URL abnormality) can be positive or negative, a positive value indicates that the first URL discreteness is higher than the random discreteness mean, indicating that the diversity of pages or interfaces accessed by the IP is high, and there may be abnormal behavior, the larger the deviation amplitude (the higher the positive deviation), the more the first URL discreteness is significantly higher than the random mean, indicating that the IP is more inclined to access different pages and has a stronger detection behavior feature; a negative value indicates that the URL access diversity of the IP is low, which may belong to normal user behavior, indicating that the access mode of the IP is close to that of normal users and has low abnormality.

[0051] Using the same method for obtaining the first URL anomaly degree, continue to calculate and obtain multiple URL anomaly degrees of the multiple secondary abnormal IPs; and arrange the multiple URL anomaly degrees in descending order, that is, arrange them in order from large to small, to construct a URL anomaly degree sequence, and then select the secondary abnormal IPs corresponding to the first K / 10 URL anomaly degrees in the URL anomaly degree sequence as multiple tertiary abnormal IPs, where K is an integer greater than 1, and the value of K can be set according to needs. For example, set K to 5 to obtain multiple tertiary abnormal IPs and multiple tertiary URL anomaly degrees.

[0052] By calculating the URL anomaly degree and filtering out multiple third-level abnormal IPs based on the URL anomaly degree, we can analyze and identify potential abnormal access behaviors from the diversity dimension of accessed URLs, accurately capture IPs that attempt to access multiple different pages or interfaces, and thus identify potential attack sources that attempt to detect system vulnerabilities, attempt unauthorized access, or find vulnerabilities.

[0053] Furthermore, step S400 of the present application also includes:

[0054] S460: Perform weighted calculation on the first-level IP anomaly degree, the second-level time anomaly degree and the third-level URL anomaly degree of the multiple third-level abnormal IPs to obtain multiple comprehensive anomaly degrees; S470: Sort the multiple third-level abnormal IPs from large to small according to the multiple comprehensive anomaly degrees to obtain the abnormal IP tracing sorting result, and output it as the network security attack tracing result.

[0055] Specifically, the first-level IP abnormality, the second-level time abnormality and the third-level URL abnormality are weighted, wherein the greater the impact of which indicator on network security, the greater the corresponding weight. For example, the weight can be configured by the existing coefficient of variation method. First, the mean and standard deviation of the first-level IP abnormality, the second-level time abnormality and the third-level URL abnormality are calculated; then the coefficient of variation of each abnormality is calculated according to the mean and standard deviation, and the coefficient of variation is the ratio of the standard deviation to the mean, reflecting the relative discreteness of the data; then, according to the coefficient of variation of each abnormality, the weight of each abnormality is calculated, wherein the weight is the ratio of the coefficient of variation to the sum of the coefficients of variation of the three abnormalities, and the weight values ​​corresponding to the first-level IP abnormality, the second-level time abnormality and the third-level URL abnormality are obtained. By weighting the coefficient of variation method, the relative importance of each abnormality indicator can be determined according to its discreteness, so that the comprehensive abnormality calculation is more scientific and accurate. Then, the first-level IP abnormality, the second-level time abnormality and the third-level URL abnormality of the multiple third-level abnormal IPs are weightedly calculated according to the weight value to obtain multiple comprehensive abnormalities.

[0056] Then, according to the multiple comprehensive abnormality degrees, the multiple third-level abnormal IPs are sorted from large to small to obtain the abnormal IP tracing sorting result; finally, the abnormal IP tracing sorting result is output as the final result of network security attack tracing, where the tracing result can accurately reflect the abnormality degree of each third-level abnormal IP, help the tracing system and network security personnel focus on high-risk IPs, and improve the accuracy and effectiveness of network security protection.

[0057] In summary, the network security attack tracing method provided by this application has the following technical effects:

[0058] After starting the attack tracing instruction, the network log data within the preset time range in the past is retrieved to obtain the tracing log; then the access IP is clustered in the tracing log to obtain multiple access IPs and multiple IP access times, an IP tracing graph is constructed, and the number of access IPs is analyzed abnormally according to the IP tracing graph, and multiple first-level abnormal IPs and multiple first-level IP abnormal degrees are obtained; further, in the tracing log, the access timestamp set of the multiple first-level abnormal IPs is retrieved to perform access density analysis, an access density tracing graph is constructed, and an access density abnormal analysis is performed according to the access density tracing graph, and multiple second-level abnormal IPs and multiple second-level time abnormal degrees are obtained; then, in the tracing log, the request URL set of the multiple second-level abnormal IPs is retrieved to perform URL analysis L dispersion analysis is performed, and a URL dispersion traceability diagram is constructed to perform anomaly analysis of the dispersion, and multiple three-level abnormal IPs and multiple three-level URL anomalies are obtained; then, the first-level IP anomaly, the second-level time anomaly, and the third-level URL anomaly of the multiple three-level abnormal IPs are weightedly calculated to obtain multiple comprehensive anomalies; finally, the multiple three-level abnormal IPs are sorted according to the multiple comprehensive anomalies, and the abnormal IP tracing sorting results are used as the network security attack tracing results; that is to say, through multi-level and multi-dimensional anomaly analysis and attack tracing, the attack IPs with higher risks can be accurately located, the probability of misjudgment and missed judgment can be effectively reduced, and the identification accuracy and comprehensiveness of the attack source can be significantly improved, thereby achieving the technical goal of effectively responding to complex and hidden network attacks and improving the security and protection capabilities of the network system.

[0059] Embodiment 2: Based on the network security attack tracing method in the above embodiment, the present application also provides a network security attack tracing system, see the attached Figure 2 ,include:

[0060] The network log retrieval module 11 is used to retrieve the network log data within a preset time range in the past after starting the attack tracing instruction, and obtain the tracing log; the access number analysis module 12 is used to cluster the access IP in the tracing log, obtain multiple access IPs and multiple IP access times, build an IP tracing graph, perform an abnormal analysis of the number of access IPs, and divide and obtain multiple first-level abnormal IPs and multiple first-level IP abnormal degrees; the access density analysis module 13 is used to retrieve the access timestamp set of the multiple first-level abnormal IPs in the tracing log, perform access density analysis, and build an access density tracing graph, perform an abnormal analysis of the access density, and divide and obtain multiple second-level abnormal IPs and multiple second-level time abnormal degrees; the access dispersion analysis module 14 is used to retrieve the request URL set of the multiple second-level abnormal IPs in the tracing log, perform URL dispersion analysis, and build a URL dispersion tracing graph, perform an abnormal analysis of dispersion, divide and obtain multiple third-level abnormal IPs and multiple third-level URL abnormal degrees, and calculate to obtain multiple comprehensive abnormal degrees, and output the network security attack tracing result in combination with the multiple third-level abnormal IPs.

[0061] Furthermore, the network security attack tracing system is also used to: after starting the attack tracing instruction, retrieve the access IP, access timestamp and request URL of the website within the past preset time range; integrate the access IP, access timestamp and request URL of the website within the preset time range, and perform correlation matching and integration to obtain a tracing log.

[0062] Furthermore, the network security attack tracing system is also used to: extract all access IPs in the tracing log, obtain the access IP set and cluster the same access IPs to obtain multiple access IP clustering results; obtain multiple access IPs in the multiple access IP clustering results, and extract the number of access IPs in the multiple access IP clustering results as multiple IP access times; construct an IP tracing graph based on the multiple access IPs and the multiple IP access times; perform abnormality analysis on the access IP in the IP tracing graph to obtain multiple IP abnormality degrees, and obtain multiple first-level abnormal IPs according to the multiple IP abnormality degrees.

[0063] Furthermore, the network security attack tracing system is also used to: select the first IP access number of the first access IP in the IP tracing graph, and randomly extract multiple random IP access times; calculate the deviation amplitude between the first IP access number and the mean of the multiple random IP access times as the first IP abnormality; continue to calculate multiple IP abnormalities of other multiple access IPs; extract the access IPs corresponding to the largest top K / 10 IP abnormalities among the multiple IP abnormalities as multiple first-level abnormal IPs and multiple first-level IP abnormalities.

[0064] Furthermore, the network security attack tracing system is also used to: retrieve all access timestamps of the multiple first-level abnormal IPs in the tracing log to obtain multiple access timestamp sets; calculate the average access time interval in the multiple access timestamp sets to obtain multiple access time intervals, calculate the ratio of the mean of the multiple access time intervals to each access time interval as multiple access densities, and construct an access density tracing graph; extract a first access density in the access density tracing graph, and randomly extract multiple random access densities; calculate the deviation amplitude between the first access density and the mean of the multiple random access densities as a first time anomaly; continue to calculate to obtain multiple time anomalies of the multiple first-level abnormal IPs, extract the first-level abnormal IPs corresponding to the largest top K / 10 time anomalies among the multiple time anomalies, as multiple second-level abnormal IPs and multiple second-level time anomalies.

[0065] Furthermore, the network security attack tracing system is also used to: retrieve all request URLs of the multiple secondary abnormal IPs in the tracing log to obtain multiple request URL sets; extract multiple maximum repeated URL numbers in the multiple request URL sets, calculate the ratio of the mean of the multiple maximum repeated URL numbers to each maximum repeated URL number as multiple URL discretenesses, and construct a URL discreteness tracing graph; extract the first URL discreteness in the URL discreteness tracing graph, and randomly extract multiple random URL discretenesses; calculate the deviation amplitude between the first URL discreteness and the mean of the multiple random URL discretenesses as the first URL abnormality; continue to calculate to obtain multiple URL abnormality degrees of the multiple secondary abnormal IPs, extract the secondary abnormal IPs corresponding to the largest top K / 10 URL abnormality degrees among the multiple URL abnormality degrees, as multiple tertiary abnormal IPs and multiple tertiary URL abnormality degrees.

[0066] Furthermore, the network security attack tracing system is also used to: perform weighted calculation on the first-level IP anomaly degree, the second-level time anomaly degree and the third-level URL anomaly degree of the multiple third-level abnormal IPs to obtain multiple comprehensive anomaly degrees; sort the multiple third-level abnormal IPs from large to small according to the multiple comprehensive anomaly degrees to obtain the abnormal IP tracing sorting result, and output it as the network security attack tracing result.

[0067] Example 3: Please refer to Figure 3 , Figure 3 Schematic diagram of an electronic device provided by an embodiment of the present invention. Figure 3As shown, an embodiment of the present invention provides an electronic device 500, including a memory 510, a processor 520, and a first computer program 511 stored in the memory 510 and executable on the processor 520. When the processor 520 executes the first computer program 511, the following steps are implemented: after starting the attack source tracing instruction, network log data within a preset time range in the past is retrieved to obtain a source tracing log; clustering the access IPs in the source tracing log to obtain multiple access IPs and multiple IP access times, constructing an IP source tracing graph, performing an abnormal analysis of the number of access IPs, and obtaining multiple first-level abnormal IPs and multiple first-level IP abnormality degrees. ; In the tracing log, retrieve the access timestamp set of the multiple first-level abnormal IPs, perform access density analysis, and construct an access density tracing graph, perform access density anomaly analysis, and divide to obtain multiple second-level abnormal IPs and multiple second-level time anomalies; In the tracing log, retrieve the request URL set of the multiple second-level abnormal IPs, perform URL discreteness analysis, and construct a URL discreteness tracing graph, perform discreteness anomaly analysis, and divide to obtain multiple third-level abnormal IPs and multiple third-level URL anomalies, and calculate to obtain multiple comprehensive anomalies, and output network security attack tracing results in combination with the multiple third-level abnormal IPs.

[0068] Example 4: Please refer to Figure 4 , Figure 4 A schematic diagram of an embodiment of a computer-readable storage medium provided in an embodiment of the present invention. Figure 4 As shown, the present embodiment provides a computer-readable storage medium 600 on which a second computer program 611 is stored. When the second computer program 611 is executed by the processor, the following steps are implemented: after starting the attack tracing instruction, the network log data within a preset time range in the past is retrieved to obtain a tracing log; in the tracing log, the access IPs are clustered to obtain multiple access IPs and multiple IP access times, an IP tracing graph is constructed, and an abnormal analysis of the number of access IPs is performed, and multiple first-level abnormal IPs and multiple first-level IP abnormal degrees are obtained by division; in the tracing log, the access timestamp set of the multiple first-level abnormal IPs is retrieved, the access density analysis is performed, and an access density tracing graph is constructed, and an abnormal analysis of the access density is performed, and multiple second-level abnormal IPs and multiple second-level time abnormal degrees are obtained by division; in the tracing log, the request URL set of the multiple second-level abnormal IPs is retrieved, the URL discreteness analysis is performed, and a URL discreteness tracing graph is constructed, and an abnormal analysis of the discreteness is performed, and multiple third-level abnormal IPs and multiple third-level URL abnormal degrees are obtained by division, and multiple comprehensive abnormal degrees are calculated, and the network security attack tracing result is output in combination with the multiple third-level abnormal IPs.

[0069] It should be noted that in the above embodiments, the description of each embodiment has its own emphasis, and for parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0070] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0071] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded computer, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0072] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0073] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0074] Although preferred embodiments of the present invention have been described, additional changes and modifications may occur to these embodiments once those skilled in the art understand the basic inventive concepts.

[0075] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention belong to the scope of the present invention and its equivalent technologies, the present invention is also intended to include these changes and variations.

Claims

1. A network security attack tracing method, characterized in that: include: After starting the attack source tracing command, retrieve the network log data within the preset time range in the past to obtain the source tracing log; Clustering the access IPs in the traceability log to obtain multiple access IPs and multiple IP access times, constructing an IP traceability graph, performing an abnormal analysis of the number of access IPs, and obtaining multiple first-level abnormal IPs and multiple first-level IP abnormality degrees; In the traceability log, retrieve the access timestamp set of the multiple first-level abnormal IPs, perform access density analysis, and construct an access density traceability graph to perform access density abnormality analysis, and divide and obtain multiple second-level abnormal IPs and multiple second-level time abnormalities; In the tracing log, retrieve the request URL set of the multiple second-level abnormal IPs, perform URL discreteness analysis, and construct a URL discreteness tracing graph, perform discreteness abnormality analysis, divide and obtain multiple third-level abnormal IPs and multiple third-level URL abnormality degrees, and calculate and obtain multiple comprehensive abnormality degrees, and output network security attack tracing results in combination with the multiple third-level abnormal IPs; Among them, multiple comprehensive abnormality degrees are calculated and combined with the multiple third-level abnormal IPs to output the network security attack tracing results, including: Performing weighted calculation on the first-level IP abnormality, the second-level time abnormality, and the third-level URL abnormality of the multiple third-level abnormal IPs to obtain multiple comprehensive abnormality degrees; According to the multiple comprehensive abnormality degrees, the multiple third-level abnormal IPs are sorted from large to small to obtain the abnormal IP tracing sorting result, which is output as the network security attack tracing result.

2. A network security attack tracing method according to claim 1, characterized in that: After starting the attack source tracing command, retrieve the network log data within the preset time range in the past to obtain the source tracing log, including: After launching the attack source tracing command, retrieve the access IP, access timestamp and request URL of the website within the preset time range in the past; The access IP, access timestamp and request URL of the website within the preset time range are integrated, and associated matching is performed to obtain a tracing log.

3. A network security attack tracing method according to claim 1, characterized in that: Cluster the access IPs in the traceability log to obtain multiple access IPs and multiple IP access times, build an IP traceability graph, perform abnormality analysis on the access IPs, and obtain multiple first-level abnormal IPs, including: Extract all access IPs in the tracing log, obtain an access IP set, cluster the same access IPs, and obtain multiple access IP clustering results; Acquire multiple access IPs in the multiple access IP clustering results, and extract the number of access IPs in the multiple access IP clustering results as the number of IP accesses; Constructing an IP traceability graph based on the multiple access IPs and the multiple IP access times; In the IP traceability graph, an abnormality analysis of the access IP is performed to obtain multiple IP abnormality degrees, and multiple first-level abnormal IPs are obtained according to the multiple IP abnormality degrees.

4. A network security attack tracing method according to claim 3, characterized in that: In the IP traceability graph, an abnormality analysis of the access IP is performed to obtain multiple IP abnormality degrees, and multiple first-level abnormal IPs are obtained according to the multiple IP abnormality degrees, including: Selecting the first IP access times of the first access IP in the IP traceability graph, and randomly extracting a plurality of random IP access times; Calculate the deviation between the first IP access count and the average of the plurality of random IP access counts as the first IP abnormality; Continue to calculate the IP anomaly degrees of other multiple access IPs; The access IPs corresponding to the largest first K / 10 IP abnormality degrees among the multiple IP abnormality degrees are extracted as multiple first-level abnormal IPs and multiple first-level IP abnormality degrees.

5. A network security attack tracing method according to claim 1, characterized in that: In the tracing log, retrieve the access timestamp set of the multiple first-level abnormal IPs, perform access density analysis, and construct an access density tracing graph to obtain multiple second-level abnormal IPs, including: In the tracing log, retrieve all access timestamps of the multiple first-level abnormal IPs to obtain multiple access timestamp sets; Calculate the average access time interval in the multiple access timestamp sets to obtain multiple access time intervals, calculate the ratio of the average of the multiple access time intervals to each access time interval as multiple access densities, and construct an access density traceability graph; Extracting a first access density in the access density traceability graph, and randomly extracting a plurality of random access densities; Calculating a deviation between the first access density and an average of the plurality of random access densities as a first temporal abnormality; Continue to calculate to obtain multiple time anomaly degrees of the multiple first-level abnormal IPs, extract the first-level abnormal IPs corresponding to the largest top K / 10 time anomaly degrees among the multiple time anomaly degrees as multiple second-level abnormal IPs and multiple second-level time anomaly degrees.

6. A network security attack tracing method according to claim 1, characterized in that: In the tracing log, the request URL set of the multiple secondary abnormal IPs is retrieved, URL dispersion analysis is performed, and a URL dispersion tracing graph is constructed to perform dispersion anomaly analysis, and multiple third-level abnormal IPs are obtained by division, including: In the tracing log, retrieve all request URLs of the multiple secondary abnormal IPs to obtain multiple request URL sets; Extract multiple maximum numbers of repeated URLs in the multiple request URL sets, calculate the ratio of the mean of the multiple maximum numbers of repeated URLs to each maximum number of repeated URLs as multiple URL discreteness, and construct a URL discreteness traceability graph; Extracting a first URL discreteness in the URL discreteness traceability graph, and randomly extracting a plurality of random URL discretenesses; Calculate the deviation between the first URL discreteness and the mean of the plurality of random URL discretenesses as the first URL abnormality; Continue to calculate and obtain multiple URL abnormality degrees of the multiple secondary abnormal IPs, extract the secondary abnormal IPs corresponding to the largest top K / 10 URL abnormality degrees among the multiple URL abnormality degrees as multiple tertiary abnormal IPs and multiple tertiary URL abnormality degrees.

7. A network security attack tracing system, characterized in that: The steps for implementing a network security attack tracing method according to any one of claims 1 to 6 include: A network log retrieval module is used to retrieve network log data within a preset time range in the past to obtain a tracing log after starting an attack tracing instruction; The access number analysis module is used to cluster the access IPs in the traceability log, obtain multiple access IPs and multiple IP access times, build an IP traceability graph, perform an abnormal analysis of the number of access IPs, and obtain multiple first-level abnormal IPs and multiple first-level IP abnormality degrees; An access density analysis module is used to retrieve the access timestamp set of the multiple first-level abnormal IPs in the traceability log, perform access density analysis, and construct an access density traceability graph to perform access density anomaly analysis, and divide and obtain multiple second-level abnormal IPs and multiple second-level time anomalies; The access dispersion analysis module is used to retrieve the request URL set of the multiple second-level abnormal IPs in the tracing log, perform URL dispersion analysis, and construct a URL dispersion tracing graph to perform dispersion anomaly analysis, divide and obtain multiple third-level abnormal IPs and multiple third-level URL anomaly degrees, and calculate multiple comprehensive anomaly degrees, and output network security attack tracing results in combination with the multiple third-level abnormal IPs.

8. An electronic device, characterized in that: include: Memory for storing computer software programs; A processor is used to read and execute the computer software program, thereby implementing the steps of a network security attack tracing method as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium, characterized in that: The storage medium stores a computer software program, which, when executed by a processor, implements the steps of a network security attack tracing method as described in any one of claims 1 to 6.

Images