Attack detection method, device, electronic device and storage medium

Abstract

The present application relates to the field of network security technology, and in particular to an attack detection method, device, electronic device and storage medium for improving the accuracy of attack detection. The method includes: sampling the characteristic information of data packets in the network according to a preset time period, obtaining a characteristic information set sampled in each time period, using the sub-flow data of data packets of each network protocol in a characteristic information set, obtaining the comprehensive flow data of each network protocol in the time period corresponding to a characteristic information set, based on the difference between the reference flow data of each network protocol and the corresponding comprehensive flow data, obtaining the flow difference corresponding to a characteristic information set; based on the flow difference corresponding to each characteristic information set, obtaining the attack detection result. The present application can effectively improve the attack detection accuracy by comparing the comprehensive flow data and reference flow data under the same network protocol.

Description

Background Art

[0002] Distributed Denial of Service (DDoS) attack is a network attack method that aims to overload the target server or network resources through a large amount of network traffic or requests, thereby preventing normal users from accessing or using these resources.

[0003] Existing DDoS attack detection mainly targets traditional high-speed DDoS attacks. By setting a total traffic threshold, it is determined that a DDoS attack exists when the current traffic exceeds the traffic threshold.

[0004] However, with the continuous development of attack methods, low-speed DDoS attacks have emerged, that is, sending data packets at a low rate. Since this type of attack does not rely on huge traffic flooding, it can avoid triggering the traffic threshold. It is difficult to detect low-speed DDoS attacks based on traffic thresholds.

[0005] In summary, how to improve the accuracy of DDoS attack detection has become a problem that needs to be solved urgently. Summary of the invention

[0006] The embodiments of the present application provide an attack detection method, device, electronic device and storage medium to improve the accuracy of attack detection.

[0007] An attack detection method provided in an embodiment of the present application includes:

[0008] According to a preset time period, characteristic information of a data packet in the network is sampled to obtain a set of characteristic information sampled in each time period, wherein the characteristic information includes: sub-flow data of a corresponding data packet and a used network protocol;

[0009] For each feature information set, perform the following operations:

[0010] Based on the sub-flow data of the data packets of each network protocol in a characteristic information set, the comprehensive flow data of each network protocol in the time period corresponding to the characteristic information set is obtained, and the comprehensive flow data is used to characterize: the flow situation of the data packets using the corresponding network protocol;

[0011] Based on the difference between the reference flow data of each of the network protocols and the corresponding comprehensive flow data, obtaining the flow difference degree corresponding to the one characteristic information set;

[0012] Based on the traffic difference corresponding to each feature information set, the attack detection result is obtained.

[0013] Optionally, the reference traffic data is obtained based on the historical traffic data of the corresponding network protocol in each historical time period;

[0014] Then, the difference between the reference flow data of each network protocol and the corresponding integrated flow data is used to obtain the flow difference corresponding to the one characteristic information set, including:

[0015] Based on the historical traffic data sets of each of the network protocols, respectively, traffic correlation characteristics between the network protocols are obtained;

[0016] Based on the traffic correlation characteristics and the difference between the reference traffic data of each of the network protocols and the corresponding integrated traffic data, the traffic difference degree corresponding to the one feature information set is obtained.

[0017] Optionally, obtaining the traffic correlation characteristics between the network protocols based on the respective historical traffic data sets of the network protocols includes:

[0018] Based on each historical traffic data set, each historical traffic vector is obtained, wherein the elements in the historical traffic vector are the historical traffic data in the corresponding historical traffic data set;

[0019] Based on the correlation between the historical traffic vectors, the traffic correlation feature is obtained.

[0020] Optionally, obtaining the flow difference corresponding to the one characteristic information set based on the flow correlation feature and the difference between the reference flow data of each network protocol and the corresponding integrated flow data includes:

[0021] Obtaining a comprehensive traffic vector based on each comprehensive traffic data, and obtaining a reference traffic vector based on each reference traffic data, wherein the position of the comprehensive traffic data corresponding to the same network protocol in the comprehensive traffic vector is the same as the position of the reference traffic data in the reference traffic vector;

[0022] Based on the difference vector between the comprehensive traffic vector and the reference traffic vector, and the traffic correlation feature, the traffic difference corresponding to the one feature information set is obtained.

[0023] Optionally, before obtaining the flow difference corresponding to the one characteristic information set based on the difference between the reference flow data of each of the network protocols and the corresponding integrated flow data, the method further includes:

[0024] For each network protocol, based on the historical traffic data of the network protocol in each historical time period, the comprehensive traffic data of the network protocol is adjusted to obtain the adjusted comprehensive traffic data.

[0025] Optionally, obtaining the flow difference corresponding to the one characteristic information set based on the difference between the reference flow data of each of the network protocols and the corresponding integrated flow data includes:

[0026] Based on the difference between the reference flow data of each of the network protocols and the corresponding adjusted comprehensive flow data, the flow difference degree corresponding to the one characteristic information set is obtained.

[0027] Optionally, obtaining the attack detection result based on the flow difference corresponding to each characteristic information set includes:

[0028] Based on the differences of each flow rate, a mean difference is determined;

[0029] The ratios between the flow differences and the difference mean are determined respectively, and when a first ratio greater than a first value exists among the obtained first ratios, it is determined that the attack detection result is that an attack exists.

[0030] Optionally, after determining that the attack detection result is that an attack exists, the method further includes:

[0031] For each network protocol, respectively determine the reference flow data of the network protocol and the difference between the comprehensive flow data of the network protocol in each time period, and determine a second ratio between each difference and the reference difference; based on each second ratio, determine a target ratio of the network protocol;

[0032] Based on the target ratios of the network protocols, network protocols whose corresponding target ratios are greater than a second value are screened out, and attack protection measures are executed according to the screened out network protocols.

[0033] An attack detection device provided in an embodiment of the present application includes:

[0034] A sampling unit, used to sample characteristic information of data packets in the network according to a preset time period, and obtain a set of characteristic information sampled in each time period, wherein the characteristic information includes: sub-flow data of the corresponding data packet and the network protocol used;

[0035] The statistical unit is used to perform the following operations for each feature information set:

[0036] Based on the sub-flow data of the data packets of each network protocol in a characteristic information set, the comprehensive flow data of each network protocol in the time period corresponding to the characteristic information set is obtained, and the comprehensive flow data is used to characterize: the flow situation of the data packets using the corresponding network protocol;

[0037] Based on the difference between the reference flow data of each of the network protocols and the corresponding comprehensive flow data, obtaining the flow difference degree corresponding to the one characteristic information set;

[0038] The detection unit is used to obtain the attack detection result based on the flow difference corresponding to each characteristic information set.

[0039] Optionally, the reference traffic data is obtained based on the historical traffic data of the corresponding network protocol in each historical time period;

[0040] Then the statistical unit is specifically used for:

[0041] Based on the historical traffic data sets of each of the network protocols, respectively, traffic correlation characteristics between the network protocols are obtained;

[0042] Based on the traffic correlation characteristics and the difference between the reference traffic data of each of the network protocols and the corresponding integrated traffic data, the traffic difference degree corresponding to the one feature information set is obtained.

[0043] Optionally, the statistical unit is specifically used for:

[0044] Based on each historical traffic data set, each historical traffic vector is obtained, wherein the elements in the historical traffic vector are the historical traffic data in the corresponding historical traffic data set;

[0045] Based on the correlation between the historical traffic vectors, the traffic correlation feature is obtained.

[0046] Optionally, the statistical unit is specifically used for:

[0047] Obtaining a comprehensive traffic vector based on each comprehensive traffic data, and obtaining a reference traffic vector based on each reference traffic data, wherein the position of the comprehensive traffic data corresponding to the same network protocol in the comprehensive traffic vector is the same as the position of the reference traffic data in the reference traffic vector;

[0048] Based on the difference vector between the comprehensive traffic vector and the reference traffic vector, and the traffic correlation feature, the traffic difference corresponding to the one feature information set is obtained.

[0049] Optionally, the device further comprises an adjustment unit, configured to:

[0050] For each network protocol, based on the historical traffic data of the network protocol in each historical time period, the comprehensive traffic data of the network protocol is adjusted to obtain the adjusted comprehensive traffic data.

[0051] Optionally, the statistical unit is specifically used for:

[0052] Based on the difference between the reference flow data of each of the network protocols and the corresponding adjusted comprehensive flow data, the flow difference degree corresponding to the one characteristic information set is obtained.

[0053] Optionally, the detection unit is specifically used for:

[0054] Based on the differences of each flow rate, a mean difference is determined;

[0055] The ratios between the flow differences and the difference mean are determined respectively, and when a first ratio greater than a first value exists among the obtained first ratios, it is determined that the attack detection result is that an attack exists.

[0056] Optionally, the device further comprises a screening unit, for:

[0057] For each network protocol, respectively determine the reference flow data of the network protocol and the difference between the comprehensive flow data of the network protocol in each time period, and determine a second ratio between each difference and the reference difference; based on each second ratio, determine a target ratio of the network protocol;

[0058] Based on the target ratios of the network protocols, network protocols whose corresponding target ratios are greater than a second value are screened out, and attack protection measures are executed according to the screened out network protocols.

[0059] An electronic device provided in an embodiment of the present application includes a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of any one of the above-mentioned attack detection methods.

[0060] An embodiment of the present application provides a computer-readable storage medium, which includes a computer program. When the computer program is executed on an electronic device, the computer program is used to enable the electronic device to execute the steps of any one of the above-mentioned attack detection methods.

[0061] An embodiment of the present application provides a computer program product, which includes a computer program, and the computer program is stored in a computer-readable storage medium; when a processor of an electronic device reads the computer program from the computer-readable storage medium, the processor executes the computer program, so that the electronic device performs the steps of any one of the above-mentioned attack detection methods.

[0062] The beneficial effects of this application are as follows:

[0063] The embodiments of the present application provide an attack detection method, device, electronic device and storage medium, which obtains the comprehensive flow data of each network protocol in each time period by sampling the characteristic information of the data packets in the network, and obtains the flow difference degree corresponding to each characteristic information set based on the difference between the reference flow data of each network protocol and the corresponding comprehensive flow data, and then obtains the attack detection result. Based on the above method, by using the flow correlation under the same network protocol, by comparing the difference between the comprehensive flow data and the reference flow data under the same network protocol, attacks can be identified more flexibly, and the accuracy of attack detection can be improved. It is not limited to identifying specific attack protocol types, and can identify attacks of multiple network protocols, with a higher scope of application, and does not need to use the entire data packet, only the characteristic information of the sampled data packet is detected, which reduces the complexity of detection and system overhead.

[0064] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0066] Figure 1 An optional schematic diagram of an application scenario in an embodiment of the present application;

[0067] Figure 2 This is a flowchart of an attack detection method in an embodiment of the present application;

[0068] Figure 3 This is an overall flow chart of an attack detection method in an embodiment of the present application;

[0069] Figure 4 This is a schematic diagram of the structure of an attack detection device in an embodiment of the present application;

[0070] Figure 5 A schematic diagram of a hardware structure of an electronic device to which an embodiment of the present application is applied;

[0071] Figure 6 The present invention is a schematic diagram of the hardware structure of another electronic device to which the embodiments of the present application are applied. DETAILED DESCRIPTION

[0072] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the technical solution of the present application, rather than all of the embodiments. Based on the embodiments recorded in the application documents, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the technical solution of the present application.

[0073] The following is an introduction to some concepts involved in the embodiments of the present application.

[0074] Low-speed hybrid DDoS attack: This is a more complex form of attack that combines multiple attack techniques and strategies to circumvent traditional DDoS defense mechanisms. This type of attack usually does not rely on huge traffic flooding, but instead uses low-rate data packets, which makes it more difficult to detect and block.

[0075] Net Flow data: is a standard protocol for network traffic monitoring and analysis. It helps network administrators better understand the data flow behavior in the network by collecting and summarizing network traffic data on network devices (such as routers and switches). Net Flow data can provide important information about network traffic, such as the direction, source address, destination address, protocol type, port number, etc. of the data packet. The characteristic information in the embodiment of the present application can be Net Flow data.

[0076] Sliding Window Smoothing: is a technique used for time series analysis and smoothing data, usually used to reduce noise or highlight data trends. This method calculates the average or other statistics within each window by applying a sliding window to the data series to obtain a smoothed data series.

[0077] Mahalanobis distance: is a method to measure the distance between two data points, which takes into account the covariance structure of the data. Unlike Euclidean distance, Mahalanobis distance not only measures the straight-line distance between two points, but also takes into account the distribution of the data set. Therefore, it is very useful for processing multidimensional data with correlation.

[0078] Z-score: Also known as the standard score, it is a statistic used to measure how far a value is from the mean of its sample or population, usually expressed in units of standard deviation. Z-score helps understand the relative position of a data point in the data distribution and is an important concept in statistical analysis and data standardization.

[0079] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application may be combined with each other if there is no conflict.

[0080] like Figure 1 As shown, it is a schematic diagram of an application scenario of an embodiment of the present application. The application scenario diagram includes two terminal devices 110 and a server 120.

[0081] In the embodiments of the present application, the terminal device includes but is not limited to mobile phones, tablet computers, laptop computers, desktop computers, e-book readers, intelligent voice interaction devices, smart home appliances, vehicle-mounted terminals and other devices; the terminal device may be installed with a client related to attack detection, which may be software (such as a browser, attack detection software, etc.), or a web page, a small program, etc. The server is a background server corresponding to the software or web page, small program, etc., or a server specifically used for attack detection, which is not specifically limited in the present application. The server may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0082] It should be noted that the attack detection method in the embodiment of the present application can be executed by an electronic device, which can be a server or a terminal device, that is, the method can be executed by the server or the terminal device alone, or can be executed by the server and the terminal device together.

[0083] In an optional implementation, the terminal device and the server may communicate via a communication network.

[0084] In an optional implementation, the communication network is a wired network or a wireless network.

[0085] It should be noted that Figure 1 The figure is only an example. In fact, the number of terminal devices and servers is not limited and is not specifically limited in the embodiments of the present application.

[0086] The following describes the attack detection method provided by the exemplary embodiment of the present application in combination with the application scenario described above and with reference to the accompanying drawings. It should be noted that the above application scenario is only shown to facilitate understanding of the spirit and principles of the present application, and the implementation of the present application is not limited in this respect.

[0087] See also Figure 2 As shown, it is an implementation flow chart of an attack detection method provided in an embodiment of the present application. Taking the execution subject as a server as an example, the specific implementation process of the method includes the following steps S21-S23:

[0088] S21: The server samples characteristic information of data packets in the network according to a preset time period, and obtains a set of characteristic information sampled in each time period;

[0089] Among them, Net Flow traffic data in the network is collected periodically, and Net Flow traffic data can include data such as source address, destination address, source port number, destination port number, number of packets, number of bytes in packets, etc. Net Flow traffic data can be directly used as a feature information set, or feature information sets can be filtered out from Net Flow traffic data. It supports the detection of low-speed DDoS hybrid attacks through flow-level traffic, does not require full flow data, reduces system complexity and system overhead, and makes the solution more feasible.

[0090] The characteristic information of the data packet includes the sub-flow data of the data packet and the network protocol used. The sub-flow data may include the number of bytes of the data packet. The network protocol used may be Simple Service Discovery Protocol (SSDP), Transmission Control Protocol (TCP) Synchronize, Network Time Protocol (NTP), TCP Reset, User Datagram Protocol (UDP), etc., which are not specifically limited here.

[0091] Multiple feature information sets can be obtained in each time period, and each feature information set contains feature information of multiple data packets. For example, if the time period is 1 day, feature information sets 1, 2, and 3 are sampled on the first day, feature information sets 4, 5, and 6 are sampled on the second day, and feature information sets 7 and 8 are sampled on the third day.

[0092] S22: The server performs the following operations for each feature information set:

[0093] S221: Based on a characteristic information set, using sub-flow data of data packets of each network protocol, obtaining comprehensive flow data of each network protocol within a time period corresponding to the characteristic information set;

[0094] For example, characteristic information set 1 includes characteristic information 1 of data packet 1, characteristic information 2 of data packet 2, characteristic information 3 of data packet 3, and characteristic information 4 of data packet 4. Data packet 1 uses network protocol 1, and its sub-traffic data is 64 bytes. Data packet 2 uses network protocol 1, and its sub-traffic data is 64 bytes. Data packet 3 uses network protocol 2, and its sub-traffic data is 128 bytes. Data packet 4 uses network protocol 1, and its sub-traffic data is 64 bytes. The comprehensive traffic data is used to characterize the traffic conditions of data packets using the corresponding network protocols. The comprehensive traffic data of network protocol 1 is 192 bytes, which can be expressed as

[192] . The comprehensive traffic data of network protocol 2 is 128 bytes, which can be expressed as

[128] .

[0095] Furthermore, the comprehensive traffic data can also include the number of data packets using the network protocol. Taking the above-mentioned network protocol as an example, the number of data packets using network protocol 1 is 3, and the number of data packets using network protocol 2 is 1. The comprehensive traffic data of network protocol 1 can be expressed as [3, 192], and the comprehensive traffic data of network protocol 2 can be expressed as [1, 128].

[0096] In the embodiment of the present application, the network protocols are SSDP, TCP SYN, NTP, TCP RST, UDP, and five common low-speed DDoS hybrid attack protocol types as examples, and the comprehensive traffic data includes the number of packets and the number of bytes as an example for explanation. For each network protocol, two types of protocol data are counted, namely the number of packets and the number of bytes. A list of attack protocol types 1 can be established as shown below:

[0097]

[0098] Table 1

[0099] In the specific implementation, Net Flow traffic data in the network is collected periodically, and the Net Flow traffic data is classified according to the protocols defined in the attack protocol type list. The protocol type in the Net Flow traffic data is determined based on information such as the transport layer protocol type, port number, and protocol flags. For example, SSDP is determined by Net Flow traffic port 1900 and UDP protocol type, and TCP SYN is determined by TCP protocol and data with the TCP_FLAGS flag position as SYN.

[0100] After the classified traffic data, count the number of packets of each protocol in the attack protocol type list x p and the number of bytes x b The different protocol data in a sampling result are combined into a vector X:

[0101]

[0102] Among them, x1 and x2 are the number of packets and bytes of protocol 1, x3 and x4 are the number of packets and bytes of protocol 2, and so on. The protocol type TCP SYN corresponding to the data in the vector of X can be obtained by querying the attack protocol type list 1 through the protocol number 2.

[0103] Net Flow data is collected multiple times in a row in the same time period. The number of samplings is 12. After the protocol classification statistics are performed, 12 sampling results X1, X2, ..., X12 are obtained.

[0104] Optionally, after obtaining each integrated traffic data, for each network protocol, based on the historical traffic data of the network protocol in each historical time period, the integrated traffic data of the network protocol is adjusted to obtain adjusted integrated traffic data.

[0105] Specifically, for each network protocol, the comprehensive traffic data within the current time period is obtained, and the comprehensive traffic data can also be smoothed using historical traffic data. The historical time period is the time period before the current time period. In the embodiment of the present application, the historical time period is mainly used as the first 7 time periods of the current time period as an example for explanation, that is, the sliding window is 8. The specific number can be set according to needs and is not specifically limited here.

[0106] Optionally, an average of multiple historical traffic data and comprehensive traffic data of a network protocol is used as the adjusted comprehensive traffic data.

[0107] For example, the comprehensive traffic data of network protocol 1 in time period 25 is [3, 256], where 3 represents the number of data packets and 256 represents the number of bytes. The historical time periods are time periods 18-24, the historical traffic data of time period 18 is [3, 256], the historical traffic data of time period 19 is [4, 256], the historical traffic data of time period 20 is [6, 448], the historical traffic data of time period 21 is [2, 128], the historical traffic data of time period 22 is [4, 320], the historical traffic data of time period 23 is [8, 256], and the historical traffic data of time period 24 is [2, 192]. In the adjusted comprehensive traffic data of time period 25, the number of data packets is the average number of data packets in time periods 18-25, and the number of bytes is the average number of bytes in time periods 18-25. Then the adjusted comprehensive traffic data of time period 25 is [4, 264].

[0108] S222: based on the difference between the reference flow data of each network protocol and the corresponding integrated flow data, obtaining a flow difference degree corresponding to a characteristic information set;

[0109] Specifically, corresponding reference traffic data is pre-determined for each network protocol, and the reference traffic data is the reference value of the comprehensive traffic data. For example, network protocol 1 corresponds to reference traffic data 1 and comprehensive traffic data 1, network protocol 2 corresponds to reference traffic data 2 and comprehensive traffic data 2, and network protocol 3 corresponds to reference traffic data 3 and comprehensive traffic data 3. Then, based on the difference between reference traffic data 1 and comprehensive traffic data 1, the difference between reference traffic data 2 and comprehensive traffic data 2, and the difference between reference traffic data 3 and comprehensive traffic data 3, the traffic difference degree is obtained.

[0110] Optionally, the reference traffic data is obtained based on the historical traffic data of the corresponding network protocol in each historical time period.

[0111] Specifically, historical traffic data of a historical time period refers to traffic data in a time period before the current time period in which no attack has been detected, and can also be referred to as normal traffic data. For example, for network protocol 1, the current time period is time period 10, and the historical traffic data in the historical time period can be traffic data in time period 1, traffic data in time period 2, and traffic data in time period 3, which are not specifically limited here. This application mainly uses the example that the reference traffic data is obtained based on the historical traffic data in 12 historical time periods. The reference traffic data can be any one of the 12 historical traffic data, or it can be the average of the 12 historical traffic data, which are not specifically limited here.

[0112] For example, for 12 samples of Net Flow traffic data , the mean of the sampling results is calculated as , where the mean of the j-th protocol data is .

[0113] Optionally, step S222 can be implemented as steps 1-2:

[0114] Step 1: Based on the historical traffic data sets of each network protocol, the traffic correlation characteristics between the network protocols are obtained;

[0115] Step 2: Based on the traffic correlation characteristics and the difference between the reference traffic data of each network protocol and the corresponding comprehensive traffic data, a traffic difference degree corresponding to a feature information set is obtained.

[0116] Specifically, the historical traffic data set of each network protocol contains corresponding historical traffic data. Here, taking 12 historical traffic data as an example, the traffic correlation features are extracted for each historical traffic data to obtain the traffic correlation features, and then the traffic difference is obtained based on the traffic correlation features. The traffic difference can characterize the difference between the reference traffic data and the comprehensive traffic data.

[0117] Optionally, step 1 may be implemented as follows:

[0118] Based on each historical traffic data set, each historical traffic vector is obtained, and based on the correlation between each historical traffic vector, a traffic correlation feature is obtained.

[0119] Specifically, the elements in the historical traffic vector are the historical traffic data in the corresponding historical traffic data set. The comprehensive traffic data is given as an example above. In fact, the historical traffic data and the comprehensive traffic data contain the same elements, that is, they contain the number of data packets and the number of bytes. For example, the historical traffic data set contains historical traffic data 1-5, historical traffic data 1 is [1, 64], historical traffic data 2 is [2, 128], historical traffic data 3 is [3, 192], historical traffic data 4 is [4, 256], and historical traffic data 5 is [5, 320]. Based on the historical traffic data set 1, the historical traffic vector 1 [1, 64, 2, 128, 3, 192, 4, 256, 5, 320] is obtained, and the traffic correlation feature is obtained by extracting the correlation features of each historical traffic vector.

[0120] In the embodiment of the present application, the covariance matrix of the historical traffic vector is mainly calculated as the traffic correlation feature. The number of historical traffic vectors is 12, that is, the number of samples is 12, and each historical traffic vector contains 10 elements. Then the dimension of the covariance matrix C is 10×10:

[0121]

[0122]

[0123]

[0124] Where i, j = 1, 2, ... k, k = 10, For x i The mean of For x j The mean value of For x i Reference flow data.

[0125] When it is detected that the current flow is normal flow data, the above covariance matrix and reference flow data (normal flow parameters) are continuously updated according to the latest collected normal flow data, so that the normal flow parameters can be updated as the flow changes.

[0126] By continuously updating normal traffic parameters, changes in normal traffic can be tracked, making abnormal attack detection capable of adaptive adjustment, reducing false alarms caused by changes in normal traffic and improving the accuracy of identifying low-speed DDoS hybrid attacks.

[0127] Optionally, step 2 may be implemented as follows:

[0128] A comprehensive flow vector is obtained based on each comprehensive flow data, and a reference flow vector is obtained based on each reference flow data; based on a difference vector between the comprehensive flow vector and the reference flow vector, and flow correlation characteristics, a flow difference corresponding to a feature information set is obtained.

[0129] Among them, the position of the integrated traffic data corresponding to the same network protocol in the integrated traffic vector is the same as the position of the reference traffic data in the reference traffic vector. The method of obtaining the integrated traffic vector and the reference traffic vector is the same as the method of obtaining the historical traffic vector. For example, the integrated traffic data 1 is [1, 64], the integrated traffic data 2 is [2, 128], the integrated traffic data 3 is [3, 192], the integrated traffic data 4 is [4, 256], and the integrated traffic data 5 is [5, 320]. Based on the integrated traffic data 1-5, the integrated traffic vector 1 [1, 64, 2, 128, 3, 192, 4, 256, 5, 320] is obtained.

[0130] For the comprehensive flow vector , assuming the reference traffic vector is:

[0131]

[0132] The covariance matrix is:

[0133]

[0134] Calculate the Mahalanobis distance from the comprehensive flow data to the normal flow data, and use the calculated Mahalanobis distance as the flow difference:

[0135]

[0136] Among them, D m represents the Mahalanobis distance, X-µ represents the difference vector between the comprehensive flow vector and the reference flow vector, C -1 is the inverse of the covariance matrix.

[0137] Optionally, after adjusting the comprehensive traffic data, a traffic difference corresponding to a feature information set is obtained based on the difference between the reference traffic data of each network protocol and the corresponding adjusted comprehensive traffic data.

[0138] S23: The server obtains the attack detection result based on the traffic difference corresponding to each feature information set.

[0139] Specifically, a difference threshold may be set, and when the differences in each flow rate exceed the difference threshold, it is determined that there is no attack; or when the differences in each flow rate are less than the difference threshold, it is determined that there is an attack; or when there is a flow difference less than the difference threshold, it is determined that there is an attack. No specific limitation is made here.

[0140] In an embodiment of the present application, by sampling the characteristic information of the data packets in the network, the comprehensive flow data of each network protocol in each time period is obtained. Based on the difference between the reference flow data of each network protocol and the corresponding comprehensive flow data, the flow difference corresponding to each characteristic information set can be obtained, and then the attack detection result can be obtained. Based on the above method, by using the flow correlation under the same network protocol, by comparing the difference between the comprehensive flow data and the reference flow data under the same network protocol, attacks can be identified more flexibly, and the accuracy of attack detection can be improved. It is not limited to identifying specific attack protocol types, and can identify attacks of multiple network protocols. It has a higher scope of application, and does not need to use the entire data packet, only the characteristic information of the sampled data packet is detected, which reduces the complexity of detection and system overhead.

[0141] Optionally, step S23 may be implemented as the following steps:

[0142] S231: Determine a difference mean based on the flow difference;

[0143] S232: respectively determining the ratios between the flow differences and the difference mean, and when there is a first ratio greater than the first value among the obtained first ratios, determining that the attack detection result is that an attack exists.

[0144] Specifically, for the obtained flow difference , calculate the mean:

[0145]

[0146] Then calculate , there exists any When the value is greater than the Mahalanobis distance judgment threshold E (first ratio), it is determined that an attack exists.

[0147] Based on the above method, when an attack occurs, the changes in each network protocol in the traffic are identified, and the changes in multi-dimensional data of common mixed attack multi-protocols (which can be cross-layer protocol mixtures) in NetFlow traffic are fully detected. At the same time, the traffic correlation between different network layer protocols and the impact of different data dimension measurement scales can be reduced, making the degree of deviation between attack traffic and normal traffic more accurately judged.

[0148] Optionally, after determining that the attack detection result is that an attack exists, for each network protocol, determine the reference traffic data of the network protocol and the difference between the comprehensive traffic data of the network protocol in each time period, and determine a second ratio between each difference and the reference difference; based on each second ratio, determine a target ratio of the network protocol; based on the target ratio of each network protocol, screen out network protocols whose corresponding target ratio is greater than the second value, and execute attack protection measures based on the screened network protocols.

[0149] Specifically, when an attack is determined, the z-score value of a network protocol in 12 time periods, i.e., the target ratio, is calculated respectively. The reference difference value is the standard deviation of each reference traffic data. For the 12 sampled reference traffic data X1, X2, ..., X12, the standard deviation of the sampling results is calculated:

[0150]

[0151] Among them, the standard deviation of the jth network protocol is , that is, the reference difference value of each network protocol is the standard deviation of the corresponding 12 historical traffic data.

[0152] For network protocol j, its z-score value is , x j is the comprehensive flow data, µ j is the reference flow data, σ j is the standard deviation of the 12 historical flow data, i.e. the reference difference. Calculate the comprehensive flow vector The z-score of all protocols in , after calculating the z-score values ​​of the 12 comprehensive flow vectors, we get ,for Calculate the mean z-score of the j protocol , L is the second value, here we assume , determining that there is a suspected attack protocol.

[0153] in Get the attack protocol data numbers 1, 2, and 4. According to the protocol numbers, query the protocol names in the attack protocol type list 1. The attack protocols SSDP and TCP SYN used in this low-speed DDoS hybrid attack are obtained, and attack protection measures can be taken.

[0154] Based on the above method, the problem of low-speed DDoS hybrid attacks being difficult to identify is solved. In the detection of low-speed DDoS hybrid attacks, any combination of multi-protocol attack methods can be identified without limiting the combination of a certain type of attack protocol. The system has the ability to automatically identify various attack protocols in hybrid attacks.

[0155] like Figure 3 As shown, it is a schematic diagram of the overall process of the attack detection method implemented in this application, including:

[0156] S301: sampling a set of feature information within 12 time periods according to a preset time period;

[0157] S302: Calculate the comprehensive flow vector of each feature information set respectively;

[0158] S303: Calculating the flow difference of each feature information set based on the reference flow vector, the comprehensive flow vector and the flow correlation feature of each feature information set respectively;

[0159] S304: Determine a difference mean based on the flow differences;

[0160] S305: respectively determining the ratios between the flow differences and the difference mean, and determining that an attack exists when there is a first ratio greater than a first value among the obtained first ratios;

[0161] S306: Calculate the target ratio of each network protocol respectively, filter out the network protocols whose corresponding target ratio is greater than the second value, and execute the attack protection measures according to the filtered network protocols.

[0162] In a specific implementation, the attack detection method in this application can be executed by the following modules:

[0163] Data collection and classification module: used to collect the Net Flow traffic data of the gateway, classify it according to the types of different network protocols in the traffic, and count the multi-dimensional data of each protocol, such as the number of data packets and the size of data packets.

[0164] Data preprocessing module: used to smooth the collected Net Flow traffic. It uses a sliding window to smooth several consecutive Net Flow traffic data to reduce the impact of outliers. The window size can be determined based on the sampling frequency and the tolerable error. Other outlier processing methods can also be used.

[0165] Parameter calculation module: used to calculate the covariance matrix parameters of each network protocol in Net Flow traffic data when the normal traffic data is in progress. The pre-processed continuous traffic data is used as the sample point to calculate the covariance matrix parameters between the protocols in the traffic data and continuously update the parameters.

[0166] Mahalanobis distance calculation module: used to calculate the Mahalanobis distance between the latest traffic data and the current normal traffic sample. The latest pre-processed traffic collection data is used to calculate the Mahalanobis distance using the latest normal traffic sample parameters to identify points with abnormally large results.

[0167] Attack protocol analysis module: used to analyze specific attack protocols in abnormal traffic. When the Mahalanobis distance of multiple consecutive sampling points increases abnormally, the Z-score value of each protocol in the Net Flow data is calculated. When the Z-score values ​​of multiple protocols increase abnormally, it is determined that there is a DDos mixed attack, and these protocols are determined as the mixed attack protocols used this time.

[0168] Based on the same inventive concept, the embodiment of the present application also provides an attack detection device. Figure 4 As shown, it is a schematic diagram of the structure of the attack detection device 400, which may include:

[0169] The sampling unit 401 is used to sample the characteristic information of the data packets in the network according to a preset time period, and obtain a set of characteristic information sampled in each time period, wherein the characteristic information includes: sub-flow data of the corresponding data packets and the used network protocol;

[0170] The statistical unit 402 is used to perform the following operations for each feature information set:

[0171] Based on the sub-flow data of the data packets of each network protocol in a characteristic information set, the comprehensive flow data of each network protocol in a time period corresponding to the characteristic information set is obtained, and the comprehensive flow data is used to characterize: the flow situation of the data packets using the corresponding network protocol;

[0172] Based on the difference between the reference flow data of each network protocol and the corresponding comprehensive flow data, a flow difference degree corresponding to a characteristic information set is obtained;

[0173] The detection unit 403 is used to obtain an attack detection result based on the flow difference corresponding to each characteristic information set.

[0174] Optionally, the reference traffic data is obtained based on the historical traffic data of the corresponding network protocol in each historical time period;

[0175] The statistical unit 402 is specifically used for:

[0176] Based on the historical traffic data sets of each network protocol, the traffic correlation characteristics between the network protocols are obtained;

[0177] Based on the traffic correlation characteristics and the difference between the reference traffic data of each network protocol and the corresponding integrated traffic data, a traffic difference degree corresponding to a feature information set is obtained.

[0178] Optionally, the statistical unit 402 is specifically used for:

[0179] Based on each historical traffic data set, each historical traffic vector is obtained, and the elements in the historical traffic vector are the historical traffic data in the corresponding historical traffic data set;

[0180] Based on the correlation between each historical traffic vector, a traffic correlation feature is obtained.

[0181] Optionally, the statistical unit 402 is specifically used for:

[0182] Obtaining a comprehensive traffic vector based on each comprehensive traffic data, and obtaining a reference traffic vector based on each reference traffic data, wherein the position of the comprehensive traffic data corresponding to the same network protocol in the comprehensive traffic vector is the same as the position of the reference traffic data in the reference traffic vector;

[0183] Based on the difference vector between the comprehensive flow vector and the reference flow vector, as well as the flow correlation characteristics, a flow difference corresponding to a feature information set is obtained.

[0184] Optionally, the device further includes an adjustment unit 404, configured to:

[0185] For each network protocol, based on the historical traffic data of the network protocol in each historical time period, the comprehensive traffic data of the network protocol is adjusted to obtain the adjusted comprehensive traffic data.

[0186] Optionally, the statistical unit 402 is specifically used for:

[0187] Based on the difference between the reference flow data of each network protocol and the corresponding adjusted comprehensive flow data, a flow difference degree corresponding to a characteristic information set is obtained.

[0188] Optionally, the detection unit 403 is specifically configured to:

[0189] Based on the differences of each flow rate, a mean difference is determined;

[0190] The ratios between the flow differences and the difference mean are determined respectively, and when there is a first ratio greater than the first value among the obtained first ratios, it is determined that the attack detection result is that an attack exists.

[0191] Optionally, the device further includes a screening unit 405, which is used to:

[0192] For each network protocol, respectively determine the reference flow data of the network protocol and the difference between the comprehensive flow data of the network protocol in each time period, and determine a second ratio between each difference and the reference difference; based on each second ratio, determine a target ratio of the network protocol;

[0193] Based on the target ratios of the respective network protocols, network protocols whose corresponding target ratios are greater than the second value are screened out, and attack protection measures are executed according to the screened out network protocols.

[0194] For the convenience of description, the above parts are divided into modules (or units) according to their functions and described separately. Of course, when implementing this application, the functions of each module (or unit) can be implemented in the same or multiple software or hardware.

[0195] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program that has a predetermined function and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories), or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0196] Those skilled in the art will appreciate that various aspects of the present application may be implemented as a system, method or program product. Therefore, various aspects of the present application may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to as "circuit", "module" or "system" herein.

[0197] Based on the same inventive concept as the above method embodiment, an electronic device is also provided in the embodiment of the present application. In one embodiment, the electronic device may be a server, such as Figure 1 In this embodiment, the structure of the electronic device can be as follows: Figure 5 As shown, it includes a memory 501 , a communication module 503 and one or more processors 502 .

[0198] The memory 501 is used to store computer programs executed by the processor 502. The memory 501 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and programs required for running the instant messaging function, etc.; the data storage area may store various instant messaging information and operation instruction sets, etc.

[0199] The memory 501 may be a volatile memory, such as a random-access memory (RAM); the memory 501 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); or the memory 501 may be any other medium that can be used to carry or store a desired computer program in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 501 may be a combination of the above memories.

[0200] The processor 502 may include one or more central processing units (CPU) or a digital processing unit, etc. The processor 502 is configured to implement the above attack detection method when calling the computer program stored in the memory 501 .

[0201] The communication module 503 is used to communicate with terminal devices and other servers.

[0202] The specific connection medium between the memory 501, the communication module 503 and the processor 502 is not limited in the embodiment of the present application. Figure 5 In the embodiment, the memory 501 and the processor 502 are connected via a bus 504. The bus 504 is connected to the processor 502 via a bus 504. Figure 5 The connections between the other components are described with bold lines, which are only for illustrative purposes and are not intended to be limiting. The bus 504 can be divided into an address bus, a data bus, a control bus, etc. For ease of description, Figure 5 The diagram shows that only one thick line is used, but this does not mean that there is only one bus or only one type of bus.

[0203] The memory 501 stores a computer storage medium, and the computer storage medium stores computer executable instructions, and the computer executable instructions are used to implement the attack detection method of the embodiment of the present application. The processor 502 is used to execute the above-mentioned attack detection method, such as Figure 2 shown.

[0204] In another embodiment, the electronic device may also be other electronic devices, such as Figure 1 In this embodiment, the structure of the electronic device can be as follows: Figure 6 As shown, it includes: a communication component 610, a memory 620, a display unit 630, a camera 640, a sensor 650, an audio circuit 660, a Bluetooth module 670, a processor 680 and other components.

[0205] The communication component 610 is used to communicate with the server. In some embodiments, a wireless fidelity (WiFi) module may be included. The WiFi module belongs to a short-range wireless transmission technology. The electronic device can help the user to send and receive information through the WiFi module.

[0206] The memory 620 can be used to store software programs and data. The processor 680 executes various functions and data processing of the terminal device by running the software programs or data stored in the memory 620. The memory 620 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage device. The memory 620 stores an operating system that enables the terminal device to run. In the present application, the memory 620 can store an operating system and various application programs, and can also store a computer program for executing the attack detection method of the embodiment of the present application.

[0207] The display unit 630 can also be used to display information input by the user or information provided to the user and a graphical user interface (GUI) of various menus of the terminal device. Specifically, the display unit 630 may include a display screen 632 disposed on the front of the terminal device. The display screen 632 may be configured in the form of a liquid crystal display, a light emitting diode, etc. The display unit 630 may be used to display the attack detection user interface in the embodiment of the present application, etc.

[0208] The display unit 630 can also be used to receive input digital or character information and generate signal input related to user settings and function control of the terminal device. Specifically, the display unit 630 may include a touch screen 631 arranged on the front of the terminal device, which can collect user touch operations on or near it, such as clicking a button, dragging a scroll box, etc.

[0209] The touch screen 631 can be covered on the display screen 632, or the touch screen 631 and the display screen 632 can be integrated to realize the input and output functions of the terminal device, and the integrated display screen can be referred to as a touch display screen. In this application, the display unit 630 can display the application and the corresponding operation steps.

[0210] The camera 640 can be used to capture still images, and users can post comments on the images taken by the camera 640 through the application. The camera 640 can be one or more. The object generates an optical image through the lens and projects it onto the photosensitive element. The photosensitive element can be a charge coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the optical signal into an electrical signal, and then transmits the electrical signal to the processor 680 for conversion into a digital image signal.

[0211] The terminal device may further include at least one sensor 650, such as an acceleration sensor 651, a distance sensor 652, a fingerprint sensor 653, and a temperature sensor 654. The terminal device may also be configured with other sensors such as a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, a light sensor, and a motion sensor.

[0212] The audio circuit 660, the speaker 661, and the microphone 662 can provide an audio interface between the user and the terminal device. The audio circuit 660 can transmit the electrical signal converted from the received audio data to the speaker 661, which is converted into a sound signal for output. The terminal device can also be equipped with a volume button for adjusting the volume of the sound signal. On the other hand, the microphone 662 converts the collected sound signal into an electrical signal, which is received by the audio circuit 660 and converted into audio data, and then the audio data is output to the communication component 610 to be sent to, for example, another terminal device, or the audio data is output to the memory 620 for further processing.

[0213] The Bluetooth module 670 is used to exchange information with other Bluetooth devices having Bluetooth modules through the Bluetooth protocol. For example, the terminal device can establish a Bluetooth connection with a wearable electronic device (such as a smart watch) that also has a Bluetooth module through the Bluetooth module 670 to exchange data.

[0214] The processor 680 is the control center of the terminal device. It uses various interfaces and lines to connect various parts of the entire terminal. It executes various functions of the terminal device and processes data by running or executing software programs stored in the memory 620 and calling data stored in the memory 620. In some embodiments, the processor 680 may include one or more processing units; the processor 680 may also integrate an application processor and a baseband processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the baseband processor mainly processes wireless communications. It is understandable that the above-mentioned baseband processor may not be integrated into the processor 680. In the present application, the processor 680 can run the operating system, application programs, user interface display and touch response, as well as the attack detection method of the embodiment of the present application. In addition, the processor 680 is coupled to the display unit 630.

[0215] In some possible implementations, various aspects of the attack detection method provided by the present application may also be implemented in the form of a program product, which includes a computer program. When the program product is run on an electronic device, the computer program is used to enable the electronic device to execute the steps of the attack detection method according to various exemplary embodiments of the present application described above in this specification. For example, the electronic device may execute the following steps: Figure 2 Follow the steps shown in .

[0216] The program product may adopt any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0217] The program product of the embodiment of the present application may adopt a portable compact disk read-only memory (CD-ROM) and include a computer program, and can be run on an electronic device. However, the program product of the present application is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, which can be used by or in combination with a command execution system, apparatus, or device.

[0218] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable computer program is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with a command execution system, apparatus, or device.

[0219] The computer program embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0220] The computer program for performing the operation of the present application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and also conventional procedural programming languages ​​such as "C" language or similar programming languages. The computer program can be executed entirely on the user electronic device, partially on the user device, as an independent software package, partially on the user electronic device and partially on the remote electronic device, or completely on the remote electronic device or server. In the case of involving a remote electronic device, the remote electronic device can be connected to the user electronic device through any type of network including a local area network (LAN) or a wide area network (WAN), or can be connected to an external electronic device (for example, using an Internet service provider to connect through the Internet).

[0221] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0222] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0223] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain a computer-usable computer program.

[0224] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program commands. These computer program commands can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the commands executed by the processor of the computer or other programmable data processing device generate commands for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0225] These computer program commands may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the commands stored in the computer readable memory produce an article of manufacture comprising a command device, the command device implementing the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0226] These computer program commands can also be loaded onto a computer or other programmable data processing device so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the commands executed on the computer or other programmable device provide the instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0227] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0228] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. An attack detection method, characterized in that: The method comprises: According to a preset time period, characteristic information of a data packet in the network is sampled to obtain a set of characteristic information sampled in each time period, wherein the characteristic information includes: sub-flow data of a corresponding data packet and a used network protocol; For each feature information set, perform the following operations: Based on the sub-flow data of the data packets of each network protocol in a characteristic information set, the comprehensive flow data of each network protocol in the time period corresponding to the characteristic information set is obtained, and the comprehensive flow data is used to characterize: the flow situation of the data packets using the corresponding network protocol; Based on the difference between the reference flow data of each network protocol and the corresponding comprehensive flow data, the flow difference corresponding to the one characteristic information set is obtained; the reference flow data is obtained based on the historical flow data of the corresponding network protocol in each historical time period; Based on the traffic difference corresponding to each feature information set, the attack detection result is obtained; The obtaining of the flow difference corresponding to the one characteristic information set based on the difference between the reference flow data of each network protocol and the corresponding integrated flow data comprises: Based on the historical traffic data sets of each of the network protocols, the traffic correlation characteristics between the network protocols are obtained respectively; based on the integrated traffic data, a comprehensive traffic vector is obtained, and based on the reference traffic data, a reference traffic vector is obtained; based on the difference vector between the integrated traffic vector and the reference traffic vector, and the traffic correlation characteristics, the traffic difference corresponding to the one feature information set is obtained; wherein, the position of the integrated traffic data corresponding to the same network protocol in the integrated traffic vector is the same as the position of the reference traffic data in the reference traffic vector.

2. The method according to claim 1, characterized in that The obtaining of the flow correlation characteristics between the network protocols based on the respective historical flow data sets of the network protocols includes: Based on each historical traffic data set, each historical traffic vector is obtained, wherein the elements in the historical traffic vector are the historical traffic data in the corresponding historical traffic data set; Based on the correlation between the historical traffic vectors, the traffic correlation feature is obtained.

3. The method according to claim 1, characterized in that Before obtaining the flow difference corresponding to the one characteristic information set based on the difference between the reference flow data of each network protocol and the corresponding integrated flow data, the method further includes: For each network protocol, based on the historical traffic data of the network protocol in each historical time period, the comprehensive traffic data of the network protocol is adjusted to obtain the adjusted comprehensive traffic data.

4. The method according to claim 3, characterized in that The obtaining the flow difference corresponding to the one characteristic information set based on the difference between the reference flow data of each network protocol and the corresponding integrated flow data includes: Based on the difference between the reference flow data of each of the network protocols and the corresponding adjusted comprehensive flow data, the flow difference degree corresponding to the one characteristic information set is obtained.

5. The method according to any one of claims 1 to 4, characterized in that The attack detection result is obtained based on the flow difference corresponding to each characteristic information set, including: Based on the differences of each flow rate, a mean difference is determined; The ratios between the flow differences and the difference mean are determined respectively, and when a first ratio greater than a first value exists among the obtained first ratios, it is determined that the attack detection result is that an attack exists.

6. The method according to claim 5, characterized in that After determining that the attack detection result is that an attack exists, the method further includes: For each network protocol, respectively determine the reference flow data of the network protocol and the difference between the comprehensive flow data of the network protocol in each time period, and determine a second ratio between each difference and the reference difference; based on each second ratio, determine a target ratio of the network protocol; Based on the target ratios of the network protocols, network protocols whose corresponding target ratios are greater than a second value are screened out, and attack protection measures are executed according to the screened out network protocols.

7. An attack detection device, characterized in that: include: A sampling unit, used to sample characteristic information of data packets in the network according to a preset time period, and obtain a set of characteristic information sampled in each time period, wherein the characteristic information includes: sub-flow data of the corresponding data packet and the network protocol used; The statistical unit is used to perform the following operations for each feature information set: Based on the sub-flow data of the data packets of each network protocol in a characteristic information set, the comprehensive flow data of each network protocol in the time period corresponding to the characteristic information set is obtained, and the comprehensive flow data is used to characterize: the flow situation of the data packets using the corresponding network protocol; Based on the difference between the reference flow data of each network protocol and the corresponding comprehensive flow data, the flow difference corresponding to the one characteristic information set is obtained; the reference flow data is obtained based on the historical flow data of the corresponding network protocol in each historical time period; A detection unit, used to obtain an attack detection result based on the flow difference corresponding to each characteristic information set; The statistical unit is specifically used for: Based on the historical traffic data sets of each of the network protocols, respectively, traffic correlation characteristics between the network protocols are obtained; A comprehensive traffic vector is obtained based on each comprehensive traffic data, and a reference traffic vector is obtained based on each reference traffic data. Based on a difference vector between the comprehensive traffic vector and the reference traffic vector, and the traffic correlation feature, a traffic difference degree corresponding to the one feature information set is obtained; wherein, the position of the comprehensive traffic data corresponding to the same network protocol in the comprehensive traffic vector is the same as the position of the reference traffic data in the reference traffic vector.

8. An electronic device, characterized in that: It comprises a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of any one of the methods of claims 1 to 6.

Images