A security threat defense method and system for internal and external networks

Abstract

The present invention relates to a security threat defense method and system for internal and external networks, and relates to the field of network security, including: responding to an internal network access request sent by an external network; performing access risk assessment through threat intelligence samples to obtain a first access risk coefficient; when the first access risk coefficient is less than or equal to the first access risk coefficient threshold, performing access risk assessment through access log samples to obtain a second access risk coefficient; when the second access risk coefficient is less than or equal to the second access risk coefficient threshold, accessing the external network to execute the internal network access request. The present application solves the technical problem that the security verification of internal and external network access requests in the prior art is insufficient, and it is easy for attack sources to steal and deceive through identity authentication to invade the internal network, and achieves the technical effect of improving the security and reliability of internal and external network access control through phased comprehensive analysis of small sample threat intelligence and large sample access logs, while taking into account the saving of computing resources.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a method and system for defending against security threats to internal and external networks. Background Art

[0002] With the continuous development of computer network technology, data interaction between internal and external networks is becoming more and more frequent. However, the core data resources stored and transmitted in the internal network are usually core data resources. Once invaded and attacked from the external network, it will cause immeasurable losses. At present, the security verification of internal and external network access requests mainly adopts the identity verification method. The request source is authenticated and judged according to the historical access status of the request source. If the identity verification fails or the historical access status has an attack record, the access request is rejected. However, this method has great limitations. For access requests that have never appeared, there is usually only a relatively simple identity verification link. The attack source may pass the identity verification by means of stealing or deception, thereby bypassing the security line of defense and invading the internal network, posing a serious threat to the security of the internal network. In addition, if a complex security analysis is performed on each access request, a large amount of computing resources will be consumed, affecting the security defense performance and response speed. Summary of the invention

[0003] The present invention aims to solve the technical problem that the security verification of internal and external network access requests in the prior art is insufficient, and the internal network is easily invaded by attack sources through identity theft and deception, and a security threat defense method and system for internal and external networks are provided to solve the problem.

[0004] The technical solution of the present invention to solve the above technical problems is as follows:

[0005] In a first aspect, the present invention provides a method for defending against security threats against internal and external networks, comprising: in response to an intranet access request sent by an external network, obtaining a request source IP address, a request source domain name, a request program hash value, and an access instruction sequence; using a threat intelligence sample, performing an access risk assessment on the intranet access request based on the request source IP address, the request source domain name, the request program hash value, and the access instruction sequence to obtain a first access risk coefficient; when the first access risk coefficient is less than or equal to a first access risk coefficient threshold, using an access log sample, performing an access risk assessment on the intranet access request based on the access instruction sequence to obtain a second access risk coefficient; when the second access risk coefficient is less than or equal to the second access risk coefficient threshold, accessing the external network to execute the intranet access request.

[0006] In a second aspect, the present invention provides a security threat defense system for internal and external networks, including: an access request acquisition module, used to respond to an internal network access request sent by an external network, and obtain a request source IP address, a request source domain name, a request program hash value, and an access instruction sequence; a threat intelligence assessment module, used to perform an access risk assessment on the internal network access request based on the request source IP address, the request source domain name, the request program hash value, and the access instruction sequence through a threat intelligence sample, and obtain a first access risk coefficient; an access log assessment module, used to perform an access risk assessment on the internal network access request based on the access instruction sequence through an access log sample when the first access risk coefficient is less than or equal to a first access risk coefficient threshold, and obtain a second access risk coefficient; a network access execution module, used to access the external network to execute the internal network access request when the second access risk coefficient is less than or equal to a second access risk coefficient threshold.

[0007] In a third aspect, the present application provides an electronic device, comprising: a processor; a memory for storing instructions executable by the processor; wherein the processor is used to execute a security threat defense method for internal and external networks provided in the present application.

[0008] In a fourth aspect, the present application provides a computer-readable storage medium storing a computer program, and the computer program is used to execute a security threat defense method for internal and external networks provided by the present application.

[0009] The beneficial effects of the present invention are:

[0010] In response to the intranet access request sent by the external network, the request source IP address, request source domain name, request program hash value, and access instruction sequence are obtained, providing a basis for subsequent access risk assessment; through the threat intelligence sample, the intranet access request is evaluated for access risk based on the request source IP address, request source domain name, request program hash value, and access instruction sequence to obtain the first access risk coefficient, and the threat intelligence sample is used for rapid evaluation to efficiently identify known malicious request features, thereby preliminarily judging the risk level of the request; when the first access risk coefficient is less than or equal to the first access risk coefficient threshold, the intranet access request is evaluated for access risk based on the access instruction sequence through the access log sample to obtain the second access risk coefficient. If no high risk is found in the first stage of evaluation, a large sample access log is further used for in-depth analysis, and the risk level of the request is comprehensively judged by matching the access behavior pattern to improve the accuracy of risk judgment; when the second access risk coefficient is less than or equal to the second access risk coefficient threshold, the external network is connected to execute the intranet access request. Only when the risk assessment in both stages does not exceed the set threshold, the request is allowed to access the intranet, ensuring the security and reliability of intranet access.

[0011] Through the phased comprehensive analysis of threat intelligence samples and access log samples, a multi-level access risk assessment mechanism is constructed; the threshold comparison method is adopted to achieve quantitative control of access request risks; at the same time, by combining small sample rapid assessment with large sample in-depth analysis, while ensuring the security and reliability of internal and external network access control, it also takes into account the conservation of computing resources. This method effectively solves the problem of insufficient security verification of internal and external network access requests in the existing technology, and improves the security and intelligence level of internal and external network access control. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 A schematic diagram of a process for defending against security threats to internal and external networks provided by the present invention;

[0013] Figure 2 A schematic diagram of the structure of a security threat defense system for internal and external networks provided by the present invention;

[0014] Figure 3 A schematic diagram of the structure of an electronic device provided by the present invention;

[0015] Figure 4 A schematic diagram of the structure of a computer-readable storage medium provided by the present invention.

[0016] In the accompanying drawings, the components represented by the reference numerals are as follows:

[0017] Access request acquisition module 110, threat intelligence assessment module 120, access log assessment module 130, network access execution module 140, electronic device 200, memory 210, processor 220, first computer program 211, computer readable storage medium 300, second computer program 311. DETAILED DESCRIPTION

[0018] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0019] In the description of the present invention, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0020] In the description of the present invention, the term "for example" is used to mean "used as an example, illustration or explanation". Any embodiment described as "for example" in the present invention is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is given to enable any technician in the field to implement and use the present invention. In the following description, details are listed for the purpose of explanation. It should be understood that a person of ordinary skill in the art can recognize that the present invention can be implemented without using these specific details. In other examples, well-known structures and processes will not be elaborated in detail to avoid obscuring the description of the present invention with unnecessary details. Therefore, the present invention is not intended to be limited to the embodiments shown, but is consistent with the widest scope consistent with the principles and features disclosed in the present invention.

[0021] Embodiment 1:

[0022] like Figure 1 As shown, an embodiment of the present invention provides a method for defending against security threats to internal and external networks, including:

[0023] S100: In response to an intranet access request sent from an external network, obtain a request source IP address, a request source domain name, a request program hash value, and an access instruction sequence.

[0024] Specifically, when the intranet receives an intranet access request from an external network, it obtains key information parameters of the intranet access request, including the request source IP address, request source domain name, request program hash value, and access instruction sequence. Among them, the request source IP address refers to the source IP address that sends this intranet access request, which is used to identify the host or device that sends the request; the request source domain name refers to the domain name that sends this intranet access request, which is used to identify the website or service that sends the request; the request program hash value refers to the hash operation value of the program that sends this intranet access request, which is used to uniquely identify the request program; the access instruction sequence refers to a series of access instructions contained in the intranet access request, which represents a series of access operations to be performed by the request.

[0025] For example, a request acquisition module is deployed at the entrance of the intranet. When an intranet access request is received from an external network, the module can capture the request and extract the request source IP address and request source domain name from the header information of the request data packet of the intranet access request; at the same time, according to the program file carried in the request data packet, a preset hash algorithm is used to calculate it to obtain the request program hash value; in addition, the access instruction sequence contained in the request data packet is parsed out.

[0026] Through the request acquisition module, the request source IP address, request source domain name, request program hash value, and access instruction sequence required for subsequent access risk assessment are obtained, laying a data foundation for judging the security of the request through threat intelligence samples and access log samples.

[0027] S200: Using threat intelligence samples, perform an access risk assessment on the intranet access request based on the request source IP address, the request source domain name, the request program hash value and the access instruction sequence to obtain a first access risk coefficient.

[0028] Specifically, threat intelligence samples refer to samples formed by collecting and storing known network threat intelligence data, which include known malicious IP addresses, malicious domain names, malicious program hash values, malicious access instruction sequences, etc. By comparing and analyzing the relevant parameters of the intranet access request with the data in the threat intelligence sample, it can be determined whether the request has a threat risk.

[0029] After responding to and receiving the request source IP address, request source domain name, request program hash value, and access instruction sequence of the intranet access request in the intranet, it is compared with the data in the threat intelligence sample. During the comparison process, first, it is determined whether the request source IP address, request source domain name, and request program hash value match the attack IP address, attack domain name, and attack program hash value in the threat intelligence sample. If they match, it indicates that the source of the request has a higher threat risk, and the first access risk coefficient is set to a higher value; if they do not match, it is further determined whether the access instruction sequence is similar to the attack access instruction sequence in the threat intelligence sample. If the similarity is high, it indicates that the request operation has a higher threat risk, and the first access risk coefficient is also set to a higher value; if the similarity is low, the first access risk coefficient is set to a lower value. Among them, the first access risk coefficient is used to characterize the risk level of the intranet access request, and its value can be set to different levels or values ​​according to the comparison results of the threat intelligence sample. When the first access risk coefficient is high, it indicates that the intranet access request is likely to have a threat risk; when the first access risk coefficient is low, it indicates that the intranet access request is relatively safe.

[0030] The threat intelligence sample data volume is small, and what is stored in it are known and clear malicious threat intelligence. Using it for access risk assessment can quickly identify known malicious requests, but the ability to identify unknown threats is weak. Therefore, using threat intelligence samples to initially assess access risks can quickly complete the judgment of known threats with a small amount of data, play a role in initial screening, and lay the foundation for further evaluation.

[0031] S300: When the first access risk coefficient is less than or equal to a first access risk coefficient threshold, an access risk assessment is performed on the intranet access request based on the access instruction sequence through an access log sample to obtain a second access risk coefficient.

[0032] Specifically, the first access risk coefficient threshold is a preset critical value used to determine whether the risk of an intranet access request exceeds an acceptable range after threat intelligence sample evaluation. When the first access risk coefficient is less than or equal to the first access risk coefficient threshold, it indicates that the risk of the request is low after preliminary evaluation, but there may still be unknown threats, which require further analysis. When the first access risk coefficient is greater than the first access risk coefficient threshold, it indicates that the risk of the request is very high and can basically be determined to be a malicious request.

[0033] If the first access risk coefficient does not exceed the first access risk coefficient threshold, the access instruction sequence of the intranet access request is compared and analyzed with the access instruction sequences of a large number of normal access requests in the access log sample. The access log sample refers to the historical log big data of normal access behavior in the intranet, which records the instruction execution of a large number of real normal access requests. By comparing and analyzing the similarity between the access instruction sequence of the request and the normal access instruction sequence, it can be determined whether the access behavior of the request conforms to the normal mode. Specifically, first, the instruction sequences of all normal access requests in the access log sample are extracted to form a set of normal access instruction sequences; then, a sequence similarity algorithm, such as an edit distance algorithm, a longest common subsequence algorithm, etc., is used to calculate the similarity between the access instruction sequence of the intranet access request and each instruction sequence in the set of normal access instruction sequences to obtain a set of similarity scores; then, the group of similarity scores is averaged to obtain an average similarity, which is used as the second access risk coefficient. The value range of the second access risk coefficient can be set to [0, 1]. The closer the value is to 1, the higher the average similarity between the access instruction sequence and the normal access pattern, and the lower the risk. In this case, the second access risk coefficient can be set to a lower value; the closer the value is to 0, the lower the average similarity between the access instruction sequence and the normal access pattern, and the higher the risk. In this case, the second access risk coefficient can be set to a higher value.

[0034] The access log sample size is much larger than the threat intelligence sample, which contains a large amount of real normal access behavior data. Therefore, using the access log sample to conduct a second round of fine-grained evaluation of intranet access requests can fully identify whether the request conforms to the normal access mode, thereby improving the accuracy of risk judgment. At the same time, since not all requests need to undergo large sample analysis, but only those with a low risk factor in the initial screening stage are further evaluated, it also avoids performance loss caused by repeated calculations, and takes into account both risk prevention capabilities and operational efficiency.

[0035] S400: When the second access risk coefficient is less than or equal to a second access risk coefficient threshold, access the external network to execute the intranet access request.

[0036] Specifically, the second access risk coefficient threshold is a preset critical value used to determine whether the risk of an intranet access request is acceptable after the access log sample evaluation. When the second access risk coefficient is less than or equal to the second access risk coefficient threshold, it indicates that the average similarity between the intranet access request and the normal access mode is high, the risk is low, and it can be considered a normal access request; when the second access risk coefficient is greater than the second access risk coefficient threshold, it indicates that the average similarity between the request and the normal access mode is low, the risk is high, and further processing is required.

[0037] The second access risk coefficient is compared with the preset second access risk coefficient threshold, and the corresponding access control strategy is executed according to the comparison result. If the second access risk coefficient is less than or equal to the second access risk coefficient threshold, the risk of the intranet access request is considered acceptable, the intranet access request is released, and it is allowed to access the intranet, and the corresponding access operation is performed. If the second access risk coefficient is greater than the second access risk coefficient threshold, the risk of the intranet access request is considered high. At this time, a rejection strategy is adopted to directly block the request from accessing the intranet.

[0038] By dynamically adjusting the handling strategy of intranet access requests based on the comparison result between the second access risk coefficient and the second access risk coefficient threshold, accurate control of intranet access risks can be achieved, minimizing the possibility of external threats infiltrating the intranet without affecting the execution efficiency of normal access requests, thereby comprehensively improving the intelligence level of intranet security protection and ensuring network security.

[0039] Furthermore, the embodiment of the present application also includes:

[0040] S210: extracting first attack record parameters of a first attack sample according to the threat intelligence sample, wherein the first attack record parameters include an attack source IP address, an attack source domain name, an attack program hash value, and an attack instruction sequence;

[0041] S220: performing access risk assessment on the request source IP address, the request source domain name, and the request program hash value according to the attack source IP address, the attack source domain name, and the attack program hash value to obtain a first-level access risk coefficient;

[0042] S230: When the first level access risk coefficient is greater than the first access risk coefficient threshold, adding the first level access risk coefficient to the initial access risk coefficient;

[0043] S240: When the first-level access risk coefficient is less than or equal to the first access risk coefficient threshold, perform access risk assessment on the access instruction sequence according to the attack instruction sequence and add it to the initial access risk coefficient;

[0044] S250: When all threat intelligence samples are traversed, extract the maximum value from the initial access risk coefficient and set it as the first access risk coefficient.

[0045] In a feasible implementation, known network attack samples are stored in the threat intelligence sample, and each attack sample contains the key characteristic parameters of the attack, including the attack source IP address, the attack source domain name, the attack program hash value and the attack instruction sequence. Each attack sample in the threat intelligence sample is read in turn as the first attack sample, and the corresponding first attack record parameters are extracted therefrom, including the attack source IP address, that is, the source IP address that initiates the attack; the attack source domain name, that is, the source domain name that initiates the attack; the attack program hash value, that is, the hash value of the malicious program used in the attack; the attack instruction sequence, that is, a series of malicious instructions executed by the attack. Then, the request source IP address, the request source domain name, and the request program hash value of the intranet access request are compared one by one with the attack source IP address, the attack source domain name, and the attack program hash value of the first attack sample. Among them, the comparison process uses a string matching algorithm to determine whether the two sets of parameters are exactly the same, so as to obtain a first-level access risk coefficient. For example, the value range of the first-level access risk coefficient is set to [0, 1], and the larger the value, the higher the access risk. If the three parameters of the intranet access request are exactly the same as the three parameters of an attack sample, it means that the request is likely to come from a known attack source and its access risk is very high. In this case, the first-level access risk coefficient is set to a larger value (such as 0.9); if the three parameters of the intranet access request are different from the three parameters of all attack samples, it means that the request is unlikely to come from a known attack source and its access risk is relatively low. In this case, the first-level access risk coefficient is set to a smaller value (such as 0.1).

[0046] Then, it is determined whether the first-level access risk coefficient is greater than the first access risk coefficient threshold. If so, it means that the request source IP address, request source domain name, request program hash value and access instruction sequence of the intranet access request are highly consistent with a known attack sample, and its access risk has exceeded the tolerance range of the intranet. At this time, the first-level access risk coefficient is added to the initial access risk coefficient. If the first-level access risk coefficient is less than or equal to the first access risk coefficient threshold, it is not enough to determine whether the risk of the intranet access request exceeds the standard. At this time, the similarity between the access instruction sequence and the attack instruction sequence is further compared. For example, a sequence similarity algorithm, such as an edit distance algorithm, a longest common subsequence algorithm, etc., is used to calculate the similarity between the access instruction sequence of the intranet access request and the attack instruction sequence in the first attack sample. The value range of the similarity is also [0, 1], and the obtained similarity value is added to the initial access risk coefficient. Repeat the execution until all attack samples in the threat intelligence sample are traversed. The initial access risk coefficient records the access risk coefficient obtained by the intranet access request in the comparison process of all attack samples. The maximum value of these access risk coefficients is extracted and used as the first access risk coefficient to quantify the access risk of the intranet access request. The larger the first access risk coefficient, the higher the degree of consistency between the intranet access request and the known attack sample, and the greater the threat possibility; conversely, the smaller the first access risk coefficient, the less likely the intranet access request is to be a known attack behavior.

[0047] By using threat intelligence samples to assess the risk level of intranet access requests, we can obtain the first access risk coefficient and quickly identify requests with known attack patterns, consuming relatively few computing resources. By setting the first access risk coefficient threshold, we can also flexibly adjust the strictness of risk determination and strike a balance between intranet security and business convenience.

[0048] Furthermore, the embodiment of the present application also includes:

[0049] S221: When the attack program hash value is different from the request program hash value, setting the first-level access risk coefficient to be greater than the first access risk coefficient threshold;

[0050] S222: When the attack program hash value is the same as the request program hash value, a first historical attack access frequency ratio since the request source IP address was recorded in the intranet is counted, and a second historical attack access frequency ratio since the request source domain name was recorded in the intranet is counted;

[0051] S223: When at least one of the first historical attack access frequency ratio and the second historical attack access frequency ratio is greater than or equal to a historical attack access frequency ratio threshold, the first-level access risk coefficient is set to be greater than the first access risk coefficient threshold, wherein 0<the historical attack access frequency ratio threshold≤25%.

[0052] In a preferred embodiment, when obtaining the first-level access risk coefficient, first, the attack program hash value and the request program hash value are compared. The hash value is a way to uniquely identify the program file, and different program files will generate different hash values. If the program hash value of the intranet access request is different from the program hash value of the attack sample, it can be directly determined that the two programs are not the same, that is, the request program is unlikely to be a known malicious program. At this time, the first-level access risk coefficient is set to be greater than the first access risk coefficient threshold, indicating that although the request program may be harmless, it still needs to be further evaluated through other factors. When the request program hash value is the same as the attack program hash value, it means that the request program is the same as the known malicious program and is more dangerous. However, the same program alone is not enough to fully determine the risk, because the program may be maliciously used or may be used for normal business. Therefore, it is also necessary to make a comprehensive judgment based on the historical behavior of the request source. Specifically, first, the proportion of the number of historical attack visits of the request source IP address since the intranet record to all visits is counted to obtain the first historical attack visit frequency ratio; then the proportion of the number of historical attack visits of the request source domain name since the intranet record to all visits is counted to obtain the second historical attack visit frequency ratio. These two percentage data reflect the degree of danger of the request source. The higher the percentage, the more suspicious the request source is. Then, a historical attack access frequency percentage threshold is introduced, and its value range is (0, 25%). When at least one of the first historical attack access frequency percentage or the second historical attack access frequency percentage exceeds the threshold, it is considered that the risk of the request source is very high, and the first-level access risk coefficient is directly set to be greater than the first access risk coefficient threshold.

[0053] Through program hash value comparison and historical behavior analysis, the danger level of the source of intranet access requests can be more accurately assessed, providing a basis for the calculation of the first-level access risk coefficient, and improving the overall effect of intranet access risk assessment. In actual applications, the threshold and statistical caliber can be flexibly adjusted according to the specific situation of the intranet, and applicability and reliability can be continuously optimized.

[0054] Furthermore, the embodiment of the present application also includes:

[0055] S241: Counting the number of access instructions in the intersection of the attack instruction sequence and the access instruction sequence;

[0056] S242: Calculate the ratio of the number of intersection access instructions to the number of access instruction sequence instructions, and set it as the attack instruction occupancy rate;

[0057] S243: When the attack instruction occupancy rate is greater than or equal to the attack instruction occupancy rate threshold:

[0058] S244: extracting the sorting information of the intersection access instruction in the attack instruction sequence, and obtaining the first sequence number attack instruction, the second sequence number attack instruction, and the Mth sequence number attack instruction;

[0059] S245: extracting the sorting information of the intersection access instruction in the access instruction sequence, and obtaining the first sequence number access instruction, the second sequence number access instruction, and the Mth sequence number access instruction;

[0060] S246: Count the proportion of the first serial number attack instructions, the second serial number attack instructions up to the Mth serial number attack instructions, and the same number instructions as the first serial number access instructions, the second serial number access instructions up to the Mth serial number access instructions, and add them to the initial access risk coefficient.

[0061] In a preferred embodiment, when performing an access risk assessment on an access instruction sequence based on an attack instruction sequence, first, the number of intersection access instructions of the attack instruction sequence and the access instruction sequence is counted to measure the similarity of the two instruction sequences. The more the number of intersection access instructions, the more known attack instructions are contained in the access instruction sequence, and the higher its risk. Then, the number of intersection access instructions is divided by the number of instructions in the access instruction sequence to obtain the attack instruction occupancy rate. The higher the attack instruction occupancy rate, the greater the proportion of known attack instructions in the access instruction sequence, and the higher its risk level.

[0062] Subsequently, the attack instruction occupancy rate threshold is introduced as a quantitative standard to measure the risk level of the access instruction sequence. When the attack instruction occupancy rate reaches or exceeds the attack instruction occupancy rate threshold, the risk of the access instruction sequence is considered to be high, and the distribution of the attack instructions in it needs to be further analyzed. Then, the sorting information of the intersection access instructions in the attack instruction sequence and the access instruction sequence is extracted respectively. Specifically, each intersection access instruction is numbered according to the order in which the instructions in the intersection access instruction appear in the attack instruction sequence and the access instruction sequence respectively, forming the first-numbered attack instruction, the second-numbered attack instruction until the M-th-numbered attack instruction, and the first-numbered access instruction, the second-numbered access instruction until the M-th-numbered access instruction. In this way, the relative positions of the same instructions in the two sequences can be compared. Afterwards, the proportion of the same number of instructions in the attack instruction sequence and the access instruction sequence is counted as the risk score of the access instruction sequence and added to the initial access risk coefficient. The higher the proportion of the same number of instructions, the higher the instruction content and order of the access instruction sequence are, indicating that the access instruction sequence is highly consistent with the attack instruction sequence, and the higher its risk coefficient is.

[0063] Through the indicator of the number of intersection access instructions, the similarity between the access instruction sequence and the known attack instruction sequence is quantitatively evaluated, providing a clear basis for risk judgment. At the same time, the attack instruction occupancy rate and attack instruction occupancy rate threshold are introduced to filter out instruction sequences that contain some attack instructions but are still normal access sequences as a whole, thereby improving the accuracy of risk judgment.

[0064] Furthermore, the embodiment of the present application also includes:

[0065] S310: Step 1: According to the access log sample, perform k-item frequency analysis on the access instruction sequence to obtain the proportion of k-item infrequent access instructions, where the initial value of k is equal to 1, k is an integer, Q≥k≥1, and Q represents the number of instructions in the access instruction sequence;

[0066] S320: Step 2: When the proportion of the number of k infrequently accessed instructions is greater than or equal to the threshold of the proportion of the number of infrequently accessed instructions, the proportion of the number of k infrequently accessed instructions is set as the second access risk coefficient;

[0067] S330: Step 3: When the proportion of the k infrequently accessed instructions is less than the threshold of the proportion of the k infrequently accessed instructions, and k<Q, the k infrequently accessed instructions are deleted from the access instruction sequence to obtain a first updated access instruction sequence;

[0068] S340: Step 4: Update the access instruction sequence according to the first updated access instruction sequence, update the k value according to k+1, and return to step 1 to execute the loop;

[0069] S350: Step 5: When the proportion of the k infrequently accessed instructions is less than the infrequently accessed instructions proportion threshold, and k=Q, the second access risk coefficient is set to be less than or equal to the second access risk coefficient threshold.

[0070] In a preferred embodiment, when performing access risk assessment on intranet access requests through access log samples, an iterative optimization strategy is adopted to gradually screen out suspicious instructions in the access instruction sequence through multiple rounds of frequency analysis and threshold comparison, thereby determining the size relationship between the second access risk coefficient and the second access risk coefficient threshold.

[0071] First, based on the access log samples, a k-item frequency analysis is performed on the access instruction sequence. The so-called k-item frequency analysis refers to counting the frequency of occurrence of each continuous subsequence of length k in the access instruction sequence, and judging whether it reaches a certain frequency standard. The proportion of the number of k-item non-frequent access instructions is introduced as a frequency measurement indicator. Among them, the instructions contained in the k-item subsequences with lower occurrence frequency are k-item non-frequent access instructions. The proportion of the number of k-item non-frequent access instructions refers to the proportion of the number of non-frequent instructions in the total number of instructions in the access instruction sequence. Initially, the value of k is 1, that is, starting from the frequency analysis of a single instruction. The value range of k is [1, Q], where Q represents the total number of instructions in the access instruction sequence.

[0072] After obtaining the proportion of the number of k non-frequent access instructions, compare it with the preset threshold of the proportion of the number of non-frequent access instructions. If the proportion of the number of k non-frequent access instructions is greater than or equal to the threshold, it means that the access instruction sequence contains too many non-frequent instructions, and its abnormality is high. At this time, the proportion of the number of k non-frequent access instructions is directly used as the second access risk coefficient. If the proportion of the number of k non-frequent access instructions is less than the threshold, it means that the current non-frequent instructions are not enough to determine the risk level of the access instruction sequence, and the k value needs to be further increased. However, if k is equal to Q at this time, that is, the frequency analysis of subsequences of all lengths has been completed, it is impossible to continue to refine, and directly enter step five. If k is less than Q, it is necessary to delete the k non-frequent access instructions found in this round of analysis from the original access instruction sequence to obtain a new access instruction sequence, that is, the first updated access instruction sequence. Subsequently, the original access instruction sequence is replaced by the first updated access instruction sequence, and the value of k is increased by 1, and then return to step one to re-perform the k-item frequent analysis. If after multiple rounds of screening, the proportion of k non-frequent access instructions is always less than the threshold of the proportion of non-frequent access instructions, and the value of k has increased to Q, it means that there is no obvious suspicious instruction pattern in the access instruction sequence, and the access risk is low. At this time, the second access risk coefficient can be set to be less than or equal to the second access risk coefficient threshold.

[0073] By introducing k-item frequency analysis, high-frequency and low-frequency patterns in access instruction sequences are discovered. By adopting an iterative optimization strategy, normal frequent access instructions are gradually filtered out through multiple rounds of screening, suspicious instruction patterns are highlighted, and the accuracy of access risk detection is improved.

[0074] Furthermore, the embodiment of the present application also includes:

[0075] S311: performing k-item continuous instruction enumeration extraction on the access instruction sequence to obtain a plurality of k-item access instruction sequences;

[0076] S312: traversing the frequencies of triggering of the k access instruction sequences in the access log sample, and obtaining the triggering frequencies of the k access instruction sequences;

[0077] S313: Counting the k access instruction sequences whose trigger frequencies are less than the trigger frequency threshold among the k access instruction sequences, and adding them into the k infrequent access instruction sequences;

[0078] S314: Count the proportion of the access instructions of the union of the k infrequently accessed instruction sequences in the number of the access instruction sequences, and set it as the proportion of the number of the k infrequently accessed instructions.

[0079] In a preferred embodiment, when performing k-item frequency analysis, first, perform k-item continuous instruction enumeration extraction on the access instruction sequence to obtain several k-item access instruction sequences. Specifically, use a sliding window of size k, start from the first position of the access instruction sequence, intercept k continuous instructions in sequence, form a k-item access instruction sequence, then move the sliding window to the right by one position, intercept k continuous instructions again, form another k-item access instruction sequence, and repeat until the sliding window reaches the end of the access instruction sequence. By enumeration extraction, all possible several k-item access instruction sequences in the access instruction sequence are obtained. Then, traverse the access log sample, count the frequency of each k-item access instruction sequence in the access log sample, that is, to what extent it is triggered by the real access request, thereby obtaining the triggering frequency of each k-item access instruction sequence. For example, using a string matching algorithm, compare the instruction sequence fragments in each access log one by one with the k-item access instruction sequence to see if they are the same. If they are the same, the triggering frequency of the k-item access instruction sequence is increased by 1. By traversing all access log samples, the triggering frequency of each k-item access instruction sequence is obtained, and several triggering frequencies of k-item access instruction sequences are obtained.

[0080] On the basis of obtaining the trigger frequencies of several k-item access instruction sequences, the k-item access instruction sequences whose trigger frequencies are less than the preset trigger frequency threshold are screened out and added to the k-item infrequent access instruction sequences. Among them, the trigger frequency threshold is used to divide frequent access instruction sequences and infrequent access instruction sequences. If the trigger frequency of a k-item access instruction sequence is less than the threshold, it means that the number of times it appears in the real access log sample is small, it belongs to an uncommon access mode, and has a certain degree of suspicion. Through the trigger frequency threshold, the screening criteria of the infrequent access instruction sequence can be flexibly adjusted to control the strictness of the subsequent risk assessment. After obtaining the k-item infrequent access instruction sequence, the total number of instructions contained in these sequences in the access instruction sequence is further counted, and the proportion of the instructions in the total number of instructions in the access instruction sequence is calculated, and this proportion is used as the proportion of the number of k-item infrequent access instructions. Since there may be overlaps between different k-item infrequent access instruction sequences, in order to avoid repeated counting, the k-item infrequent access instruction sequences are firstly subjected to the instruction-level union operation, and then the number of instructions in the union is counted. The larger the proportion of k infrequent access instructions, the more uncommon instructions are contained in the access instruction sequence, and the higher the overall suspiciousness is.

[0081] Furthermore, the embodiment of the present application also includes:

[0082] S500: When the first access risk coefficient is greater than the first access risk coefficient threshold, feeding back an access rejection signal to the external network;

[0083] S600: Or when the second access risk coefficient is greater than the second access risk coefficient threshold, a denial of access signal is fed back to the external network, and at the same time, the threat intelligence sample is updated according to the request source IP address, the request source domain name, the request program hash value, and the access instruction sequence.

[0084] In a feasible implementation, when the first access risk coefficient is greater than the first access risk coefficient threshold, a rejection signal is fed back to the external network. Specifically, if the first access risk coefficient of the intranet access request has exceeded the preset first access risk coefficient threshold after the threat intelligence sample comparison, it means that the request is very likely to come from a known malicious attack source and poses a direct security threat to the intranet. At this time, the request is directly rejected to block its access to the intranet. Among them, the rejection signal can be fed back to the request initiator in various forms, such as returning a specific error code, closing the TCP connection, not responding, etc. The specific method is set according to the communication protocol and interface specification of the internal and external networks.

[0085] When the second access risk coefficient is greater than the second access risk coefficient threshold, in addition to feeding back the access denial signal to the external network, the existing threat intelligence samples need to be updated and expanded based on the request source IP address, request source domain name, request program hash value, and access instruction sequence. Specifically, if the first access risk coefficient of the intranet access request does not exceed the first access risk coefficient threshold after the threat intelligence sample comparison, but after further access log sample analysis, the second access risk coefficient exceeds the second access risk coefficient threshold, it means that the characteristics of the request have certain similarities with known threats, but are not completely consistent, and it is a new variant threat. In this case, while rejecting the request, the request source IP address, request source domain name, request program hash value, and access instruction sequence of the request are extracted as a new threat intelligence sample and updated to the existing threat intelligence sample, so that such new threats can be quickly identified in the future, and the coverage and timeliness of threat intelligence can be continuously improved.

[0086] Through the dual screening of threat intelligence samples and access log samples, as well as the flexible control of dynamic thresholds, various known and unknown network threats can be accurately and efficiently identified and handled, and through real-time sample update mechanisms, continuous learning and evolution can be achieved to build an intelligent and reliable security line of defense for the intranet.

[0087] The embodiment of the present invention provides a method for defending against security threats to internal and external networks, which has at least the following technical effects:

[0088] In response to the intranet access request sent by the external network, the request source IP address, request source domain name, request program hash value, and access instruction sequence are obtained. By obtaining multiple feature information of the access request, a comprehensive judgment basis is provided for the subsequent access risk assessment. Through the threat intelligence sample, the intranet access request is evaluated for access risk based on the request source IP address, request source domain name, request program hash value, and access instruction sequence to obtain the first access risk coefficient. The access request is quickly evaluated using the threat intelligence sample, and the known malicious request pattern is identified through feature matching to preliminarily determine the risk level of the request. Through this step, obvious malicious requests can be quickly intercepted to save computing resources. When the first access risk coefficient is less than or equal to the first access risk coefficient threshold, the intranet access request is evaluated for access risk based on the access instruction sequence through the access log sample to obtain the second access risk coefficient. In the case that no obvious risk is found in the first stage of the assessment, a large sample access log is further used for in-depth analysis. By extracting the access behavior pattern features in the access log, the risk level of the request is comprehensively judged, the accuracy of risk judgment is improved, and unknown threats are effectively identified. When the second access risk coefficient is less than or equal to the second access risk coefficient threshold, the external network is connected to execute the intranet access request. Only when the risk assessment in both stages does not exceed the set threshold, the request is allowed to access the intranet. By setting the quantitative risk factor threshold, the security boundary of intranet access is controlled, ensuring the security of the intranet to the greatest extent.

[0089] Embodiment 2:

[0090] like Figure 2 As shown, based on the same inventive concept as the security threat defense method for internal and external networks provided in Embodiment 1, the embodiment of the present invention further provides a security threat defense system for internal and external networks, including:

[0091] The access request acquisition module 110 is used to obtain the request source IP address, request source domain name, request program hash value, and access instruction sequence in response to the intranet access request sent by the external network;

[0092] The threat intelligence assessment module 120 is used to perform an access risk assessment on the intranet access request based on the request source IP address, the request source domain name, the request program hash value and the access instruction sequence through the threat intelligence sample to obtain a first access risk coefficient;

[0093] The access log evaluation module 130 is used to, when the first access risk coefficient is less than or equal to a first access risk coefficient threshold, perform access risk evaluation on the intranet access request based on the access instruction sequence through an access log sample to obtain a second access risk coefficient;

[0094] The network access execution module 140 is used to access the external network to execute the intranet access request when the second access risk coefficient is less than or equal to a second access risk coefficient threshold.

[0095] Furthermore, the threat intelligence assessment module 120 includes the following execution steps:

[0096] Extracting first attack record parameters of a first attack sample according to the threat intelligence sample, wherein the first attack record parameters include an attack source IP address, an attack source domain name, an attack program hash value, and an attack instruction sequence;

[0097] According to the attack source IP address, the attack source domain name, and the attack program hash value, an access risk assessment is performed on the request source IP address, the request source domain name, and the request program hash value to obtain a first-level access risk coefficient;

[0098] When the first level access risk coefficient is greater than the first access risk coefficient threshold, adding the first level access risk coefficient to the initial access risk coefficient;

[0099] When the first level access risk coefficient is less than or equal to the first access risk coefficient threshold, performing access risk assessment on the access instruction sequence according to the attack instruction sequence and adding it to the initial access risk coefficient;

[0100] When all threat intelligence samples are traversed, a maximum value is extracted from the initial access risk coefficient and is set as the first access risk coefficient.

[0101] Furthermore, the threat intelligence assessment module 120 further includes the following execution steps:

[0102] When the attack program hash value is different from the request program hash value, setting the first-level access risk coefficient to be greater than the first access risk coefficient threshold;

[0103] When the attack program hash value is the same as the request program hash value, the first historical attack access frequency ratio since the request source IP address was recorded in the intranet is counted, and the second historical attack access frequency ratio since the request source domain name was recorded in the intranet is counted;

[0104] When at least one of the first historical attack access frequency ratio and the second historical attack access frequency ratio is greater than or equal to the historical attack access frequency ratio threshold, the first-level access risk coefficient is set to be greater than the first access risk coefficient threshold, where 0<the historical attack access frequency ratio threshold≤25%.

[0105] Furthermore, the threat intelligence assessment module 120 further includes the following execution steps:

[0106] Counting the number of access instructions at the intersection of the attack instruction sequence and the access instruction sequence;

[0107] Calculate the ratio of the number of intersection access instructions to the number of access instruction sequence instructions, and set it as the attack instruction occupancy rate;

[0108] When the attack instruction occupancy rate is greater than or equal to the attack instruction occupancy rate threshold:

[0109] Extracting the sorting information of the intersection access instruction in the attack instruction sequence, and obtaining the first sequence number attack instruction, the second sequence number attack instruction, and the Mth sequence number attack instruction;

[0110] Extracting the sorting information of the intersection access instruction in the access instruction sequence, obtaining the first sequence number access instruction, the second sequence number access instruction, and finally the Mth sequence number access instruction;

[0111] The first serial number attack instruction, the second serial number attack instruction up to the Mth serial number attack instruction, and the proportion of the same serial number instructions as the first serial number access instruction, the second serial number access instruction up to the Mth serial number access instruction are counted and added to the initial access risk coefficient.

[0112] Furthermore, the access log evaluation module 130 includes the following execution steps:

[0113] Step 1: According to the access log sample, perform k-item frequency analysis on the access instruction sequence to obtain the proportion of k-item infrequent access instructions, where the initial value of k is equal to 1, k is an integer, Q≥k≥1, and Q represents the number of instructions in the access instruction sequence;

[0114] Step 2: When the proportion of the number of k infrequent access instructions is greater than or equal to the threshold of the proportion of the number of infrequent access instructions, the proportion of the number of k infrequent access instructions is set as the second access risk coefficient;

[0115] Step 3: When the proportion of the k infrequently accessed instructions is less than the threshold of the proportion of the k infrequently accessed instructions, and k<Q, the k infrequently accessed instructions are deleted from the access instruction sequence to obtain a first updated access instruction sequence;

[0116] Step 4: Update the access instruction sequence according to the first update access instruction sequence, update the k value according to k+1, and return to step 1 to execute the loop;

[0117] Step 5: When the proportion of the k infrequently accessed instructions is less than the infrequently accessed instructions proportion threshold, and k=Q, the second access risk coefficient is set to be less than or equal to the second access risk coefficient threshold.

[0118] Furthermore, the access log evaluation module 130 further includes the following execution steps:

[0119] Performing k-item continuous instruction enumeration extraction on the access instruction sequence to obtain a plurality of k-item access instruction sequences;

[0120] Traversing the frequencies of triggering of the k access instruction sequences in the access log sample, respectively, to obtain the triggering frequencies of the k access instruction sequences;

[0121] Counting the k access instruction sequences whose trigger frequencies are less than the trigger frequency threshold among the k access instruction sequences, and adding them into the k infrequent access instruction sequences;

[0122] The proportion of the union access instructions of the k infrequently accessed instruction sequences in the number of the access instruction sequences is counted, and is set as the proportion of the number of the k infrequently accessed instructions.

[0123] Furthermore, the embodiment of the present application also includes a rejection response module, which includes the following execution steps:

[0124] When the first access risk coefficient is greater than the first access risk coefficient threshold, feeding back an access rejection signal to the external network;

[0125] Or when the second access risk coefficient is greater than the second access risk coefficient threshold, a denial of access signal is fed back to the external network, and at the same time, the threat intelligence sample is updated according to the request source IP address, the request source domain name, the request program hash value, and the access instruction sequence.

[0126] Embodiment three:

[0127] See also Figure 3 , Figure 3 Schematic diagram of an electronic device provided by an embodiment of the present invention. Figure 3 As shown, an electronic device 200 provided by an embodiment of the present invention includes a memory 210, a processor 220, and a first computer program 211 stored in the memory 210 and executable on the processor 220. When the processor 220 executes the first computer program 211, a security threat defense method for internal and external networks is implemented.

[0128] Embodiment 4:

[0129] See also Figure 4 , Figure 4 A schematic diagram of an embodiment of a computer-readable storage medium provided in an embodiment of the present invention. Figure 4As shown, this embodiment provides a computer-readable storage medium 300 on which a second computer program 311 is stored. When the second computer program 311 is executed by a processor, a method for defending against security threats against internal and external networks is implemented.

[0130] It should be noted that in the above embodiments, the description of each embodiment has its own emphasis, and for parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0131] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0132] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded computer, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A system that specifies the functions of a box or multiple boxes.

[0133] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction system, which is implemented in the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0134] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0135] Although preferred embodiments of the present invention have been described, additional changes and modifications may occur to these embodiments once those skilled in the art understand the basic inventive concepts.

[0136] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention belong to the scope of the present invention and its equivalent technologies, the present invention is also intended to include these changes and variations.

Claims

1. A method for defending against security threats to internal and external networks, characterized in that: include: In response to an intranet access request sent from an external network, obtain the request source IP address, request source domain name, request program hash value, and access instruction sequence; Through the threat intelligence sample, an access risk assessment is performed on the intranet access request based on the request source IP address, the request source domain name, the request program hash value and the access instruction sequence to obtain a first access risk coefficient; When the first access risk coefficient is less than or equal to a first access risk coefficient threshold, performing an access risk assessment on the intranet access request based on the access instruction sequence through an access log sample to obtain a second access risk coefficient; When the second access risk coefficient is less than or equal to a second access risk coefficient threshold, accessing the external network to execute the intranet access request; Among them, through the threat intelligence sample, the access risk assessment of the intranet access request is performed based on the request source IP address, the request source domain name, the request program hash value and the access instruction sequence to obtain a first access risk coefficient, including: Extracting first attack record parameters of a first attack sample according to the threat intelligence sample, wherein the first attack record parameters include an attack source IP address, an attack source domain name, an attack program hash value, and an attack instruction sequence; According to the attack source IP address, the attack source domain name, and the attack program hash value, an access risk assessment is performed on the request source IP address, the request source domain name, and the request program hash value to obtain a first-level access risk coefficient; When the first level access risk coefficient is greater than the first access risk coefficient threshold, adding the first level access risk coefficient to the initial access risk coefficient; When the first-level access risk coefficient is less than or equal to the first access risk coefficient threshold, performing access risk assessment on the access instruction sequence according to the attack instruction sequence and adding it to the initial access risk coefficient; When all threat intelligence samples are traversed, extract the maximum value from the initial access risk coefficient and set it as the first access risk coefficient; According to the attack source IP address, the attack source domain name, and the attack program hash value, an access risk assessment is performed on the request source IP address, the request source domain name, and the request program hash value to obtain a first-level access risk coefficient, including: When the attack program hash value is different from the request program hash value, setting the first-level access risk coefficient to be greater than the first access risk coefficient threshold; When the attack program hash value is the same as the request program hash value, the first historical attack access frequency ratio since the request source IP address was recorded in the intranet is counted, and the second historical attack access frequency ratio since the request source domain name was recorded in the intranet is counted; When at least one of the first historical attack access frequency ratio and the second historical attack access frequency ratio is greater than or equal to a historical attack access frequency ratio threshold, the first-level access risk coefficient is set to be greater than the first access risk coefficient threshold, wherein 0<the historical attack access frequency ratio threshold≤25%; Among them, performing access risk assessment on the access instruction sequence according to the attack instruction sequence and adding an initial access risk coefficient includes: Counting the number of access instructions at the intersection of the attack instruction sequence and the access instruction sequence; Calculate the ratio of the number of intersection access instructions to the number of access instruction sequence instructions, and set it as the attack instruction occupancy rate; When the attack instruction occupancy rate is greater than or equal to the attack instruction occupancy rate threshold: Extracting the sorting information of the intersection access instruction in the attack instruction sequence, and obtaining the first sequence number attack instruction, the second sequence number attack instruction, and the Mth sequence number attack instruction; Extracting the sorting information of the intersection access instruction in the access instruction sequence, obtaining the first sequence number access instruction, the second sequence number access instruction, and finally the Mth sequence number access instruction; The proportion of the first serial number attack instruction, the second serial number attack instruction up to the Mth serial number attack instruction and the same serial number instructions as the first serial number access instruction, the second serial number access instruction up to the Mth serial number access instruction is counted and added to the initial access risk coefficient.

2. The method according to claim 1, characterized in that When the first access risk coefficient is less than or equal to a first access risk coefficient threshold, performing an access risk assessment on the intranet access request based on the access instruction sequence through an access log sample to obtain a second access risk coefficient, including: Step 1: According to the access log sample, perform k-item frequency analysis on the access instruction sequence to obtain the proportion of k-item infrequent access instructions, where the initial value of k is equal to 1, k is an integer, Q≥k≥1, and Q represents the number of instructions in the access instruction sequence; Step 2: When the proportion of the number of k infrequent access instructions is greater than or equal to the threshold of the proportion of the number of infrequent access instructions, the proportion of the number of k infrequent access instructions is set as the second access risk coefficient; Step 3: When the proportion of the k infrequently accessed instructions is less than the threshold of the proportion of the k infrequently accessed instructions, and k<Q, the k infrequently accessed instructions are deleted from the access instruction sequence to obtain a first updated access instruction sequence; Step 4: Update the access instruction sequence according to the first update access instruction sequence, update the k value according to k+1, and return to step 1 to execute the loop; Step 5: When the proportion of the k infrequently accessed instructions is less than the infrequently accessed instructions proportion threshold, and k=Q, the second access risk coefficient is set to be less than or equal to the second access risk coefficient threshold.

3. The method according to claim 2, characterized in that According to the access log sample, a k-item frequency analysis is performed on the access instruction sequence to obtain a proportion of the number of k infrequent access instructions, including: Performing k-item continuous instruction enumeration extraction on the access instruction sequence to obtain a plurality of k-item access instruction sequences; Traversing the frequencies of triggering of the k access instruction sequences in the access log sample, respectively, to obtain the triggering frequencies of the k access instruction sequences; Counting the k access instruction sequences whose trigger frequencies are less than the trigger frequency threshold among the k access instruction sequences, and adding them into the k infrequent access instruction sequences; The proportion of the union access instructions of the k infrequently accessed instruction sequences in the number of the access instruction sequences is counted, and is set as the proportion of the number of the k infrequently accessed instructions.

4. The method according to claim 1, characterized in that Also includes: When the first access risk coefficient is greater than the first access risk coefficient threshold, feeding back an access rejection signal to the external network; Or when the second access risk coefficient is greater than the second access risk coefficient threshold, a denial of access signal is fed back to the external network, and at the same time, the threat intelligence sample is updated according to the request source IP address, the request source domain name, the request program hash value, and the access instruction sequence.

5. A security threat defense system for internal and external networks, characterized in that: A method for defending against security threats against internal and external networks according to any one of claims 1 to 4, comprising: An access request acquisition module, the access request acquisition module is used to respond to an intranet access request sent by an external network, obtain a request source IP address, a request source domain name, a request program hash value, and an access instruction sequence; A threat intelligence assessment module, wherein the threat intelligence assessment module is used to perform an access risk assessment on the intranet access request based on the request source IP address, the request source domain name, the request program hash value and the access instruction sequence through a threat intelligence sample to obtain a first access risk coefficient; An access log evaluation module, wherein when the first access risk coefficient is less than or equal to a first access risk coefficient threshold, the access log evaluation module is used to perform an access risk evaluation on the intranet access request based on the access instruction sequence through an access log sample to obtain a second access risk coefficient; A network access execution module, wherein the network access execution module is used to access the external network to execute the intranet access request when the second access risk coefficient is less than or equal to a second access risk coefficient threshold; Among them, through the threat intelligence sample, the access risk assessment of the intranet access request is performed based on the request source IP address, the request source domain name, the request program hash value and the access instruction sequence to obtain a first access risk coefficient, including: Extracting first attack record parameters of a first attack sample according to the threat intelligence sample, wherein the first attack record parameters include an attack source IP address, an attack source domain name, an attack program hash value, and an attack instruction sequence; According to the attack source IP address, the attack source domain name, and the attack program hash value, an access risk assessment is performed on the request source IP address, the request source domain name, and the request program hash value to obtain a first-level access risk coefficient; When the first level access risk coefficient is greater than the first access risk coefficient threshold, adding the first level access risk coefficient to the initial access risk coefficient; When the first-level access risk coefficient is less than or equal to the first access risk coefficient threshold, performing access risk assessment on the access instruction sequence according to the attack instruction sequence and adding it to the initial access risk coefficient; When all threat intelligence samples are traversed, extract the maximum value from the initial access risk coefficient and set it as the first access risk coefficient; According to the attack source IP address, the attack source domain name, and the attack program hash value, an access risk assessment is performed on the request source IP address, the request source domain name, and the request program hash value to obtain a first-level access risk coefficient, including: When the attack program hash value is different from the request program hash value, setting the first-level access risk coefficient to be greater than the first access risk coefficient threshold; When the attack program hash value is the same as the request program hash value, the first historical attack access frequency ratio since the request source IP address was recorded in the intranet is counted, and the second historical attack access frequency ratio since the request source domain name was recorded in the intranet is counted; When at least one of the first historical attack access frequency ratio and the second historical attack access frequency ratio is greater than or equal to a historical attack access frequency ratio threshold, the first-level access risk coefficient is set to be greater than the first access risk coefficient threshold, wherein 0<the historical attack access frequency ratio threshold≤25%; Among them, performing access risk assessment on the access instruction sequence according to the attack instruction sequence and adding an initial access risk coefficient includes: Counting the number of access instructions at the intersection of the attack instruction sequence and the access instruction sequence; Calculate the ratio of the number of intersection access instructions to the number of access instruction sequence instructions, and set it as the attack instruction occupancy rate; When the attack instruction occupancy rate is greater than or equal to the attack instruction occupancy rate threshold: Extracting the sorting information of the intersection access instruction in the attack instruction sequence, and obtaining the first sequence number attack instruction, the second sequence number attack instruction, and the Mth sequence number attack instruction; Extracting the sorting information of the intersection access instruction in the access instruction sequence, obtaining the first sequence number access instruction, the second sequence number access instruction, and finally the Mth sequence number access instruction; The proportion of the first serial number attack instruction, the second serial number attack instruction up to the Mth serial number attack instruction and the same serial number instructions as the first serial number access instruction, the second serial number access instruction up to the Mth serial number access instruction is counted and added to the initial access risk coefficient.

6. An electronic device, characterized in that: include: Memory for storing computer software programs; A processor is used to read and execute the computer software program, thereby implementing a security threat defense method for internal and external networks as described in any one of claims 1-4.

7. A non-transitory computer-readable storage medium, characterized in that: The storage medium stores a computer software program, which, when executed by a processor, implements a security threat defense method for internal and external networks as described in any one of claims 1 to 4.

Images