Network attacker analysis method and device
The method addresses the limitations of traditional attacker analysis by integrating data from multiple network security devices to generate comprehensive and accurate attacker profiles through enhanced data correlation and frequency-based filtering.
Patent Information
- Application Number
- CN202411215094.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-30
- Publication Date
- 2024-12-20
AI Technical Summary
Traditional attacker analysis methods are limited by relying on single network security devices, failing to provide a comprehensive and accurate portrayal of attacker information due to incomplete log data acquisition, leading to difficulties in attack tracing.
A network attacker analysis method that collects and correlates log data from multiple types of network security devices, generates original alarm events based on attack rules, enhances attacker information using network enhancement data, and filters based on occurrence frequency to achieve accurate characterization.
Enables comprehensive and accurate portrayal of attackers by integrating data from various devices, enhancing attacker information through multiple dimensions, and ensuring the reliability of attacker tracing.
Smart Images
Figure CN119172122A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security technology, and in particular to a network attacker analysis method and device. Background Art
[0002] With the development of the Internet, network attacks have emerged one after another, causing many adverse effects on users, such as malicious occupation of user terminal resources and leakage of user information. Therefore, network security is increasingly valued by users. In order to prevent and avoid network attacks, it is necessary to actively analyze the behavior of network attackers, analyze and characterize the attackers, that is, to automatically analyze the access traces (log information) left by attackers in the network and the association between the access traces and traces, extract some feature data, thereby obtaining feature data related to the attackers themselves, and then discover the attackers.
[0003] Traditional attacker analysis methods are based on a single network security device and cannot globally obtain the attacker's entire attack path or log information. The attacker information obtained through analysis is only local information, resulting in an incomplete and inaccurate portrayal of the attacker, which brings great difficulty to the subsequent attack tracing work. Summary of the invention
[0004] The present invention provides a network attacker analysis method and device, which are used to solve the problem that the attacker information is not fully and accurately described in the existing attack analysis method.
[0005] The invention provides a network attacker analysis method, comprising the following steps.
[0006] Get multiple targeted log data from different types of network security devices in real time.
[0007] Based on the target log data and attack rules corresponding to the preset attack scenarios, an original alarm event is generated.
[0008] Based on the source IP address of the attacker in the original alarm event, the network enhancement information of the attacker is obtained, and the initial information of the attacker is generated by using the source IP address and the network enhancement information.
[0009] When the attacker's initial information is obtained multiple times within a preset time, the attacker's initial information is determined to be attacker information.
[0010] According to a network attacker analysis method provided by the present invention, the real-time acquisition of multiple target log data of different types of network security devices includes the following steps.
[0011] Read multiple source log data collected by log collection plug-ins in different types of network security devices in real time.
[0012] The parsing plug-ins corresponding to different types of network security devices are called to parse the plurality of source log data to obtain source attribute fields in the source log data.
[0013] Based on a preset attribute field mapping relationship table, the source attribute field is converted into a target attribute field in the target log data to obtain the target log data.
[0014] According to a network attacker analysis method provided by the present invention, the original alarm event is generated based on the attack rules corresponding to the multiple target log data and the preset attack scenarios, including the following steps.
[0015] Using the attack rules corresponding to the preset attack scenarios, correlation analysis is performed on the plurality of target log data.
[0016] When the correlation analysis result shows that the plurality of target log data matches the attack rule, at least the source IP addresses in the plurality of target log data are obtained.
[0017] The original alarm event is generated based on the source IP address.
[0018] According to a network attacker analysis method provided by the present invention, based on the source IP address of the attacker in the original alarm event, the network enhancement information of the attacker is obtained, and the initial information of the attacker is generated by the source IP address and the network enhancement information, including the following steps.
[0019] Obtain network traffic data from a full traffic analysis device in the network, and filter out target traffic data with the same IP address as the source IP address from the network traffic data.
[0020] A first attack event of an attacker corresponding to the source IP address is analyzed based on the target traffic data, a second attack event in the target log data is obtained, and the attacked target IP address is obtained based on the first attack event and the second attack event.
[0021] Fingerprint information, social information, and geographic location information of a host corresponding to a source IP address are obtained from the target traffic data and the target log data.
[0022] The intelligence information corresponding to the source IP address is obtained through a preset intelligence library.
[0023] The first attack event, the second attack event, fingerprint information, social information, geographic location information, intelligence information and target IP address are used as the network enhancement information and combined with the source IP address to generate the attacker initial information.
[0024] According to a network attacker analysis method provided by the present invention, in the case where the attacker initial information is obtained multiple times within a preset time, determining the attacker initial information as attacker information includes the following steps.
[0025] The currently obtained attacker initial information is matched with the previous attacker initial information stored in the attacker initial information table.
[0026] In the case of a successful match, the previous attacker's initial information is updated with the currently obtained attacker's initial information, and the number of updates of the currently obtained attacker's initial information is accumulated.
[0027] In the case of unsuccessful matching, the currently obtained initial information of the attacker is inserted into the initial information table of the attacker, and the number of updates of the currently obtained initial information of the attacker is set to 1.
[0028] Within the preset time, the attacker's initial information whose update times exceed a threshold is determined as the attacker information.
[0029] According to a network attacker analysis method provided by the present invention, after the preset time is reached, the attacker initial information in the attacker initial information table whose update times do not reach the times threshold is deleted.
[0030] According to a network attacker analysis method provided by the present invention, after acquiring the target log data and before generating the original alarm event, it also includes: writing the target log data to a disk and storing it in a first message queue.
[0031] After the original alarm event is generated and before the network enhancement information of the attacker is obtained, the method further includes: storing the original alarm event in a second message queue.
[0032] The present invention also provides a network attacker analysis device, comprising the following modules.
[0033] The target log data acquisition module is used to acquire multiple target log data of different types of network security devices in real time.
[0034] The original alarm event generation module is used to generate an original alarm event based on the target log data and the attack rules corresponding to the preset attack scenarios.
[0035] The initial information generation module is used to obtain the attacker's network enhancement information based on the attacker's source IP address in the original alarm event, and generate the attacker's initial information with the source IP address and the network enhancement information.
[0036] The attacker information generating module is used to determine the attacker initial information as attacker information when the attacker initial information is obtained multiple times within a preset time.
[0037] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the network attacker analysis method described in any one of the above methods is implemented.
[0038] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the network attacker analysis method described in any one of the above is implemented.
[0039] The network attacker analysis method and device provided by the present invention obtain multiple target log data of different types of network security devices in real time; generate original alarm events based on multiple target log data and attack rules corresponding to preset attack scenarios; obtain the attacker's network enhancement information based on the attacker's source IP address in the original alarm event, and generate the attacker's initial information with the source IP address and network enhancement information; determine the attacker's initial information as the attacker's information when the attacker's initial information is obtained multiple times within a preset time. That is, the original alarm event analysis is performed by obtaining multiple target log data from different types of network security devices, and the attacker's network information is enhanced based on the source IP address in the original alarm event to obtain network enhancement information, thereby obtaining more comprehensive attacker initial information based on multiple network security devices and multiple dimensions, and then screening based on the number of occurrences of the attacker's initial information within the preset time to obtain more accurate attacker information, so that the attacker is finally portrayed more comprehensively and accurately, and more accurate attacker tracing can be achieved later. BRIEF DESCRIPTION OF THE DRAWINGS
[0040] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0041] Figure 1 This is one of the flow charts of the network attacker analysis method provided by the present invention.
[0042] Figure 2 This is the second flow chart of the network attacker analysis method provided by the present invention.
[0043] Figure 3This is the third flow chart of the network attacker analysis method provided by the present invention.
[0044] Figure 4 This is the fourth flow chart of the network attacker analysis method provided by the present invention.
[0045] Figure 5 This is the fifth flow chart of the network attacker analysis method provided by the present invention.
[0046] Figure 6 It is a schematic diagram of an application scenario of the network attacker analysis method provided by the present invention.
[0047] Figure 7 It is a structural schematic diagram of the network attacker analysis device provided by the present invention.
[0048] Figure 8 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION
[0049] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0050] The network attacker analysis method of the embodiment of the present invention can be performed by a server for attacker analysis. By continuously performing the following steps according to a preset period, the attacker information in the network is analyzed to obtain the attacker information. The specific process of the method is as follows: Figure 1 As shown, the following steps are included.
[0051] Step S110: Acquire multiple target log data of different types of network security devices in real time. Specifically, different types of network security devices include: Intrusion Prevention System (IPS), Intrusion Detection System (IDS), Web Application Firewall (WAF), honeypots, firewalls and other network security devices. These network security devices record the original traffic data related to security in the network in the form of logs, that is, source log data. Since different types of network security devices have different log types, that is, the description format of the attribute field in the source log data is different, for example: the description field of the source IP address in the intrusion detection system is: sIP, and the description field of the source IP address in the intrusion detection system is: srcIP. In order to facilitate subsequent processing, the attribute description fields in the log data of different types of network security devices are formatted in a unified manner to obtain multiple target log data. In this step, by obtaining multiple target log data of different types of network security devices, more comprehensive attack information of the attacker can be obtained. Among them, the target log data includes: source IP address, source port number, destination IP address, destination port number, access time and security device ID for obtaining the log data. If the network security device detects an attack, the target log data also includes information about the attack event such as attack characteristics and attack methods.
[0052] Step S120: Generate an original alarm event based on the multiple target log data and the attack rules corresponding to the preset attack scenarios. Specifically, common attack scenarios include: brute force password guessing, XSS (Cross-site scripting) cross-site scripting attack, SQL injection, etc. These attack scenarios have their own attack rules and corresponding algorithms to detect whether the multiple target log data match the corresponding rules. If they match, the original alarm event is generated according to the multiple target log data. The original alarm event includes at least: source IP address information, and may also include: target IP address of the attack, number of attacks, attack start time and duration, etc.
[0053] Step S130: Based on the source IP address of the attacker in the original alarm event, the network enhancement information of the attacker is obtained, and the initial information of the attacker is generated by the source IP address and the network enhancement information. The network enhancement information is the relevant network information about the attacker corresponding to the source IP address, such as: attack events, geographic location information, social information and fingerprint information of the host corresponding to the source IP address, etc. Through the network enhancement information, the initial information of the attacker is more comprehensive, so that the attacker can be more comprehensively characterized.
[0054] Step S140: If the attacker's initial information is obtained multiple times within a preset time (e.g., within 0.5 hours to 6 hours), the attacker's initial information is determined to be attacker information. Specifically, since step S110 is to obtain multiple target log data in different types of network security devices in real time at a certain acquisition frequency, that is, multiple target log data will be obtained each time the acquisition is performed, and the multiple target log data obtained each time are analyzed according to the above steps S120-S140, if within the preset time, the attacker's initial information currently obtained has also appeared in the previous analysis cycle, then the attacker's initial information is determined to be attacker information. This avoids the information generated by the network user's misoperation or multiple routine operations (for example, if the user forgets the password and enters the wrong password multiple times in a short period of time, even if it is regarded as an attacker to generate the attacker's initial information, but a normal user will not tentatively enter the password for a long time, and the same or similar attacker's initial information will not appear later, then the attacker's initial information will not be determined as the final attacker information) being mistaken for the attacker's information, so that the attacker information finally obtained is more accurate, and the attacker can be more accurately portrayed.
[0055] In the network attacker analysis method of the present embodiment, the original alarm event analysis is performed by acquiring multiple target log data from different types of network security devices, and based on the source IP address in the original alarm event obtained as the starting point, the network information of the attacker is enhanced to obtain network enhanced information, thereby obtaining more comprehensive initial attacker information based on multiple network security devices and multiple dimensions, and then filtering based on the number of occurrences of the initial attacker information within a preset time to obtain more accurate attacker information, so that the final characterization of the attacker is more comprehensive and accurate, and more accurate attacker tracing can be achieved subsequently.
[0056] In some embodiments, the specific process of step S110 is as follows: Figure 2 As shown, the process includes the following steps S210 to S230.
[0057] Step S210: Read multiple source log data collected by log collection plug-ins in different types of network security devices in real time. Specifically, log collection plug-ins corresponding to the devices are deployed in different types of network security devices. The log collection plug-ins can be provided by the corresponding manufacturers of the network security devices. The log collection plug-ins continuously collect source log data in the corresponding network security devices according to a preset collection cycle. In this embodiment, the corresponding multiple source log data are obtained by accessing the log collection plug-in.
[0058] Step S220: Call the parsing plug-ins corresponding to different types of network security devices to parse the multiple source log data to obtain the source attribute field in the source log data. The parsing plug-in is a parsing plug-in provided by the network security device manufacturer. If the parsing plug-in cannot be found, the reason for the failure to parse can be directly given.
[0059] Step S230: Based on the preset attribute field mapping relationship table, the source attribute field is converted into the target attribute field in the target log data to obtain the target log data. Since different types of network security devices have different log types, the description format of the attribute field in the source log data is different for different types of network security devices. In order to facilitate subsequent processing, the attribute fields representing the same attributes in different types of network security devices must be formatted in a unified manner. Specifically, the attribute field mapping relationship table records the correspondence between the source attribute field and the target attribute field of each network security device, and the conversion is achieved by querying the attribute field mapping relationship table. For example: the source log data of a firewall of a certain manufacturer has source attribute fields such as fwID, sIP, dIP, sPort and dPort. After the unified format, the corresponding target attribute fields are: fw_id, src_ip, dst_ip, s_port and d_port.
[0060] In this embodiment, the source log data of different types of network security devices are processed in a unified format through the above steps S210 to S230, which is more conducive to the subsequent analysis of attacker information.
[0061] In some embodiments, the specific process of step S120 is as follows: Figure 3 As shown, the process includes the following steps S310 to S330.
[0062] Step S310: Use the attack rules corresponding to the preset attack scenarios to perform correlation analysis on the multiple target log data. Specifically, there are different attack rules for different attack scenarios, and different algorithms are used to analyze whether the multiple target log data match the corresponding attack rules. For example, for brute force cracking scenarios, brute force cracking detection and correlation analysis can be performed based on decision trees. Of course, users can also set attack rules according to actual business scenarios to improve the scalability of attack scenarios. For example, for brute force cracking, the attack rules can be set as: 3-5 minute intervals, the same user name, different passwords, and logging into the same server.
[0063] Step S320: When the result of the correlation analysis is that the multiple target log data matches the attack rule, at least the source IP addresses in the multiple target log data are obtained, and it is indicated that the multiple target log data are associated. For example: in the multiple target log data, the source IP address, the target IP address and the user name are the same, but the passwords are different, and the interval time of the multiple target log data is within 3-5 minutes, then it is considered that the multiple target log data matches the brute force attack rule, and the source IP addresses of the multiple target log data are obtained.
[0064] Step S330: Generate the original alarm event based on the source IP address, that is, generate an original alarm event, which includes the source IP address, and of course can also include: target IP address, number of attacks, attack start time, duration and other information, which can be used as part of the subsequent attacker's network enhancement information.
[0065] In this embodiment, by performing correlation analysis on multiple target log data according to attack rules corresponding to preset attack scenarios, it is possible to accurately identify whether the multiple target log data have attack behaviors and generate relevant original alarm events.
[0066] In some embodiments, the specific process of step S130 is as follows: Figure 4 As shown, the process includes the following steps S410 to S450.
[0067] Step S410: Obtain network traffic data from a full traffic analysis device in the network, and filter out target traffic data with the same IP address as the source IP address from the network traffic data. The full traffic analysis device is a device in the network dedicated to monitoring network traffic and helping users understand traffic composition, protocol distribution, and user activities. By obtaining network traffic data corresponding to the source IP address in the full traffic analysis device, the attacker's relevant information can be further expanded and enhanced.
[0068] Step S420: Analyze the first attack event of the attacker corresponding to the source IP address based on the target traffic data, obtain the second attack event in the target log data, and obtain the attacked target IP address based on the first attack event and the second attack event. Specifically, the first attack event can be obtained by analyzing the target traffic data through the ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) model. The second attack event is the attack event in the target log data in step S110. These attack events are recorded in the form of logs by different types of network security devices after detecting the attack behavior. Of course, the original alarm event is generated based on the target log data. If the original alarm event contains relevant information about the attack event, then the attack event contained in the original alarm event can also be used as the second attack event. Among them, the first attack event and the second attack event both include: at least one of the attack chain stage, attack method, attack feature and attack tool.
[0069] Step S430: Obtain fingerprint information, social information and geographic location information of the host corresponding to the source IP address from the target traffic data and target log data. The fingerprint information includes: the host's operating system, browser type, cookie information, User-Agent, screen resolution, MAC address and host type; the social information includes: the attacker's social software and account information; the geographic location information includes: the latitude and longitude of the source IP address and the province, city and country geographic location information.
[0070] Step S440: Obtain intelligence information corresponding to the source IP address through a preset intelligence database, wherein the intelligence information includes: the organization to which the source IP address belongs, the confidence level, the attack method, the country and industry targeted by the attack, and other information.
[0071] Step S450: The first attack event, the second attack event, fingerprint information, social information, geographic location information, intelligence information and target IP address are combined with the source IP address as the network enhancement information to generate the attacker initial information.
[0072] In this embodiment, the initial attacker information corresponding to the source IP address is expanded and enhanced with the source IP address in the original alarm event as the starting point, so as to characterize the attacker in more dimensions, thereby making the attacker information finally obtained more comprehensive.
[0073] In some embodiments, the specific process of step S140 is as follows: Figure 5 As shown, the process includes the following steps S510 to S550.
[0074] Step S510: Match the attacker's initial information currently obtained with the attacker's initial information previously stored in the attacker's initial information table. Specifically, each information item of the attacker's initial information currently obtained and the attacker's initial information previously stored can be encoded by hashing or other encoding methods to form a feature vector, and then the similarity of the two feature vectors is calculated, and whether they match is determined based on the similarity. For example, if the similarity is greater than 80%, it can be considered that the two are similar, indicating that they are the same attacker.
[0075] Furthermore, when calculating the similarity, the first attack event, the second attack event, the fingerprint information, the social information and the geographic location information are selected as the information items for calculating the similarity to calculate the similarity between the attacker's initial information currently obtained and the attacker's initial information previously obtained. Since the attacker's source IP address and the target of his attack will constantly change in order to hide himself, but his attack behavior (attack event), location (geolocation information) and some user behavior habits (fingerprint information and social information) will basically not change, therefore, by performing similarity calculations through such information items in the target traffic data and target log data collected in real time, the similarity accuracy obtained is higher, and it is possible to more accurately determine whether the attacker's initial information currently obtained is similar to the attacker's initial information previously obtained.
[0076] The attacker initial information table is dynamically generated and updated by executing the above steps S110 to S140.
[0077] Step S520: Determine whether the match is successful, if so, execute step S530, otherwise, execute step S540.
[0078] Step S530: If the match is successful, the attacker's initial information currently obtained is used to update the previous attacker's initial information, and the number of updates of the attacker's initial information currently obtained is accumulated. Specifically, since the attacker's initial information currently obtained can better reflect the attacker's attack behavior or other user behavior (address location information and fingerprint information) in the recent or future period, the information item of the attacker's initial information currently obtained is used for the inconsistent information item between the two, thereby updating the attacker's attacker information.
[0079] Step S540: When the matching is unsuccessful, the currently obtained initial information of the attacker is inserted into the initial information table of the attacker, and the number of updates of the currently obtained initial information of the attacker is set to 1.
[0080] Step S550: within the preset time, the attacker's initial information whose update times exceed a threshold (eg, 3-5 times) is determined as the attacker information.
[0081] In this embodiment, the attacker's initial information table is dynamically updated and the similarity comparison method can accurately determine whether the attacker's initial information is real attacker information, thereby more accurately characterizing the attacker.
[0082] In some embodiments, after the preset time is reached, the attacker's initial information in the attacker's initial information table whose update times do not reach the threshold number is deleted, that is, it is determined that it is not the real attacker information. The information is deleted to save storage space of the attacker's initial information table, reduce the calculation amount of similarity comparison, and improve the efficiency of attacker analysis.
[0083] In some embodiments, Figure 6 As shown, after obtaining the target log data and before generating the original alarm event, it also includes: writing the target log data to a disk and storing it in a first message queue (such as a Kafka message queue); after generating the original alarm event and before obtaining the attacker's network enhancement information, it also includes: storing the original alarm event in a second message queue (such as a Kafka message queue). The message queue ensures the orderly processing of the target log data and the original alarm event, and both the first message queue and the second message queue can be multiple to improve the processing capability.
[0084] The target log data is written to the disk to facilitate subsequent query of the target log data. The target log data can be stored in the ES (Elasticsearch) database. The attacker's initial information and attacker information obtained in step S130 and step S140 can be written to the disk for storage. The attacker's initial information and attacker information can be stored in the PG (PostgreSQL) database for subsequent query.
[0085] The network attacker analysis device provided by the present invention is described below. The network attacker analysis device described below and the network attacker analysis method described above can be referenced to each other.
[0086] The network attacker analysis device of the embodiment of the present invention is as follows: Figure 7 As shown, it includes the following modules.
[0087] The target log data acquisition module 710 is used to acquire multiple target log data of different types of network security devices in real time.
[0088] The original alarm event generation module 720 is used to generate an original alarm event based on the target log data and the attack rules corresponding to the preset attack scenarios.
[0089] The initial information generation module 730 is used to obtain the attacker's network enhancement information based on the attacker's source IP address in the original alarm event, and generate the attacker's initial information using the source IP address and the network enhancement information.
[0090] The attacker information generating module 740 is used to determine the attacker initial information as attacker information when the attacker initial information is obtained multiple times within a preset time.
[0091] The network attacker analysis device of the embodiment of the present invention obtains multiple target log data from different types of network security devices to perform original alarm event analysis, and enhances the attacker's network information based on the source IP address in the original alarm event to obtain network enhanced information, thereby obtaining more comprehensive attacker initial information based on multiple network security devices and multiple dimensions, and then filtering based on the number of occurrences of the attacker initial information within a preset time to obtain more accurate attacker information, so that the final characterization of the attacker is more comprehensive and accurate, and more accurate attacker tracing can be achieved later.
[0092] In some embodiments, the target log data acquisition module 710 specifically includes the following steps.
[0093] The source log data reading module is used to read multiple source log data collected by log collection plug-ins in different types of network security devices in real time.
[0094] The source log data parsing module is used to call parsing plug-ins corresponding to different types of network security devices to parse the plurality of source log data to obtain source attribute fields in the source log data.
[0095] The attribute field conversion module is used to convert the source attribute field into the target attribute field in the target log data based on a preset attribute field mapping relationship table to obtain the target log data.
[0096] In some embodiments, the original alarm event generation module 720 is specifically used to perform correlation analysis on multiple target log data using attack rules corresponding to preset attack scenarios; when the correlation analysis result is that multiple target log data match the attack rules, at least obtain the source IP addresses in the multiple target log data; and generate the original alarm event based on the source IP address.
[0097] In some embodiments, the initial information generation module 730 specifically includes the following modules.
[0098] The target traffic data acquisition module is used to acquire the network traffic data of the full traffic analysis device in the network, and filter out the target traffic data with the same IP address as the source IP address from the network traffic data.
[0099] The attack event acquisition module is used to analyze the first attack event of the attacker corresponding to the source IP address based on the target traffic data, obtain the second attack event in the target log data, and obtain the attacked target IP address based on the first attack event and the second attack event.
[0100] The user information acquisition module is used to obtain fingerprint information, social information and geographic location information of the host corresponding to the source IP address from the target traffic data and target log data.
[0101] The intelligence information acquisition module is used to obtain the intelligence information corresponding to the source IP address through a preset intelligence library.
[0102] An information merging module is used to merge the first attack event, the second attack event, fingerprint information, social information, geographic location information, intelligence information and target IP address as the network enhancement information with the source IP address to generate the attacker's initial information.
[0103] In some embodiments, the attacker information generating module 740 specifically includes the following modules.
[0104] The information matching module is used to match the attacker's initial information currently obtained with the attacker's initial information previously stored in the attacker's initial information table.
[0105] The information updating module is used to update the previous attacker's initial information with the currently obtained attacker's initial information when the match is successful, and accumulate the number of updates of the currently obtained attacker's initial information.
[0106] The information insertion module is used to insert the currently obtained attacker initial information into the attacker initial information table when the matching fails, and set the update times of the currently obtained attacker initial information to 1.
[0107] The information determination module is used to determine the attacker's initial information whose update times exceed a threshold value within the preset time as the attacker information.
[0108] In some embodiments, the network attacker analysis device further includes: an information deletion module, configured to delete the attacker initial information in the attacker initial information table whose update times do not reach the times threshold after the preset time is reached.
[0109] In some embodiments, the target log data acquisition module 710 is further configured to write the target log data to a disk and store it in a first message queue after acquiring the target log data and before generating an original alarm event.
[0110] The original alarm event generating module 720 is further configured to store the original alarm event into a second message queue after generating the original alarm event and before acquiring the attacker's network enhancement information.
[0111] Figure 8 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 8 As shown, the electronic device may include: a processor 810, a communication interface 820, a memory 830 and a communication bus 840, wherein the processor 810, the communication interface 820 and the memory 830 communicate with each other through the communication bus 840. The processor 810 may call the logic instructions in the memory 830 to execute the network attacker analysis method, which includes the following steps.
[0112] Get multiple targeted log data from different types of network security devices in real time.
[0113] Based on the target log data and attack rules corresponding to the preset attack scenarios, an original alarm event is generated.
[0114] Based on the source IP address of the attacker in the original alarm event, the network enhancement information of the attacker is obtained, and the initial information of the attacker is generated by using the source IP address and the network enhancement information.
[0115] When the attacker's initial information is obtained multiple times within a preset time, the attacker's initial information is determined to be attacker information.
[0116] In addition, the logic instructions in the above-mentioned memory 830 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.
[0117] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the network attacker analysis method provided by the above methods, which includes the following steps.
[0118] Get multiple targeted log data from different types of network security devices in real time.
[0119] Based on the target log data and attack rules corresponding to the preset attack scenarios, an original alarm event is generated.
[0120] Based on the source IP address of the attacker in the original alarm event, the network enhancement information of the attacker is obtained, and the initial information of the attacker is generated by using the source IP address and the network enhancement information.
[0121] When the attacker's initial information is obtained multiple times within a preset time, the attacker's initial information is determined to be attacker information.
[0122] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the network attacker analysis method provided by the above methods is implemented, and the method includes the following steps.
[0123] Get multiple targeted log data from different types of network security devices in real time.
[0124] Based on the target log data and attack rules corresponding to the preset attack scenarios, an original alarm event is generated.
[0125] Based on the source IP address of the attacker in the original alarm event, the network enhancement information of the attacker is obtained, and the initial information of the attacker is generated by using the source IP address and the network enhancement information.
[0126] When the attacker's initial information is obtained multiple times within a preset time, the attacker's initial information is determined to be attacker information.
[0127] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.
[0128] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.
[0129] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A network attacker analysis method, characterized in that: include: Obtain multiple target log data of different types of network security devices in real time; Generate an original alarm event based on the target log data and the attack rules corresponding to the preset attack scenario; Based on the source IP address of the attacker in the original alarm event, obtaining the network enhancement information of the attacker, and generating the initial information of the attacker with the source IP address and the network enhancement information; When the attacker's initial information is obtained multiple times within a preset time, the attacker's initial information is determined to be attacker information.
2. The network attacker analysis method according to claim 1, characterized in that: The real-time acquisition of multiple target log data of different types of network security devices includes: Read multiple source log data collected by log collection plug-ins in different types of network security devices in real time; Invoke parsing plug-ins corresponding to different types of network security devices to parse the plurality of source log data to obtain source attribute fields in the source log data; Based on a preset attribute field mapping relationship table, the source attribute field is converted into a target attribute field in the target log data to obtain the target log data.
3. The network attacker analysis method according to claim 1, characterized in that: The generating of the original alarm event based on the plurality of target log data and the attack rules corresponding to the preset attack scenarios includes: Using the attack rules corresponding to the preset attack scenarios, a correlation analysis is performed on the plurality of target log data; When the correlation analysis result shows that the plurality of target log data matches the attack rule, at least the source IP addresses in the plurality of target log data are obtained; The original alarm event is generated based on the source IP address.
4. The network attacker analysis method according to claim 1, characterized in that: The acquiring, based on the source IP address of the attacker in the original alarm event, network enhancement information of the attacker, and generating initial information of the attacker using the source IP address and the network enhancement information, comprises: Obtain network traffic data from a full traffic analysis device in the network, and filter out target traffic data with the same IP address as the source IP address from the network traffic data; Analyze the first attack event of the attacker corresponding to the source IP address based on the target traffic data, obtain the second attack event in the target log data, and obtain the attacked target IP address based on the first attack event and the second attack event; Obtaining fingerprint information, social information, and geographic location information of a host corresponding to a source IP address from the target traffic data and the target log data; Obtain intelligence information corresponding to the source IP address through a preset intelligence database; The first attack event, the second attack event, fingerprint information, social information, geographic location information, intelligence information and target IP address are used as the network enhancement information and combined with the source IP address to generate the attacker initial information.
5. The network attacker analysis method according to claim 1, characterized in that: In the case where the attacker's initial information is obtained multiple times within the preset time, determining the attacker's initial information as attacker information includes: Matching the attacker's initial information currently obtained with the attacker's initial information previously stored in the attacker's initial information table; In the case of a successful match, the previous attacker initial information is updated with the currently obtained attacker initial information, and the number of updates of the currently obtained attacker initial information is accumulated; In the case of unsuccessful matching, the currently obtained initial information of the attacker is inserted into the initial information table of the attacker, and the number of updates of the currently obtained initial information of the attacker is set to 1; Within the preset time, the attacker's initial information whose update times exceed a threshold is determined as the attacker information.
6. The network attacker analysis method according to claim 5, characterized in that: After the preset time is reached, the attacker's initial information in the attacker's initial information table whose update times do not reach the times threshold is deleted.
7. The network attacker analysis method according to any one of claims 1 to 6, characterized in that: After acquiring the target log data and before generating the original alarm event, the method further includes: writing the target log data to a disk and storing it in a first message queue; After the original alarm event is generated and before the network enhancement information of the attacker is obtained, the method further includes: storing the original alarm event in a second message queue.
8. A network attacker analysis device, characterized in that: include: A target log data acquisition module is used to acquire multiple target log data of different types of network security devices in real time; An original alarm event generation module, used to generate an original alarm event based on a plurality of target log data and attack rules corresponding to a preset attack scenario; An initial information generating module, configured to obtain network enhancement information of the attacker based on the source IP address of the attacker in the original alarm event, and generate initial information of the attacker using the source IP address and the network enhancement information; The attacker information generating module is used to determine the attacker initial information as attacker information when the attacker initial information is obtained multiple times within a preset time.
9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the network attacker analysis method according to any one of claims 1 to 7 is implemented.
10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the network attacker analysis method according to any one of claims 1 to 7 is implemented.