Method, device and equipment for monitoring and identifying network attack and medium

Abstract

The invention discloses a network attack monitoring identification method and device, equipment and a medium, and the method comprises the steps: extracting corresponding access feature information from an access request if the access request is received; identifying the access feature information according to a preset abnormal access identification model to obtain an identification result about whether the access feature information is abnormal or not; if the identification result is abnormal, performing flow control on the access request through a preset DNS routing strategy; according to a preset cloud service address, sequentially sending access feature information of the access request and the identification result to a cloud server according to flow control, so as to obtain a feedback result which is fed back by the cloud server and is about whether to intercept or not; and if the feedback result is not intercepted or the identification result is non-abnormal, accessing the access request to the source station service. According to the monitoring and identifying method, the network access requests can be quickly classified and accurately identified, so that the network attacks in the network access requests are determined and intercepted, and the efficiency of monitoring and identifying the network attacks is greatly improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, device, equipment and medium for monitoring and identifying network attacks. Background Art

[0002] In the current network environment, malicious network attacks have become an important factor that seriously threatens network security, including various attack methods such as DDoS attacks, CC attacks, phishing, etc. These attack methods have disrupted the smooth operation of the network and even caused serious economic losses. At present, the monitoring and identification of these malicious attacks often requires a lot of manpower and material resources, and requires technical support from specialized technicians, and it is difficult to quickly classify and accurately identify network attacks during the application process. Therefore, the technical methods used for network attack monitoring and identification in the existing technical methods have the problem of low recognition efficiency. Summary of the invention

[0003] The embodiments of the present invention provide a method, device, equipment and medium for monitoring and identifying network attacks, aiming to solve the problem of low identification efficiency in the technical methods for monitoring and identifying network attacks in the prior art.

[0004] In a first aspect, an embodiment of the present invention provides a method for monitoring and identifying network attacks, wherein the method is applied to a management server, the management server establishes a network connection with an access terminal and a cloud server to realize the transmission of data information, and the method includes:

[0005] If an access request is received, extracting corresponding access feature information from the access request;

[0006] Identify the access feature information according to a preset abnormal access identification model to obtain an identification result of whether it is abnormal;

[0007] If the identification result is abnormal, flow control is performed on the access request through a preset DNS routing strategy;

[0008] According to the preset cloud service address, the access feature information and identification result of the access request are sent to the cloud server in sequence according to the flow control, so as to obtain the feedback result of whether to intercept from the cloud server;

[0009] If the feedback result is not to be intercepted or the identification result is not abnormal, the access request is connected to the source station service.

[0010] In a second aspect, an embodiment of the present invention further provides a network attack monitoring and identification device, wherein the device is configured in a management server, the management server establishes a network connection with an access terminal and a cloud server to realize the transmission of data information, and the device is used to execute the network attack monitoring and identification method as described in the first aspect above, and the device includes:

[0011] An access characteristic information acquisition unit, configured to extract corresponding access characteristic information from an access request upon receiving the access request;

[0012] An identification result acquisition unit, used to identify the access feature information according to a preset abnormal access identification model to obtain an identification result of whether it is abnormal;

[0013] A flow control unit, configured to perform flow control on the access request through a preset DNS routing policy if the identification result is abnormal;

[0014] A feedback result acquisition unit, used to send the access feature information and the identification result of the access request to the cloud server in sequence according to the preset cloud service address according to the flow control, so as to obtain the feedback result of whether to intercept from the cloud server;

[0015] The access request access unit is used to connect the access request to the source station service if the feedback result is not intercepted or the identification result is not abnormal.

[0016] In a third aspect, an embodiment of the present invention further provides a computer device, wherein the device includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus;

[0017] Memory, used to store computer programs;

[0018] The processor is used to implement the steps of the network attack monitoring and identification method described in the first aspect when executing the program stored in the memory.

[0019] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the steps of the method for monitoring and identifying network attacks as described in the first aspect above are implemented.

[0020] The embodiment of the present invention provides a method, device, equipment and medium for monitoring and identifying network attacks, the method comprising: if an access request is received, extracting corresponding access feature information from the access request; identifying the access feature information according to a preset abnormal access identification model to obtain an identification result of whether it is abnormal; if the identification result is abnormal, performing flow control on the access request through a preset DNS routing policy; sending the access feature information and the identification result of the access request to the cloud server in sequence according to the flow control according to the preset cloud service address, so as to obtain the feedback result of whether to intercept from the cloud server; if the feedback result is not to intercept or the identification result is not abnormal, connecting the access request to the source station service. The above-mentioned monitoring and identification method can quickly classify and accurately identify network access requests, thereby determining the network attacks therein and intercepting them, greatly improving the efficiency of monitoring and identifying network attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying any creative work.

[0022] Figure 1 A method flow chart of a method for monitoring and identifying network attacks provided by an embodiment of the present invention;

[0023] Figure 2 A schematic diagram of an application scenario of a method for monitoring and identifying network attacks provided by an embodiment of the present invention;

[0024] Figure 3 A schematic block diagram of a network attack monitoring and identification device provided by an embodiment of the present invention;

[0025] Figure 4 It is a schematic block diagram of a computer device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0026] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0027] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0028] It should also be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, the singular forms "a", "an" and "the" are intended to include plural forms unless the context clearly indicates otherwise.

[0029] It should be further understood that the term "and / or" used in the present description and the appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0030] See also Figure 1 As shown in the figure, the embodiment of the present invention provides a method for monitoring and identifying network attacks, which is applied in a management server. Figure 2 As shown, the method is applied to the management server 10, and the management server 10 establishes a network connection with the access terminal 20 and the cloud server 30 to realize the transmission of data information, wherein the management server 10 is also a server end configured within an enterprise or organization for providing access services, and the access terminal 20 is an external terminal device that sends access requests and accesses the management server 10, such as a laptop, desktop computer, tablet computer or mobile phone; the cloud server 30 is also a server end configured in the cloud, and the cloud server 30 can communicate with the management server 10, thereby providing cloud services for the management server 10. Figure 1 As shown, the method includes steps S110 to S150.

[0031] S110: If an access request is received, extract corresponding access feature information from the access request.

[0032] If an access request is received, the corresponding access feature information is extracted from the access request. The access terminal can send an access request to the management server, and after receiving the access request, the management server can extract the access feature information from the access request, and the access feature information can be used to characterize the features of the access request.

[0033] In a specific embodiment, step S110 includes sub-steps: obtaining historical access data corresponding to the access request; extracting corresponding basic characteristic parameters from the access request; extracting corresponding traffic characteristic parameters from the historical access data; and combining the basic characteristic parameters with the traffic characteristic parameters into the access characteristic information.

[0034] Specifically, historical access data corresponding to an access request may be obtained. The access request includes a terminal address of an access terminal, and historical access data corresponding to the terminal address of the access request may be obtained. The historical access data is data information corresponding to the terminal address and including historical access requests.

[0035] Furthermore, basic characteristic parameters contained in the access request can be extracted from the access request, and the basic characteristic parameters include access type, request length, protocol type, etc.; wherein the access type is the specific type of network access performed by the access request, such as the access type can be a data read type, a data write type, etc., and the request length is the number of data packets contained in the access request, and the more data packets, the longer the request length of the access request; the protocol type is the specific protocol used for network transmission of the access request, such as HTTP1.0, HTTP2.0, etc.

[0036] Corresponding traffic characteristic parameters are extracted from historical access data. The receiving time of the current access request can be used as the end time point, and the starting time point corresponding to the end time point can be determined in a unit time period. For example, if the unit time period is 2 minutes, the receiving time of the access request is used as the end time point to trace back 2 minutes and determine the starting time point. Obtain historical access requests between the start time point and the end time point in the historical access data, and count the number of data packets, traffic bandwidth, number of requests, and QPS (queries per second) corresponding to the historical access requests in this time period.

[0037] S120: Identify the access feature information according to a preset abnormal access identification model to obtain an identification result of whether it is abnormal.

[0038] The access feature information is identified according to a preset abnormal access identification model to obtain an identification result of whether it is abnormal. Further, the obtained access feature information is input into the abnormal access identification model to identify the access feature information of the access request and obtain an identification result of whether it is abnormal.

[0039] In a specific embodiment, step S120 includes sub-steps: converting each item of information in the access feature information according to a preset conversion rule to obtain a corresponding feature array; inputting the feature array into the abnormal access recognition model to obtain the corresponding matching probability between each classification in the abnormal access recognition model and the feature array; judging whether the classification with the highest matching probability is an abnormal classification to obtain an identification result of whether it is abnormal.

[0040] Specifically, the information included in the access feature information can be converted according to the conversion rules, and each information can be converted to a corresponding value, and the values ​​corresponding to multiple information are combined into a feature array. Specifically, the type value corresponding to the access type and protocol type can be obtained according to the value matching strategy in the conversion rules, and the calculated values ​​corresponding to other information can be calculated according to the numerical calculation formulas corresponding to each information in the conversion rules.

[0041] For example, if the type value corresponding to "data read type" in the value matching strategy is "15", and the access type in the access feature information is data read type, then "15" is placed at the first position of the feature array. If the traffic bandwidth in the access feature information is 155kbps, then the calculated value corresponding to the traffic bandwidth can be calculated as "5" through the numerical calculation formula r=ln(155) corresponding to the traffic bandwidth information.

[0042] The obtained feature array is input into the abnormal access recognition model, which includes multiple input nodes and multiple output nodes. Each input node corresponds to a value in the feature array, and each value in the feature array can be input into the abnormal access recognition model through the input node. One or more intermediate layers are set between the input node and the output node, and each intermediate layer is configured with a different weight coefficient. The matching probability corresponding to each output node can be calculated through the intermediate layer. Each output node corresponds to a classification, and the classification corresponding to the output node can be a normal classification (such as low-frequency access requests, high-frequency access requests) or an abnormal classification (DDoS attacks, CC attacks, phishing and other network attack classifications). The matching probability corresponding to each classification can be obtained, and the classification with the highest matching probability is selected to determine whether it is an abnormal classification, and obtain an abnormal recognition result.

[0043] In a specific embodiment, before step S120, the method further includes the following steps: training the abnormal access recognition model according to a preconfigured training data set to obtain the trained abnormal access recognition model; each piece of training data in the training data set includes a feature array and a type tag.

[0044] Before using the abnormal access recognition model, the abnormal access recognition model can also be trained through a training data set. Among them, the training data set is a pre-configured data set containing multiple training data, each training data includes a feature array and a type tag, and the feature array without training data is used to input the abnormal access recognition model for training and obtain output information, obtain the difference information between the output information and the type tag, and feedback adjust the abnormal access recognition model based on the difference information, that is, calculate the loss function based on the difference information, and feedback adjust the weight coefficient and parameter value configured in the abnormal access recognition model through the loss function, so as to realize the training of the abnormal access recognition model. One piece of training data can adjust the weight coefficient and parameter value in the abnormal access recognition model once, that is, train the abnormal access recognition model once, and multiple training data can realize iterative training of the abnormal access recognition model.

[0045] S130: If the identification result is abnormal, flow control is performed on the access request through a preset DNS routing policy.

[0046] If the identification result is abnormal, the access request is flow controlled by a preset DNS routing policy. If the identification result is abnormal, the access request currently received can be flow controlled by a DNS (Domain Name System) routing policy preset in the management server.

[0047] In a specific embodiment, step S130 includes sub-steps: obtaining a matching control level in the DNS routing policy according to the classification and region of the access request; and prioritizing the access request according to the control level and receiving time of the access request to achieve flow control of the access request.

[0048] Specifically, the control level that matches the access request with the DNS routing policy can be determined based on the classification and region of the access request. The classification of the access request is the classification with the highest matching probability obtained by identifying the abnormal access identification model, and the region of the access request is the regional information determined by performing domain name resolution on the terminal address of the access request. The DNS routing policy includes control levels corresponding to different classifications and different regions. For example, if the control level corresponding to the "Pacific" region and the "DDoS attack" classification in the DNS routing policy is level three, it can be determined that the control level of the access requests matching the region and classification are all level three.

[0049] After determining the control level of the access request, the priority of each access request is sorted according to the receiving time of the access request. Specifically, the access request with the earlier receiving time in the same control level is sorted first, and the access requests of different control levels are sorted according to the control level. The higher the control level, the higher the priority corresponding to the access request, and the higher the ranking. Through this priority sorting, the flow control of the access request can be achieved.

[0050] S140. According to the preset cloud service address, the access feature information and the identification result of the access request are sent to the cloud server in sequence according to the flow control, so as to obtain the feedback result of whether to intercept from the cloud server.

[0051] According to the preset cloud service address, the access feature information and identification results of the access request are sent to the cloud server in sequence according to the flow control to obtain the feedback result of whether to intercept from the cloud server. The management server pre-stores the cloud service address, and the access feature information and identification results of the access request can be sent to the cloud server in sequence according to the cloud service address. The access request that has sent the access feature information and identification results is deleted from the priority sorting. After the cloud server receives the access feature information and identification results of the access request, it can configure the defense level of WAF (Web Application Firewall) according to the identification results, that is, optimize the rules and defense level of WAF according to the classification of the access request in the identification results; the access feature information of the access request is detected by the optimized configured WAF after abnormality detection. If the detection is abnormal, the corresponding feedback result is determined to be interception; if the detection is not abnormal, the corresponding feedback result is determined to be non-interception. After obtaining the feedback result of an access request, the next access request is obtained from the priority sorting and sent to the cloud server.

[0052] In a specific embodiment, after step S140, a sub-step is also included: if the feedback result is interception, the access request is input into a pre-isolated mirror service for honeypot analysis to obtain a corresponding analysis result; the mirror service is a virtual service obtained by mirroring the source station service; and the vulnerability of the source station service is repaired according to the analysis result.

[0053] If the feedback result is interception, the access request can also be input into the pre-isolated mirror service. Specifically, the management server is configured with a source station service, which can provide normal access services for the access request; in order to implement honeypot analysis of the access request, a mirror service corresponding to the source station service can be built in the management server. An independent system space isolated from the source station service can be allocated in the management server. The system space is configured with computing resources, storage space, cache space and data transmission path isolated from the source station service, and the program code corresponding to the source station service is copied and run in the allocated independent system space, thereby obtaining a mirror service isolated from the source station service. The access request with the feedback result of interception is input into the mirror service, so that the access request can be honeypot analyzed and the corresponding analysis results can be obtained. According to the obtained analysis results, the vulnerability of the source station service is repaired. For example, the high-risk operation contained in the analysis result is: the access request maliciously writes code in the A area of ​​the mirror service, then the vulnerability repair can be adjusted to adjust the read and write permissions of the A area in the source station service, and the read and write permissions of the A area in the source station service are adjusted to write protection.

[0054] In a specific embodiment, the step of inputting the access request into a pre-isolated mirror service for honeypot analysis to obtain a corresponding analysis result includes: recording the access path of the access request to the mirror service to obtain log information; and analyzing the log information to obtain a corresponding analysis result.

[0055] Specifically, an access request may be input into a mirror service, the access request may be serviced by the mirror service, and the access path of the access request in the mirror service may be recorded, thereby obtaining log information corresponding to the access request; the log information may be analyzed, the access path of the access request may be obtained from the log information, and it may be determined whether the operation of the access request in each access path is high risk, thereby obtaining the corresponding analysis result.

[0056] S150: If the feedback result is not to be intercepted or the identification result is not abnormal, the access request is connected to the source station service.

[0057] If the feedback result is not to be intercepted or the identification result is not abnormal, the access request is connected to the source station service. Further, if the feedback result is not to be intercepted, the access request corresponding to the feedback result is wirelessly intercepted, and the access request is connected to the source station service to provide normal access service for the access request through the source station service; similarly, if the identification result is not abnormal, it is indicated that the access request is not abnormal during the local analysis and identification process of the access request by the management server, and the access request is connected to the source station service to provide normal access service for the access request through the source station service.

[0058] In the monitoring and identification method of network attacks disclosed in the above embodiment, the method includes: if an access request is received, extracting corresponding access feature information from the access request; identifying the access feature information according to a preset abnormal access identification model to obtain an identification result of whether it is abnormal; if the identification result is abnormal, performing flow control on the access request through a preset DNS routing policy; sending the access feature information and the identification result of the access request to the cloud server in sequence according to the flow control according to the preset cloud service address, so as to obtain the feedback result of whether to intercept from the cloud server; if the feedback result is not to intercept or the identification result is not abnormal, connecting the access request to the source station service. The above monitoring and identification method can quickly classify and accurately identify network access requests, thereby determining the network attacks therein and intercepting them, greatly improving the efficiency of network attack monitoring and identification.

[0059] The embodiment of the present invention also provides a network attack monitoring and identification device, which can be configured in a terminal device and is used to execute any embodiment of the aforementioned network attack monitoring and identification method. Figure 3 , Figure 3 A schematic block diagram of a network attack monitoring and identification device provided in an embodiment of the present invention.

[0060] like Figure 3 As shown, the network attack monitoring and identification device 100 includes an access feature information acquisition unit 110, an identification result acquisition unit 120, a traffic control unit 130, a feedback result acquisition unit 140 and an access request access unit 150.

[0061] The access characteristic information acquisition unit 110 is configured to extract corresponding access characteristic information from an access request if an access request is received.

[0062] The recognition result acquisition unit 120 is used to identify the access feature information according to a preset abnormal access recognition model to obtain a recognition result of whether it is abnormal.

[0063] The flow control unit 130 is used to control the flow of the access request through a preset DNS routing policy if the identification result is abnormal.

[0064] The feedback result acquisition unit 140 is used to send the access feature information and identification result of the access request to the cloud server in sequence according to the preset cloud service address based on flow control, so as to obtain the feedback result of whether to intercept from the cloud server.

[0065] The access request access unit 150 is configured to access the access request to the source station service if the feedback result is not to be intercepted or the identification result is not abnormal.

[0066] The network attack monitoring and identification device provided in the embodiment of the present invention applies the above-mentioned network attack monitoring and identification method. If an access request is received, the corresponding access feature information is extracted from the access request; the access feature information is identified according to the preset abnormal access identification model to obtain an identification result of whether it is abnormal; if the identification result is abnormal, the access request is flow controlled through the preset DNS routing policy; the access feature information and the identification result of the access request are sent to the cloud server in sequence according to the preset cloud service address according to the flow control, so as to obtain the feedback result of whether to intercept from the cloud server; if the feedback result is not to intercept or the identification result is not abnormal, the access request is connected to the source station service. The above-mentioned monitoring and identification method can quickly classify and accurately identify network access requests, thereby determining the network attacks therein and intercepting them, which greatly improves the efficiency of network attack monitoring and identification.

[0067] The above-mentioned network attack monitoring and identification device can be implemented in the form of a computer program. The computer program can be implemented in the form of a computer program. Figure 4 Runs on the computer device shown.

[0068] See also Figure 4 , Figure 4 1 is a schematic block diagram of a computer device provided by an embodiment of the present invention. The computer device may be a management server for executing a method for monitoring and identifying network attacks to monitor network requests and thereby identify network attacks.

[0069] See also Figure 4 The computer device 500 includes a processor 502 , a memory and a communication interface 505 connected via a communication bus 501 , wherein the memory may include a storage medium 503 and an internal memory 504 .

[0070] The storage medium 503 may store an operating system 5031 and a computer program 5032. When the computer program 5032 is executed, the processor 502 may execute a method for monitoring and identifying network attacks, wherein the storage medium 503 may be a volatile storage medium or a non-volatile storage medium.

[0071] The processor 502 is used to provide computing and control capabilities to support the operation of the entire computer device 500 .

[0072] The internal memory 504 provides an environment for the operation of the computer program 5032 in the storage medium 503. When the computer program 5032 is executed by the processor 502, the processor 502 can execute the monitoring and identification method of the network attack.

[0073] The communication interface 505 is used for network communication, such as providing data information transmission, etc. Those skilled in the art will appreciate that Figure 4 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present invention, and does not constitute a limitation on the computer device 500 to which the solution of the present invention is applied. The specific computer device 500 may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0074] The processor 502 is used to run the computer program 5032 stored in the memory to implement the corresponding functions in the above-mentioned network attack monitoring and identification method.

[0075] Those skilled in the art will understand that Figure 4 The embodiments of the computer device shown in the figure do not constitute a limitation on the specific composition of the computer device. In other embodiments, the computer device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. For example, in some embodiments, the computer device may only include a memory and a processor. In such embodiments, the structure and function of the memory and the processor are the same as those of the embodiment of the present invention. Figure 4 The embodiments shown are consistent and will not be described again here.

[0076] It should be understood that in the embodiment of the present invention, the processor 502 may be a central processing unit (CPU), and the processor 502 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0077] In another embodiment of the present invention, a computer-readable storage medium is provided. The computer-readable storage medium may be a volatile or non-volatile computer-readable storage medium. The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the steps included in the above-mentioned network attack monitoring and identification method are implemented.

[0078] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the above-described equipment, devices and units can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here. Those of ordinary skill in the art can appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to the function. Whether these functions are executed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

[0079] In the several embodiments provided by the present invention, it should be understood that the disclosed equipment, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. Units with the same function may also be combined into one unit. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interfaces, devices or units, or may be an electrical, mechanical or other form of connection.

[0080] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of the present invention.

[0081] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0082] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a computer-readable storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned computer-readable storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a magnetic disk or an optical disk.

[0083] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A method for monitoring and identifying network attacks, characterized in that: The method is applied to a management server, and the management server establishes a network connection with an access terminal and a cloud server to realize the transmission of data information. The method includes: If an access request is received, extracting corresponding access feature information from the access request; Identify the access feature information according to a preset abnormal access identification model to obtain an identification result of whether it is abnormal; If the identification result is abnormal, flow control is performed on the access request through a preset DNS routing strategy; According to the preset cloud service address, the access feature information and identification result of the access request are sent to the cloud server in sequence according to the flow control, so as to obtain the feedback result of whether to intercept from the cloud server; If the feedback result is not to be intercepted or the identification result is not abnormal, the access request is connected to the source station service.

2. The method for monitoring and identifying network attacks according to claim 1, characterized in that: The extracting corresponding access feature information from the access request includes: Acquire historical access data corresponding to the access request; Extracting corresponding basic characteristic parameters from the access request; Extracting corresponding traffic characteristic parameters from the historical access data; The basic characteristic parameter and the traffic characteristic parameter are combined into the access characteristic information.

3. The method for monitoring and identifying network attacks according to claim 1, characterized in that: The step of identifying the access feature information according to a preset abnormal access identification model to obtain an identification result of whether the access feature information is abnormal includes: Convert each item of information in the access feature information according to a preset conversion rule to obtain a corresponding feature array; Inputting the feature array into the abnormal access recognition model to obtain the corresponding matching probability between each classification in the abnormal access recognition model and the feature array; Determine whether the category with the highest matching probability is an abnormal category to obtain an abnormal recognition result.

4. The method for monitoring and identifying network attacks according to claim 1, characterized in that: Before the access feature information is identified according to the preset abnormal access identification model to obtain an identification result of whether it is abnormal, the method further includes: The abnormal access recognition model is trained according to a pre-configured training data set to obtain the trained abnormal access recognition model; each piece of training data in the training data set includes a feature array and a type tag.

5. The method for monitoring and identifying network attacks according to claim 1, characterized in that: After the access feature information and the identification result of the access request are sent to the cloud server in sequence according to the preset cloud service address according to the flow control to obtain the feedback result of whether to intercept from the cloud server, the method further includes: If the feedback result is interception, the access request is input into a pre-isolated mirror service for honeypot analysis to obtain a corresponding analysis result; the mirror service is a virtual service obtained by mirroring the source station service; The vulnerability of the source station service is repaired according to the analysis results.

6. The method for monitoring and identifying network attacks according to claim 5, characterized in that: The step of inputting the access request into the pre-isolated image service for honeypot analysis to obtain corresponding analysis results includes: Recording the access path of the access request to the mirror service to obtain log information; The log information is analyzed to obtain corresponding analysis results.

7. The method for monitoring and identifying network attacks according to claim 1, characterized in that: The flow control of the access request by using a preset DNS routing strategy includes: Obtaining a matching control level in the DNS routing policy according to the category and region of the access request; The access requests are prioritized according to their control levels and receiving times, so as to implement flow control on the access requests.

8. A network attack monitoring and identification device, characterized in that: The device is configured in a management server, and the management server establishes a network connection with an access terminal and a cloud server to realize the transmission of data information. The network attack monitoring and identification device is used to execute the network attack monitoring and identification method according to any one of claims 1 to 7, and the device includes: An access characteristic information acquisition unit, configured to extract corresponding access characteristic information from an access request upon receiving the access request; An identification result acquisition unit, used to identify the access feature information according to a preset abnormal access identification model to obtain an identification result of whether it is abnormal; A flow control unit, configured to perform flow control on the access request through a preset DNS routing policy if the identification result is abnormal; A feedback result acquisition unit is used to send the access feature information and the identification result of the access request to the cloud server in sequence according to the preset cloud service address according to the flow control, so as to obtain the feedback result of whether to intercept from the cloud server; The access request access unit is used to connect the access request to the source station service if the feedback result is not intercepted or the identification result is not abnormal.

9. A computer device, characterized in that: The device includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; Memory, used to store computer programs; The processor is used to implement the steps of the network attack monitoring and identification method described in any one of claims 1 to 7 when executing the program stored in the memory.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for monitoring and identifying network attacks according to any one of claims 1 to 7 are implemented.

Images