Virus attack prediction method and device based on network attack-kill chain

Abstract

The embodiments of the present application relate to the field of virus attack prediction, and specifically to a virus attack prediction method and device based on a network attack-kill chain. A specific implementation of the method includes: inputting a network browsing log set into an abnormal log feature information detection model; inputting each abnormal log feature detection information that meets the abnormal feature conditions into a log data abnormal recognition model corresponding to the abnormal log recognition configuration information; for each log data abnormal recognition result, performing the following processing steps: inputting a historical user access behavior information sequence into a pre-trained network attack-kill chain generation model to obtain a network attack-kill chain corresponding to the abnormal user; constructing a network virus attack prediction model based on each obtained network attack-kill chain; and performing network virus attack prediction on each accessing user based on the network virus attack prediction model. This implementation improves the recognition of various types of virus attacks and enhances network security.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of virus attack prediction, and specifically to a virus attack prediction method and device based on a network attack-kill chain. Background Art

[0002] With the rapid development of network technology, network security threats have become increasingly complex and diverse. Network attackers use increasingly covert, multi-level, and multi-source attack methods, which poses a great challenge to network security. Timely identification of network attacks and accurate restoration of attack chains are crucial to ensuring network security. Existing network attack detection methods usually perform detection through a single log. However, existing network attack detection methods usually have the following problems: due to the small amount of information that can be captured, the detection accuracy is not high, and it is easy to generate false positives and false negatives. Summary of the invention

[0003] The content of this application is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The content of this application is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0004] Some embodiments of the present application propose a virus attack prediction method and device based on a network attack-kill chain to solve one or more of the technical problems mentioned in the above background technology section.

[0005] In the first aspect, some embodiments of the present application provide a virus attack prediction method based on a network attack and kill chain, the method comprising: obtaining a network browsing log of each user within a preset time period to obtain a network browsing log set; inputting the network browsing log set into an abnormal log feature information detection model corresponding to abnormal log feature identification indication information to obtain an abnormal log feature detection information set, wherein one network browsing log corresponds to one abnormal log feature detection information; in response to determining that there is abnormal log feature detection information that meets the abnormal feature condition in the abnormal log feature detection information set, inputting each abnormal log feature detection information that meets the abnormal feature condition into a log data abnormal identification model corresponding to abnormal log identification configuration information to obtain a log data abnormal identification result; for each log data abnormal identification result, performing the following processing steps: determining the user corresponding to the log data abnormal identification result as an abnormal user; obtaining a historical user access behavior information sequence of the abnormal user on different device terminals; inputting the historical user access behavior information sequence into a pre-trained network attack and kill chain generation model to obtain a network attack and kill chain corresponding to the abnormal user; constructing a network virus attack prediction model based on each obtained network attack and kill chain; and performing network virus attack prediction on each access user based on the network virus attack prediction model. .

[0006] In a second aspect, the present application also provides a computer device, comprising a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the method described in any implementation of the first aspect is implemented.

[0007] In a third aspect, the present application further provides a computer-readable storage medium, on which a computer program is stored, wherein when the computer program is executed by a processor, the method described in any implementation of the first aspect is implemented.

[0008] The above-mentioned embodiments of the present application have the following beneficial effects: through the virus attack prediction method based on the network attack and kill chain of some embodiments of the present application, through the abnormal log feature information detection model and the log data abnormality recognition model, abnormal logs can be quickly found, and the network attack and kill chains of various users can be constructed through the abnormal users corresponding to the abnormal logs. Therefore, the behavior of new access users can be identified through various network attack and kill chains, thereby improving the identification of various types of virus attacks and enhancing network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The above and other features, advantages and aspects of the embodiments of the present application will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0010] Figure 1 is a flowchart of some embodiments of a virus attack prediction method based on a network attack-kill chain according to the present application;

[0011] Figure 2 It is a schematic diagram of the structure of a computer device suitable for implementing some embodiments of the present application. DETAILED DESCRIPTION

[0012] Embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present application. It should be understood that the drawings and embodiments of the present application are only for exemplary purposes and are not intended to limit the scope of protection of the present application.

[0013] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other.

[0014] It should be noted that the concepts such as "first" and "second" mentioned in this application are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0015] It should be noted that the modifications of "one" and "plurality" mentioned in the present application are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0016] The names of the messages or information exchanged between multiple devices in the embodiments of the present application are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0017] The present application will be described in detail below with reference to the accompanying drawings and in combination with embodiments.

[0018] Figure 1 The flowchart 100 of some embodiments of the virus attack prediction method based on the network attack and kill chain according to the present application is shown. The virus attack prediction method based on the network attack and kill chain includes the following steps:

[0019] Step 101, obtaining the web browsing log of each user within a preset time period to obtain a web browsing log set.

[0020] In some embodiments, the executor (for example, a computer device) of the virus attack prediction based on the network attack and kill chain can obtain the network browsing log of each user within a preset time period from the storage terminal through a wired connection or a wireless connection to obtain a set of network browsing logs. The network browsing logs may include: network side logs, device side logs, and service logs. For example, network side logs: mainly record the network side traffic corresponding to the user, including full traffic records and various network side alarm logs. The device side logs may include: mainly record the operations and behaviors of the terminal device, application or client, such as user interaction, device status, error logs, application events, etc. The service log mainly records information at the application layer, including specific business service logs and database operation logs. The preset time period may refer to a historical preset time period.

[0021] Furthermore, a sample set of web browsing logs is obtained.

[0022] In some embodiments, the execution subject may obtain a network browsing log sample set. The network browsing log sample may correspond to a user and may include a network side log, a device side log, and a service log.

[0023] Further, initial abnormal log identification configuration information and initial abnormal log feature identification indication information are determined.

[0024] In some embodiments, the execution subject may determine initial abnormal log identification configuration information and initial abnormal log feature identification indication information. The initial abnormal log identification configuration information may be abnormal log identification configuration information before each model training. The abnormal log identification configuration information may be information for configuring abnormal log data identification. The abnormal log identification configuration information may include: an identification feature type set, a log data abnormality threshold set, and an abnormal log data type identification method identification set. The identification feature type in the identification feature type set may characterize the type of data corresponding to the feature required when performing abnormal log data identification. The identification feature type set may include: detailed log, internal operation log, important log, consumer group delay log, Logtail alarm log. The log data abnormality threshold may be a threshold for characterizing data abnormality of the corresponding log data type. The data types may be: plaintext classification, protocol classification, application classification, and behavior classification. The abnormal log data type identification method identification may be a unique identifier of the abnormal log data type identification method. The abnormal log data type identification method may be a classification method for detecting abnormal types of abnormal log data. The above classification methods may be: Lightgbm (Light Gradient Boosting Machine) machine learning model, LOF (Local Outlier Factor), support vector machine. The above anomaly types may be: abnormal, no abnormal. The above initial abnormal log feature identification indication information may be information for guiding the abnormal log feature information detection model to extract required features. The above initial abnormal log feature identification indication information may include: log key data set, abnormal value type set, log data verification type set, and value fluctuation information.

[0025] Furthermore, a target web browsing log sample is selected from the web browsing log sample set.

[0026] In some embodiments, the execution subject may select a target web browsing log sample from the web browsing log sample set. A web browsing log sample may be randomly selected from the web browsing log sample set as the target web browsing log sample.

[0027] Furthermore, the target network browsing log sample is input into an initial abnormal log feature information detection model corresponding to the initial abnormal log feature identification indication information to obtain sample abnormal log feature detection information.

[0028] In some embodiments, the execution subject may input the target network browsing log sample into the initial abnormal log feature information detection model corresponding to the initial abnormal log feature identification indication information to obtain the sample abnormal log feature detection information. The initial abnormal log feature information detection model may be: a feature extraction model for extracting the features indicated by the initial abnormal log feature identification indication information in the target network browsing log sample. The initial abnormal log feature information detection model may be a GPT model.

[0029] Furthermore, the above sample abnormal log feature detection information is input into the initial log data abnormality recognition model corresponding to the initial abnormal log recognition configuration information to obtain the sample log data abnormality recognition result.

[0030] In some embodiments, the execution subject may input the sample abnormal log feature detection information into the initial log data abnormality recognition model corresponding to the initial abnormal log recognition configuration information to obtain the sample log data abnormality recognition result. The initial log data abnormality recognition model includes: an abnormal log cause information generation network and an abnormal data type generation network corresponding to the initial abnormal log recognition configuration information. The abnormal log cause information generation network may be a model for automatically generating abnormal log cause information. The abnormal log cause may be the cause of the target network browsing log sample abnormality. For example, the abnormal log cause may be "the presence of a program virus". The abnormal log cause information generation network may be a GPT model. The abnormal data type generation network may be: a model corresponding to at least one abnormal log data type recognition method among the various abnormal log data type recognition methods corresponding to the initial abnormal log recognition configuration information.

[0031] In an actual application scenario, the execution subject may input the sample abnormal log feature detection information into the initial log data abnormality recognition model corresponding to the initial abnormal log recognition configuration information through the following steps:

[0032] In the first step, the sample abnormal log feature detection information is input into the abnormal data type generation network to obtain the sample log abnormal type, wherein the sample log abnormal type can characterize whether the target network browsing log sample is abnormal.

[0033] In the second step, in response to determining that the sample log anomaly type meets the preset anomaly type condition, the sample anomaly log feature detection information is input into the anomaly log cause information generation network to obtain the sample anomaly log cause information. The preset anomaly type condition may be: the sample log anomaly type indicates anomaly.

[0034] The third step is to determine the sample log anomaly type and the sample anomaly log reason information as the sample log data anomaly identification result.

[0035] Further, determine the loss value between the above sample log data anomaly identification result and the corresponding sample log data anomaly label.

[0036] In some embodiments, the execution entity may determine the loss value between the sample log data anomaly identification result and the corresponding sample log data anomaly label. The loss value between the sample log data anomaly identification result and the corresponding sample log data anomaly label may be determined by a preset loss function. The preset loss function may be, but is not limited to, mean square error loss function (MSE), support vector machine loss function (SVM), cross entropy loss function (CrossEntropy), etc.

[0037] Further, in response to determining that the above-mentioned loss value is less than or equal to the preset loss value, the initial abnormal log identification configuration information, the initial abnormal log feature identification indication information, the initial abnormal log feature information detection model and the initial log data abnormality identification model are determined as the abnormal log identification configuration information, the abnormal log feature identification indication information, the abnormal log feature information detection model and the log data abnormality identification model.

[0038] In some embodiments, the above-mentioned execution entity can determine the initial abnormal log identification configuration information, initial abnormal log feature identification indication information, initial abnormal log feature information detection model and initial log data abnormality identification model as abnormal log identification configuration information, abnormal log feature identification indication information, abnormal log feature information detection model and log data abnormality identification model in response to determining that the above-mentioned loss value is less than or equal to a preset loss value.

[0039] In this way, the abnormal type of log data can be automatically identified and the abnormal reason information can be automatically generated, thereby facilitating the verification and review of the network browsing log.

[0040] Step 102: input the above network browsing log set into an abnormal log feature information detection model corresponding to the abnormal log feature identification indication information to obtain an abnormal log feature detection information set.

[0041] In some embodiments, the execution subject may input the network browsing log set into an abnormal log feature information detection model corresponding to the abnormal log feature identification indication information to obtain an abnormal log feature detection information set, wherein one network browsing log corresponds to one abnormal log feature detection information.

[0042] Step 103, in response to determining that there is abnormal log feature detection information that meets the abnormal feature conditions in the above-mentioned abnormal log feature detection information set, each abnormal log feature detection information that meets the abnormal feature conditions is input into the log data abnormality recognition model corresponding to the abnormal log recognition configuration information to obtain the log data abnormality recognition result.

[0043] In some embodiments, the execution subject may, in response to determining that there is abnormal log feature detection information satisfying an abnormal feature condition in the abnormal log feature detection information set, input each abnormal log feature detection information satisfying the abnormal feature condition into the log data abnormality recognition model of the corresponding abnormal log recognition configuration information to obtain a log data abnormality recognition result. The abnormal feature condition may be: the abnormal log feature detection information indicates the presence of an abnormality.

[0044] Step 104: for each log data anomaly identification result, perform the following processing steps:

[0045] Step 1041: determine the user corresponding to the above log data anomaly identification result as an abnormal user.

[0046] In some embodiments, the execution entity may determine the user corresponding to the log data anomaly identification result as an abnormal user.

[0047] Step 1042, obtaining the historical user access behavior information sequence of the abnormal user on different device terminals.

[0048] In some embodiments, the execution subject may obtain the historical user access behavior information sequence of the abnormal user on different device terminals. The historical user access behavior information may refer to the browsing behavior, click behavior, download behavior, upload behavior and other information of the abnormal user. That is, one historical user access behavior information corresponds to one device terminal. There is a sequence between each historical user access behavior information. And the historical user access behavior information includes attack traffic labels.

[0049] Step 1043, input the above historical user access behavior information sequence into a pre-trained network attack and kill chain generation model to obtain a network attack and kill chain corresponding to the above abnormal user.

[0050] In some embodiments, the execution subject may input the historical user access behavior information sequence into a pre-trained network attack kill chain generation model to obtain a network attack kill chain corresponding to the abnormal user. The network attack kill chain generation model may be a pre-trained network kill chain model that takes the historical user access behavior information sequence as input and the corresponding network attack kill chain as output. The network attack kill chain may refer to a network kill chain.

[0051] Cyber ​​kill chain: refers to a series of links and steps that an attacker goes through when conducting a cyber attack, from the starting point of the attack to the target of the attack, involving multiple stages and behaviors. Usually, a cyber kill chain includes 6 main stages: network scanning stage, intrusion and penetration stage, persistence stage (privilege escalation stage), lateral movement stage, target action execution stage, and masking and cleaning traces stage. Each stage may leave traces in different device logs, including: security protection device logs, application service logs, operating system logs, etc.

[0052] The Cyber ​​Kill Chain model provides defenders with an intelligence feedback loop by defining and describing the different stages of an intrusion, enabling them to establish information advantages and reduce the likelihood of success in subsequent intrusion attempts by the adversary. This model not only identifies patterns that can link individual attacks to broader activities, but also helps defenders recognize that iterative intelligence collection is the foundation of intelligence-driven computer network defense. Specifically, the Cyber ​​Kill Chain model includes the following key links:

[0053] 1. Intelligence gathering and reconnaissance: Attackers use various means to obtain relevant information about the target system, such as IP address, operating system type, vulnerability information, etc. This information helps attackers better understand the target system, making it easier to launch attacks.

[0054] 2. Vulnerability scanning and exploitation: Attackers use the vulnerability information obtained during the intelligence collection phase to scan the target system for vulnerabilities and exploit known vulnerabilities to launch attacks.

[0055] 3. System access and privilege escalation: After successfully exploiting the vulnerability, the attacker attempts to access the target system and obtain higher privileges.

[0056] 4. Data theft and tampering: After successfully accessing the system, the attacker can attempt to steal sensitive data or tamper with the data.

[0057] 5. Command and Control: After successfully stealing data or controlling the system, the attacker attempts to remotely control the target system through remote control tools.

[0058] Step 105: construct a network virus attack prediction model based on each obtained network attack-kill chain.

[0059] In some embodiments, the above-mentioned execution entity can build a network virus attack prediction model based on each obtained network attack and kill chain.

[0060] In an actual application scenario, the above execution entity can build a network virus attack prediction model through the following steps:

[0061] The first step is to construct a network attack and kill chain training sample set based on each network attack and kill chain obtained. The network attack and kill chain training samples include: network attack and kill chain, sample network virus attack prediction results.

[0062] The second step is to determine the initial network virus attack prediction model. The initial network virus attack prediction model includes: an initial diffusion convolutional network, an initial virus attack recognition network, and an initial virus attack prediction network. Here, the initial diffusion convolutional network can be a diffusion convolutional recurrent neural network model that takes the network attack and kill chain as input and the initial network attack and kill chain convolution information as output. The initial virus attack recognition network can be a neural network model that takes the initial network attack and kill chain convolution information as input and the initial virus attack recognition information as output. For example, the initial recognition model can be a support vector machine (SVM) model.

[0063] The initial virus attack prediction network may be a neural network model that takes the initial virus attack identification information as input and the initial network virus attack prediction result as output. For example, the initial virus attack prediction network may be an optimized GRU (Gated Recurrent Unit) model. Here, the transfer relationship between each layer included in the initial virus attack prediction network may be expressed by the following formula:

[0064]

[0065] Where t represents the sequence number of the network layer of the initial virus attack prediction network. t+T represents the initial virus attack prediction network. (t) H represents the input features of the tth layer. t-1 represents the hidden state of the t-1th layer. W represents the weight matrix. t Indicates the gate state of the tth layer control reset. t represents the gated state of the control update of the tth layer. t Represents the output of the tth layer. b r Indicates that the tth layer is in r t The bias matrix in b. u The tth layer is in u t The bias matrix in b. C Indicates that the tth layer is in C tThe bias matrix in . σ represents the Sigmoid function. ⊙ represents the Hadamard product.

[0066] The third step is to select a target network attack and kill chain training sample from the network attack and kill chain training sample set. A network attack and kill chain training sample can be randomly selected from the network attack and kill chain training sample set as the target network attack and kill chain training sample.

[0067] The fourth step is to input the network attack and kill chain included in the target network attack and kill chain training sample into the initial diffusion convolutional network to obtain the initial network attack and kill chain convolution information.

[0068] The fifth step is to input the initial network attack and kill chain convolution information into the initial virus attack identification network to generate initial virus attack identification information.

[0069] In the sixth step, the initial virus attack identification information is input into the initial virus attack prediction network to obtain the initial network virus attack prediction result.

[0070] In the seventh step, based on a preset loss function, the prediction difference between the initial network virus attack prediction result and the corresponding sample network virus attack prediction result is determined. The preset loss function may be, but is not limited to, mean square error loss function (MSE), support vector machine loss function (SVM), cross entropy loss function (CrossEntropy), etc.

[0071] In step 8, in response to determining that the predicted difference value is less than or equal to the preset difference value, the initial network virus attack prediction model is determined as the trained network virus attack prediction model.

[0072] In step 9, in response to determining that the predicted difference value is greater than the preset difference value, the network parameters of the initial network virus attack prediction model are adjusted, and the target network attack and kill chain training samples are selected from each unselected network attack and kill chain training sample to train the adjusted initial network virus attack prediction model again. For example, the difference between the above difference value and the preset difference value can be calculated. On this basis, the network parameters of the above initial network virus attack prediction model are adjusted using methods such as back propagation and gradient descent. For example, the preset difference value can be 0.1.

[0073] Therefore, by training the initial network virus attack prediction model including the initial diffusion convolutional network, the initial virus attack identification network, and the initial virus attack prediction network, a network virus attack prediction model with higher robustness can be trained, so that virus attack predictions can be performed on various types of user behaviors through the trained network virus attack prediction model, thereby improving the efficiency of network virus attack prevention and improving network security.

[0074] Step 106: perform network virus attack prediction on each accessing user according to the network virus attack prediction model.

[0075] In some embodiments, the execution entity may perform a network virus attack prediction for each accessing user based on the network virus attack prediction model.

[0076] In an actual application scenario, the above execution entity can predict network virus attacks for each access user through the following steps:

[0077] The first step is to obtain the current access behavior information of the above-mentioned access user. The access behavior information may refer to the current network access behavior of the access user, which may include: browsing behavior, clicking behavior, downloading behavior, uploading behavior and other information. Therefore, it is possible to predict whether the user is likely to carry out a network virus attack based on the user's behavior.

[0078] The second step is to input the access behavior information into the network virus attack prediction model to generate a network virus attack prediction result. The network virus attack prediction result may refer to whether the access user predicted by the access behavior information has the characteristics of a network virus attack. For example, the access behavior information is input into the network virus attack prediction model to determine whether the user meets the characteristics of the network attack and kill chain.

[0079] In the third step, in response to determining that the network virus attack prediction result meets the preset prediction condition, the access user is blocked. The preset prediction condition may refer to that the network virus attack prediction result meets the characteristics of the network attack-kill chain.

[0080] The present application also provides a computer device 200. Figure 2 As shown, the computer device 200 includes: a bus 201, a processor 202, a memory 203 and a communication interface 204. The processor 202, the memory 203 and the communication interface 204 communicate with each other through the bus 201. The computer device 200 can be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in the computer device 200.

[0081] The bus 201 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 2The bus 201 is represented by only one line, but it does not mean that there is only one bus or one type of bus. The bus 201 may include a path for transmitting information between various components of the computer device 200 (for example, the memory 203, the processor 202, and the communication interface 204).

[0082] The processor 202 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0083] The memory 203 may include a volatile memory, such as a random access memory (RAM). The memory 203 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0084] The memory 203 stores executable program codes, and the processor 202 executes the executable program codes to respectively implement the functions of the acquisition module, the sampling module, the determination module, and the mixing module, thereby implementing the above-mentioned virus attack prediction method based on the network attack and kill chain. That is, the memory 203 stores instructions for executing the above-mentioned virus attack prediction based on the network attack and kill chain.

[0085] The communication interface 204 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computer device 200 and other devices or a communication network.

[0086] An embodiment of the present application also provides a chip, which includes a processor and a data interface. The processor reads instructions stored in a memory through the data interface to execute the above-mentioned virus attack prediction method based on the network attack and kill chain.

[0087] The embodiment of the present application also provides a computer-readable storage medium. The above-mentioned computer-readable storage medium can be any available medium that can be stored by a computing device or a data storage device such as a data center containing one or more available media. The above-mentioned available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid-state hard disk). The computer-readable storage medium includes instructions, and the above-mentioned instructions instruct the computing device to execute the above-mentioned virus attack prediction method based on the network attack and kill chain.

[0088] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0089] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. A virus attack prediction method based on a network attack-kill chain, comprising: Obtaining the web browsing log of each user within a preset time period to obtain a web browsing log set; Inputting the network browsing log set into an abnormal log feature information detection model corresponding to the abnormal log feature identification indication information to obtain an abnormal log feature detection information set, wherein one network browsing log corresponds to one abnormal log feature detection information; In response to determining that there is abnormal log feature detection information satisfying the abnormal feature condition in the abnormal log feature detection information set, each abnormal log feature detection information satisfying the abnormal feature condition is input into a log data abnormality recognition model corresponding to the abnormal log recognition configuration information to obtain a log data abnormality recognition result; For each log data anomaly identification result, perform the following processing steps: Determine the user corresponding to the log data anomaly identification result as an abnormal user; Obtaining a sequence of historical user access behavior information of the abnormal user on different device terminals; Inputting the historical user access behavior information sequence into a pre-trained network attack-kill chain generation model to obtain a network attack-kill chain corresponding to the abnormal user; Based on the obtained network attack and kill chains, a network virus attack prediction model is constructed; According to the network virus attack prediction model, a network virus attack prediction is performed on each access user.

2. The virus attack prediction method based on network attack-kill chain according to claim 1, wherein: Before inputting the network browsing log set into a pre-trained abnormal log feature information detection model to obtain the abnormal log feature detection information set, the method further includes: Get a sample set of web browsing logs; Determine initial abnormal log identification configuration information and initial abnormal log feature identification indication information; Selecting a target web browsing log sample from the web browsing log sample set; Inputting the target network browsing log sample into the initial abnormal log feature information detection model corresponding to the initial abnormal log feature identification indication information to obtain the sample abnormal log feature detection information; Inputting the sample abnormal log feature detection information into the initial log data abnormality recognition model corresponding to the initial abnormal log recognition configuration information to obtain the sample log data abnormality recognition result, wherein the initial log data abnormality recognition model includes: an abnormal log cause information generation network and an abnormal data type generation network corresponding to the initial abnormal log recognition configuration information; Determine a loss value between the sample log data anomaly identification result and the corresponding sample log data anomaly label; In response to determining that the loss value is less than or equal to the preset loss value, the initial abnormal log identification configuration information, the initial abnormal log feature identification indication information, the initial abnormal log feature information detection model and the initial log data abnormality identification model are determined as the abnormal log identification configuration information, the abnormal log feature identification indication information, the abnormal log feature information detection model and the log data abnormality identification model.

3. The virus attack prediction method based on network attack-kill chain according to claim 2, wherein: The step of inputting the sample abnormal log feature detection information into the initial log data abnormality recognition model corresponding to the initial abnormal log recognition configuration information to obtain the sample log data abnormality recognition result includes: Inputting the sample abnormal log feature detection information into the abnormal data type generation network to obtain the sample log abnormal type; In response to determining that the sample log exception type meets a preset exception type condition, inputting the sample exception log feature detection information into the exception log cause information generation network to obtain the sample exception log cause information; The sample log exception type and the sample exception log cause information are determined as the sample log data exception identification result.

4. The virus attack prediction method based on network attack-kill chain according to claim 1, wherein: The method of predicting a network virus attack for each access user according to the network virus attack prediction model includes: Obtaining the current access behavior information of the accessing user; Inputting the access behavior information into the network virus attack prediction model to generate a network virus attack prediction result; In response to determining that the network virus attack prediction result meets the preset prediction condition, the accessing user is banned.

5. A computer device, wherein: The computer device comprises a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the steps of the method according to any one of claims 1 to 4 are implemented.

6. A computer-readable storage medium, wherein: The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images