Network attack prevention method and device, terminal equipment and storage medium

Abstract

The invention discloses a network attack prevention method and device, terminal equipment and a storage medium, and the method comprises the steps: obtaining network flow data through a monitoring point disposed in a network; extracting a data packet from the network flow data; classifying the data packets through a network attack mode recognition model to obtain a network attack mode recognition result; judging whether a potential network attack behavior exists or not according to the network attack mode recognition result; and if yes, triggering a network attack defense measure. According to the network attack mode identification model, the potential network attack mode can be identified according to the current network flow data, and defense measures are triggered when the potential network attack is identified. Therefore, the network flow data can be monitored, potential network attacks can be prevented according to the monitored network flow data, and defense measures can be triggered in advance.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network attack prevention method, device, terminal equipment and storage medium. Background Art

[0002] With the continuous development of computer technology, network security issues have become more and more concerned. Since the Internet lacked an overall conception of its security mechanism at the beginning of its design, the TCP / IP protocol, as a widely used communication protocol, is itself a network interconnection model based on a trusted environment, lacks security design, and has many security loopholes in the protocol; similarly, many network products launched by many manufacturers, whether operating systems, databases or application software, have security loopholes in design and implementation to varying degrees. Due to these loopholes, various security incidents such as viruses, worms, Trojans, and intrusions have emerged in an endless stream; and for various reasons, now a huge and rapidly increasing number of hacker tools can be downloaded almost at will, making it possible for ordinary people or script users to become hackers and conduct destructive attacks. Understanding the methods and techniques of network attacks is of great significance to maintaining network security.

[0003] Traditional methods of defending against cyberattacks are usually based on signature or feature detection mechanisms. These methods rely on known attack patterns or malware signatures to identify and block attacks. The problem with this defense strategy is that it requires prior knowledge of a specific threat before it can be effectively identified and blocked. This approach is usually detected after the attack has already occurred or at least partially occurred because they rely on known threat signatures. This means that defense measures are triggered after the attack occurs, rather than preventing it before it occurs. If the attack is new or modified to avoid signature detection, then traditional defense systems may not be able to identify it until it is added to the threat database. It can be seen that traditional defense methods often react only after the attack occurs and cannot achieve real-time detection and prevention. Summary of the invention

[0004] The present invention provides a network attack prevention method, device, terminal equipment and storage medium to solve the technical problem that the prior art cannot monitor and prevent network attacks in real time.

[0005] In order to solve the above technical problems, an embodiment of the present invention provides a network attack prevention method, including:

[0006] Obtain network traffic data through monitoring points set up on the network;

[0007] extracting data packets from the network traffic data;

[0008] Classifying the data packets through a network attack pattern recognition model to obtain a network attack pattern recognition result;

[0009] According to the network attack pattern recognition result, determine whether there is potential network attack behavior; if so, trigger network attack defense measures;

[0010] The training process of the network attack pattern recognition model includes:

[0011] Acquire a number of normal network traffic data samples and a number of network traffic data samples with potential anomalies; wherein the normal network traffic data samples are marked as normal, and the network traffic data samples with potential anomalies are marked as corresponding network attack patterns;

[0012] For each of the network traffic data samples, extracting a data packet from the network traffic data sample;

[0013] Constructing an initial neural network model, taking the data packets corresponding to each of the network traffic data samples as input and taking the labels predicted by each of the network traffic data samples as output, and training the neural network model;

[0014] The trained neural network model is used as the network attack pattern recognition model.

[0015] As a preferred solution, the obtaining of network traffic data includes:

[0016] Get network traffic information through system commands; or,

[0017] Obtain network traffic information by scanning the target system; or,

[0018] Obtain network traffic information through network sniffing technology.

[0019] As a preferred solution, the data packet includes: source IP address, destination IP address, data packet size and transmission time;

[0020] The extracting of data packets from the network traffic data comprises:

[0021] Extracting data packets from the network traffic data using a packet capture tool; or,

[0022] by extracting data packets from the network traffic data using network traffic filtering technology at the monitoring point; or,

[0023] A packet capture library provided by a programming language is used to extract packets from the network traffic data.

[0024] As a preferred solution, the network attack modes include: denial of service attack, cross-site scripting attack, man-in-the-middle attack and SQL injection attack;

[0025] The triggering of network attack defense measures includes:

[0026] Take different defense measures for different attack modes;

[0027] Among them, defense measures against denial of service attacks include: enabling traffic cleaning services to filter out malicious traffic and increasing bandwidth and service resources;

[0028] Defense measures against cross-site scripting attacks include: escaping user input and setting security policies for HTTP response headers;

[0029] Defense measures against man-in-the-middle attacks include: using encrypted communication protocols and adopting authentication mechanisms;

[0030] Defenses against SQL injection attacks include: validating and filtering input data, and using parameterized queries or object-relational mapping frameworks.

[0031] As a preferred solution, after triggering the network attack defense measures, it also includes:

[0032] During the implementation of network attack defense measures, process information is recorded; wherein the process information includes: the type of defense measures, execution time and source information.

[0033] As a preferred solution, after obtaining the network traffic data, the following is also included:

[0034] Counting the number of first network attack events according to the network traffic data;

[0035] After the network attack defense measures are triggered, they also include:

[0036] After the implementation of network attack defense measures, continue to monitor network traffic data;

[0037] According to the network traffic data that continues to be monitored, the number of second network attack events is counted;

[0038] According to the number of the first network attack events and the number of the second network attack events, the implementation effect of the network attack defense measures is evaluated to obtain an evaluation result.

[0039] As a preferred solution, the types of evaluation results include: successfully blocking the attack, partially blocking the attack, failing to block the attack, and false alarm and false blocking;

[0040] After obtaining the evaluation results, it also includes:

[0041] When the evaluation result is partial attack blocking, failure to block the attack, or false alarm or false blocking, the network attack pattern recognition model and the network attack defense measures are optimized.

[0042] On the basis of the above-mentioned embodiment, another embodiment of the present invention provides a network attack prevention device, comprising: a data acquisition module, a network attack pattern recognition module and a network attack defense module;

[0043] The data acquisition module is used to acquire network traffic data through monitoring points set up on the network;

[0044] The network attack pattern recognition module is used to extract data packets from the network traffic data; classify the data packets through the network attack pattern recognition model to obtain network attack pattern recognition results;

[0045] The network attack defense module is used to determine whether there is a potential network attack behavior based on the network attack pattern recognition result; if so, trigger the network attack defense measures;

[0046] The training process of the network attack pattern recognition model includes:

[0047] Acquire a number of normal network traffic data samples and a number of network traffic data samples with potential anomalies; wherein the normal network traffic data samples are marked as normal, and the network traffic data samples with potential anomalies are marked as corresponding network attack patterns;

[0048] For each of the network traffic data samples, extracting a data packet from the network traffic data sample;

[0049] Constructing an initial neural network model, taking the data packets corresponding to each of the network traffic data samples as input and taking the labels predicted by each of the network traffic data samples as output, and training the neural network model;

[0050] The trained neural network model is used as the network attack pattern recognition model.

[0051] Based on the above embodiments, another embodiment of the present invention provides a terminal device, which includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and when the processor executes the computer program, the network attack prevention method described in the above invention embodiment is implemented.

[0052] Based on the above embodiments, another embodiment of the present invention provides a storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute the network attack prevention method described in the above invention embodiment.

[0053] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0054] The present invention obtains network traffic data by setting up monitoring points in the network; extracts data packets from the network traffic data; classifies the data packets through a network attack pattern recognition model to obtain network attack pattern recognition results; determines whether there is potential network attack behavior based on the network attack pattern recognition results; if so, triggers network attack defense measures. The network attack pattern recognition model of the present invention can identify potential network attack patterns based on current network traffic data, and trigger defense measures when potential network attacks are identified. It can be seen that the present invention can not only monitor network traffic data, but also prevent potential network attacks and trigger defense measures in advance based on the monitored network traffic data. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 It is a flowchart of a network attack prevention method provided by an embodiment of the present invention;

[0056] Figure 2 It is a structural diagram of a network attack prevention device provided by another embodiment of the present invention. DETAILED DESCRIPTION

[0057] To make the purpose, technical solution and advantages of this application clearer, the technical solution in this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0058] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which this application belongs; the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit this application; the terms "including" and "having" in the specification and claims of this application and the above-mentioned figure descriptions and any variations thereof are intended to cover non-exclusive inclusions.

[0059] In the description of the embodiments of the present application, the technical terms "first", "second", etc. are only used to distinguish different objects, and cannot be understood as indicating or implying relative importance or implicitly indicating the number, specific order or primary and secondary relationship of the indicated technical features. In the description of the embodiments of the present application, the meaning of "multiple" is more than two, unless otherwise clearly and specifically defined.

[0060] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0061] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0062] Embodiment 1

[0063] Please refer to Figure 1 , is a flow chart of a network attack prevention method provided by an embodiment of the present invention, including:

[0064] S1. Obtain network traffic data through monitoring points set up on the network.

[0065] It should be noted that the present invention is applied to a metering automation system.

[0066] In step S1, all network traffic data passing through the metering automation system is collected by setting monitoring points in the network.

[0067] In a preferred embodiment, the obtaining of network traffic data includes:

[0068] Get network traffic information through system commands; or,

[0069] Obtain network traffic information by scanning the target system; or,

[0070] Obtain network traffic information through network sniffing technology.

[0071] In this embodiment, the present invention provides three methods for obtaining network traffic data: The methods are:

[0072] (1) Obtain information using system commands: Obtain network traffic data through commands provided by the operating system to view network status and routing information;

[0073] (2) Scan the target system: Use port scanning tools such as NMAP and X-Scan and vulnerability scanning tools such as Nessus to obtain service information provided by the target host;

[0074] (3) Network sniffing: Capture the numerous information generated by the computer on the network that does not belong to it through sniffing.

[0075] S2. Extracting data packets from the network traffic data.

[0076] In a preferred embodiment, the data packet includes: a source IP address, a destination IP address, a data packet size, and a transmission time;

[0077] The extracting of data packets from the network traffic data comprises:

[0078] Extracting data packets from the network traffic data using a packet capture tool; or,

[0079] by extracting data packets from the network traffic data using network traffic filtering technology at the monitoring point; or,

[0080] A packet capture library provided by a programming language is used to extract packets from the network traffic data.

[0081] In this embodiment, the present invention provides three methods for extracting data packets, namely:

[0082] (1) Packet capture tools: Use Wireshark, Fiddler, and other packet capture tools;

[0083] (2) Network traffic filtering: Setting monitoring points in the network means collecting only target data packets through traffic filtering techniques, such as IP filtering and port filtering;

[0084] (3) Packet capture library: Use library functions or modules provided by the programming language, such as Python's scapy library.

[0085] S3. Classifying the data packets through a network attack pattern recognition model to obtain a network attack pattern recognition result; wherein the training process of the network attack pattern recognition model includes:

[0086] Acquire a number of normal network traffic data samples and a number of network traffic data samples with potential anomalies; wherein the normal network traffic data samples are marked as normal, and the network traffic data samples with potential anomalies are marked as corresponding network attack patterns;

[0087] For each of the network traffic data samples, extracting a data packet from the network traffic data sample;

[0088] Constructing an initial neural network model, taking the data packets corresponding to each of the network traffic data samples as input and taking the labels predicted by each of the network traffic data samples as output, and training the neural network model;

[0089] The trained neural network model is used as the network attack pattern recognition model.

[0090] In a preferred embodiment, a support vector machine or a decision tree may also be used as a network tool pattern recognition model.

[0091] In a preferred embodiment, the network attack modes include: denial of service attack, cross-site scripting attack, man-in-the-middle attack and SQL injection attack;

[0092] The triggering of network attack defense measures includes:

[0093] Take different defense measures for different attack modes;

[0094] Among them, defense measures against denial of service attacks include: enabling traffic cleaning services to filter out malicious traffic and increasing bandwidth and service resources;

[0095] Defense measures against cross-site scripting attacks include: escaping user input and setting security policies for HTTP response headers;

[0096] Defense measures against man-in-the-middle attacks include: using encrypted communication protocols and adopting authentication mechanisms;

[0097] Defenses against SQL injection attacks include: validating and filtering input data, and using parameterized queries or object-relational mapping frameworks.

[0098] It should be noted that denial of service attacks include DoS and DDoS, which congest the target network with a large number of invalid or high-traffic data packets, making it unable to provide services normally. Cross-site scripting (XSS) is an attacker injecting malicious scripts into normal websites. When other users visit the website, the malicious scripts will be executed on the user's browser. Man-in-the-middle attack (MITM) is an attacker inserting between two communicating entities, so that the communication that was originally conducted directly becomes conducted through the attacker. SQL injection attack is an attacker inserting malicious SQL code into the input field of the application to try to illegally access, tamper with or delete data in the database.

[0099] In this embodiment, the present invention provides corresponding defense measures for each network attack mode, which are:

[0100] (1) For denial of service attacks: Enable traffic cleaning services to filter out malicious traffic; increase bandwidth and server resources to improve anti-attack capabilities;

[0101] (2) For cross-site scripting attacks: escape user input to prevent the execution of malicious scripts; set security policies for HTTP response headers, such as CSP (Content Security Policy);

[0102] (3) Against man-in-the-middle attacks: Use encrypted communication protocols such as HTTPS to prevent data from being stolen or tampered with during transmission; adopt a secure identity authentication mechanism to ensure that the identities of both parties in the communication are authentic;

[0103] (4) Against SQL injection attacks: Strictly validate and filter input data to prevent the execution of malicious SQL code; use parameterized queries or ORM (object-relational mapping) framework to reduce the risk of SQL injection.

[0104] S4. According to the network attack pattern recognition result, determine whether there is potential network attack behavior; if so, trigger network attack defense measures.

[0105] In this embodiment, if the network attack pattern recognition result is normal, it is determined that there is no potential network attack behavior; if the network attack pattern recognition result is a certain network attack pattern, it is determined that there is a potential attack behavior.

[0106] In a preferred embodiment, after the network attack defense measure is triggered, the method further includes:

[0107] During the implementation of network attack defense measures, process information is recorded; wherein the process information includes: the type of defense measures, execution time and source information.

[0108] In this embodiment, source information refers to the source information of the network attack, which usually includes the source IP address, because the source IP address is an important clue to determine the location of the attacker; in addition to the source IP address, the source information also includes the port number used by the attacker, the time when the attack was launched, etc.

[0109] In a preferred embodiment, after the network attack defense measure is triggered, the method further includes:

[0110] Collect all attack detection related logs from firewalls, intrusion detection systems (IDS), security information and event management (SIEM) systems, or other security-related components;

[0111] Use a log parser or custom script to parse the collected logs and extract key information of the attack event, such as timestamp, attack type, source IP address, etc.; Data storage: Store the parsed attack event information in the database to facilitate subsequent query and statistics; the database table structure should contain necessary fields, such as attack ID, timestamp, attack type, source IP address, etc.;

[0112] Perform grouping and statistics based on attack type, source IP address, and other conditions as needed;

[0113] Generate test result reports periodically or in real time.

[0114] In a preferred embodiment, after obtaining the network traffic data, the method further includes:

[0115] Counting the number of first network attack events according to the network traffic data;

[0116] After the network attack defense measures are triggered, they also include:

[0117] After the implementation of network attack defense measures, continue to monitor network traffic data;

[0118] According to the network traffic data that continues to be monitored, the number of second network attack events is counted;

[0119] According to the number of the first network attack events and the number of the second network attack events, the implementation effect of the network attack defense measures is evaluated to obtain an evaluation result.

[0120] In this embodiment, the implementation results of the defense measures are as follows:

[0121] (1) Successfully blocked the attack: The defensive measures successfully blocked the attack, network traffic returned to normal, and the number of attack incidents decreased;

[0122] (2) Partially stopping the attack: defensive measures reduce the impact of the attack to some extent, but the attack is still not completely stopped;

[0123] (3) Failure to prevent attacks: Defense measures failed to effectively prevent attacks, and network traffic and the number of attack events remained high;

[0124] (4) False alarm and false blocking: Defense measures mistakenly identify normal traffic as attack and block it, causing normal services to be affected.

[0125] In a preferred embodiment, the present invention also provides a network attack simulation method, which conducts a comprehensive analysis and information collection on the target network or host according to the hacker's attack techniques, formulates a reasonable attack strategy, and actually launches an attack. This process is actually an in-depth test of the security of the target network or host to discover possible security vulnerabilities and weaknesses, which are used to detect the effectiveness of preventing attacks.

[0126] The network attack simulation method comprises:

[0127] Collect target information of this system through port scanning, vulnerability scanning and I CMP scanning;

[0128] Performing information analysis on the target information, and performing weakness mining in combination with a preset weakness and attack method database to obtain weakness information;

[0129] Determine the corresponding attack strategy based on the vulnerability information and in combination with a preset vulnerability and attack method database;

[0130] Implement the attack strategy to attack this system.

[0131] In a preferred embodiment, the types of evaluation results include: successfully blocking an attack, partially blocking an attack, failing to block an attack, and false alarms and false blocking;

[0132] After obtaining the evaluation results, it also includes:

[0133] When the evaluation result is partial attack blocking, failure to block the attack, or false alarm or false blocking, the network attack pattern recognition model and the network attack defense measures are optimized.

[0134] In this embodiment, optimization can be performed from the following aspects:

[0135] (1) Algorithm optimization: Aiming at the classification effect in the network attack pattern recognition model, the algorithm parameters and model structure can be continuously optimized to improve the classification accuracy and efficiency;

[0136] (2) Adjustment of defense measures: In response to attacks of different types and sources, defense strategies can be continuously adjusted and optimized to improve defense effectiveness and efficiency; the latest attack information from external threat intelligence sources, including attack patterns, attacker behavior characteristics, etc., can be collected and integrated in real time; threat intelligence can be combined with existing defense strategies to timely identify and defend known threats; in-depth analysis of attack traffic can be performed to extract attack characteristics and behavior patterns; machine learning or artificial intelligence algorithms can be used to automatically identify and classify new types of attacks; firewall rules and intrusion detection / prevention system (IDS / IPS) thresholds can be dynamically adjusted based on the type, frequency, and severity of the attack; adaptive security controls can be implemented, such as dynamic access control based on user behavior; security policy simulation tools can be used to simulate attacks in different scenarios and evaluate the effectiveness of existing defense strategies; policy parameters can be adjusted based on simulation results to optimize defense effectiveness.

[0137] Embodiment 2

[0138] Please refer to Figure 2 , is a schematic diagram of the structure of a network attack prevention device provided by an embodiment of the present invention, comprising: a data acquisition module, a network attack pattern recognition module and a network attack defense module;

[0139] The data acquisition module is used to acquire network traffic data through monitoring points set up on the network;

[0140] The network attack pattern recognition module is used to extract data packets from the network traffic data; classify the data packets through the network attack pattern recognition model to obtain network attack pattern recognition results;

[0141] The network attack defense module is used to determine whether there is a potential network attack behavior based on the network attack pattern recognition result; if so, trigger the network attack defense measures;

[0142] The training process of the network attack pattern recognition model includes:

[0143] Acquire a number of normal network traffic data samples and a number of network traffic data samples with potential anomalies; wherein the normal network traffic data samples are marked as normal, and the network traffic data samples with potential anomalies are marked as corresponding network attack patterns;

[0144] For each of the network traffic data samples, extracting a data packet from the network traffic data sample;

[0145] Constructing an initial neural network model, taking the data packets corresponding to each of the network traffic data samples as input and taking the labels predicted by each of the network traffic data samples as output, and training the neural network model;

[0146] The trained neural network model is used as the network attack pattern recognition model.

[0147] Embodiment 3

[0148] Accordingly, an embodiment of the present invention provides a terminal device, which includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and when the processor executes the computer program, the network attack prevention method described in the above-mentioned embodiment of the invention is implemented.

[0149] Embodiment 4

[0150] Accordingly, an embodiment of the present invention provides a storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute the network attack prevention method described in the above-mentioned embodiment of the invention.

[0151] In summary, the present invention provides a network attack prevention method, apparatus, terminal device and storage medium, which can implement the monitoring of network traffic data, and can also prevent potential network attacks and trigger defense measures in advance based on the monitored network traffic data.

[0152] It should be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the accompanying drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art may understand and implement it without paying any creative effort.

[0153] Those skilled in the art can clearly understand that, for the sake of convenience and brevity, the specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0154] The terminal device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The terminal device may include, but is not limited to, a processor and a memory.

[0155] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the device, and various interfaces and lines are used to connect various parts of the entire device.

[0156] The memory can be used to store the computer program, and the processor realizes various functions of the device by running or executing the computer program stored in the memory and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created according to the use of the mobile phone, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (FlashCard), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0157] The storage medium is a storage medium, and the computer program is stored in the storage medium. When the computer program is executed by the processor, the steps of each method embodiment described above can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form, etc. The computer readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer readable media do not include electric carrier signals and telecommunication signals.

[0158] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A network attack prevention method, characterized in that: include: Obtain network traffic data through monitoring points set up on the network; extracting data packets from the network traffic data; Classifying the data packets through a network attack pattern recognition model to obtain a network attack pattern recognition result; According to the network attack pattern recognition result, determine whether there is a potential network attack behavior; If so, cyber attack defense measures are triggered; The training process of the network attack pattern recognition model includes: Acquire a number of normal network traffic data samples and a number of network traffic data samples with potential anomalies; wherein the normal network traffic data samples are marked as normal, and the network traffic data samples with potential anomalies are marked as corresponding network attack patterns; For each of the network traffic data samples, extracting a data packet from the network traffic data sample; Constructing an initial neural network model, taking the data packets corresponding to each of the network traffic data samples as input and taking the labels predicted by each of the network traffic data samples as output, and training the neural network model; The trained neural network model is used as the network attack pattern recognition model.

2. The network attack prevention method according to claim 1, characterized in that: The obtaining of network traffic data includes: Get network traffic information through system commands; or, Obtain network traffic information by scanning the target system; or, Obtain network traffic information through network sniffing technology.

3. The network attack prevention method according to claim 1, characterized in that: The data packet includes: source IP address, destination IP address, data packet size and transmission time; The extracting of data packets from the network traffic data comprises: Extracting data packets from the network traffic data using a packet capture tool; or, by extracting data packets from the network traffic data using network traffic filtering technology at the monitoring point; or, A packet capture library provided by a programming language is used to extract packets from the network traffic data.

4. The network attack prevention method according to claim 1, characterized in that: The network attack modes include: denial of service attack, cross-site scripting attack, man-in-the-middle attack and SQL injection attack; The triggering of network attack defense measures includes: Take different defense measures for different attack modes; Among them, defense measures against denial of service attacks include: enabling traffic cleaning services to filter out malicious traffic and increasing bandwidth and service resources; Defense measures against cross-site scripting attacks include: escaping user input and setting security policies for HTTP response headers; Defense measures against man-in-the-middle attacks include: using encrypted communication protocols and adopting authentication mechanisms; Defenses against SQL injection attacks include: validating and filtering input data, and using parameterized queries or object-relational mapping frameworks.

5. The network attack prevention method according to claim 1, characterized in that: After the network attack defense measures are triggered, they also include: During the implementation of network attack defense measures, process information is recorded; wherein the process information includes: the type of defense measures, execution time and source information.

6. The network attack prevention method according to claim 1, characterized in that: After obtaining network traffic data, it also includes: Counting the number of first network attack events according to the network traffic data; After the network attack defense measures are triggered, they also include: After the implementation of network attack defense measures, continue to monitor network traffic data; According to the network traffic data that continues to be monitored, the number of second network attack events is counted; According to the number of the first network attack events and the number of the second network attack events, the implementation effect of the network attack defense measures is evaluated to obtain an evaluation result.

7. The network attack prevention method according to claim 6, characterized in that: The types of evaluation results include: successfully blocking an attack, partially blocking an attack, failing to block an attack, and false positives and false blocking; After obtaining the evaluation results, it also includes: When the evaluation result is partial attack blocking, failure to block the attack, or false alarm or false blocking, the network attack pattern recognition model and the network attack defense measures are optimized.

8. A network attack prevention device, characterized in that: include: Data acquisition module, network attack pattern recognition module and network attack defense module; The data acquisition module is used to acquire network traffic data through monitoring points set up on the network; The network attack pattern recognition module is used to extract data packets from the network traffic data; classify the data packets through the network attack pattern recognition model to obtain network attack pattern recognition results; The network attack defense module is used to determine whether there is a potential network attack behavior based on the network attack pattern recognition result; If so, cyber attack defense measures are triggered; The training process of the network attack pattern recognition model includes: Acquire a number of normal network traffic data samples and a number of network traffic data samples with potential anomalies; wherein the normal network traffic data samples are marked as normal, and the network traffic data samples with potential anomalies are marked as corresponding network attack patterns; For each of the network traffic data samples, extracting a data packet from the network traffic data sample; Constructing an initial neural network model, taking the data packets corresponding to each of the network traffic data samples as input and taking the labels predicted by each of the network traffic data samples as output, and training the neural network model; The trained neural network model is used as the network attack pattern recognition model.

9. A terminal device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, the network attack prevention method according to any one of claims 1 to 7 is implemented.

10. A storage medium, characterized in that: The storage medium includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute the network attack prevention method according to any one of claims 1 to 7.

Images