Man-machine attack behavior classification method and device and network security protection method

Abstract

The invention relates to the technical field of network security, and discloses a man-machine attack behavior classification method and device and a network security protection method, and the man-machine attack behavior classification method comprises the steps: obtaining man-machine attack behavior data; performing feature extraction on the man-machine attack behavior data, and constructing a classification rule based on the extracted features; updating the constructed classification rule to a cloud rule base; and performing rule matching on to-be-classified man-machine attack behavior data by using the updated cloud rule library, and outputting a classification result. According to the method, multi-dimensional information of attack behaviors is captured through feature extraction, and interpretable classification rules with high adaptability are constructed. Dynamic updating and rapid synchronization are achieved through the cloud rule base, novel attacks are coped in time, the newest rule is used during matching, the false alarm rate is reduced, the classification accuracy is improved, and reliable support is provided for network security protection.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and more specifically, to a method and device for classifying human-machine attack behaviors and a network security protection method. Background Art

[0002] At present, network security attacks have become an increasingly serious global problem. The endless network security incidents have caused huge losses to users and enterprises, and posed a major threat to social and economic development. Traditional detection methods, such as firewalls or encryption, are not enough to prevent all types of attacks. Therefore, in order to protect organizations and individuals from network attacks, the evolving network attack intrusion detection technology plays an important role in ensuring network security. In network security protection, it is particularly critical to accurately identify various attack categories in the network, among which the task of classifying human-machine attack behaviors is particularly arduous.

[0003] Existing intrusion detection technology is mainly implemented through two methods: misuse detection and anomaly detection. Anomaly detection-based technology is currently the most widely used network attack detection method, which can be divided into three categories: statistical-based, knowledge-based, and machine learning-based. Among them, machine learning-based anomaly detection technology, especially deep learning methods, has become an important solution for the classification and detection of network attack behaviors due to its excellent performance in processing complex and large-scale data. However, due to the complexity and variability of human-machine attack behaviors, including manual attacks, automated attacks, and hybrid attacks, many existing classification methods have low classification accuracy for human-machine attack behaviors. Summary of the invention

[0004] In order to overcome the low accuracy of the existing human-machine attack behavior classification technology, the present invention proposes the following technical solutions:

[0005] In a first aspect, the present invention proposes a method for classifying human-machine attack behaviors, comprising:

[0006] Obtain human-machine attack behavior data.

[0007] Feature extraction is performed on the human-machine attack behavior data, and classification rules are constructed based on the extracted features.

[0008] Update the constructed classification rules to the cloud rule base.

[0009] The updated cloud rule library is used to match the rules of the human-machine attack behavior data to be classified and output the classification results.

[0010] As a preferred technical solution, the extracted features include the number of requests per unit time, the periodicity of the request time interval, the frequency of access to a specific URL path, the degree of abnormality of parameter combinations, and the frequency of access to sensitive pages.

[0011] As a preferred technical solution, the constructing of classification rules based on the extracted features includes constructing classification rules based on preset expert experience rules and / or constructing classification rules based on a decision tree algorithm.

[0012] As a preferred technical solution, the expert classification rules constructed based on preset expert experience rules include:

[0013] When the number of requests per unit time in the human-machine attack behavior data exceeds a preset threshold, the current human-machine attack behavior is marked as an automated attack.

[0014] When the request time interval in the human-machine attack behavior data periodically exceeds a preset threshold, the current human-machine attack behavior is marked as an automated attack.

[0015] When the access frequency of a specific URL path in the human-machine attack behavior data exceeds a preset threshold, the current human-machine attack behavior is marked as a manual attack.

[0016] When the abnormality of the parameter combination in the human-machine attack behavior data exceeds the preset threshold, the current human-machine attack behavior is marked as a manual attack.

[0017] When the sensitive page access frequency and parameter combination abnormality in the human-machine attack behavior data exceed their respective preset thresholds at the same time, the current human-machine attack behavior is marked as a human-machine hybrid attack.

[0018] When the request time interval periodicity and sensitive page access frequency in the human-machine attack behavior data simultaneously exceed their respective preset thresholds, the behavior is marked as a human-machine hybrid attack.

[0019] As a preferred technical solution, building classification rules based on the decision tree algorithm includes at least one of the following:

[0020] The nodes of the decision tree are constructed by utilizing the characteristics of the human-machine attack behavior data. The nodes of the decision tree include leaf nodes and root nodes.

[0021] The splitting condition of each non-node in the decision tree is set as the judgment threshold of the feature, and the attack type corresponding to each node of the decision tree is marked to obtain the decision tree.

[0022] The decision tree is trained and pruned, and classification rules are extracted from the trained decision tree, where each classification rule corresponds to a path from a root node to a leaf node.

[0023] Each path is converted into a classification rule in the form of if-then conditional statements, where the if part is the judgment condition of each node on the path, and the then part is the attack type corresponding to the leaf node.

[0024] As a preferred technical solution, after updating the constructed classification rules to the cloud rule base, and before using the updated cloud rule base to perform rule matching on the human-machine attack behavior data, the method further includes:

[0025] Assign a weight to each classification rule based on the preset conditions.

[0026] Arrange each classification rule in descending order according to its weight.

[0027] As a preferred technical solution, the updated cloud rule library is used to match the human-machine attack behavior data to be classified, and the classification results are output, including:

[0028] Extract feature values ​​from the human-machine attack behavior data to be classified.

[0029] According to the weight sorting of the classification rules, the characteristic values ​​of the human-machine attack behavior data are compared with the conditions in the classification rules in turn.

[0030] When the characteristic value of the human-machine attack behavior data meets the conditions of a certain classification rule, the attack type corresponding to the classification rule is used as the classification result of the current human-machine attack behavior.

[0031] As a preferred technical solution, after outputting the classification result, the method further includes:

[0032] When the classification result is an incorrect classification result, it is determined whether the expert classification rule is misjudged. If so, the conditions of the expert classification rule are modified. If not, the parameters of the decision tree are optimized and updated.

[0033] In a second aspect, the present invention further provides a human-machine attack behavior classification device, which is applied to the human-machine attack behavior classification method as described in any solution of the first aspect, comprising:

[0034] The acquisition module is used to obtain human-machine attack behavior data.

[0035] The construction module is used to extract features from the human-machine attack behavior data and construct classification rules based on the extracted features.

[0036] The update module is used to update the constructed classification rules to the cloud rule base.

[0037] The matching module is used to use the updated cloud rule library to perform rule matching on the human-machine attack behavior data to be classified and output the classification results.

[0038] In a third aspect, the present invention further proposes a network security protection method, characterized in that the network security protection method realizes human-machine attack behavior identification based on the human-machine attack behavior classification method described in any scheme of the first aspect.

[0039] The beneficial effects of the present invention include at least:

[0040] (1) The human-machine attack behavior classification method proposed in the present invention can capture the multi-dimensional characteristics of the attack behavior by acquiring the human-machine attack behavior data and performing feature extraction, and provide a rich information basis for the subsequent construction of classification rules, so that the generated rules have both strong interpretability and can adapt to complex and changeable attack modes. The constructed classification rules are updated to the cloud rule library, and the dynamic update and rapid synchronization of the rules are realized, so that new attack behaviors can be responded to in a timely manner and the classification accuracy can be continuously improved. When performing rule matching, the updated cloud rule library is used to match the human-machine attack behavior data to be classified, making full use of the latest classification knowledge, ensuring the timeliness of the classification results, effectively reducing the false alarm rate, and significantly improving the accuracy of the human-machine attack behavior classification, providing more reliable technical support for network security protection.

[0041] (2) The network security protection method proposed in the present invention can make full use of the precise identification capability provided by the human-machine attack behavior classification method, take targeted protection measures against different types of malicious attacks, and improve the overall security protection level. This differentiated protection based on precise identification can not only effectively block various types of malicious attacks, but also greatly improve the overall protection effect, providing reliable protection for the network security of enterprises and users. Compared with traditional single defense methods, this method significantly enhances the efficiency and accuracy of network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 This is a flow chart of the human-machine attack behavior classification method provided in Example 1.

[0043] Figure 2 This is an architectural diagram of the human-machine attack behavior classification method provided in Example 1.

[0044] Figure 3 This is a schematic diagram of the human-machine attack behavior classification method provided in Example 2.

[0045] Figure 4 This is a schematic diagram of the principle of constructing classification rules based on the decision tree algorithm provided in Example 2.

[0046] Figure 5 This is an architectural diagram of the human-machine attack behavior classification device provided in Example 3.

[0047] Figure 6 This is a schematic diagram of the structure of an electronic device provided in Example 5. DETAILED DESCRIPTION

[0048] The following will describe the embodiments of the present invention with reference to the accompanying drawings and preferred technical solutions. Those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be understood that the preferred technical solutions are only for illustrating the present invention, not for limiting the scope of protection of the present invention.

[0049] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and thus the drawings only show components related to the present invention rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0050] In the following description, numerous details are discussed to provide a more thorough explanation of the embodiments of the present invention. However, it is obvious to those skilled in the art that the embodiments of the present invention can be implemented without these specific details. In other embodiments, well-known structures and devices are shown in the form of block diagrams rather than in detail to avoid making the embodiments of the present invention difficult to understand.

[0051] It should be understood that the rule model of the embodiment of the present invention is an artificial intelligence algorithm that makes decisions and inferences based on a set of clearly defined rules. It is suitable for decision-making mechanisms that require interpretability, situations where problems are relatively structured, or situations where expert knowledge can be clearly expressed. This model uses a predefined rule set to process and analyze input data and output data analysis results. Each rule in the rule set is usually composed of a rule antecedent (conditional part If) and a rule consequent (action part Then), forming an 'IF-THEN' structure. When the input data matches the rule antecedent, the corresponding rule consequent instruction is executed.

[0052] The following is an "IF-THEN" representation of the rule:

[0053] Rule antecedent (IF): defines the conditions for triggering the rule, which can be one or more logical expressions.

[0054] Rule consequent (THEN): defines the action to be performed when the condition is met.

[0055] For example:

[0056] Automated attack rules:

[0057] IF a certain IP address has made more than 100 requests AND within a short period of time (e.g. within 1 minute)

[0058] THEN it is considered an automated attack.

[0059] Manual attack rules:

[0060] IF the request contains abnormal parameter combinations, such as overly long strings, SQL injection features, etc.

[0061] THEN it is considered as a manual attack.

[0062] Human-machine hybrid attack rules:

[0063] IF a certain IP address frequently accesses specific sensitive pages in a short period of time AND the request contains attack features such as SQL injection.

[0064] THEN it is considered a human-machine hybrid attack.

[0065] It should be understood that the principle of the rule model is mainly based on logical reasoning and pattern matching, and mainly includes the following aspects:

[0066] 1) Knowledge solidification: Expert knowledge and business experience in the field are solidified in the form of rules. These rules reflect the actions that should be taken or the conclusions that should be drawn in specific situations.

[0067] 2) Logical expression: construct rules through a series of logical relationships. For example, use logical means such as conditional judgment and Boolean operations to describe various situations and corresponding processing methods.

[0068] 3) Logical reasoning: including forward reasoning and backward reasoning. Forward reasoning is to start from known facts and gradually deduce new facts according to rules. Backward reasoning is to start from the goal and reversely find the conditions that meet the goal.

[0069] 4) Pattern matching algorithm: Evaluate the input data or situations in the order of the set rules, and match the input information with the pattern defined in the rules. If the match is successful, act according to the instructions of the rule. At the same time, when processing a large number of rules, the rule model usually uses an efficient pattern matching algorithm (such as the Rete algorithm) to improve the efficiency of reasoning.

[0070] 5) Conflict resolution: When multiple rules are matched at the same time, the rule model needs to decide which rule to execute first. Common conflict resolution strategies include rule-based priority, latest matching rule priority, etc.

[0071] The human-machine attack behavior classification method based on the rule model requires a predefined rule base with high coverage and high accuracy. The rules should not only be arranged in descending order according to priority (the priority can be based on accuracy, coverage, total description length, order of rule generation, etc.), but also meet the following characteristics:

[0072] 1) Mutual Exclusivity: Each attack behavior data input is covered by at most one rule, and no two rules in the rule set are triggered at the same time.

[0073] 2) Exhaustiveness: For any combination of attribute values ​​of each attack behavior data, there is a rule to cover it, ensuring that each attack behavior data is covered by at least one rule.

[0074] Example 1

[0075] This embodiment proposes a human-machine attack behavior classification method, such as Figure 1 As shown, Figure 1 The present invention provides a flow chart of a method for classifying human-machine attack behaviors, which includes the following steps:

[0076] S1: Obtain human-machine attack behavior data.

[0077] S2: Extract features from the human-machine attack behavior data, and construct classification rules based on the extracted features.

[0078] S3: Update the constructed classification rules to the cloud rule base.

[0079] S4: Use the updated cloud rule library to perform rule matching on the human-machine attack behavior data to be classified and output the classification results.

[0080] like Figure 2 As shown, the architecture of the human-machine attack behavior classification method of this embodiment is as follows:

[0081] 1) User interface: Provides a visual interface for interaction with users, through which users can input attack behavior data, view the attack behavior classification results of the rule model, and modify the attack behavior classification rules in the rule library.

[0082] 2) Cloud rule base: stores all human-machine attack behavior classification rules. The rule base is the core of the rule model, and the quality and quantity of the rules directly affect the performance of the model.

[0083] 3) Working storage: stores the currently input attack behavior data and the classification results generated during the classification process, and records the data information used and generated during the classification process.

[0084] 4) Classification Engine: Responsible for matching rules and executing the classification process. It obtains the input attack behavior data from the working storage, processes and matches it according to the classification rules in the cloud rule base, and generates the identified attack behavior category output.

[0085] In the specific implementation process, first, users obtain human-machine attack behavior data through network security equipment or monitoring. These data may include network traffic logs, intrusion detection logs, HTTP request records, user behavior data, etc. For example, all HTTP requests initiated by an IP address within 5 minutes are recorded, including request time, URL, parameters and other information.

[0086] Then, feature extraction is performed on the acquired human-machine attack behavior data. The extracted features may include the number of requests per unit time, request time interval, URL access mode, parameter change frequency, etc. For example, the average request frequency of the IP address within 5 minutes, the standard deviation of the request time interval, the number of independent URLs visited, etc. are calculated.

[0087] Next, build classification rules based on the extracted features. This step can combine expert knowledge and machine learning algorithms. For example, set the rule: "If the number of requests per unit time exceeds 100 times, and the standard deviation of the request time interval is less than 0.1 seconds, it is judged as an automated attack." At the same time, use the decision tree algorithm to learn and generate supplementary rules based on historical data.

[0088] Subsequently, the newly constructed classification rules are updated to the cloud rule base. This may involve adding new rules, modifying the thresholds of existing rules, or adjusting the priority of rules. For example, the new rule is added to the cloud rule base and given a higher priority.

[0089] Finally, when new attack behavior data needs to be classified, the latest rule set is obtained from the cloud rule library, the data to be classified is feature extracted, and then matched with the conditions in the rule set. If the behavior characteristics of an IP meet the rule conditions of automated attacks, it will be classified as an automated attack and the corresponding classification results will be output.

[0090] It is understandable that by acquiring human-machine attack behavior data and performing feature extraction, the multi-dimensional characteristics of attack behavior can be captured, providing a rich information basis for the subsequent construction of classification rules, so that the generated rules are both highly interpretable and adaptable to complex and changing attack patterns. The constructed classification rules are updated to the cloud rule library to achieve dynamic update and rapid synchronization of rules, so that new attack behaviors can be responded to in a timely manner and the classification accuracy can be continuously improved. When matching rules, the updated cloud rule library is used to match the human-machine attack behavior data to be classified, making full use of the latest classification knowledge, ensuring the timeliness of the classification results, effectively reducing the false alarm rate, and significantly improving the accuracy of human-machine attack behavior classification, providing more reliable technical support for network security protection.

[0091] Example 2

[0092] This embodiment makes improvements based on the human-machine attack behavior classification method proposed in Embodiment 1, such as Figure 3 As shown, Figure 3 This is a schematic diagram of the human-machine attack behavior classification method provided in this embodiment.

[0093] In this embodiment, the extracted features include multi-dimensional features and proportion weights such as the sporadic nature of attack time intervals, the breadth of attack URLs, the proportion of successful status codes, the frequency of attack payload changes, attack duration, the number of single attacks, authentication information, the frequency of response content changes, as well as the number of requests per unit time, the periodicity of request time intervals, the frequency of access to specific URL paths, the abnormality of parameter combinations, and the frequency of access to sensitive pages.

[0094] As an example, first extract the raw data from the network log, and then calculate the various features. For example, when calculating the sporadic nature of the attack time interval, the standard deviation of the request time interval can be used. When calculating the breadth of the attack URL, the number of different URLs can be counted. When calculating the percentage of successful status codes, the proportion of HTTP 200 status codes can be counted. For the number of requests per unit time, the total number of requests is calculated within a fixed time window.

[0095] It is understandable that the extraction of multi-dimensional features provides a rich information basis for subsequent classification and can comprehensively characterize the characteristics of attack behavior. This multi-angle feature combination can effectively distinguish different types of attacks and improve the accuracy and robustness of classification.

[0096] In this embodiment, constructing classification rules based on the extracted features includes constructing classification rules based on preset expert experience rules and constructing classification rules based on a decision tree algorithm.

[0097] It is understandable that rules formulated by experts have the advantage of strong interpretability, but they rely too much on expert experience and are difficult to detect unknown attacks. Rules formulated based on machine learning algorithms have good scalability and adaptability, and have the ability to detect unknown attacks and threats. Combining the two to establish a cloud rule base, while dynamically optimizing the cloud rule base in real time, it can also achieve synchronous updates of each access point, thereby improving the intelligence and accuracy of the rule model.

[0098] In this embodiment, the expert classification rules constructed based on the preset expert experience rules include:

[0099] When the number of requests per unit time in the human-machine attack behavior data exceeds a preset threshold, the current human-machine attack behavior is marked as an automated attack.

[0100] When the request time interval in the human-machine attack behavior data periodically exceeds a preset threshold, the current human-machine attack behavior is marked as an automated attack.

[0101] When the access frequency of a specific URL path in the human-machine attack behavior data exceeds a preset threshold, the current human-machine attack behavior is marked as a manual attack.

[0102] When the abnormality of the parameter combination in the human-machine attack behavior data exceeds the preset threshold, the current human-machine attack behavior is marked as a manual attack.

[0103] When the sensitive page access frequency and parameter combination abnormality in the human-machine attack behavior data exceed their respective preset thresholds at the same time, the current human-machine attack behavior is marked as a human-machine hybrid attack.

[0104] When the request time interval periodicity and sensitive page access frequency in the human-machine attack behavior data simultaneously exceed their respective preset thresholds, the behavior is marked as a human-machine hybrid attack.

[0105] As an example, by monitoring network traffic in real time, when a behavior that meets the rules is detected, the corresponding classification is triggered immediately. For example, if it is detected that a certain IP has initiated more than 1,000 requests within 1 minute, it will be immediately marked as an automated attack.

[0106] It is understandable that expert rules can quickly identify typical attack patterns and provide real-time protection capabilities. These rules are simple and intuitive, easy to understand and adjust, and help administrators quickly respond to and handle attack behaviors.

[0107] In this embodiment, the classification rules are constructed based on the decision tree algorithm, including:

[0108] The nodes of the decision tree are constructed by utilizing the characteristics of the human-machine attack behavior data. The nodes of the decision tree include leaf nodes and root nodes.

[0109] The splitting condition of each non-node in the decision tree is set as the judgment threshold of the feature, and the attack type corresponding to each node of the decision tree is marked to obtain the decision tree.

[0110] The decision tree is trained and pruned, and classification rules are extracted from the trained decision tree, where each classification rule corresponds to a path from a root node to a leaf node.

[0111] Each path is converted into a classification rule in the form of if-then conditional statements, where the if part is the judgment condition of each node on the path, and the then part is the attack type corresponding to the leaf node.

[0112] As an example, we first train a decision tree model using historical attack data. During the training process, we select the most discriminative features as nodes, such as the number of requests per unit time. After the training is complete, we prune the decision tree to remove overfitting branches. Finally, we traverse each path of the decision tree to generate if-then rules.

[0113] For example, Figure 4 As shown, firstly, key features are extracted from the network log. In this embodiment, the key features mainly include: the number of requests per unit time, the request time interval, and whether the IP address is in the whitelist.

[0114] The structure of the decision tree is as follows: Root node A: Combines the number of single attacks and the attack time interval. Child nodes B and C: Branch based on whether the IP is in the whitelist. Weight = number of single attacks * 2 + 1 / attack time interval Input: An IP initiates 100 requests within 1 minute, with an average time interval of 0.6 seconds.

[0115] Classification process:

[0116] a) Calculate the weight of node A:

[0117] Weight = 100*2+1 / 0.6≈201.67

[0118] b) Due to the higher weight value, the system prioritizes evaluating this node.

[0119] c) Check whether the IP is in the white list. In this embodiment, the IP is not in the white list, so enter branch C.

[0120] d) Based on a preset threshold (for example, a weight > 200 is considered an automated attack), the behavior is classified as an automated attack.

[0121] It is understandable that decision tree algorithms can automatically discover patterns in data and generate more complex and sophisticated classification rules. This method can capture attack patterns that human experts may overlook and improve the ability to identify new types of attacks.

[0122] In this embodiment, a function mapping relationship between input and output is constructed based on the random forest and extreme gradient boosting decision tree methods, and a Bayesian optimization algorithm is introduced to optimize the number of input factors and algorithm hyperparameters to obtain the optimal hyperparameter combination of the model. Finally, the optimal classification rule for the objective function is obtained based on the optimal hyperparameter training.

[0123] In this embodiment, after updating the constructed classification rules to the cloud rule base, and before using the updated cloud rule base to perform rule matching on the human-machine attack behavior data, the method further includes:

[0124] Assign a weight to each classification rule based on the preset conditions.

[0125] Arrange each classification rule in descending order according to its weight.

[0126] As an exemplary illustration, a weight is assigned to each rule based on the accuracy, coverage, and other indicators of the rule. For example, the F1 score of the rule can be used as the weight. Then, the rules are sorted from high to low according to the weight.

[0127] It is understandable that by assigning weights and sorting, more reliable rules can be used for matching first, improving the accuracy and efficiency of classification. This method can effectively reduce false positives and false negatives while increasing processing speed.

[0128] In this embodiment, the updated cloud rule library is used to perform rule matching on the human-machine attack behavior data to be classified, and the classification results are output, including:

[0129] Extract feature values ​​from the human-machine attack behavior data to be classified.

[0130] According to the weight sorting of the classification rules, the characteristic values ​​of the human-machine attack behavior data are compared with the conditions in the classification rules in turn.

[0131] When the characteristic value of the human-machine attack behavior data meets the conditions of a certain classification rule, the attack type corresponding to the classification rule is used as the classification result of the current human-machine attack behavior.

[0132] As an example, when new attack behavior data enters, its feature values ​​are first extracted. Then, the feature values ​​of the data are compared with the rule conditions in the order of the rule weights. For example, if the number of requests per unit time of the data is 1500, the high-weight automated attack rules will be checked first. Once a matching rule is found, the corresponding attack type will be immediately output as the classification result.

[0133] It is understandable that this weight-based sequential matching method can quickly and accurately identify attack types, greatly improving response speed and accuracy. At the same time, because high-weight rules are used first, complex attack scenarios can be handled more effectively and the possibility of misjudgment can be reduced.

[0134] In this embodiment, after outputting the classification result, the method further includes:

[0135] When the classification result is an incorrect classification result, it is determined whether the expert classification rule is misjudged. If so, the conditions of the expert classification rule are modified. If not, the parameters of the decision tree are optimized and updated.

[0136] As an example, by continuously monitoring the accuracy of the classification results, when an incorrect classification is found, it will automatically determine whether it is the expert rule or the decision tree rule that makes the wrong judgment. For the expert rule misjudgment, it will recommend adjusting the relevant threshold. For the decision tree rule misjudgment, the decision tree model will be retrained with new data to optimize its parameters (such as the penalty coefficient).

[0137] It is understandable that this dynamic optimization mechanism enables continuous learning and adaptation to new attack patterns. Through continuous feedback and optimization, the classification accuracy will continue to improve over time. At the same time, this mechanism can also correct wrong rules in a timely manner to prevent the cumulative impact of wrong classification.

[0138] Example 3

[0139] like Figure 5 As shown, this embodiment proposes a human-machine attack behavior classification device, which is applied to the human-machine attack behavior classification method as described in the above embodiment, including: an acquisition module 100, a construction module 200, an update module 300 and a matching module 400.

[0140] The acquisition module 100 is used to acquire human-machine attack behavior data. The construction module 200 is used to extract features from the human-machine attack behavior data and construct classification rules based on the extracted features. The update module 300 is used to update the constructed classification rules to the cloud rule library. The matching module 400 is used to use the updated cloud rule library to perform rule matching on the human-machine attack behavior data to be classified and output the classification results.

[0141] It should be noted that the above explanation of the embodiment of the human-machine attack behavior classification method is also applicable to the human-machine attack behavior classification device of this embodiment, and will not be repeated here.

[0142] Example 4

[0143] This embodiment proposes a network security protection method, which realizes human-machine attack behavior identification based on the human-machine attack behavior classification method described in the above embodiment.

[0144] Specifically, the method first obtains network traffic data, and then uses the human-machine attack behavior classification method to analyze the data, accurately identifying different types of malicious behaviors such as automated attacks, manual attacks, and human-machine hybrid attacks. Based on these classification results, the network security protection method can flexibly adjust the protection strategy:

[0145] For automated attacks, you can take measures such as limiting the access frequency of suspicious IP addresses and deploying verification code recognition.

[0146] For manual attacks, in-depth behavioral analysis, traffic monitoring and other defensive measures can be used.

[0147] For human-machine hybrid attacks, the above-mentioned defense measures need to be adopted in combination.

[0148] It is understandable that this differentiated protection based on accurate identification can not only effectively block various malicious attacks, but also greatly improve the overall protection effect, providing reliable protection for the network security of enterprises and users. Compared with the traditional single defense method, this method significantly enhances the intelligence and precision of network security protection.

[0149] As an example, in an edge computing environment, due to low resource allocation, it is difficult to deploy enterprise-level firewalls or WAF devices. In such scenarios, the network security protection method proposed in this embodiment can obtain network traffic data of edge nodes in real time, analyze the data using pre-built classification rules, accurately identify different types of malicious behaviors such as automated attacks, manual attacks, and human-machine hybrid attacks, and effectively improve the overall security protection capabilities of edge nodes.

[0150] As an example, in an enterprise network environment, first obtain the network traffic data of each department and office area within the enterprise, and use the updated cloud rule library to analyze and match the internal network traffic data of the enterprise, which can accurately identify various malicious attack behaviors. Once an abnormal situation is found, targeted protection measures can be taken according to the type of attack, such as restricting access to suspicious IPs, deploying verification codes, etc. to defend against automated attacks, or conducting behavioral analysis, traffic monitoring, etc. to defend against manual attacks.

[0151] Example 5

[0152] This embodiment provides an electronic device, Figure 6 The electronic device 500 provided in this embodiment is a schematic diagram of the structure of the electronic device 500. The electronic device 500 includes: a memory 501, a processor 502, and a computer program stored in the memory 501 and executable on the processor 502.

[0153] When the processor 502 executes the program, a human-machine attack behavior classification method provided in the above embodiment is implemented.

[0154] Furthermore, the electronic device 500 also includes: a communication interface 503 for communication between the memory 501 and the processor 502 .

[0155] The memory 501 may include a high-speed RAM (Random Access Memory) memory, and may also include a non-volatile memory, such as at least one disk memory.

[0156] If the memory 501, the processor 502 and the communication interface 503 are implemented independently, the communication interface 503, the memory 501 and the processor 502 can be connected to each other through a bus and communicate with each other. The bus can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component) bus or an EISA (Extended Industry Standard Architecture) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0157] Optionally, in a specific implementation, if the memory 501, the processor 502 and the communication interface 503 are integrated on a chip, the memory 501, the processor 502 and the communication interface 503 can communicate with each other through an internal interface.

[0158] The processor 502 may be a CPU (Central Processing Unit), or an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the present embodiment.

[0159] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms are not necessarily directed to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or N embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0160] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "N" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0161] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0162] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiment, the N steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array, a field programmable gate array, etc.

[0163] A person skilled in the art may understand that all or part of the steps in the above-mentioned embodiment method may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0164] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the present invention, and are not intended to limit the embodiments of the present invention. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the embodiments here. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the claims of the present invention.

Claims

1. A method for classifying human-machine attack behaviors, characterized in that: include: Obtain human-machine attack behavior data; Extracting features from the human-machine attack behavior data, and constructing classification rules based on the extracted features; Update the constructed classification rules to the cloud rule base; The updated cloud rule library is used to match the rules of the human-machine attack behavior data to be classified and output the classification results.

2. The human-machine attack behavior classification method according to claim 1 is characterized in that: The extracted features include the number of requests per unit time, the periodicity of request time intervals, the frequency of access to specific URL paths, the degree of abnormality of parameter combinations, and the frequency of access to sensitive pages.

3. The human-machine attack behavior classification method according to claim 2 is characterized in that: The constructing of classification rules based on the extracted features includes constructing classification rules based on preset expert experience rules and / or constructing classification rules based on a decision tree algorithm.

4. The human-machine attack behavior classification method according to claim 3 is characterized in that: The expert classification rules constructed based on the preset expert experience rules include at least one of the following: When the number of requests per unit time in the human-machine attack behavior data exceeds the preset threshold, the current human-machine attack behavior is marked as an automated attack; When the request time interval in the human-machine attack behavior data periodically exceeds a preset threshold, the current human-machine attack behavior is marked as an automated attack; When the access frequency of a specific URL path in the human-machine attack behavior data exceeds a preset threshold, the current human-machine attack behavior is marked as a manual attack; When the abnormality of the parameter combination in the human-machine attack behavior data exceeds the preset threshold, the current human-machine attack behavior is marked as a manual attack; When the sensitive page access frequency and parameter combination abnormality in the human-machine attack behavior data exceed their respective preset thresholds at the same time, the current human-machine attack behavior is marked as a human-machine hybrid attack; When the request time interval periodicity and sensitive page access frequency in the human-machine attack behavior data simultaneously exceed their respective preset thresholds, the behavior is marked as a human-machine hybrid attack.

5. The method for classifying human-machine attack behaviors according to claim 3 is characterized in that: Building classification rules based on decision tree algorithm, including: Constructing nodes of a decision tree using the characteristics of human-machine attack behavior data; the nodes of the decision tree include leaf nodes and root nodes; Set the splitting condition of each non-node in the decision tree as the judgment threshold of the feature, and mark the attack type corresponding to each node of the decision tree to obtain the decision tree; Train and prune the decision tree, and extract classification rules from the trained decision tree, where each classification rule corresponds to a path from the root node to the leaf node; Each path is converted into a classification rule in the form of if-then conditional statements, where the if part is the judgment condition of each node on the path, and the then part is the attack type corresponding to the leaf node.

6. The method for classifying human-machine attack behaviors according to claim 4 or 5, characterized in that: After updating the constructed classification rules to the cloud rule base, and before using the updated cloud rule base to perform rule matching on the human-machine attack behavior data, the method further includes: Assign weights to each classification rule based on preset conditions; Arrange each classification rule in descending order according to its weight.

7. The method for classifying human-machine attack behaviors according to claim 6, characterized in that: Use the updated cloud rule library to match the human-machine attack behavior data to be classified and output the classification results, including: Extracting feature values ​​from human-machine attack behavior data to be classified; According to the weight sorting of the classification rules, the characteristic values ​​of the human-machine attack behavior data are compared with the conditions in the classification rules in turn; When the characteristic value of the human-machine attack behavior data meets the conditions of a certain classification rule, the attack type corresponding to the classification rule is used as the classification result of the current human-machine attack behavior.

8. The method for classifying human-machine attack behaviors according to claim 3 is characterized in that: After outputting the classification result, the method further includes: When the classification result is an incorrect classification result, it is determined whether the expert classification rule is misjudged. If so, the conditions of the expert classification rule are modified. If not, the parameters of the decision tree are optimized and updated.

9. A human-machine attack behavior classification device, characterized in that: include: An acquisition module is used to obtain human-machine attack behavior data; A construction module is used to extract features from the human-machine attack behavior data and construct classification rules based on the extracted features; An update module, used to update the constructed classification rules to the cloud rule base; The matching module is used to use the updated cloud rule library to perform rule matching on the human-machine attack behavior data to be classified and output the classification results.

10. A network security protection method, characterized in that: The network security protection method realizes human-machine attack behavior identification based on the human-machine attack behavior classification method described in any one of claims 1 to 8.

Images