Network attack protection method and device based on log analysis and computer equipment

Abstract

The invention relates to a network attack protection method and device based on log analysis and computer equipment. The method comprises the steps of obtaining log information of a firewall and flow data of the firewall, and matching dynamic rules corresponding to the log information through a session identification program based on the log information and the flow data; identifying an attack access request in the log information through the dynamic rule corresponding to the log information on the basis of the log information under the condition that the dynamic rule corresponding to the log information exists, and identifying the attack access request in the log information through a rule matching strategy on the basis of the log information under the condition that the dynamic rule corresponding to the log information does not exist. Identifying a target matching rule corresponding to the log information; and based on the target matching rule of the log information, identifying an attack access request of the log information, and carrying out request interception processing on the attack access request. By adopting the method, the security protection effect on a novel network attack means can be improved.

Description

Technical Field

[0001] The present application relates to the technical field of binary code file homology analysis, and in particular to a network attack protection method, device and computer equipment based on log analysis. Background Art

[0002] With the rapid development of the Internet, the forms and means of network attacks are becoming increasingly complex and diverse. Web applications have become one of the main targets of attackers because they are often exposed to the Internet and carry a large amount of sensitive data. Web application firewalls (WAFs) are important tools for protecting Web applications from various attacks. Traditional WAFs mainly rely on predefined static rules and signature libraries to detect and intercept malicious traffic. These rules and signature libraries are based on known attack patterns and features, such as specific URL patterns, parameters, and values. However, this rule-based protection method has a lag in updates, is difficult to deal with new and variant attacks, and cannot actively defend. Therefore, how to improve the defense effect of the web against new and variant attacks is the current research focus.

[0003] The existing defense method for network attacks is to combine the attack method and attack data of the network attack, and then use preset programs such as firewalls (WAF) to protect against network attacks. However, the hiding and camouflage methods of new attacks are strong, and the recognition is poor, which makes the Internet's prevention and control measures against new network attacks weak, resulting in poor security protection against new network attacks. Summary of the invention

[0004] Based on this, it is necessary to provide a network attack protection method, device, computer equipment, computer-readable storage medium and computer program product based on log analysis to address the above technical problems.

[0005] In a first aspect, the present application provides a network attack protection method based on log analysis, comprising:

[0006] Obtaining each log information of the firewall and each flow data of the firewall, and matching the dynamic rules corresponding to each log information through a session identification program based on each log information and each flow data;

[0007] In the case where there is a dynamic rule corresponding to the log information, based on the log information, identifying the attack access request in the log information through the dynamic rule corresponding to the log information, and in the case where there is no dynamic rule corresponding to the log information, based on the log information, identifying the target matching rule corresponding to the log information through a rule matching strategy;

[0008] Based on the target matching rule of the log information, the attack access request of the log information is identified, and the attack access request is intercepted and processed.

[0009] Optionally, matching the dynamic rules corresponding to each log information through a session identification program based on each log information and each flow data includes:

[0010] For each flow data, the current protection rules of the system are collected, and the flow data is subjected to session identification processing according to the current protection rules to obtain the current access request information corresponding to the flow data;

[0011] Based on the log information and the current access request information, a dynamic rule corresponding to the log information is matched in a dynamic rule database.

[0012] Optionally, the identifying, based on the log information and by a dynamic rule corresponding to the log information, the attack access request in the log information includes:

[0013] Identify dynamic verification information corresponding to the log information, and identify request behavior information of current access request information corresponding to the log information and device fingerprint information corresponding to the current access request information through the dynamic rules corresponding to the log information and the dynamic verification information;

[0014] Based on the device fingerprint information and the access request information, it is determined whether the device fingerprint information is an abnormal fingerprint, and when the device fingerprint information is an abnormal fingerprint, the access request information is used as an attack access request in the log information.

[0015] Optionally, the identifying, based on the log information, a target matching rule corresponding to the log information through a rule matching strategy includes:

[0016] Based on the current protection rule, in each of the log information and each of the traffic data, each of the target log information and each of the target traffic data is screened, and each of the target log information and each of the target traffic data is clustered to obtain each aggregate information group;

[0017] The target matching rule corresponding to each aggregate information group is identified through the rule matching strategy, and the target matching rule corresponding to each aggregate group is used as the target matching rule of each target log information of each aggregate information group.

[0018] Optionally, the identifying the attack access request of the log information based on the target matching rule of the log information includes:

[0019] Based on the target matching rule of the log information, identifying the matching value of each matching condition of the target matching rule for the current request information corresponding to the log information;

[0020] When all matching conditional matching values ​​are greater than the matching threshold of each matching condition, the current request information corresponding to the log information is used as an attack access request.

[0021] Optionally, intercepting the attack access request includes:

[0022] When the attack access request is current access request information corresponding to the log information with dynamic rules, the attack access request is subjected to access interception processing by using a preset access interception strategy;

[0023] When the attack access request is not the current access request information corresponding to the log information for which the dynamic rule exists, a new dynamic rule for the log information corresponding to the attack access request and an active defense code for the log information corresponding to the attack access request are generated, and the new dynamic rule and the active defense code are transmitted to the current protection rule;

[0024] The attack access request is intercepted and processed by using a preset access interception strategy.

[0025] In a second aspect, the present application also provides a network attack protection device based on log analysis, comprising:

[0026] An acquisition module, used for acquiring various log information of the firewall and various flow data of the firewall, and matching dynamic rules corresponding to each log information through a session identification program based on each log information and each flow data;

[0027] an identification module, configured to identify the attack access request in the log information based on the log information and through the dynamic rule corresponding to the log information if there is a dynamic rule corresponding to the log information, and to identify the target matching rule corresponding to the log information based on the log information and through a rule matching strategy if there is no dynamic rule corresponding to the log information;

[0028] The interception module is used to identify the attack access request of the log information based on the target matching rule of the log information, and perform request interception processing on the attack access request.

[0029] Optionally, the acquisition module is specifically used to:

[0030] For each flow data, the current protection rules of the system are collected, and the flow data is subjected to session identification processing according to the current protection rules to obtain the current access request information corresponding to the flow data;

[0031] Based on the log information and the current access request information, a dynamic rule corresponding to the log information is matched in a dynamic rule database.

[0032] Optionally, the identification module is specifically used to:

[0033] Identify dynamic verification information corresponding to the log information, and identify request behavior information of current access request information corresponding to the log information and device fingerprint information corresponding to the current access request information through the dynamic rules corresponding to the log information and the dynamic verification information;

[0034] Based on the device fingerprint information and the access request information, it is determined whether the device fingerprint information is an abnormal fingerprint, and when the device fingerprint information is an abnormal fingerprint, the access request information is used as an attack access request in the log information.

[0035] Optionally, the identification module is specifically used to:

[0036] Based on the current protection rule, in each of the log information and each of the traffic data, each of the target log information and each of the target traffic data is screened, and each of the target log information and each of the target traffic data is clustered to obtain each aggregate information group;

[0037] The target matching rule corresponding to each aggregate information group is identified through the rule matching strategy, and the target matching rule corresponding to each aggregate group is used as the target matching rule of each target log information of each aggregate information group.

[0038] Optionally, the interception module is specifically used to:

[0039] Based on the target matching rule of the log information, identifying the matching value of each matching condition of the target matching rule for the current request information corresponding to the log information;

[0040] When all matching conditional matching values ​​are greater than the matching threshold of each matching condition, the current request information corresponding to the log information is used as an attack access request.

[0041] Optionally, the interception module is specifically used to:

[0042] When the attack access request is current access request information corresponding to the log information with dynamic rules, the attack access request is subjected to access interception processing by using a preset access interception strategy;

[0043] When the attack access request is not the current access request information corresponding to the log information for which the dynamic rule exists, a new dynamic rule for the log information corresponding to the attack access request and an active defense code for the log information corresponding to the attack access request are generated, and the new dynamic rule and the active defense code are transmitted to the current protection rule;

[0044] The attack access request is intercepted and processed by using a preset access interception strategy.

[0045] In a third aspect, the present application provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of any one of the methods in the first aspect are implemented.

[0046] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the steps of any one of the methods in the first aspect are implemented.

[0047] In a fifth aspect, the present application provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the steps of any one of the methods in the first aspect are implemented.

[0048] The above-mentioned network attack protection method, device and computer equipment based on log analysis obtain each log information of the firewall and each flow data of the firewall, and match the dynamic rules corresponding to each log information through the session identification program based on each log information and each flow data; in the case where there is a dynamic rule corresponding to the log information, based on the log information, through the dynamic rule corresponding to the log information, identify the attack access request in the log information, and in the case where there is no dynamic rule corresponding to the log information, based on the log information, through the rule matching strategy, identify the target matching rule corresponding to the log information; based on the target matching rule of the log information, identify the attack access request of the log information, and intercept the attack access request. This solution realizes active defense against threat traffic by real-time full analysis of log data, combined with dynamic encapsulation and dynamic verification. Through a series of means such as dynamic encapsulation, dynamic verification, user behavior, device fingerprint verification, and JS challenge / verification code, the flexibility and effectiveness of defense measures are enhanced, and a certain defense capability is possessed against advanced Bots. Finally, this solution introduces advanced log analysis, real-time statistical processing and active defense technology on the basis of traditional WAF, which significantly improves the network security protection capability and adapts to the current complex and changing network security environment. It also improves the security protection effect against new network attack methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0050] Figure 1 A schematic diagram of a flow chart of a network attack protection method based on log analysis in one embodiment;

[0051] Figure 2 A flowchart of an example of network attack protection based on log analysis in one embodiment;

[0052] Figure 3 is a structural block diagram of a network attack protection device based on log analysis in an embodiment;

[0053] Figure 4 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0055] The network attack protection method based on log analysis provided in the embodiment of the present application can be applied to the application environment of dietary control. Among them, the method can be applied to the terminal, can also be applied to the server, can also be applied to the system including the terminal and the server, and is realized through the interaction between the terminal and the server. Among them, the terminal can be, but not limited to, various personal computers, laptops, etc. Among them, the terminal realizes active defense against threatening traffic by analyzing the log data in real time and in full, combined with dynamic encapsulation and dynamic verification. Through a series of means such as dynamic encapsulation, dynamic verification, user behavior, device fingerprint verification, and JS challenge / verification code, the flexibility and effectiveness of the defense measures are enhanced, and a certain defense capability is possessed against advanced Bots. Finally, this solution introduces advanced log analysis, real-time statistical processing and active defense technology on the basis of traditional WAF, which significantly improves the network security protection capability and adapts to the current complex and changeable network security environment. Thereby improving the security protection effect against new network attack means.

[0056] In an exemplary embodiment, Figure 1 As shown, a network attack protection method based on log analysis is provided, and the method is applied to a terminal as an example for explanation, including the following steps S101 to S103. Among them:

[0057] Step S101, obtaining various log information of the firewall and various flow data of the firewall, and matching dynamic rules corresponding to various log information through a session identification program based on various log information and various flow data.

[0058] In this embodiment, the terminal reads the security log and access log of the WAF engine in real time through the shared memory, and reads the traffic data of the WAF in real time through the shared memory (only necessary fields), and then the terminal parses the log and traffic data according to the custom delimiter or regular expression, and after parsing, supports removing useless fields and retaining only useful fields, and obtains the log information of the firewall and the traffic data of the firewall. Then, the terminal matches the dynamic rules corresponding to each log information through the session identification program set in the analysis program of the firewall. Among them, the analysis program is mainly divided into two parts: bot-gather and bot-statr. Bot-Gather runs on each engine node, responsible for collecting the WAF logs and necessary data of the local machine, performing session identification on the traffic, and judging whether the current session has corresponding dynamic rules: if so, dynamic verification, fingerprint verification and behavior analysis, etc. are performed, and the traffic that fails the verification is handled; if not, rule condition matching is performed, pre-aggregation is performed, and the pre-aggregated data is sent to redis for processing. Bot-Statr runs on a separate central server and supports multiple deployments. It is responsible for consuming the pre-aggregated data of the same tenant according to the tenant dimension, aggregating the entire network, and performing network-wide statistics and rule threshold judgment according to the statistical dimension configured by the Bot rule. If it is found that the rule threshold is exceeded, a dynamic rule corresponding to the session and a JS code to be inserted into the front end (if active defense is configured) will be generated, and broadcast to the Bot-Gather of the entire network through MQ (reusing redis). The specific matching process will be explained in detail later. Among them, the entire system only introduces redis as the message middleware (very lightweight compared to other MQs), and the other two modules are written in golang. Bot-Gather and Bot-Statr can be compiled into executable files separately for easy deployment and operation and maintenance.

[0059] Step S102, in the case where there are dynamic rules corresponding to the log information, based on the log information, through the dynamic rules corresponding to the log information, identify the attack access request in the log information, and in the case where there are no dynamic rules corresponding to the log information, based on the log information, through the rule matching strategy, identify the target matching rule corresponding to the log information.

[0060] In this embodiment, when there are dynamic rules corresponding to the log information, the terminal identifies the attack access request in the log information based on the log information and through the dynamic rules corresponding to the log information. Among them, the terminal supports configuration management, receives various configurations issued by the management platform (configuration issued by the tenant), and supports configuration restart recovery; supports session identification of traffic according to the currently configured Bot rules; supports storage and expiration aging of dynamic rules. Then, the terminal queries the dynamic rules according to the session identification results; in the absence of dynamic rules corresponding to the log information, based on the log information, through the rule matching strategy, identifies the target matching rules corresponding to the log information. Among them, the terminal supports rule matching of traffic according to the currently configured Bot rules, filtering out traffic and logs that do not meet the matching conditions; supports caching and pre-aggregation of traffic and matching results that meet the matching conditions in memory; supports regular hash bucketing of pre-aggregated data according to tenant ID, and distribution to the central redis to ensure that the data of the same tenant can be allocated to the same queue; supports concurrent processing. The specific identification process will be described in detail later.

[0061] Step S103: based on the target matching rule of the log information, identifying the attack access request of the log information, and performing request interception processing on the attack access request.

[0062] In this embodiment, the terminal identifies the attack access request of the log information based on the target matching rule of the log information, and intercepts the attack access request. The interception method for different log information is different, and the specific interception method will be described in detail later.

[0063] Based on the above solution, active defense against threat traffic is achieved through real-time full analysis of log data, combined with dynamic encapsulation and dynamic verification. Through a series of means such as dynamic encapsulation, dynamic verification, user behavior, device fingerprint verification, and JS challenge / verification code, the flexibility and effectiveness of defense measures are enhanced, and a certain defense capability against advanced Bots is possessed. Finally, this solution introduces advanced log analysis, real-time statistical processing, and active defense technologies on the basis of traditional WAF, which significantly improves network security protection capabilities and adapts to the current complex and changing network security environment. Thereby improving the security protection effect against new network attack methods.

[0064] Optionally, based on each log information and each flow data, a session identification program is used to match dynamic rules corresponding to each log information, including: for each flow data, collecting the current protection rules of the system, and performing session identification processing on the flow data through the current protection rules to obtain current access request information corresponding to the flow data; based on the log information and the current access request information, matching the dynamic rules corresponding to the log information in the dynamic rule database.

[0065] In this embodiment, the terminal collects the current protection rules of the system for each flow data, and performs session identification processing on the flow data through the current protection rules to obtain the current access request information corresponding to the flow data. Then, based on the log information and the current access request information, the terminal matches the dynamic rules corresponding to the log information in the dynamic rule database. Among them, the current protection rules are the Bot rules currently adapted by the firewall.

[0066] Based on the above solution, the current Both rules of the firewall can be adapted, thereby reducing the load on the firewall and improving the adaptation accuracy and efficiency of dynamic rules.

[0067] Optionally, based on the log information, through the dynamic rules corresponding to the log information, identifying the attack access request in the log information, including: identifying the dynamic verification information corresponding to the log information, and identifying the request behavior information of the current access request information corresponding to the log information, and the device fingerprint information corresponding to the current access request information through the dynamic rules corresponding to the log information and the dynamic verification information; based on the device fingerprint information and the requested access information, determining whether the device fingerprint information is an abnormal fingerprint, and when the device fingerprint information is an abnormal fingerprint, treating the requested access information as the attack access request in the log information.

[0068] In this embodiment, the terminal identifies the dynamic verification information corresponding to the log information, and identifies the request behavior information of the current access request information corresponding to the log information and the device fingerprint information corresponding to the current access request information through the dynamic rules corresponding to the log information and the dynamic verification information. Then, based on the device fingerprint information and the requested access information, the terminal determines whether the device fingerprint information is an abnormal fingerprint, and if the device fingerprint information is an abnormal fingerprint, the requested access information is regarded as an attack access request in the log information. Specifically, the terminal supports extracting the signature value and related data (such as URL, parameters, random numbers, etc.) in the request, and verifies the signature value using the preset public key. If the signature fails, the current request access information of the log information is considered to be an attack access request, and the execution action is interception, otherwise the process continues; then, the terminal supports extracting the user behavior data (such as mouse movement, clicks or keyboard input, etc.) in the request, and analyzes the current behavior through the built-in scoring rules to determine whether the current behavior belongs to a robot or a normal user. If it is determined to be a robot, the current request access information of the log information is considered to be an attack access request, and the execution action is interception. At the same time, alarm monitoring is performed for abnormal behavior, otherwise the process continues; then, the terminal supports extracting the unique information about the device in the request (such as browser type, operating system, hardware parameters, etc.), generates a device fingerprint through a built-in algorithm, associates the fingerprint with the request, determines whether the fingerprint is repeated or abnormal, and supports custom whitelist or blacklist fingerprints. Finally, if the fingerprint is abnormal, the current request access information of the log information is considered to be an attack access request, and the execution action is interception. At the same time, alarm monitoring is performed for abnormal fingerprints, otherwise the process continues.

[0069] Based on the above solution, the attack access request identification strategy of bot-gather preset in the firewall is used to accurately identify the attack access request, thereby improving the identification accuracy of the attack access request.

[0070] Optionally, based on the log information, a target matching rule corresponding to the log information is identified through a rule matching strategy, including: based on the current protection rule, each target log information and each target traffic data are screened, and each target log information and each target traffic data are clustered to obtain each aggregate information group; through the rule matching strategy, the target matching rule corresponding to each aggregate information group is identified, and the target matching rule corresponding to each aggregate group is used as the target matching rule for each target log information of each aggregate information group.

[0071] In this embodiment, the terminal screens each target log information and each target traffic data in each log information and each traffic data based on the current protection rules, and clusters each target log information and each target traffic data to obtain each aggregate information group. Specifically, the terminal supports rule matching of traffic according to the currently configured Bot rules, filtering out traffic and logs that do not meet the matching conditions; then, the terminal supports caching and pre-aggregating the traffic and matching results that meet the matching conditions in memory; then, the terminal supports regular hash bucketing of pre-aggregated data according to tenant ID, and distributes it to the central redis to ensure that the data of the same tenant can be allocated to the same queue. Finally, the terminal identifies the target matching rule corresponding to each aggregate information group through the rule matching strategy, and uses the target matching rule corresponding to each aggregate group as the target matching rule for each target log information of each aggregate information group.

[0072] Based on the above solution, by performing rule matching and clustering on the log information that does not match the dynamic rules, the log information can be grouped for anomaly identification, thereby improving the efficiency and accuracy of anomaly identification.

[0073] Optionally, based on the target matching rules of the log information, identifying the attack access request of the log information, including: based on the target matching rules of the log information, identifying the matching value of each matching condition of the target matching rules for the current request information corresponding to the log information; when all matching conditional matching values ​​are greater than the matching threshold of each matching condition, treating the current request information corresponding to the log information as the attack access request.

[0074] In this embodiment, the terminal identifies the matching value of the current request information corresponding to the log information in each matching condition of the target matching rule based on the target matching rule of the log information. Finally, when the matching values ​​of all matching conditions are greater than the matching threshold of each matching condition, the terminal uses the current request information corresponding to the log information as an attack access request. Specifically, the terminal supports load sharing between multiple statrs; then, the terminal supports consuming the pre-aggregated data of the Bot rule matching in redis, caching it in the memory for a period of time, and aggregating the data of the entire network; then, the terminal supports regularly sending the aggregated data of the entire network to the rule statistics and judgment module through the internal chan; supports concurrent processing. The terminal supports configuration management, receives various configurations issued by the management platform (tenant configuration), and supports configuration restart and recovery; then, the terminal supports associating the above-mentioned aggregated data to the same rule according to the latitude of the Bot rule, and performing statistics of each dimension according to each matching condition; finally, the terminal supports judging whether all the matching conditions associated therewith reach the threshold according to the latitude of the Bot rule; the terminal uses the current request information corresponding to the log information whose matching conditions reach the threshold as an attack access request, and performs concurrent processing.

[0075] Based on the above solution, by performing rule matching and clustering on the log information that does not match the dynamic rules, the log information can be grouped for anomaly identification, thereby improving the efficiency and accuracy of anomaly identification.

[0076] Optionally, the attack access request is subjected to request interception processing, including: when the attack access request is the current access request information corresponding to the log information for which a dynamic rule exists, performing access interception processing on the attack access request through a preset access interception strategy; when the attack access request is not the current access request information corresponding to the log information for which a dynamic rule exists, generating a new dynamic rule for the log information corresponding to the attack access request and an active defense code for the log information corresponding to the attack access request, and transmitting the new dynamic rule and the active defense code to the current protection rule; performing access interception processing on the attack access request through a preset access interception strategy.

[0077] In this embodiment, when the attack access request is the current access request information corresponding to the log information with dynamic rules, the terminal performs access interception processing on the attack access request through the preset access interception strategy. Then, when the attack access request is not the current access request information corresponding to the log information with dynamic rules, the terminal generates a new dynamic rule for the log information corresponding to the attack access request, and an active defense code for the log information corresponding to the attack access request, and transmits the new dynamic rule and the active defense code to the current protection rule. Finally, the terminal performs access interception processing on the attack access request through the preset access interception strategy. Specifically, the terminal supports writing dynamic rule information into a database (such as PG) to facilitate customers and administrators to view dynamic rules; supports dynamic rules to be restored when Bot-Statr is restarted (pulling data from the database); if the Bot rule is configured with a dynamic protection function, it needs to be dynamically encapsulated in this module: use a private key to sign the key fields in the request (dynamic changes in different rules) and attach the results to JS; encapsulate JS code to collect user behavior; encapsulate JS code to collect fingerprint information of user devices. Finally, the terminal sends the dynamic rule and the dynamically generated JS code to MQ (reusing Redis) and broadcasts them to each engine node.

[0078] Based on the above scheme, by generating new dynamic rules and active defense codes for new attack access requests, data synchronization identification and attack prevention of new attack access requests are ensured, thereby improving the security prevention effect of each attack access request.

[0079] This application also provides a network attack protection example of log analysis, such as Figure 2 As shown, the specific processing process includes the following steps:

[0080] Step S201, obtaining various log information of the firewall and various flow data of the firewall.

[0081] Step S202: for each flow data, the current protection rules of the system are collected, and session identification processing is performed on the flow data through the current protection rules to obtain current access request information corresponding to the flow data.

[0082] Step S203: Based on the log information and the current access request information, the dynamic rule corresponding to the log information is matched in the dynamic rule database.

[0083] Step S204, identifying the dynamic verification information corresponding to the log information, and identifying the request behavior information of the current access request information corresponding to the log information and the device fingerprint information corresponding to the current access request information through the dynamic rules corresponding to the log information and the dynamic verification information.

[0084] Step S205: Based on the device fingerprint information and the access request information, determine whether the device fingerprint information is an abnormal fingerprint, and if the device fingerprint information is an abnormal fingerprint, use the access request information as an attack access request in the log information.

[0085] Step S206, based on the current protection rules, in each log information and each flow data, each target log information and each target flow data are screened, and each target log information and each target flow data are clustered to obtain each aggregate information group.

[0086] Step S207, identifying the target matching rule corresponding to each aggregate information group through the rule matching strategy, and using the target matching rule corresponding to each aggregate group as the target matching rule for each target log information of each aggregate information group.

[0087] Step S208: Based on the target matching rule of the log information, identifying the matching value of each matching condition of the target matching rule of the current request information corresponding to the log information.

[0088] Step S209: when all matching conditional matching values ​​are greater than the matching threshold of each matching condition, the current request information corresponding to the log information is used as an attack access request.

[0089] Step S210: When the attack access request is current access request information corresponding to the log information with dynamic rules, the attack access request is intercepted by using a preset access interception strategy.

[0090] Step S211, when the attack access request is not the current access request information corresponding to the log information for which a dynamic rule exists, a new dynamic rule for the log information corresponding to the attack access request and an active defense code for the log information corresponding to the attack access request are generated, and the new dynamic rule and the active defense code are transmitted to the current protection rule.

[0091] Step S212: perform access interception processing on the attack access request through a preset access interception strategy.

[0092] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0093] Based on the same inventive concept, the embodiment of the present application also provides a network attack protection device based on log analysis for implementing the network attack protection method based on log analysis involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the one or more network attack protection device embodiments based on log analysis provided below can refer to the limitations of the network attack protection method based on log analysis above, and will not be repeated here.

[0094] In an exemplary embodiment, Figure 3 As shown, a network attack protection device based on log analysis is provided, including: an acquisition module 310, an identification module 320 and an interception module 330, wherein:

[0095] The acquisition module 310 is used to acquire various log information of the firewall and various flow data of the firewall, and based on each of the log information and each of the flow data, match the dynamic rules corresponding to each of the log information through a session identification program;

[0096] an identification module 320, configured to identify the attack access request in the log information based on the log information and through the dynamic rule corresponding to the log information if there is a dynamic rule corresponding to the log information, and to identify the target matching rule corresponding to the log information based on the log information and through a rule matching strategy if there is no dynamic rule corresponding to the log information;

[0097] The interception module 330 is used to identify the attack access request of the log information based on the target matching rule of the log information, and perform request interception processing on the attack access request.

[0098] Optionally, the acquisition module 310 is specifically configured to:

[0099] For each flow data, the current protection rules of the system are collected, and the flow data is subjected to session identification processing according to the current protection rules to obtain the current access request information corresponding to the flow data;

[0100] Based on the log information and the current access request information, a dynamic rule corresponding to the log information is matched in a dynamic rule database.

[0101] Optionally, the identification module 320 is specifically configured to:

[0102] Identify dynamic verification information corresponding to the log information, and identify request behavior information of current access request information corresponding to the log information and device fingerprint information corresponding to the current access request information through the dynamic rules corresponding to the log information and the dynamic verification information;

[0103] Based on the device fingerprint information and the access request information, it is determined whether the device fingerprint information is an abnormal fingerprint, and when the device fingerprint information is an abnormal fingerprint, the access request information is used as an attack access request in the log information.

[0104] Optionally, the identification module 320 is specifically configured to:

[0105] Based on the current protection rule, in each of the log information and each of the traffic data, each of the target log information and each of the target traffic data is screened, and each of the target log information and each of the target traffic data is clustered to obtain each aggregate information group;

[0106] The target matching rule corresponding to each aggregate information group is identified through the rule matching strategy, and the target matching rule corresponding to each aggregate group is used as the target matching rule of each target log information of each aggregate information group.

[0107] Optionally, the interception module 330 is specifically configured to:

[0108] Based on the target matching rule of the log information, identifying the matching value of each matching condition of the target matching rule for the current request information corresponding to the log information;

[0109] When all matching conditional matching values ​​are greater than the matching threshold of each matching condition, the current request information corresponding to the log information is used as an attack access request.

[0110] Optionally, the interception module 330 is specifically configured to:

[0111] When the attack access request is current access request information corresponding to the log information with dynamic rules, the attack access request is subjected to access interception processing by using a preset access interception strategy;

[0112] When the attack access request is not the current access request information corresponding to the log information for which the dynamic rule exists, a new dynamic rule for the log information corresponding to the attack access request and an active defense code for the log information corresponding to the attack access request are generated, and the new dynamic rule and the active defense code are transmitted to the current protection rule;

[0113] The attack access request is intercepted and processed by using a preset access interception strategy.

[0114] Each module in the network attack protection device based on log analysis can be implemented in whole or in part by software, hardware and their combination. Each module can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to each module above.

[0115] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 4As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be realized through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a network attack protection method based on log analysis is realized. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0116] Those skilled in the art will understand that Figure 4 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0117] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, steps corresponding to the method for network attack protection based on log analysis are implemented.

[0118] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps corresponding to the method for network attack protection based on log analysis are implemented.

[0119] In one embodiment, a computer program product is provided, including a computer program, which, when executed by a processor, implements steps corresponding to a method for network attack protection based on log analysis.

[0120] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0121] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0122] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0123] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A network attack protection method based on log analysis, characterized in that: The method comprises: Obtaining each log information of the firewall and each flow data of the firewall, and matching the dynamic rules corresponding to each log information through a session identification program based on each log information and each flow data; In the case where there is a dynamic rule corresponding to the log information, based on the log information, identifying the attack access request in the log information through the dynamic rule corresponding to the log information, and in the case where there is no dynamic rule corresponding to the log information, based on the log information, identifying the target matching rule corresponding to the log information through a rule matching strategy; Based on the target matching rule of the log information, the attack access request of the log information is identified, and the attack access request is intercepted and processed.

2. The method according to claim 1, characterized in that: The matching of the dynamic rules corresponding to each log information through a session identification program based on each log information and each flow data includes: For each flow data, the current protection rules of the system are collected, and the flow data is subjected to session identification processing according to the current protection rules to obtain the current access request information corresponding to the flow data; Based on the log information and the current access request information, a dynamic rule corresponding to the log information is matched in a dynamic rule database.

3. The method according to claim 2, characterized in that The identifying, based on the log information and by using a dynamic rule corresponding to the log information, an attack access request in the log information includes: Identify dynamic verification information corresponding to the log information, and identify request behavior information of current access request information corresponding to the log information and device fingerprint information corresponding to the current access request information through the dynamic rules corresponding to the log information and the dynamic verification information; Based on the device fingerprint information and the access request information, it is determined whether the device fingerprint information is an abnormal fingerprint, and when the device fingerprint information is an abnormal fingerprint, the access request information is used as an attack access request in the log information.

4. The method according to claim 2, characterized in that: The identifying, based on the log information, a target matching rule corresponding to the log information through a rule matching strategy includes: Based on the current protection rule, in each of the log information and each of the traffic data, each of the target log information and each of the target traffic data is screened, and each of the target log information and each of the target traffic data is clustered to obtain each aggregate information group; The target matching rule corresponding to each aggregate information group is identified through the rule matching strategy, and the target matching rule corresponding to each aggregate group is used as the target matching rule of each target log information of each aggregate information group.

5. The method according to claim 1, characterized in that The identifying the attack access request of the log information based on the target matching rule of the log information includes: Based on the target matching rule of the log information, identifying the matching value of each matching condition of the target matching rule for the current request information corresponding to the log information; When all matching conditional matching values ​​are greater than the matching threshold of each matching condition, the current request information corresponding to the log information is used as an attack access request.

6. The method according to claim 1, characterized in that The intercepting and processing the attack access request includes: When the attack access request is current access request information corresponding to the log information with dynamic rules, the attack access request is subjected to access interception processing by using a preset access interception strategy; When the attack access request is not the current access request information corresponding to the log information for which the dynamic rule exists, a new dynamic rule for the log information corresponding to the attack access request and an active defense code for the log information corresponding to the attack access request are generated, and the new dynamic rule and the active defense code are transmitted to the current protection rule; The attack access request is intercepted and processed by using a preset access interception strategy.

7. A network attack protection device based on log analysis, characterized in that: The device comprises: An acquisition module, used for acquiring various log information of the firewall and various flow data of the firewall, and matching dynamic rules corresponding to each log information through a session identification program based on each log information and each flow data; an identification module, configured to identify the attack access request in the log information based on the log information and through the dynamic rule corresponding to the log information if there is a dynamic rule corresponding to the log information, and to identify the target matching rule corresponding to the log information based on the log information and through a rule matching strategy if there is no dynamic rule corresponding to the log information; The interception module is used to identify the attack access request of the log information based on the target matching rule of the log information, and perform request interception processing on the attack access request.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images