Network attack detection method and device, equipment, storage medium and program product

Abstract

The invention discloses a network attack detection method and device, equipment, a storage medium and a program product. The method comprises the following steps: acquiring behavior characteristics of a to-be-detected system, wherein the behavior characteristics are determined based on first operation state information of the to-be-detected system; the behavior characteristics are matched with a plurality of attack events in an attack database, the attack events corresponding to the behavior characteristics are determined as reference attack events under the condition that it is determined that the attack events corresponding to the behavior characteristics exist in the attack database, and the attack events are determined based on the behavior characteristics of multiple attack viruses; and under the condition that the reference attack events comprise at least two attack events, determining whether a network attack exists in the to-be-detected system based on the reference attack events. According to the embodiment of the invention, the network attack can be effectively identified and detected.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a network attack detection method, device, equipment, storage medium and program product. Background Art

[0002] Cyber ​​attacks refer to any type of offensive action against computer information systems, computer networks, or personal computer devices. These cyber attacks are intended to damage software or services, or access data without authorization. In order to maintain network security, cyber attack detection is particularly important. Cyber ​​attack detection refers to the detection of potential cyber attacks by monitoring traffic, logs, behavior and other data in the network system, and providing support for the maintenance of network security.

[0003] Network attack detection mainly relies on identifying known feature strings in traffic, such as public resource pool domain names, specific wallet addresses, and keywords. This detection method has a good detection effect on known network attacks. However, in order to evade detection, attackers may use private resource pools to hide the source of attacks and use encryption protocols to protect communication content. In this case, since the traffic characteristics and strings used by attackers are unknown to the detection system, existing detection methods based on known feature strings may fail and fail to effectively identify and detect these network attacks. Summary of the invention

[0004] Embodiments of the present invention provide a network attack detection method, apparatus, device, storage medium and program product, which can effectively identify and detect network attacks.

[0005] In a first aspect, an embodiment of the present application provides a network attack detection method, the method comprising:

[0006] Acquire a behavior feature of the system to be detected, where the behavior feature is determined based on first operating state information of the system to be detected;

[0007] Matching the behavior characteristics with multiple attack events in the attack database respectively, and if it is determined that there is an attack event corresponding to the behavior characteristics in the attack database, determining the attack event corresponding to the behavior characteristics as a reference attack event, wherein the multiple attack events are determined based on the behavior characteristics of multiple attack viruses;

[0008] In the case where the reference attack events include at least two attack events, it is determined whether there is a network attack in the system to be detected based on the reference attack events.

[0009] As an optional implementation, before matching the behavior feature with the multiple attack events in the attack database respectively, the method further includes:

[0010] Acquire an attack virus sample set, where the attack virus sample set includes multiple virus samples;

[0011] For each virus sample, run the virus sample in the isolated environment of the system and perform the following operations A1 to A4:

[0012] A1: Obtain the second operating state information of the system;

[0013] A2: Compare the second operating state information with the third operating state information of the system in a normal operating state, and determine abnormal information in the second operating state information;

[0014] A3: Extract features from abnormal information to obtain corresponding attack behavior features;

[0015] A4: For each attack behavior feature, determine the standard parameter value corresponding to the attack behavior feature and the attack stage according to the second operation state information and the third operation state information, where the attack stage includes the attack preparation stage and the attack execution stage;

[0016] Each event is associated with its corresponding attack stage and stored to obtain an attack database. The attack event includes attack behavior characteristics and corresponding standard parameter values.

[0017] As an optional implementation, matching the behavior feature with multiple attack events in the attack database respectively, and determining the attack event corresponding to the behavior feature as a reference attack event when it is determined that the attack event corresponding to the behavior feature exists in the attack database, includes:

[0018] For each behavioral characteristic, do the following:

[0019] When the behavior feature meets the first matching condition, the following operations are performed, where the first matching condition is that there is an attack behavior feature matching the behavior feature in the attack database:

[0020] Determine a characteristic state parameter value corresponding to the behavior characteristic according to the first characteristic operation information and the second characteristic operation information, wherein the first characteristic operation information is information related to the behavior characteristic in the first operation state information, and the second characteristic operation information is information related to the behavior characteristic when the system to be detected is in a normal operation state;

[0021] When the characteristic state parameter value is greater than the standard parameter value, the attack event corresponding to the behavior characteristic is determined as a reference attack event, and the standard parameter value is a standard threshold value of the attack behavior characteristic under the attack behavior.

[0022] As an optional implementation manner, when the reference attack event includes at least two attack events, determining whether there is a network attack in the system to be detected based on the reference attack event includes:

[0023] For each attack event in the reference attack event, the ratio of the corresponding characteristic state parameter value to the standard parameter value is calculated to obtain the trigger index of the attack event;

[0024] Obtain the weight coefficient corresponding to each attack event in the reference attack event, where the weight coefficient is used to represent the relative importance of the attack event in evaluating the network attack;

[0025] According to the attack database, determine the first target attack event and the second target attack event in the reference attack event, the first target attack event is an event that occurs during the attack preparation phase of the attack virus, and the second target attack event is an event that occurs during the attack execution phase of the attack virus;

[0026] For each first target attack event, calculate the product of the weight coefficient corresponding to the first target attack event and the trigger index to obtain a first trigger value;

[0027] For each second target attack event, calculate the product of the weight coefficient corresponding to the second target attack event and the trigger index to obtain a second trigger value;

[0028] It is determined whether there is a network attack in the system to be detected according to the multiple first trigger values ​​and the multiple second trigger values.

[0029] As an optional implementation, before determining whether a network attack exists in the system to be detected according to the multiple first trigger values ​​and the multiple second trigger values, the method further includes:

[0030] Determining a first weighing coefficient and a second weighing coefficient according to operating status information of the system to be detected in a normal operating state;

[0031] Determining whether a network attack exists in the system to be detected according to the plurality of first trigger values ​​and the plurality of second trigger values ​​includes:

[0032] Calculate the sum of multiple first trigger values ​​under the reference attack event to obtain a first attack risk assessment value;

[0033] Calculate the sum of multiple second trigger values ​​under the reference attack event to obtain a second attack risk assessment value;

[0034] When the first attack risk assessment value is greater than the first measurement coefficient, and the second attack risk assessment value is greater than the second measurement coefficient, it is determined that a network attack exists in the system to be detected.

[0035] As an optional implementation method, a set of attack virus samples is obtained, including:

[0036] Collect attack virus sample sets through the cloud resource pool.

[0037] In a second aspect, an embodiment of the present application provides a network attack detection device, the device comprising:

[0038] A first acquisition module, used to acquire a behavior feature of the system to be detected, where the behavior feature is determined based on first operating state information of the system to be detected;

[0039] A first determination module is used to match the behavior feature with multiple attack events in the attack database respectively, and if it is determined that there is an attack event corresponding to the behavior feature in the attack database, determine the attack event corresponding to the behavior feature as a reference attack event, and the multiple attack events are determined based on the behavior features of multiple attack viruses;

[0040] The second determination module is used to determine whether there is a network attack in the system to be detected based on the reference attack event when the reference attack event includes at least two attack events.

[0041] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, the network attack detection method as described in any one of the first aspects is implemented.

[0042] In a fourth aspect, an embodiment of the present application provides a computer storage medium, on which computer program instructions are stored. When the computer program instructions are executed by a processor, a network attack detection method as described in any one of the first aspects is implemented.

[0043] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a computer program, and when the computer program is processed and executed, it implements any network attack detection method of the first aspect.

[0044] The network attack detection method, device, equipment, storage medium and program product of the embodiment of the present application can preliminarily identify potential reference attack events by matching the behavioral characteristics of the system to be detected with multiple known attack events in the attack database. However, if there is only a single attack event, there may be accidental or false positives, because a single attack event may be caused by accidental fluctuations in the system and is not a real network attack behavior, and multiple attack events combined together are more likely to be real attack behaviors. Therefore, only when it is preliminarily determined that the reference attack event includes at least two attack events, and then judging whether the system to be detected is subjected to a network attack based on multiple reference attack events, can the possibility of such false positives be reduced and the accuracy of network attack detection be improved.

[0045] This method of using the behavioral characteristics of the system to be detected to detect network attacks does not rely on specific traffic characteristics, but focuses on the behavioral patterns of attack viruses in the system. Traffic characteristics can be hidden, while this behavioral pattern is relatively difficult to hide, and can accurately capture network attack behaviors, thereby improving the sensitivity and accuracy of detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0047] Figure 1 A schematic diagram of a flow chart of a network attack detection method provided by an embodiment of the present application is shown;

[0048] Figure 2 A flowchart of a specific implementation method of S102 provided in an embodiment of the present application is shown;

[0049] Figure 3 A schematic diagram of a process for building an attack database provided by an embodiment of the present application is shown;

[0050] Figure 4 A schematic diagram showing the stage behavior of a network attack provided by an embodiment of the present application is shown;

[0051] Figure 5 A flowchart of a specific implementation method of S103 provided in an embodiment of the present application is shown;

[0052] Figure 6 A flowchart of a specific implementation method of S1036 provided in an embodiment of the present application is shown;

[0053] Figure 7 It is a structural diagram of a network attack detection device provided by an embodiment of the present application;

[0054] Figure 8 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0055] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0056] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0057] In order to solve the problem that the existing detection methods based on known feature strings in the related art may not be able to effectively identify and detect encrypted network attacks, the embodiments of the present application provide a network attack detection method, device, equipment, storage medium and program product. The network attack detection method provided by the embodiments of the present application is first introduced below.

[0058] Figure 1 FIG. 1 is a flow chart of a network attack detection method provided by an embodiment of the present application. Figure 1 As shown, the method includes the following steps: S101-S103.

[0059] S101: Acquire a behavior feature of a system to be detected, where the behavior feature is determined based on first operating state information of the system to be detected.

[0060] S102: Match the behavior feature with multiple attack events in the attack database respectively, and if it is determined that there is an attack event corresponding to the behavior feature in the attack database, determine the attack event corresponding to the behavior feature as a reference attack event, and the multiple attack events are determined based on the behavior features of multiple attack viruses.

[0061] S103: When the reference attack events include at least two attack events, determine whether there is a network attack in the system to be detected based on the reference attack events.

[0062] In an embodiment of the present application, by matching the behavioral characteristics of the system to be detected with multiple known attack events in the attack database, potential reference attack events can be preliminarily identified. However, if there is only a single attack event, there may be accidental or false positives, because a single attack event may be caused by accidental fluctuations in the system and is not a real network attack behavior, and multiple attack events combined together are more likely to be real attack behaviors. Therefore, only when it is preliminarily determined that the reference attack event includes at least two attack events, and then judging whether the system to be detected is subjected to a network attack based on multiple reference attack events, can the possibility of such false positives be reduced and the accuracy of network attack detection be improved.

[0063] Moreover, the method of using the behavioral characteristics of the system to be detected to detect network attacks does not rely on specific traffic characteristics, but focuses on the behavioral patterns of attack viruses in the system. Traffic characteristics can be hidden, while this behavioral pattern is relatively difficult to hide, and thus can accurately capture network attack behaviors, thereby improving the sensitivity and accuracy of detection.

[0064] In some embodiments, in S101, the first operating status information refers to a series of data or parameters reflecting the current operating status of the system to be detected. These data include but are not limited to performance indicators, resource usage, network activities, process status, etc. of the system to be detected. In specific implementation, it can be obtained through an information collection module deployed in the system to be detected. The information collection module may include a system resource monitoring unit, a process activity monitoring unit, and a network communication monitoring unit.

[0065] The system resource monitoring unit is used to monitor the resource usage of the system to be detected, including:

[0066] CPU monitoring subunit: used to periodically collect CPU utilization data of the system to be tested.

[0067] Memory monitoring subunit: used to record the memory usage of the system to be tested, which may include used memory, available memory, and swap memory.

[0068] Hard disk monitoring subunit: used to monitor the usage of disk space, which can include real-time data of the remaining space and total capacity of each disk partition.

[0069] Network bandwidth monitoring subunit: used to monitor the transmission rate of the network interface and detect network traffic conditions.

[0070] The process activity monitoring unit is used to monitor the processes running in the system to be detected, which may include:

[0071] Process recording subunit: used to record all running processes in the system to be detected, including process ID, process name, parent process ID and child process ID.

[0072] Process resource usage monitoring subunit: used to monitor the CPU usage, memory usage and network resource usage of each process.

[0073] Process behavior monitoring subunit: used to monitor the behavior of the process, including file operation behavior and network communication behavior.

[0074] The network communication monitoring unit is used to monitor the network communication activities of the system to be detected, including:

[0075] Network connection record subunit: used to record the network connection information established in the system, including source IP address, target IP address, port and connection status, etc.

[0076] Network traffic monitoring subunit: used to monitor the size and direction of network traffic.

[0077] Based on this, in some embodiments, features can be extracted from the first operating status information collected by the information collection module, such as CPU utilization, memory usage, network traffic, etc. Then, the extracted features are processed by statistical methods or machine learning algorithms to accurately describe the behavioral characteristics of the system to be detected, such as abnormal memory usage, etc.

[0078] In some embodiments, in S102, the attack database includes behavioral features and related information of multiple attack events based on multiple known attack viruses, and the related information describes the specific manifestation of the behavioral features under the attack event in the system to be detected. As an optional implementation, a feature matching algorithm can be used to traverse the behavioral features of each attack event in the attack database, and compare and match them with the extracted behavioral features of the system to be detected. When the matching conditions are met, the corresponding attack event is determined as a reference attack event of the system to be detected.

[0079] In order to accurately identify the reference attack event, the present application also provides a specific implementation of S102. Figure 2 As shown, the aforementioned S102 may specifically include executing the following steps for each behavior feature: S1021 to S1025.

[0080] S1021: Determine whether there is an attack behavior feature matching the behavior feature in the attack database. If the judgment result is yes, execute S1023; if the judgment result is no, execute S1022.

[0081] S1022: Determine that the event corresponding to the behavior feature does not belong to the reference attack event.

[0082] In some embodiments, by setting the first matching condition, potential abnormal or attack behaviors can be quickly screened out, and a large number of normal behaviors can be quickly excluded, so that resources can be concentrated on analyzing potential threat behaviors that need further verification, thereby optimizing resource allocation.

[0083] S1023: Determine the characteristic state parameter value corresponding to the behavior characteristic according to the first characteristic operation information and the second characteristic operation information, wherein the first characteristic operation information is information related to the behavior characteristic in the first operation state information, and the second characteristic operation information is information related to the behavior characteristic when the system to be detected is in a normal operation state.

[0084] In some embodiments, the characteristic state parameter value can reflect the degree of deviation between the current state and the normal state of the system to be detected, which can be determined by calculating the difference between the first characteristic operation information (current state value) and the second characteristic operation information (normal state value). Specifically, the relative difference or percentage difference between the current value and the normal value can be calculated.

[0085] S1024: Determine whether the characteristic state parameter value is greater than the standard parameter value. The standard parameter value is the standard threshold of the attack behavior characteristic under the attack behavior. If the judgment result is yes, execute S1025; if the judgment result is no, execute S1022.

[0086] In some embodiments, the standard parameter value is a preset or standard data value associated with the attack behavior feature, which is used to reflect the standard threshold of the system to be detected when the attack behavior feature appears, and can usually be determined based on factors such as the normal operating status and historical data of the system to be detected. The system to be detected will record the characteristic state parameter value corresponding to the attack behavior feature, and compare it with the standard parameter value of the corresponding attack event to determine whether the characteristic state parameter value exceeds the range, thereby determining whether an attack event is triggered.

[0087] S1025: Determine the attack event corresponding to the behavior feature as a reference attack event.

[0088] In the embodiment of the present application, by extracting the target operating state information associated with the behavior feature from the operating state information and determining the characteristic state parameter value, the system can perform a refined analysis on the specific behavior feature. When the characteristic state parameter value is greater than the standard parameter value, the attack event corresponding to the current behavior feature can be determined as a reference attack event, indicating that a possible attack event has been identified. When the characteristic state parameter value does not exceed the standard parameter value, it can be considered that the current behavior feature has not reached the level of triggering an attack event. By judging the reference attack event through the quantized data value, the potential attack event of the system to be detected can be effectively identified.

[0089] In order to improve the efficiency and accuracy of network attack detection, the standard parameter values ​​of each known attack behavior feature can be stored in the attack database in advance. When judging the behavior features, these predefined standard parameter values ​​can be directly queried from the attack database for calculation. Figure 3 As shown, before the aforementioned S102, the method further includes the following steps: S301 to S306.

[0090] S301: Acquire an attack virus sample set, where the attack virus sample set includes multiple virus samples.

[0091] In some embodiments, the attack virus sample set can be collected through the cloud resource pool. The cloud resource pool not only broadens the channels for obtaining virus information, but also brings together virus samples from many sources. With the help of the huge network of the cloud resource pool, the attack virus sample set can be collected more widely. Compared with the collection method of a single channel, this method has stronger coverage and ensures the comprehensiveness and effectiveness of the samples.

[0092] S302: For each virus sample, the virus sample is placed in an isolated environment of the system for execution, and second operation status information of the system is obtained.

[0093] In some embodiments, running virus samples directly on the main system may cause system infection or data loss risks, so running viruses in an isolated environment can effectively ensure the safety of the main system. Run the virus sample in an isolated, controlled environment, and then use the aforementioned information collection unit to collect the second operating state information of the system, such as the behavior pattern of the virus, network activities, and file operations. For the specific content of the second operating state information and the specific architecture of the information collection unit, please refer to the above introduction, which will not be repeated here.

[0094] As an example, an isolated environment may include a sandbox, a virtual machine, a container, or an isolated network. In an isolated environment, by executing known security attack virus samples, the typical weak behavior characteristics of these viruses before and during security attacks can be captured and analyzed. These weak behavior characteristics include, but are not limited to, small-scale file copying, collection of sensitive information, etc. By continuously recording and monitoring the changing values ​​of specific data, such as the frequency of file calls (normally 30 to 50 times per second), the characteristics of these attack viruses can be effectively extracted and identified.

[0095] S303: Compare the second operating state information with the third operating state information of the system in a normal operating state, and determine abnormal information in the second operating state information.

[0096] In some embodiments, abnormal information refers to data or behavior patterns that are inconsistent with normal behavior patterns during system operation. The second operation status information (i.e., the system status when the virus is running) is compared with the third operation status information (i.e., the status when the system is running normally) to find out the difference.

[0097] S304: Extract features from the abnormal information to obtain corresponding attack behavior features.

[0098] In some embodiments, indicative features may be extracted from the collected data using techniques such as machine learning, pattern recognition, or rule engines, etc. These features may include file access patterns, network connection behavior, system process activity, memory usage, etc.

[0099] S305: For each attack behavior feature, determine the standard parameter value corresponding to the attack behavior feature and the attack stage according to the second operation state information and the third operation state information. The attack stage includes an attack preparation stage and an attack execution stage.

[0100] In some implementation scenarios, such as Figure 4 As shown in the figure, in the preparation stage of the attack, the attacker usually performs a series of premeditated behavioral characteristics, such as releasing specific files to lurk in the system, collecting system information to assess the vulnerability of the target, hijacking system resources to achieve long-term control, and ensuring the persistence of suspicious behaviors to maintain the effect of the attack. When the attack enters the execution stage, the attacker will begin to use the resources and information obtained in the preparation stage, such as consuming system resources (CPU), and may even try to access ports that are defined as suspicious when accessed at abnormal time points. In order to effectively detect these attack behaviors, the method of comparing and analyzing them with the data during normal system execution can be used to identify potential security threats.

[0101] S306: Each event is associated with its corresponding attack stage and stored to obtain an attack database. The attack event includes attack behavior characteristics and corresponding standard parameter values.

[0102] In the embodiment of the present application, by constructing an attack database including multiple attack behavior features and corresponding standard parameter values, it helps to accurately identify known attack behaviors in the system to be detected.

[0103] As a possible implementation method, in order to build an efficient and secure virus protection system, the system may also include: a virus sample management unit, a virtual environment management unit, a virus behavior analysis unit, a log recording and reporting unit, and a performance optimization unit. The specific functions of these units are as follows:

[0104] Virus sample management unit: used to manage the collection, storage and timely update of virus samples. The unit accurately obtains virus samples from verified and secure sources to ensure the diversity and representativeness of the samples. The samples are then properly stored in a secure and reinforced database or dedicated storage medium to ensure a high degree of security and integrity. In addition, the virus sample library is regularly updated to ensure timely response and effective defense against the latest virus threats.

[0105] Isolation environment management unit: used to configure and manage the isolation environment during the virus sample analysis process to ensure that the virus samples are run in an isolated and secure environment, and to completely isolate the possible impact of the virus samples on the main system. As a preferred example, a virtual system can be built and set to sandbox mode. This unit limits the access rights of virus samples to the main system, effectively preventing virus samples from escaping the virtual environment and ensuring the security of the main system. At the same time, the unit monitors the operating status of the virtual environment in real time, including key indicators such as CPU utilization, memory usage, and disk space usage, and pre-sets multiple monitoring item thresholds (such as the CPU utilization threshold is set to 90%) to ensure that the behavior of the virus sample will not cause the virtual environment to crash or affect the performance of other modules.

[0106] Virus behavior analysis unit: used to monitor the behavior of virus samples in an isolated environment. Specifically, by analyzing in detail all process behaviors of virus samples in an isolated environment, suspicious or malicious process activities are detected and identified. These detailed analyses not only cover file operations, network communications (such as abnormal or large-scale network activities) and registry modifications, but also accurately identify abnormal behaviors by comparing the normal behavior of virus samples with their disguised modules or units, and further distinguish these abnormal behaviors into attack preparation phase behaviors and attack execution phase behaviors.

[0107] Logging and reporting unit: used to record key information during virus analysis and generate reports based on this information. These reports record key information such as the module's operating status, virus samples and their behavioral characteristics.

[0108] In summary, this system builds a comprehensive, efficient and secure virus protection system by integrating the virus sample management unit, virtual environment management unit, virus behavior analysis unit, and log recording and reporting unit. The system can not only accurately acquire and store virus samples, but also analyze virus behavior in an isolated environment, record key information and generate reports.

[0109] In some embodiments, in order to improve the accuracy of network attack detection, such as Figure 5 As shown, the aforementioned S103 may also include the following steps: S1031 to S1036.

[0110] S1031: For each attack event in the reference attack events, calculate the ratio of the corresponding characteristic state parameter value to the standard parameter value to obtain a trigger index of the attack event.

[0111] In some embodiments, the trigger index represents the degree to which the attack event triggers the event. A higher trigger index indicates that the attack event is more likely to be an obvious attack behavior. A lower trigger index indicates that the attack event is likely to be a system fluctuation or a false alarm. As an example, when the trigger index is 1, it indicates that the attack event is just triggered.

[0112] S1032: Obtain a weight coefficient corresponding to each attack event in the reference attack events, where the weight coefficient is used to represent the relative importance of the attack event in evaluating the network attack.

[0113] In some embodiments, the relative importance of different attack events in evaluating network attacks. Different attack events may have different impacts on the detection system, so they need to be distinguished by weight coefficients. As an example, a weight coefficient can be assigned to each attack event based on the user's experience and the historical operating status information of the attack event. These weight coefficients can be pre-set according to the prevalence and abnormality of the event. Specifically, if the behavior corresponding to an attack event frequently occurs in normal operation, and only the numerical value is abnormal, then the weight coefficient corresponding to the attack event will be relatively low; conversely, if the behavior corresponding to an attack event rarely occurs under normal circumstances, and the numerical value also shows significant abnormalities, then the weight corresponding to the attack event will be higher.

[0114] S1033: Determine a first target attack event and a second target attack event in the reference attack event according to the attack database, wherein the first target attack event is an event that occurs during the attack preparation phase of the attack virus, and the second target attack event is an event that occurs during the attack execution phase of the attack virus.

[0115] In some embodiments, the first target attack event refers to an event that occurs during the attack preparation phase of the attack virus, such as scanning targets, detecting vulnerabilities, etc. The second target attack event refers to an event that occurs during the attack execution phase of the attack virus, such as data theft, system damage, etc.

[0116] S1034: For each first target attack event, calculate the product of the weight coefficient corresponding to the first target attack event and the trigger index to obtain a first trigger value.

[0117] S1035: For each second target attack event, calculate the product of the weight coefficient corresponding to the second target attack event and the trigger index to obtain a second trigger value.

[0118] S1036: Determine whether there is a network attack in the system to be detected according to the multiple first trigger values ​​and the multiple second trigger values.

[0119] As an optional implementation, a lower threshold value T1 is set for the first trigger value, and a higher threshold value T2 is set for the second trigger value. Each first trigger value and second trigger value is calculated, and these trigger values ​​are compared with the corresponding thresholds. If e first trigger values ​​exceed T1, and f second trigger values ​​exceed T2, it is determined that there is a network attack in the system to be detected.

[0120] As another optional implementation, a weight is assigned to each first trigger value and second trigger value according to the severity and impact of the attack event, each trigger value is multiplied by its corresponding weight value, and then all products are added to obtain a weighted sum. A total threshold is set and the weighted sum is compared with the threshold. If the weighted sum exceeds the threshold, it is confirmed that a network attack has occurred.

[0121] In the embodiment of the present application, by calculating the trigger index, the impact of each attack event on the system can be quantitatively evaluated, making the evaluation result more objective and accurate. By introducing the weight coefficient, the relative importance of different attack events in evaluating network attacks can be distinguished, making the evaluation result more in line with the actual situation. Combining multiple first trigger values ​​and multiple second trigger values, it is possible to comprehensively judge whether there is a network attack in the system to be detected, effectively improving the accuracy and reliability of the detection.

[0122] In some embodiments, in order to more accurately assess the actual impact of the event on the network environment, before the aforementioned S1036, as Figure 6 As shown, the method may also include:

[0123] According to the operating state information of the system to be detected in a normal operating state, a first weighing coefficient and a second weighing coefficient are determined.

[0124] In some embodiments, the first measurement coefficient and the second measurement coefficient can be obtained by collecting operating status information of the system to be detected under normal operating conditions, including but not limited to network traffic, system logs, user behavior, etc. The collected data is then analyzed. Next, the first measurement coefficient and the second measurement coefficient are determined using statistical analysis, user experience, or a machine learning model. The measurement coefficient is used to adjust the contribution of different attack events to the network attack, so that the evaluation result is more accurate.

[0125] In other embodiments, the first weighing coefficient and the second weighing coefficient can be set to adjust the detection sensitivity according to different security requirements and risk tolerance. If the security requirement of the system to be detected is high, a lower weighing coefficient is set; if the security requirement of the system to be detected is low, a higher weighing coefficient is set to reduce false positives.

[0126] Based on this, Figure 6 As shown, the aforementioned S1036 may specifically include the following steps: S1036a~S1036e.

[0127] S1036a: Calculate the sum of multiple first trigger values ​​under the reference attack event to obtain a first attack risk assessment value.

[0128] S1036b: Calculate the sum of multiple second trigger values ​​under the reference attack event to obtain a second attack risk assessment value.

[0129] In some embodiments, by calculating the sum of multiple first triggers and the sum of multiple second triggers, the severity of the attack event in the attack preparation stage and the severity of the attack event in the attack execution stage can be quantified.

[0130] S1036c: Determine whether the first attack risk assessment value is greater than the first measurement coefficient, and whether the second attack risk assessment value is greater than the second measurement coefficient. If the judgment result is yes, execute S1036d, if the judgment result is no, execute S1036e.

[0131] S1036d: Determine whether a network attack exists in the system to be detected.

[0132] S1036e: Determine that there is no network attack on the system to be detected.

[0133] In some embodiments, when both the first attack risk assessment value and the second attack risk assessment value exceed their respective measurement coefficients, it is determined that there is a network attack on the system to be detected, thereby achieving rapid identification and response to the network attack and reducing potential damage to the system to be detected. When at least one of the first attack risk assessment value and the second attack risk assessment value does not exceed the corresponding measurement coefficient, it is determined that there is no network attack on the system to be detected, thereby effectively avoiding false alarms and unnecessary waste of resources.

[0134] In the embodiment of the present application, by dividing the attack event into two stages, preparation and execution, and calculating the staged evaluation of the impact respectively, the potential risk and actual impact of the reference attack event can be quantified more accurately, and then the severity of the reference attack event can be evaluated more accurately and comprehensively. By calculating the sum of the impacts of the attack preparation stage and the attack execution stage on the system to be detected, that is, the first attack risk assessment value and the second attack risk assessment value, and respectively using the first measurement coefficient and the second measurement coefficient to perform the first attack risk assessment value and the second attack risk assessment value to evaluate the attack index of the system to be detected. The higher the attack index, the greater the impact of the attack on the system to be detected.

[0135] As an example, the calculation formula for the attack index is as follows:

[0136]

[0137] In formula (1), m is the number of first target attack events, n is the number of second target attack events, λ(i) is the weight coefficient of the i-th first target attack event, η(j) is the weight coefficient of the j-th second target attack event, k1 is the first weight coefficient, and k2 is the second weight coefficient; a i is the trigger index of the first target attack event, b j The trigger index of the second target attack event.

[0138] Based on this, is greater than 0, and When it is greater than 0, it indicates that there is a network attack in the system to be detected.

[0139] Based on the network attack detection method provided in the above embodiment, the present application also provides a specific implementation of a network attack detection device. Please refer to the following embodiment.

[0140] See first Figure 7 The network attack detection device 700 provided in the embodiment of the present application may also include the following modules:

[0141] The first acquisition module 701 is used to acquire the behavior characteristics of the system to be detected, where the behavior characteristics are determined based on the first operating state information of the system to be detected.

[0142] The first determination module 702 is used to match the behavior feature with multiple attack events in the attack database respectively, and when it is determined that there is an attack event corresponding to the behavior feature in the attack database, determine the attack event corresponding to the behavior feature as a reference attack event, and multiple attack events are determined based on the behavior features of multiple attack viruses.

[0143] The second determination module 703 is configured to determine whether there is a network attack in the system to be detected based on the reference attack events when the reference attack events include at least two attack events.

[0144] In the embodiment of the present application, the first determination module 702 is used to match the behavior characteristics of the system to be detected obtained by the first acquisition module 701 with multiple known attack events in the attack database, so that potential reference attack events can be preliminarily identified. However, if there is only a single attack event, there may be accidental or false positives, because a single attack event may be caused by accidental fluctuations in the system, not a real network attack behavior, and multiple attack events combined together are more likely to be real attack behaviors. When the second determination module 703 is used to preliminarily determine that the reference attack event includes at least two attack events, the judgment of whether the system to be detected is subjected to a network attack based on multiple reference attack events can reduce the possibility of such false positives and improve the accuracy of network attack detection. In addition, the method of using the behavior characteristics of the system to be detected for network attack detection does not rely on specific traffic characteristics, but focuses on the behavior pattern of the attack virus in the system. The traffic characteristics can be hidden, and this behavior pattern is relatively difficult to hide, so that the network attack behavior can be accurately captured, thereby improving the sensitivity and accuracy of detection.

[0145] As an implementation of the present application, in order to accurately identify the reference attack event, the first determination module 702 may specifically include:

[0146] The first judgment submodule is used to judge whether there is an attack behavior feature matching the behavior feature in the attack database. If the judgment result is yes, it will be transferred to the second determination submodule for execution. If the judgment result is no, it will be transferred to the first determination submodule for execution.

[0147] The first determination submodule is used to determine that the event corresponding to the behavior feature does not belong to the reference attack event.

[0148] The second determination submodule is used to determine the characteristic state parameter value corresponding to the behavior feature based on the first characteristic operation information and the second characteristic operation information, the first characteristic operation information is the information related to the behavior feature in the first operation state information, and the second characteristic operation information is the information related to the behavior feature when the system to be detected is in a normal operating state.

[0149] The second judgment submodule is used to judge whether the characteristic state parameter value is greater than the standard parameter value. The standard parameter value is the standard threshold value of the attack behavior characteristic under the attack behavior. If the judgment result is yes, it will be transferred to the third determination submodule for execution. If the judgment result is no, it will be transferred to the second determination submodule for execution.

[0150] The third determination submodule is used to determine the attack event corresponding to the behavior feature as a reference attack event.

[0151] As an implementation of the present application, in order to improve the detection efficiency and accuracy of network attack detection, the above-mentioned device may also include:

[0152] The second acquisition module is used to acquire an attack virus sample set, where the attack virus sample set includes multiple virus samples.

[0153] The third acquisition module is used to put each virus sample into an isolated environment of the system for operation, and obtain second operation status information of the system.

[0154] The third determination module is used to compare the second operation status information with the third operation status information of the system in a normal operation state, and determine abnormal information in the second operation status information.

[0155] The fourth determination module is used to extract features from abnormal information to obtain corresponding attack behavior features.

[0156] The fifth determination module is used to determine, for each attack behavior feature, the standard parameter value corresponding to the attack behavior feature and the attack stage according to the second operation status information and the third operation status information, where the attack stage includes the attack preparation stage and the attack execution stage.

[0157] The sixth determination module is used to associate and store each event with its corresponding attack stage to obtain an attack database. The attack event includes attack behavior characteristics and corresponding standard parameter values.

[0158] As an implementation of the present application, in order to improve the accuracy of network attack detection, the second determination module may further include:

[0159] The fourth determination submodule is used to calculate the ratio of the corresponding characteristic state parameter value to the standard parameter value for each attack event in the reference attack events, so as to obtain the trigger index of the attack event.

[0160] The first calculation submodule is used to obtain a weight coefficient corresponding to each attack event in the reference attack event, where the weight coefficient is used to characterize the relative importance of the attack event in evaluating the network attack.

[0161] The fifth determination submodule is used to determine the first target attack event and the second target attack event in the reference attack event according to the attack database, the first target attack event is the event that the attack virus occurs in the attack preparation stage, and the second target attack event is the event that the attack virus occurs in the attack execution stage.

[0162] A second calculation submodule is used to calculate, for each first target attack event, a product of a weight coefficient corresponding to the first target attack event and a trigger index to obtain a first trigger value;

[0163] A third calculation submodule is used to calculate, for each second target attack event, the product of the weight coefficient corresponding to the second target attack event and the trigger index to obtain a second trigger value;

[0164] The sixth determination submodule is used to determine whether there is a network attack in the system to be detected according to the multiple first trigger values ​​and the multiple second trigger values.

[0165] As an implementation of the present application, in order to more accurately evaluate the actual impact of the event on the network environment, the above-mentioned device may also include:

[0166] The seventh determination module is used to determine the first weighing coefficient and the second weighing coefficient according to the operating state information of the system to be detected in the normal operating state.

[0167] As an implementation of the present application, in order to further improve the accuracy of network attack detection, the sixth determination submodule may further include:

[0168] The first calculation unit is used to calculate the sum of multiple first trigger values ​​under the reference attack event to obtain a first attack risk assessment value.

[0169] The second calculation unit is used to calculate the sum of multiple second trigger values ​​under the reference attack event to obtain a second attack risk assessment value.

[0170] The first judgment unit is used to judge whether the first attack risk assessment value is greater than the first measurement coefficient, and whether the second attack risk assessment value is greater than the second measurement coefficient. If the judgment result is yes, it is transferred to the first determination unit for execution; if the judgment result is no, it is transferred to the second determination unit for execution.

[0171] The first determining unit is used to determine whether a network attack exists in the system to be detected.

[0172] The second determining unit is used to determine whether there is no network attack on the system to be detected.

[0173] Figure 8 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application is shown.

[0174] The electronic device may include a processor 801 and a memory 802 storing computer program instructions.

[0175] Specifically, the processor 801 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0176] The memory 802 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 802 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive or a combination of two or more of these. In appropriate cases, the memory 802 may include a removable or non-removable (or fixed) medium. In appropriate cases, the memory 802 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 802 is a non-volatile solid-state memory.

[0177] The memory 802 may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk storage media device, an optical storage media device, a flash memory device, an electrical, optical or other physical / tangible memory storage device. Thus, typically, the memory 802 includes one or more tangible (non-transitory) computer-readable storage media (e.g., a memory device) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to an aspect of the present disclosure.

[0178] The processor 801 implements any one of the network attack detection methods in the above embodiments by reading and executing computer program instructions stored in the memory 802 .

[0179] In one example, the electronic device may further include a communication interface 803 and a bus 810. Figure 8 As shown, the processor 801, the memory 802, and the communication interface 803 are connected via a bus 810 and communicate with each other.

[0180] The communication interface 803 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0181] Bus 810 includes hardware, software or both, and the parts of electronic equipment are coupled to each other.For example, but not limitation, bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industrial standard architecture (EISA) bus, front side bus (FSB), hypertransport (HT) interconnection, industrial standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations. In appropriate cases, bus 810 may include one or more buses. Although the present application embodiment describes and shows a specific bus, the application considers any suitable bus or interconnection.

[0182] The electronic device can execute the network attack detection method in the embodiment of the present application, thereby realizing the combination Figure 1 and Figure 7 A network attack detection method and apparatus are described.

[0183] In addition, in combination with the network attack detection method in the above embodiment, the embodiment of the present application can provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when the computer program instructions are executed by the processor, any one of the network attack detection methods in the above embodiment is implemented.

[0184] In addition, in combination with the network attack detection method in the above embodiment, an embodiment of the present application can provide a computer program product, which includes a computer program, and when the computer program is processed and executed, it implements any of the above-mentioned network attack detection methods.

[0185] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0186] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0187] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be performed simultaneously.

[0188] Aspects of the present disclosure are described above with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the implementation of the function / action specified in one or more boxes of the flowchart and / or block diagram. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field programmable logic circuit. It can also be understood that each box in the block diagram and / or flowchart and the combination of boxes in the block diagram and / or flowchart can also be implemented by dedicated hardware that performs a specified function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0189] The above is only a specific implementation of the present application. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the protection scope of the present application is not limited to this. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the protection scope of this application.

Claims

1. A network attack detection method, characterized in that: The method comprises: Acquire a behavior feature of the system to be detected, where the behavior feature is determined based on first operating state information of the system to be detected; Matching the behavior feature with a plurality of attack events in an attack database respectively, and determining the attack event corresponding to the behavior feature as a reference attack event when it is determined that the attack database contains an attack event corresponding to the behavior feature, wherein the plurality of attack events are determined based on the behavior features of a plurality of attack viruses; In a case where the reference attack events include at least two attack events, it is determined whether there is a network attack in the system to be detected based on the reference attack events.

2. The method according to claim 1, characterized in that Before matching the behavior feature with a plurality of attack events in the attack database respectively, the method further includes: Acquire an attack virus sample set, wherein the attack virus sample set includes a plurality of virus samples; For each virus sample, the virus sample is placed in the isolated environment of the system for operation, and the following operations A1 to A4 are performed: A1: Acquire second operating state information of the system; A2: comparing the second operating state information with the third operating state information of the system in a normal operating state, and determining abnormal information in the second operating state information; A3: Extract features from the abnormal information to obtain corresponding attack behavior features; A4: for each attack behavior feature, determine the standard parameter value corresponding to the attack behavior feature and the attack stage according to the second operation state information and the third operation state information, where the attack stage includes an attack preparation stage and an attack execution stage; Each event is associated with its corresponding attack stage and stored to obtain an attack database, wherein the attack event includes attack behavior characteristics and corresponding standard parameter values.

3. The method according to claim 1 or 2, characterized in that: The matching of the behavior feature with a plurality of attack events in the attack database respectively, and determining the attack event corresponding to the behavior feature as a reference attack event when it is determined that the attack database contains an attack event corresponding to the behavior feature, includes: For each behavioral characteristic, do the following: When the behavior feature satisfies a first matching condition, the following operations are performed, wherein the first matching condition is that there is an attack behavior feature matching the behavior feature in the attack database: Determine a characteristic state parameter value corresponding to the behavior characteristic according to first characteristic operation information and second characteristic operation information, wherein the first characteristic operation information is information related to the behavior characteristic in the first operation state information, and the second characteristic operation information is information related to the behavior characteristic when the system to be detected is in a normal operation state; In the case where the characteristic state parameter value is greater than the standard parameter value, the attack event corresponding to the behavior feature is determined as a reference attack event, and the standard parameter value is a standard threshold value of the attack behavior feature under attack behavior.

4. The method according to claim 2, characterized in that: In the case where the reference attack event includes at least two attack events, determining whether there is a network attack in the system to be detected based on the reference attack event includes: For each attack event in the reference attack events, the ratio of the corresponding characteristic state parameter value to the standard parameter value is calculated to obtain a trigger index of the attack event; Obtaining a weight coefficient corresponding to each attack event in the reference attack event, wherein the weight coefficient is used to characterize the relative importance of the attack event in evaluating the network attack; Determine, according to the attack database, a first target attack event and a second target attack event in the reference attack event, wherein the first target attack event is an event that occurs during the attack preparation phase of the attack virus, and the second target attack event is an event that occurs during the attack execution phase of the attack virus; For each first target attack event, calculate the product of the weight coefficient corresponding to the first target attack event and the trigger index to obtain a first trigger value; For each second target attack event, calculate the product of the weight coefficient corresponding to the second target attack event and the trigger index to obtain a second trigger value; It is determined whether there is a network attack in the system to be detected according to the multiple first trigger values ​​and the multiple second trigger values.

5. The method according to claim 4, characterized in that Before determining whether a network attack exists in the system to be detected according to the plurality of first trigger values ​​and the plurality of second trigger values, the method further includes: Determining a first weighing coefficient and a second weighing coefficient according to the operating state information of the system to be detected in a normal operating state; The determining, according to the plurality of first trigger values ​​and the plurality of second trigger values, whether there is a network attack in the system to be detected comprises: Calculating a sum of multiple first trigger values ​​under the reference attack event to obtain a first attack risk assessment value; Calculating a sum of multiple second trigger values ​​under the reference attack event to obtain a second attack risk assessment value; When the first attack risk assessment value is greater than the first measurement coefficient, and the second attack risk assessment value is greater than the second measurement coefficient, it is determined that a network attack exists in the system to be detected.

6. The method according to claim 2, characterized in that The step of obtaining the attack virus sample set includes: Collect attack virus sample sets through the cloud resource pool.

7. A network attack detection device, characterized in that: The device comprises: A first acquisition module, used to acquire a behavior feature of the system to be detected, wherein the behavior feature is determined based on first operating state information of the system to be detected; A first determination module is used to match the behavior feature with a plurality of attack events in an attack database respectively, and if it is determined that an attack event corresponding to the behavior feature exists in the attack database, determine the attack event corresponding to the behavior feature as a reference attack event, wherein the plurality of attack events are determined based on the behavior features of a plurality of attack viruses; The second determination module is used to determine whether there is a network attack in the system to be detected based on the reference attack events when the reference attack events include at least two attack events.

8. An electronic device, characterized in that: The device comprises: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the network attack detection method according to any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by the processor, the network attack detection method according to any one of claims 1 to 6 is implemented.

10. A computer program product, characterized in that It comprises a computer program, which, when executed, implements the network attack detection method according to any one of claims 1 to 6.

Images