Network attack detection methods, devices, equipment, storage media, and program products

Abstract

This application discloses a method, apparatus, device, storage medium, and program product for detecting network attacks. The method includes: acquiring behavioral characteristics of a system to be detected, the behavioral characteristics being determined based on first operational state information of the system to be detected; matching the behavioral characteristics with multiple attack events in an attack database, and, if it is determined that an attack event corresponding to the behavioral characteristics exists in the attack database, determining the attack event corresponding to the behavioral characteristics as a reference attack event, wherein the multiple attack events are determined based on the behavioral characteristics of various attack viruses; and, if the reference attack event includes at least two attack events, determining whether a network attack exists in the system to be detected based on the reference attack event. According to the embodiments of this application, network attacks can be effectively identified and detected.

Description

Technical Field

[0001] This invention belongs to the technical field of network security, and particularly relates to a network attack detection method, apparatus, device, storage medium, and program product. Background Technology

[0002] A cyberattack refers to any type of offensive action against a computer information system, computer network, or personal computer device. These cyberattacks aim to disrupt software or services, or to gain unauthorized access to data. To maintain network security, cyberattack detection is crucial. Cyberattack detection involves monitoring data such as traffic, logs, and behavior within a network system to identify potential cyberattacks, thus supporting the maintenance of network security.

[0003] Network attack detection primarily relies on identifying known signature strings in traffic, such as public resource pool domains, specific wallet addresses, and keywords. This detection method is effective against known network attacks. However, to evade detection, attackers may use private resource pools to hide the attack source and employ encryption protocols to protect communication content. In such cases, because the traffic characteristics and strings used by the attacker are unknown to the detection system, existing detection methods based on known signature strings may fail, unable to effectively identify and detect these network attacks. Summary of the Invention

[0004] This invention provides a network attack detection method, apparatus, device, storage medium, and program product that can effectively identify and detect network attacks.

[0005] In a first aspect, embodiments of this application provide a network attack detection method, the method comprising:

[0006] The behavioral characteristics of the system under test are obtained, and the behavioral characteristics are determined based on the first operating state information of the system under test.

[0007] The behavioral characteristics are matched with multiple attack events in the attack database. If it is determined that there is an attack event in the attack database that corresponds to the behavioral characteristics, the attack event corresponding to the behavioral characteristics is determined as a reference attack event. Multiple attack events are determined based on the behavioral characteristics of multiple attack viruses.

[0008] If the reference attack event includes at least two attack events, determine whether a network attack exists in the system to be detected based on the reference attack event.

[0009] As an optional implementation, the method further includes the following before matching the behavioral characteristics with multiple attack events in the attack database:

[0010] Obtain an attack virus sample set, which includes multiple virus samples;

[0011] For each virus sample, run it in the system's isolated environment and perform the following operations A1 to A4:

[0012] A1: Obtain the system's second operating status information;

[0013] A2: Compare the second operating status information with the third operating status information of the system under normal operating conditions to determine the abnormal information in the second operating status information;

[0014] A3: Extract features from abnormal information to obtain the corresponding attack behavior features;

[0015] A4: For each attack behavior feature, determine the standard parameter value and the attack stage corresponding to the attack behavior feature based on the second and third running status information. The attack stage includes the attack preparation stage and the attack execution stage.

[0016] Each event is associated with its corresponding attack stage and stored to obtain an attack database. Attack events include attack behavior characteristics and corresponding standard parameter values.

[0017] As an optional implementation, the behavioral characteristics are matched against multiple attack events in the attack database. If an attack event corresponding to the behavioral characteristics is found in the attack database, that attack event is designated as a reference attack event, including:

[0018] For each behavioral characteristic, perform the following operations:

[0019] If the behavioral characteristics meet the first matching condition, perform the following operations: The first matching condition is that there is an attack behavior characteristic in the attack database that matches the behavioral characteristics.

[0020] Based on the first feature operation information and the second feature operation information, the feature state parameter values ​​corresponding to the behavioral features are determined. The first feature operation information is the information related to the behavioral features in the first operation state information, and the second feature operation information is the information related to the behavioral features when the system to be detected is in normal operation.

[0021] If the value of the feature state parameter is greater than the value of the standard parameter, the attack event corresponding to the behavior feature is determined as the reference attack event, and the standard parameter value is the standard threshold of the attack behavior feature under the attack behavior.

[0022] As an optional implementation, when the reference attack event includes at least two attack events, the existence of a network attack in the system to be detected is determined based on the reference attack event, including:

[0023] For each attack event in the reference attack events, the ratio of the corresponding characteristic state parameter value to the standard parameter value is calculated to obtain the triggering index of the attack event;

[0024] Obtain the weight coefficient corresponding to each attack event in the reference attack events. The weight coefficient is used to characterize the relative importance of the attack event when evaluating the network attack.

[0025] Based on the attack database, the first target attack event and the second target attack event in the reference attack events are identified. The first target attack event is the event that occurs during the attack preparation phase of the attack virus, and the second target attack event is the event that occurs during the attack execution phase of the attack virus.

[0026] For each first target attack event, calculate the product of the weight coefficient and the trigger index corresponding to the first target attack event to obtain the first trigger value;

[0027] For each second target attack event, the product of the weight coefficient and the triggering index corresponding to the second target attack event is calculated to obtain the second triggering value;

[0028] Based on multiple first trigger values ​​and multiple second trigger values, determine whether a network attack exists in the system to be detected.

[0029] As an optional implementation, before determining whether a network attack exists in the system to be detected based on multiple first trigger values ​​and multiple second trigger values, the method further includes:

[0030] Based on the operating status information of the system under test when it is in normal operating condition, determine the first and second measurement coefficients;

[0031] Based on multiple first trigger values ​​and multiple second trigger values, determine whether a network attack exists in the system under test, including:

[0032] The sum of multiple first trigger values ​​under the reference attack event is calculated to obtain the first attack risk assessment value;

[0033] The sum of multiple second trigger values ​​under the reference attack event is calculated to obtain the second attack risk assessment value;

[0034] If the first attack risk assessment value is greater than the first measurement coefficient, and the second attack risk assessment value is greater than the second measurement coefficient, it is determined that the system under test is under network attack.

[0035] As an optional implementation, obtaining a sample set of attack viruses includes:

[0036] Collect attack virus sample sets through cloud resource pools.

[0037] Secondly, embodiments of this application provide a network attack detection device, the device comprising:

[0038] The first acquisition module is used to acquire the behavioral characteristics of the system to be detected, and the behavioral characteristics are determined based on the first operating state information of the system to be detected.

[0039] The first determination module is used to match the behavioral characteristics with multiple attack events in the attack database, and if it is determined that there is an attack event in the attack database that corresponds to the behavioral characteristics, the attack event corresponding to the behavioral characteristics is determined as a reference attack event. Multiple attack events are determined based on the behavioral characteristics of multiple attack viruses.

[0040] The second determining module is used to determine whether a network attack exists in the system to be detected based on the reference attack event, when the reference attack event includes at least two attack events.

[0041] Thirdly, embodiments of this application provide an electronic device, which includes: a processor and a memory storing computer program instructions; the processor, when executing the computer program instructions, implements the network attack detection method as described in any of the first aspects.

[0042] Fourthly, embodiments of this application provide a computer storage medium storing computer program instructions, which, when executed by a processor, implement the network attack detection method as described in any of the first aspects.

[0043] Fifthly, embodiments of this application provide a computer program product, which includes a computer program that, when executed, implements the network attack detection method of any one of the first aspects.

[0044] The network attack detection method, apparatus, device, storage medium, and program product of this application can initially identify potential reference attack events by matching the behavioral characteristics of the system under test with multiple known attack events in an attack database. However, if there is only a single attack event, there may be randomness or false alarms, because a single attack event may originate from random fluctuations in the system and is not a real network attack, while multiple attack events combined are more likely to be a real attack. Therefore, only when it is initially determined that the reference attack events include at least two attack events, and then the determination of whether the system under test has been subjected to a network attack is made based on multiple reference attack events, can the possibility of such false alarms be reduced and the accuracy of network attack detection be improved.

[0045] This method of detecting network attacks by using the behavioral characteristics of the system under test does not rely on specific traffic characteristics, but focuses on the behavioral patterns of attacking viruses in the system. Traffic characteristics can be hidden, but these behavioral patterns are relatively difficult to hide, thus enabling accurate capture of network attack behavior and improving the sensitivity and accuracy of detection. Attached Figure Description

[0046] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1 A flowchart illustrating a network attack detection method according to an embodiment of this application is shown;

[0048] Figure 2 A flowchart illustrating a specific implementation of S102 provided in an embodiment of this application is shown;

[0049] Figure 3 This illustration shows a flowchart of constructing an attack database according to an embodiment of this application;

[0050] Figure 4 This illustration shows a schematic diagram of the phased behavior of a network attack according to an embodiment of this application;

[0051] Figure 5 A flowchart illustrating a specific implementation of S103 provided in an embodiment of this application is shown;

[0052] Figure 6 A flowchart illustrating a specific implementation of S1036 provided in an embodiment of this application is shown.

[0053] Figure 7 This is a schematic diagram of the structure of a network attack detection device provided in one embodiment of this application;

[0054] Figure 8 This is a schematic diagram of the structure of an electronic device provided in one embodiment of this application. Detailed Implementation

[0055] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0056] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0057] To address the limitation that existing detection methods based on known feature strings may not be effective in identifying and detecting encrypted network attacks, this application provides a network attack detection method, apparatus, device, storage medium, and program product. The network attack detection method provided in this application is described below.

[0058] Figure 1 A flowchart illustrating a network attack detection method according to an embodiment of this application is shown. Figure 1 As shown, the method includes the following steps: S101 to S103.

[0059] S101: Obtain the behavioral characteristics of the system under test, which are determined based on the first operating state information of the system under test.

[0060] S102: Match the behavioral characteristics with multiple attack events in the attack database, and if it is determined that there is an attack event in the attack database that corresponds to the behavioral characteristics, determine the attack event that corresponds to the behavioral characteristics as a reference attack event. Multiple attack events are determined based on the behavioral characteristics of multiple attack viruses.

[0061] S103: If the reference attack event includes at least two attack events, determine whether a network attack exists in the system to be detected based on the reference attack event.

[0062] In this embodiment, potential reference attack events can be initially identified by matching the behavioral characteristics of the system under test with multiple known attack events in the attack database. However, if only a single attack event exists, there may be cases of chance or false alarms, because a single attack event may originate from accidental fluctuations in the system and is not a real network attack, while multiple attack events combined are more likely to be a real attack. Therefore, only when it is initially determined that the reference attack events include at least two attack events, and then the determination of whether the system under test has suffered a network attack is made based on multiple reference attack events, can the possibility of such false alarms be reduced and the accuracy of network attack detection be improved.

[0063] Furthermore, the method of detecting network attacks by using the behavioral characteristics of the system under test does not rely on specific traffic characteristics, but focuses on the behavioral patterns of attacking viruses in the system. Traffic characteristics can be hidden, but these behavioral patterns are relatively difficult to hide, thus enabling accurate capture of network attack behavior and improving the sensitivity and accuracy of detection.

[0064] In some embodiments, in S101, the first operating status information refers to a series of data or parameters reflecting the current operating status of the system under test. This data includes, but is not limited to, the performance indicators, resource usage, network activity, and process status of the system under test. Specifically, it can be acquired through an information acquisition module deployed on the system under test. This information acquisition module may include a system resource monitoring unit, a process activity monitoring unit, and a network communication monitoring unit.

[0065] The system resource monitoring unit is used to monitor the resource usage of the system under test, specifically including:

[0066] CPU monitoring subunit: Used to periodically collect CPU utilization data of the system under test.

[0067] Memory monitoring subunit: Used to record the memory usage of the system under test, which may include used memory, available memory and swap memory.

[0068] Hard disk monitoring subunit: Used to monitor disk space usage, specifically including real-time data on the remaining space and total capacity of each disk partition.

[0069] Network bandwidth monitoring subunit: Used to monitor the transmission rate of network interfaces and detect network traffic.

[0070] The process activity monitoring unit is used to monitor the processes running in the system under test, and may specifically include:

[0071] Process recording sub-unit: Used to record all running processes in the system under test, including process ID, process name, parent process ID, and child process ID.

[0072] Process resource usage monitoring subunit: used to monitor the CPU usage, memory usage, and network resource usage of each process.

[0073] Process behavior monitoring subunit: Used to monitor process behavior, specifically file operation behavior and network communication behavior.

[0074] The network communication monitoring unit is used to monitor the network communication activities of the system under test, specifically including:

[0075] Network connection record sub-unit: Used to record network connection information established in the system, including source IP address, destination IP address, port, and connection status.

[0076] Network traffic monitoring subunit: Used to monitor the size and direction of network traffic.

[0077] Based on this, in some embodiments, features such as CPU utilization, memory usage, and network traffic can be extracted from the first operating status information collected by the information acquisition module. Then, the extracted features are processed using statistical methods or machine learning algorithms to accurately describe the behavioral characteristics of the system under test, such as abnormal memory usage.

[0078] In some embodiments, in S102, the attack database includes behavioral characteristics and related information of various attack events based on multiple known attack viruses. This related information describes the specific manifestation of the behavioral characteristics under the attack event in the system to be detected. As an optional implementation, a feature matching algorithm can be used to traverse the behavioral characteristics of each attack event in the attack database and compare and match them with the extracted behavioral characteristics of the system to be detected. If the matching conditions are met, the corresponding attack event is determined as a reference attack event for the system to be detected.

[0079] To accurately identify reference attack events, this application also provides a specific implementation of S102. For example... Figure 2 As shown, the aforementioned S102 may specifically include performing the following steps for each behavioral feature: S1021 to S1025.

[0080] S1021: Determine whether there is an attack behavior feature in the attack database that matches the behavior feature. If the result is yes, execute S1023; if the result is no, execute S1022.

[0081] S1022: Determine that the event corresponding to the behavioral characteristics does not belong to the reference attack event.

[0082] In some embodiments, by setting a first matching condition, potential abnormal or attack behaviors can be quickly filtered out, and a large number of normal behaviors can be quickly eliminated, so that resources can be concentrated on analyzing potential threat behaviors that need further verification and optimizing resource allocation.

[0083] S1023: Determine the feature state parameter value corresponding to the behavior feature based on the first feature operation information and the second feature operation information. The first feature operation information is the information related to the behavior feature in the first operation state information, and the second feature operation information is the information related to the behavior feature when the system to be detected is in normal operation.

[0084] In some embodiments, the characteristic state parameter value can reflect the degree of deviation between the current state and the normal state of the system to be detected. It can be determined by calculating the difference between the first characteristic operating information (current state value) and the second characteristic operating information (normal state value). Specifically, the relative difference or percentage difference between the current value and the normal value can be calculated.

[0085] S1024: Determine whether the feature state parameter value is greater than the standard parameter value. The standard parameter value is the standard threshold of the attack behavior feature under attack behavior. If the determination result is yes, execute S1025. If the determination result is no, execute S1022.

[0086] In some embodiments, the standard parameter value is a preset or standard data value associated with attack behavior characteristics, used to reflect the standard threshold of the system under test when attack behavior characteristics occur. It is typically determined based on factors such as the normal operating status and historical data of the system under test. The system under test records the characteristic state parameter value corresponding to the attack behavior characteristic and compares it with the standard parameter value of the corresponding attack event to determine whether the characteristic state parameter value exceeds the range, thereby determining whether an attack event has been triggered.

[0087] S1025: Identify the attack event corresponding to the behavioral characteristics as the reference attack event.

[0088] In this embodiment, by extracting target operational status information associated with behavioral characteristics from operational status information and determining feature status parameter values, the system can perform refined analysis on specific behavioral characteristics. When the feature status parameter value is greater than a standard parameter value, an attack event corresponding to the current behavioral characteristic can be identified as a reference attack event, indicating that a possible attack event has been identified. When the feature status parameter value does not exceed the standard parameter value, it can be considered that the current behavioral characteristic has not yet reached the level of triggering an attack event. By judging reference attack events using quantified data values, potential attack events on the system to be detected can be effectively identified.

[0089] To improve the efficiency and accuracy of network attack detection, standard parameter values ​​for each known attack behavior characteristic can be pre-stored in an attack database. When judging behavior characteristics, these predefined standard parameter values ​​can be directly retrieved from this attack database for calculation. Based on this, such as... Figure 3 As shown, before the aforementioned S102, the method further includes the following steps: S301 to S306.

[0090] S301: Obtain the attack virus sample set, which includes multiple virus samples.

[0091] In some embodiments, attack virus sample sets can be collected through cloud resource pools. Cloud resource pools not only broaden the channels for obtaining virus information, but also aggregate virus samples from numerous sources. With the help of the vast network of cloud resource pools, attack virus sample sets can be collected more extensively. Compared with single-channel collection methods, this method has stronger coverage and ensures the comprehensiveness and effectiveness of the samples.

[0092] S302: For each virus sample, place the virus sample in the system's isolation environment to run, and obtain the system's second running status information.

[0093] In some embodiments, running a virus sample directly on the main system may lead to system infection or data loss. Therefore, running the virus in an isolated environment can effectively ensure the security of the main system. The virus sample is run in an isolated, controlled environment, and then the aforementioned information collection unit collects second operational status information of the system, such as the virus's behavior patterns, network activity, and file operations. For details regarding the specific content of the second operational status information and the specific architecture of the information collection unit, please refer to the foregoing description; further details will not be elaborated here.

[0094] As an example, an isolated environment can include a sandbox, virtual machine, container, or isolated network. Running known security attack virus samples within an isolated environment allows for the capture and analysis of typical weak behavioral characteristics of these viruses before and during the attack. These weak behavioral characteristics include, but are not limited to, small-scale file copying and the collection of sensitive information. By continuously recording and monitoring changes in specific data, such as the frequency of file access (normally 30 to 50 times per second), the characteristics of these attack viruses can be effectively extracted and identified.

[0095] S303: Compare the second operating status information with the third operating status information of the system under normal operating conditions to determine the abnormal information in the second operating status information.

[0096] In some embodiments, abnormal information refers to data or behavioral patterns that deviate from normal behavior patterns during system operation. The second operational status information (i.e., the system state during virus operation) is compared with the third operational status information (i.e., the state when the system is operating normally) to identify discrepancies.

[0097] S304: Extract features from abnormal information to obtain the corresponding attack behavior features.

[0098] In some embodiments, techniques such as machine learning, pattern recognition, or rule engines can be used to extract indicative features from the collected data. These features may include file access patterns, network connection behavior, system process activity, memory usage, etc.

[0099] S305: For each attack behavior feature, determine the standard parameter value and the attack stage corresponding to the attack behavior feature based on the second and third running status information. The attack stage includes the attack preparation stage and the attack execution stage.

[0100] In some implementation scenarios, such as Figure 4 As shown, during the preparation phase of an attack, attackers typically perform a series of premeditated actions, such as releasing specific files to lurk within the system, collecting system information to assess the target's vulnerabilities, hijacking system resources to achieve long-term control, and ensuring the persistence of suspicious behavior to maintain the attack's effectiveness. When the attack enters the execution phase, attackers begin to utilize the resources and information acquired during the preparation phase, such as consuming system resources (CPU), and may even attempt to access ports that would be considered suspicious if accessed at abnormal times. To effectively detect these attack behaviors, a comparative analysis of the data with data from normal system execution can be used to identify potential security threats.

[0101] S306: Associate each event with its corresponding attack stage to obtain an attack database. Attack events include attack behavior characteristics and corresponding standard parameter values.

[0102] In this embodiment of the application, by constructing an attack database that includes multiple attack behavior characteristics and corresponding standard parameter values, it is helpful to accurately identify known attack behaviors in the system to be detected.

[0103] As a possible implementation for building an efficient and secure virus protection system, the system may also include: a virus sample management unit, a virtual environment management unit, a virus behavior analysis unit, a log recording and reporting unit, and a performance optimization unit. The specific functions of these units are as follows:

[0104] Virus Sample Management Unit: This unit manages the collection, storage, and timely updates of virus samples. It accurately acquires virus samples from verified, secure sources, ensuring sample diversity and representativeness. The samples are then securely stored in a hardened database or dedicated storage media to guarantee a high level of security and integrity. Furthermore, the virus sample database is regularly updated to ensure timely response and effective defense against the latest virus threats.

[0105] The Isolation Environment Management Unit is used to configure and manage the isolation environment during virus sample analysis. This ensures that virus samples run in an isolated and secure environment, completely isolating them from any potential impact on the main system. As a preferred example, a virtual system can be built and set to sandbox mode. This unit restricts the virus sample's access to the main system, effectively preventing the virus sample from escaping the virtual environment and ensuring the security of the main system. Simultaneously, this unit monitors the virtual environment's operational status in real time, including key indicators such as CPU utilization, memory usage, and disk space usage. Multiple monitoring thresholds are pre-set (e.g., a CPU utilization threshold of 90%) to ensure that the virus sample's behavior does not cause the virtual environment to crash or affect the performance of other modules.

[0106] Virus Behavior Analysis Unit: Used to monitor the behavior of virus samples in the quarantine environment. Specifically, it detects and identifies suspicious or malicious process activities by analyzing all process behaviors performed by the virus sample in the quarantine environment. This detailed analysis covers not only file operations, network communication (such as abnormal or large-volume network activity), and registry modifications, but also accurately identifies abnormal behaviors by comparing the normal behavior of the virus sample with that of its disguised modules or units, and further distinguishes these abnormal behaviors into attack preparation phase behaviors and attack execution phase behaviors.

[0107] Log recording and reporting unit: Used to record key information during the virus analysis process and generate reports based on this information. These reports record key information such as the module's operating status, virus samples, and their behavioral characteristics.

[0108] In summary, this system integrates a virus sample management unit, a virtual environment management unit, a virus behavior analysis unit, and a log recording and reporting unit to build a comprehensive, efficient, and secure virus protection system. This system can not only accurately acquire and store virus samples, but also analyze virus behavior in an isolated environment, record key information, and generate reports.

[0109] In some embodiments, to improve the accuracy of network attack detection, such as Figure 5 As shown, the aforementioned S103 may further include the following steps: S1031 to S1036.

[0110] S1031: For each attack event in the reference attack event, calculate the ratio of the corresponding characteristic state parameter value to the standard parameter value to obtain the triggering index of the attack event.

[0111] In some embodiments, the trigger index characterizes the degree to which an attack event is triggered. A higher trigger index indicates that the attack event is more likely to be an obvious attack. A lower trigger index indicates that the attack event may be a system fluctuation or a false alarm. As an example, a trigger index of 1 represents an attack event that is exactly triggered.

[0112] S1032: Obtain the weight coefficient corresponding to each attack event in the reference attack events. The weight coefficient is used to characterize the relative importance of the attack event in evaluating the network attack.

[0113] In some embodiments, different attack events are evaluated based on their relative importance in assessing network attacks. Different attack events may have varying impacts on the detection system, thus requiring differentiation through weighting coefficients. As an example, a weighting coefficient can be assigned to each attack event based on user experience and historical operational information. These weighting coefficients can be pre-set based on the prevalence and anomaly of the event. Specifically, if an attack event corresponds to behavior that occurs frequently during normal operation, but is only numerically abnormal, then the weighting coefficient for that attack event will be relatively low; conversely, if an attack event corresponds to behavior that rarely occurs under normal circumstances, and also exhibits significant numerical anomalies, then the weighting coefficient for that attack event will be high.

[0114] S1033: Based on the attack database, determine the first target attack event and the second target attack event in the reference attack events. The first target attack event is the event that occurs during the attack preparation phase of the attack virus, and the second target attack event is the event that occurs during the attack execution phase of the attack virus.

[0115] In some embodiments, a first-target attack event refers to an event that occurs during the attack preparation phase of the attack virus, such as scanning targets or probing vulnerabilities. A second-target attack event refers to an event that occurs during the attack execution phase of the attack virus, such as data theft or system damage.

[0116] S1034: For each first target attack event, calculate the product of the weight coefficient and the trigger index corresponding to the first target attack event to obtain the first trigger value.

[0117] S1035: For each second target attack event, calculate the product of the weight coefficient and the trigger index corresponding to the second target attack event to obtain the second trigger value.

[0118] S1036: Determine whether a network attack exists in the system to be detected based on multiple first trigger values ​​and multiple second trigger values.

[0119] As an optional implementation, a lower threshold T1 is set for the first trigger value, and a higher threshold T2 is set for the second trigger value. Each first and second trigger value is calculated and compared to its corresponding threshold. If e first trigger values ​​exceed T1 and f second trigger values ​​exceed T2, a network attack is determined to exist in the system under test.

[0120] As an alternative implementation, a weight is assigned to each first and second trigger value based on the severity and impact of the attack. Each trigger value is multiplied by its corresponding weight, and all products are summed to obtain a weighted sum. A total threshold is set, and the weighted sum is compared to this threshold. If the weighted sum exceeds the threshold, a network attack is confirmed.

[0121] In this embodiment, by calculating the trigger index, the impact of each attack event on the system can be quantitatively assessed, making the assessment results more objective and accurate. By introducing weighting coefficients, the relative importance of different attack events in assessing network attacks can be distinguished, making the assessment results more consistent with reality. Combining multiple first trigger values ​​and multiple second trigger values, a comprehensive judgment can be made as to whether a network attack exists in the system under test, effectively improving the accuracy and reliability of detection.

[0122] In some embodiments, in order to more accurately assess the actual impact of the event on the network environment, before the aforementioned S1036, such as Figure 6 As shown, the method may further include:

[0123] Based on the operating status information of the system under test when it is in normal operating condition, the first and second measurement coefficients are determined.

[0124] In some embodiments, the first and second measurement coefficients can be obtained by collecting operational status information of the system under test during normal operation, including but not limited to network traffic, system logs, and user behavior. The collected data is then analyzed. Next, statistical analysis, user experience, or machine learning models are used to determine the first and second measurement coefficients. These measurement coefficients are used to adjust the contribution of different attack events to the network attack, making the evaluation results more accurate.

[0125] In other embodiments, the setting of the first and second measurement coefficients can be adjusted to adjust the detection sensitivity according to different security requirements and risk tolerance. If the security requirements of the system under test are high, a lower measurement coefficient is set; if the security requirements of the system under test are low, a higher measurement coefficient is set to reduce false alarms.

[0126] Based on this, such as Figure 6 As shown, the aforementioned S1036 may specifically include the following steps: S1036a~S1036e.

[0127] S1036a: Calculate the sum of multiple first trigger values ​​under the reference attack event to obtain the first attack risk assessment value.

[0128] S1036b: Calculate the sum of multiple second trigger values ​​under the reference attack event to obtain the second attack risk assessment value.

[0129] In some embodiments, the severity of an attack event in the attack preparation phase and the severity of an attack event in the attack execution phase can be quantified by calculating the sum of multiple first triggers and the sum of multiple second triggers.

[0130] S1036c: Determine whether the first attack risk assessment value is greater than the first measurement coefficient, and whether the second attack risk assessment value is greater than the second measurement coefficient. If the determination result is yes, execute S1036d; if the determination result is no, execute S1036e.

[0131] S1036d: The system under test has been identified as being under a network attack.

[0132] S1036e: Determined that the system under test is not subject to network attacks.

[0133] In some embodiments, if both the first attack risk assessment value and the second attack risk assessment value exceed their respective measurement coefficients, it is determined that the system under test is under attack, enabling rapid identification and response to network attacks and reducing potential damage to the system under test. If at least one of the first and second attack risk assessment values ​​does not exceed its corresponding measurement coefficient, it is determined that the system under test is not under attack, effectively avoiding false alarms and unnecessary waste of resources.

[0134] In this embodiment, by dividing the attack event into two phases—preparation and execution—and calculating the phased impact assessments separately, the potential risks and actual impacts of the reference attack event can be quantified more accurately, thereby enabling a more accurate and comprehensive assessment of the severity of the reference attack event. The attack index of the system under test is evaluated by calculating the sum of the impacts of the attack preparation and execution phases on the system under test, i.e., the first attack risk assessment value and the second attack risk assessment value, and then applying the first and second measurement coefficients respectively. A higher attack index indicates a greater impact of the attack on the system under test.

[0135] As an example, the formula for calculating the attack index is as follows:

[0136]

[0137] In equation (1), m is the number of first-target attack events, n is the number of second-target attack events, λ(i) is the weight coefficient of the i-th first-target attack event, η(j) is the weight coefficient of the j-th second-target attack event, k1 is the first measurement coefficient, and k2 is the second measurement coefficient; a i b is the trigger index for the first target attack event. j This is the trigger index for the second target attack event.

[0138] Based on this, Greater than 0, and A value greater than 0 indicates that a network attack exists in the system being tested.

[0139] Based on the network attack detection method provided in the above embodiments, this application also provides specific implementations of a network attack detection device. Please refer to the following embodiments.

[0140] First see Figure 7 The network attack detection device 700 provided in this application embodiment may further include the following modules:

[0141] The first acquisition module 701 is used to acquire the behavioral characteristics of the system to be detected, and the behavioral characteristics are determined based on the first operating state information of the system to be detected.

[0142] The first determining module 702 is used to match the behavioral characteristics with multiple attack events in the attack database, and if it is determined that there is an attack event in the attack database that corresponds to the behavioral characteristics, the attack event corresponding to the behavioral characteristics is determined as a reference attack event. The multiple attack events are determined based on the behavioral characteristics of multiple attack viruses.

[0143] The second determining module 703 is used to determine whether a network attack exists in the system to be detected based on the reference attack event, when the reference attack event includes at least two attack events.

[0144] In this embodiment, the first determining module 702 matches the behavioral characteristics of the system to be detected, obtained by the first acquiring module 701, with multiple known attack events in the attack database to initially identify potential reference attack events. However, if there is only a single attack event, there may be accidental or false alarms, because a single attack event may originate from accidental fluctuations in the system and is not a real network attack, while multiple attack events combined are more likely to be real attacks. The second determining module 703, after initially determining that the reference attack events include at least two attack events, further determines whether the system to be detected has been subjected to a network attack based on multiple reference attack events, which can reduce the possibility of false alarms and improve the accuracy of network attack detection. Furthermore, the method of using the behavioral characteristics of the system to be detected for network attack detection does not rely on specific traffic characteristics, but focuses on the behavioral patterns of attack viruses in the system. Traffic characteristics can be hidden, but these behavioral patterns are relatively difficult to hide, thus enabling accurate capture of network attack behavior and improving the sensitivity and accuracy of detection.

[0145] As one implementation of this application, in order to accurately identify reference attack events, the aforementioned first determining module 702 may specifically include:

[0146] The first judgment submodule is used to determine whether there are attack behavior characteristics that match the behavior characteristics in the attack database. If the judgment result is yes, it will transfer to the second determination submodule for execution; if the judgment result is no, it will transfer to the first determination submodule for execution.

[0147] The first determination submodule is used to determine whether an event corresponding to a behavioral characteristic is a reference attack event.

[0148] The second determining submodule is used to determine the feature state parameter value corresponding to the behavior feature based on the first feature operation information and the second feature operation information. The first feature operation information is the information related to the behavior feature in the first operation state information, and the second feature operation information is the information related to the behavior feature when the system to be detected is in normal operation.

[0149] The second judgment submodule is used to determine whether the feature status parameter value is greater than the standard parameter value. The standard parameter value is the standard threshold of the attack behavior feature under attack behavior. If the judgment result is yes, it will transfer to the third determination submodule for execution. If the judgment result is no, it will transfer to the second determination submodule for execution.

[0150] The third determination submodule is used to determine the attack event corresponding to the behavioral characteristics as the reference attack event.

[0151] As one implementation of this application, in order to improve the detection efficiency and accuracy of network attack detection, the above-mentioned apparatus may further include:

[0152] The second acquisition module is used to acquire an attack virus sample set, which includes multiple virus samples.

[0153] The third acquisition module is used to place each virus sample into the system's isolation environment for execution and to acquire the system's second running status information.

[0154] The third determination module is used to compare the second operating status information with the third operating status information of the system under normal operating conditions to determine the abnormal information in the second operating status information.

[0155] The fourth determination module is used to extract features from abnormal information to obtain the corresponding attack behavior features.

[0156] The fifth determination module is used to determine the standard parameter value and the attack stage corresponding to each attack behavior feature based on the second and third running status information. The attack stage includes the attack preparation stage and the attack execution stage.

[0157] The sixth determination module is used to associate and store each event with its corresponding attack stage to obtain an attack database. Attack events include attack behavior characteristics and corresponding standard parameter values.

[0158] As one implementation of this application, in order to improve the accuracy of network attack detection, the second determining module may further include:

[0159] The fourth determination submodule is used to calculate the ratio of the corresponding characteristic state parameter value to the standard parameter value for each attack event in the reference attack event, so as to obtain the trigger index of the attack event.

[0160] The first calculation submodule is used to obtain the weight coefficient corresponding to each attack event in the reference attack event. The weight coefficient is used to characterize the relative importance of the attack event when evaluating the network attack.

[0161] The fifth determination submodule is used to determine the first target attack event and the second target attack event in the reference attack events based on the attack database. The first target attack event is the event that occurs during the attack preparation phase of the attack virus, and the second target attack event is the event that occurs during the attack execution phase of the attack virus.

[0162] The second calculation submodule is used to calculate the product of the weight coefficient and the trigger index corresponding to each first target attack event to obtain the first trigger value.

[0163] The third calculation submodule is used to calculate the product of the weight coefficient and the trigger index corresponding to each second target attack event to obtain the second trigger value.

[0164] The sixth determination submodule is used to determine whether a network attack exists in the system to be detected based on multiple first trigger values ​​and multiple second trigger values.

[0165] As one implementation of this application, in order to more accurately assess the actual impact of an event on the network environment, the above-mentioned apparatus may further include:

[0166] The seventh determination module is used to determine the first and second measurement coefficients based on the operating status information of the system under test when it is in normal operating condition.

[0167] As one implementation of this application, to further improve the accuracy of network attack detection, the sixth determining submodule may further include:

[0168] The first calculation unit is used to calculate the sum of multiple first trigger values ​​under the reference attack event to obtain the first attack risk assessment value.

[0169] The second calculation unit is used to calculate the sum of multiple second trigger values ​​under the reference attack event to obtain the second attack risk assessment value.

[0170] The first judgment unit is used to determine whether the first attack risk assessment value is greater than the first measurement coefficient and whether the second attack risk assessment value is greater than the second measurement coefficient. If the judgment result is yes, it will transfer to the first determination unit for execution; if the judgment result is no, it will transfer to the second determination unit for execution.

[0171] The first determining unit is used to determine whether the system under test is subject to a network attack.

[0172] The second determining unit is used to determine whether the system to be detected is not under network attack.

[0173] Figure 8 A schematic diagram of the hardware structure of the electronic device provided in an embodiment of this application is shown.

[0174] The electronic device may include a processor 801 and a memory 802 storing computer program instructions.

[0175] Specifically, the processor 801 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0176] Memory 802 may include mass storage for data or instructions. For example, and not limitingly, memory 802 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 802 may include removable or non-removable (or fixed) media. Where appropriate, memory 802 may be internal or external to the integrated gateway disaster recovery device. In a particular embodiment, memory 802 is non-volatile solid-state memory.

[0177] Memory 802 may include read-only memory (ROM), random access memory (RAM), disk storage media device, optical storage media device, flash memory device, electrical, optical, or other physical / tangible memory storage device. Therefore, typically, memory 802 includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to one aspect of this disclosure.

[0178] The processor 801 reads and executes computer program instructions stored in the memory 802 to implement any of the network attack detection methods in the above embodiments.

[0179] In one example, the electronic device may also include a communication interface 803 and a bus 810. Wherein, as... Figure 8 As shown, the processor 801, memory 802, and communication interface 803 are connected through bus 810 and complete communication with each other.

[0180] The communication interface 803 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0181] Bus 810 includes hardware, software, or both, that couples components of an electronic device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 810 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, this application contemplates any suitable bus or interconnect.

[0182] The electronic device can execute the network attack detection method in the embodiments of this application, thereby achieving a combination of Figure 1 and Figure 7 The described method and apparatus for detecting network attacks.

[0183] Furthermore, in conjunction with the network attack detection methods described in the above embodiments, this application embodiment can provide a computer storage medium for implementation. This computer storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement any of the network attack detection methods described in the above embodiments.

[0184] In addition, in conjunction with the network attack detection methods in the above embodiments, this application embodiment can provide a computer program product, which includes a computer program, and when the computer program is processed and executed, it implements any of the aforementioned network attack detection methods.

[0185] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0186] The functional blocks shown in the above-described structural diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0187] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0188] The aspects of this disclosure have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by special-purpose hardware performing the specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0189] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A method for detecting network attacks, characterized in that, The method includes: The behavioral characteristics of the system under test are obtained, and the behavioral characteristics are determined based on the first operating state information of the system under test. The behavioral characteristics are matched with multiple attack events in the attack database. If it is determined that there is an attack event in the attack database that corresponds to the behavioral characteristics, the attack event that corresponds to the behavioral characteristics is determined as a reference attack event. The multiple attack events are determined based on the behavioral characteristics of various attack viruses. If the reference attack event includes at least two attack events, determine whether a network attack exists in the system to be detected based on the reference attack event. The step of matching the behavioral characteristics with multiple attack events in the attack database, and determining the attack event corresponding to the behavioral characteristics as a reference attack event when it is determined that there is an attack event in the attack database that corresponds to the behavioral characteristics, includes: For each behavioral feature, the following operations are performed: If the behavioral feature satisfies a first matching condition, the following operations are performed, where the first matching condition is that there is an attack behavior feature in the attack database that matches the behavioral feature: Based on first feature operation information and second feature operation information, the feature state parameter value corresponding to the behavioral feature is determined, where the first feature operation information is information related to the behavioral feature in the first operation state information, and the second feature operation information is information related to the behavioral feature when the system to be detected is in normal operation; If the feature state parameter value is greater than a standard parameter value, the attack event corresponding to the behavioral feature is determined as a reference attack event, where the standard parameter value is a standard threshold for the attack behavior feature under attack behavior conditions.

2. The method according to claim 1, characterized in that, Before matching the behavioral characteristics with multiple attack events in the attack database, the method further includes: Obtain an attack virus sample set, which includes multiple virus samples; For each virus sample, place the virus sample in the system's isolated environment and run it, performing the following operations A1~A4: A1: Obtain the second operating status information of the system; A2: Compare the second operating status information with the third operating status information of the system under normal operating conditions to determine the abnormal information in the second operating status information; A3: Extract features from the abnormal information to obtain the corresponding attack behavior features; A4: For each attack behavior feature, the standard parameter value corresponding to the attack behavior feature and the attack stage are determined based on the second running status information and the third running status information. The attack stage includes the attack preparation stage and the attack execution stage. Each event is associated with its corresponding attack stage and stored to obtain an attack database. The attack events include attack behavior characteristics and corresponding standard parameter values.

3. The method according to claim 2, characterized in that, When the reference attack event includes at least two attack events, determining whether a network attack exists in the system to be detected based on the reference attack event includes: For each attack event in the reference attack events, the ratio of the corresponding characteristic state parameter value to the standard parameter value is calculated to obtain the triggering index of the attack event; Obtain the weight coefficient corresponding to each attack event in the reference attack events. The weight coefficient is used to characterize the relative importance of the attack event when evaluating network attacks. Based on the attack database, a first target attack event and a second target attack event are determined from the reference attack events. The first target attack event is an event that occurs during the attack preparation phase of the attack virus, and the second target attack event is an event that occurs during the attack execution phase of the attack virus. For each first target attack event, the product of the weight coefficient and the triggering index corresponding to the first target attack event is calculated to obtain the first triggering value; For each second target attack event, the product of the weight coefficient and the triggering index corresponding to the second target attack event is calculated to obtain the second triggering value; Based on multiple first trigger values ​​and multiple second trigger values, it is determined whether a network attack exists in the system to be detected.

4. The method according to claim 3, characterized in that, Before determining whether a network attack exists in the system to be detected based on multiple first trigger values ​​and multiple second trigger values, the method further includes: Based on the operating status information of the system under test when it is in normal operating condition, determine the first measurement coefficient and the second measurement coefficient; The step of determining whether a network attack exists in the system to be detected based on multiple first trigger values ​​and multiple second trigger values ​​includes: The sum of multiple first trigger values ​​under the reference attack event is calculated to obtain the first attack risk assessment value; The sum of multiple second trigger values ​​under the reference attack event is calculated to obtain the second attack risk assessment value; If the first attack risk assessment value is greater than the first measurement coefficient, and the second attack risk assessment value is greater than the second measurement coefficient, it is determined that the system to be detected is under network attack.

5. The method according to claim 2, characterized in that, The acquisition of the attack virus sample set includes: Collect attack virus sample sets through cloud resource pools.

6. A network attack detection device, characterized in that, The device includes: The first acquisition module is used to acquire the behavioral characteristics of the system to be detected, the behavioral characteristics being determined based on the first operating state information of the system to be detected. The first determining module is used to match the behavioral characteristics with multiple attack events in the attack database, and if it is determined that there is an attack event in the attack database that corresponds to the behavioral characteristics, the attack event that corresponds to the behavioral characteristics is determined as a reference attack event, wherein the multiple attack events are determined based on the behavioral characteristics of multiple attack viruses. The second determining module is used to determine whether a network attack exists in the system to be detected based on the reference attack event when the reference attack event includes at least two attack events. Specifically, the first determining module is used to: for each behavioral feature, perform the following operations: when the behavioral feature meets a first matching condition, perform the following operations, where the first matching condition is that there is an attack behavior feature in the attack database that matches the behavioral feature: determine the feature state parameter value corresponding to the behavioral feature based on the first feature operation information and the second feature operation information, where the first feature operation information is the information related to the behavioral feature in the first operation state information, and the second feature operation information is the information related to the behavioral feature when the system to be detected is in normal operation; when the feature state parameter value is greater than a standard parameter value, determine the attack event corresponding to the behavioral feature as a reference attack event, where the standard parameter value is a standard threshold value for the attack behavior feature under attack behavior.

7. An electronic device, characterized in that, The device includes: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, it implements the network attack detection method as described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the network attack detection method as described in any one of claims 1-5.

9. A computer program product, characterized in that, Includes a computer program, which, when executed, implements the network attack detection method according to any one of claims 1-5.

Images