Network attack detection method based on multi-source information analysis

Abstract

The invention discloses a network attack detection method based on multi-source information analysis, and relates to the technical field of multi-source information analysis protection, in particular to a network attack detection method based on multi-source information analysis. The network attack detection method comprises a network attack information scanning module, a network attack information collection module, an attack real-time data flow feature collection module, a data flow feature comparison module, a comparison data statistical analysis module and a local authority attacked detection module. The network attack detection method comprises the following specific steps: S1, scanning network attack information; s2, collecting network attack information; s3, collecting attack real-time data stream features; and S4, comparing data features. According to the network attack detection method based on multi-source information analysis, a command from a system service program is monitored, related interfaces of a database service program are controlled, and permission improvement through the system service program is prevented; and monitoring the access of the registry, and adopting a feature code detection method to prevent Trojan horse and attack program operation.

Description

Technical Field

[0001] The present invention relates to the field of multi-source information analysis and protection technology, and in particular to a network attack detection method based on multi-source information analysis. Background Art

[0002] With the rapid development of network technology, security vulnerabilities emerge in an endless stream. The increasing number of network nodes makes it increasingly difficult to detect vulnerabilities. It is even more difficult to trace the development of vulnerabilities based on conventional propagation paths.

[0003] In the context of the new power system, multiple energy sources are complementary, energy flow, information flow and business flow are highly integrated, and intelligence, automation and networking are its main features. The network is becoming more and more open, and the business is becoming more and more integrated. There is a greater need to achieve security immunity of end, edge and cloud. In recent years, my country's power industry has developed rapidly, and the scale of the secondary power system has continued to expand.

[0004] Traditional power systems lack contact with the outside world, so there are few ways to attack them. As long as a proprietary architecture is adopted, the system itself will have few vulnerabilities, so the system safety factor is high. However, with the deep integration of new technologies and traditional services, the structure of the new power system and the communication network environment are more complex, and two-way interactions are more frequent. The source-grid-load data interaction business in the new power system spans multiple departments and involves multiple types of internal and external users. The attack surface is large, the attack chain is long, and there are many risk points. It is necessary to improve the full-link monitoring capability, make up for the shortcomings in security protection, and avoid security incidents such as data theft and system intrusion.

[0005] The existing patent (publication number: CN101778112B) discloses a network attack detection method, which belongs to the field of network security technology. The method of the present invention is: 1) converting the alarm obtained from the network security infrastructure into an alarm in a unified format; 2) obtaining the status information of the host associated with the alarm behavior, judging whether the alarm-related behavior is effective according to the status information, and when an alarm-related behavior is invalid, discarding the alarm, otherwise marking the alarm as valid; when the status information of the host associated with the alarm behavior cannot be obtained, marking the alarm as undetermined; 3) aggregating valid alarms and undetermined alarms to generate security events; 4) using the generated security events to instantiate the attack graph to obtain the attack scenario graph; 5) outputting the attack scenario graph that meets the conditions to determine the attack type. The present invention effectively reduces the overhead of the attack graph algorithm, while improving the accuracy of discovering network attacks, it will not reduce the timeliness of the discovery process. However, the current network attack detection method has a relatively simple detection method, and most of them adopt a wide-net method to capture attack information, with a large capture range, but low capture efficiency, low sensitivity to attack signals, and cannot meet people's usage needs. Summary of the invention

[0006] In view of the shortcomings of the prior art, the present invention provides a network attack detection method based on multi-source information analysis, which solves the problems that the network attack detection methods proposed in the above background technology are relatively simple in detection mode, mostly adopt a wide-net approach to capture attack information, have a large capture range, but low capture efficiency, and are not sensitive enough to attack signals.

[0007] To achieve the above objectives, the present invention is implemented through the following technical solutions: a network attack detection method based on multi-source information analysis, the network attack detection method includes network attack information scanning, network attack information collection, attack real-time data stream feature collection, data stream feature comparison, comparison data statistical analysis and local authority attack detection module;

[0008] The specific steps of the network attack detection method are as follows:

[0009] S1. Scanning network attack information: By scanning network attack information, we can determine whether there is a network attack risk. By scanning, we can find the data features contained in the data packets during the attack. We can also detect the presence of port scanning by analyzing whether the network information packets contain data with port scanning features.

[0010] S2. Network attack information collection;

[0011] S3, real-time attack data stream feature collection, package and cache the data scanned in real time in S1 as feature comparison record files, and continuously expand the comparison range of the comparison database during the collection process;

[0012] S4, data feature comparison;

[0013] S5. Comparative data statistical analysis, divide the time into equal intervals, keep the duration of each time period equal, and independently save and compare the scan data of each time period, and generate alarm information based on the number of successful comparisons and when the number of successful comparisons exceeds a predetermined value;

[0014] S6, local authority attack detection module;

[0015] S7. Output attack detection data and determine the attack type.

[0016] Optionally, the local authority attack detection module in S6 is divided into the following four units to implement alarm information detection:

[0017] (1) Behavior monitoring unit;

[0018] (2) Sensitive file detection;

[0019] (3) Document completeness check;

[0020] (4) System snapshot comparison check.

[0021] Optionally, the behavior monitoring unit in S6 formulates rule conditions according to the common behavior of the overflow program, and if it meets the existing condition rules, it is considered to be an overflow program.

[0022] Optionally, the sensitive file detection in S6 is used to perform real-time monitoring operations on sensitive directories and sensitive types of files.

[0023] Optionally, the real-time monitoring operation of sensitive directories and sensitive type files is to intercept and arbitrate the execution of executable files from sensitive directories such as script execution directories and FTP service directories of network access services.

[0024] Optionally, the sensitive file detection also includes auditing file write operations on the directory to prevent uploading and writing of illegal programs;

[0025] Monitor the execution of commands from system service programs;

[0026] Control the relevant interfaces of the database service program to prevent the escalation of permissions through the system service program; monitor the access to the registry and use the signature code detection method to prevent the operation of Trojans and attack programs.

[0027] Optionally, the file integrity check in S6 is a regular integrity check of system files and common library files. The checksum method can be used to make a priori snapshots of important files, detect access to these files, check the integrity of these files, and combine behavioral detection methods to prevent file overwrite attacks and spoofing attacks.

[0028] Optionally, the system snapshot comparison check in S6 is to take a priori snapshot of public information in the system, such as system configuration parameters and environment variables, to detect access to these system variables and prevent tampering-oriented attacks.

[0029] The present invention provides a network attack detection method based on multi-source information analysis, which has the following beneficial effects:

[0030] In this network attack detection method based on multi-source information analysis, the behavior monitoring unit will detect unknown overflow programs, where the detection range includes monitoring memory activities, tracking abnormal changes in memory capacity, monitoring and detecting interrupt vectors; at the same time, tracking the stack changes of the program process and maintaining the legitimacy of the stack during program operation;

[0031] Use the checksum method to take a priori snapshots of important files, detect access to these files, check the integrity of these files, and combine behavioral detection methods to prevent file overwrite attacks and spoofing attacks;

[0032] By constructing a register table, instruction table and virtual memory of a virtual x86 computer, a program with overflow-sensitive features can be run in the virtual machine for a period of time. This process can extract behaviors that may be suspected of being overflow programs or similar to overflow programs. Combined with the signature code scanning method, the prior knowledge of the known overflow program code feature library is applied to the running results of the virtual machine to complete the judgment of a specific attack behavior. DETAILED DESCRIPTION

[0033] The technical solutions in the embodiments of the present invention will be described clearly and completely below. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0034] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "connected" and "connection" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0035] Embodiment 1

[0036] The present invention provides a technical solution: a network attack detection method based on multi-source information analysis, the network attack detection method includes network attack information scanning, network attack information collection, attack real-time data stream feature collection, data stream feature comparison, comparison data statistical analysis and local authority attack detection module;

[0037] The specific steps of the network attack detection method are as follows:

[0038] S1. Scanning network attack information: By scanning network attack information, we can determine whether there is a network attack risk. By scanning, we can find the data features contained in the data packets during the attack. We can also detect the presence of port scanning by analyzing whether the network information packets contain data with port scanning features.

[0039] S2. Network attack information collection;

[0040] S3, real-time attack data stream feature collection, package and cache the data scanned in real time in S1 as feature comparison record files, and continuously expand the comparison range of the comparison database during the collection process;

[0041] S4, data feature comparison;

[0042] S5. Comparative data statistical analysis, divide the time into equal intervals, keep the duration of each time period equal, and independently save and compare the scan data of each time period, and generate alarm information based on the number of successful comparisons and when the number of successful comparisons exceeds a predetermined value;

[0043] S6, local authority attack detection module;

[0044] S7. Output attack detection data and determine the attack type.

[0045] In this embodiment, the local authority attack detection module in S6 is divided into the following four units to implement alarm information detection:

[0046] (1) Behavior monitoring unit;

[0047] (2) Sensitive file detection;

[0048] (3) Document completeness check;

[0049] (4) System snapshot comparison check.

[0050] In this embodiment, the behavior monitoring unit in S6 formulates rule conditions according to the common behaviors of the overflow programs, and if the existing condition rules are met, it is considered to be an overflow program.

[0051] In this embodiment, the sensitive file detection in S6 is used to perform real-time monitoring operations on sensitive directories and sensitive files.

[0052] In this embodiment, the real-time monitoring operation of sensitive directories and sensitive type files is to intercept and arbitrate the execution of executable files from sensitive directories such as script execution directories and FTP service directories of network access services.

[0053] In this embodiment, sensitive file detection also includes auditing file write operations in the directory to prevent uploading and writing of illegal programs;

[0054] Monitor the execution of commands from system service programs;

[0055] Control the relevant interfaces of the database service program to prevent the escalation of permissions through the system service program; monitor the access to the registry and use the signature code detection method to prevent the operation of Trojans and attack programs.

[0056] In this embodiment, the file integrity check in S6 is a regular integrity check of system files and commonly used library files. The checksum method can be used to make a priori snapshots of important files, detect access to these files, and check the integrity of these files. Combined with the behavior detection method, file overwrite attacks and deception attacks can be prevented.

[0057] In this embodiment, the system snapshot comparison check in S6 is to take a priori snapshot of the public information in the system, such as the system configuration parameters and environment variables, to detect access to these system variables and prevent tampering-oriented attacks.

[0058] Embodiment 2

[0059] The present invention provides a technical solution: a network attack detection method based on multi-source information analysis, the network attack detection method includes network attack information scanning, network attack information collection, attack real-time data stream feature collection, data stream feature comparison, comparison data statistical analysis and local authority attack detection module;

[0060] The specific steps of the network attack detection method are as follows:

[0061] S1. Scanning network attack information: By scanning network attack information, we can determine whether there is a network attack risk. By scanning, we can find the data features contained in the data packets during the attack. We can also detect the presence of port scanning by analyzing whether the network information packets contain data with port scanning features.

[0062] S2. Network attack information collection;

[0063] S3, real-time attack data stream feature collection, package and cache the data scanned in real time in S1 as feature comparison record files, and continuously expand the comparison range of the comparison database during the collection process;

[0064] S4, data feature comparison;

[0065] S5. Comparative data statistical analysis, divide the time into equal intervals, keep the duration of each time period equal, and independently save and compare the scan data of each time period, and generate alarm information based on the number of successful comparisons and when the number of successful comparisons exceeds a predetermined value;

[0066] S6, local authority attack detection module, the local authority attack detection module is divided into the following four units to realize alarm information detection;

[0067] (1) The behavior monitoring unit formulates rules and conditions based on the common behaviors of overflow programs. If the existing rules and conditions are met, it is considered to be an overflow program. The behavior monitoring unit will detect unknown overflow programs, and the detection scope includes monitoring memory activities, tracking abnormal changes in memory capacity, monitoring and detecting interrupt vectors, and tracking changes in the program process stack to maintain the legitimacy of the stack during program operation.

[0068] (2) Sensitive file detection, which is used to monitor sensitive directories and sensitive types of files in real time, intercept and arbitrate the operation of executable files from sensitive directories such as the script execution directory of the network access service and the FTP service directory; audit the file write operations in these directories to prevent the upload and writing of illegal programs; monitor the execution of commands from system service programs. Control the relevant interfaces of the database service program to prevent the escalation of permissions through the system service program. Monitor the access to the registry and use the signature code detection method to prevent the operation of Trojans and attack programs;

[0069] (3) File integrity check: File integrity check is to perform regular integrity checks on system files and common library files. Checksum can be used to take a priori snapshots of important files, detect access to these files, and check the integrity of these files. Combined with behavioral detection methods, it can prevent file overwrite attacks and spoofing attacks.

[0070] (4) System snapshot comparison check: System snapshot comparison check is to take a priori snapshot of the public information in the system, such as system configuration parameters and environment variables, to detect access to these system variables and prevent tampering-oriented attacks;

[0071] S7. Output attack detection data and determine the attack type.

[0072] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A network attack detection method based on multi-source information analysis, characterized in that: The network attack detection method includes network attack information scanning, network attack information collection, attack real-time data stream feature collection, data stream feature comparison, comparison data statistical analysis and local authority attack detection module; The specific steps of the network attack detection method are as follows: S1. Scanning network attack information: By scanning network attack information, we can determine whether there is a network attack risk. By scanning, we can find the data features contained in the data packets during the attack. We can also detect the presence of port scanning by analyzing whether the network information packets contain data with port scanning features. S2. Network attack information collection; S3, real-time attack data stream feature collection, package and cache the data scanned in real time in S1 as feature comparison record files, and continuously expand the comparison range of the comparison database during the collection process; S4, data feature comparison; S5. Comparative data statistical analysis, divide the time into equal intervals, keep the duration of each time period equal, and independently save and compare the scan data of each time period, and generate alarm information based on the number of successful comparisons and when the number of successful comparisons exceeds a predetermined value; S6, local authority attack detection module; S7. Output attack detection data and determine the attack type.

2. The network attack detection method based on multi-source information analysis according to claim 1 is characterized in that: The local authority attack detection module in S6 is divided into the following four units to implement alarm information detection: (1) Behavior monitoring unit; (2) Sensitive file detection; (3) Document completeness check; (4) System snapshot comparison check.

3. The network attack detection method based on multi-source information analysis according to claim 2 is characterized in that: The behavior monitoring unit in S6 formulates rule conditions according to the common behavior of the overflow program, and if the existing condition rules are met, it is considered to be an overflow program.

4. The network attack detection method based on multi-source information analysis according to claim 2 is characterized in that: The sensitive file detection in S6 is used to perform real-time monitoring operations on sensitive directories and sensitive files.

5. A network attack detection method based on multi-source information analysis according to claim 4, characterized in that: The real-time monitoring operation of sensitive directories and sensitive type files is to intercept and arbitrate the running of executable files from sensitive directories such as script execution directories of network access services and FTP service directories.

6. The network attack detection method based on multi-source information analysis according to claim 4 is characterized in that: The sensitive file detection also includes auditing the file writing operation of the directory to prevent the uploading and writing of illegal programs; Monitor the execution of commands from system service programs; Control the relevant interfaces of the database service program to prevent the escalation of permissions through the system service program; monitor the access to the registry and use the signature code detection method to prevent the operation of Trojans and attack programs.

7. The network attack detection method based on multi-source information analysis according to claim 4 is characterized in that: The file integrity check in S6 is a regular integrity check of system files and common library files. The checksum method can be used to take a priori snapshots of important files, detect access to these files, and check the integrity of these files. In combination with the behavior detection method, file overwrite attacks and spoofing attacks can be prevented.

8. The network attack detection method based on multi-source information analysis according to claim 2 is characterized in that: The system snapshot comparison check in S6 is to take a priori snapshot of the public information in the system, such as the system configuration parameters and environment variables, to detect the access to these system variables and prevent tampering-oriented attacks.