Network flow detection method and system

Abstract

The invention relates to a network flow detection method and system, and belongs to the technical field of network security. The method comprises the following steps: obtaining a token of abnormal traffic of each network protocol according to an analysis result of first network traffic under each network protocol; matching the second network traffic under each network protocol by using the token, responding to target alarm data under any protocol matched by using the token, and mounting a target node corresponding to the target alarm data on an alarm map; according to a first node link containing the target node in the alarm map, a matched second node link containing a complete network protocol link in the alarm map is determined, whether a node with any protocol in the second node link has a connected next node or not is determined, and if the next node exists, the node with any protocol in the second node link does not have the connected next node; and generating pre-alarm information according to the network protocol corresponding to the next node. Safety protection can be carried out in advance, and the alarm efficiency is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a network flow detection method and system. Background Art

[0002] With the rapid development of information technology, the Internet has become an indispensable part of people's lives and work. The growth of network traffic has brought rich information resources and convenient communication methods, but it is also accompanied by a series of security risks, such as network attacks, malware, and illegal access. These security incidents pose a serious threat to personal privacy, corporate secrets, and national security. Therefore, how to effectively detect anomalies in network traffic has become an urgent problem to be solved in the field of network security. Traditional detection methods are mainly based on rule matching and statistical learning, but these methods show certain limitations when faced with complex and changing network environments and massive data.

[0003] The existing anomaly classification attack detection scheme has the following problems:

[0004] It only detects a single or several attack methods, such as network scanning, SQL injection, and cross-site scripting (XSS), which makes it helpless against new types of attacks.

[0005] Attack field extraction only focuses on abnormal characters or keywords in specific fields, such as extracting specific strings from SQL injection. This method may not be able to respond to new attacks in a timely manner, resulting in more false positives or false negatives.

[0006] Detection based on statistical methods analyzes traffic parameters (such as the number of packets, bytes, traffic rate, etc.), which has the problems of poor detection effect and high false alarm rate. These methods identify anomalies through statistical comparison or rule formulation, but their performance is limited in complex environments. Summary of the invention

[0007] 1. Technical issues to be resolved

[0008] The technical problem to be solved by the present invention is how to provide a network traffic detection method and system to solve the above-mentioned problems existing in the existing abnormal classification attack detection scheme.

[0009] (II) Technical solution

[0010] In order to solve the above technical problems, the present invention proposes a network traffic detection method, which comprises:

[0011] According to the analysis results of the first network traffic under each network protocol, a token of the abnormal traffic of each network protocol is obtained; the network protocol includes: protocols corresponding to the information collection stage, the vulnerability scanning stage, the network attack stage and the data theft stage;

[0012] The token is used to match the second network traffic under each of the network protocols, and in response to the target alarm data under any protocol being matched by the token, the target node corresponding to the target alarm data is mounted on the alarm map; the alarm map includes at least one alarm data node, and the alarm data nodes are connected in the order of the same source IP, the same destination IP, the same source port, the same destination port, and the time sequence;

[0013] According to the first node link containing the target node in the alarm map, a matching second node link in the alarm map is determined, wherein the second node link contains a complete network protocol link, and it is determined whether there is a next node connected to the node with any protocol in the second node link. If the next node exists, a pre-alarm message is generated according to the network protocol corresponding to the next node.

[0014] The present invention provides a network traffic detection system, the system comprising:

[0015] A token acquisition module, which obtains the token of the abnormal traffic of each network protocol according to the analysis result of the first network traffic under each network protocol; the network protocol includes protocols corresponding to the information collection stage, vulnerability scanning stage, network attack stage and data theft stage;

[0016] The abnormal alarm and node mounting module uses the token to match the second network traffic under each of the network protocols, and in response to matching the target alarm data under any protocol using the token, mounts the target node corresponding to the target alarm data on the alarm map; the alarm map includes at least one alarm data node, and the alarm data nodes are connected in the order of the same source IP, the same destination IP, the same source port, the same destination port, and the time sequence;

[0017] The pre-alarm module determines a matching second node link in the alarm map based on a first node link containing the target node in the alarm map, wherein the second node link contains a complete network protocol link, and determines whether there is a next node connected to a node with any protocol in the second node link. If the next node exists, pre-alarm information is generated based on the network protocol corresponding to the next node.

[0018] (III) Beneficial effects

[0019] The present invention proposes a network traffic detection method and system. The method of the present invention can summarize and learn the tokens included in the abnormal traffic under each network protocol, and use the token to detect the abnormal traffic under each network protocol, so that it can effectively identify anomalies for new attack types and issue security alarms. In addition, it can also predict the abnormal traffic that may be generated in the next step based on the detected alarm data using the learned alarm map to issue a pre-alarm, perform security protection in advance, and improve the alarm efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is a corresponding diagram of the attack steps and network protocols of the present invention;

[0021] Figure 2 A schematic diagram of a flow chart of a network traffic detection method according to an embodiment of the present invention;

[0022] Figure 3 A schematic diagram of a method for generating an attack graph according to the present invention;

[0023] Figure 4 It is a structural schematic diagram of an attack graph of the present invention;

[0024] Figure 5 It is a structural schematic diagram of another attack graph of the present invention;

[0025] Figure 6 A flowchart of a method for obtaining a token according to the present invention is shown below;

[0026] Figure 7 It is a schematic diagram of the method flow of aggregated alarm of the present invention;

[0027] Figure 8 It is a structural schematic diagram of a network traffic detection system of the present invention;

[0028] Fig. 9 The figure is a schematic diagram of an alarm spectrum of the present invention. DETAILED DESCRIPTION

[0029] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0030] The present invention provides a network traffic detection method, the method comprising:

[0031] According to the analysis results of the first network traffic under each network protocol, a token of the abnormal traffic of each network protocol is obtained; the network protocol includes protocols corresponding to the information collection stage, the vulnerability scanning stage, the network attack stage and the data theft stage;

[0032] The token is used to match the second network traffic under each of the network protocols, and in response to the target alarm data under any protocol being matched by the token, the target node corresponding to the target alarm data is mounted on the alarm map; the alarm map includes at least one alarm data node, and the alarm data nodes are connected in the order of the same source IP, the same destination IP, the same source port, the same destination port, and the time sequence;

[0033] According to the first node link containing the target node in the alarm map, a matching second node link in the alarm map is determined, wherein the second node link contains a complete network protocol link, and it is determined whether there is a next node connected to the node with any protocol in the second node link. If the next node exists, a pre-alarm message is generated according to the network protocol corresponding to the next node.

[0034] Furthermore, the method further comprises:

[0035] Obtain at least one node link in the alarm graph;

[0036] For each of the node links, extract information of each node included in the node link, the information including attack protocol information, target IP information, and information on whether the attack is successful;

[0037] An attack graph corresponding to each of the node links is generated according to the extracted information, wherein the attack graph includes an attack target node, an attack tool node, an attack strategy node, an attack effect node, an attack capability node, and an attack event sequence; wherein the target node includes the target IP information, the attack effect includes information on whether the attack is successful, the attack tool node includes a set of attack protocol information, the attack strategy node includes a set of attack protocol information arranged in chronological order; the attack capability node includes a set of business stages corresponding to the attack protocol information, and the attack event sequence includes a set of alarm data nodes arranged in chronological order;

[0038] The attack graph corresponding to each of the node links is displayed.

[0039] Furthermore, the step of obtaining the token of abnormal traffic of each network protocol according to the analysis result of the first network traffic under each network protocol includes:

[0040] For each network protocol, a segment whose number of repetitions reaches a first threshold in traffic determined as suspicious traffic under the network protocol is determined as a first token;

[0041] Filter out the second token in the first token whose false alarm rate is lower than the second threshold and / or whose coverage rate is higher than the third threshold as the token of the abnormal traffic of the network protocol; the false alarm rate refers to the probability that the normal traffic containing the first token is mistakenly detected as abnormal traffic; the coverage rate refers to the probability that the abnormal traffic containing the first token is indeed detected as abnormal traffic.

[0042] Furthermore, after determining the first token, the following steps are also included:

[0043] Remove the sub-token in the first token; the sub-token is a partial fragment of the first token.

[0044] Furthermore, the using the token to match the second network traffic under each of the network protocols includes:

[0045] Collecting the first alarm data under each of the network protocols matched by using the token;

[0046] According to a preset alarm removal rule, duplicate alarm data in the first alarm data is removed to obtain second alarm data;

[0047] For each of the network protocols, aggregating the second alarm data under the network protocol within the alarm retention time corresponding to the network protocol;

[0048] In response to the aggregation duration of the second alarm data under any protocol reaching the alarm retention duration corresponding to the arbitrary protocol, the super alarm obtained by aggregation is determined as the target alarm data under the arbitrary protocol matched by using the token.

[0049] Furthermore, the method for adaptively adjusting the alarm retention time includes:

[0050] Count the number of abnormal traffic under the network protocol within a unit time;

[0051] The alarm retention time corresponding to the abnormal traffic quantity is queried in a preset alarm retention time template, and is determined to be the alarm retention time corresponding to the network protocol; the alarm retention time is between the first value and the second value.

[0052] Further, the aggregating the second alarm data under the network protocol includes:

[0053] Aggregate in the following order. If the aggregation is completed according to the conditions that come first, the conditions that come later are ignored:

[0054] The network protocol type, source IP, and destination IP are the same;

[0055] The source IP and destination IP are the same;

[0056] The destination IP is the same;

[0057] The source IP is the same.

[0058] Further, mounting the target node corresponding to the target alarm data on the alarm map includes:

[0059] Get the alarm map;

[0060] Searching for a first node in the alarm graph, wherein the source IP indicated by the first node is the same as the first source IP indicated by the target alarm data;

[0061] If the first node that meets the condition is not found, determining the target node as an independent node;

[0062] If the first node that meets the condition is found, a second node is searched among the nodes connected to the first node, and the target IP included in the second node is the same as the first target IP indicated by the target alarm data;

[0063] If the second node that meets the condition is not found, mounting the target node on the first node;

[0064] If the second node that meets the condition is found, searching for a third node among the nodes connected to the second node, wherein the source port included in the third node is the same as the first source port indicated by the target alarm data;

[0065] If the third node that meets the condition is not found, mounting the target node on the second node;

[0066] If the third node that meets the condition is found, searching for a fourth node among the nodes connected to the third node, wherein the destination port included in the fourth node is the same as the first destination port indicated by the target alarm data;

[0067] If the fourth node that meets the condition is not found, mounting the target node on the third node;

[0068] If the fourth node that meets the conditions is found, in response to the fourth node having an earlier alarm time, the target node is mounted on the fourth node.

[0069] Further, the determining a matching second node link in the alarm graph according to the first node link containing the target node in the alarm graph includes:

[0070] Acquire a first node link including the target node in the alarm graph;

[0071] According to the network protocol link indicated by the first node link, determining a second node link with the highest indicated network protocol link repetition; the second node link corresponds to a composite attack scenario; the composite attack scenario includes multiple network protocols;

[0072] The determining whether there is a next node connected to the node with the arbitrary protocol in the second node link comprises:

[0073] Calculate the detection degree and / or matching degree corresponding to the target node according to the position of the target node on the first node link; the detection degree refers to the proportion of the network protocols actually detected from the initial network protocol to the network protocol corresponding to the target node in the composite attack scenario when the network protocol corresponding to the target node is detected; the matching degree refers to the proportion of the network protocols detected in all the network protocols included in the composite attack scenario when the network protocol corresponding to the target node is detected;

[0074] In response to the detection degree reaching a fourth threshold and / or the matching degree obtaining a fifth threshold, it is determined whether there is a next node connected to the node having the arbitrary protocol in the second node link.

[0075] The present invention also provides a network traffic detection system, the system comprising:

[0076] A token acquisition module, which obtains the token of the abnormal traffic of each network protocol according to the analysis result of the first network traffic under each network protocol; the network protocol includes protocols corresponding to the information collection stage, vulnerability scanning stage, network attack stage and data theft stage;

[0077] The abnormal alarm and node mounting module uses the token to match the second network traffic under each of the network protocols, and in response to matching the target alarm data under any protocol using the token, mounts the target node corresponding to the target alarm data on the alarm map; the alarm map includes at least one alarm data node, and the alarm data nodes are connected in the order of the same source IP, the same destination IP, the same source port, the same destination port, and the time sequence;

[0078] The pre-alarm module determines a matching second node link in the alarm map based on a first node link containing the target node in the alarm map, wherein the second node link contains a complete network protocol link, and determines whether there is a next node connected to a node with any protocol in the second node link. If the next node exists, pre-alarm information is generated based on the network protocol corresponding to the next node.

[0079] Embodiment 1:

[0080] Regardless of the type of network attack, it generally goes through four attack stages: information collection stage, vulnerability scanning stage, vulnerability scanning stage, and network attack stage.

[0081] Information collection phase: including passive collection and active collection. Mainly collect the target's network information (domain name, IP address, network topology), system information (operating system version, network service version) and user information (user ID, group ID, shared resources, instant messaging software account, email account), etc.

[0082] Vulnerability scanning phase: This phase is carried out after information collection. Through scanning methods based on vulnerability databases, the security vulnerabilities of designated computer systems are detected to discover exploitable vulnerabilities.

[0083] Cyber ​​Attack Phase: After information gathering and vulnerability scanning, attackers exploit vulnerabilities in the target system or application to gain initial access.

[0084] Data theft stage: The attacker carries out the ultimate goal of stealing sensitive data, destroying system functions or extorting money. Use tools to screen and filter data to retain valuable information such as financial data, business secrets, personal identity information, etc.

[0085] Each stage corresponds to its own network protocol. Please refer to Table 1, which is a corresponding table of network protocols and attack stages illustrated in the present invention.

[0086] Table 1 Protocols corresponding to each stage

[0087]

[0088] These four stages can include five attack steps: reconnaissance, scanning, penetration, escalation of privileges, and theft. Figure 1 , Figure 1 The attack steps and network protocol corresponding diagram shown in the present invention. Figure 1As shown in the figure, the first row contains 5 attack steps from left to right. Usually, it takes 5 steps from left to right to complete a compound attack. The column below each attack step corresponds to the network protocol, and each step requires at least one corresponding network protocol to complete the communication. For example, the site-scouting step corresponds to the three network protocols Fping, DNS, and Nmap ping. There are arrows between these network protocols, representing the association between the network protocols. For example, Fping in site-scouting may be connected to Nmap Scan or TCPScan in scanning. Completing a compound attack means that abnormal alarms for the 5 steps for the same destination IP may be detected.

[0089] Even new attack types will go through the previous four attack stages or five attack steps. Therefore, by detecting abnormal traffic in the attack stage or attack step, no matter what type of attack, abnormalities can be effectively identified and security alarms can be issued. In addition, if the detected abnormal traffic is matched with the learned composite attack graph (the composite attack graph is obtained using alarm data, also referred to as the alarm graph in the present invention), a pre-alarm can be issued for the abnormalities that may occur in the next step, and security protection can be carried out in advance to improve the efficiency of alarms.

[0090] Based on this, the present invention proposes a network traffic detection method. In this method, tokens included in abnormal traffic under various network protocols can be summarized and learned, and the tokens can be used to detect abnormal traffic under various network protocols, so that abnormalities can be effectively identified for new attack types, and security alarms can be issued. In addition, according to the detected alarm data, the learned alarm graph can be used to predict the abnormal traffic that may be generated in the next step, and pre-alarms can be issued, so as to carry out security protection in advance and improve the alarm efficiency.

[0091] The following is an example description with reference to the accompanying drawings. Figure 2 , Figure 2 The present invention is a flowchart of a method for detecting network traffic according to an embodiment of the present invention.

[0092] Figure 2 The network traffic detection method shown can be applied to an electronic device. The electronic device can execute the method by carrying software logic corresponding to the network traffic detection method. The type of the electronic device can be a laptop, a computer, a server, a mobile phone, a PDA (Personal Digital Assistant), etc. The type of the electronic device is not particularly limited in the present invention. The electronic device can also be a client device or a server device.

[0093] like Figure 2As shown, the method may include S202-S206. Unless otherwise specified, the present invention does not specifically limit the execution order of these steps.

[0094] S202: According to the analysis result of the first network traffic under each network protocol, a token of the abnormal traffic of each network protocol is obtained.

[0095] The network protocol includes protocols corresponding to the information collection stage, vulnerability scanning stage, network attack stage and data theft stage. In some examples, the protocols shown in Table 1 can be referred to.

[0096] The first network traffic refers to the traffic used to update the token. The first or second is for the convenience of distinguishing network traffic.

[0097] In this step, some existing network traffic anomaly detection methods can be used to track and analyze the first network traffic. If abnormal traffic is found, the traffic can be marked. When the abnormal traffic reaches a certain amount, the statistical analysis method can be used to extract the fragments that the abnormal traffic under each network protocol usually has to form a token.

[0098] For example, most abnormal traffic under the Mysql.Value protocol may contain the "k0\efffffal" segment, which is the token corresponding to the Mysql.Value protocol.

[0099] For another example, most abnormal traffic under the http.filename protocol may contain a "0\eff" segment, which is the token corresponding to the http.filename protocol.

[0100] In this step, a corresponding token that can identify abnormal traffic can be generated for each protocol.

[0101] S204, using the token to match the second network traffic under each of the network protocols, in response to using the token to match the target alarm data under any protocol, mounting the target node corresponding to the target alarm data on the alarm map.

[0102] The second network traffic may be traffic to be detected.

[0103] The alarm graph is formed based on the alarm data. In some embodiments, the alarm data may be some historical alarm data.

[0104] The alarm graph includes at least one alarm data node, and the alarm data nodes are connected in the order of the same source IP, the same destination IP, the same source port, the same destination port, and the time sequence.

[0105] Take the alarm data shown in Table 2 as an example.

[0106] Table 2 Alarm data example

[0107]

[0108] According to the historical alarm data in Table 2, we can get the following Fig. 9 See the alarm diagram shown in Fig. 9 , Fig. 9 The figure is a schematic diagram of an alarm spectrum according to the present invention.

[0109] like Fig. 9 As shown, each node may include information such as alarm time, source IP, destination IP, source port, destination port, attack type, and attack steps. The attack type can be understood as an abnormal network protocol. The attack step is the step or stage where the abnormality occurs. Five steps are taken as an example in the present invention.

[0110] Node 1, Node 4, Node 5 have the same source IP, destination IP, source port, and destination port. In chronological order, we can get node 1 connected to node 4 and node 5. The source IPs of nodes 2 and 3 are different from other nodes, so they are independent nodes, waiting for other nodes with the same source IP to mount later. The alarm graph shown in the end can associate all historical alarm data. Among them, nodes with the same source IP, destination IP, source port, and destination port can be connected in series in chronological order. Nodes with different source IPs do not interfere with each other, and each will form a node link.

[0111] It is understandable that each node link can indicate a compound attack. By parsing the node link, the target of the attack, that is, the target IP, the attack protocol, that is, the network protocol with the abnormality, can be known. The network protocols are sorted in chronological order, and the connection relationship between the network protocols in the compound attack can also be obtained. For example, through the connection relationship between nodes 1, 4 and 5, Fping->tcpcsan->Arp can be obtained. When the alarm spectrum is complete enough, the following can also be obtained: Figure 1 The network protocol link shown in the figure. The attack type refers to the network protocol that has abnormal traffic, so the network protocol link is the attack type link.

[0112] In S204, after abnormal traffic is detected for any protocol using token, target alarm data can be generated, and the following Fig. 9The target node is similar to the node shown in the figure, and then the upstream node that needs to be mounted can be found in the map in the order of source IP, destination IP, source port, destination port, and time. After the mounting is completed, the alarm map can be expanded in real time, and the currently detected abnormal traffic can be recorded. Later, the attack process of the entire compound attack can be traced back by tracing the alarm map.

[0113] S206, based on the first node link containing the target node in the alarm map, determine the second node link that matches in the alarm map, the second node link contains a complete network protocol link, and determine whether there is a next node connected to the node with the arbitrary protocol in the second node link, if the next node exists, generate a pre-alarm information according to the network protocol corresponding to the next node.

[0114] The first node link refers to a link including a target node. The nodes included in this link may have the same source IP, destination IP, source port, and destination port, and are arranged in chronological order.

[0115] The second node link refers to a node link that includes a complete network protocol link. For example, the second node link may include Figure 1 The diagram shows a complete network protocol link from left to right, such as Fping->TCPScan->ARP->Http->Mysql.

[0116] The first node link refers to the link formed by the currently detected abnormal alarm. It also has a network protocol link. It may only detect Fping->TCPScan->ARP at present. Figure 1 By comparing the illustrated links, we can obtain the second node link corresponding to the network protocol link Fping->TCPScan->ARP->Http->Mysql with the highest matching degree.

[0117] After finding the second node link, you can find nodes with any protocol. Assuming that the current alarm protocol is the ARP protocol, find a node with the ARP protocol, and then determine whether the node is connected to the next node. If there is a next node after the second node link, it means that the next step may also generate an alarm similar to the next node. In this way, the source IP, destination IP, source port, and destination port in the alarm data corresponding to the next node can be replaced with the same data corresponding to the node in the first node link to generate a pre-alarm. For example, if Http is connected after ARP, the IP, port and other information contained in the target node can generate a pre-alarm for Http, so that risks can be known in advance and relevant protection can be carried out conveniently.

[0118] Therefore, through the corresponding solutions of S202-S206, on the one hand, we can summarize and learn the tokens included in the abnormal traffic under each network protocol, and use the token to detect the abnormal traffic under each network protocol, so that no matter what type of attack, especially for new types of attacks, we can effectively identify anomalies and issue security alerts.

[0119] On the other hand, based on the alarm data, an alarm graph can be formed in the order of source IP, destination IP, source port, destination port, and time, so as to complete the network protocol link learning of the compound attack, and also record the currently detected abnormal traffic. Later, by tracing the alarm graph, the attack process of the entire compound attack can be traced back.

[0120] On the other hand, based on the detected alarm data, the learned alarm graph can be used to predict the abnormal traffic that may be generated in the next step, issue a pre-alarm, take safety precautions in advance, and improve the efficiency of the alarm.

[0121] In some embodiments, an attack map can be generated based on the alarm map and displayed to the user, so that the user can intuitively understand the links of various attacks, attack targets, whether the attack is successful, attack strategies, attack tools and other information.

[0122] See also Figure 3 , Figure 3 FIG. 1 is a flow chart of a method for generating an attack graph according to the present invention. Figure 3 As shown, the method may include S302-S308.

[0123] S302: Obtain at least one node link in the alarm graph.

[0124] This step can obtain the node link by accessing the database. In some embodiments, the node link can be a node link with a complete protocol link.

[0125] S304, for each of the node links, extract information of each node included in the node link, the information including attack protocol information, target IP information, and information on whether the attack is successful.

[0126] Each node has pre-set fields corresponding to various types of information. After matching the target alarm data in the front, each field can be filled in according to the target alarm data to form a target node. In some embodiments, the node can include attack protocol information, target IP information, whether the attack is successful, and of course other required fields.

[0127] In this step, node information can be obtained through data access.

[0128] S306: Generate an attack graph corresponding to each of the node links according to the extracted information.

[0129] In some methods, the structure of the attack graph, that is, the graph nodes included, can be preset, and then the correspondence between the graph nodes and the node field information can be preset.

[0130] See also Figure 4 , Figure 4 The figure is a schematic diagram of the structure of an attack graph according to the present invention.

[0131] like Figure 4 As shown, the attack graph includes an attack target node, an attack tool node, an attack strategy node, an attack effect node, an attack capability node and an attack event sequence; wherein the target node includes the target IP information, the attack effect includes information on whether the attack is successful, the attack tool node includes a set of attack protocol information, the attack strategy node includes a set of attack protocol information arranged in chronological order; the attack capability node includes a set of business stages corresponding to the attack protocol information, and the attack event sequence includes a set of alarm data nodes sorted in chronological order.

[0132] Then, through the corresponding relationship and using the node information extracted in S304, the attack graph can be constructed.

[0133] In some ways, in order to more clearly display the attack graph, the attack event sequence can be expanded into the form of attack steps and attack features. Figure 5 , Figure 5 The figure is a schematic diagram of the structure of an attack graph according to the present invention. Figure 5 In addition to Figure 4 In addition to the same structure, it also includes at least one attack step node and at least one attack feature extracted from the attack step. The attack step can be understood as the alarm data arranged in chronological order, and the attack feature can be understood as the alarm information of the preset dimension extracted from the alarm data, that is, the node information of the preset dimension. For example, network protocol, source IP, attack time, number of attacks, etc.

[0134] S308, displaying the attack graph corresponding to each of the node links.

[0135] In this step, in response to the display request, the attack graph generated in S306 can be displayed through a web page. In some embodiments, Figure 5 The attack step nodes shown may be hidden first, and then displayed in response to the user operating the attack event sequence.

[0136] Through the scheme recorded in S302-S308, an attack map can be generated based on the alarm map and displayed to the user, so that the user can intuitively understand the links of various attacks, attack targets, whether the attack is successful, attack strategies, attack tools and other information.

[0137] In some embodiments, tokens can be refined in some ways, and the refined tokens have a low false positive rate and a high coverage rate (correct rate).

[0138] See also Figure 6 , Figure 6 The figure is a flowchart of a method for obtaining a token according to the present invention. Figure 6 The illustrated steps are for explanation of S202. Figure 6 As shown, the method may include S602-S604.

[0139] S602: For each network protocol, determine, as a first token, a segment whose number of repetitions reaches a first threshold in traffic determined as suspicious traffic under the network protocol.

[0140] This step can refer to the related steps, that is, a conventional abnormal traffic detection tool can be used to detect abnormal traffic. After abnormal traffic is detected, the abnormal traffic under each network protocol can be sorted out by statistical methods to determine the segments whose repetition times reach the first threshold as the first token. The first threshold can be set based on experience, such as 100, 90, 80, etc.

[0141] S604, filter out the second token with a false alarm rate lower than the second threshold and / or a coverage rate higher than the third threshold in the first token as the token of the abnormal traffic of the network protocol; the false alarm rate refers to the probability that the normal traffic containing the first token is mistakenly detected as abnormal traffic; the coverage rate refers to the probability that the abnormal traffic containing the first token is indeed detected as abnormal traffic.

[0142] This step is to fine-screen the token obtained in S602. The first token can be used to detect network traffic, and the detection result can be compared with the detection result of the conventional abnormal traffic detection tool. Then, according to the comparison result, the false alarm rate and coverage rate of each first token are counted. The statistical method of the false alarm rate is to divide the normal traffic detected by the first token by all the traffic containing the first token. The statistical method of the coverage rate is to divide the abnormal traffic detected by the first token by all the traffic containing the first token.

[0143] After obtaining the false alarm rate and coverage rate, the preset second threshold and third threshold can be used to filter out tokens that meet the conditions as the second token.

[0144] It is understandable that S604 may be a step that is performed multiple times until the first token no longer contains tokens whose false alarm rate and coverage do not meet the conditions.

[0145] Through the scheme recorded in S602-S604, tokens with low false alarm rate and high coverage (accuracy) can be extracted, especially the accuracy of alarms can be improved, and the accuracy of network traffic anomaly detection of the entire scheme can be improved.

[0146] It is understandable that among the tokens obtained through S602, their sub-tokens will also be used as the first token, which results in too many tokens and some repeated tokens. For example, k0\efffffal is identified as the first token, efffffal will also be identified as the first token, and efffffal is a sub-token. In some embodiments, after S602, the sub-tokens in the first token can be removed; the sub-tokens are partial fragments of the first token. In this step, some matching algorithms can be set to match the sub-tokens corresponding to each first token, and then delete these sub-tokens. The matching method is to find some tokens that have repeated characters with themselves, that is, sub-tokens.

[0147] It is understandable that in S204, if any alarm matched by token is used as the target alarm data, the amount of data will be very large, and these alarms are often similar or identical alarms under the same network protocol. For example, for source IP1 and destination IP2, dozens of similar alarms may be matched under the ARP protocol. If all these alarms are mounted in the alarm map, data redundancy will occur. Therefore, these similar alarms need to be aggregated to form one target alarm data for mounting, thereby reducing the amount of data in the alarm map and improving the detection performance and effect.

[0148] See also Figure 7 , Figure 7 The figure is a flow chart of the method for aggregating alarms according to the present invention. Figure 7 The illustrated steps are for explanation of S204. Figure 7 As shown, the method may include S702-S708.

[0149] S702: Collect the first alarm data under each of the network protocols matched by using the token.

[0150] This step can use a conventional character matching method to match each network protocol using the corresponding token to find the first alarm data.

[0151] S704: According to a preset alarm removal rule, remove duplicate alarm data in the first alarm data to obtain second alarm data.

[0152] In this step, duplicate alarm data can be removed within the period corresponding to each network protocol. For example, within the period, only one piece of data with the same alarm information (eg, source IP, destination IP, network protocol) can be retained.

[0153] S706, for each of the network protocols, aggregating the second alarm data under the network protocol within the alarm retention time corresponding to the network protocol;

[0154] In this step, the first alarm data cached in the memory may be aggregated according to the following logic within the alarm retention time corresponding to each network protocol to obtain the second alarm data:

[0155] Aggregate in the following order. If the aggregation is completed according to the conditions that come first, the conditions that come later are ignored:

[0156] The network protocol type, source IP, and destination IP are the same;

[0157] The source IP and destination IP are the same;

[0158] The destination IP is the same;

[0159] The source IP is the same.

[0160] That is, if there is any second alarm data, first check whether there is an alarm with the same network protocol type, source IP, and destination IP. If so, merge it first. If not, check whether there is an alarm with the same source IP and destination IP. If so, merge it. And so on. The second alarm data can be alarmed within the alarm retention time.

[0161] In some embodiments, the alarm retention time of each network protocol can be adaptively adjusted, thereby achieving a better aggregation effect, thereby improving the detection effect, and the method includes: counting the number of abnormal traffic under the network protocol within a unit time;

[0162] The alarm retention time corresponding to the abnormal traffic quantity is queried in a preset alarm retention time template, and is determined to be the alarm retention time corresponding to the network protocol; the alarm retention time is between the first value and the second value.

[0163] S708: In response to the aggregation duration of the second alarm data under any protocol reaching the alarm retention duration corresponding to the arbitrary protocol, the super alarm obtained by aggregation is determined as the target alarm data under the arbitrary protocol matched by using the token.

[0164] When the alarm aggregation time reaches the alarm retention time under any protocol, the finally aggregated ultra-high alarm is used as the target alarm, and the step of mounting the target node corresponding to the target alarm data as shown in S204 is performed.

[0165] Through S702-S708, the amount of redundant data in the alarm map is reduced, and the detection performance and effect are improved.

[0166] In some embodiments, the target node may be mounted with an alarm map by referring to the following steps:

[0167] Get the alarm map;

[0168] Searching for a first node in the alarm graph, wherein the source IP indicated by the first node is the same as the first source IP indicated by the target alarm data;

[0169] If the first node that meets the condition is not found, determining the target node as an independent node;

[0170] If the first node that meets the condition is found, a second node is searched among the nodes connected to the first node, and the target IP included in the second node is the same as the first target IP indicated by the target alarm data;

[0171] If the second node that meets the condition is not found, mounting the target node on the first node;

[0172] If the second node that meets the condition is found, searching for a third node among the nodes connected to the second node, wherein the source port included in the third node is the same as the first source port indicated by the target alarm data;

[0173] If the third node that meets the condition is not found, mounting the target node on the second node;

[0174] If the third node that meets the condition is found, searching for a fourth node among the nodes connected to the third node, wherein the destination port included in the fourth node is the same as the first destination port indicated by the target alarm data;

[0175] If the fourth node that meets the condition is not found, mounting the target node on the third node;

[0176] If the fourth node that meets the conditions is found, in response to the fourth node having an earlier alarm time, the target node is mounted on the fourth node.

[0177] For example, suppose there is an alarm graph used to understand the order and relationship of network events. The nodes of the alarm graph represent different alarms, and the connections between the nodes represent the relationship between them. The specific information of the target alarm (target node) is as follows:

[0178] First source IP: 192.168.1.10; first target IP: 10.0.0.5; first source port: 443; first destination port: 8080; alarm time: 2023-09-0510:00:00.

[0179] You can process these target alarm data by following the steps below: Get the alarm map: Assume that the alarm map has been loaded and is available for query. Find the first node: Find the node with a source IP of 192.168.1.10 in the alarm map. Assume that you find such a node A. Find the second node: Among the nodes connected to node A, find the node with a target IP of 10.0.0.5. Assume that you find such a node B. Find the third node: Among the nodes connected to node B, find the node with a source port of 443. Assume that you find such a node C. Find the fourth node: Among the nodes connected to node C, find the node with a destination port of 8080. Assume that you find such a node D. Mount the target node: Check the alarm time of node D. If the alarm time of D is earlier than the time of the target alarm data 2023-09-052023-09-0510:00:00, then mount the target alarm data to node D.

[0180] In this example: If the node found in the alarm map matches the source IP, target IP, source port, and destination port in sequence, and the alarm time condition is met, then the target alarm data will be mounted to the node that best meets the conditions (in this example, node D). If the next node is not found after a node is found, the target node will be mounted to the node found.

[0181] The above steps can complete the node mounting.

[0182] In some embodiments, matching the second node link in S206 may be performed by referring to the following steps:

[0183] Acquire a first node link including the target node in the alarm graph;

[0184] According to the network protocol link indicated by the first node link, a second node link having the highest indicated network protocol link repetition is determined; the second node link corresponds to a composite attack scenario; the composite attack scenario includes multiple network protocols.

[0185] For example, a complete second node link may include Figure 1 The network protocol link of any network protocol link from left to right in the first node link may contain only network links like Figure 1 By using the matching method of the network protocol, the second node link with the highest degree of repetition of the network links included in the first node link can be found.

[0186] In some embodiments, in order to improve the accuracy of the pre-alarm, the pre-alarm may be issued when it is determined that the detected first node link does have a high repetition rate with a composite alarm. In this example, the index for measuring the repetition rate with the composite alarm includes the detection degree and / or the matching degree.

[0187] The detection degree refers to the proportion of the network protocols actually detected from the initial network protocol to the network protocol corresponding to the target node in the composite attack scenario when the network protocol corresponding to the target node is detected.

[0188] The compound attack scenario can be understood as Figure 1 Any network protocol link from left to right is shown. The compound attack scenario has an initial network protocol and a final network protocol. When calculating the detection degree, you can first determine each network protocol from the initial network protocol to the network protocol where the target alarm is located in the compound attack scenario, and then determine the ratio of the number of protocols detected in the first node link to the number of protocols from the initial network protocol to the network protocol where the target alarm is located.

[0189] For example, the composite attack scenario is Fping->TCPScan->ARP->Http->Mysql, and the current target alarm is detected by ARP. Then the composite attack scenario has three protocols from the initial protocol Fping to ARP. Assuming that the first node link only detects TCPScan and ARP, the detection degree of the target node is 2 divided by 3, which is 66.7%.

[0190] It is understandable that the higher the detection degree, the higher the repetition rate of the currently detected alarms and compound attack scenarios.

[0191] The matching degree refers to the proportion of the detected network protocols among all the network protocols included in the composite attack scenario when the network protocol corresponding to the target node is detected.

[0192] The compound attack scenario can be understood as Figure 1Any network protocol link from left to right is shown. The compound attack scenario has an initial network protocol and a final network protocol. When calculating the matching degree, you can first determine each network protocol from the initial network protocol to the final network protocol in the compound attack scenario, and then determine the number of network protocols detected in the first node link together with the network protocol where the target alarm is located, and divide it by the total number of network protocols in the compound attack scenario to get the matching degree.

[0193] For example, the composite attack scenario is Fping->TCPScan->ARP->Http->Mysql, with a total of 5 protocols. The current target alarm is detected by ARP. Assuming that the first node link only detects TCPScan and ARP, 2 protocols, the matching degree of the target node is 2 divided by 5, which is 40%.

[0194] It can be understood that the higher the detection matching degree, the higher the repetition degree between the currently detected alarm and the compound attack scenario.

[0195] After introducing the calculation methods of the detection degree and the matching degree, the following describes how to determine in S206 whether there is a next node to which the node having the arbitrary protocol in the second node link is connected.

[0196] Calculate the detection degree and / or matching degree corresponding to the target node according to the position of the target node on the first node link; the detection degree refers to the proportion of the network protocols actually detected from the initial network protocol to the network protocol corresponding to the target node in the composite attack scenario when the network protocol corresponding to the target node is detected; the matching degree refers to the proportion of the network protocols detected in all the network protocols included in the composite attack scenario when the network protocol corresponding to the target node is detected;

[0197] In response to the detection degree reaching a fourth threshold and / or the matching degree obtaining a fifth threshold, it is determined whether there is a next node connected to the node having the arbitrary protocol in the second node link.

[0198] In this step, it can be determined whether there is a next node only when the detection degree and / or matching degree meet the standards, thereby avoiding false alarms caused by issuing pre-alarms when the current alarm and the composite attack scenario are not highly repetitive, thereby improving the alarm accuracy and further improving the detection effect.

[0199] The invention also provides a network flow detection system.

[0200] See also Figure 8 , Figure 8 FIG. 1 is a schematic diagram of the structure of a network traffic detection system shown in the present invention. Figure 8As shown, the network traffic detection system 800 includes:

[0201] The token acquisition module 810 obtains the token of the abnormal traffic of each network protocol according to the analysis result of the first network traffic under each network protocol; the network protocol includes protocols corresponding to the information collection stage, vulnerability scanning stage, network attack stage and data theft stage;

[0202] The abnormal alarm and node mounting module 820 uses the token to match the second network traffic under each of the network protocols, and in response to matching the target alarm data under any protocol using the token, mounts the target node corresponding to the target alarm data on the alarm map; the alarm map includes at least one alarm data node, and the alarm data nodes are connected in the order of the same source IP, the same destination IP, the same source port, the same destination port, and the time sequence;

[0203] The pre-alarm module 830 determines a second node link that matches the alarm map based on a first node link that includes the target node in the alarm map, wherein the second node link includes a complete network protocol link, and determines whether there is a next node connected to the node with any protocol in the second node link. If the next node exists, a pre-alarm message is generated based on the network protocol corresponding to the next node.

[0204] In some embodiments, the system 800 further includes an attack graph generation module, which is used to:

[0205] Obtain at least one node link in the alarm graph;

[0206] For each of the node links, extract information of each node included in the node link, the information including attack protocol information, target IP information, and information on whether the attack is successful;

[0207] An attack graph corresponding to each of the node links is generated according to the extracted information, wherein the attack graph includes an attack target node, an attack tool node, an attack strategy node, an attack effect node, an attack capability node, and an attack event sequence; wherein the target node includes the target IP information, the attack effect includes information on whether the attack is successful, the attack tool node includes a set of attack protocol information, the attack strategy node includes a set of attack protocol information arranged in chronological order; the attack capability node includes a set of business stages corresponding to the attack protocol information, and the attack event sequence includes a set of alarm data nodes arranged in chronological order;

[0208] The attack graph corresponding to each of the node links is displayed.

[0209] In some embodiments, the token acquisition module 810 further:

[0210] For each network protocol, a segment whose number of repetitions reaches a first threshold in traffic determined as suspicious traffic under the network protocol is determined as a first token;

[0211] Filter out the second token in the first token whose false alarm rate is lower than the second threshold and / or whose coverage rate is higher than the third threshold as the token of the abnormal traffic of the network protocol; the false alarm rate refers to the probability that the normal traffic containing the first token is mistakenly detected as abnormal traffic; the coverage rate refers to the probability that the abnormal traffic containing the first token is indeed detected as abnormal traffic.

[0212] In some embodiments, the token acquisition module 810 further:

[0213] After determining the first token, remove the sub-token in the first token; the sub-token is a partial fragment of the first token.

[0214] In some embodiments, the abnormal alarm and node mounting module 820 further:

[0215] Collecting the first alarm data under each of the network protocols matched by using the token;

[0216] According to a preset alarm removal rule, duplicate alarm data in the first alarm data is removed to obtain second alarm data;

[0217] For each of the network protocols, aggregating the second alarm data under the network protocol within the alarm retention time corresponding to the network protocol;

[0218] In response to the aggregation duration of the second alarm data under any protocol reaching the alarm retention duration corresponding to the arbitrary protocol, the super alarm obtained by aggregation is determined as the target alarm data under the arbitrary protocol matched by using the token.

[0219] In some embodiments, the abnormal alarm and node mounting module 820 further:

[0220] Count the number of abnormal traffic under the network protocol within a unit time;

[0221] The alarm retention time corresponding to the abnormal traffic quantity is queried in a preset alarm retention time template, and is determined to be the alarm retention time corresponding to the network protocol; the alarm retention time is between the first value and the second value.

[0222] In some embodiments, the abnormal alarm and node mounting module 820 further:

[0223] Aggregate in the following order. If the aggregation is completed according to the conditions that come first, the conditions that come later are ignored:

[0224] The network protocol type, source IP, and destination IP are the same;

[0225] The source IP and destination IP are the same;

[0226] The destination IP is the same;

[0227] The source IP is the same.

[0228] In some embodiments, the abnormal alarm and node mounting module 820 further:

[0229] Get the alarm map;

[0230] Searching for a first node in the alarm graph, wherein the source IP indicated by the first node is the same as the first source IP indicated by the target alarm data;

[0231] If the first node that meets the condition is not found, determining the target node as an independent node;

[0232] If the first node that meets the condition is found, a second node is searched among the nodes connected to the first node, and the target IP included in the second node is the same as the first target IP indicated by the target alarm data;

[0233] If the second node that meets the condition is not found, mounting the target node on the first node;

[0234] If the second node that meets the condition is found, searching for a third node among the nodes connected to the second node, wherein the source port included in the third node is the same as the first source port indicated by the target alarm data;

[0235] If the third node that meets the condition is not found, mounting the target node on the second node;

[0236] If the third node that meets the condition is found, searching for a fourth node among the nodes connected to the third node, wherein the destination port included in the fourth node is the same as the first destination port indicated by the target alarm data;

[0237] If the fourth node that meets the condition is not found, mounting the target node on the third node;

[0238] If the fourth node that meets the conditions is found, in response to the fourth node having an earlier alarm time, the target node is mounted on the fourth node.

[0239] In some embodiments, the pre-warning module 830 further:

[0240] Acquire a first node link including the target node in the alarm graph;

[0241] According to the network protocol link indicated by the first node link, determining a second node link with the highest indicated network protocol link repetition; the second node link corresponds to a composite attack scenario; the composite attack scenario includes multiple network protocols;

[0242] The determining whether there is a next node connected to the node with the arbitrary protocol in the second node link comprises:

[0243] Calculate the detection degree and / or matching degree corresponding to the target node according to the position of the target node on the first node link; the detection degree refers to the proportion of the network protocols actually detected from the initial network protocol to the network protocol corresponding to the target node in the composite attack scenario when the network protocol corresponding to the target node is detected; the matching degree refers to the proportion of the network protocols detected in all the network protocols included in the composite attack scenario when the network protocol corresponding to the target node is detected;

[0244] In response to the detection degree reaching a fourth threshold and / or the matching degree obtaining a fifth threshold, it is determined whether there is a next node connected to the node having the arbitrary protocol in the second node link.

[0245] In any of the above embodiments, on the one hand, the tokens included in the abnormal traffic under each network protocol can be summarized and learned, and the tokens can be used to detect the abnormal traffic under each network protocol, so that no matter what type of attack, especially for new types of attacks, anomalies can be effectively identified and security alerts can be issued.

[0246] On the other hand, based on the alarm data, an alarm graph can be formed in the order of source IP, destination IP, source port, destination port, and time, so as to complete the network protocol link learning of the compound attack, and also record the currently detected abnormal traffic. Later, by tracing the alarm graph, the attack process of the entire compound attack can be traced back.

[0247] On the other hand, based on the detected alarm data, the learned alarm graph can be used to predict the abnormal traffic that may be generated in the next step, issue a pre-alarm, take safety precautions in advance, and improve the efficiency of the alarm.

[0248] The method of the present invention can summarize and learn the tokens included in the abnormal traffic under each network protocol, and use the token to detect the abnormal traffic under each network protocol, so that it can effectively identify anomalies and issue security alerts for new attack types. In addition, based on the detected alarm data, the learned alarm map can be used to predict the abnormal traffic that may be generated in the next step, issue a pre-alert, perform security protection in advance, and improve the alarm efficiency.

[0249] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A network traffic detection method, characterized in that: The method comprises: According to the analysis results of the first network traffic under each network protocol, a token of the abnormal traffic of each network protocol is obtained; the network protocol includes: protocols corresponding to the information collection stage, the vulnerability scanning stage, the network attack stage and the data theft stage; The token is used to match the second network traffic under each of the network protocols, and in response to the target alarm data under any protocol being matched by the token, the target node corresponding to the target alarm data is mounted on the alarm map; the alarm map includes at least one alarm data node, and the alarm data nodes are connected in the order of the same source IP, the same destination IP, the same source port, the same destination port, and the time sequence; According to the first node link containing the target node in the alarm map, a matching second node link in the alarm map is determined, wherein the second node link contains a complete network protocol link, and it is determined whether there is a next node connected to the node with any protocol in the second node link. If the next node exists, a pre-alarm message is generated according to the network protocol corresponding to the next node.

2. The network traffic detection method according to claim 1, characterized in that: The method further comprises: Obtain at least one node link in the alarm graph; For each of the node links, extract information of each node included in the node link, the information including attack protocol information, target IP information and information on whether the attack is successful; An attack graph corresponding to each of the node links is generated according to the extracted information, wherein the attack graph includes: an attack target node, an attack tool node, an attack strategy node, an attack effect node, an attack capability node, and an attack event sequence; wherein the target node includes the target IP information, the attack effect includes information on whether the attack is successful, the attack tool node includes a set of attack protocol information, the attack strategy node includes a set of attack protocol information arranged in chronological order; the attack capability node includes a set of business stages corresponding to the attack protocol information, and the attack event sequence includes a set of alarm data nodes arranged in chronological order; The attack graph corresponding to each of the node links is displayed.

3. The network traffic detection method according to claim 1, characterized in that: The step of obtaining the token of abnormal traffic of each network protocol according to the analysis result of the first network traffic under each network protocol includes: For each network protocol, a segment whose number of repetitions reaches a first threshold in traffic determined as suspicious traffic under the network protocol is determined as a first token; Filter out the second token in the first token whose false alarm rate is lower than the second threshold and / or whose coverage rate is higher than the third threshold as the token of the abnormal traffic of the network protocol; the false alarm rate refers to the probability that the normal traffic containing the first token is mistakenly detected as abnormal traffic; the coverage rate refers to the probability that the abnormal traffic containing the first token is indeed detected as abnormal traffic.

4. The network traffic detection method according to claim 3, characterized in that: After determining the first token, it also includes: Remove the sub-token in the first token; the sub-token is a partial fragment of the first token.

5. The network traffic detection method according to claim 1, characterized in that: The using the token to match the second network traffic under each of the network protocols includes: Collecting the first alarm data under each of the network protocols matched by using the token; According to a preset alarm removal rule, duplicate alarm data in the first alarm data is removed to obtain second alarm data; For each of the network protocols, aggregating the second alarm data under the network protocol within the alarm retention time corresponding to the network protocol; In response to the aggregation duration of the second alarm data under any protocol reaching the alarm retention duration corresponding to the arbitrary protocol, the super alarm obtained by aggregation is determined as the target alarm data under the arbitrary protocol matched by using the token.

6. The network traffic detection method according to claim 5, characterized in that: The method for adaptively adjusting the alarm retention time includes: Count the number of abnormal traffic under the network protocol within a unit time; The alarm retention time corresponding to the abnormal traffic quantity is queried in a preset alarm retention time template, and is determined to be the alarm retention time corresponding to the network protocol; the alarm retention time is between the first value and the second value.

7. The network traffic detection method according to claim 5, characterized in that: The aggregating the second alarm data under the network protocol includes: Aggregate in the following order. If the aggregation is completed according to the conditions that come first, the conditions that come later are ignored: The network protocol type, source IP, and destination IP are the same; The source IP and destination IP are the same; The destination IP is the same; The source IP is the same.

8. The network traffic detection method according to claim 1, characterized in that: The step of mounting the target node corresponding to the target alarm data on the alarm map includes: Get the alarm map; Searching for a first node in the alarm graph, wherein the source IP indicated by the first node is the same as the first source IP indicated by the target alarm data; If the first node that meets the condition is not found, determining the target node as an independent node; If the first node that meets the condition is found, a second node is searched among the nodes connected to the first node, and the target IP included in the second node is the same as the first target IP indicated by the target alarm data; If the second node that meets the condition is not found, mounting the target node on the first node; If the second node that meets the condition is found, searching for a third node among the nodes connected to the second node, wherein the source port included in the third node is the same as the first source port indicated by the target alarm data; If the third node that meets the condition is not found, mounting the target node on the second node; If the third node that meets the condition is found, searching for a fourth node among the nodes connected to the third node, wherein the destination port included in the fourth node is the same as the first destination port indicated by the target alarm data; If the fourth node that meets the condition is not found, mounting the target node on the third node; If the fourth node that meets the conditions is found, in response to the fourth node having an earlier alarm time, the target node is mounted on the fourth node.

9. The network traffic detection method according to claim 1, characterized in that: The determining, according to the first node link containing the target node in the alarm graph, a second node link matching in the alarm graph comprises: Acquire a first node link including the target node in the alarm graph; According to the network protocol link indicated by the first node link, determining a second node link with the highest indicated network protocol link repetition; the second node link corresponds to a composite attack scenario; the composite attack scenario includes multiple network protocols; The determining whether there is a next node connected to the node with the arbitrary protocol in the second node link comprises: Calculate the detection degree and / or matching degree corresponding to the target node according to the position of the target node on the first node link; the detection degree refers to the proportion of the network protocols actually detected from the initial network protocol to the network protocol corresponding to the target node in the composite attack scenario when the network protocol corresponding to the target node is detected; the matching degree refers to the proportion of the network protocols detected in all the network protocols included in the composite attack scenario when the network protocol corresponding to the target node is detected; In response to the detection degree reaching a fourth threshold and / or the matching degree obtaining a fifth threshold, it is determined whether there is a next node connected to the node having the arbitrary protocol in the second node link.

10. A network traffic detection system, characterized in that: The system comprises: A token acquisition module, which obtains the token of the abnormal traffic of each network protocol according to the analysis result of the first network traffic under each network protocol; the network protocol includes protocols corresponding to the information collection stage, vulnerability scanning stage, network attack stage and data theft stage; The abnormal alarm and node mounting module uses the token to match the second network traffic under each of the network protocols, and in response to matching the target alarm data under any protocol using the token, mounts the target node corresponding to the target alarm data on the alarm map; the alarm map includes at least one alarm data node, and the alarm data nodes are connected in the order of the same source IP, the same destination IP, the same source port, the same destination port, and the time sequence; The pre-alarm module determines a matching second node link in the alarm map based on a first node link containing the target node in the alarm map, wherein the second node link contains a complete network protocol link, and determines whether there is a next node connected to a node with any protocol in the second node link. If the next node exists, pre-alarm information is generated based on the network protocol corresponding to the next node.

Images