Method and device for generating attacker portrait, electronic equipment and storage medium

Abstract

The invention discloses an attacker portrait generation method and device, electronic equipment and a storage medium. The method comprises the following steps: acquiring attack behavior information corresponding to an attack behavior suffered by an attacked honeypot; determining one or more behavior characteristics according to the attack behavior information; analyzing the one or more behavior characteristics through an organization recognition model obtained through training to obtain an attack organization corresponding to the attack behavior information; and generating an attacker portrait corresponding to the same attack organization according to the behavior characteristics corresponding to the attack behavior information belonging to the same attack organization. Through the attacker portrait generation method and device, the electronic equipment and the storage medium, the accuracy of describing the attacker portrait of an attack organization can be improved, and the information security is further improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a method, device, electronic device and storage medium for generating an attacker portrait. Background Art

[0002] In the current network security protection system, attacker profiles can be constructed to track attack information and trace attackers, so as to better formulate targeted security strategies. However, since attacker profile data may contain noise, errors, or incomplete information, it is difficult to create a clear, accurate and dynamic attacker profile. Summary of the invention

[0003] The embodiments of the present application disclose a method, device, electronic device and storage medium for generating an attacker portrait, which can improve the accuracy of the attacker portrait depicting the attacking organization and further improve information security.

[0004] A first aspect of an embodiment of the present application discloses a method for generating an attacker portrait, which is applied to a terminal device. The method includes:

[0005] Collect attack behavior information corresponding to the attack behavior suffered by the attacked honeypot;

[0006] determining one or more behavior characteristics according to the attack behavior information;

[0007] Analyzing the one or more behavior characteristics through the organization recognition model obtained through training to obtain the attack organization corresponding to the attack behavior information;

[0008] An attacker profile corresponding to the same attack organization is generated according to the behavior characteristics corresponding to the attack behavior information belonging to the same attack organization.

[0009] In some possible embodiments, before the organization recognition model obtained through training analyzes the behavior characteristics to obtain the attack organization corresponding to the attack behavior information, the method further includes:

[0010] Mapping each of the behavior characteristics to convert each of the behavior characteristics into a behavior characteristic value;

[0011] The organization recognition model obtained through training analyzes the one or more behavior features to obtain the attack organization corresponding to the attack behavior information, including:

[0012] The organization recognition model obtained through training analyzes the behavior feature values ​​corresponding to each of the behavior features to obtain the attack organization corresponding to the attack behavior information.

[0013] In some possible embodiments, the organization recognition model includes a plurality of weak classifiers; the organization recognition model obtained through training analyzes the one or more behavior features to obtain the attack organization corresponding to the attack behavior information, including:

[0014] The one or more behavior features are analyzed respectively by the multiple weak classifiers to obtain classification results corresponding to each of the weak classifiers, and the attack organization corresponding to the attack behavior information is determined according to the classification results corresponding to each of the weak classifiers.

[0015] In some possible embodiments, before collecting attack behavior information corresponding to the attack behavior suffered by the attacked honeypot, the method further includes:

[0016] Acquire a training data set, the training data set including a plurality of attack sample information, each of the attack sample information being annotated with a corresponding actual attack organization;

[0017] Determine, according to each of the attack sample information, attack sample features corresponding to each of the attack sample information;

[0018] The organization recognition model to be trained is trained according to the attack sample features respectively corresponding to the plurality of attack sample information and the corresponding actual attack organizations.

[0019] In some possible embodiments, the organization identification model includes multiple weak classifiers; and training the organization identification model to be trained according to the attack sample features corresponding to the multiple attack sample information and the corresponding actual attack organizations includes:

[0020] Assigning weights to the attack sample features respectively corresponding to the plurality of attack sample information;

[0021] According to each of the attack sample features, the weight corresponding to each of the attack sample features and the actual attack organization, the multiple weak classifiers are iteratively trained for multiple times until a convergence condition is met;

[0022] A trained tissue recognition model is determined according to the multiple trained weak classifiers.

[0023] In some possible embodiments, the multiple weak classifiers are iteratively trained multiple times according to the attack sample features, the weights corresponding to the attack sample features, and the actual attack organization until a convergence condition is met, including:

[0024] Determine the weight corresponding to each of the attack sample features in the current iteration round;

[0025] Determine the predicted attack organization corresponding to each of the attack sample features by a first weak classifier, and determine the training error of the first weak classifier in the current iteration round according to the predicted attack organization, the actual attack organization and the weight corresponding to each of the attack sample features, wherein the first weak classifier is any of the weak classifiers, and different weak classifiers correspond to different classification thresholds;

[0026] Determine the target weak classifier with the smallest training error in the current iteration round, and calculate the weight of the target weak classifier in the current iteration round according to the training error of the target weak classifier in the current iteration round;

[0027] If the training error of the first weak classifier in the current iteration round is not less than the error threshold, updating the weights corresponding to the respective attack sample features in the next iteration round;

[0028] If the training error of the first weak classifier in the current iteration round is less than the error threshold, it is determined that the convergence condition is met.

[0029] In some possible embodiments, the organization recognition model obtained through training analyzes the one or more behavior features to obtain the attack organization corresponding to the attack behavior information, including:

[0030] Inputting the one or more behavior features into the tissue identification model, analyzing the one or more behavior features through the tissue identification model, and obtaining a first tissue assessment value corresponding to the attack behavior information;

[0031] The first organization evaluation value is compared with the second organization evaluation values ​​corresponding to one or more attacking organizations. If the first organization evaluation value matches the second organization evaluation value corresponding to any attacking organization, the matched attacking organization is determined as the attacking organization corresponding to the attacking behavior information.

[0032] A second aspect of an embodiment of the present application discloses a device for generating an attacker portrait, the device comprising:

[0033] An information collection module is used to collect attack behavior information corresponding to the attack behavior suffered by the attacked honeypot;

[0034] A feature acquisition module, used to determine one or more behavior features according to the attack behavior information;

[0035] An organization identification module, configured to analyze the one or more behavior characteristics through a trained organization identification model to obtain an attack organization corresponding to the attack behavior information;

[0036] The portrait generation module is used to generate an attacker portrait corresponding to the same attack organization according to the behavior characteristics corresponding to the attack behavior information belonging to the same attack organization.

[0037] A third aspect of an embodiment of the present application discloses an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the processor implements the method described in any of the above embodiments.

[0038] A fourth aspect of the embodiments of the present application discloses a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor in an electronic device, the electronic device implements the method described in any of the above embodiments.

[0039] In an embodiment of the present application, attack behavior information corresponding to the attack behavior suffered by the attacked honeypot is collected, one or more behavior characteristics are determined based on the attack behavior information, and the terminal device analyzes the one or more behavior characteristics through the organization recognition model obtained through training to obtain the attack organization corresponding to the attack behavior information, and generates an attacker portrait corresponding to the same attack organization based on the behavior characteristics corresponding to the attack behavior information belonging to the same attack organization. In an embodiment of the present application, the attack behavior information corresponding to the attack behavior suffered by the attacked honeypot can be analyzed and identified through the organization recognition model, and the attack organization to which the attack behavior information belongs can be accurately identified, and the attack behavior can be effectively classified, so that the behavior characteristics corresponding to the attack behavior information of each attack organization are richer and more accurate, and the attacker portrait corresponding to the same attack organization can be generated based on the behavior characteristics corresponding to the attack behavior information belonging to the same attack organization, thereby improving the accuracy of the attacker portrait corresponding to each attack organization. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0041] Figure 1 An application scenario diagram of a method for generating an attacker portrait provided in an embodiment of the present application;

[0042] Figure 2 A flowchart of a method for generating an attacker portrait provided in an embodiment of the present application;

[0043] Figure 3 A flowchart of another method for generating an attacker portrait provided in an embodiment of the present application;

[0044] Figure 4 A flowchart for determining an attacking organization through an organization identification model provided in an embodiment of the present application;

[0045] Figure 5 A flowchart of using a training data set to train a tissue recognition model to be trained provided in an embodiment of the present application;

[0046] Figure 6 A flowchart of a training tissue recognition model provided in an embodiment of the present application;

[0047] Figure 7 A flowchart for iterative training of the tissue recognition model provided in an embodiment of the present application;

[0048] Figure 8 A structural block diagram of a device for generating an attacker portrait provided in an embodiment of the present application;

[0049] Fig. 9 A structural block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0050] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0051] It should be noted that the terms "including" and "having" and any variations thereof in the embodiments of the present application and the accompanying drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products or devices.

[0052] In addition, "at least one" means one or more, and "plurality" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b and c can mean: a, or b, or c, or a and b, or a and c, or b and c, or a, b and c, where a, b, c can be single or multiple.

[0053] Figure 1 This is an application scenario diagram of a method for generating an attacker portrait provided in an embodiment of the present application. Figure 1 As shown, the attacker portrait generation method can be applied to the server 100, and the server 100 can be provided with a honeypot trapping platform 110, and multiple honeypots 120 can be deployed in the honeypot trapping platform 110. When the attack organization 130 attacks the server 100, it can attack the multiple honeypots 120 deployed by the honeypot trapping platform 110 on the server 100. The server 100 can be a device including but not limited to a server, a workstation, a supercomputer, or a server cluster composed of multiple servers.

[0054] The honeypot 120 may be a network trap or bait. The honeypot 120 may actively expose some vulnerabilities or set some baits to lure attackers to attack it, thereby capturing and analyzing the attack behavior.

[0055] The honeypot trapping platform 110 may refer to a management platform based on the honeypot trapping technology. The honeypot trapping platform 110 may be used to manage the lower-level honeypot trapping environment, thereby realizing the deployment management of the honeypot 120 and the acquisition of attack data and other functions. The honeypot trapping technology may use simulation technology to form a trapping environment, and through a series of inducement and disguise means, induce the attack organization 130 to transfer the attack target to the honeypot 120; and take measures such as interception and blocking, behavior analysis, and tracking and tracing, which can not only achieve the purpose of protecting the real server, but also portray the attacker portrait of the attack organization 130.

[0056] Attacker profiling refers to the process of describing and modeling the attack organization 130 to understand the characteristics, behaviors, and motivations of the attack organization 130. By profiling the attack organization 130, potential threats can be better understood, future threats can be predicted in advance, and targeted security strategies can be better formulated.

[0057] Exemplarily, the honeypot trapping platform 110 can be built on the server 100 based on WireGuard tunnel communication, Docker virtualization technology and Sysdig kernel monitoring. WireGuard is a network tunnel tool. In the honeypot trapping platform 110, WireGuard is used to build node probes, which are responsible for creating virtual network cards and virtual Internet Protocol (IP), building communication tunnels, and realizing communication between the honeypot 120 and the honeypot trapping platform 110.

[0058] Docker is an application container engine that allows users to package applications and their dependent packages into a lightweight, portable container, and then install it on any server 100 running Linux or Windows. Compared with traditional virtual machines, Docker containers provide lightweight virtualization, easy installation, and fast start and stop. In the honeypot trapping platform 110, different honeypots 120 and honeypot templates can be built through Docker virtualization technology.

[0059] Sysdig is a system discovery tool used for system-level investigation and troubleshooting. It provides a simple way to capture, analyze, and filter system events, thereby helping users better understand the operating status and performance bottlenecks of the server. When the attack organization 130 launches an attack on the honeypot 120, the honeypot trapping platform 110 can collect and record the attack behavior of the honeypot 120 through the Sysdig kernel monitoring.

[0060] The attack organization 130 may refer to a plurality of attackers with the same or similar attack methods and / or attack tactics, or may refer to a group with clear division of labor in which different attackers are responsible for different attack stages, which is not specifically limited herein.

[0061] Exemplarily, a honeypot trapping platform 110 is deployed on the server 100. When multiple attack organizations 130 launch attacks on the server 100, the honeypot trapping platform 110 induces the attack organization 130 to transfer the attack target to the honeypot 120. The honeypot trapping platform 110 can collect and record the attack behavior information of the attacked honeypot 120 on a large scale, so that the corresponding behavior characteristics can be determined according to the attack behavior information. The honeypot trapping platform 110 analyzes the behavior characteristics through the organization recognition model obtained through training, and can obtain the attack organization 130 corresponding to the attack behavior information. The honeypot trapping platform 110 can generate an attacker portrait corresponding to the same attack organization based on the behavior characteristics corresponding to the attack behavior information belonging to the same attack organization.

[0062] like Figure 2As shown, in one embodiment, a method for generating an attacker portrait is provided, which can be applied to the above-mentioned server. The method may include the following steps:

[0063] Step 202: Collect attack behavior information of the attacked honeypot.

[0064] It is understandable that the server deploys multiple honeypots through the honeypot trapping platform, but in the process of the attack organization attacking the honeypot, not all honeypots will be attacked, so the honeypot trapping platform can only collect the attack behavior information of the attacked honeypot. The attack behavior information can refer to a series of behavior information captured by the honeypot trapping platform in the process of monitoring the attacked honeypot.

[0065] For example, attack behavior information may include attack source information, attack time, attack method and attack target. Attack source information may include unique identification information such as the attacker's IP address, Media Access Control (MAC) address, device fingerprint, etc. The attack time is used to record the time point or time period when the attack occurred. The attack method is used to describe the attack means and methods used by the attacker. The attack method may include Structured Query Language (SQL) injection, Distributed Denial of Service (DDOS) attack, brute force cracking, etc. The attack target refers to the specific target that the attacker attempts to access or destroy, such as a specific service, port, file or database.

[0066] Step 204: determining behavior characteristics according to the attack behavior information.

[0067] Behavior features are extracted from attack behavior information and are used to describe the attacker's attack behavior. In some embodiments, the behavior features may include attacker features and the operating features of the attacked honeypot. Attacker features refer to the features of the client when the attacked honeypot is attacked by the client. Attacker features may include, but are not limited to, attack source information, attack protocol, attack time, device fingerprints, and file samples.

[0068] An attack protocol may refer to a method of implementing an attack by exploiting loopholes or weaknesses in a network protocol, including but not limited to the Transmission Control Protocol (TCP) and the User Datagram Protocol (UDP). A device fingerprint may refer to a device feature or device identifier used to uniquely identify a device. A device fingerprint may be an inherent identifier such as a hardware identity document (ID), serial number, or production ID of a server, or may be a collection of features such as the server's name, model, shape, color, and function. A file sample may refer to a file fragment containing malicious code or data.

[0069] The operating characteristics of the attacked honeypot refer to the operating characteristics of the attacked honeypot when the attacked honeypot is attacked by the client. The operating characteristics of the attacked honeypot may include but are not limited to the device status such as the central processing unit (CPU) usage rate, memory usage rate, the type of vulnerability exploited by the intrusion, the sample callback address and port, Crontab tasks, wallet address and data return address, etc.

[0070] The intrusion exploit vulnerability type may refer to the specific vulnerability type used by the attacker to invade the honeypot system. The sample callback address and port may refer to the remote server address and port used by the attacker to receive the stolen data or execute malicious code in the honeypot after successfully invading the honeypot. The Crontab task may refer to the scheduled task set by the Crontab tool. The wallet address may refer to the unique address used to receive and store cryptocurrency, and the data transmission may refer to the process in which the attacker transmits the stolen data or the result of executing malicious code back to the remote server after successfully invading the honeypot.

[0071] Step 206: Analyze the behavior characteristics through the trained organization recognition model to obtain the attack organization corresponding to the attack behavior information.

[0072] The organization recognition model can determine the attack organization affiliation of new attack behavior information by learning the relationship between the behavior characteristics in known attack behavior information and the attack organization affiliation. Furthermore, the organization recognition model can be constructed by integrating machine learning algorithms. The integrated machine learning algorithms can include but are not limited to the Gradient Boosting Decision Tree (GBDT), XGboost algorithm, Adaptive Boosting (Adaboost) algorithm, and Random Forest (RF) algorithm.

[0073] For example, the Adaboost algorithm can be used to train the organization recognition model to determine the attack organization affiliation of the attack behavior information. The Adaboost algorithm is based on the idea of ​​Boosting, and a strong classifier is obtained by linear combination of multiple weak classifiers. The Adaboost algorithm can increase the attention paid to the samples that are misclassified, reduce the weight of the weak classifier with a large classification error rate, and thus obtain a higher classification accuracy.

[0074] The behavior features corresponding to the attack behavior information are input into the organization recognition model obtained through training, so that the organization recognition model can output the attack organization corresponding to the attack behavior information predicted by the model.

[0075] Exemplarily, after the organization identification model is trained by the Adaboost algorithm, the behavioral features consisting of attack source information, attack protocol, CPU usage, etc. are introduced into the trained organization identification model, so that the organization identification model can output the attack organization predicted by the model as attack organization A.

[0076] Optionally, different numerical values ​​can be used to correspond one-to-one to attack organizations. After the behavioral characteristics corresponding to the attack behavior information are input into the organization identification model obtained through training, the organization identification model outputs a predicted numerical value. By comparing the predicted numerical value with the numerical values ​​corresponding to each attack organization, the attack organization corresponding to the attack behavior information is obtained.

[0077] Exemplarily, after the organization identification model is trained by the Adaboost algorithm, the behavioral characteristics consisting of attack source information, attack protocol, CPU usage, etc. are brought into the trained organization identification model, so that the organization identification model can output a predicted value, which is the same as the value pre-given by the attack organization A, and thus the attack organization of the input attack behavior information is determined to be the attack organization A.

[0078] Step 208, generating an attacker portrait corresponding to the same attack organization according to the behavior characteristics corresponding to the attack behavior information belonging to the same attack organization.

[0079] After the organization identification model analyzes and identifies the behavior features corresponding to the input attack behavior information and determines the affiliation of the attack organization to which the input attack behavior information belongs, the honeypot trapping platform can add the behavior features corresponding to the attack behavior information to the first behavior feature set belonging to the corresponding attack organization.

[0080] At regular intervals or when the number of newly added behavior features in the first behavior feature set reaches a certain number, an attacker profile corresponding to the attack organization is generated based on all features in the first behavior feature set.

[0081] In an embodiment of the present application, the server can analyze and identify the attack behavior information through the organization identification model, can accurately identify the attack organization to which the attack behavior information belongs, and effectively classify the attack behavior, so that the behavior characteristics corresponding to the attack behavior information of each attack organization are richer and more accurate. According to the behavior characteristics corresponding to the attack behavior information belonging to the same attack organization, an attacker portrait corresponding to the same attack organization can be generated, thereby improving the accuracy of the attacker portraits corresponding to each attack organization.

[0082] like Figure 3 As shown, in another embodiment, a method for generating an attacker portrait is provided, and the method may include the following steps:

[0083] Step 302: Collect attack behavior information corresponding to the attack behavior suffered by the attacked honeypot.

[0084] Step 304: determine one or more behavior features according to the attack behavior information.

[0085] Step 306: Map the one or more behavior features to convert the one or more behavior features into behavior feature values.

[0086] After determining one or more behavior features corresponding to the attack behavior information, the server may obtain the data type of each behavior feature, which may refer to the representation method of the behavior feature. Optionally, the behavior feature may include a numerical behavior feature and a character behavior feature. A numerical behavior feature may refer to a behavior feature represented by a number. For example, the attack source IP is 219.239.110.138, which is a numerical behavior feature. A character behavior feature may refer to a behavior feature represented by a combination of at least one type such as text, letters, and symbols. For example, the attack protocol is TCP, which is a character behavior feature.

[0087] It is understandable that each behavioral feature usually has a different representation method. Directly applying the original behavioral features to the tissue recognition model may lead to a significant increase in computational complexity and training time. Therefore, before training the tissue recognition model through behavioral features or inputting behavioral features into the tissue recognition model, these behavioral features need to be mapped into behavioral feature values ​​in a unified format to ensure data standardization.

[0088] For a numerical behavior feature, the numbers in the numerical behavior feature can be directly extracted to obtain the behavior feature value corresponding to the conversion of the numerical behavior feature.

[0089] For example, for IP address-type numerical behavior features, the IP address can be directly converted into a corresponding numerical value. For example, the attack source IP of 219.239.110.138 can be converted into a numerical value of 219239110138. Optionally, each segment of the IP address can be split into binary form and combined according to a preset numerical conversion method, and then converted into decimal to obtain an Int digital address. For example, each segment of the attack source IP 219.239.110.138 is split into binary forms 11011011, 11101111, 01101110 and 10001010, and then combined to obtain 110110111110111101101101010001010, and converted into a decimal 3689901706, that is, the IP address of 219.239.110.138 is converted into an Int digital address of 3689901706.

[0090] For the character-type behavior feature, the character-type behavior feature can be mapped to a behavior feature value through a pre-set mapping table. The mapping table can pre-define behavior feature values ​​corresponding to a plurality of character-type behavior features.

[0091] Exemplarily, the attack protocol may be TCP or UDP. Therefore, the behavior feature value corresponding to the attack protocol may be determined through a pre-stored mapping table, for example, if the attack protocol is TCP, the corresponding behavior feature value is 1; if the attack protocol is UDP, the corresponding behavior feature value is 2, etc., but it is not limited thereto.

[0092] It should be noted that there are usually multiple behavior features corresponding to the attack behavior information, so the attack behavior information can be represented as a second behavior feature set. After each behavior feature in the second behavior feature set is converted into a behavior feature value one by one, the second behavior feature set can be converted into a behavior feature vector.

[0093] Exemplarily, the behavior features corresponding to the attack behavior information include the attack source IP and the attack protocol, so a second behavior feature set can be represented as {"attack source IP", "attack protocol"}, and the second behavior feature set can be represented as {"219.239.110.138", "TCP"} by substituting specific data. According to the different conversion methods of numerical behavior features and character behavior features, the numerical behavior feature 219.239.110.138 can be directly converted into the behavior feature value 3689901706, and the character behavior feature TCP can be mapped to the behavior feature value 1 according to the mapping table, so the second behavior feature set {"219.239.110.138", "TCP"} can be converted into the behavior feature vector [3689901706, 1].

[0094] In the embodiment of the present application, by mapping each behavioral feature and converting the original behavioral features into behavioral feature values ​​in the same numerical format, data standardization is ensured, which helps to reduce computational complexity and training time and improve the efficiency and accuracy of the tissue recognition model.

[0095] Step 308: Analyze the behavior feature values ​​corresponding to one or more behavior features through the organization recognition model obtained through training to obtain the attack organization corresponding to the attack behavior information.

[0096] In step 306, each behavior feature corresponding to the attack behavior information has been converted into a behavior feature value, that is, the second behavior feature set of the attack behavior information has been converted into a corresponding behavior feature vector. Therefore, the behavior feature vector is brought into the organization recognition model obtained through training, so that the organization recognition model can output the attack organization corresponding to the attack behavior information.

[0097] Exemplarily, a behavior feature vector [3689901706, 1] corresponding to an attack behavior information is brought into the organization recognition model trained by the Adaboost algorithm, so that the organization recognition model can output a predicted value "100", which is the same as the value "100" given in advance by the attack organization A. Therefore, it is determined that the attack organization of the attack behavior information belongs to the attack organization A.

[0098] In some embodiments, the organization identification model includes multiple weak classifiers; the server can analyze the behavior characteristics through multiple weak classifiers respectively, obtain the classification results corresponding to each weak classifier, and determine the attack organization corresponding to the attack behavior information according to the classification results corresponding to each weak classifier.

[0099] A weak classifier may refer to a classifier with a small amount of calculation and a low classification accuracy. Multiple weak classifiers can be combined into a strong classifier with high classification accuracy. Multiple weak classifiers are set in the organization identification model, and multiple weak classifiers can be combined into a strong classifier of the organization identification model. The input behavior features can be analyzed separately by multiple weak classifiers, and each weak classifier can give the classification result of the classifier for the input behavior features. According to the classification results corresponding to each weak classifier, the attack organization corresponding to the attack behavior information can be determined.

[0100] Exemplarily, the organization identification model includes three weak classifiers, namely weak classifier A, weak classifier B and weak classifier C. Each weak classifier analyzes the behavior characteristics corresponding to the input attack behavior information, weak classifier A determines that the attack organization corresponding to the attack behavior information is attack organization A, weak classifier B determines that the attack organization is attack organization B, and weak classifier C determines that the attack organization is attack organization A. According to the classification results of each weak classifier, it can be determined that the attack organization actually corresponding to the attack behavior information is attack organization A, that is, the attack organization corresponding to the attack behavior information is determined to be attack organization A through the organization identification model.

[0101] Furthermore, multiple weak classifiers can be weighted and calculated to become a strong classifier. Since the classification accuracy of each weak classifier is different, the weight of each weak classifier is also different. A correctly classified weak classifier can have a higher weight, and an incorrectly classified weak classifier can have a lower weight.

[0102] After converting the second behavior feature set corresponding to the attack behavior information into a corresponding behavior feature vector, the server can analyze the behavior feature vectors respectively through multiple weak classifiers, and each weak classifier classifies the behavior feature vector to obtain a corresponding classification result, and then weights and calculates the weights corresponding to each weak classifier and the classification results corresponding to each weak classifier to determine the attack organization corresponding to the attack behavior information.

[0103] Exemplarily, the weight of weak classifier A of the organization identification model is a1, the weight of weak classifier B is b1, and the weight of weak classifier C is c1. Each weak classifier analyzes the input behavior feature vector, and the classification results of weak classifier A are a2, the classification results of weak classifier B are b2, and the classification results of weak classifier C are c2. The weights corresponding to each weak classifier and the classification results corresponding to each weak classifier are weighted and calculated, that is, a1*a2+b1*b2+c1*c2, so as to obtain the final strong classifier D, that is, the classification result of the organization identification model, and determine that the attack organization corresponding to the attack behavior information is the attack organization A.

[0104] In an embodiment of the present application, multiple weak classifiers are set in the organization identification model, and the behavior characteristics are analyzed by the multiple weak classifiers respectively to determine the attack organization corresponding to the attack behavior information. This can not only utilize the characteristics of different weak classifiers to classify the same behavior characteristics from different angles or characteristics, but also improve the complementarity of the behavior feature classification and reduce the misjudgment of the behavior features, thereby improving the overall recognition accuracy of the behavior features by the organization identification model.

[0105] Figure 4 A flowchart of determining an attacking organization through an organization identification model provided in an embodiment of the present application. Figure 4As shown, in one embodiment, the step of analyzing the behavior characteristics through the organization recognition model obtained through training to obtain the attack organization corresponding to the attack behavior information may include the following steps:

[0106] Step 402: input one or more behavior features into the organization recognition model, analyze the one or more behavior features through the organization recognition model, and obtain a first organization assessment value corresponding to the attack behavior information.

[0107] The behavior feature vector is input into the organization recognition model, and the behavior feature vector is analyzed by the organization recognition model to obtain a first organization evaluation value corresponding to the attack behavior information.

[0108] The first organization evaluation value may be an output result of the organization identification model, and each first organization evaluation value may correspond to an attacking organization.

[0109] Step 404, compare the first organization evaluation value with the second organization evaluation values ​​corresponding to one or more attacking organizations respectively, if the first organization evaluation value matches the second organization evaluation value corresponding to any attacking organization, determine the matched attacking organization as the attacking organization corresponding to the attacking behavior information.

[0110] Since the attack method and attack tactics of the attack organization can also be described by a behavior feature vector, the second organization evaluation value can be pre-calculated by the behavior feature vector corresponding to the attack organization. It should be noted that the behavior feature vector of the attack organization and the corresponding second organization evaluation value can be pre-stored in the server and / or the honeypot trapping platform.

[0111] Since the behavior characteristics corresponding to the behavior characteristic vector include the attacker characteristics and the operation characteristics of the attacked honeypot, the second organization evaluation value can also be calculated based on the attacker characteristics and the operation characteristics of the attacked honeypot.

[0112] Furthermore, since the attack methods and tactics of each attack organization are different, the behavioral feature vectors of each attack organization are also different. In order to improve the degree of differentiation of the second organization evaluation value for different attack organizations, different feature weights can be set for the attacker features and the operating features of the attacked honeypot, and the second organization evaluation value can be obtained by weighted sum calculation. Since the attacker features are more common, the weight of the attacker features can be significantly smaller than the weight of the operating features of the attacked honeypot; and in order to highlight the contribution of the operating features of the attacked honeypot to the corresponding attack organization, the weight of the operating features of each attacked honeypot is also different.

[0113] For example, the attack protocol of attack organization A is TCP, the CPU usage is 99%, the attack protocol of attack organization B is UDP, and the intrusion exploit vulnerability type is SQL injection. Since the attack protocol is an attacker feature, the weight of the attack protocol can be set to 0.1, while the CPU usage and the intrusion exploit vulnerability type are the operating characteristics of the attacked honeypot, so the weight of the CPU usage can be set to 2, and the weight of the intrusion exploit vulnerability type can be set to 5. After mapping the behavior characteristics to behavior feature values, the behavior feature values ​​of attack organization A are 1 and 99, respectively, and the behavior feature values ​​of attack organization B are 2 and 3, respectively. Therefore, after weighted and calculated, the second organization evaluation value of attack organization A is 198.1, and the second organization evaluation value of attack organization B is 15.2. It can be seen that the second organization evaluation values ​​of the two are very different, which makes the attack organization A and attack organization B highly distinguishable.

[0114] The first tissue assessment value matches the second tissue assessment value, which may mean that the first tissue assessment value is identical or similar to the second tissue assessment value. The first tissue assessment value output by the tissue recognition model may not be completely identical to the pre-calculated second tissue assessment value, so when the first tissue assessment value and the second tissue assessment value are similar, the first tissue assessment value and the second tissue assessment value may also be considered to match.

[0115] Exemplarily, the second organization evaluation value of attack organization A is pre-calculated to be 198.1, and the second organization evaluation value of attack organization B is 15.2. The behavior feature vector corresponding to the attack behavior information is input into the organization identification model. The behavior feature vector is analyzed by the organization identification model to obtain a first organization evaluation value of 195 corresponding to the behavior feature vector. It is found that the first organization evaluation value 195 is most matched with the second organization evaluation value of attack organization A of 198.1. Therefore, the matched attack organization A is determined as the attack organization corresponding to the attack behavior information.

[0116] Optionally, when the first organization evaluation value does not match the second organization evaluation value corresponding to any attack organization, the server and / or the honeypot trapping platform can construct a new attack organization based on the behavioral characteristics corresponding to the first organization evaluation value, recalculate the second organization evaluation value based on the behavioral feature vector corresponding to the new attack organization, and store the behavioral feature vector and the corresponding second organization evaluation value corresponding to the new attack organization in the server and / or the honeypot trapping platform.

[0117] In an embodiment of the present application, the organization recognition model obtained through training obtains a first organization evaluation value of the behavioral characteristics corresponding to new attack behavior information, and compares the first organization evaluation value with a second organization evaluation value corresponding to a pre-stored attack organization to determine the attack organization corresponding to the attack behavior information, thereby improving the accuracy of the organization recognition model in identifying the attack organization corresponding to the attack behavior information.

[0118] Figure 5 A flowchart of using a training data set to train a tissue recognition model to be trained is provided in an embodiment of the present application. Figure 5 As shown, in one embodiment, before collecting the attack behavior information corresponding to the attack behavior suffered by the attacked honeypot, the steps may include the following steps:

[0119] Step 501: Obtain a training data set, where the training data set includes a plurality of attack sample information, each of which is labeled with a corresponding actual attack organization.

[0120] Attack behavior information corresponding to the attack behaviors suffered by the attacked honeypots can be collected on a large scale on the honeypot trapping platform deployed on the server to form a training data set.

[0121] The attack sample information may refer to the attack behavior information corresponding to the historical attack behaviors suffered by each honeypot of the honeypot trapping platform, and a training data set is constructed through multiple attack sample information.

[0122] In the training data set, experts need to pre-label the corresponding actual attack organization for each attack sample information. Optionally, experts can pre-label the second organization evaluation value for each attack sample information, and use the second organization evaluation value to represent the corresponding actual attack organization. For example, the second organization evaluation value "1" can be used to represent that the actual attack organization corresponding to the attack sample information is attack organization A, and the second organization evaluation value "100" can be used to represent that the actual attack organization corresponding to the attack sample information is attack organization B. This ensures that in the subsequent training process of the organization identification model, the organization identification model can learn the correlation characteristics between the attack sample information and the actual attack organization.

[0123] Step 503: Determine attack sample features corresponding to each attack sample information according to each attack sample information.

[0124] The attack sample features corresponding to each attack sample information are determined according to each attack sample information, and then each attack sample feature is mapped according to the data type of each attack sample feature, and each attack sample feature is converted into a sample feature value. In other words, the attack sample information can be converted into a sample feature vector including multiple sample feature values.

[0125] Step 505 , training the organization recognition model to be trained according to the attack sample features corresponding to the plurality of attack sample information and the corresponding actual attack organizations.

[0126] Since in the training data set, multiple attack sample information has been converted into corresponding sample feature vectors, and the corresponding second organization evaluation values ​​have been marked for the corresponding sample feature vectors to indicate the actual attack organization corresponding to the attack sample information, the organization recognition model to be trained can be directly trained based on the multiple sample feature vectors and the corresponding second organization evaluation values.

[0127] Exemplarily, the training data set includes three attack sample information, and the three attack sample information are converted into corresponding sample feature vectors, which are [3689901706, 1], [167773121, 2] and [167773121, 3] respectively. Experts annotate the second organization assessment values ​​for the three attack sample information as "1", "10" and "100" respectively. Therefore, the three sample feature vectors [3689901706, 1], [167773121, 2] and [167773121, 3] and the corresponding second organization assessment values ​​"1", "10" and "100" can be used to train the organization recognition model to be trained.

[0128] In an embodiment of the present application, by acquiring and labeling a training data set, it is ensured that each attack sample information corresponds to an actual attack organization, and at the same time, different attack organizations are labeled in a numerical manner, so that the organization identification model can better capture and learn the correlation characteristics between the attack sample information and the actual attack organization during the training process, so that the organization identification model can more accurately identify the attack organization affiliation of new attack behavior information, thereby improving the accuracy and reliability of the organization identification model.

[0129] In some embodiments, the Adaboost algorithm can be used to construct a tissue recognition model. Figure 6 As shown, Figure 6 A flowchart of training an organization identification model provided in an embodiment of the present application. Steps: Training an organization identification model to be trained according to attack sample features and attack organizations corresponding to a plurality of attack sample information, may include the following steps:

[0130] Step 602: assign weights to attack sample features corresponding to a plurality of attack sample information.

[0131] Exemplarily, the server may obtain a sample feature data set D consisting of sample feature vectors and second organization evaluation values ​​respectively corresponding to a plurality of attack sample information:

[0132] D={(x 1 ,y 1 ),(x 2 ,y 2 ),...,(x N ,yN )} Formula (1);

[0133] Where i=1,2,...,N represents the i-th attack sample information, y i The second organization evaluation value of the actual attack organization corresponding to the i-th attack sample information; x i ={λ 1 ,λ 2 ,...,λ K},i=1,2,...,N,x i represents the sample feature vector corresponding to the i-th attack sample information, λ k represents the sample feature value in the sample feature vector, K represents the total number of features of the sample feature vector, and N represents the total number of samples of the attack sample information.

[0134] Determine the initial weight W of the attack sample information 0 :

[0135] W 0 =(w 0,1 ,w 0,2 ,..,w 0,N ) Formula (2);

[0136] Among them, since the attack sample information is generally given the same initial weight therefore

[0137]

[0138] Step 604 , performing multiple iterative training on multiple weak classifiers according to each attack sample feature, the weight corresponding to each attack sample feature and the actual attack combination, until a convergence condition is met.

[0139] In some embodiments, the tissue recognition model is iteratively trained using an Adaboost algorithm. Figure 7 Flow chart of iterative training of the tissue recognition model provided in the embodiment of the present application. Figure 7 As shown, in one embodiment, step 604 may include the following specific steps:

[0140] Step 701: determine the weight corresponding to each attack sample feature in the current iteration round.

[0141] Since the attack sample information has been converted into the corresponding sample feature vector, the weight corresponding to each sample feature vector in the current iteration round is determined during the iterative training process.

[0142] Step 703, using the first weak classifier to respectively determine the predicted attack organization corresponding to each attack sample feature, and determine the training error of the first weak classifier in the current iteration round according to the predicted attack organization, actual attack organization and weight corresponding to each attack sample feature.

[0143] The first weak classifier is any weak classifier among multiple weak classifiers of the tissue identification model, and different weak classifiers correspond to different classification thresholds.

[0144] The classification threshold may refer to the judgment criteria that a weak classifier relies on when making a classification decision.

[0145] Exemplarily, the tissue recognition model includes three weak classifiers, where weak classifier A is G 1 (x), weak classifier B is G 2 (x), weak classifier C is G 3 (x), as follows:

[0146]

[0147] Among them, 2.5 represents the classification threshold of weak classifier A. When the sample feature vector or sample feature value input to weak classifier A is greater than 2.5, weak classifier A can output "1" to indicate correct classification, otherwise it outputs "-1" to indicate wrong classification, thereby completing the classification of the sample feature vector or sample feature value. Similarly, weak classifiers B and C also classify the sample feature vector or sample feature value. After all weak classifiers have classified all sample feature vectors or sample feature values, the classification accuracy of each weak classifier can be calculated, so that the training error of each weak classifier can be determined.

[0148] Step 705 , determining the target weak classifier with the smallest training error in the current iteration round, and calculating the weight of the target weak classifier in the current iteration round according to the training error of the target weak classifier in the current iteration round.

[0149] Step 707 , determining whether the training error of the target weak classifier in the current iteration round is less than the error threshold, if not, executing step 709 , if less than, executing step 711 .

[0150] Step 709: Update the weight corresponding to each attack sample feature in the next iteration round.

[0151] Step 711, determine whether the convergence condition is met.

[0152] Exemplarily, for iteration rounds t=1, 2, ..., T, determine the weight coefficient W of the sample feature vector corresponding to the N attack sample information in the tth iteration round: t :

[0153] W t =(w t,1 ,w t,2 ,...,w t,N ), t=1,2,...,T Formula (4);

[0154] In the tth iteration, the jth weak classifier (i.e., the first weak classifier) ​​is used to classify each sample feature vector, and the sample weight w of the i-th sample feature vector is t,j , calculate the training error ε of the jth weak classifier in the tth iteration round t,j :

[0155]

[0156] Among them, I(h j (x i )≠y i ) represents the indicator function. When the formula in the brackets holds true, I(h j (x i )≠y i )=1, when the formula in brackets is not true, I(h j (x i )=y i )=0, that is, the jth weak classifier classifies the i-th sample feature vector. When the jth weak classifier misclassifies, I(h j (x i )≠y i )=1, when the jth weak classifier is accurate in classification, I(h j (x i )≠y i )=0, j represents the jth weak classifier, and J is a positive integer representing the total number of weak classifiers.

[0157] In the tth iteration, the training error ε of each weak classifier is determined according to formula (5): t,j After that, the training error ε t,j The smallest weak classifier is used as the target weak classifier H t , determine the target weak classifier H t The training error is ε t , we can calculate 1 minus the training error ε t The difference obtained is the same as the training error ε t The ratio of the target weak classifier H is obtained by performing logarithmic calculation on the ratio. t Specifically, the target weak classifier H can be calculated using formula (6): t Updated weights:

[0158]

[0159] Among them, α t Represents the target weak classifier H t Updated weights;

[0160] The training error ε of the target weak classifier in the current iteration round can be determined t is not less than the error threshold. If the training error ε of the target weak classifier in the current iteration round t Not less than the error threshold ε, that is, ε t ≥ε, then according to the second organization evaluation value y of the actual attack organization corresponding to the i-th attack sample information i , target weak classifier H t For the classification result of the i-th sample feature vector and the sample weight of the i-th sample feature vector in the t-th iteration round, update the sample weight corresponding to the i-th sample feature vector in the next iteration round, that is, the t+1-th iteration round:

[0161]

[0162] Among them, w t,i represents the sample weight of the i-th sample feature vector in the t-th iteration round, Z t is the normalization factor used to convert the training error ε t Mapped to the range of 0 to 1.

[0163] If the target weak classifier H t The training error ε in the tth iteration t is less than the error threshold ε, that is, ε t ≤ε, it is determined that the convergence condition is met and the iterative training is stopped.

[0164] Step 606: Determine a trained tissue recognition model based on the multiple trained weak classifiers.

[0165] It should be noted that each iteration round usually only obtains one weak classifier, so the target weak classifiers of all iteration rounds can be linearly combined to obtain a strong classifier, which can be used as a trained tissue recognition model.

[0166] Exemplarily, in the tth iteration round, the strong classifier obtained by linearly combining the target weak classifiers of each iteration round is:

[0167]

[0168] After determining the weak classifier H that meets the target t The training error ε in the tth iteration tWhen the error is less than the error threshold ε, the strong classifier of the current iteration round can be used as the final strong classifier:

[0169] H(x)=H t (x) Formula (10);

[0170] The final strong classifier H(x) is the trained tissue recognition model.

[0171] In an embodiment of the present application, the sample weights of the attack sample information and the weights of the weak classifiers are continuously updated during the iterative training process of the organization recognition model, and a plurality of weak classifiers obtained through training are linearly combined to obtain a strong classifier as the organization recognition model. This allows the model to pay more attention to the features of the attack samples that are misclassified, and to obtain new weak classifiers through further learning of the features of the attack samples that are misclassified, thereby improving the accuracy of the weak classifiers in classifying the attack sample features, and further improving the accuracy of the organization recognition model classification.

[0172] Based on the method for generating an attacker portrait provided in the above embodiment, Figure 8 This is a structural block diagram of a device for generating an attacker portrait provided in an embodiment of the present application. Figure 8 As shown, in one embodiment, a device 800 for generating an attacker portrait is provided, and the device 800 for generating an attacker portrait includes an information collection module 801, a feature acquisition module 802, an organization identification module 803, and a portrait generation module 804.

[0173] The information collection module 801 is used to collect attack behavior information corresponding to the attack behavior suffered by the attacked honeypot.

[0174] The feature acquisition module 802 is used to determine the behavior feature according to the attack behavior information.

[0175] The organization identification module 803 is used to analyze the behavior characteristics through the trained organization identification model to obtain the attack organization corresponding to the attack behavior information.

[0176] The portrait generation module 804 is used to generate an attacker portrait corresponding to the same attack organization according to the behavior characteristics corresponding to the attack behavior information belonging to the same attack organization.

[0177] In some embodiments, the attacker portrait generating device 800 further includes a feature mapping module.

[0178] The feature mapping module is used to map one or more behavior features before the organization recognition model obtained through training analyzes one or more behavior features to obtain the attack organization corresponding to the attack behavior information, so as to convert the one or more behavior features into behavior feature values.

[0179] The feature acquisition module 802 is further used to analyze the behavior feature values ​​corresponding to one or more behavior features through the organization recognition model obtained through training, so as to obtain the attack organization corresponding to the attack behavior information.

[0180] In some embodiments, the organization identification module 803 is used to analyze one or more behavior features through multiple weak classifiers respectively, obtain classification results corresponding to each weak classifier, and determine the attack organization corresponding to the attack behavior information according to the classification results corresponding to each weak classifier.

[0181] In some embodiments, the attacker portrait generation device 800 also includes a training data acquisition module and a model training module.

[0182] The training data acquisition module is used to acquire a training data set, which includes a plurality of attack sample information, each of which is annotated with a corresponding actual attack organization.

[0183] The model training module is used to determine the attack sample features corresponding to each attack sample information according to each attack sample information; and train the organization recognition model to be trained according to the attack sample features corresponding to multiple attack sample information and the corresponding actual attack organizations.

[0184] In some embodiments, the model training module includes a weight allocation unit and a training unit.

[0185] The weight allocation unit is used to allocate weights to the attack sample features corresponding to the multiple attack sample information.

[0186] The training unit is used to perform multiple iterative training on multiple weak classifiers according to the characteristics of each attack sample, the weight corresponding to each attack sample characteristic and the actual attack organization until the convergence condition is met; and determine the trained organization recognition model according to the multiple weak classifiers obtained by training.

[0187] In some embodiments, the training unit is also used to determine the weight corresponding to each attack sample feature in the current iteration round; determine the predicted attack organization corresponding to each attack sample feature through the first weak classifier, and determine the training error of the first weak classifier in the current iteration round according to the predicted attack organization, actual attack organization and weight corresponding to each attack sample feature; the first weak classifier is any weak classifier; determine the target weak classifier with the smallest training error in the current iteration round, and calculate the weight of the target weak classifier in the current iteration round according to the training error of the target weak classifier in the current iteration round; if the training error of the first weak classifier in the current iteration round is not less than the error threshold, update the weight corresponding to each attack sample feature in the next iteration round; if the training error of the first weak classifier in the current iteration round is less than the error threshold, determine that the convergence condition is met.

[0188] In some embodiments, the organization identification module 803 is also used to input one or more behavioral features into the organization identification model, analyze the one or more behavioral features through the organization identification model, and obtain a first organization assessment value corresponding to the attack behavior information; compare the first organization assessment value with the second organization assessment value corresponding to one or more attacking organizations, and if the first organization assessment value matches the second organization assessment value corresponding to any attacking organization, the matched attacking organization is determined as the attacking organization corresponding to the attacking behavior information.

[0189] Fig. 9 This is a structural block diagram of an electronic device provided in an embodiment of the present application. Fig. 9 As shown, the electronic device 900 may include a memory 902 and a processor 901. The memory 902 stores a computer program. When the computer program is executed by the processor 901, the electronic device 900 implements the method for generating an attacker portrait as described in the above embodiments.

[0190] The processor 901 may include one or more processing cores. The processor 901 uses various interfaces and lines to connect the various parts of the entire electronic device, and executes various functions of the electronic device and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory, and calling data stored in the memory. Optionally, the processor 901 can be implemented in at least one hardware form of digital signal processing, field programmable gate array, and programmable logic array. The processor 901 can integrate one or a combination of a central processing unit (Central Processing Unit, referred to as CPU), a graphics processing unit (Graphics Processing Unit, referred to as GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing display content; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 901, and it can be implemented separately through a communication chip.

[0191] The memory 902 may include a random access memory or a read-only memory. The memory may be used to store instructions, programs, codes, code sets or instruction sets. The memory may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function, instructions for implementing the above-mentioned various method embodiments, etc. The data storage area may also store data created by the electronic device during use, etc.

[0192] An embodiment of the present application discloses a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor implements the method for generating an attacker portrait as described in the above embodiments.

[0193] An embodiment of the present application discloses a computer program product, which includes a computer program. When the computer program can be executed by a processor, the processor implements the method for generating an attacker portrait as described in the above embodiments.

[0194] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a non-volatile computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a ROM, etc.

[0195] The above description is only a specific example of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for generating an attacker portrait, characterized in that: The method comprises: Collect attack behavior information corresponding to the attack behavior suffered by the attacked honeypot; determining one or more behavior characteristics according to the attack behavior information; Analyzing the one or more behavior characteristics through the organization recognition model obtained through training to obtain the attack organization corresponding to the attack behavior information; An attacker profile corresponding to the same attack organization is generated according to the behavior characteristics corresponding to the attack behavior information belonging to the same attack organization.

2. The method according to claim 1, characterized in that Before the organization recognition model obtained through training analyzes the one or more behavior features to obtain the attack organization corresponding to the attack behavior information, the method further includes: Mapping the one or more behavior characteristics to convert the one or more behavior characteristics into behavior characteristic values; The organization recognition model obtained through training analyzes the one or more behavior features to obtain the attack organization corresponding to the attack behavior information, including: The organization recognition model obtained through training analyzes the behavior feature values ​​corresponding to the one or more behavior features to obtain the attack organization corresponding to the attack behavior information.

3. The method according to claim 1, characterized in that The organization recognition model includes a plurality of weak classifiers; the organization recognition model obtained through training analyzes the one or more behavior features to obtain the attack organization corresponding to the attack behavior information, including: The one or more behavior features are analyzed respectively by the multiple weak classifiers to obtain classification results corresponding to each of the weak classifiers, and the attack organization corresponding to the attack behavior information is determined according to the classification results corresponding to each of the weak classifiers.

4. The method according to claim 1, characterized in that: Before collecting the attack behavior information corresponding to the attack behavior suffered by the attacked honeypot, the method further includes: Acquire a training data set, the training data set including a plurality of attack sample information, each of the attack sample information being annotated with a corresponding actual attack organization; Determine, according to each of the attack sample information, attack sample features corresponding to each of the attack sample information; The organization recognition model to be trained is trained according to the attack sample features respectively corresponding to the plurality of attack sample information and the corresponding actual attack organizations.

5. The method according to claim 4, characterized in that The organization identification model includes a plurality of weak classifiers; the training of the organization identification model to be trained according to the attack sample features corresponding to the plurality of attack sample information and the corresponding actual attack organizations includes: Assigning weights to the attack sample features respectively corresponding to the plurality of attack sample information; According to each of the attack sample features, the weight corresponding to each of the attack sample features and the actual attack organization, the multiple weak classifiers are iteratively trained for multiple times until a convergence condition is met; A trained tissue recognition model is determined according to the multiple trained weak classifiers.

6. The method according to claim 5, characterized in that The iterative training of the multiple weak classifiers is performed multiple times according to the attack sample features, the weights corresponding to the attack sample features, and the actual attack organization until the convergence condition is met, including: Determine the weight corresponding to each of the attack sample features in the current iteration round; Determine the predicted attack organization corresponding to each of the attack sample features by the first weak classifier, and determine the training error of the first weak classifier in the current iteration round according to the predicted attack organization, the actual attack organization and the weight corresponding to each of the attack sample features; the first weak classifier is any of the weak classifiers, and different weak classifiers correspond to different classification thresholds; Determine the target weak classifier with the smallest training error in the current iteration round, and calculate the weight of the target weak classifier in the current iteration round according to the training error of the target weak classifier in the current iteration round; If the training error of the target weak classifier in the current iteration round is not less than the error threshold, updating the weights corresponding to the attack sample features in the next iteration round; If the training error of the target weak classifier in the current iteration round is less than the error threshold, it is determined that the convergence condition is met.

7. The method according to claim 1, characterized in that The organization recognition model obtained through training analyzes the one or more behavior features to obtain the attack organization corresponding to the attack behavior information, including: Inputting the one or more behavior features into the tissue identification model, analyzing the one or more behavior features through the tissue identification model, and obtaining a first tissue assessment value corresponding to the attack behavior information; The first organization evaluation value is compared with the second organization evaluation values ​​corresponding to one or more attacking organizations. If the first organization evaluation value matches the second organization evaluation value corresponding to any attacking organization, the matched attacking organization is determined as the attacking organization corresponding to the attacking behavior information.

8. A device for generating an attacker portrait, characterized in that: The device comprises: An information collection module is used to collect attack behavior information corresponding to the attack behavior suffered by the attacked honeypot; A feature acquisition module, used to determine one or more behavior features according to the attack behavior information; An organization identification module, configured to analyze the one or more behavior characteristics through a trained organization identification model to obtain an attack organization corresponding to the attack behavior information; The portrait generation module is used to generate an attacker portrait corresponding to the same attack organization according to the behavior characteristics corresponding to the attack behavior information belonging to the same attack organization.

9. An electronic device, characterized in that: The method comprises a memory and a processor, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the processor implements the method for generating an attacker portrait according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the processor implements the method for generating an attacker portrait according to any one of claims 1 to 7.

Images