System service security detection method and device, electronic equipment and storage medium

Abstract

The invention discloses a system service security detection method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining resource occupation data of a network node connected with a target system at a plurality of moments for the target system, and determining resource change data according to the resource occupation data at the plurality of moments; determining a service attack state corresponding to the target system through the resource change data and a target service identification model; under the condition that the target system is attacked by the target service rejected by the target system, determining a target network node which initiates the target service in the plurality of network nodes; the number of times of initiating the target service by each target network node and the number of the target network nodes are determined, and the system security index of the target system is determined according to the number of the nodes and the number of times of initiating, so that an attack source can be found and positioned in time, the security condition of the system can be dynamically evaluated, and the protection capability and response speed of the system are improved. And complex and changeable network attacks can be effectively handled.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a system service security detection method, device, electronic equipment and storage medium. Background Art

[0002] In modern network environments, target systems (such as servers, network devices, etc.) often face various security threats, especially service attacks (such as DDoS attacks, SYN Flood attacks, etc.).

[0003] In related technologies, security protection measures often rely on fixed rules and are difficult to deal with complex and changing attack methods. In addition, attackers often use multiple network nodes to launch attacks, making single-point protection ineffective. Summary of the invention

[0004] The present invention provides a system service security detection method, device, electronic device and storage medium to solve the problem in related technologies that it is difficult to locate complex and changeable attack sources and only single-point protection can be achieved.

[0005] According to one aspect of the present invention, a system service security detection method is provided, the method comprising:

[0006] Acquire resource occupancy data of the target system by network nodes connected to the target system at multiple times, and determine resource change data according to the resource occupancy data at multiple times;

[0007] Determining a service attack state corresponding to the target system through the resource change data and the target service identification model, wherein the service attack state is used to characterize whether the target system is attacked by a target service rejected by the target system;

[0008] In the case where the target system is attacked by a target service rejected by the target system, determining a target network node among the plurality of network nodes that initiates the target service;

[0009] The number of times each of the target nodes initiates the target service and the number of the target network nodes are determined, and a system security index of the target system is determined according to the number of nodes and the number of initiations.

[0010] According to another aspect of the present invention, a system service security detection device is provided, the device comprising:

[0011] A node resource monitoring module, used to obtain resource occupancy data of a network node connected to a target system at multiple times for the target system, and determine resource change data based on the resource occupancy data at multiple times;

[0012] A service attack identification module, used to determine the service attack status corresponding to the target system through the resource change data and the target service identification model, wherein the service attack status is used to characterize whether the target system is attacked by a target service rejected by the target system;

[0013] a target node determination module, configured to determine a target network node among the plurality of network nodes that initiates the target service when the target system is attacked by a target service rejected by the target system;

[0014] The system security determination module is used to determine the number of times each target node initiates the target service and the number of target network nodes, and determine the system security index of the target system according to the number of nodes and the number of initiations.

[0015] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0016] at least one processor; and

[0017] a memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the system service security detection method described in any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the system service security detection method described in any embodiment of the present invention when executed.

[0020] The technical solution of the embodiment of the present invention is as follows: first, by acquiring resource occupancy data of the target system at multiple times by the network nodes connected to the target system, the resource change data is determined according to the resource occupancy data at multiple times, so that the resource usage change can be detected in real time and abnormal behavior can be discovered in time; then, the service attack state corresponding to the target system is determined by the resource change data and the target service identification model. Since the service attack state is used to characterize whether the target system is attacked by the target service rejected by the target system, it can be accurately judged whether the target system is attacked; then, in the case that the target system is attacked by the target service rejected by the target system, the target network node that initiates the target service among the multiple network nodes is determined, so that the attack source can be quickly located and the network node that initiates the attack can be accurately identified; finally, the number of initiations of the target service by each target node and the number of nodes of the target network node are determined, and the system security index of the target system is determined according to the number of nodes and the number of initiations, so that the system security state can be quantified, which solves the problem that it is difficult to locate the complex and changeable attack source in the related technology and can only provide single-point protection. It can not only discover and locate the attack source in time, but also dynamically evaluate the security status of the system, improve the protection capability and response speed of the system, and effectively deal with complex and changeable network attacks.

[0021] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 is a flow chart of a system service security detection method provided according to Embodiment 1 of the present invention;

[0024] Figure 2 is a flow chart of a system service security detection method provided according to Embodiment 2 of the present invention;

[0025] Figure 3 is a structural diagram of a system service security detection device provided according to Embodiment 3 of the present invention;

[0026] Figure 4 It is a structural schematic diagram of an electronic device for implementing the system service security detection method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0030] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0031] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0032] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0033] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0034] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0035] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0036] Embodiment 1

[0037] Figure 1 A flowchart of a system service security detection method is provided for the first embodiment of the present invention. This embodiment is applicable to systems that require real-time detection and defense against network attacks. The method can be executed by a system service security detection device, which can be implemented in the form of hardware and / or software. Optionally, it can be implemented by an electronic device, which can be a mobile terminal, a PC or a server, etc.

[0038] like Figure 1 As shown, the method may specifically include:

[0039] S110, obtaining resource occupancy data of the target system by network nodes connected to the target system at multiple time instants, and determining resource change data according to the resource occupancy data at multiple time instants.

[0040] Among them, the target system can be understood as a specific computer system or server that needs to be detected and protected, and the target system may face security threats from the outside or inside. The network node can be understood as each component in the network, and each device connected to the network can be called a network node. The network nodes can include but are not limited to servers, workstations, routers and switches, and the network nodes can communicate with each other through network protocols. The resource occupancy data can be understood as data on various resources consumed by the target system during operation, including but not limited to CPU utilization, memory usage, and disk read and write speed. The resource occupancy data reflects the current working status and load of the target system. The resource change data can be understood as the usage change trend or difference of the resource occupancy data obtained by comparing and analyzing the resource occupancy data at different times. The resource change data is used to indicate whether the target system is subject to abnormal attacks or loads.

[0041] S120. Determine a service attack status corresponding to the target system through the resource change data and the target service identification model, wherein the service attack status is used to indicate whether the target system is attacked by a target service rejected by the target system.

[0042] Among them, the target service identification model can be understood as a pre-trained algorithm or model for identifying a specific type of service request and determining whether the service request is normal. The target service identification model can learn normal request patterns based on historical data, thereby effectively distinguishing legitimate service requests from potential attack behaviors. The service attack status can be understood as status information indicating whether the target system is suffering from some form of service attack. The service attack can be understood as an attempt to make the target service unavailable or reduce the quality of service. Exemplarily, the service attack can be a DDoS attack (distributed denial of service attack), etc. The target service can be understood as a service that the attacker attempts to use or interfere with. Exemplarily, the target service may include but is not limited to HTTP service, FTP service, database service, etc. It can be understood that in some cases, the target service may be a service explicitly rejected by the target system, that is, the system is configured to not allow such service to be provided.

[0043] S130: When the target system is attacked by a target service rejected by the target system, determine a target network node that initiates the target service among the multiple network nodes.

[0044] The target network node can be understood as a network node that is identified as initiating an attack when a service attack is confirmed. For example, the target network node can be a botnet controlled by a hacker, or a device infected by malware, or a device of a legitimate user but used by an attacker to amplify the attack effect, etc., which is not limited here.

[0045] Based on the above scheme, optionally, after determining the target network node that initiates the target service among the multiple network nodes, it also includes: intercepting the target service and reducing the system resources allocated to the target network node according to the number of times the target network node initiates the target service.

[0046] In an optional implementation, when a target network node is detected to have initiated a target service that is considered an attack, the system will take measures to prevent the target service request from reaching the target system. The interception can be achieved through firewall rules, intrusion prevention systems (IPS) or other security mechanisms, etc., in order to prevent the attacker from further using the target service to cause damage. In addition, in order to mitigate the impact of the attack, the system can reduce system resources to the target network node. For example, the bandwidth, CPU time, memory and other resources allocated to the target network node can be reduced, or the service response can be completely stopped.

[0047] The above scheme can effectively reduce the attacker's ability to use the target network node to launch an attack by reducing the system resource allocation of the target network node, thereby alleviating the pressure on the target system and improving the overall security and stability of the system.

[0048] S140: Determine the number of times each of the target network nodes initiates the target service and the number of the target network nodes, and determine a system security index of the target system according to the number of nodes and the number of initiations.

[0049] Among them, the number of initiations can be understood as the number of times each target network node initiates a target service request to the target system. It is understandable that a high frequency of initiations may be a sign of an attack. The number of nodes can be understood as the total number of target network nodes participating in the attack. It is understandable that a larger number of attack nodes means a stronger attack capability. The system security index can be understood as a quantitative indicator determined based on factors such as the number of target network nodes and the number of initiations of each node, which is used to evaluate the overall security of the target system. It is understandable that the higher the system security index, the greater the threat to the target system, and the more stringent protection measures need to be taken.

[0050] On the basis of the above solution, optionally, the system security index of the target system may be determined according to the number of nodes and the number of initiations based on the following formula:

[0051]

[0052] Where F represents the system security index of the target system, M represents the number of nodes in the target network, and γ n represents the weight coefficient of the nth network node, N represents the total number of network nodes connected to the target system, 1≤n≤N, n is a positive integer, A n Indicates the number of times the nth target network node initiates the target service.

[0053] An optional implementation method is to determine the total number N of all network nodes connected to the target system, identify which network nodes are target network nodes (i.e., nodes that initiate the attack), and record the number M of these nodes. For each target network node, record the number of times it initiates the target service A. n , set the weight coefficient γ for each target network node n The weight coefficient can be determined based on historical data, the importance of the node, or other factors. For example, if a network node frequently launches attacks, a higher weight coefficient can be set for it. The system security index of the target system is calculated using a formula.

[0054] The technical solution of the embodiment of the present invention is as follows: first, by acquiring resource occupancy data of the target system at multiple times by the network nodes connected to the target system, the resource change data is determined according to the resource occupancy data at multiple times, so that the resource usage change can be detected in real time and abnormal behavior can be discovered in time; then, the service attack state corresponding to the target system is determined by the resource change data and the target service identification model. Since the service attack state is used to characterize whether the target system is attacked by the target service rejected by the target system, it can be accurately judged whether the target system is attacked; then, in the case that the target system is attacked by the target service rejected by the target system, the target network node that initiates the target service among the multiple network nodes is determined, so that the attack source can be quickly located and the network node that initiates the attack can be accurately identified; finally, the number of initiations of the target service by each target node and the number of nodes of the target network node are determined, and the system security index of the target system is determined according to the number of nodes and the number of initiations, so that the system security state can be quantified, which solves the problem that it is difficult to locate the complex and changeable attack source in the related technology and can only provide single-point protection. It can not only discover and locate the attack source in time, but also dynamically evaluate the security status of the system, improve the protection capability and response speed of the system, and effectively deal with complex and changeable network attacks.

[0055] Embodiment 2

[0056] Figure 2A flow chart of a system service security detection method provided for Embodiment 2 of the present invention, this embodiment is based on the above embodiment, and further refines the method of determining the service attack status corresponding to the target system through the resource change data and the target service identification model. Optionally, the method of determining the service attack status corresponding to the target system through the resource change data and the target service identification model includes: determining abnormal change data in the resource change data, inputting the abnormal change data into the target service identification model to obtain the service attack status corresponding to the target system, wherein the target service identification model is obtained by training a deep learning model based on sample resource data and the service attack status corresponding to the sample resource data. For specific implementation methods, please refer to the description of this embodiment. Among them, technical features that are the same or similar to those in the above embodiments are not repeated here.

[0057] like Figure 2 As shown, the method may specifically include:

[0058] S210, obtaining resource occupancy data of the target system by network nodes connected to the target system at multiple times, and determining resource change data according to the resource occupancy data at multiple times;

[0059] S220: Determine abnormal change data in the resource change data, and input the abnormal change data into a target service identification model to obtain a service attack status corresponding to the target system.

[0060] Among them, the abnormal change data can be understood as data that is different from the normal change mode in the resource change data. The abnormal change data can indicate that the system is experiencing abnormal resource usage, which may be caused by an attack or other abnormal events. The target service identification model can be a pre-trained algorithm or model, which can be trained to obtain a deep learning model based on sample resource data and the service attack status corresponding to the sample resource data. The sample resource data can be understood as historical resource usage data used to train the target service identification model. The service attack status can be understood as a status label of whether the system is actually under attack when collecting sample resource data. The service attack status can be binary (such as "attack" or "normal") or multi-category (such as "DDoS attack", "SYN Flood attack", "normal", etc.), which is not limited here. The deep learning model can be trained with a large amount of sample resource data and the corresponding service attack status, and the model parameters are gradually adjusted to minimize the prediction error, which is used to detect and classify new resource change data and determine whether the system is under attack.

[0061] Based on the above solution, optionally, determining the abnormal change data in the resource change data includes: if the resource change data satisfies a preset abnormality detection condition, determining the resource change data as abnormal change data, wherein the abnormality detection condition is:

[0062]

[0063] Where D t+1 represents the resource occupancy data of the target system by the network node at time t+1, D t represents the resource occupancy data of the target system by the network node at time t, D t ≠0, μ represents the error coefficient of resource data, and θ represents a preset constant.

[0064] Among them, the anomaly detection condition can be used as a standard for judging whether the resource change data is abnormal. It is understandable that when the resource change data meets the anomaly detection condition, it is considered to be abnormal change data. The error coefficient can be understood as an adjustment factor used to adjust the sensitivity of resource changes. It is understandable that a larger error coefficient will make anomaly detection more relaxed, while a smaller error coefficient will make anomaly detection more stringent. The preset constant can be understood as a threshold for judging whether the resource change data is abnormal. It is understandable that when the calculation result of the resource change data is greater than or equal to the preset constant, the resource change data is considered to be abnormal.

[0065] The above scheme, by using the anomaly detection conditions, can timely and accurately identify abnormal changes in resource usage, reduce false positives and missed positives, thereby quickly discovering potential attacks or failures, improving the security and stability of the system, optimizing resource allocation, and ensuring the normal operation of key services.

[0066] Based on the above scheme, optionally, before inputting the abnormal change data into the target service identification model, it also includes: obtaining sample resource data of a sample system of the same type as the target system; determining a service attack status corresponding to the sample resource data, and training a deep learning model according to the sample resource data and the service attack status corresponding to the sample resource data to obtain a target service identification model.

[0067] The sample resource data can be understood as resource usage data collected from the sample system, including but not limited to CPU usage, memory usage, disk I / O rate and network bandwidth, etc., which are used to train the deep learning model so that the model can learn and identify normal and abnormal resource usage patterns. The sample resource data is the change data of the resources occupied by the sample system when the sample node connected to the sample system initiates a service rejected by the sample system, and the change data of the resources occupied by the sample system when the sample node initiates a normal service. The sample system can be understood as other systems of the same type or similar characteristics as the target system, which are used to collect data required for training the deep learning model. The sample node can be understood as a network node connected to the sample system, which can be a server, workstation, router and switch, etc. The service request initiated by the sample node is used to generate sample resource data to help train the deep learning model to identify normal and abnormal behaviors.

[0068] An optional implementation method includes selecting a sample system of the same type or with similar characteristics as the target system, collecting resource usage data of the sample system at multiple time points, including CPU usage, memory usage, disk I / O rate, network bandwidth, etc., recording resource change data when the sample node initiates a service rejected by the sample system, and recording resource change data when the sample node initiates a normal service; determining the service attack status (such as "attack" or "normal") corresponding to each sample resource data through manual labeling or an existing security system, and associating these labels with the corresponding sample resource data to form a labeled data set; using the labeled data set to train a deep learning model, adjusting model parameters to minimize prediction errors, and evaluating the performance of the model through cross-validation and test sets to ensure the accuracy and generalization ability of the deep learning model; after training, saving the trained model as a target service identification model.

[0069] The above solution collects resource change data of sample systems of the same type as the target system, marks their service attack status, and trains a deep learning model to obtain a target service identification model. This not only improves the deep learning model's ability to identify abnormal change data in a timely and accurate manner, but can also effectively discover and respond to potential attacks, enhance the security and stability of the system, and ensure the normal operation of key services.

[0070] Based on the above solution, optionally, after obtaining the target service identification model, the method further includes: updating the sample resource data, and updating the target service identification model according to the updated sample resource data.

[0071] An optional implementation method is to obtain a target service identification model; re-collect resource usage data of sample systems periodically or under specific conditions (such as when a new attack pattern is detected); and retrain or fine-tune the existing target service identification model using the new sample resource data.

[0072] The above scheme, by regularly updating sample resource data and retraining the target service identification model, can ensure that the target service identification model always maintains the latest attack detection capabilities, adapts to new attack methods and system changes in a timely manner, improves the accuracy and generalization ability of the model, and thus more effectively identifies and responds to potential security threats, enhancing the security and stability of the system.

[0073] S230, in a case where the target system is attacked by a target service rejected by the target system, determining a target network node among the plurality of network nodes that initiates the target service;

[0074] S240: Determine the number of times each target network node initiates the target service and the number of target network nodes, and determine the system security index of the target system according to the number of nodes and the number of initiations.

[0075] The technical solution of the embodiment of the present invention timely discovers abnormal behavior by determining resource change data, and secondly, utilizes the target service identification model based on deep learning to accurately determine whether the system is under attack and identify the network node that initiates the attack. In addition, by regularly updating sample resource data and models, the accuracy and generalization ability of the model are ensured to adapt to new attack methods. Finally, by calculating the system security index and quantifying the security status of the system, it helps the administrator to take protective measures in time, and can identify and respond to complex network attacks in real time and accurately, improve the system's protection capabilities and response speed, and ensure the normal operation of key services.

[0076] Embodiment 3

[0077] Figure 3 This is a schematic diagram of the structure of a system service security detection device provided by Embodiment 3 of the present invention. Figure 3 As shown, the device includes: a node resource monitoring module 310, a service attack identification module 320, a target node determination module 330, and a system security determination module 340.

[0078] The node resource monitoring module 310 is used to obtain the resource occupancy data of the target system by the network nodes connected to the target system at multiple times, and determine the resource change data according to the resource occupancy data at multiple times; the service attack identification module 320 is used to determine the service attack status corresponding to the target system through the resource change data and the target service identification model, wherein the service attack status is used to characterize whether the target system is attacked by the target service rejected by the target system; the target node determination module 330 is used to determine the target network node that initiates the target service among the multiple network nodes when the target system is attacked by the target service rejected by the target system; the system security determination module 340 is used to determine the number of initiations of the target service by each target node and the number of nodes of the target network node, and determine the system security index of the target system according to the number of nodes and the number of initiations.

[0079] The technical solution of the embodiment of the present invention is as follows: first, the resource occupancy data of the network nodes connected to the target system at multiple moments is obtained through the node resource monitoring module 310, and the resource change data is determined according to the resource occupancy data at multiple moments, so that the resource usage change can be detected in real time and abnormal behavior can be discovered in time; then, the service attack status corresponding to the target system is determined through the service attack identification module 320 according to the resource change data and the target service identification model. Since the service attack status is used to characterize whether the target system is attacked by the target service rejected by the target system, it can be accurately determined whether the target system is attacked; then, the target node determination module determines whether the target system is attacked by the target service rejected by the target system. In the case of an attack on a target service that is rejected by the system, the target network node that initiates the target service among the multiple network nodes is determined, so that the source of the attack can be quickly located and the network node that initiates the attack can be accurately identified; finally, the number of times each of the target nodes initiates the target service and the number of the target network nodes are determined through the system security determination module 340, and the system security index of the target system is determined according to the number of nodes and the number of initiations, so that the system security status can be quantified, which solves the problem that it is difficult to locate complex and changeable attack sources in related technologies and can only provide single-point protection. It can not only detect and locate the attack source in a timely manner, but also dynamically evaluate the security status of the system, improve the system's protection capability and response speed, and effectively respond to complex and changeable network attacks.

[0080] Based on the above solution, optionally, the service attack identification module includes: a service attack status acquisition submodule.

[0081] Among them, the service attack status acquisition submodule is used to determine the abnormal change data in the resource change data, and input the abnormal change data into the target service identification model to obtain the service attack status corresponding to the target system, wherein the target service identification model is obtained by training a deep learning model based on sample resource data and the service attack status corresponding to the sample resource data.

[0082] On the basis of the above solution, optionally, the service attack identification module further includes: a sample resource data acquisition submodule and a target service identification model acquisition submodule.

[0083] Among them, the sample resource data acquisition submodule is used to acquire sample resource data of a sample system of the same type as the target system, wherein the sample resource data is change data of resources occupied by the sample system when a sample node connected to the sample system initiates a service rejected by the sample system, and change data of resources occupied by the sample system when the sample node initiates a normal service; the target service identification model acquisition submodule is used to determine the service attack status corresponding to the sample resource data, and train the deep learning model according to the sample resource data and the service attack status corresponding to the sample resource data to obtain the target service identification model.

[0084] Based on the above solution, optionally, the service attack identification module further includes: a target service identification model updating submodule.

[0085] The target service identification model updating submodule is used to update the sample resource data after the target service identification model is obtained, and to update the target service identification model according to the updated sample resource data.

[0086] Based on the above solution, optionally, determining the abnormal change data in the resource change data includes: if the resource change data satisfies a preset abnormality detection condition, determining the resource change data as abnormal change data, wherein the abnormality detection condition is:

[0087]

[0088] Where D t+1 represents the resource occupancy data of the target system by the network node at time t+1, D t represents the resource occupancy data of the target system by the network node at time t, D t ≠0, μ represents the error coefficient of resource data, and θ represents a preset constant.

[0089] Based on the above solution, optionally, the system service security detection device further includes:

[0090] System resource reduction module.

[0091] Among them, the system resource allocation reduction module is used to intercept the target service after determining the target network node that initiates the target service among the multiple network nodes, and reduce the system resources allocated to the target network node according to the number of times the target network node initiates the target service.

[0092] On the basis of the above solution, optionally, the system service security detection device further includes: determining the system security index of the target system according to the number of nodes and the number of initiations based on the following formula:

[0093]

[0094] Where F represents the system security index of the target system, M represents the number of nodes in the target network, and γ n represents the weight coefficient of the nth network node, N represents the total number of network nodes connected to the target system, 1≤n≤N, n is a positive integer, A n Indicates the number of times the nth target network node initiates the target service.

[0095] The system service security detection device provided in the embodiment of the present invention can execute the system service security detection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0096] Embodiment 4

[0097] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0098] like Figure 4As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0099] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0100] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a system service security detection method.

[0101] In some embodiments, a system service security detection method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the system service security detection method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform a system service security detection method in any other appropriate manner (e.g., by means of firmware).

[0102] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0103] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0104] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0105] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0106] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0107] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0108] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0109] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A system service security detection method, characterized in that: include: Acquire resource occupancy data of the target system by network nodes connected to the target system at multiple times, and determine resource change data according to the resource occupancy data at multiple times; Determining a service attack state corresponding to the target system through the resource change data and the target service identification model, wherein the service attack state is used to characterize whether the target system is attacked by a target service rejected by the target system; In the case where the target system is attacked by a target service rejected by the target system, determining a target network node among the plurality of network nodes that initiates the target service; The number of times each of the target network nodes initiates the target service and the number of the target network nodes are determined, and a system security index of the target system is determined according to the number of nodes and the number of initiations.

2. The method according to claim 1, characterized in that The determining the service attack status corresponding to the target system by using the resource change data and the target service identification model includes: Determine abnormal change data in the resource change data, and input the abnormal change data into a target service identification model to obtain a service attack status corresponding to the target system, wherein the target service identification model is obtained by training a deep learning model based on sample resource data and the service attack status corresponding to the sample resource data.

3. The method according to claim 2, characterized in that Before inputting the abnormal change data into the target service identification model, the method further includes: Acquire sample resource data of a sample system of the same type as the target system, wherein the sample resource data is change data of resources occupied by the sample system when a sample node connected to the sample system initiates a service rejected by the sample system, and change data of resources occupied by the sample system when the sample node initiates a normal service; Determine a service attack status corresponding to the sample resource data, and train a deep learning model according to the sample resource data and the service attack status corresponding to the sample resource data to obtain a target service identification model.

4. The method according to claim 3, characterized in that After obtaining the target service identification model, the method further includes: The sample resource data is updated, and the target service identification model is updated according to the updated sample resource data.

5. The method according to claim 2, characterized in that: The determining of abnormal change data in the resource change data includes: In the case where the resource change data meets a preset abnormality detection condition, the resource change data is determined as abnormal change data, wherein the abnormality detection condition is: Where D t+1 represents the resource occupancy data of the target system by the network node at time t+1, D t represents the resource occupancy data of the target system by the network node at time t, D t ≠0, μ represents the error coefficient of resource data, and θ represents a preset constant.

6. The method according to claim 1, characterized in that After determining a target network node among the plurality of network nodes for initiating the target service, the method further includes: The target service is intercepted, and system resources allocated to the target network node are reduced according to the number of times the target network node initiates the target service.

7. The method according to claim 1, characterized in that The system security index of the target system is determined according to the number of nodes and the number of initiations based on the following formula: Where F represents the system security index of the target system, M represents the number of nodes in the target network, and γ n represents the weight coefficient of the nth network node, N represents the total number of network nodes connected to the target system, 1≤n≤N, n is a positive integer, A n Indicates the number of times the nth target network node initiates the target service.

8. A system service security detection device, characterized in that: include: A node resource monitoring module, used to obtain resource occupancy data of a network node connected to a target system at multiple times for the target system, and determine resource change data based on the resource occupancy data at multiple times; A service attack identification module, used to determine the service attack status corresponding to the target system through the resource change data and the target service identification model, wherein the service attack status is used to characterize whether the target system is attacked by a target service rejected by the target system; a target node determination module, configured to determine a target network node among the plurality of network nodes that initiates the target service when the target system is attacked by a target service rejected by the target system; The system security determination module is used to determine the number of times each target node initiates the target service and the number of target network nodes, and determine the system security index of the target system according to the number of nodes and the number of initiations.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the system service security detection method described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the system service security detection method according to any one of claims 1 to 7 when executed.

Images