Method, device and electronic device for identifying scanner

Abstract

The present invention provides a method, device and electronic device for identifying a scanner, and relates to the field of network security technology. The method includes: obtaining the target data packets of the two communicating parties; obtaining the values ​​of each initial variable by accumulation according to the correspondence between the predetermined characteristics and the initial variables, and the characteristics of the target data packets; determining the value of the risk variable based on the correspondence between the predetermined initial variables and the risk variables, and the values ​​of each of the initial variables; identifying the scanners in the first communication terminal and the second communication terminal based on the values ​​of the risk variables. The above method solves the technical problem that the prior art cannot identify the scanner in real time and accurately, and achieves the technical effect of reducing the computational complexity and resource consumption, improving the efficiency and accuracy of identifying the scanner, and reducing the risk of the system being attacked by the network.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, device and electronic equipment for identifying a scanner. Background Art

[0002] The early stage of a cyberattack, the reconnaissance stage, is a critical period for attackers to collect information about their targets. The success or failure of this stage directly affects the effectiveness of subsequent attacks.

[0003] System scanning is an important part of the reconnaissance phase, and its purpose is to discover weaknesses in the target system to facilitate subsequent attack activities. System scanning can check the open ports in the system, identify potential intrusion points and unauthorized services, and then help attackers identify known vulnerabilities in the system, such as software defects, configuration errors, or insecure default settings. At the same time, it can discover the network topology map, identify all connected devices and systems, understand the network structure and discover potential security risks. In addition, system scanning can also monitor system performance and identify performance issues that may affect system stability and security.

[0004] It can be seen that once the scanning action is successfully blocked, subsequent attacks will become groundless. Therefore, developing a method that can detect system scanning behavior in real time and accurately is crucial to preventing network attacks. Summary of the invention

[0005] The object of the present invention is to provide a method, device, electronic device and storage medium for identifying a scanner, so as to alleviate the technical problem existing in the prior art that the scanner cannot be identified in real time and accurately.

[0006] In the first aspect, an embodiment of the present invention provides a method for identifying a scanner. The two communicating parties include a first communication terminal and a second communication terminal, and the method includes: obtaining target data packets of the two communicating parties; obtaining the values ​​of each initial variable by accumulating according to the correspondence between predetermined features and initial variables, and the features of the target data packet, wherein the features include flow features, protocol features, and attribute features, and one or more of the flow features, protocol features, and attribute features corresponding to each two different initial variables are different; determining the value of the risk variable based on the correspondence between the predetermined initial variables and the risk variables, and the values ​​of each of the initial variables; and identifying the scanner in the first communication terminal and the second communication terminal based on the value of the risk variable.

[0007] In some possible implementations, the method of obtaining the target data packets of the communicating parties includes: determining a current data packet among the data packets of the communicating parties; determining whether a protocol feature of the current data packet belongs to a sensitive protocol; if so, retaining the current data packet as an initial data packet, otherwise discarding the current data packet; determining the current session round group to which the initial data packet belongs; determining a target number of data packets that need to be retained in the current session round group according to a preset rule; when the initial data packet belongs to the first target number of data packets in the current session round group, retaining the initial data packet as a target data packet, otherwise discarding the initial data packet.

[0008] In some possible implementations, the initial variables include accumulated variables and discrete variables; the accumulated variables include first-class accumulated variables and second-class accumulated variables, the first-class accumulated variables are variables when the first communication terminal is the requester, and the second-class accumulated variables are variables when the second communication terminal is the requester; the discrete variables include first-class discrete variables and second-class discrete variables, the first-class discrete variables are variables when the first communication terminal is the sender, and the second-class discrete variables are variables when the second communication terminal is the sender; the correspondence between the predetermined features and the initial variables includes a first table, a second table, a third table, and a fourth table; the first-class accumulated variables correspond to the first table; the second-class accumulated variables correspond to the second table; the first-class discrete variables correspond to the third table; the second-class discrete variables correspond to the fourth table; the first table includes multiple first-class accumulated variable entries, each of the accumulated variable entries includes a variable identifier, a feature, and The correspondence between the values ​​of the initial variables; the second table includes a plurality of second-category cumulative variable entries, each of which includes the correspondence between the variable identifier, the feature and the value of the initial variable; the third table includes a plurality of first-category discrete variable entries, each of which includes the correspondence between the variable identifier, the feature, the discrete method identifier and the value of the initial variable; the fourth table includes a plurality of second-category discrete variable entries, each of which includes the correspondence between the variable identifier, the feature, the discrete method identifier and the value of the initial variable; wherein, when the values ​​of the initial variables are obtained by accumulation according to the correspondence between the predetermined features and the initial variables and the features of the target data packet, after the feature match with the first table or the second table is successful, the variable value of the corresponding table item is directly accumulated; when the feature match with the third table or the fourth table is successful, the variable value of the corresponding table item is updated according to the discrete method corresponding to the table item.

[0009] In some possible implementations, the discrete variable calculates the variable value according to the lifetime and the destination port number of the target data packet, and the discrete method is used to perform dimensionality reduction processing on the destination port number or the lifetime to obtain the value of the discrete variable.

[0010] In some possible implementations, the types of destination port numbers are determined by counting, and the types are used as discrete totals; based on the discrete totals, discrete percentages are determined as values ​​of discrete variables.

[0011] In some possible implementations, the survival time is divided into intervals according to a pre-set sub-interval division rule to generate corresponding sub-intervals; the sub-intervals are subjected to displacement transformation, and the value of the discrete variable is obtained by calculating the discreteness of the displacement.

[0012] In some possible implementations, the risk variables include first-category risk variables and second-category risk variables, the first-category risk variables are variables when the first communication end is the requesting party, and the second-category risk variables are variables when the second communication end is the requesting party; the correspondence between the predetermined initial variables and the risk variables includes a fifth table and a sixth table; the first-category risk variables correspond to the fifth table; the second-category risk variables correspond to the sixth table; the fifth table includes multiple first-category risk variable entries, each of the risk variable entries includes a variable identifier, a mapping relationship with the initial variable, and a correspondence relationship between the value of the risk variable; the sixth table includes multiple second-category risk variable entries, each of the risk variable entries includes a variable identifier, a mapping relationship with the initial variable, and a correspondence relationship between the value of the risk variable.

[0013] In some possible implementations, identifying the scanners in the first communication terminal and the second communication terminal based on the value of the risk variable includes: determining the value of the probability variable based on the value of the risk variable and a predetermined correspondence between the value of the risk variable and the probability variable; judging whether the first communication terminal and the second communication terminal are scanners based on a predetermined risk probability threshold and the value of the probability variable; wherein the predetermined correspondence between the value of the probability variable and the probability variable includes a seventh table; the seventh table includes multiple probability variable entries, each of the probability variables including a variable identifier, a mapping relationship with the value of the risk variable, and a correspondence between the value of the probability variable.

[0014] In the second aspect, a device for identifying a scanner is provided. The two communicating parties include a first communication terminal and a second communication terminal, and the device includes: an acquisition module for acquiring target data packets of the two communicating parties; a first calculation module for obtaining the values ​​of each initial variable by accumulation according to the correspondence between predetermined features and initial variables and the features of the target data packet, wherein the features include flow features, protocol features and attribute features, and one or more of the flow features, protocol features and attribute features corresponding to each two different initial variables are different; a second calculation module for determining the value of the risk variable based on the correspondence between the predetermined initial variables and the risk variables and the values ​​of each of the initial variables; and an identification module for identifying the scanner in the first communication terminal and the second communication terminal based on the value of the risk variable.

[0015] In a third aspect, an embodiment of the present invention provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program executable on the processor, and when the processor executes the computer program, the steps of any one of the methods described in the first aspect are implemented.

[0016] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores machine-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions cause the processor to execute any method described in the first aspect above.

[0017] The present invention provides a method, device and electronic device for identifying a scanner, the method comprising: obtaining target data packets of the two communicating parties; obtaining the values ​​of each initial variable by accumulating according to the correspondence between predetermined features and initial variables, and the features of the target data packets, the features comprising flow features, protocol features and attribute features, one or more of the flow features, protocol features and attribute features corresponding to each two different initial variables are different; determining the value of the risk variable based on the correspondence between the predetermined initial variables and the risk variables, and the values ​​of each of the initial variables; identifying the scanners in the first communication terminal and the second communication terminal based on the value of the risk variable. The above method solves the technical problem that the prior art cannot identify the scanner in real time and accurately, improves the efficiency and accuracy of identifying the scanner, and reduces the risk of the system being attacked by the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 A schematic flow chart of a method for identifying a scanner provided by an embodiment of the present invention;

[0020] Figure 2 An example of a method for calculating the dispersion of the number of remaining hops of a data packet provided by an embodiment of the present invention;

[0021] Figure 3 This is an example of a communication process between two communicating parties in an embodiment of the present invention;

[0022] Figure 4 This is an example of filtering data packets in an embodiment of the present invention;

[0023] Figure 5 This is an example of the cumulative variable calculation process in an embodiment of the present invention;

[0024] Figure 6 This is an example of a discrete variable calculation process in an embodiment of the present invention;

[0025] Figure 7 This is an example of the calculation method of method α and method β in the embodiment of the present invention;

[0026] Figure 8 This is an example of a method for calculating γ in an embodiment of the present invention;

[0027] Fig. 9 This is an example of a probability variable calculation process in an embodiment of the present invention;

[0028] Fig.10 An example of a determination scanner in an embodiment of the present invention;

[0029] Fig.11 Another example of a determination scanner in an embodiment of the present invention;

[0030] Fig.12 It is an example of large and small cycles in the embodiment of the present invention;

[0031] Fig.13 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0033] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0034] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings. Some embodiments of the present invention are described in detail below in conjunction with the drawings. The following embodiments and features in the embodiments can be combined with each other without conflict.

[0035] A network attack refers to the act of attacking a system and resources by exploiting the vulnerabilities and security flaws in a network information system. It usually consists of several subtasks with specific goals, such as reconnaissance, weaponization, delivery, utilization, installation, command, control, and implementation. In reality, programs that perform various reconnaissance tasks are collectively referred to as scanners. Depending on the scanned object, the functions of scanners can be further divided into system scanning, WEB scanning, database scanning, etc. Among them, system scanning can check the open ports in the system, identify potential intrusion points and unauthorized services, and then help attackers identify known vulnerabilities in the system, such as software defects, configuration errors, or insecure default settings. At the same time, it can discover the network topology map, identify all connected devices and systems, understand the network structure, and discover potential security risks. In addition, system scanning can also monitor system performance and identify performance issues that may affect system stability and security. It can be seen that once the scanning action is successfully blocked, subsequent attacks will become groundless. Therefore, an effective real-time and accurate detection method is needed to identify the scanner, thereby reducing the risk of the system being attacked by the network. In other words, the existing technology has the technical problem of being unable to identify the scanner in real time and accurately.

[0036] Based on this, the embodiments of the present invention provide a method, device and electronic device for identifying a scanner to solve the technical problem in the prior art that the scanner cannot be identified in real time and accurately.

[0037] To facilitate understanding of this embodiment, a method for identifying a scanner disclosed in an embodiment of the present invention is first described in detail. The method can be applied to a network security device, or to a first communication terminal or a second communication terminal. For example, the network security device can be Figure 1 The method shown identifies whether there is a scanner in the first communication end or the second communication end. The first communication end may identify whether the second communication end is a scanner, or the second communication end may identify whether the first communication end is a scanner.

[0038] Among them, the network security device can obtain network traffic of one or more groups of communicating parties, the communicating parties include a first communication end and a second communication end, or the network device can disguise itself as the first communication end or the second communication end to communicate with the second communication end or the first communication end; in other words, the network security device can be the first communication end or the second communication end, or it can be a network security device located between the first communication end and the second communication end.

[0039] In the embodiments of the present application, the scanner can be a network security device or a communication device used by some bad actors for malicious purposes. For example, the scanner can be used for regular internal security assessments. The scanner can be disguised as an ordinary communication device to avoid arousing suspicion or being blocked by firewalls and other security measures.

[0040] See also Figure 1 The flowchart of a method for identifying a scanner is shown in FIG. 1 , and the method mainly includes the following steps S110 to S130:

[0041] S110: Obtain target data packets of both communicating parties;

[0042] In some embodiments, the data packets may be filtered first, and then cumulative calculations may be performed based on the filtered data packets to further reduce the amount of calculations. For example, the current data packets of the communicating parties may be filtered based on the following steps to obtain the target data packets:

[0043] Step A), determining the current data packet in the data packets of both communicating parties;

[0044] Step B), determining whether the protocol feature of the current data packet belongs to a sensitive protocol; if it does, retaining the current data packet as the initial data packet, otherwise discarding the current data packet;

[0045] Step C), determining the current session round group to which the initial data packet belongs;

[0046] Step D) determines the target number of data packets to be retained in the current session round grouping according to a preset rule; when the initial data packet belongs to the first target number of data packets in the current session round grouping, retains the initial data packet as the target data packet, otherwise discards the initial data packet.

[0047] As an example, the network security device can collect data packets between the communicating parties in advance, divide the data packets into first-class data packets flowing from the first communication end to the second communication end, and second-class data packets flowing from the second communication end to the first communication end, and determine an ordered data packet set of the first-class data packets and an ordered data packet set of the second-class data packets.

[0048] In order to further reduce the amount of data and reduce the computational complexity, the data packets can be filtered according to the protocol characteristics of the data packets, and the data packets corresponding to the sensitive protocols are retained as the initial data packets. The sensitive protocols here are generally the common protocols used by the scanner to send data packets; the sensitive protocols may include: ICMP, TCP, UDP protocols. The data packets of the communicating parties that do not belong to the sensitive protocols can be directly discarded.

[0049] In some embodiments, the initial data packet with TCP protocol may be secondary filtered according to the data packet identifier, and the first data packet in each round of TCP session may be retained according to the filtering rules, or the first data packet and the second data packet in each round of TCP session may be retained.

[0050] As an example, continue to refer to Figure 3 and Figure 4 . Figure 3 Schematic diagram of a data packet set of two communicating parties in an embodiment of the present invention (the data packet with black text on a gray background will be retained). Figure 4 This is a schematic diagram of retaining TCP data packets in different situations in units of sessions in an embodiment of the present invention (each number represents a session, and data packets with black text on a gray background will be retained). The method includes:

[0051] Collecting data packets of both communicating parties, defining ordered data packet sets flowing from the first communication end to the second communication end and from the second communication end to the first communication end as first-category data packets and second-category data packets, respectively;

[0052] The first filtering is performed on the data packets in the first category and the data packets in the second category respectively in the following manner: the data packets whose top layer protocols are ICMP, TCP, and UDP are retained; and the retained TCP data packets are grouped according to the number of session rounds.

[0053] Next, perform a second filtering according to the following rules to obtain the target data packet:

[0054] When one of the following two conditions is met, the first and second initial data packets in each round of TCP session are retained as target data packets:

[0055] Condition 1: The first initial data packet flags (packet identifier) ​​is [SYN] and the second initial data packet flags is [SYN, ACK] or [RESET, ACK];

[0056] Condition 2: The flags of the first initial data packet is not [SYN] and the flags of the second initial data packet is [RESET];

[0057] When one of the following two conditions is met, the first initial data packet in each round of TCP session is retained as the target data packet:

[0058] Condition 3: The flags of the first initial data packet is [SYN] and the flags of the second initial data packet are not [SYN, ACK] and [RESET, ACK];

[0059] Condition 4: The flags of the first initial data packet is not [SYN] and the flags of the second initial data packet is not [RESET].

[0060] S120: According to the correspondence between the predetermined features and the initial variables, and the features of the target data packet, the values ​​of the initial variables are obtained by accumulation.

[0061] The features here include flow direction features, protocol features and attribute features, and one or more of the flow direction features, protocol features and attribute features corresponding to each two different initial variables are different.

[0062] In some embodiments, the initial variables may include cumulative variables as well as discrete variables.

[0063] The accumulated variables here may include first-type accumulated variables and second-type accumulated variables, wherein the first-type accumulated variables are variables when the first communication terminal is the requesting party, and the second-type accumulated variables are variables when the second communication terminal is the requesting party.

[0064] The discrete variables here may include first-class discrete variables and second-class discrete variables, wherein the first-class discrete variables are variables when the first communication terminal is the sender, and the second-class discrete variables are variables when the second communication terminal is the sender.

[0065] The correspondence between the predetermined features and the initial variables may include a first table, a second table, a third table, and a fourth table;

[0066] The first type of accumulated variable corresponds to the first table; the first table includes multiple first type accumulated variable entries, and each accumulated variable entry includes a corresponding relationship between a variable identifier, a feature, and a value of an initial variable.

[0067] The second type of accumulated variables corresponds to the second table; the second table includes multiple second type accumulated variable entries, each accumulated variable entry includes a corresponding relationship between a variable identifier, a feature, and a value of an initial variable.

[0068] The first type of discrete variables corresponds to the third table; the third table includes multiple first type discrete variable entries, each discrete variable entry includes a corresponding relationship between a variable identifier, a feature, a discrete method identifier, and a value of an initial variable.

[0069] The second type of discrete variables corresponds to the fourth table; the fourth table includes multiple second type discrete variable entries, each discrete variable entry includes a corresponding relationship between a variable identifier, a feature, a discrete method identifier, and a value of an initial variable.

[0070] For the above step S120, when the value of each initial variable is obtained by accumulation according to the correspondence between the predetermined features and the initial variables, as well as the features of the target data packet, after a successful match with the features in the first table or the second table, the variable value of the corresponding table item is directly accumulated; when a successful match with the features in the third table or the fourth table, the variable value of the corresponding table item is updated according to the discrete method corresponding to the table item.

[0071] As an example, parts of the first and second tables may be as follows:

[0072]

[0073]

[0074] As shown in the first and second tables above, the characteristics of the target data packet include a triplet characteristic, which includes a flow direction characteristic, a protocol characteristic, and an attribute characteristic of the data packet; wherein the flow direction characteristic of the data packet may include flowing from A (the first communication end) to B (the second communication end), which is expressed as: ; Flowing from B to A, expressed as: ; Protocol characteristics may include ICMP, TCP; Attribute characteristics may include the values ​​of the following fields: type, code, flags and corresponding settings.

[0075] As a specific example, the target data packets are checked one by one in order, and the triplet values ​​of each entry in the first table and the second table are matched with the target data packets, and the number of matched data packets is respectively accumulated to the value of the corresponding entry (the initial value is 0, and 1 is added each time);

[0076] Continue to refer Figure 5 , you can apply triples to match specific data packets and then accumulate them into corresponding variables (the white-gray data packets correspond to the triples and variables in the first and second tables respectively). This can be achieved through the following steps: check the retained target data packets one by one in order, match them according to the triples listed in the first and second tables, and accumulate the successfully matched data packets into the values ​​of the corresponding accumulated variables (the initial value is 0, and 1 is added each time).

[0077] As another example, parts of the third and fourth tables may look like this:

[0078]

[0079]

[0080] The discrete variable calculates the variable value according to the lifetime and the destination port number of the target data packet. The discrete method is used to perform dimensionality reduction processing on the destination port number or the lifetime to obtain the value of the discrete variable.

[0081] As an example, the types of destination port numbers may be determined by counting, and the types may be used as discrete totals; based on the discrete totals, discrete percentages may be determined as values ​​of discrete variables.

[0082] As another example, the survival time may be divided into intervals according to a pre-set sub-interval division rule to generate corresponding sub-intervals; the sub-intervals are subjected to displacement transformation, and the value of the discrete variable is obtained by calculating the discreteness of the displacement.

[0083] As shown in the third and fourth tables above, the characteristics of the target data packet include a two-tuple characteristic, and the two-tuple characteristic includes a flow direction characteristic and a protocol characteristic of the data packet; wherein the flow direction characteristic of the data packet may include flowing from A (the first communication end) to B (the second communication end), which is expressed as: ; Flowing from B to A, expressed as: ; Protocol features may include TCP and UDP. Check the target data packets one by one in order, and match them according to the binary tuples of the entries in the third table and the fourth table; obtain the TTL and destination port number of the successfully matched data packets; based on the TTL and the destination port number, calculate the discreteness of different discrete variables of the lifetime and the destination port number according to the method α, method β or method γ shown in the third table and the fourth table above, and store them in the corresponding variables respectively.

[0084] Continue to refer Figure 6 According to method α, method β and method γ, based on the values ​​of the accumulated variables in the first table and the second table, the discreteness can be calculated to determine the value of the discrete variable.

[0085] Specifically, the remaining target data packets can be checked one by one in sequence, matched according to the binary tuples listed in the third table and the fourth table, the successfully matched TTL and destination port numbers are extracted, and the values of the discrete variables can be calculated respectively according to the aforementioned method α, method β, and method γ.

[0086] In some embodiments, continue to refer to Figure 7 , Figure 7 shows the flowcharts of method α and method β (in this example, var_01 = 8, a total of 11 ports are processed, and the operations with updates are in gray background).

[0087] The specific calculation method α includes the following steps:

[0088] Initialize var_01 (default equal to variable N) bits to 0 (denoted as var_02); set 2 variables var_03 and var_04 (both with initial values of 0); where var_01 is the length of the bit string recording the discrete situation of TCP data packet ports; var_02 is a fixed-length (var_01) bit string recording the discrete situation of TCP data packet ports; var_03 is the number of TCP data packet ports that have taken remainders (been discretized); var_04 is the type of TCP data packet ports that have taken remainders (been discretized); N is related to the small cycle.

[0089] Among them, there are the following two measurement methods for the small cycle: successfully matching N (default value 16) data packets; reaching a certain predetermined time period P (default value 0.05 seconds); P is the duration of the detection small cycle.

[0090] Within each small cycle, divide each destination port number by the above variable var_01 in sequence and take the remainder var_09, then: if the bit at the index number of the above remainder var_09 in the above var_02 is 0, flip the bit to 1 and increment the above var_04 by 1. Increment the above var_03 by 1, and if var_03 = var_01 at this time: reset all bits in the above var_02 to 0; reset the above var_03 to 0; decrement the above var_04 by 1.

[0091] If it is found that var_03 < var_01 after traversing the last destination port number according to the above steps, decrement the above var_04 by 1;

[0092] According to the protocol and flow direction of the above destination port, assign the above var_04 to the corresponding variables numbered between 01 - 02 in the third table and the fourth table.

[0093] In some embodiments, the calculation method β specifically includes the following steps: divide the variables numbered between 01-02 in the third table and the fourth table by the above var_01 respectively: assign the above results to the corresponding variables numbered between 03-04 with the same flow direction and protocol.

[0094] In some embodiments, continue to refer to Figure 8 , Figure 8 The flowchart of method γ is shown (in this example, var_05 = 4, [var_e_01, var_e_02] = [32, 63], var_e_05 = 4, a total of 14 TTLs are processed, and the gray background indicates an update operation). The calculation method γ may specifically include the following steps:

[0095] Set the variable var_e_05 (default value 4) and the interval [var_e_01, var_e_02] (default value [32,63]). The constraints on var_e_01 and var_e_02 are:

[0096]

[0097] Among them, var_e_01 is the minimum value that the remaining hop count of TCP and UDP data packets must meet when performing the remainder operation; var_e_02 is the maximum value that the remaining hop count of TCP and UDP data packets must meet when performing the remainder operation; var_e_05 is a parameter used to calculate the high and low sub-intervals of the remaining hop count of several TCP and UDP data packets. ;var_e_01 and var_e_02 are integers; .

[0098] In each small cycle, traverse each TTL in order, retain the first TTL1 in the above interval [var_e_01, var_e_02], and divide it from the above interval [var_e_01, var_e_02] according to TTL1. as the central sub-interval.

[0099] Specifically: if , then adjust the above central subinterval to ;like , then adjust the above central subinterval to ;

[0100] According to the above central sub-interval, several high and low sub-intervals are divided to both sides:

[0101] ;

[0102] The general formula for dividing the high and low sub-intervals is:

[0103]

[0104] The following processing is performed on all the high and low sub-intervals divided above (by default, the intervals divided under various TTL1 are shown in Figure 2 As shown): retain the high and low sub-intervals that intersect with the above interval [var_e_01, var_e_02]. Check the above retained highest and low sub-intervals: if the lower limit of the above lowest sub-interval is less than var_e_01, adjust the lower limit to var_e_01; if the upper limit of the above highest sub-interval is greater than var_e_02, adjust the upper limit to var_e_02.

[0105] Initialize var_05 bits to 0 (denoted as var_06), where var_05 is the number of subintervals divided according to TTL1 (i.e., in the default setting, var_05 can be equal to 4 or 5 by default depending on TTL1); set two variables var_07 and var_08 (both with initial values ​​of 0); var_06 is a fixed-length (var_05) bit string that records the discreteness of the remaining hops of TCP and UDP data packets; var_07 is the number of remaining hops of TCP and UDP data packets after taking the remainder (discrete); var_08 is the type of remaining hops of TCP and UDP data packets after taking the remainder (discrete).

[0106] In each small cycle, check in order which sub-interval (denoted as Z) each TTL (including TTL1) is located in according to the above TTL1 division. Then: if the Zth bit in the above var_06 is 0, flip the bit to 1 and add 1 to the above var_08. Add 1 to the above var_07. If var_07=var_05 at this time, then: reset all bits in the above var_06 to 0; reset the above var_07 to 0; and subtract 1 from the above var_08.

[0107] If you find that after traversing the last TTL according to the above steps , then reduce the above var_08 by 1;

[0108] According to the flow direction of the above TTL, the above var_08 is assigned to the corresponding variables numbered 05 in the third table and the fourth table respectively.

[0109] S130: Determine the value of the risk variable based on the predetermined correspondence between the initial variable and the risk variable, and the value of each initial variable.

[0110] In some embodiments, the risk variable includes a first type of risk variable and a second type of risk variable. The first type of risk variable is a variable when the first communication terminal is the requesting party; the second type of risk variable is a variable when the second communication terminal is the requesting party; the correspondence between the predetermined initial variable and the risk variable includes a fifth table and a sixth table; the first type of risk variable corresponds to the fifth table; the second type of risk variable corresponds to the sixth table; the fifth table includes a plurality of first type of risk variable entries, each of which includes a variable identifier, a mapping relationship with the initial variable, and a corresponding relationship between the value of the risk variable; the sixth table includes a plurality of second type of risk variable entries, each of which includes a variable identifier, a mapping relationship with the initial variable, and a corresponding relationship between the value of the risk variable.

[0111] As an example, parts of the fifth and sixth tables may be as follows:

[0112]

[0113]

[0114] The variables in the first and second tables and the third and fourth tables can be assigned to the risk variables in the fifth and sixth tables, respectively. The variables in the fifth and sixth tables constitute vectors var_e_03 and var_e_04, respectively. The variables in the same position in these two vectors must have the same number in the corresponding tables. Among them, var_e_03 is a risk vector composed of the risk values ​​of the data packets sent from A to B, and var_e_04 is a risk vector composed of the risk values ​​of the data packets sent from B to A.

[0115] S140: Identify scanners in the first communication end and the second communication end based on the value of the risk variable.

[0116] Among them, the value of the probability variable can be determined based on the value of the risk variable and the correspondence between the predetermined value of the risk variable and the probability variable; whether the first communication terminal and the second communication terminal are scanners can be judged based on a predetermined risk probability threshold and the value of the probability variable; wherein the correspondence between the predetermined value of the probability variable and the probability variable includes a seventh table; the seventh table includes multiple probability variable entries, each probability variable includes a variable identifier, a mapping relationship with the value of the risk variable, and a correspondence between the value of the probability variable.

[0117] For example, the seventh table may look like this:

[0118]

[0119] The values ​​of the probability variables in the seventh table can be obtained based on the values ​​in the fifth table and the sixth table and the corresponding calculation formulas.

[0120] Continue to refer Fig. 9 , Fig. 9 A flow chart of calculating risk variables, forming risk vectors, and calculating risk probabilities in an embodiment of the present invention is shown, which specifically includes: assigning variables in the first table (Table 1) and the third table (Table 3) and the second table (Table 2) and the fourth table (Table 4) to the fifth table (Table 5) and the sixth table (Table 6) to obtain values ​​of risk variables.

[0121] According to the variables in the fifth and sixth tables, two vectors var_e_03 and var_e_04 are constructed. The two vectors var_e_03 and var_e_04 are combined with the formula in the seventh table to calculate the values ​​of the three probability variables: var_71, var_72 and var_73.

[0122] Among them, based on the three probability variables in the seventh table and the two probability thresholds var_e_06 (default value 0.4, ) and var_e_07 (default 0.7, ), based on the following steps to identify the scanners in the first communication end and the second communication end, where var_e_07 is a threshold for determining whether the risk probability (bidirectional) of the communication data packet between AB is abnormal, and var_e_06 is a threshold for determining whether the port discreteness of the TCP and UDP data packets is abnormal:

[0123] Continue to refer Fig.10 , Fig.10 The flowchart of using var_71 to determine the scanner is shown. Using var_71:

[0124] like ; And, if at least one of var_33 and var_34 is greater than var_e_06, then A is determined to be a scanner;

[0125] like , and at least one of var_43 and var_44 is greater than var_e_06, then B is determined to be a scanner;

[0126] like , or if it is other situations that do not meet the above conditions, it is determined that neither A nor B is a scanner.

[0127] Continue to refer Fig.11 , Fig.11 The flowchart of using var_72 and var_73 to determine the scanner is shown. The smaller value of var_e_09 is used (if the two are equal, one is selected), where var_e_09 is the smaller one (one-way) of the risk probability (bidirectional) of the communication data packet between A (first communication end) and B (second communication end):

[0128] like var_e_09 = var_72; and at least one of var_33 and var_34 is greater than var_e_06, then A is determined to be a scanner;

[0129] like var_e_09 = var_73; and at least one of var_43 and var_44 is greater than var_e_06, then B is determined to be a scanner;

[0130] like , or if it is other situations that do not meet the above conditions, it is determined that neither A nor B is a scanner.

[0131] In some embodiments, continue to refer to Fig.12 The variables in the third to seventh tables will be recalculated after each small cycle. There are two measurement methods for the small cycle: successfully matching N (default value 16) data packets; reaching a certain predetermined time period P (default value 0.05 seconds).

[0132] The variables in the first and second tables are reset to 0 after each large cycle. The large cycle has the following two measurement methods: Successful matching (Default value 64) packets; reach a certain predetermined time period (Default value 0.2 seconds).

[0133] The accumulation operation of the variables in the first table and the second table will be executed continuously, and the parameter F is a positive integer (the default value is 4).

[0134] The embodiment of the present invention obtains the target data packets of the two communicating parties; obtains the values ​​of each initial variable by accumulation according to the correspondence between the predetermined features and the initial variables, and the features of the target data packets, wherein the features include flow features, protocol features, and attribute features, and one or more of the flow features, protocol features, and attribute features corresponding to each two different initial variables are different; determines the value of the risk variable based on the correspondence between the predetermined initial variables and the risk variables, and the values ​​of each of the initial variables; identifies the scanners in the first communication terminal and the second communication terminal based on the value of the risk variable. The above method solves the technical problem that the prior art cannot identify the scanner in real time and accurately, improves the efficiency and accuracy of identifying the scanner, and reduces the risk of the system being attacked by the network.

[0135] The embodiment of the present invention provides a method for identifying a scanner, which calculates a series of risk variables by counting the number of packets of a specific type and certain protocol attributes (such as TTL value, destination port number), then constructs two vectors based on these risk variables, and calculates three risk probability variables based on these two vectors, and finally determines whether the communication end providing the packet is a scanner by comparing these probability variables with preset thresholds, thereby identifying the scanner. The above method solves the technical problem that the prior art cannot identify the scanner in real time and accurately, and achieves the technical effect of improving the efficiency and accuracy of identifying the scanner and reducing the risk of the system being attacked by the network.

[0136] The method has a wide range of applications and can identify scanning behaviors based on TCP, UDP, and ICMP protocols; in terms of avoiding false positives, the method is able to distinguish between the behaviors of regular applications traversing ports on demand and scanners maliciously detecting ports; in terms of avoiding missed reports, the method is able to identify trickle scanning behaviors based on a single protocol and targeting only a single IP; in terms of identification efficiency, the method can complete the judgment within a window containing only a single-digit number of data packets to maximize the guarantee of zero leakage of vulnerability information. In summary, the method for identifying scanners provided by the embodiments of the present invention truly reduces the risk of network attacks on the system due to the detection of its own vulnerabilities.

[0137] In addition, an embodiment of the present invention further provides a device for identifying a scanner, wherein the communicating parties include a first communication terminal and a second communication terminal, and the device includes:

[0138] An acquisition module, used to acquire target data packets of the communicating parties;

[0139] A first calculation module is used to obtain the value of each initial variable by accumulating the correspondence between the predetermined characteristics and the initial variables and the characteristics of the target data packet, wherein the characteristics include flow characteristics, protocol characteristics and attribute characteristics, and one or more of the flow characteristics, protocol characteristics and attribute characteristics corresponding to each two different initial variables are different;

[0140] A second calculation module, configured to determine a risk value of a risk variable based on a predetermined correspondence between an initial variable and a risk variable, and a value of each of the initial variables;

[0141] An identification module is used to identify the scanners in the first communication end and the second communication end based on the value of the risk variable.

[0142] The device for identifying a scanner provided in the embodiment of the present application may be specific hardware on the device or software or firmware installed on the device, etc. The implementation principle and technical effects of the device provided in the embodiment of the present application are the same as those of the aforementioned method embodiment. For the sake of brief description, for matters not mentioned in the device embodiment, reference may be made to the corresponding contents in the aforementioned method embodiment. Technical personnel in the relevant field can clearly understand that, for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above can all refer to the corresponding processes in the aforementioned method embodiment, and will not be repeated here. The device for identifying a scanner provided in the embodiment of the present application has the same technical features as the method for identifying a scanner provided in the aforementioned embodiment, so it can also solve the same technical problems and achieve the same technical effects.

[0143] An embodiment of the present application further provides an electronic device. Specifically, the electronic device includes a processor and a storage device. The storage device stores a computer program, and when the computer program is executed by the processor, it executes the method described in any one of the above-mentioned embodiments.

[0144] Fig.13 A structural schematic diagram of an electronic device provided in an embodiment of the present application, the electronic device 400 includes: a processor 40, a memory 41, a bus 42 and a communication interface 43, wherein the processor 40, the communication interface 43 and the memory 41 are connected via the bus 42; the processor 40 is used to execute an executable module stored in the memory 41, such as a computer program.

[0145] The memory 41 may include a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk memory. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 43 (which may be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. may be used.

[0146] The bus 42 may be an ISA bus, a PCI bus, or an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.13 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0147] Among them, the memory 41 is used to store programs, and the processor 40 executes the program after receiving the execution instruction. The method executed by the process definition device disclosed in any embodiment of the above-mentioned embodiment of the present invention can be applied to the processor 40 or implemented by the processor 40.

[0148] The processor 40 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 40. The above processor 40 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in the embodiments of the present invention can be directly embodied as a hardware decoding processor to execute, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 41, and the processor 40 reads the information in the memory 41 and completes the steps of the above method in combination with its hardware.

[0149] Corresponding to the above method, an embodiment of the present application also provides a computer-readable storage medium, which stores machine-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions prompt the processor to execute the steps of the above method.

[0150] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0151] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0152] In addition, each functional unit in the embodiments provided in the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0153] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, electronic device, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., various media that can store program codes.

[0154] It should be noted that similar numbers and letters represent similar items in the accompanying drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. In addition, the terms "first", "second", "third", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0155] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for identifying a scanner, characterized in that: The communicating parties include a first communicating end and a second communicating end, and the method includes: Obtain target data packets of the communicating parties; According to the correspondence between the predetermined features and the initial variables, and the features of the target data packet, the values ​​of the initial variables are obtained by accumulation, wherein the features include flow features, protocol features, and attribute features, and one or more of the flow features, protocol features, and attribute features corresponding to each two different initial variables are different; Determining the value of the risk variable based on the predetermined correspondence between the initial variable and the risk variable, and the value of each of the initial variables; Scanners in the first peer and the second peer are identified based on the value of the risk variable.

2. The method according to claim 1, characterized in that The target data packets of the two communicating parties are obtained: Determine a current data packet among the data packets of the communicating parties; Determine whether the protocol feature of the current data packet belongs to a sensitive protocol; if yes, keep the current data packet as the initial data packet, otherwise discard the current data packet; Determine the current session round group to which the initial data packet belongs; The target number of data packets to be retained in the current session round grouping is determined according to a preset rule; when the initial data packet belongs to the first target number of data packets in the current session round grouping, the initial data packet is retained as the target data packet, otherwise the initial data packet is discarded.

3. The method according to claim 2, characterized in that The initial variables include accumulated variables and discrete variables; the accumulated variables include first-class accumulated variables and second-class accumulated variables, the first-class accumulated variables are variables when the first communication terminal is the requester, and the second-class accumulated variables are variables when the second communication terminal is the requester; the discrete variables include first-class discrete variables and second-class discrete variables, the first-class discrete variables are variables when the first communication terminal is the sender, and the second-class discrete variables are variables when the second communication terminal is the sender; the correspondence between the predetermined features and the initial variables includes a first table, a second table, a third table, and a fourth table; The first type of accumulated variables corresponds to the first table; The second type of accumulated variables corresponds to the second table; The first type of discrete variables corresponds to the third table; The second type of discrete variables corresponds to the fourth table; The first table includes a plurality of first-type accumulated variable entries, each of which includes a corresponding relationship between a variable identifier, a feature, and a value of an initial variable; The second table includes a plurality of second-type accumulated variable entries, each of which includes a corresponding relationship between a variable identifier, a feature, and a value of an initial variable; The third table includes a plurality of first-category discrete variable entries, each of which includes a corresponding relationship between a variable identifier, a feature, a discrete method identifier, and a value of an initial variable; The fourth table includes a plurality of second-category discrete variable entries, each of which includes a corresponding relationship between a variable identifier, a feature, a discrete method identifier, and a value of an initial variable; Among them, when the values ​​of each initial variable are obtained by accumulation according to the correspondence between the predetermined features and the initial variables, as well as the features of the target data packet, after a successful match with the features in the first table or the second table, the variable value of the corresponding table item is directly accumulated; when a successful match with the features in the third table or the fourth table, the variable value of the corresponding table item is updated according to the discrete method corresponding to the table item.

4. The method according to claim 3, characterized in that The discrete variable calculates the variable value according to the lifetime and the destination port number of the target data packet, and the discrete method is used to perform dimensionality reduction processing on the destination port number or the lifetime to obtain the value of the discrete variable.

5. The method according to claim 4, characterized in that The types of destination port numbers are determined by counting, and the types are used as discrete totals; based on the discrete totals, discrete percentages are determined as values ​​of discrete variables.

6. The method according to claim 4, characterized in that According to the pre-set sub-interval division rule, the survival time is divided into intervals to generate corresponding sub-intervals; the sub-intervals are shifted and the value of the discrete variable is obtained by calculating the discreteness of the shift.

7. The method according to claim 3, characterized in that The risk variables include first-class risk variables and second-class risk variables, the first-class risk variables are variables when the first communication terminal is the requesting party, and the second-class risk variables are variables when the second communication terminal is the requesting party; the correspondence between the predetermined initial variables and the risk variables includes a fifth table and a sixth table; The first type of risk variables corresponds to the fifth table; The second type of risk variables corresponds to the sixth table; The fifth table includes a plurality of first-category risk variable entries, each of which includes a variable identifier, a mapping relationship with an initial variable, and a corresponding relationship between a value of the risk variable; The sixth table includes a plurality of second-category risk variable entries, each of which includes a variable identifier, a mapping relationship with an initial variable, and a corresponding relationship between a value of the risk variable.

8. The method according to claim 7, characterized in that Identifying scanners in the first communication end and the second communication end based on the value of the risk variable includes: Determining the value of the probability variable based on the value of the risk variable and the predetermined correspondence between the value of the risk variable and the probability variable; Determining whether the first communication end and the second communication end are scanners based on a predetermined risk probability threshold and a value of the probability variable; Wherein, the correspondence between the predetermined values ​​of the probability variables and the probability variables comprises a seventh table; The seventh table includes a plurality of probability variable entries, each of which includes a variable identifier, a mapping relationship with a value of a risk variable, and a corresponding relationship between the values ​​of the probability variable.

9. A device for identifying a scanner, characterized in that: The communicating parties include a first communication terminal and a second communication terminal, and the device includes: An acquisition module, used to acquire target data packets of the communicating parties; A first calculation module is used to obtain the value of each initial variable by accumulating the correspondence between the predetermined characteristics and the initial variables and the characteristics of the target data packet, wherein the characteristics include flow characteristics, protocol characteristics and attribute characteristics, and one or more of the flow characteristics, protocol characteristics and attribute characteristics corresponding to each two different initial variables are different; A second calculation module, configured to determine the value of the risk variable based on a predetermined correspondence between the initial variable and the risk variable, and the value of each of the initial variables; An identification module is used to identify the scanners in the first communication end and the second communication end based on the value of the risk variable.

10. An electronic device comprising a memory and a processor, wherein the memory stores a computer program that can be run on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 8 are implemented.

Images