Network anomaly detection method and computer equipment based on network security attack and defense

Abstract

Embodiments of the present application relate to the field of network anomaly detection, and specifically to a network anomaly detection method and computer equipment based on network security attack and defense. A specific implementation of the method includes: for each device network information in the device network information set, executing the following processing steps: determining multiple device network information groups including the device network information in multiple device network information group sets; determining the information anomaly score corresponding to the device network information in the device network information group; performing score fusion on each of the multiple information anomaly scores obtained to generate a corresponding network information anomaly score; generating device network anomaly information based on the network information anomaly score. Based on each device network anomaly information, network security attack and defense detection operations are performed on each network device in the network device cluster. This implementation improves the efficiency of network device detection and facilitates attack and defense detection of the device.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network anomaly detection, and specifically to a network anomaly detection method and computer equipment based on network security attack and defense. Background Art

[0002] At present, in the field of network security attack and defense, network intrusions are becoming increasingly rampant. Therefore, it is very important to accurately identify whether a device has been invaded by a network. For the detection of devices with abnormal network behavior, the usual method is to detect through the original IP packet and set the abnormal network behavior detection rules of fixed fields to detect devices with abnormal network behavior. However, this method usually has the following technical problems: the fixed field detection method has a lag in the detection of abnormal network behavior, and it is difficult to quickly and effectively detect new abnormal network behaviors, resulting in low detection efficiency and low device security. Summary of the invention

[0003] The content of this application is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The content of this application is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0004] Some embodiments of the present application propose a network anomaly detection method, a computer device, and a computer-readable storage medium based on network security attack and defense to solve one or more of the technical problems mentioned in the above background technology section.

[0005] In the first aspect, some embodiments of the present application provide a network anomaly detection method based on network security attack and defense, the method comprising: obtaining device network information of each network device in a network device cluster to be detected, and obtaining a device network information set; performing multi-aggregation dimension combination on each device network information in the above device network information set to generate multiple device network information group sets, wherein each device network information group set corresponds to an aggregation dimension; for each device network information in the above device network information set, performing the following processing steps: determining multiple device network information groups including the above device network information in the above multiple device network information group sets; for each device network information group in the above multiple device network information groups, determining the information anomaly score corresponding to the above device network information in the above device network information group; score fusion of each information anomaly score in the obtained multiple information anomaly scores to generate a network information anomaly score corresponding to the above device network information; generating device network anomaly information based on the above network information anomaly score, wherein the above device network anomaly information indicates whether the device corresponding to the above device network information has network anomaly behavior. According to each device network anomaly information, network security attack and defense detection operations are performed on each network device in the network device cluster.

[0006] In a second aspect, the present application also provides a computer device, comprising a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the method described in any implementation of the first aspect is implemented.

[0007] In a third aspect, the present application further provides a computer-readable storage medium, on which a computer program is stored, wherein when the computer program is executed by a processor, the method described in any implementation of the first aspect is implemented.

[0008] The above-mentioned embodiments of the present application have the following beneficial effects: through the network feature southwest-west stratification and network information anomaly score analysis, the device information with abnormal network behavior can be accurately determined, the efficiency of network device detection is improved, and the attack and defense detection of the device is convenient. Thus, it is easier to carry out targeted maintenance on the equipment. First, the device network information of each network device in the network device cluster to be detected is obtained to obtain a device network information set. Secondly, the network information of each device in the above-mentioned device network information set is combined in multiple aggregation dimensions to generate multiple device network information groups, wherein each device network information group corresponds to an aggregation dimension. Thus, by performing multiple aggregation dimensions, each device network information group under different aggregation dimensions can be obtained to perform information characteristics and data distribution of device network information groups under different aggregation dimensions, so as to effectively identify abnormal devices showing abnormal characteristics according to the network information characteristics. Thus, it is convenient to perform fine-grained determination of anomaly scores in the subsequent period, and it can also be used for attack and defense detection of devices with abnormal network behavior. Next, for each device network information in the above-mentioned device network information set, the following processing steps are performed: determine multiple device network information groups including the above-mentioned device network information in the above-mentioned multiple device network information group sets; for each device network information group in the above-mentioned multiple device network information groups, determine the information anomaly score corresponding to the above-mentioned device network information in the above-mentioned device network information group; perform score fusion on each of the obtained multiple information anomaly scores to generate a network information anomaly score corresponding to the above-mentioned device network information; generate device network anomaly information according to the above-mentioned network information anomaly score, wherein the above-mentioned device network anomaly information characterizes whether the device corresponding to the above-mentioned device network information has network anomaly behavior. Thus, through the method of multiple aggregation dimensions, the stratification of the device network information set is realized to realize the analysis of network anomaly scores. Thus, the device network information with network anomaly behavior can be accurately and efficiently generated. Finally, according to each device network anomaly information, network security attack and defense detection operations are performed on each network device in the network device cluster. Thus, the efficiency of network device detection is improved, and it is convenient to perform attack and defense detection on the device. Thus, it is easier to repair the equipment in a targeted manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The above and other features, advantages and aspects of the embodiments of the present application will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0010] Figure 1 is a flow chart of some embodiments of the network anomaly detection method based on network security attack and defense according to the present application;

[0011] Figure 2 is a schematic diagram of a computer device suitable for implementing some embodiments of the present application;

[0012] Figure 3 It is a simplified example diagram of step 103 in the network anomaly detection method based on network security attack and defense of the present application. DETAILED DESCRIPTION

[0013] Embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present application. It should be understood that the drawings and embodiments of the present application are only for exemplary purposes and are not intended to limit the scope of protection of the present application.

[0014] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other.

[0015] It should be noted that the concepts such as "first" and "second" mentioned in this application are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0016] It should be noted that the modifications of "one" and "plurality" mentioned in the present application are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0017] The names of the messages or information exchanged between multiple devices in the embodiments of the present application are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0018] The present application will be described in detail below with reference to the accompanying drawings and in combination with embodiments.

[0019] Figure 1 The process 100 of some embodiments of the network anomaly detection method based on network security attack and defense according to the present application is shown. The network anomaly detection method based on network security attack and defense includes the following steps:

[0020] Step 101: Obtain device network information of each network device in the network device cluster to be detected to obtain a device network information set.

[0021] In some embodiments, the execution subject (e.g., computing device) of the network anomaly detection method based on network security attack and defense can obtain the device network information of each network device in the network device cluster to be detected, and obtain the device network information set. The device network information may refer to the operation information of various network operations performed on the network device. The device network information may be the operation data related to the network device. For example, the device network information may include: user access information, traffic usage information, network status information, page browsing behavior information of each device, etc. User access information may include: user's IP address, browser information, access time, access page, etc. Traffic usage information may include: data packet, protocol, port, traffic type, traffic size, traffic mode, traffic source. Data packet: the basic unit in network transmission, including source address, destination address, protocol type and other information. Protocol: rules and standards used in network communication, such as TCP / IP, HTTP, FTP, etc. Port: network traffic uses specific port numbers to identify different services or applications, for example, HTTP usually uses port 80 and HTTPS uses port 443. Traffic type: includes inbound traffic and outbound traffic, which refer to data entering and leaving the network respectively. Traffic size: refers to the amount of data transmitted in a certain period of time, usually measured in bits per second (bps) or bytes per second (Bps). Traffic pattern: the regularity and periodicity of data transmission, such as peak and trough periods. Traffic source: analyze the source and destination of data packets to identify different users and devices. Network status information may include: connection status, sequence number, confirmation number, routing table, actual network connection, database file status, encryption status, etc. Connection status: includes the current status of the connection, such as established, closed, or half-open. Sequence number: the sequence number in the data packet used to track the progress of the session. Confirmation number: the confirmation number in the data packet used to confirm that the previous data packet has been received. Routing table: displays routing table information, including network paths and device status. Actual network connection: displays the actual network connection status, including the status information of each network interface device. Database file status: in a single-user environment, displays the locked / unlocked status of each database file, as well as the number of locked records. Encryption status: displays the current encryption status, such as the ENCRYPTION status. Device page browsing behavior information may include: visit actuals, page views, stay actuals, and click paths. Visit time: records the specific time when the user visits the website, which can help analyze the user's active time period. Page views: counts the number of pages visited by the user, reflecting the user's browsing breadth and interests. Stay time: records the length of time the user stays on each page, and understands the user's interest in the content and the attractiveness of the page. Click path: records the user's click behavior and browsing path, and analyzes the user's interests and behavioral habits.

[0022] Step 102 : performing multi-aggregation dimension combination on each device network information in the device network information set to generate a plurality of device network information sets.

[0023] In some embodiments, the execution subject may combine the individual device network information in the device network information set in multiple aggregation dimensions to generate multiple device network information sets, wherein each device network information set corresponds to an aggregation dimension.

[0024] Among them, the aggregation dimension can characterize the aggregation method of aggregating device network information. For example, the type of abnormal network behavior can be used as an aggregation dimension to combine the device network information set into a device network information group set according to the different types of abnormal network behavior, wherein each device network information group corresponds to the same type of abnormal network behavior. The types of abnormal network behavior focus on the fields that abnormal access behavior / abnormal traffic behavior may focus on. The union of the device network information corresponding to the device network information group set is the device network information set. There is no identical device network information between the device network information groups in the device network information group set.

[0025] For example, the device network information set may include: device network information 1, device network information 2, device network information 3, device network information 4, and device network information 5. The multi-aggregation dimension may include: A focus dimension and B focus dimension. The device network information group set corresponding to the A focus dimension is {[device network information 1 and device network information 2], [device network information 3 and device network information 4], [device network information 5]}. Among them, [device network information 1 and device network information 2] are the first device network information group. [Device network information 3 and device network information 4] are the second device network information group. [Device network information 5] is the third device network information group. The device network information group set corresponding to the B focus dimension is {[device network information 1, device network information 2 and device network information 3], [device network information 4 and device network information 5]}. [Device network information 1, device network information 2 and device network information 3] are the fourth device network information group. [Device network information 4 and device network information 5] are the fifth device network information group.

[0026] In an actual application scenario, the execution subject can perform multi-aggregation dimension combination on each device network information in the above device network information set through the following steps:

[0027] First, for each information partitioning function in the preset information partitioning function group, the information partitioning function is used to partition each device network information in the device network information set to generate a device network information group set. One aggregation dimension corresponds to one information partitioning function. The function logic corresponding to the information partitioning function can characterize the aggregation dimension setting of the corresponding device network information. For example, when the aggregation dimension is a business characteristic, the corresponding information partitioning function can be a segmented function that partitions the device network information based on the network category characteristics.

[0028] Second, each generated device network information set is determined as a plurality of device network information sets.

[0029] Furthermore, for each device network information in the above device network information set, the following update steps are performed:

[0030] First, determine the device network feature information set corresponding to the above device network information.

[0031] Second, binary processing is performed on the non-floating-point device network feature information in the device network feature information set to generate a binary device network information set.

[0032] Third, the floating-point feature information in the above-mentioned device network feature information set is classified to generate a classified device network information set.

[0033] Fourth, the binary device network information set and the classified device network information set are merged to generate device network processing data corresponding to the device network information.

[0034] Furthermore, the obtained network processing data of each device is determined as a device network information set.

[0035] Step 103: for each device network information in the device network information set, perform the following processing steps:

[0036] Step 1031 , determining a plurality of device network information groups including the device network information in the plurality of device network information groups.

[0037] In some embodiments, the execution subject may determine multiple device network information groups including the device network information in the multiple device network information groups. Each of the multiple device network information groups includes device network information. For example, for the device network information being device network information 1, the corresponding multiple device network information groups include: a first device network information group and a fourth device network information group. The number of device network information groups corresponding to the multiple device network information groups is the same as the number of aggregation dimensions corresponding to the multiple aggregation dimensions.

[0038] Step 1032: for each device network information group in the plurality of device network information groups, determine an information anomaly score corresponding to the device network information in the device network information group.

[0039] In some embodiments, the execution subject may determine, for each of the plurality of device network information groups, an information anomaly score corresponding to the device network information in the device network information group. The information anomaly score may represent the degree of abnormality of the information content of the device network information under the data distribution corresponding to the device network information group. The larger the information anomaly score, the higher the degree of abnormality of the corresponding information.

[0040] In an actual application scenario, the execution subject can determine the information anomaly score corresponding to the above-mentioned device network information in the above-mentioned device network information group through the following steps:

[0041] In the first step, for each device network feature in the device network feature set included in the device network information, the following processing steps are performed:

[0042] 1. Determine the device network feature information of each device network information in the above device network information group under the above device network feature, and obtain the device network feature information group. Among them, one device network feature corresponds to one device network feature information. The device network feature information can characterize the feature content corresponding to the device network feature. For example, the device network feature set may include: data occurrence time, device identification, device execution operation, operation object, user characteristics, browsing behavior characteristics, and traffic characteristics.

[0043] 2. According to the above-mentioned device network characteristic information group, determine each characteristic anomaly score corresponding to each enumerated characteristic information under the above-mentioned device network characteristic. For example, the each characteristic anomaly score corresponding to each enumerated characteristic information under the above-mentioned device network characteristic can be determined by a scoring function. Among them, the scoring function can be a pre-set function that outputs the characteristic anomaly score in the corresponding group according to the distribution of each device network characteristic information in the device network characteristic information group. Among them, one enumerated characteristic information corresponds to one individual characteristic anomaly score. Each enumerated characteristic information can be all possible values ​​of the enumeration under the device network characteristic. Among them, the scoring function can be: binomial test function, chi-square test.

[0044] For example, first, determine the amount of data corresponding to the device network information group, the amount of device network information corresponding to each enumerated feature information, and the proportion of the number of devices corresponding to each enumerated feature information. Then, based on the amount of data, the amount of device network information corresponding to each enumerated feature information, and the proportion of the number of devices corresponding to each enumerated feature information, determine the binomial distribution hypothesis test score formula through the binom.test() function. Next, perform negative logarithmic function processing on the binomial distribution hypothesis test score formula to obtain the abnormal score formula corresponding to the feature. Finally, determine the feature abnormality score corresponding to each enumerated feature information based on the abnormal score formula.

[0045] 3. Determine the device network characteristic information corresponding to the above device network information as the target device network characteristic information.

[0046] 4. Select a feature anomaly score corresponding to the target device network feature information from the above-mentioned feature anomaly scores as the target feature anomaly score.

[0047] The second step is to determine the information anomaly score based on the anomaly scores of each target feature. For example, the anomaly scores of each target feature can be weighted averaged to obtain the information anomaly score.

[0048] Step 1033: Score fusion is performed on each of the multiple information anomaly scores obtained to generate a network information anomaly score corresponding to the device network information.

[0049] In some embodiments, the execution subject may perform score fusion on each of the multiple information anomaly scores obtained to generate a network information anomaly score corresponding to the device network information. The network information anomaly score may characterize the degree of anomaly of the device network information under each aggregation dimension. The network information anomaly score may characterize the degree of anomaly of the device network information under the data distribution corresponding to the device network information set. The larger the network information anomaly score, the higher the corresponding degree of anomaly.

[0050] In an actual application scenario, the execution entity can perform score fusion on each of the multiple information anomaly scores obtained by the following steps:

[0051] In the first step, for each device network feature in the device network feature set, perform the following processing steps:

[0052] 1. Determine the intra-group information anomaly scores corresponding to the device network characteristics among the plurality of information anomaly scores, and obtain a plurality of intra-group information anomaly scores. The plurality of intra-group information anomaly scores may be respective information anomaly scores of the device network information obtained by segmentation of the plurality of information partitioning functions under the device network characteristics.

[0053] 2. Determine the function weight and function category corresponding to the above information partitioning function group. Among them, the function weight can represent the importance of the information partitioning function corresponding to the information partitioning characteristics. That is, the function weight can represent the importance of the information anomaly score corresponding to the side standard. The function category can be the function type corresponding to the information partitioning function. Specifically, different function types represent different function calculation logics. The function weight can be a value between 0 and 1. The higher the value, the higher the corresponding importance.

[0054] 3. Generate a characteristic anomaly score corresponding to the device network information according to the function weight, the function category and the multiple in-group information anomaly scores. The characteristic anomaly score can characterize the degree of abnormality of the device network information under the device network feature. The higher the characteristic anomaly score, the greater the corresponding degree of abnormality. For example, first, the execution subject can divide the multiple information partitioning functions into function categories to obtain a set of information partitioning function groups. The information partitioning function group corresponds to a function category. Then, for each information partitioning function group in the information partitioning function group set, the first step is to determine the in-group information anomaly score group corresponding to the information partitioning function group. The second step is to filter out the maximum in-group information anomaly score from the in-group information anomaly score group. Then, the obtained maximum in-group information anomaly score set is weighted and summed with the corresponding function weight set to generate a characteristic anomaly score.

[0055] The second step is to generate a network information anomaly score based on the anomaly scores of each feature.

[0056] Wherein, generating a network information anomaly score according to each feature anomaly score includes: generating a network information anomaly score corresponding to each feature anomaly score according to the feature category between each device network feature in the device network feature set using a feature aggregation function. Wherein, the feature aggregation function can be a function of aggregating the feature anomaly scores under each device network feature to generate an overall feature anomaly score corresponding to the device network information. The feature category can characterize the feature type corresponding to the device network feature. For example, first, the execution subject can divide the device network feature set into multiple device network feature groups according to the feature type. Wherein, the feature category corresponding to each device network feature in each device network feature group is the same. Then, for each device network feature group in the multiple device network feature groups, first, determine the feature anomaly score group corresponding to the device network feature group. Second, add each feature anomaly score in the feature anomaly score group to obtain a sum score. Then, the obtained multiple sum scores are weighted summed with the category weights corresponding to the corresponding feature categories to generate a network information anomaly score.

[0057] Step 1034: Generate device network anomaly information based on the above network information anomaly score.

[0058] In some embodiments, the execution subject may generate device network anomaly information based on the above network information anomaly score. The above device network anomaly information indicates whether the device corresponding to the above device network information has network anomaly behavior. The device network anomaly information may be information in the form of a label. For example, the device network anomaly information may include: normal device network information, suspicious device network information, malicious device network information, and virus device network information. Different network information anomaly scores correspond to different anomaly score intervals. One anomaly score interval corresponds to one type of device network anomaly information. Suspicious device network information, malicious device network information, and virus device network information all indicate that the network device has abnormal behavior.

[0059] like Figure 3 As shown in the example, as a simple example of step 103, the multiple device network information groups corresponding to the device network information 1 include: device network information group A and device network information group C. Secondly, for each of the above multiple device network information groups, determine the intra-group anomaly score of the above device network information 1 in the above device network information group. The intra-group information anomaly score corresponding to device network information group A can be "23 points". The intra-group information anomaly score corresponding to device network information group C can be "27 points". Then, score fusion is performed on each of the multiple information anomaly scores obtained to generate a network information anomaly score of "25 points" corresponding to the above device network information 1. Based on the above network information anomaly score "25 points", generate device network anomaly information. The device network anomaly information may be "the device has abnormal network behavior".

[0060] Therefore, by using multiple aggregation dimensions, we can obtain the network information groups of each device under different aggregation dimensions, so as to analyze the information characteristics and data distribution of the network information groups of the devices under different aggregation dimensions, so as to effectively identify abnormal devices that show abnormal characteristics based on the network information characteristics. This facilitates the subsequent fine-grained determination of abnormal scores, and can also be used for attack and defense detection of devices with abnormal network behavior.

[0061] Step 104: Perform network security attack and defense detection operations on each network device in the network device cluster according to the network anomaly information of each device.

[0062] In some embodiments, the execution entity may perform network security attack and defense detection operations on each network device in the network device cluster based on network anomaly information of each device.

[0063] For example, first, the network anomaly information of each device that meets the network security attack and defense detection conditions is determined as the network anomaly information of the device to be detected, and the network anomaly information group of the device to be detected is obtained. Then, each network device corresponding to the above-mentioned network anomaly information group of the device to be detected is determined as the network device group to be detected. After that, the network security attack and defense drill model can be used to perform network security attack and defense detection on each network device to be detected. For example, the network security attack and defense drill model can include: PDR model, P2DR model, PETS penetration test framework, network kill chain model. Among them, the PDR model includes: protection (Protection), detection (Detection) and response (Response) three links. Protection measures include encryption, authentication, access control, firewall and antivirus; detection technology includes intrusion detection, vulnerability detection and network scanning; response is the most effective way to solve security problems, and it is crucial to establish an emergency response mechanism. P2DR model: It is a representative model of the dynamic network security system. It includes protection, detection and response, forming a collaborative and dynamic "closed-loop process". The core of the P2DR model is security strategy, and all protection, detection and response are implemented based on security strategy. PETS penetration testing framework: divided into early interaction, intelligence gathering, threat modeling, vulnerability analysis, penetration attack, post-penetration attack and reporting stages. The PETS framework has been widely recognized by the security industry by defining the basic principles of penetration testing. Network kill chain model: divided into seven steps: reconnaissance and tracking, weapon construction, payload delivery, vulnerability exploitation, installation and implantation, command and control, and goal achievement. By identifying the progression stages of an attack, organizations can better defend and prevent network incidents. Network security attack and defense detection conditions can be: Device network abnormal information indicates abnormal behavior of network devices.

[0064] In an actual application scenario, the execution subject can perform network security attack and defense detection operations on each network device in the network device cluster through the following steps:

[0065] In the first step, the device network anomaly information that meets the network security attack and defense detection conditions among the above-mentioned device network anomaly information is determined as the device network anomaly information to be detected, and a device network anomaly information group to be detected is obtained.

[0066] In the second step, each network device corresponding to the above-mentioned network anomaly information group of the devices to be detected is determined as a network device group to be detected.

[0067] Step 3: For each network device to be detected in the above-mentioned group of network devices to be detected, perform the following detection steps:

[0068] 1. Obtain the network device operation data of the above-mentioned network device to be detected within a preset time period. The preset time period may refer to a preset history to the current time period. For example, the preset time period refers to the current to the previous 48 hours. The network device operation data may include: historical user access information sequence, historical traffic usage information sequence, historical network status information sequence, and each historical device page browsing behavior information sequence.

[0069] 2. Based on the above network equipment operation data and the abnormal causal model in the network equipment anomaly detection model, determine the causal coefficient information of each indicator that affects the abnormal operation of the network equipment. Wherein, the above network equipment operation data includes: feature data sequences under multiple indicator dimensions. The network equipment anomaly detection model may include an abnormal causal model for estimating causal coefficient information. Wherein, the abnormal causal model is set according to actual needs, such as a linear causal model (Linear DML (Double Machine Learning)), a tree series causal model (Causal Forest DML), etc. The execution subject can determine the causal coefficient information of each indicator that affects the abnormal operation of the network device based on the network equipment operation data and the abnormal causal model in the network equipment anomaly detection model. For example, the execution subject can input the network equipment operation data into the abnormal causal model, analyze the network equipment operation data through the abnormal causal model, and obtain the causal coefficient information of each indicator that affects the abnormal operation of the network device.

[0070] 3. Select the causal coefficient information corresponding to the target condition from the causal coefficient information of each indicator. The target condition is a factor that matches the set time and the set feature dimension. The set time and the set dimension here are usually the time and dimension of the device network feature to be detected.

[0071] 4. According to the above network equipment operation data and the basic equipment anomaly detection model in the above network equipment anomaly detection model, obtain preliminary network equipment anomaly results. Among them, the basic equipment anomaly detection model can be used to detect the network characteristics of the device at the set time. The basic equipment anomaly detection model here can also be set according to actual needs, and the Transformer deep learning model commonly used in related technologies can be used. For example, the network equipment operation data can be input into the basic equipment anomaly detection model to obtain preliminary network equipment anomaly results.

[0072] 5. Generate the network device anomaly detection result output by the network device anomaly detection model according to the above-mentioned causal coefficient information and the above-mentioned preliminary network device anomaly result. As an example, the causal coefficient information and the above-mentioned preliminary network device anomaly result can be multiplied, and the result obtained can be used as the final data output of the network device anomaly detection model. For another example, the network device anomaly detection model may include: a network device anomaly detection model, an anomaly-based detection model, a host-based intrusion detection model, a network-based intrusion detection model, and a hybrid intrusion detection model. Among them, the signature-based detection model: detects intrusion by matching the signature of a known attack pattern. The advantage is high accuracy and the ability to quickly identify known attacks. The anomaly-based detection model: by establishing a baseline of normal behavior, detecting abnormal behavior that deviates from the baseline, and being able to detect unknown attacks. The host-based intrusion detection model: monitors system calls, log files, file integrity, etc. on a single host or device. The advantage is that it can detect deep attacks on specific hosts and defend against internal threats. The network-based intrusion detection model: monitors and analyzes network traffic at the network level, covers the entire network, and can detect a wide range of network attacks. Hybrid intrusion detection model: Combines signature and anomaly detection methods, or combines the advantages of host-based and network-based methods to improve the comprehensiveness and accuracy of detection. For example, the above-mentioned causal coefficient information and the above-mentioned preliminary network device anomaly results can be input into the above-mentioned network device anomaly detection model to obtain the network device anomaly detection results. The network device anomaly detection results can indicate the type and degree of anomaly of the network device.

[0073] In an actual application scenario, the execution subject can determine the causal coefficient information of each indicator that affects the abnormal operation of the network device through the following steps:

[0074] The first step is to generate causal effect information of various indicators that affect the abnormal operation of network equipment based on the above network equipment operation data and abnormal causal model.

[0075] The second step is to transform the causal effect information of each indicator to obtain the causal coefficient information of each indicator. The second step may include: first, performing an exponential transformation on the causal effect information of each indicator to obtain the transformed causal coefficient. Second, evaluating the transformed causal coefficient, and determining the evaluated causal coefficient as the causal coefficient information of each indicator.

[0076] Furthermore, the network security attack and defense detection results of each network device to be detected can be sent to an associated network device maintenance terminal to facilitate device maintenance.

[0077] This improves the efficiency of network equipment detection and facilitates attack and defense detection of the equipment, making it easier to perform targeted repairs on the equipment.

[0078] The present application also provides a computer device 200. Figure 2 As shown, the computer device 200 includes: a bus 201, a processor 202, a memory 203 and a communication interface 204. The processor 202, the memory 203 and the communication interface 204 communicate with each other through the bus 201. The computer device 200 can be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in the computer device 200.

[0079] The bus 201 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 2 The bus 201 is represented by only one line, but it does not mean that there is only one bus or one type of bus. The bus 201 may include a path for transmitting information between various components of the computer device 200 (for example, the memory 203, the processor 202, and the communication interface 204).

[0080] The processor 202 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0081] The memory 203 may include a volatile memory, such as a random access memory (RAM). The memory 203 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0082] The memory 203 stores executable program codes, and the processor 202 executes the executable program codes to respectively implement the functions of the aforementioned acquisition module, sampling module, determination module, and mixing module, thereby implementing the aforementioned method for network anomaly detection based on network security attack and defense. That is, the memory 203 stores instructions for executing the aforementioned method for network anomaly detection based on network security attack and defense.

[0083] The communication interface 204 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computer device 200 and other devices or a communication network.

[0084] An embodiment of the present application also provides a chip, which includes a processor and a data interface. The processor reads instructions stored in a memory through the data interface to execute the above-mentioned method of network anomaly detection based on network security attack and defense.

[0085] The embodiment of the present application also provides a computer-readable storage medium. The above-mentioned computer-readable storage medium can be any available medium that can be stored by a computing device or a data storage device such as a data center containing one or more available media. The above-mentioned available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid-state hard disk). The computer-readable storage medium includes instructions, and the above-mentioned instructions instruct the computing device to execute the above-mentioned method for network anomaly detection based on network security attack and defense.

[0086] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0087] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. A network anomaly detection method based on network security attack and defense, comprising: Obtain device network information of each network device in the network device cluster to be detected, and obtain a device network information set; Combining each device network information in the device network information set with multiple aggregation dimensions to generate multiple device network information group sets, wherein each device network information group set corresponds to an aggregation dimension, and the aggregation dimension represents an aggregation method for aggregating the device network information; For each device network information in the device network information set, the following processing steps are performed: Determine a plurality of device network information groups including the device network information in the plurality of device network information group sets, wherein the number of device network information groups corresponding to the plurality of device network information groups is the same as the number of aggregation dimensions corresponding to the plurality of aggregation dimensions; For each device network information group in the plurality of device network information groups, determining an information anomaly score corresponding to the device network information in the device network information group; Score merging each of the multiple information anomaly scores obtained to generate a network information anomaly score corresponding to the device network information; Generate device network anomaly information according to the network information anomaly score, wherein the device network anomaly information indicates whether the device corresponding to the device network information has network anomaly behavior; According to the network anomaly information of each device, perform network security attack and defense detection operations on each network device in the network device cluster; Wherein, determining the information anomaly score corresponding to the device network information in the device network information group includes: For each device network feature in the device network feature set included in the device network information, the following processing steps are performed: Determine device network characteristic information of each device network information in the device network information group under the device network characteristic to obtain a device network characteristic information group; Determine, according to the device network feature information group, each feature anomaly score corresponding to each enumerated feature information under the device network feature; Determine the device network characteristic information corresponding to the device network information as the target device network characteristic information; Selecting a feature anomaly score corresponding to the target device network feature information from the feature anomaly scores as a target feature anomaly score; Determine the information anomaly score based on the anomaly score of each target feature; The performing of multi-aggregation-dimensional combination of each device network information in the device network information set to generate multiple device network information sets includes: For each information partitioning function in the preset information partitioning function group, using the information partitioning function, information partitioning is performed on each device network information in the device network information set to generate a device network information group set, wherein one aggregation dimension corresponds to one information partitioning function; The generated device network information sets are determined as a plurality of device network information sets.

2. The network anomaly detection method based on network security attack and defense according to claim 1 is characterized in that: After combining the individual device network information in the device network information set in multiple aggregation dimensions to generate multiple device network information sets, the method further includes: For each device network information in the device network information set, perform the following update steps: Determine a device network characteristic information set corresponding to the device network information; Performing binary processing on the non-floating-point device network characteristic information in the device network characteristic information set to generate a binary device network information set; Classifying the floating-point feature information in the device network feature information set to generate a classified device network information set; Merging the binary device network information set and the classified device network information set to generate device network processing data corresponding to the device network information; The obtained network processing data of each device is determined as a device network information set.

3. A computer device, wherein: The computer device comprises a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the steps of the method according to any one of claims 1 to 2 are implemented.

4. A computer-readable storage medium, wherein: The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 2 are implemented.

Images