Attack traceability path determination method and device, equipment, storage medium and product

Abstract

The embodiment of the invention provides an attack traceability path determination method and device, equipment, a storage medium and a product, and the method comprises the steps: obtaining communication behavior data of lost equipment in a lost time range; for the communication behavior data of each network device, if the communication behavior data exceeds the standard range of the communication behavior baseline, the probability that each network device is an attack address is calculated, and if the probability that any network device is an attack address exceeds a malicious probability threshold, according to the communication behavior data, the malicious probability is determined; constructing a communication behavior graph and iteratively executing the following steps: calculating the probability that each IP address of communication is an attack address according to historical communication data of any network equipment; if the malicious probability exceeds the malicious probability threshold, adding any IP address into the communication behavior graph; if the probabilities that all the IP addresses communicating with any network device are attack addresses are not exceeded, ending the iteration process; and determining an attack traceability path based on the determined communication behavior graph. The method is used for achieving the effect of restoring the multi-level attack path.

Description

Technical Field

[0001] The present application relates to the field of Internet of Things technology, and in particular to a method, device, equipment, storage medium and product for determining an attack tracing path. Background Art

[0002] With the rapid development of IoT technology, various IoT applications such as smart home, smart wearable, Internet of Vehicles, and Industrial IoT have emerged, resulting in a sharp increase in the number of IoT devices. Compared with traditional Internet terminals, the security protection of IoT devices is relatively weak, making it more difficult to resist various network attacks.

[0003] In the existing technology, the path reconstruction model is built by relying on vulnerability assessment and threat modeling, and the scores of the vulnerability scoring system are used as the weight or probability of the potential path. However, these attack path construction methods rely on a lot of prior knowledge. In actual tracing scenarios, this information is often incomplete or has a lag, so it is difficult to implement in large-scale network environments. Summary of the invention

[0004] The embodiments of the present application provide a method, apparatus, device, storage medium and product for determining an attack tracing path, so as to achieve the effect of restoring a multi-level attack path.

[0005] In a first aspect, an embodiment of the present application provides a method for determining an attack source tracing path, which is applied to a computer device, comprising: obtaining the moment of loss of a compromised device, and determining a loss time range based on the moment of loss and a preset time window; within the loss time range, obtaining communication behavior data of the compromised device; for the communication behavior data between each network device and the compromised device, if the communication behavior data exceeds the standard range of a communication behavior baseline, calculating the probability of each network device being an attack address based on the communication behavior data, wherein the communication behavior baseline is pre-constructed; if the probability of any network device being an attack address exceeds a malicious probability threshold, constructing a communication behavior graph based on the communication behavior data of any network device and the compromised device; based on any network device, iteratively executing the following steps: within the loss time range , obtain the historical communication data of any network device to determine the communication behavior set of any network device; in the communication behavior set of any network device, calculate the probability that each IP address communicating with any network device is an attack address based on the historical communication data; if the probability that any IP address is an attack address exceeds the malicious probability threshold, then add any IP address to the communication behavior graph; if the probability that all IP addresses communicating with any network device are attack addresses does not exceed the malicious probability threshold, then end the iterative process; based on the determined communication behavior graph, take the compromised device as the starting point, and search from back to front to obtain all potential attack paths; in each potential attack path, calculate the cumulative probability of each potential attack path; determine the potential attack path with the largest cumulative probability as the attack tracing path.

[0006] In one possible implementation, the probability of each network device being an attack address is calculated, including: obtaining the number of consecutive communication days between each network device and the compromised device; obtaining the number of daily communications between each network device and the compromised device; obtaining the number of port types for communication between each network device and the compromised device; obtaining the number of domain names for communication between each network device and the compromised device; obtaining the number of URL categories for communication between each network device and the compromised device; and inputting the consecutive communication days, daily communications, port type number, domain name number, and URL category number into an attack probability calculation formula to determine the probability of each network device being an attack address.

[0007] In a possible implementation, the attack probability calculation formula is:

[0008]

[0009] Where P y represents the probability that each network device is an attack address; Per represents the number of consecutive days that each network device communicates with the compromised device; C represents the number of daily communications between each network device and the compromised device; N p Indicates the number of port types that each network device uses to communicate with the victim device; N d Indicates the number of domain names that each network device communicates with the compromised device; N u It indicates the number of URL categories that each network device communicates with the compromised device; ω1, ω2, ω3, ω4, and ω5 are weight coefficients.

[0010] In one possible implementation, the process of constructing a communication behavior baseline includes: continuously collecting multi-source communication data of the compromised device within a preset time period, wherein the multi-source communication and data at least include the number of daily connections, the number and types of port types, the number of domain name categories, and the number of website categories; performing cleaning operations on the multi-source communication data; calculating the average daily number of connections of the compromised device within the preset time period based on the number of daily connections; counting the proportion of each type of port in the communication of the compromised device and the frequency of use distribution based on the number and types of port types; analyzing the access popularity and change trend of domain names of different categories based on the number of domain name categories; determining the mutual correlation between each website category in the communication of the compromised device based on the number of website categories; constructing a communication behavior baseline based on the average daily number of connections, the proportion of each type of port in the communication of the compromised device and the frequency of use distribution, the access popularity and change trend of domain names of different categories, and the mutual correlation between each website category in the communication of the compromised device, and the communication behavior baseline is used to define the standard range of communication behavior of the compromised device under normal operating conditions.

[0011] In one possible implementation, in each potential attack path, the cumulative probability of each potential attack path is calculated, including: in a determined communication behavior graph, obtaining the probability that each node is an attack address; and multiplying the probabilities that each node in each potential attack path is an attack address to determine the cumulative probability of each potential attack path.

[0012] In a second aspect, an embodiment of the present application provides an attack tracing path determination device, which is applied to a computer device, including:

[0013] The loss time range determination module is used to obtain the loss time of the IoT lost device and determine the loss time range based on the loss time and the preset time window.

[0014] The communication behavior set determination module is used to obtain the historical communication data of the trapped device within the time range of the trap.

[0015] The attack address probability calculation module is used to calculate the probability of each network device being an attack address based on the communication behavior data between each network device and the compromised device. If the communication behavior data exceeds the standard range of the communication behavior baseline, the communication behavior baseline is pre-constructed.

[0016] The communication behavior graph construction module is used to construct a communication behavior graph based on the communication behavior data of any network device and the compromised device if the probability that any network device is an attack address exceeds a malicious probability threshold.

[0017] The iteration module is used to iteratively execute the following steps based on any network device.

[0018] The historical communication data acquisition unit is used to acquire the historical communication data of any network device within the time range of the loss, so as to determine the communication behavior set of any network device.

[0019] The attack address probability calculation unit is used to calculate the probability that each IP address communicating with any network device is an attack address in the communication behavior set of any network device according to historical communication data.

[0020] The communication behavior graph construction unit is used to add any IP address to the communication behavior graph if the probability that any IP address is an attack address exceeds a malicious probability threshold.

[0021] The iteration ending unit is used to end the iteration process if the probability that all IP addresses communicating with any network device are attack addresses does not exceed a malicious probability threshold.

[0022] The attack path retrieval module is used to retrieve all potential attack paths from back to front based on the determined communication behavior graph, starting from the compromised device.

[0023] The path cumulative probability calculation module is used to calculate the cumulative probability of each potential attack path in each potential attack path.

[0024] The attack tracing path determination module is used to determine the potential attack path with the largest cumulative probability as the attack tracing path.

[0025] In a third aspect, an embodiment of the present application provides a computer device, including: a memory, a processor;

[0026] The memory stores computer executable instructions;

[0027] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the first aspect and / or various possible implementations of the first aspect as described above.

[0028] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect.

[0029] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0030] The attack tracing path determination method, apparatus, equipment, storage medium and product provided in the embodiments of the present application are based on the historical communication behavior data of the compromised device. If the communication behavior data of the communication with the compromised device exceeds the standard range of the communicative behavior baseline, the probability of it being an attack address continues to be calculated. When the probability exceeds the malicious probability threshold, the device is added to the communication behavior graph. By iteratively constructing the communication behavior graph of the compromised device, it is possible to restore the multi-level attack path on the basis of reducing the computing space. At the same time, the use of the historical communication data of the compromised device avoids dependence on prior knowledge or data such as device vulnerabilities and attack modes. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0032] Figure 1 A schematic diagram of a scenario of a method for determining an attack source tracing path provided in an embodiment of the present application;

[0033] Figure 2 A flowchart of a method for determining an attack source tracing path provided in an embodiment of the present application;

[0034] Figure 3A schematic diagram of the structure of an attack tracing path determination device provided in an embodiment of the present application;

[0035] Figure 4 A schematic diagram of the structure of a computer device provided in an embodiment of the present application.

[0036] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0037] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0038] In order to clearly understand the technical solution of the present application, the solution of the prior art is first introduced in detail. With the rapid development of Internet of Things technology, various Internet of Things applications such as smart home, smart wearable, Internet of Vehicles, and Industrial Internet of Things continue to emerge, resulting in a sharp increase in the number of Internet of Things devices. Compared with traditional Internet terminals, the security protection of Internet of Things devices is relatively weak, and it is more difficult to resist various network attacks. A large number of compromised Internet of Things devices will be manipulated by attackers to carry out further cybercrime activities. The compromise of Internet of Things devices is usually the result of several reconnaissance and attacks by attackers through multi-level attack springboards. In order to trace the source of the attack, it is necessary to start from the compromised device and trace back to build an attack path consisting of multiple levels of springboards. The current technology constructs a set of rules for attack graphs based on an attack technology knowledge base, or constructs an attack tracing knowledge base for tracing knowledge reasoning. Another type of path reconstruction model relies on vulnerability assessment and threat modeling, using the scores of a general vulnerability scoring system as the weight or probability of a potential path. However, these attack path construction methods all rely on a large amount of prior knowledge, such as device vulnerabilities, attack techniques, etc. The construction of these attack paths requires a comprehensive understanding and storage of data such as vulnerabilities of potential devices and potential attack patterns. In actual tracing scenarios, the above information is often incomplete or has a lag, so traditional attack tracing is difficult to implement and apply in large-scale network environments.

[0039] In response to the above technical problems, the inventors have come up with the idea of ​​building a baseline based on the historical communication data of the device, and judging the probability that the communication behavior is an attack behavior based on the communication baseline. Within the time range of the compromised device, for the communication behavior data generated by the communication between the compromised device and each network device, if it exceeds the standard range of the communication behavior baseline, the probability of each network device being an attack address continues to be calculated. If the probability that any network device is an attack address exceeds the malicious probability threshold, the communication behavior data between any network device and the compromised device is added to the communication behavior graph; for the current communication behavior graph, iterative execution is performed to obtain the historical communication data of any network device newly added to the communication behavior graph, and the probability that each IP address communicating with any network device is an attack address is calculated. If the probability exceeds the malicious probability threshold, the IP address and the communication behavior data of the IP address with any network device are added to the communication behavior graph until the probability that all IP addresses communicating with any network device are attack addresses does not exceed the malicious probability threshold, and the iterative process ends. Based on the determined communication behavior graph, starting from the compromised device, all potential attack paths are retrieved, and the attack tracing path is determined based on the cumulative probability of each potential path. This method iteratively constructs the communication behavior graph of the compromised device, which can restore multi-level attack paths on the basis of reducing the computing space. At the same time, the attack tracing path determination method is based on the historical communication behavior data of the compromised device, avoiding dependence on prior knowledge or data such as device vulnerabilities and attack patterns.

[0040] Based on the above creative findings, the inventor proposed the technical solution of the present application.

[0041] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0042] Figure 1 A schematic diagram of a scenario of a method for determining an attack source tracing path provided in an embodiment of the present application, such as Figure 1 As shown, the specific application scenario of the present application includes: a receiving device 101, a processor 102 and a display device 103.

[0043] It is understandable that the structure illustrated in the embodiment of the present application does not constitute a specific limitation on the method for determining the attack source tracing path. In other feasible implementations of the present application, the above architecture may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently, which can be determined according to the actual application scenario and is not limited here. Figure 1 The components shown may be implemented in hardware, software, or a combination of software and hardware.

[0044] In a specific implementation process, the receiving device 101 may be an input / output interface or a communication interface, which is used to obtain the time of loss of the lost device.

[0045] The processor 102 can determine the time range of the loss according to the loss moment and the preset time window; obtain the communication behavior data of the lost device within the loss time range; for the communication behavior data of each network device and the lost device, if the communication behavior data exceeds the standard range of the communication behavior baseline, calculate the probability of each network device being an attack address according to the communication behavior data, wherein the communication behavior baseline is pre-constructed; if the probability of any network device being an attack address exceeds the malicious probability threshold, construct a communication behavior graph according to the communication behavior data of any network device and the lost device; based on any network device, iteratively perform the following steps: obtain any network device within the loss time range; The historical communication data of the equipment is used to determine the communication behavior set of any network device; in the communication behavior set of any network device, the probability of each IP address communicating with any network device being an attack address is calculated based on the historical communication data; if the probability of any IP address being an attack address exceeds the malicious probability threshold, any IP address is added to the communication behavior graph; if the probability of all IP addresses communicating with any network device being attack addresses does not exceed the malicious probability threshold, the iterative process is terminated; based on the determined communication behavior graph, starting from the compromised device, all potential attack paths are retrieved from back to front; in each potential attack path, the cumulative probability of each potential attack path is calculated.

[0046] The display device 103 can be used to display the potential attack path with the maximum cumulative probability output. The display device can also be a touch screen, which is used to receive user instructions while displaying the above content to achieve operational interaction with the user.

[0047] It should be understood that the above-mentioned processor can be implemented by the processor reading instructions in the memory and executing the instructions, or it can be implemented by a chip circuit.

[0048] Figure 2 The following is a flow chart of the attack source tracing path determination method provided in the embodiment of the present application. Figure 2 As shown, the method includes:

[0049] S201: Obtain the time of loss of the lost device, and determine the loss time range according to the time of loss and a preset time window.

[0050] Among them, the preset time window is a pre-set time period, which is determined based on previous analysis of similar device failures, industry experience, and comprehensive consideration of the current network environment and business characteristics.

[0051] Specifically, the abnormal behavior of the device in network communication is observed through network traffic monitoring tools. When a large amount of abnormal communication traffic appears at a specific time and the communication pattern does not meet normal business needs, this specific time point is used as the basis for judging whether the device has failed, and then the time of failure is determined.

[0052] Exemplarily, it is known that the device is compromised at time T, and the time window for constructing the attack path is w. Then, based on the period [Tw, T), the compromise time range is determined.

[0053] S202: Acquire communication behavior data of the compromised device within the compromised time range.

[0054] Among them, communication behavior data includes IoT card logs, DNS (Domain Name System Data) data and NetFlow (Network Flow Data) data.

[0055] Specifically, the communication behavior data directly related to the compromised device is obtained from the IoT card logs, DNS data, and NetFlow data within the [Tw,T) period, including the communication between the device and the IP, the URL requested and / or requested by the compromised device, and the domain name requested and / or requested by the compromised device, as the communication behavior data of the compromised device.

[0056] S203: For the communication behavior data between each network device and the compromised device, if the communication behavior data exceeds the standard range of the communication behavior baseline, the probability of each network device being an attack address is calculated based on the communication behavior data, wherein the communication behavior baseline is pre-constructed.

[0057] The communication behavior baseline refers to a reference standard used to describe and define the typical communication patterns and behavior characteristics of network devices or systems under normal operating conditions in network security and traffic analysis. The purpose of establishing a communication behavior baseline is to identify and detect abnormal activities or potential security threats.

[0058] Specifically, in the communication behavior data between the compromised device and each network device, the communication behavior between the compromised device and each network device at each IP address is used to calculate the number of consecutive communication days between the compromised device and each network device, the number of daily communications between the compromised device and each network device, and the number of different port types, domain names, and URL (Uniform Resource Locator) categories that appear during the communication between the compromised device and each network device. If the above data exceeds the standard range of the communication behavior baseline, it is determined that the network device may be a device in the attack path, and the probability of the network device being an attack address is calculated based on the above communication behavior data.

[0059] Specifically, the steps of calculating the probability that each network device is an attack address include Sa1 to Sa6:

[0060] Sa1: Get the number of consecutive communication days between each network device and the compromised device.

[0061] Sa2: Get the daily communication times between each network device and the compromised device.

[0062] Sa3: Get the number of port types used by each network device to communicate with the compromised device.

[0063] Sa4: Get the number of domain names that each network device communicates with the compromised device.

[0064] Sa5: Get the number of URL categories that each network device communicates with the compromised device.

[0065] Sa6: Input the number of consecutive communication days, daily communication times, number of port types, number of domain names, and number of URL categories into the attack probability calculation formula to determine the probability of each network device being an attack address.

[0066] Specifically, the attack probability calculation formula is:

[0067]

[0068] Where P y Indicates the probability that each network device is an attack address; P er represents the number of consecutive communication days between each network device and the compromised device; C represents the number of daily communications between each network device and the compromised device; N p Indicates the number of port types that each network device uses to communicate with the victim device; N d Indicates the number of domain names that each network device communicates with the compromised device; N u It indicates the number of URL categories that each network device communicates with the compromised device; ω1, ω2, ω3, ω4, and ω5 are weight coefficients.

[0069] S204: If the probability that any network device is an attack address exceeds a malicious probability threshold, a communication behavior graph is constructed based on the communication behavior data between any network device and the compromised device.

[0070] Among them, the communication behavior graph initially has only one node, the lost device.

[0071] Specifically, a malicious probability threshold is set. When the probability that any network device is an attack address exceeds the malicious probability threshold, the IP address of the network device is used as a candidate IP and added to the communication behavior graph. If the probability that any network device is an attack address does not exceed the malicious probability threshold, the IP address of the network device and the communication behavior data generated by the communication between the network device and the compromised device are filtered.

[0072] S205: Based on any network device, iteratively execute the following steps.

[0073] S51: within the time range of the loss, obtain historical communication data of any network device to determine a communication behavior set of any network device.

[0074] S52: In the communication behavior set of any network device, based on historical communication data, calculate the probability that each IP address communicating with any network device is an attack address.

[0075] S53: If the probability that any IP address is an attack address exceeds a malicious probability threshold, then any IP address is added to the communication behavior graph.

[0076] S54: If the probability that all IP addresses communicating with any network device are attack addresses does not exceed the malicious probability threshold, the iteration process ends.

[0077] Specifically, for the tracing of multi-level springboard attacks, iterative execution is performed to obtain the communication behavior data of network devices whose probability of attack addresses exceeds the malicious probability threshold. For the communication behavior data of each IP address and the network device, if the communication behavior data of any IP address with the network device exceeds the standard range of the communication behavior baseline, the probability of the IP address being an attack address is calculated. If the probability exceeds the malicious probability threshold, the IP address and the communication behavior data between the IP address and the network device are added to the communication behavior graph until the probability of all IP addresses in the communication behavior data of the devices in the current iteration being attack addresses is less than the malicious probability threshold, and the iteration process ends.

[0078] S206: Based on the determined communication behavior graph, starting from the compromised device, search from back to front to obtain all potential attack paths.

[0079] Specifically, in the determined communication behavior graph, the compromised device is used as the starting node, and the communication behavior data is searched from back to front in chronological order to construct a potential attack path.

[0080] S207: Calculate the cumulative probability of each potential attack path in each potential attack path.

[0081] Among them, in the communication behavior graph, each node includes the probability that the communication node is an attack address.

[0082] Specifically, the steps of calculating the cumulative probability of each potential attack path include Sb1~Sb2:

[0083] Sb1: In the determined communication behavior graph, obtain the probability that each node is an attack address.

[0084] Sb2: The product of the probabilities that each node in each potential attack path is an attack address is determined as the cumulative probability of each potential attack path.

[0085] Specifically, the probabilities that all nodes in each potential attack path are attack addresses are multiplied, and the result is used as the cumulative probability that the last node in the potential attack path is an attack source tracing device.

[0086] S208: Determine the potential attack path with the largest cumulative probability as the attack source tracing path.

[0087] Specifically, the cumulative probabilities of each potential attack path are compared, and the potential attack path with the largest cumulative probability is determined as the attack tracing path.

[0088] In summary, based on the historical communication behavior data of the compromised device, if the communication behavior data of the communication with the compromised device exceeds the standard range of the communicative behavior baseline, the probability of it being an attack address will continue to be calculated. When the probability exceeds the malicious probability threshold, the device will be added to the communication behavior graph. By iteratively constructing the communication behavior graph of the compromised device, it is possible to restore the multi-level attack path on the basis of reducing the computing space. At the same time, the use of the historical communication data of the compromised device avoids dependence on prior knowledge or data such as device vulnerabilities and attack patterns.

[0089] In another embodiment of the present application, the process of constructing the communication behavior baseline includes the following steps:

[0090] S301: Continuously collect multi-source communication data of the compromised device within a preset time period, wherein the multi-source communication and data at least include the number of daily communications, the number and types of port types, the number of domain name categories, and the number of website category numbers.

[0091] Specifically, the communication behavior baseline of the compromised device is constructed based on the persistence and consistency of the historical communication behavior data of the compromised device during normal communication. Persistence means that the communication behavior between the IoT device and a certain IP occurs for a long time, regularly, and frequently, and the communication behavior with the IP is more likely to be normal communication of the device. Consistency means that the communication behavior between the device and a certain IP is the same / similar in the time dimension, and the communication behavior of the IP is more likely to be normal communication of the device.

[0092] Specifically, for the communication behavior between the device and the IP address, the continuity of the communication behavior is measured from two aspects: the number of consecutive communication days and the average number of daily communications. The continuity of the communication behavior is measured from three perspectives: port consistency, domain name consistency, and URL similarity. Port consistency means that the port involved in the communication of the device within the time window should be the port corresponding to the same or the same type of service; domain name consistency means that the domain name involved in the communication of the device within the time window should be consistent; URL consistency means that the URL involved in the communication of the device within the time window should be the same or similar.

[0093] S302: Perform cleaning operations on multi-source communication data.

[0094] S303: Calculate the average daily connection times of the compromised device within a preset time period according to the daily connection times.

[0095] S304: According to the number and types of port types, statistics are collected on the proportion of each type of port in the communication of the compromised device and the distribution of usage frequencies.

[0096] S305: Analyze the access popularity and change trend of domain names in different categories according to the number of domain name categories.

[0097] S306: Determine, based on the number of URL categories, the correlation between the URL categories in the communication of the compromised device.

[0098] S307: Based on the average daily number of connections, the proportion of various ports in the communication of the compromised device and the frequency of use, the access popularity and change trend of different categories of domain names, and the mutual correlation between each category of URLs in the communication of the compromised device, a communication behavior baseline is constructed. The communication behavior baseline is used to define the standard range of communication behavior of the compromised device under normal operating conditions.

[0099] In summary, the collection of multi-source communication data covers the number of daily communications, port types, etc., which can comprehensively capture the diverse characteristics of the communication behavior of the compromised device and improve the accuracy and efficiency of distinguishing between normal and abnormal states of the compromised device.

[0100] Figure 3 The schematic diagram of the structure of the attack tracing path determination device provided in the embodiment of the present application includes: a compromise time range determination module 301, a communication behavior set determination module 302, an attack address probability calculation module 303, a communication behavior graph construction module 304, an iteration module 305, an attack path retrieval module 306, a path cumulative probability calculation module 307 and an attack tracing path determination module 308. The iteration module 305 includes a historical communication data acquisition unit 51, an attack address probability calculation unit 52, a communication behavior graph construction unit 53 and an iteration end unit 54.

[0101] The loss time range determination module 301 is used to obtain the loss time of the IoT lost device and determine the loss time range according to the loss time and a preset time window.

[0102] The communication behavior set determination module 302 is used to obtain the historical communication data of the trapped device within the time range of the trapped device.

[0103] The attack address probability calculation module 303 is used to calculate the probability of each network device being an attack address based on the communication behavior data between each network device and the compromised device, if the communication behavior data exceeds the standard range of the communication behavior baseline, wherein the communication behavior baseline is pre-constructed.

[0104] The communication behavior graph construction module 304 is used to construct a communication behavior graph based on the communication behavior data of any network device and the compromised device if the probability that any network device is an attack address exceeds a malicious probability threshold.

[0105] The iteration module 305 is used to iteratively execute the following steps based on any network device.

[0106] The historical communication data acquisition unit 51 is used to acquire the historical communication data of any network device within the loss time range to determine the communication behavior set of any network device.

[0107] The attack address probability calculation unit 52 is used to calculate the probability that each IP address communicating with any network device is an attack address in the communication behavior set of any network device according to the historical communication data.

[0108] The communication behavior graph construction unit 53 is used to add any IP address to the communication behavior graph if the probability that any IP address is an attack address exceeds a malicious probability threshold.

[0109] The iteration ending unit 54 is used to end the iteration process if the probability that all IP addresses communicating with any network device are attack addresses does not exceed the malicious probability threshold.

[0110] The attack path retrieval module 306 is used to retrieve all potential attack paths from back to front based on the determined communication behavior graph and starting from the compromised device.

[0111] The path cumulative probability calculation module 307 is used to calculate the cumulative probability of each potential attack path in each potential attack path.

[0112] The attack tracing path determining module 308 is used to determine the potential attack path with the largest cumulative probability as the attack tracing path.

[0113] In one possible implementation, the attack address probability calculation module 303 is specifically used to obtain the number of consecutive communication days between each network device and the compromised device; obtain the number of daily communications between each network device and the compromised device; obtain the number of port types for communication between each network device and the compromised device; obtain the number of domain names for communication between each network device and the compromised device; obtain the number of website categories for communication between each network device and the compromised device; and input the consecutive communication days, daily communications, port types, domain names and website categories into the attack probability calculation formula to determine the probability of each network device being an attack address.

[0114] In a possible implementation, the attack probability calculation formula in the attack address probability calculation module 303 is:

[0115]

[0116] Where P y represents the probability that each network device is an attack address; Per represents the number of consecutive days that each network device communicates with the compromised device; C represents the number of daily communications between each network device and the compromised device; N p Indicates the number of port types that each network device uses to communicate with the victim device; N d Indicates the number of domain names that each network device communicates with the compromised device; N u It indicates the number of URL categories that each network device communicates with the compromised device; ω1, ω2, ω3, ω4, and ω5 are weight coefficients.

[0117] In a possible implementation, the device also includes a communication behavior baseline construction module, which is used to continuously collect multi-source communication data of the compromised device within a preset time period, wherein the multi-source communication and data at least include the number of daily connections, the number and types of port types, the number of domain name categories and the number of website categories; perform cleaning operations on the multi-source communication data; calculate the average daily number of connections of the compromised device within the preset time period based on the number of daily connections; count the proportion of each type of port in the communication of the compromised device and the distribution of usage frequency based on the number and types of port types; analyze the access popularity and change trend of domain names of different categories based on the number of domain name categories; determine the mutual correlation between each website category in the communication of the compromised device based on the number of website categories; construct a communication behavior baseline based on the average daily number of connections, the proportion of each type of port in the communication of the compromised device and the distribution of usage frequency, the access popularity and change trend of domain names of different categories and the mutual correlation between each website category in the communication of the compromised device, and the communication behavior baseline is used to define the standard range of communication behavior of the compromised device under normal operating conditions.

[0118] In a possible implementation, the path cumulative probability calculation module 307 is specifically used to obtain the probability of each node being an attack address in the determined communication behavior graph; and determine the product of the probability that each node in each potential attack path is an attack address as the cumulative probability of each potential attack path.

[0119] The attack source tracing path determination device provided in this embodiment can execute the method provided in the above method embodiment, and its implementation principle and technical effect are similar, which will not be described in detail in this embodiment.

[0120] Figure 4 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present application. Figure 4 As shown, the computer device provided in this embodiment includes: at least one processor 401 and a memory 402. Optionally, the computer device also includes a communication component 403. The processor 401, the memory 402 and the communication component 403 are connected via a bus 404.

[0121] In a specific implementation process, at least one processor 401 executes the computer-executable instructions stored in the memory 402, so that at least one processor 401 executes the above method.

[0122] The specific implementation process of the processor 401 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0123] In the above embodiments, it should be understood that the processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the invention can be directly implemented as a hardware processor, or can be implemented by a combination of hardware and software modules in the processor.

[0124] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (NVM), such as at least one disk storage.

[0125] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of this application is not limited to only one bus or one type of bus.

[0126] An embodiment of the present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0127] An embodiment of the present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0128] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0129] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0130] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0131] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0132] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0133] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0134] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0135] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A method for determining an attack source tracing path, characterized in that: Applicable to computer equipment, including: Obtain the time of loss of the lost device, and determine the loss time range according to the time of loss and a preset time window; Acquiring communication behavior data of the compromised device within the compromised time range; For the communication behavior data between each network device and the compromised device, if the communication behavior data exceeds the standard range of the communication behavior baseline, the probability that each network device is an attack address is calculated based on the communication behavior data, wherein the communication behavior baseline is pre-constructed; If the probability that any network device is an attack address exceeds a malicious probability threshold, a communication behavior graph is constructed based on the communication behavior data between any network device and the compromised device; Based on any of the network devices, iteratively perform the following steps: Acquire historical communication data of any network device within the loss time range to determine a communication behavior set of any network device; In the communication behavior set of any one of the network devices, according to the historical communication data, calculating the probability that each IP address communicating with any one of the network devices is an attack address; If the probability that any IP address is an attack address exceeds the malicious probability threshold, then adding the any IP address to the communication behavior graph; If the probability that all IP addresses communicating with any of the network devices are attack addresses does not exceed the malicious probability threshold, the iteration process ends; Based on the determined communication behavior graph, starting from the compromised device, all potential attack paths are retrieved from back to front; In each potential attack path, calculate the cumulative probability of each potential attack path; The potential attack path with the largest cumulative probability is determined as the attack source tracing path.

2. The method according to claim 1, characterized in that: The calculating the probability that each network device is an attack address includes: Obtain the number of consecutive communication days between each network device and the compromised device; Obtain the daily communication times between each network device and the compromised device; Obtaining the number of port types for each network device to communicate with the victim device; Obtaining the number of domain names that each network device communicates with the compromised device; Obtaining the number of website categories through which each network device communicates with the compromised device; The number of consecutive communication days, the number of daily communications, the number of port types, the number of domain names and the number of website categories are input into an attack probability calculation formula to determine the probability that each network device is an attack address.

3. The method according to claim 2, characterized in that The attack probability calculation formula is: Where P y represents the probability that each network device is an attack address; Per represents the number of consecutive communication days between each network device and the compromised device; C represents the number of daily communications between each network device and the compromised device; N p Indicates the number of port types for each network device to communicate with the victim device; N d Indicates the number of domain names that each network device communicates with the compromised device; N u It represents the number of website categories that each network device communicates with the compromised device; ω1, ω2, ω3, ω4, and ω5 are weight coefficients.

4. The method according to claim 1, characterized in that: The process of constructing the communication behavior baseline includes: Continuously collect multi-source communication data of the compromised device within a preset time period, wherein the multi-source communication and data at least include the number of daily communications, the number and types of port types, the number of domain name categories, and the number of website category numbers; Performing a cleaning operation on the multi-source communication data; Calculate the average daily number of connections of the compromised device within the preset time period according to the daily number of connections; According to the number and types of the port types, statistics are collected on the proportion of each type of port in the communication of the compromised device and the distribution of usage frequencies; According to the number of domain name categories, analyze the access popularity and change trend of domain names in different categories; Determining, based on the number of URL categories, the correlation between the URL categories in the communication of the compromised device; Based on the average daily number of connections, the proportion of each type of port in the communication of the compromised device and the frequency of use distribution, the access popularity and change trend of the different categories of domain names and the mutual correlation between the various URL categories in the communication of the compromised device, the communication behavior baseline is constructed, and the communication behavior baseline is used to define the standard range of communication behavior of the compromised device under normal operating conditions.

5. The method according to claim 1, characterized in that The step of calculating the cumulative probability of each potential attack path in each potential attack path includes: In the determined communication behavior graph, obtaining the probability that each node is an attack address; The product of the probability that each node in each potential attack path is an attack address is determined as the cumulative probability of each potential attack path.

6. A device for determining an attack source tracing path, characterized in that: Applicable to computer equipment, including: A loss time range determination module is used to obtain the loss time of the IoT loss device and determine the loss time range according to the loss time and a preset time window; A communication behavior set determination module, used to obtain historical communication data of the lost device within the lost time range; An attack address probability calculation module, for calculating the probability of each network device being an attack address based on the communication behavior data between each network device and the compromised device, if the communication behavior data exceeds the standard range of the communication behavior baseline, wherein the communication behavior baseline is pre-constructed; A communication behavior graph construction module, used to construct a communication behavior graph based on the communication behavior data of any network device and the compromised device if the probability that any network device is an attack address exceeds a malicious probability threshold; The iteration module is used to iteratively execute the following steps based on any of the network devices: A historical communication data acquisition unit, configured to acquire historical communication data of any network device within the loss time range to determine a communication behavior set of any network device; an attack address probability calculation unit, configured to calculate, in a communication behavior set of any one of the network devices, a probability that each IP address communicating with any one of the network devices is an attack address based on the historical communication data; A communication behavior graph construction unit, configured to add any IP address to the communication behavior graph if the probability that any IP address is an attack address exceeds the malicious probability threshold; an iteration ending unit, configured to end the iteration process if the probability that all IP addresses communicating with any of the network devices are attack addresses does not exceed the malicious probability threshold; An attack path retrieval module is used to retrieve all potential attack paths from back to front based on the determined communication behavior graph and starting from the compromised device; A path cumulative probability calculation module is used to calculate the cumulative probability of each potential attack path in each potential attack path; The attack tracing path determination module is used to determine the potential attack path with the largest cumulative probability as the attack tracing path.

7. The device according to claim 6, characterized in that The path cumulative probability calculation module, Specifically used for obtaining the probability of each node being an attack address in the determined communication behavior graph; and determining the product of the probability of each node being an attack address in each potential attack path as the cumulative probability of each potential attack path.

8. A computer device, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 5.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 5 when executed by a processor.

10. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 5 when being executed by a processor.

Images