Attack tracing method and device based on attack abstract and electronic equipment

Abstract

The invention provides an attack tracing method and device based on an attack abstract and electronic equipment. The method comprises the following steps: acquiring an abstract data value of a to-be-matched network flow; converting the abstract data value into a color value of a pixel point corresponding to the abstract data value in the image to obtain an abstract representation graph of the to-be-matched network flow; performing image matching based on the abstract representation graph and the current attack link representation graph to obtain a current image matching result; and determining an initial attack host based on an image matching result. According to the method and device provided by the invention, the abstract data value of the to-be-matched network flow is converted into the color value of the pixel point corresponding to the abstract data value in the image to obtain the abstract representation graph of the to-be-matched network flow, and the image matching is carried out based on the abstract representation graph and the current attack link representation graph to determine the initial attack host. The anti-interference capability of the attack tracing method on the interference information in the to-be-matched network flow is improved, and the accuracy of network attack tracing is further improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an attack source tracing method, device and electronic equipment based on attack summary. Background Art

[0002] The Internet has quickly become an indispensable part of people's lives. However, with the increase in Internet users, network attacks have become more frequent. As a result, the prevalence of network attacks and the network security risks they bring make network security protection particularly important. The current attack source tracing method is mainly flow correlation technology, which is divided into active flow correlation and passive flow correlation. The passive flow correlation technology refers to extracting and analyzing the characteristics of network flows, such as packet size, time interval between packets, etc., to determine whether multiple network flows belong to the same attack link.

[0003] However, attackers often add interference information to the forwarded attack flow, such as delay interference or adding interference packets, to avoid being traced. Therefore, the matching accuracy of network flow data in the current attack tracing method needs to be further improved. Summary of the invention

[0004] The present invention provides an attack source tracing method, device and electronic device based on attack summary, which are used to solve the defect of low matching accuracy of network flow data in the attack source tracing method in the prior art.

[0005] The present invention provides an attack source tracing method based on attack summary, comprising: Get the summary data value of the network flow to be matched; Converting the summary data value into the color value of a pixel corresponding to the summary data value in the image to obtain a summary representation graph of the network flow to be matched; Performing image matching based on the summary representation graph and the current attack link representation graph to obtain a current image matching result; Based on the current image matching result, the initially attacked host is determined.

[0006] According to an attack source tracing method based on attack summary provided by the present invention, the step of converting the summary data value into the color value of a pixel corresponding to the summary data value in an image to obtain a summary representation graph of the network flow to be matched includes: Convert the summary data values ​​of the two flow directions in the to-be-matched network flow into the grayscale values ​​of each pixel in the grayscale image, respectively, to obtain an upstream flow grayscale image and a downstream flow grayscale image; The grayscale value corresponding to each pixel in the upstream flow grayscale image is converted into the color value of the first color channel in the RGB image, and the grayscale value corresponding to each pixel in the downstream flow grayscale image is converted into the color value of the second color channel in the RGB image to obtain the summary representation image.

[0007] According to an attack source tracing method based on attack summary provided by the present invention, determining the initial attack host based on the current image matching result includes: The sending host of the network flow whose current image matching result is successful is used as the next springboard host, and the summary representation graphs of all ingress flows of the next springboard host are matched. Until all current image matching results of the next springboard host fail, the initial attacking host is obtained based on the current image matching results of the network flow under the global network area.

[0008] According to an attack source tracing method based on attack summary provided by the present invention, the current image matching result of the network flow under the global network area is based on the initial attack host, which includes: When the current image matching results of all network flows in the global network area are failures, the last next jump board host is used as the initial attack host.

[0009] According to an attack source tracing method based on attack summary provided by the present invention, the image matching is performed based on the summary representation graph and the current attack link representation graph to obtain the current image matching result, including: Based on the summary representation graph of the previous image matching result being a successful match, obtaining the current attack link representation graph; Performing image matching on the summary representation graph and the current attack link representation graph to obtain image correlation; The current image matching result is obtained based on the image correlation and a preset matching threshold.

[0010] According to an attack source tracing method based on attack summary provided by the present invention, the summary representation graph based on the previous image matching result being a successful match is obtained to obtain the current attack link representation graph, including: In the case where there is only the first historical springboard host, using the attack flow summary representation graph received by the victim host as the current attack link representation graph; In the case where there are multiple historical springboard hosts, based on the image matching weight of the summary representation graph in which the previous image matching result is a successful match and the image matching weight of the historical attack link representation graph, the summary representation graph in which the previous image matching result is a successful match and the historical attack link representation graph are combined to obtain the current attack link representation graph.

[0011] The present invention also provides an attack source tracing device based on attack summary, the device comprising: An acquisition unit, which acquires a summary data value of a network flow to be matched; A graph representation unit, converting the summary data value into a color value of a pixel corresponding to the summary data value in an image, to obtain a summary representation graph of the network flow to be matched; A matching unit, performing image matching based on the summary representation graph and the current attack link representation graph to obtain a current image matching result; The attack source tracing unit determines the initial attack host based on the current image matching result.

[0012] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, an attack tracing method based on an attack summary as described above is implemented.

[0013] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the attack tracing method based on the attack summary as described above is implemented.

[0014] The present invention also provides a computer program product, including a computer program, wherein when the computer program is executed by a processor, the attack tracing method based on the attack summary as described above is implemented.

[0015] The attack summary-based attack tracing method, device and electronic device provided by the present invention obtain a summary representation graph of the network flow to be matched by converting the summary data value of the network flow to be matched into the color value of the pixel point corresponding to the summary data value in the image, and perform image matching based on the summary representation graph and the current attack link representation graph to determine the initial attack host, thereby improving the anti-interference ability of the attack tracing method to the interference information in the matching network flow, thereby improving the accuracy of tracing the network attack. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 It is a flowchart of the attack source tracing method based on attack summary provided by the present invention; Figure 2 It is a schematic diagram of a process of determining an initially attacked host provided by the present invention; Figure 3 It is a schematic diagram of a process for determining an attack link representation diagram provided by the present invention; Figure 4 This is one of the schematic diagrams of the tracing accuracy of the attack tracing method based on attack summary provided by the present invention; Figure 5 This is the second schematic diagram of the tracing accuracy of the attack tracing method based on attack summary provided by the present invention; Figure 6 It is a structural schematic diagram of an attack source tracing device based on attack summary provided by the present invention; Figure 7 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0019] The Internet has quickly become an integral part of people's lives. However, as the number of Internet users increases, cyber attacks have become more frequent. At the same time, the types of cyber attacks are also expanding, including distributed denial of service (DDoS) attacks, phishing, malware, etc.

[0020] Detecting and tracing the source of network attacks are two important means of dealing with network threats. However, attackers often use various strategies to avoid tracing the source, such as using fake IP addresses or anonymous networks. A common strategy used by attackers is to use a jump host to forward the attack traffic, making it difficult for the victim host to directly determine the source of the attack. This type of attack is called a jump attack. In a jump attack, the attacker usually uses a series of jump hosts as forwarding nodes. The attacker first sends the attack flow to a jump host, which then forwards it through multiple jump hosts and finally reaches the victim host. At this time, the victim host can only determine that the attack traffic comes from the last jump host, but cannot determine the original attack host.

[0021] The current attack source tracing method is mainly flow correlation technology, which is divided into active flow correlation and passive flow correlation. The passive flow correlation technology refers to extracting and analyzing the characteristics of network flows, such as packet size, time interval between packets, etc., to determine whether multiple network flows belong to the same attack link. Passive flow correlation technology does not require modification of network traffic, so it has better concealment and can largely prevent the behavior of tracing network attacks from being discovered by attackers. Therefore, this tracing method is widely used in attack tracing.

[0022] However, attackers often add interference information to the forwarded attack flow, such as delay interference or adding interference data packets, which reduces the accuracy of network flow data matching, thereby increasing the difficulty of tracing the source. To address this problem, the present invention provides an attack tracing method based on attack summary to achieve strong anti-interference ability and accurate network attack tracing. Figure 1 is a flow chart of the attack source tracing method based on attack summary provided by the present invention, such as Figure 1 As shown, the method includes: Step 110, obtaining the summary data value of the network flow to be matched; Here, the network flow to be matched refers to the network flow received by the host that sends out the attack network flow received by the victim host. This host can be used as the current springboard host, and the inlet network flow of the current springboard host can be used as the network flow to be matched. The network flow containing the attack information in the inlet network flow of the current springboard host is matched and determined, and then the next springboard host is traced until the original attack host is traced back.

[0023] In addition, the summary data value here refers to a data value used to reflect the characteristics of the network flow. The summary data value here can be the length of the data packet and the interval time between data packets.

[0024] Specifically, the inlet flow of the springboard host can be captured by a network flow analysis tool, and the packet length and packet interval time in the network flow can be used as the summary data value of the network flow to be matched. It can be understood that the summary data value here can be used as a basis for determining whether the network flow to be matched contains attack information.

[0025] Step 120, converting the summary data value into the color value of the pixel corresponding to the summary data value in the image, to obtain a summary representation graph of the network flow to be matched; Specifically, first, the image can be divided into multiple pixels. For example, the image area can be discretized into pixels. In detail, the vertical coordinate of the grayscale image can be used to represent the packet length, with 0 at the top and 1 at the bottom; the horizontal coordinate of the grayscale image can be used to represent the time interval between packets, with 0 at the far left and 1 at the far right. Set the grayscale value of each pixel on the image to 0. Thus, the entire range from 0 to 1 is discretized into 64 intervals, and the width of each interval is , in order to map the summary data values ​​to specific areas of the image. Therefore, from the 1st interval to the 64th interval are , , ..., .

[0026] Then, the summary data values ​​of the two flows in the network flow to be matched can be converted into the grayscale values ​​of each pixel in the grayscale image to obtain the grayscale image of the upstream flow and the grayscale image of the downstream flow. For example, the normalized length value of data packet A in the network flow to be matched is , the packet time interval is , then the data packet A can be mapped to the coordinate point A in the image ( , ). Finally, the summary representation of the network flow to be matched can be obtained by combining the grayscale image of the upstream flow and the grayscale image of the downstream flow.

[0027] It should be noted that by converting the summary data value into the pixel point corresponding to the summary data value in the image and realizing discrete processing of the summary data value, the summary data with a certain disturbance can still be mapped to the same pixel point, thereby reducing the influence of the interference information in the attack flow on the generation of the summary representation graph, and then reducing the influence of the interference information in the attack flow on the network flow data matching, thereby greatly improving the accuracy of network flow summary data matching.

[0028] Step 130, performing image matching based on the summary representation graph and the current attack link representation graph to obtain a current image matching result; Here, the color value features of the current attack link representation graph can be used to reflect the network attack suffered by the victim host and the features of the network flow summary data in the known attack link.

[0029] Specifically, in the process of matching the network flow of the first springboard host, the attack flow summary representation graph of the victim host is used as the current attack link representation graph here. The generation steps of the attack flow summary representation graph here are the same as the generation method of the summary representation graph of the network flow to be matched. In the process of matching the network flow of the non-first springboard host, the current attack link representation graph can be obtained by combining the historical attack link representation graph and the successfully matched summary representation graph.

[0030] Then, the summary representation graph and the current attack link representation graph can be input into the image matching model, and the matching correlation between the two images can be output by the image matching model. The matching correlation between the summary representation graph and the current attack link representation graph can be used as the current image matching result. The current image matching result here can reflect the correlation between the network flow corresponding to the summary representation graph and the current attack link. Finally, the matching correlation of the summary representation graphs of all the network flows to be matched can be compared with the preset matching threshold, and the current image matching result of the network flow with the highest matching degree can be recorded as a successful match.

[0031] Step 140: determining the initial attack host based on the current image matching result.

[0032] Specifically, the sending host of the network flow whose current image matching result is a successful match is used as the next jump board host, and the image matching of the summary representation graph of all the inlet flows of the next jump board host is repeatedly performed until all the current image matching results of the next jump board host are failed, and the current image matching results of the network flows within the global network area are also failed, then the last next jump board host can be used as the initial attack host. Here, the initial attack host refers to the host that initially launches the network attack.

[0033] The method provided by the embodiment of the present invention obtains a summary representation graph of the network flow to be matched by converting the summary data value of the network flow to be matched into the color value of the pixel point corresponding to the summary data value in the image, and performs image matching based on the summary representation graph and the current attack link representation graph to determine the initial attack host, thereby improving the anti-interference ability of the attack tracing method to the interference information in the matching network flow, thereby improving the accuracy of attack tracing.

[0034] Based on any of the above embodiments, step 120 includes: Convert the summary data values ​​of the two flow directions in the to-be-matched network flow into the grayscale values ​​of each pixel in the grayscale image, respectively, to obtain an upstream flow grayscale image and a downstream flow grayscale image; The grayscale value corresponding to each pixel in the upstream flow grayscale image is converted into the color value of the first color channel in the RGB image, and the grayscale value corresponding to each pixel in the downstream flow grayscale image is converted into the color value of the second color channel in the RGB image to obtain the summary representation image.

[0035] Here, the upstream flow grayscale image and the downstream flow grayscale image can respectively reflect the summary data features of the upstream flow and the downstream flow in the network flow to be matched.

[0036] Specifically, the network flow to be matched can be regarded as a bidirectional flow, and the upstream flow grayscale image and the downstream flow grayscale image can be obtained by converting the summary data values ​​of the two flow directions in the network flow to be matched into the grayscale values ​​of each pixel area in the grayscale image.

[0037] In detail, for each initial grayscale image, it can be divided into pixel area, that is The initial grayscale value of each pixel area is 0. By traversing the summary data values ​​of each data packet in the single-direction network flow, the normalized length and time interval of each data packet can be extracted, and the corresponding pixel on the grayscale image can be located according to the data, and the grayscale value of the pixel can be increased by 1. It should be noted that the normalization of the summary data value here can be achieved by the following formula, as shown in the following formula:

[0038] In the formula, Represents the normalized summary data value; Indicates the summary data value of the network flow being processed and to be matched; Indicates the minimum summary data value in the network flow to be matched being processed; Indicates the maximum summary data value in the network flow to be matched being processed. It should be noted that all summary data values ​​of the network flow to be matched will be normalized to between 0 and 1.

[0039] Next, the grayscale value corresponding to each pixel in the grayscale image of the upstream flow can be converted into the color value of the first color channel in the RGB image, and the grayscale value corresponding to each pixel in the grayscale image of the downstream flow can be converted into the color value of the second color channel in the RGB image. For example, the grayscale value corresponding to each pixel in the grayscale image of the upstream flow can be converted into the color value of the blue channel of the RGB image; the grayscale value corresponding to each pixel in the grayscale image of the downstream flow can be converted into the color value of the green channel in the RGB image, and the color value corresponding to the red channel can be set to 0, thereby obtaining a summary representation graph. It can be understood that, compared with grayscale images, RGB multi-channel images can more clearly and accurately reflect the data characteristics of the bidirectional flow of the network flow to be matched, thereby improving the matching accuracy and reliability of the summary representation graph obtained based on the summary data value.

[0040] Based on any of the above embodiments, step 140 includes: The sending host of the network flow whose current image matching result is successful is used as the next springboard host, and the summary representation graphs of all ingress flows of the next springboard host are matched. Until all current image matching results of the next springboard host fail, the initial attacking host is obtained based on the current image matching results of the network flow under the global network area.

[0041] Specifically, the sending host of the network flow with a successful current image matching result can be used as the next springboard host. Then, all the inlet flows of the next springboard host are used as the network flows to be matched of the next springboard host. The network flows to be matched of the next springboard host are matched to obtain the current image matching results of all the network flows to be matched of the next springboard host. It can be understood that when there is a case where the current image matching result is a successful match, the host to which the successfully matched network flow belongs can continue to be used as the next springboard host, and the network flow matching of the next springboard host in the next round can be performed, until the current image matching results of all the next springboard hosts fail, and the initial attack host is obtained based on the current image matching results of the network flows under the global network area.

[0042] Compared with the prior art, the initial attack host is determined directly by analyzing the data features of the network flow. The method provided by the embodiment of the present invention uses the host to which the network flow with the current image matching result being successful belongs as the next springboard host, and matches the summary representation graph of the network flow to be matched of the next springboard host, until all the current image matching results of the next springboard host are failed, and the initial attack host is obtained based on the current image matching results of the network flow under the global network area, so as to realize the step-by-step determination of the springboard host in the network attack process, and further improve the accuracy of network attack tracing.

[0043] It should be noted that, since not all the springboard hosts that forward the attack flow are within the monitoring range of the Internet service provider, the tracing process may be interrupted at these hosts. Based on any of the above embodiments, the initial attack host is obtained based on the current image matching result of the network flow under the global network area, including: When the current image matching results of all network flows in the global network area are failures, the last next jump board host is used as the initial attack host.

[0044] Specifically, when the current image matching results of all the next springboard hosts are failed, it means that the matching correlation of all network flows in the inlet flow of this springboard host with the current attack link representation graph is less than the preset threshold. Thus, the matching results of the network flows in the global network area can be obtained, that is, the network flows in the entire network monitoring range are taken as the network flows to be matched, and the summary representation graph of the network flows in the global network area is matched with the current attack link representation graph to obtain the current image matching results of the network flows in the global network area.

[0045] It is understandable that when the summary representation graph of the network flow under the global network area is matched, if the current image matching result is successful, the next jump board host can be successfully determined. The next jump board host determined here may have multiple jump board hosts between it and the previous jump board host, but it has not been traced, but it does not affect the tracing of the original attack host. Therefore, by matching the summary representation graph of the network flow under the global network area, "multi-hop iteration" is achieved to obtain the final original attack host, overcoming the problem that some jump board hosts cannot be traced outside the monitoring range of the Internet service provider, and improving the comprehensiveness and accuracy of the attack tracing method.

[0046] It should be noted that when image matching is performed on the summary representation graph of the network flow in the global network area, the preset threshold for comparing the image matching degree can be appropriately lower than the preset threshold for single-hop iteration. For example, the preset threshold for single-hop iteration is usually 80%, then the preset threshold here can be 60%.

[0047] If the current image matching result of any network flow is a successful match, the network flow with the highest matching degree is selected, and the host from which the network flow is sent can be used as the next jump board host. Then, the image matching of the summary representation graph of the network flow is repeated, that is, a single-hop iteration is performed. If the single-hop iteration is interrupted again, the image matching of all network flows in the global network area is performed.

[0048] When the current image matching result of the network flow in the global network area fails, it means that there is no network flow matching the current attack link representation graph in the global network area, and it can be considered that the last next jump board host is the initial attack host.

[0049] For example, in one embodiment, Figure 2 : is a flow chart of determining the initial attack host provided by the present invention, such as Figure 2As shown, the process includes: first, a single-hop iteration is performed, that is, the attack link representation graph is matched with each inlet flow of the current jump board host to determine whether a matching inlet flow is found. If found, the next jump board host, that is, the sending host of the successfully matched inlet flow, is successfully determined. Then, the attack link representation graph is updated based on the summary representation graph of the successfully matched inlet flow, and step 1: single-hop iteration is repeated. If no matching inlet flow is found, step 2: multi-hop iteration is performed, that is, matching network flows are searched in the entire monitoring range to determine whether a matching network flow is found. If found, the next jump board host is successfully determined, and the attack link representation graph is updated based on the summary representation graph of the successfully matched network flow, and step 1: single-hop iteration is repeated. In the multi-hop iteration, if no matching network flow is found, the last jump board host is used as the initial attack host.

[0050] The method provided by the embodiment of the present invention uses single-hop iteration and multi-hop iteration methods to determine the initial attack host of the entire attack link, targeting the problem of jump-off hosts in network attacks and the problem that a certain jump-off host is outside the monitoring range of an Internet service provider, thereby achieving comprehensive and accurate tracing of network attacks.

[0051] Based on any of the above embodiments, step 130 includes: Based on the summary representation graph of the previous image matching result being a successful match, obtaining the current attack link representation graph; Performing image matching on the summary representation graph and the current attack link representation graph to obtain image correlation; The current image matching result is obtained based on the image correlation and a preset matching threshold.

[0052] Specifically, first, the historical attack link representation graph may be updated based on the summary representation graph in which the previous image matching result is a successful match, to obtain the current attack link representation graph.

[0053] Then, the summary representation graph to be matched and the current attack link representation graph can be input into the image matching model constructed based on the convolutional neural network, and the image relevance of the summary representation graph can be output through the image matching model. Here, the convolutional neural network consists of three convolutional layers and three fully connected layers. After each convolutional layer, there is a maximum pooling layer. In order to facilitate the update of the subsequent attack link representation graph, an attention layer is added after the last fully connected layer to obtain the attention weights of CNN (Convolutional Neural Networks) for different parts of the input image, that is, the image matching weights of the image sub-regions. That is, in the updating process, the attention layer in the convolutional neural network is needed. The attention layer in the CNN-based matching algorithm can use the attention mechanism to generate a heat map, showing the image area that CNN pays special attention to during the matching process. In this way, the advantages of convolutional neural networks in image matching are utilized to complete network attack tracing with high precision.

[0054] Furthermore, the image correlation of the entire summary representation graph can be compared with a preset matching threshold. When the image correlation is greater than or equal to the preset matching threshold, the current image matching result of the network flow with the highest matching degree is recorded as a successful match. When the matching degrees are all less than the preset matching threshold, the current image matching result is considered to be a failed match.

[0055] The method provided by the embodiment of the present invention converts the parameter data of the network flow to be matched into the color value data of the summary representation image, and reflects the correlation of the attack features between the two network flows through the correlation of image matching, thereby greatly improving the accuracy of tracing the source of network attacks.

[0056] Based on any of the above embodiments, the summary representation graph based on the previous image matching result being a successful match, obtaining the current attack link representation graph, includes: In the case where there is only the first historical springboard host, using the attack flow summary representation graph received by the victim host as the current attack link representation graph; In the case where there are multiple historical springboard hosts, based on the image matching weight of the summary representation graph in which the previous image matching result is a successful match and the image matching weight of the historical attack link representation graph, the summary representation graph in which the previous image matching result is a successful match and the historical attack link representation graph are combined to obtain the current attack link representation graph.

[0057] Specifically, when there is only the first historical jump board host, that is, when matching the entry flow of the jump board host for the first time, the attack flow summary representation graph received by the victim host can be used as the current attack link representation graph, which is used to perform image matching with the summary representation graph of the network flow to be matched, and determine the next jump board host. When there are multiple historical jump board hosts, it means that the network flow that has been successfully matched contains attack information, then based on the image matching weight of the summary representation graph whose previous image matching result is a successful match and the image matching weight of the historical attack link representation graph, the summary representation graph whose previous image matching result is a successful match and the historical attack link representation graph can be combined to obtain the current attack link representation graph.

[0058] For example, when there is only the first historical jumppoint host, the current attack link representation graph can be obtained by combining the successfully matched summary representation graph with the attack flow summary representation graph. Here, the combination of the current attack link representation graph can be achieved by the following formula, as shown in the following formula:

[0059] In the formula, Indicates the current attack link representation diagram obtained after successful matching when only the first historical springboard host exists; A summary representation diagram of the attack flow is shown; It represents the result of normalizing the heat map of the attack flow at the victim host during the matching process of the convolutional neural network, that is, the image matching weight of the attack flow summary representation graph; Indicates the summary diagram of successful matching when only the first historical springboard host exists; The image matching weight of the summary representation graph indicating a successful match.

[0060] In the case where there are multiple historical springboard hosts, that is, when the non-first image matching result is a successful match, the current attack link representation graph can be obtained by combining the summary representation graph of the last successful match and the historical attack link representation graph obtained by the last update. For example, this can be achieved by the following formula, as shown below:

[0061] In the formula, represents the updated current attack link representation graph; Indicates the attack link representation diagram obtained by the last update; A summary graph showing the last successful match; represents the image matching weight. Among them, Assign a weight to each pixel of the latest determined summary representation graph, then add the weighted network flow image and the attack link representation graph obtained in the last update, normalize the obtained result and distribute it within the maximum color value range, and the obtained image is the attack link representation graph.

[0062] It should be noted that each time a network flow on the attack link is confirmed, the above process is executed to update the current attack link representation graph. After multiple iterations, the color values ​​of some areas of the attack link representation graph will be significantly higher than other parts, which reflects the characteristics of the entire attack link. When tracing back to the initial attack host, the image shows the characteristics of the entire attack link from the initial attack host to the victim host.

[0063] The method provided by the embodiment of the present invention uses the image matching weights generated by the convolutional neural network to emphasize the more important parts in the attack flow representation graph, and adds them to the current attack link representation graph, so as to more clearly reflect the characteristics of the attack link, thereby making the matching of the summary representation graph of the network flow more accurate and more reliable.

[0064] Figure 3 It is a schematic diagram of the process of determining the attack link representation diagram provided by the present invention, such as Figure 3 As shown in the figure, the process includes: first, input the attack link representation graph and the summary representation graph of the network flow to be matched into the convolutional neural network, and output the matching result through the convolutional neural network. It should be noted that for the attack link representation graph, when there is only the first historical jump board host, the summary representation graph of the attack flow at the victim host is used instead. Then, it is determined whether the match is successful. If the match fails, the network flow that may be on the attack link is reselected for matching, for example, other inlet flows of the host, or other network flows within the entire monitoring range. If the match is successful, the attack link representation graph is updated (generated) through the attack link representation graph update (generation) algorithm, and the next network flow is matched.

[0065] Based on any of the above embodiments, simulation experiments show that the attack tracing method based on attack summary proposed in the present invention can still complete the attack chain tracing and the initial attack host tracing with high accuracy when there is interference information in the attack flow and some jump hosts are outside the monitoring range of the Internet service provider, and has a good network attack tracing effect. Figure 4 This is one of the schematic diagrams of the tracing accuracy of the attack tracing method based on attack summary provided by the present invention, such as Figure 4As shown in the figure, the attack host tracing accuracy and attack link tracing accuracy are shown when the number of all hosts in the global monitoring range is 20 and the number of springboard hosts changes from 1 to 10. It can be found that when the number of hosts in the global range is 20 and the number of springboard hosts is less than 6, the attack host tracing and attack link tracing can be completed with a higher accuracy. Figure 5 This is the second schematic diagram of the tracing accuracy of the attack tracing method based on attack summary provided by the present invention. Figure 5 As shown in the figure, the attack host tracing accuracy and attack link tracing accuracy are shown when the number of springboard hosts on the attack chain is 5 and the number of all hosts in the global scope changes from 5 to 50. It can be found that when the number of springboard hosts is 5 and the number of all hosts in the monitoring range is less than 25, the attack host tracing and attack link tracing can be completed with a higher accuracy.

[0066] Based on any of the above embodiments, Figure 6 is a schematic diagram of the structure of the attack source tracing device based on attack summary provided by the present invention, such as Figure 6 As shown, the device comprises: An acquisition unit 610 acquires a summary data value of a network flow to be matched; A graph representation unit 620 converts the summary data value into a color value of a pixel corresponding to the summary data value in an image to obtain a summary representation graph of the network flow to be matched; A matching unit 630 performs image matching based on the summary representation graph and the current attack link representation graph to obtain a current image matching result; The attack source tracing unit 640 determines the initial attack host based on the current image matching result.

[0067] The device provided by the embodiment of the present invention obtains a summary representation graph of the network flow to be matched by converting the summary data value of the network flow to be matched into the color value of the pixel point corresponding to the summary data value in the image, and performs image matching based on the summary representation graph and the current attack link representation graph to determine the initial attack host, thereby improving the anti-interference ability of the attack tracing method to the interference information in the matching network flow, thereby improving the accuracy of tracing the network attack.

[0068] Based on any of the above embodiments, the graph representation unit is specifically used for: Convert the summary data values ​​of the two flow directions in the to-be-matched network flow into the grayscale values ​​of each pixel in the grayscale image, respectively, to obtain an upstream flow grayscale image and a downstream flow grayscale image; The grayscale value corresponding to each pixel in the upstream flow grayscale image is converted into the color value of the first color channel in the RGB image, and the grayscale value corresponding to each pixel in the downstream flow grayscale image is converted into the color value of the second color channel in the RGB image to obtain the summary representation image.

[0069] Based on any of the above embodiments, the attack tracing unit is specifically used for: The sending host of the network flow whose current image matching result is successful is used as the next springboard host, and the summary representation graphs of all ingress flows of the next springboard host are matched. Until all current image matching results of the next springboard host fail, the initial attacking host is obtained based on the current image matching results of the network flow under the global network area.

[0070] Based on any of the foregoing embodiments, the attack tracing unit is further specifically configured to: When the current image matching results of all network flows in the global network area are failures, the last next jump board host is used as the initial attack host.

[0071] Based on any of the above embodiments, the matching unit is specifically used for: Based on the summary representation graph of the previous image matching result being a successful match, obtaining the current attack link representation graph; Performing image matching on the summary representation graph and the current attack link representation graph to obtain image correlation; The current image matching result is obtained based on the image correlation and a preset matching threshold.

[0072] Based on any of the above embodiments, the matching unit is further specifically configured to: In the case where there is only the first historical springboard host, using the attack flow summary representation graph received by the victim host as the current attack link representation graph; In the case where there are multiple historical springboard hosts, based on the image matching weight of the summary representation graph in which the previous image matching result is a successful match and the image matching weight of the historical attack link representation graph, the summary representation graph in which the previous image matching result is a successful match and the historical attack link representation graph are combined to obtain the current attack link representation graph.

[0073] Figure 7 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 7As shown, the electronic device may include: a processor 710, a communication interface 720, a memory 730 and a communication bus 740, wherein the processor 710, the communication interface 720 and the memory 730 communicate with each other through the communication bus 740. The processor 710 may call the logic instructions in the memory 730 to execute the attack source tracing method based on the attack summary, the method comprising: obtaining the summary data value of the network flow to be matched; converting the summary data value into the color value of the pixel corresponding to the summary data value in the image to obtain the summary representation graph of the network flow to be matched; performing image matching based on the summary representation graph and the current attack link representation graph to obtain the current image matching result; determining the initial attack host based on the current image matching result.

[0074] In addition, the logic instructions in the above-mentioned memory 730 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0075] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the attack tracing method based on the attack summary provided by the above methods, and the method includes: obtaining the summary data value of the network flow to be matched; converting the summary data value into the color value of the pixel point corresponding to the summary data value in the image to obtain the summary representation graph of the network flow to be matched; performing image matching based on the summary representation graph and the current attack link representation graph to obtain the current image matching result; determining the initial attack host based on the current image matching result.

[0076] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the attack tracing method based on attack summaries provided by the above-mentioned methods, the method comprising: obtaining a summary data value of a network flow to be matched; converting the summary data value into a color value of a pixel point in an image corresponding to the summary data value, to obtain a summary representation graph of the network flow to be matched; performing image matching based on the summary representation graph and a current attack link representation graph, to obtain a current image matching result; and determining the initial attack host based on the current image matching result.

[0077] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0078] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0079] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An attack source tracing method based on attack summary, characterized in that: include: Get the summary data value of the network flow to be matched; Converting the summary data value into the color value of a pixel corresponding to the summary data value in the image to obtain a summary representation graph of the network flow to be matched; Performing image matching based on the summary representation graph and the current attack link representation graph to obtain a current image matching result; Based on the current image matching result, the initially attacked host is determined.

2. The attack source tracing method based on attack summary according to claim 1 is characterized in that: The step of converting the summary data value into a color value of a pixel corresponding to the summary data value in an image to obtain a summary representation graph of the network flow to be matched includes: Convert the summary data values ​​of the two flow directions in the to-be-matched network flow into the grayscale values ​​of each pixel in the grayscale image, respectively, to obtain an upstream flow grayscale image and a downstream flow grayscale image; The grayscale value corresponding to each pixel in the upstream flow grayscale image is converted into the color value of the first color channel in the RGB image, and the grayscale value corresponding to each pixel in the downstream flow grayscale image is converted into the color value of the second color channel in the RGB image to obtain the summary representation image.

3. The attack source tracing method based on attack summary according to claim 1 is characterized in that: The determining the initial attack host based on the current image matching result includes: The sending host of the network flow whose current image matching result is successful is used as the next springboard host, and the summary representation graphs of all ingress flows of the next springboard host are matched. Until all current image matching results of the next springboard host fail, the initial attacking host is obtained based on the current image matching results of the network flow under the global network area.

4. The attack source tracing method based on attack summary according to claim 3 is characterized in that: The method of obtaining the initial attack host based on the current image matching result of the network flow in the global network area includes: When the current image matching result of all network flows in the global network area is a failure, the last next jump board host is used as the initial attack host.

5. The attack source tracing method based on attack summary according to any one of claims 1 to 4, characterized in that: The performing image matching based on the summary representation graph and the current attack link representation graph to obtain a current image matching result includes: Based on the summary representation graph of the previous image matching result being a successful match, obtaining the current attack link representation graph; Performing image matching on the summary representation graph and the current attack link representation graph to obtain image correlation; The current image matching result is obtained based on the image correlation and a preset matching threshold.

6. The attack source tracing method based on attack summary according to claim 5 is characterized in that: The summary representation graph based on the previous image matching result being a successful match, obtaining the current attack link representation graph, includes: In the case where there is only the first historical springboard host, using the attack flow summary representation graph received by the victim host as the current attack link representation graph; In the case where there are multiple historical springboard hosts, based on the image matching weight of the summary representation graph in which the previous image matching result is a successful match and the image matching weight of the historical attack link representation graph, the summary representation graph in which the previous image matching result is a successful match and the historical attack link representation graph are combined to obtain the current attack link representation graph.

7. An attack source tracing device based on attack summary, characterized in that: include: An acquisition unit, which acquires a summary data value of a network flow to be matched; A graph representation unit, converting the summary data value into a color value of a pixel corresponding to the summary data value in an image, to obtain a summary representation graph of the network flow to be matched; A matching unit, performing image matching based on the summary representation graph and the current attack link representation graph to obtain a current image matching result; The attack source tracing unit determines the initial attack host based on the current image matching result.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the attack tracing method based on attack summary as described in any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the attack source tracing method based on attack summary as claimed in any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the attack source tracing method based on attack summary as claimed in any one of claims 1 to 6 is implemented.

Images