Attack detection method and device, computer program product and electronic equipment

Abstract

The invention discloses an attack detection method and device, a computer program product and electronic equipment. The method relates to the field of security detection or other related fields, and comprises the following steps: obtaining a plurality of access requests and response data of each access request, a target domain name included in each access request being used for a domain name server to analyze to obtain a target IP address; processing a plurality of data pairs formed by the plurality of access requests and the response data of each access request to generate a time sequence corresponding to the access of the same client to the target domain name, a plurality of survival time fields included in the time sequence being obtained by respectively analyzing the plurality of data pairs; performing sequence evaluation processing on the time sequence to obtain a target sequence index; and determining whether the target IP address is a malicious address according to the target sequence index. Through the method and the device, the problem that whether the target IP address is malicious or not is difficult to accurately distinguish in related technologies is solved.

Description

Technical Field

[0001] The present application relates to the field of security detection or other related fields, and specifically, to an attack detection method, device, computer program product, and electronic device. Background Art

[0002] Attackers use DNS (Domain Name System) to conduct activities in a variety of ways. This is mainly because DNS is a key component of the Internet infrastructure, providing address resolution services worldwide, and its traffic is considered necessary and legitimate in many networks, making it an ideal channel for malicious actors to hide their activities.

[0003] For example, malware (or attackers) can use DNS hijacking (also known as DNS redirection attack) to return malicious IP addresses to users, causing them to be redirected to malicious websites. Malware may also use the TTL (Time To Live) value feature of DNS to frequently change malicious domain names or IP addresses to avoid detection and blocking. Existing malware detection methods mostly focus on the frequency, pattern, and content of DNS requests when analyzing DNS traffic, but these methods have difficulty accurately distinguishing whether the destination IP address is malicious. Summary of the invention

[0004] The main purpose of the present application is to provide an attack detection method, device, computer program product and electronic device.

[0005] In order to achieve the above-mentioned purpose, according to one aspect of the present application, an attack detection method is provided. The method includes: obtaining multiple access requests and response data of each access request, wherein the target domain name included in each access request is used for the domain name server to resolve and obtain the target IP address; processing multiple data pairs formed by the multiple access requests and the response data of each access request to generate a time series corresponding to the same client accessing the target domain name, wherein the multiple survival time fields included in the time series are obtained by respectively resolving the multiple data pairs; performing sequence evaluation processing on the time series to obtain a target sequence index; and determining whether the target IP address is a malicious address according to the target sequence index.

[0006] Furthermore, multiple data pairs formed by multiple access requests and response data of each access request are processed to generate a time series corresponding to the client accessing the target domain name, including: obtaining the time when each access request is issued to obtain multiple timestamps; and sorting multiple lifetime fields according to the multiple timestamps to obtain a time series.

[0007] Furthermore, the time series is subjected to sequence evaluation processing to obtain a target sequence index, including: calculating the means of multiple survival time fields to obtain a sequence mean; calculating differences between multiple survival time fields and the sequence mean to obtain multiple field differences; determining a cumulative sum sequence based on multiple field differences, and obtaining a target sequence index based on the cumulative sum sequence calculation.

[0008] Furthermore, the difference between multiple survival time fields and the sequence mean is calculated to obtain multiple field differences, including: for the i-th survival time field among the multiple survival time fields, the sum of the first survival time field to the i-th survival time field is calculated to obtain the total survival time data, wherein i is a positive integer less than or equal to M; the difference between the total survival time data and the sequence mean is calculated to obtain the i-th field difference corresponding to the i-th survival time field.

[0009] Furthermore, calculating the target sequence index based on the cumulative sum sequence includes: dividing the cumulative sum sequence according to the data window to obtain N window sequences, where N is a positive integer; for each window sequence, fitting the window sequence using the least squares method to obtain a polynomial trend data; for each window sequence, calculating the difference between the cumulative sum sequence and the polynomial trend data corresponding to the window sequence to obtain the linear trend data corresponding to the window sequence; and calculating the target sequence index based on the linear trend data corresponding to each window sequence.

[0010] Furthermore, the target sequence index is calculated based on the linear trend data corresponding to each window sequence, including: for each window sequence, calculating the difference between the window sequence and the linear trend data corresponding to the window sequence to obtain the trend difference, and calculating the square of the trend difference to obtain the trend square data; calculating the sum of the trend square data corresponding to each window sequence to obtain the total trend square data; calculating the mean of the total trend square data according to the data window to obtain the trend mean, and calculating the square root of the trend mean to obtain the trend square root data, and determining the target sequence index from the trend square root data.

[0011] Furthermore, determining whether the target IP address is a malicious address based on the target sequence index includes: when the target sequence index is not within a preset threshold range, determining that the IP address corresponding to the target domain name is a suspected malicious address; performing query verification processing on the target domain name to obtain a query result, and performing threat matching processing on the target IP address and / or target domain name to obtain a matching result, wherein the query result is used to characterize whether the target IP address is an abnormal address, and the matching result is used to characterize whether there is a threat to the target IP address and / or target domain name; when the query result characterizes that the target IP address is an abnormal address, or the matching result characterizes that there is a threat to at least one of the target IP address and the target domain name, determining that the target IP address of the suspected malicious address is a malicious address.

[0012] In order to achieve the above-mentioned purpose, according to another aspect of the present application, an attack detection device is provided. The device includes: an acquisition unit, used to acquire multiple access requests and response data of each access request, wherein the target domain name included in each access request is used for the domain name server to resolve and obtain the target IP address; a generation unit, used to process multiple data pairs formed by the multiple access requests and the response data of each access request, and generate a time series corresponding to the same client accessing the target domain name, wherein the multiple survival time fields included in the time series are obtained by respectively parsing the multiple data pairs; a processing unit, used to perform sequence evaluation processing on the time series to obtain a target sequence index; a determination unit, used to determine whether the target IP address is a malicious address according to the target sequence index.

[0013] According to another aspect of an embodiment of the present invention, a computer storage medium is provided. The computer storage medium is used to store a program. When the program is running, the device where the computer storage medium is located is controlled to execute an attack detection method.

[0014] According to another aspect of an embodiment of the present invention, an electronic device is provided, comprising one or more processors and a memory; the memory stores computer-readable instructions, and the processor is used to execute the computer-readable instructions, wherein when the computer-readable instructions are executed, the attack detection method provided in any one of the aforementioned embodiments is executed.

[0015] According to another aspect of an embodiment of the present invention, a computer program product is provided, including a computer program. When the computer program is executed by a processor, the attack detection method provided by any one of the aforementioned embodiments is executed.

[0016] Through the present application, the following steps are adopted: obtaining multiple access requests and response data of each access request, wherein the target domain name included in each access request is used for the domain name server to resolve and obtain the target IP address; processing multiple data pairs formed by the multiple access requests and the response data of each access request to generate a time series corresponding to the same client accessing the target domain name, wherein the multiple survival time fields included in the time series are respectively obtained by parsing the multiple data pairs; performing sequence evaluation processing on the time series to obtain a target sequence index; determining whether the target IP address is a malicious address according to the target sequence index. The present application creatively considers that the attacker's modification of the TTL value will cause the TTL time series to present characteristics different from normal traffic. By processing multiple data pairs formed by the multiple access requests and the response data of each access request, a time series containing multiple survival time fields corresponding to the same client accessing the target domain name is obtained, and the time series containing multiple survival time fields is processed to obtain a target sequence index, thereby realizing a quantitative description of the TTL time series. Furthermore, by analyzing the target sequence index, it is possible to accurately identify whether the traffic data returned to the user comes from a malicious destination IP address, thereby solving the technical problem in the related art that it is difficult to accurately distinguish whether the destination IP address is malicious, and effectively improving the attack detection capability. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 is a flow chart of an attack detection method provided according to an embodiment of the present application;

[0019] Figure 2 is a schematic diagram of an optional attack detection method provided according to an embodiment of the present application;

[0020] Figure 3 is a schematic diagram of an attack detection device provided according to an embodiment of the present application;

[0021] Figure 4 is a schematic diagram of an electronic device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0022] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0023] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0024] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0025] It should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties. For example, an interface is set between this system and the relevant user or organization. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0026] It should be noted that the collected information used in this application is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse to use it.

[0027] The present invention is described below in conjunction with preferred implementation steps. Figure 1 is a flow chart of an attack detection method provided according to an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0028] Step S101, obtaining multiple access requests and response data of each access request, wherein the target domain name included in each access request is used for the domain name server to resolve and obtain the target IP address.

[0029] In some examples, the time series is a non-stationary time series.

[0030] Exemplarily, the access request may include a DNS request, and the target IP address is the target IP address corresponding to the target domain name returned when the domain name server (Domain Name Service) responds to the DNS request. The domain name server is a server that converts a domain name (domain name) and its corresponding IP address (IP address).

[0031] The domain name server's response data to the access request contains a TTL field and the IP address corresponding to the target domain name.

[0032] In order to identify risks, network monitoring tools can be used to monitor the DNS traffic in the target network environment in real time, that is, to collect multiple access requests and the response data of each access request, use these data to form a data pair, and then detect the IP address based on the data pair. It should be noted that the IP address to be detected is obtained by domain name resolution by the domain name server.

[0033] Step S102, processing multiple data pairs formed by multiple access requests and response data of each access request to generate a time series corresponding to the same client accessing the target domain name, wherein the multiple survival time fields included in the time series are obtained by respectively parsing the multiple data pairs.

[0034] In some examples, a data pair can be formed for an access request and the corresponding response data of the same client to obtain multiple data pairs corresponding to the client. The multiple data pairs are sorted according to the timestamps of each access request in the multiple data pairs to obtain multiple data pairs sorted by timestamps, and TTLs are extracted from each response data in the sorted multiple data pairs. A time series is formed for each extracted TTL in the order of timestamps, which is the time series corresponding to the client accessing the target domain name.

[0035] In some embodiments, each of the multiple data pairs corresponding to the same client may include a timestamp and a survival time field. The timestamp may be a timestamp of an access request of the client.

[0036] Exemplarily, after obtaining multiple data pairs, all data pairs can be sorted according to timestamps (for example, the time when the access request sent by the client is uniformly used as the timestamp), and the TTL (Time to Live) field in each data pair is parsed through fields to obtain a non-stationary TTL time series, that is, a time series associated with the same client accessing the target domain name. Finally, the Hurst index of the above non-stationary TTL time series is calculated using a related algorithm, and this index is used to determine whether the corresponding IP address is a malicious IP address.

[0037] Step S103, performing sequence evaluation processing on the time series to obtain a target sequence index.

[0038] In some examples, the target sequence index may be a statistic or characteristic value used to describe the characteristics of the TTL time series, such as a mean, a variance, an autocorrelation coefficient, and the like.

[0039] Exemplarily, the target sequence index may refer to the Hurst index (i.e., Hurst index) used to measure the long-term memory of time series data. When processing the above time series, the detrended fluctuation analysis algorithm may be used for processing, wherein the detrended fluctuation analysis algorithm (Detrended Fluctuation Analysis, DFA) is a method for evaluating the statistical self-similarity or long-range correlation of a time series. Since a sequence containing a trend or non-stationary component may mask a potential self-similar structure, the algorithm can remove the local trend in the above sequence and analyze the scale dependence of the remaining fluctuations. After obtaining the time series, the detrended fluctuation analysis algorithm may be used to process the time series, thereby obtaining a target sequence index that characterizes the degree of self-similarity of the sequence.

[0040] In this embodiment, by performing sequence evaluation processing on the TTL time series, it is possible to analyze whether the TTL value has abnormal changes, periodic regularity, etc. Step S104, determining whether the target IP address is a malicious address according to the target sequence index.

[0041] For example, since the target sequence index can measure the degree of self-similarity of the time series, and the time series of normal traffic is a random walk or white noise, that is, the values ​​in the time series are independent data without long-term memory, the target sequence index can be compared with the preset threshold interval to determine the target IP address based on the comparison result.

[0042] In some examples, whether the target IP address is a malicious address is determined based on whether the target sequence index is within a preset threshold range.

[0043] Here, the preset threshold interval can be pre-set according to expert experience, for example, it can be [0.41, 0.51], but the present application is not limited thereto.

[0044] For example, when the target sequence index is within a preset threshold interval, it is determined that the target IP address is not a malicious address. Alternatively, when the target sequence index is not within a preset threshold interval, it is determined that the target IP address is a malicious address. It is understandable that when the target IP address is not a malicious address, the traffic provided by the service with the target IP address can be determined to be normal service traffic. When the target IP address is a malicious address, it can be determined that the traffic provided by the service with the target IP address is malicious traffic.

[0045] The present application creatively takes into account that an attacker modifying the TTL value will cause the TTL time series to present characteristics different from normal traffic. By processing multiple data pairs formed by multiple access requests and response data of each access request, a time series containing multiple time-to-live fields corresponding to the same client accessing the target domain name is obtained, and the time series containing multiple time-to-live fields is processed to obtain a target sequence index, thereby achieving a quantitative description of the TTL time series. Furthermore, by analyzing the target sequence index, it is possible to accurately identify whether the traffic data returned to the user comes from a malicious destination IP address, thereby solving the technical problem in the related art that it is difficult to accurately distinguish whether the destination IP address is malicious, and effectively improving the attack detection capability.

[0046] Optionally, in the attack detection method provided in the embodiment of the present application, multiple data pairs formed by multiple access requests and response data of each access request are processed to generate a time series corresponding to the client accessing the target domain name, including: obtaining the time when each access request is issued to obtain multiple timestamps; sorting multiple lifetime fields according to the multiple timestamps to obtain a time series.

[0047] For example, the survival time field refers to the TTL field (Time To Live), which can indicate the cache time of the DNS record on the DNS server. The smaller the value, the faster the modified record takes effect in various places. When a DNS server in a certain area receives a request, it will send the request to the authorized DNS server specified by the domain name in the request to obtain the resolution record. The time the resolution record is stored in the DNS server is the TTL value.

[0048] This embodiment uses the timestamp of the access request to sort the survival time fields in multiple data pairs, thereby providing data support for subsequent identification of risky addresses.

[0049] Optionally, in the attack detection method provided in the embodiment of the present application, sequence evaluation processing is performed on the time series to obtain a target sequence index, including: calculating the mean of multiple survival time fields to obtain a sequence mean; calculating the difference between multiple survival time fields and the sequence mean to obtain multiple field differences; determining a cumulative sum sequence based on multiple field differences, and obtaining a target sequence index based on the cumulative sum sequence calculation.

[0050] For example, when calculating the target sequence index using the detrended fluctuation analysis algorithm, the original time series can be converted into a cumulative sum sequence that can enhance the potential long-term correlation, that is, the cumulative sum sequence is constructed using the difference between the sequence mean representing the mean of the survival time field and the survival time field. The cumulative sum sequence can be constructed by the following formula: Among them, μ represents the average value of the survival time field in the time series, that is, the sequence mean, x i Represents the i-th survival time field in the time series, and then determines the target sequence index based on the cumulative sum sequence.

[0051] Optionally, in the attack detection method provided in the embodiment of the present application, the difference between multiple survival time fields and the sequence mean is calculated to obtain multiple field differences, including: for the i-th survival time field among the multiple survival time fields, the sum of the first survival time field to the i-th survival time field is calculated to obtain the total survival time data, where i is a positive integer less than or equal to M; the difference between the total survival time data and the sequence mean is calculated to obtain the i-th field difference corresponding to the i-th survival time field.

[0052] Exemplarily, the values ​​in the cumulative sum sequence can be obtained by arranging the field differences, and the field differences need to be determined by the survival time field. For example, when the time series is X={x1, x2, ..., xm}, where x1, x2, ..., xm represent the survival time fields, when calculating the field differences, the first value in the cumulative sum sequence can be determined by the difference between x1 and the mean of all the survival time fields mentioned above. When calculating the second value in the cumulative sum sequence, it is necessary to first calculate the sum of x1 and x2 (that is, x1+x2), and then calculate the difference between the result of x1+x2 and the mean of i sequences to determine the second value, where i represents the number of values ​​in the cumulative sum sequence. When calculating the mth value in the cumulative sum sequence, it is necessary to first calculate the sum of x1 to xm (that is, x1+x2+...+xm), and then calculate the difference between the result of x1+x2+...+xm and the sequence mean to determine the mth value. This embodiment calculates field differences and arranges all field differences to obtain a cumulative sum sequence, thereby enhancing potential long-term correlations and providing a data basis for subsequent identification of risky addresses.

[0053] Optionally, in the attack detection method provided in the embodiment of the present application, calculating the target sequence index based on the cumulative sum sequence includes: dividing the cumulative sum sequence according to the data window to obtain N window sequences, where N is a positive integer; for each window sequence, fitting the window sequence using the least squares method to obtain a polynomial trend data; for each window sequence, calculating the difference between the cumulative sum sequence and the polynomial trend data corresponding to the window sequence to obtain the linear trend data corresponding to the window sequence; and calculating the target sequence index based on the linear trend data corresponding to each window sequence.

[0054] Exemplarily, when determining the target sequence index based on the cumulative sum sequence, the data window can be determined first, and then the cumulative sum sequence can be divided into multiple non-overlapping windows according to the data window, and each window can be associated with a window sequence. In order to further remove the influence of the trend, the least squares method can be used to fit each window sequence to obtain the corresponding polynomial trend data, and then the polynomial trend data is subtracted from the cumulative sum sequence to obtain the detrended data, that is, the linear trend data. For example, when the data window is represented as n, n = M / win_number, where win_number represents the number of sequences in each data window (that is, the window length), and M represents the number of sequences. Finally, the linear trend data can be used for calculation to obtain the target sequence index.

[0055] Optionally, in the attack detection method provided in the embodiment of the present application, calculating the target sequence index based on the linear trend data corresponding to each window sequence includes: for each window sequence, calculating the difference between the window sequence and the linear trend data corresponding to the window sequence to obtain the trend difference, and calculating the square of the trend difference to obtain the trend square data; calculating the sum of the trend square data corresponding to each window sequence to obtain the total trend square data; calculating the mean of the total trend square data according to the data window to obtain the trend mean, and calculating the square root of the trend mean to obtain the trend square root data, and determining the target sequence index from the trend square root data.

[0056] For example, when the target sequence index is calculated using linear trend data, the trend square root data F(n) can first be calculated using the following formula:

[0057]

[0058] Among them, Y(i) represents the i-th value in the window sequence, Y fit (i) represents the linear trend data corresponding to the i-th value in the window sequence, and n represents the size of the data window.

[0059] Furthermore, after calculating the trend square root data, a relationship graph of F(n) versus data window size n in a logarithmic coordinate system can be plotted based on the trend square root data. If the time series exhibits self-similarity, a linear relationship will be shown between logF(n) and logn in the relationship graph, and the slope in the relationship graph is determined as the target sequence index, that is, the Hurst index.

[0060] It should be noted that if the target sequence index <0.5, this means that the time series is anti-persistent, which means that the past upward trend in the sequence is likely to reverse in the future, and vice versa; if the target sequence index = 0.5, it means that the sequence is a random walk or white noise, that is, the values ​​in the sequence are independent and have no long-term memory; if the target sequence index > 0.5, this means that the sequence is continuous, which means that the past trend of change is likely to continue in the future, and the sequence has long-term memory. This embodiment determines the target sequence index by using a relationship graph, and can determine the law of the time series based on the target sequence index, providing data support for determining whether the target IP address is a malicious address.

[0061] Optionally, in the attack detection method provided in the embodiment of the present application, determining whether the target IP address is a malicious address based on the target sequence index includes: when the target sequence index is not within a preset threshold interval, determining that the IP address corresponding to the target domain name is a suspected malicious address; performing query verification processing on the target domain name to obtain a query result, and performing threat matching processing on the target IP address and / or target domain name to obtain a matching result, wherein the query result is used to characterize whether the target IP address is an abnormal address, and the matching result is used to characterize whether there is a threat to the target IP address and / or target domain name; when the query result characterizes that the target IP address is an abnormal address, or the matching result characterizes that there is a threat to at least one of the target IP address and the target domain name, determining that the target IP address of the suspected malicious address is a malicious address.

[0062] Exemplarily, when using the target sequence index for detection, since the white traffic sequence of normal users is not standard white noise, the target sequence index is not strictly equal to the set parameter (wherein the parameter may be 0.5). Therefore, a preset threshold interval may be obtained, and the preset threshold interval may be (0.41, 0.51). When 0.41<target sequence index<0.51, it is determined that the target IP address is not a malicious address; when the target sequence index>0.51 or the target sequence index<0.41, the IP address corresponding to the target domain name is determined as a suspected malicious address.

[0063] Furthermore, on the basis of determining that the IP address is a suspected malicious address, the target domain name corresponding to the above IP address can be queried and verified using the whois query verification method to obtain the query result, and the threat intelligence IOC matching method can be used to perform threat matching on the above IP address and the target domain name to obtain the matching result. When the query result indicates that the IP address is an abnormal address, or the matching result indicates that at least one of the IP address and the target domain name is threatened, the target IP address of the suspected malicious address is determined to be a malicious address, and the traffic is blocked for timely processing to prevent data loss and theft. This embodiment uses the target sequence index to accurately detect whether the IP address is a malicious IP address, which can consume less resources and time, and can also effectively reduce the probability of false alarms and missed reports.

[0064] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0065] The present application also provides an attack detection method. Figure 2 is a schematic diagram of an optional attack detection method provided according to an embodiment of the present application, such as Figure 2 As shown, the method includes:

[0066] First, use network monitoring tools to monitor the DNS traffic in the network environment in real time, and then use multiple access requests and the response data of each access request to form a data pair, and then realize IP address detection based on the time series formed by the TTL in the data pair.

[0067] Exemplarily, after the access request and the corresponding response data are collected, the TTLs in the acquired data pairs are sorted according to the timestamps, and the survival time field is parsed, thereby obtaining a non-stationary TTL time series.

[0068] Furthermore, the time series is processed by sequence evaluation to convert the time series into a cumulative sum series, which can enhance any potential long-term correlation. The cumulative sum series is then divided into multiple non-overlapping windows, and the least squares method is used to fit the polynomial trend data, and the polynomial trend data is subtracted from the cumulative sum series to obtain the linear trend data. Finally, the linear trend data is used for calculation to obtain the target sequence index.

[0069] Furthermore, when using the target sequence index for detection, the preset threshold interval [0.41, 0.51] can be obtained. When the target sequence index > 0.51 or the target sequence index < 0.41, the IP address corresponding to the target domain name is determined as a suspected malicious address. The whois query verification method can be further used to query and verify the above IP address to obtain the query result. At the same time, the threat intelligence IOC matching method can be used to perform threat matching on the above IP address to obtain a matching result.

[0070] When the query result indicates that the IP address is an abnormal address, or the matching result indicates that the IP address is a threat, the target IP address is determined to be a malicious address, and traffic blocking is taken to deal with it in a timely manner to prevent data loss and theft.

[0071] This embodiment obtains data pairs consisting of multiple access requests and response data of each access request, and then processes these data pairs to obtain corresponding time series. After evaluating the above time series, a target sequence index can be obtained. Finally, based on the target sequence index, the target IP address is detected as a malicious address, thereby achieving the effect of improving the efficiency and accuracy of identifying whether the IP address is a malicious address.

[0072] The embodiment of the present application also provides an attack detection device. It should be noted that the attack detection device of the embodiment of the present application can be used to execute the attack detection method provided by the embodiment of the present application. The attack detection device provided by the embodiment of the present application is introduced below.

[0073] Figure 3 is a schematic diagram of an attack detection device provided according to an embodiment of the present application, such as Figure 3 As shown, the device includes: an acquisition unit 30, a generation unit 31, a processing unit 32, and a determination unit 33.

[0074] The acquisition unit 30 is used to acquire multiple access requests and response data of each access request, wherein the target domain name included in each access request is used for the domain name server to resolve and obtain the target IP address;

[0075] A generating unit 31 is used to process multiple data pairs formed by multiple access requests and response data of each access request to generate a time series corresponding to the same client accessing the target domain name, wherein the multiple survival time fields included in the time series are obtained by respectively parsing the multiple data pairs;

[0076] The processing unit 32 is used to perform sequence evaluation processing on the time series to obtain a target sequence index;

[0077] The determination unit 33 is used to determine whether the target IP address is a malicious address according to the target sequence index.

[0078] The attack detection device provided in the embodiment of the present application obtains multiple access requests and response data of each access request through an acquisition unit 30, wherein the target domain name included in each access request is used for the domain name server to resolve and obtain the target IP address; the generation unit 31 processes multiple data pairs formed by the multiple access requests and the response data of each access request, and generates a time series corresponding to the same client accessing the target domain name, wherein the multiple lifetime fields included in the time series are obtained by respectively parsing the multiple data pairs; the processing unit 32 performs sequence evaluation processing on the time series to obtain a target sequence index; the determination unit 33 determines whether the target IP address is a malicious address based on the target sequence index. The present application creatively takes into account that an attacker modifying the TTL value will cause the TTL time series to present characteristics different from normal traffic. By processing multiple data pairs formed by multiple access requests and response data of each access request, a time series containing multiple time-to-live fields corresponding to the same client accessing the target domain name is obtained, and the time series containing multiple time-to-live fields is processed to obtain a target sequence index, thereby achieving a quantitative description of the TTL time series. Furthermore, by analyzing the target sequence index, it is possible to accurately identify whether the traffic data returned to the user comes from a malicious destination IP address, thereby solving the technical problem in the related art that it is difficult to accurately distinguish whether the destination IP address is malicious, and effectively improving the attack detection capability.

[0079] Optionally, in the attack detection device provided in the embodiment of the present application, the generation unit 31 includes: an acquisition module, used to obtain the time when each access request is issued to obtain multiple timestamps; a sorting module, used to sort multiple lifetime fields according to the multiple timestamps to obtain a time series.

[0080] Optionally, in the attack detection device provided in the embodiment of the present application, the processing unit 32 includes: a first calculation module, used to calculate the mean of multiple survival time fields to obtain a sequence mean; a second calculation module, used to calculate the difference between multiple survival time fields and the sequence mean to obtain multiple field differences; a first determination module, used to determine the cumulative sum sequence according to the multiple field differences, and obtain the target sequence index based on the cumulative sum sequence calculation.

[0081] Optionally, in the attack detection device provided in the embodiment of the present application, the processing unit 32 includes: a third calculation module, which is used to calculate the sum of the first survival time field to the i-th survival time field for the i-th survival time field among multiple survival time fields, and obtain the total survival time data, where i is a positive integer less than or equal to M; a fourth calculation module, which is used to calculate the difference between the total survival time data and the sequence mean, and obtain the i-th field difference corresponding to the i-th survival time field.

[0082] Optionally, in the attack detection device provided in the embodiment of the present application, the processing unit 32 includes: a division module, which is used to divide the cumulative sum sequence according to the data window to obtain N window sequences, where N is a positive integer; a fitting module, which is used to fit the window sequence for each window sequence using the least squares method to obtain a polynomial trend data; a fifth calculation module, which is used to calculate the difference between the cumulative sum sequence and the polynomial trend data corresponding to the window sequence for each window sequence to obtain the linear trend data corresponding to the window sequence; and a sixth calculation module, which is used to calculate the target sequence index based on the linear trend data corresponding to each window sequence.

[0083] Optionally, in the attack detection device provided in the embodiment of the present application, the processing unit 32 includes: a seventh calculation module, which is used to calculate the difference between the window sequence and the linear trend data corresponding to the window sequence for each window sequence, to obtain the trend difference, and calculate the square of the trend difference to obtain the trend square data; an eighth calculation module, which is used to calculate the sum of the trend square data corresponding to each window sequence to obtain the total trend square data; a ninth calculation module, which is used to calculate the mean of the total trend square data according to the data window to obtain the trend mean, and calculate the square root of the trend mean to obtain the trend square root data, and determine the target sequence index from the trend square root data.

[0084] Optionally, in the attack detection device provided in the embodiment of the present application, the determination unit 33 includes: a second determination module, used to determine that the IP address corresponding to the target domain name is a suspected malicious address when the target sequence index is not within a preset threshold interval; a processing module, used to query and verify the target domain name to obtain a query result, and perform threat matching processing on the target IP address and / or target domain name to obtain a matching result, wherein the query result is used to characterize whether the target IP address is an abnormal address, and the matching result is used to characterize whether there is a threat to the target IP address and / or target domain name; a third determination module, used to determine that the target IP address of the suspected malicious address is a malicious address when the query result characterizes that the target IP address is an abnormal address, or the matching result characterizes that at least one of the target IP address and the target domain name is a threat.

[0085] The above-mentioned attack detection device includes a processor and a memory. The above-mentioned acquisition unit 30, generation unit 31, processing unit 32, determination unit 33, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0086] The processor includes a kernel, which calls the corresponding program unit from the memory. One or more kernels can be set to solve the problem in related technologies that it is difficult to accurately distinguish whether the traffic comes from a malicious destination IP address by adjusting the kernel parameters.

[0087] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0088] An embodiment of the present invention provides a computer storage medium, which is used to store a program. When the program is running, the device where the computer storage medium is located is controlled to execute an attack detection method.

[0089] Figure 4 is a schematic diagram of an electronic device provided according to an embodiment of the present application, such as Figure 4 As shown, an embodiment of the present invention provides an electronic device, the electronic device 40 includes a processor, a memory, and a program stored in the memory and executable on the processor, the processor is used to execute computer-readable instructions, wherein the computer-readable instructions execute an attack detection method when they are executed. The device herein can be various network security devices, including but not limited to firewalls, IDS (intrusion detection systems), IPS (intrusion prevention systems), WAF (application firewalls), etc.

[0090] The present application also provides a computer program product, including a computer program, which implements the steps of an attack detection method in each embodiment of the present application when the computer program is executed by a processor.

[0091] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0092] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0093] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0094] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0095] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0096] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0097] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0098] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0099] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. An attack detection method, characterized in that: include: Acquire multiple access requests and response data of each access request, wherein the target domain name included in each access request is used for the domain name server to resolve and obtain the target IP address; Processing a plurality of data pairs formed by the plurality of access requests and the response data of each of the access requests to generate a time series corresponding to the same client accessing the target domain name, wherein the plurality of survival time fields included in the time series are obtained by respectively parsing the plurality of data pairs; Performing sequence evaluation processing on the time series to obtain a target sequence index; Determine whether the target IP address is a malicious address according to the target sequence index.

2. The method according to claim 1, characterized in that Processing a plurality of data pairs formed by the plurality of access requests and the response data of each of the access requests to generate a time series corresponding to the same client accessing the target domain name, including: Get the time when each access request is issued and obtain multiple timestamps; The multiple survival time fields are sorted according to the multiple timestamps to obtain the time series.

3. The method according to claim 1, characterized in that The time series is subjected to sequence evaluation processing to obtain a target sequence index including: Calculate the mean of the multiple survival time fields to obtain a sequence mean; Calculate differences between the multiple survival time fields and the sequence mean to obtain multiple field differences; A cumulative sum sequence is determined according to the plurality of field differences, and the target sequence index is calculated according to the cumulative sum sequence.

4. The method according to claim 3, characterized in that Calculating differences between the multiple survival time fields and the sequence mean to obtain multiple field differences includes: For the i-th survival time field among the multiple survival time fields, calculate the sum of the first survival time field to the i-th survival time field to obtain the survival time sum data, wherein i is a positive integer less than or equal to the plurality; The difference between the survival time sum data and the sequence mean is calculated to obtain the i-th field difference corresponding to the i-th survival time field.

5. The method according to claim 3, characterized in that: The target sequence index calculated according to the cumulative sum sequence includes: Dividing the cumulative sum sequence according to the data window to obtain N window sequences, where N is a positive integer; For each window sequence, the window sequence is fitted using the least square method to obtain a polynomial trend data; For each window sequence, calculating the difference between the cumulative sum sequence and the polynomial trend data corresponding to the window sequence, to obtain the linear trend data corresponding to the window sequence; The target sequence index is calculated based on the linear trend data corresponding to each window sequence.

6. The method according to claim 5, characterized in that The target sequence index calculated according to the linear trend data corresponding to each window sequence includes: For each window sequence, calculating the difference between the window sequence and the linear trend data corresponding to the window sequence to obtain the trend difference, and calculating the square of the trend difference to obtain the trend square data; Calculate the sum of the trend square data corresponding to each window sequence to obtain the total trend square data; The mean of the total trend square data is calculated according to the data window to obtain the trend mean, and the square root of the trend mean is calculated to obtain the trend square root data, and the target sequence index is determined by the trend square root data.

7. The method according to claim 1, characterized in that Determining whether the target IP address is a malicious address according to the target sequence index includes: If the target sequence index is not within a preset threshold range, determining that the IP address corresponding to the target domain name is a suspected malicious address; Perform query verification processing on the target domain name to obtain a query result, and perform threat matching processing on the target IP address and / or target domain name to obtain a matching result, wherein the query result is used to characterize whether the target IP address is an abnormal address, and the matching result is used to characterize whether the target IP address and / or target domain name is a threat; When the query result indicates that the target IP address is the abnormal address, or the matching result indicates that at least one of the target IP address and the target domain name is threatening, the target IP address of the suspected malicious address is determined to be a malicious address.

8. An attack detection device, characterized in that: include: An acquisition unit, used to acquire multiple access requests and response data of each access request, wherein the target domain name included in each access request is used for the domain name server to resolve and obtain the target IP address; a generating unit, configured to process a plurality of data pairs formed by the plurality of access requests and response data of each of the access requests, and generate a time series corresponding to the same client accessing the target domain name, wherein the plurality of survival time fields included in the time series are obtained by respectively parsing the plurality of data pairs; A processing unit, used for performing sequence evaluation processing on the time series to obtain a target sequence index; A determination unit is used to determine whether the target IP address is a malicious address according to the target sequence index.

9. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the attack detection method according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: The invention comprises one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the attack detection method described in any one of claims 1 to 7.

Images