Address security assessment model training method and device, equipment and medium

Abstract

The embodiment of the invention discloses an address security assessment model training method and device, equipment and a medium. The method comprises the following steps: acquiring alarm log data and a source internet protocol address corresponding to each alarm log in the alarm log data; according to the alarm log data and a preset network security knowledge base, determining a tactics corresponding to each source Internet protocol address, and generating a corresponding attack dimension feature according to the tactics; determining access information of each source Internet protocol address in a preset time window, and generating a corresponding behavior dimension feature based on the access information; obtaining identification information corresponding to each source Internet protocol address in an Internet protocol address information base, and generating corresponding identification dimension features based on the identification information; and generating training data according to the attack dimension feature, the behavior dimension feature and the identification dimension feature corresponding to each source Internet protocol address, and performing iterative training on the address security evaluation model through the training data to obtain a trained address security evaluation model.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an address security assessment model training method, device, equipment and medium. Background Art

[0002] With the rapid development of Internet technology, network attack methods are also evolving and becoming more complex, and network security protection is becoming more and more important. In network security scenarios, it is particularly important to accurately judge the security of an Internet Protocol address, which is directly related to whether potential network threats can be identified and blocked in a timely manner, and whether security and privacy can be protected.

[0003] In related technical solutions, the security assessment of an Internet Protocol address often relies on expert judgment. Although this method can identify some Internet Protocol addresses with malicious behavior to a certain extent, its inherent shortcomings cannot be ignored: first, it is inefficient and cannot perform real-time analysis under massive Internet Protocol address data; second, it is highly subjective, and different experts may make different security assessments of the same Internet Protocol address due to factors such as experience and knowledge background; third, it is difficult to cover the various types of attack modes corresponding to Internet Protocol addresses, resulting in the omission of Internet Protocol addresses that pose potential threats.

[0004] Therefore, there are technical problems in the related art of low accuracy and low efficiency in evaluating the security of Internet Protocol addresses. Summary of the invention

[0005] The embodiments of the present application provide a method, apparatus, device and medium for training an address security assessment model. The trained address security assessment model can efficiently and accurately perform security assessment on Internet Protocol addresses.

[0006] In order to achieve the above objectives, the present application provides an address security assessment model training method, including: Acquire alarm log data stored in the security system and a source Internet Protocol address corresponding to each alarm log in the alarm log data; Determine the tactics corresponding to each source Internet Protocol address based on the alarm log data and a preset network security knowledge base, and generate attack dimension features corresponding to each source Internet Protocol address based on the tactics; Determine access information of each source Internet Protocol address within a preset time window, and generate a behavior dimension feature corresponding to each source Internet Protocol address based on the access information; Obtaining identification information corresponding to each source Internet Protocol address in an Internet Protocol address information database, and generating identification dimension features corresponding to each source Internet Protocol address based on the identification information; Training data is generated according to the attack dimension feature, the behavior dimension feature and the identification dimension feature corresponding to each source Internet Protocol address, and the address security assessment model is iteratively trained through the training data until the address security assessment model converges, thereby obtaining a trained address security assessment model, which is used to perform security assessment on the source Internet Protocol address to be detected.

[0007] In order to achieve the above-mentioned purpose, the embodiment of the present application provides an address security assessment model training device, including: An acquisition module, used to acquire the alarm log data stored in the security system and the source Internet Protocol address corresponding to each alarm log in the alarm log data; A first determination module is used to determine the tactics corresponding to each source Internet Protocol address according to the alarm log data and a preset network security knowledge base, and generate attack dimension features corresponding to each source Internet Protocol address according to the tactics; A second determination module is used to determine access information of each source Internet Protocol address within a preset time window, and generate a behavior dimension feature corresponding to each source Internet Protocol address based on the access information; A third determination module is used to obtain identification information corresponding to each source Internet Protocol address in an Internet Protocol address information database, and generate identification dimension features corresponding to each source Internet Protocol address based on the identification information; A training module is used to generate training data according to the attack dimension features, the behavior dimension features and the identification dimension features corresponding to each source Internet Protocol address, and iteratively train the address security assessment model through the training data until the address security assessment model converges to obtain a trained address security assessment model, and the trained address security assessment model is used to perform security assessment on the source Internet Protocol address to be detected.

[0008] In some embodiments, the first determination module includes a first determination submodule, a second determination submodule, and a third determination submodule; A first determination submodule is used to determine an alarm text vector corresponding to each alarm log in the alarm log data, and to determine a technology text vector corresponding to each technology in a preset network security knowledge base; A second determination submodule is used to determine the similarity between each warning text vector and each technical text vector; The third determination submodule is used to determine the target technology text vector corresponding to each alarm text vector according to the similarity, and determine the tactics corresponding to the technology corresponding to the target technology text vector as the tactics corresponding to the source Internet Protocol address associated with each alarm log.

[0009] In some implementations, the first determining submodule is configured to: Generate an alarm text according to the event type text and the alarm description text corresponding to each alarm log in the alarm log data; Inputting the alarm text into a pre-trained text processing model, and outputting an alarm text vector corresponding to each alarm log in the alarm log data; Determine the technical description text corresponding to each technology in the preset network security knowledge base; The technical description text is input into a pre-trained text processing model, and a technical text vector corresponding to each technology in the preset network security knowledge base is output.

[0010] In some implementations, the third determining submodule is configured to: Determine, among the technical text vectors, a candidate technical text vector corresponding to each of the warning text vectors, the similarity of which is greater than a preset similarity threshold; Among the candidate technical text vectors, the candidate technical text vector with the greatest similarity is determined as the target technical text vector corresponding to each warning text vector.

[0011] In some implementations, the second determining module is configured to: Obtaining a target source Internet Protocol address after access by an external device and stored by a target network device, and generating a target source Internet Protocol address set according to the target source Internet Protocol address, wherein the target network device is a network device that induces a network attack; Matching each source Internet Protocol address with the target source Internet Protocol address set within a preset time window to determine access status of each source Internet Protocol address to the target network device; Obtaining the access frequency of each source Internet Protocol address to the target website and the number of logins corresponding to each source Internet Protocol address; The access situation, the access frequency and the number of logins are determined as access information of each source Internet Protocol address within a preset time window.

[0012] In some implementations, the third determination module is configured to: Matching each of the source Internet Protocol addresses with an Internet Protocol address information database to determine security information, proxy information, scanning information, and crawler information corresponding to each of the source Internet Protocol addresses; The security information, the proxy information, the scanning information and the crawler information are determined as identification information corresponding to each source Internet Protocol address.

[0013] In some embodiments, a training module is used to: Concatenate the attack dimension feature, the behavior dimension feature, and the identification dimension feature corresponding to each source Internet Protocol address to obtain a feature vector corresponding to each source Internet Protocol address; Training data is generated according to the feature vector corresponding to each source Internet Protocol address.

[0014] In some embodiments, a training module is used to: Inputting the feature vector corresponding to each source Internet Protocol address in the training data into the address security assessment model, and outputting a predicted security score value; Determine a loss value between a label security score value and a predicted security score value corresponding to each source Internet Protocol address; When the loss value does not meet the preset loss condition, the parameters corresponding to the address security assessment model are adjusted according to the loss value to iterate the address security assessment model, and the execution is returned to input the feature vector corresponding to each source Internet Protocol address into the address security assessment model until the loss value meets the preset loss condition. The address security assessment model converges to obtain a trained address security assessment model.

[0015] In some embodiments, the acquisition module is used to: Acquire original alarm log data in the security system, and determine a target field corresponding to each original alarm log in the original alarm log data; Performing format conversion on the target field to obtain an alarm log corresponding to each original alarm log; The alarm log corresponding to each original alarm log is determined as the alarm log data.

[0016] In some embodiments, the address security assessment model training device further includes a detection module, which is used to: Obtaining an alarm log to be detected, and determining a source Internet Protocol address to be detected according to the alarm log to be detected; Determine the behavior dimension characteristics, access dimension characteristics and identification dimension characteristics of the Internet Protocol address to be detected; Generate input features according to the behavior dimension features, access dimension features and identification dimension features of the Internet Protocol address to be detected; Inputting the input feature into the trained address security assessment model to obtain a security score corresponding to the source Internet Protocol address to be detected; A corresponding processing strategy is executed on the source Internet Protocol address to be detected according to the security score.

[0017] In order to achieve the above-mentioned purpose, an embodiment of the present application also provides a computer-readable storage medium, which stores multiple instructions, and the instructions are suitable for a processor to load to execute the address security assessment model training method provided in the embodiment of the present application.

[0018] In order to achieve the above-mentioned purpose, an embodiment of the present application also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the address security assessment model training method provided in the embodiment of the present application when executing the computer program.

[0019] In an embodiment of the present application, alarm log data saved by a security system and a source Internet Protocol address corresponding to each alarm log in the alarm log data are obtained; based on the alarm log data and a preset network security knowledge base, the tactics corresponding to each source Internet Protocol address are determined, and attack dimension features corresponding to each source Internet Protocol address are generated based on the tactics; access information of each source Internet Protocol address within a preset time window is determined, and behavior dimension features corresponding to each source Internet Protocol address are generated based on the access information; identification information corresponding to each source Internet Protocol address is obtained in an Internet Protocol address information library, and identification dimension features corresponding to each source Internet Protocol address are generated based on the identification information; training data is generated based on the attack dimension features, behavior dimension features, and identification dimension features corresponding to each source Internet Protocol address, and an address security assessment model is iteratively trained using the training data until the address security assessment model converges to obtain a trained address security assessment model, and the trained address security assessment model is used to perform security assessment on the source Internet Protocol address to be detected.

[0020] In this way, by obtaining the source Internet Protocol address in the alarm log, and then determining the tactics corresponding to the source Internet Protocol address through the preset network security knowledge base, generating the attack dimension characteristics of the source Internet Protocol address in the attack dimension according to the tactics, and then determining the access information of the source Internet Protocol address, determining the behavior dimension characteristics of the source Internet Protocol address in the behavior dimension according to the access information, and then determining the identification information corresponding to the source Internet Protocol address through the Internet Protocol address information library, generating the identification dimension characteristics of the source Internet Protocol address in the identification dimension according to the identification information, and finally generating the comprehensive characteristics for characterizing the Internet Protocol address according to the attack dimension characteristics, behavior dimension characteristics and identification dimension characteristics of the source Internet Protocol address, using the comprehensive characteristics of the source Internet Protocol address of each alarm log as training data, realizing iterative training of the address security assessment model, and obtaining the trained address security assessment model. The trained address security assessment model can efficiently and accurately perform security assessment on the source Internet Protocol address to be detected. Compared with the security of the source Internet Protocol address to be detected in the related art that relies on human judgment, the trained address security assessment model in this application has higher security assessment efficiency and more accurate security assessment results for the source Internet Protocol address to be detected.

[0021] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 It is a schematic diagram of the system framework corresponding to the address security assessment model training method provided in the embodiment of the present application; Figure 2 It is a scenario diagram of the address security assessment model training method provided in an embodiment of the present application; Figure 3 It is a flowchart of the address security assessment model training method provided in the embodiment of the present application; Figure 4 is a flowchart of step 220 provided in an embodiment of the present application; Figure 5 is a processing flow chart of the trained address security assessment model provided in an embodiment of the present application; Figure 6 It is another flowchart of the address security assessment model training method provided in an embodiment of the present application; Figure 7 It is a structural diagram of an address security assessment model training device provided in this embodiment; Figure 8 It is a schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0025] It is understandable that in the specific implementation of this application, data related to Internet Protocol addresses is involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards.

[0026] It should be noted that in some processes described in the specification, claims and the above-mentioned drawings, multiple steps appearing in a specific order are included, but it should be clearly understood that these steps may not be executed in the order in which they appear in this document or may be executed in parallel. The step numbers are only used to distinguish different steps, and the numbers themselves do not represent any execution order. In addition, descriptions such as "first", "second" or "target" in this document are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0027] Before further describing the embodiments of the present disclosure in detail, the nouns and terms involved in the embodiments of the present disclosure are described. The nouns and terms involved in the embodiments of the present disclosure are subject to the following interpretations: Source IP Address refers to the IP address of the network interface of the device that sends data (such as computers, servers, smartphones, etc.) in network communication. Simply put, it is like the "home address" of the data sender in the network, which is used to identify where the data is sent from.

[0028] Preset cybersecurity knowledge base: a cyberattack behavior knowledge base based on real-world observations, such as the ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) cyberattack behavior knowledge base. It includes tactics and techniques. Tactics are high-level goals taken by attackers to achieve their goals, and techniques are specific methods to implement tactics.

[0029] Internet Protocol Address Information Database: A database that collects and organizes information related to IP addresses through open and legal channels and allows the public to freely access, use and share. By monitoring and analyzing network traffic, it collects information such as access behavior and connection patterns of different IP addresses. In the process of researching security incidents such as network attacks and malware propagation, security researchers will discover and record IP addresses related to malicious activities, and share this information in the Internet Protocol Address Information Database to help others identify potential threats.

[0030] Four honey devices: refers to the four types of devices in the field of network security: honey spots, honeypots, honeynets, and honeyholes. Honey spots: are a group of artificially set network access points deployed around the protected system. They carry the "sentinel" process carefully set up by the defender, and their external form is a simulation system of the protected object. When an attacker conducts penetration reconnaissance activities, their detection behavior will be recorded without feeling, and their source IP and other information can be obtained and recorded in the log.

[0031] Honeypot: It is the front-end of the accessed system, which is equivalent to some functions of the accessed system. For suspicious target objects pulled into the honeypot, it can not only provide real initial services, but also observe and analyze their behavior activities. If it is finally determined to be a benign user, it will be pulled into the real system environment through traffic. During operation, it will record the visitor's source IP and other information in the log.

[0032] Honeynet: It is an application gateway (WAF) placed in front of the protected system. The protected system unconditionally accepts access requests from the honeynet or other whitelists, and records and audits the access process of whitelist users, including information such as the access source IP, and records it in the log. Externally, the addresses resolved by the domain name of the protected system all point to the honeynet, and external access needs to be carried out through the honeynet.

[0033] Honeyhole: Deployed in a real network close to the attacker. When a suspected attack or non-compliant access is detected, the honeyhole system releases the traceability authentication tool to decide whether to allow the access. The premise of authentication and release is that the visitor needs to provide information proving his or her source and path, that is, identity authentication credentials. At the same time, the honeyhole will also record the source IP and other information of the relevant access in the log.

[0034] First, the technical problems existing in the relevant technology are explained: With the rapid development of Internet technology, network attack methods are also evolving and becoming more complex, and network security protection is becoming more and more important. In network security scenarios, it is particularly important to accurately judge the security of an Internet Protocol address, which is directly related to whether potential network threats can be identified and blocked in a timely manner, and whether security and privacy can be protected.

[0035] In related technical solutions, the security assessment of an Internet Protocol address often relies on expert judgment. Although this method can identify some Internet Protocol addresses with malicious behavior to a certain extent, its inherent shortcomings cannot be ignored: first, it is inefficient and cannot perform real-time analysis under massive Internet Protocol address data; second, it is highly subjective, and different experts may make different security assessments of the same Internet Protocol address due to factors such as experience and knowledge background; third, it is difficult to cover the various types of attack modes corresponding to Internet Protocol addresses, resulting in the omission of Internet Protocol addresses that pose potential threats.

[0036] Therefore, there are technical problems in the related art of low accuracy and low efficiency in evaluating the security of Internet Protocol addresses.

[0037] In order to solve the above problems, the embodiments of the present application propose an address security assessment model training method, device, equipment and medium. The trained address security assessment model can efficiently and accurately perform security assessment on Internet Protocol addresses.

[0038] Among them, by obtaining the source Internet Protocol address in the alarm log, and then determining the tactics corresponding to the source Internet Protocol address through the preset network security knowledge base, generating the attack dimension characteristics of the source Internet Protocol address in the attack dimension according to the tactics, and then determining the access information of the source Internet Protocol address, determining the behavior dimension characteristics of the source Internet Protocol address in the behavior dimension according to the access information, and then determining the identification information corresponding to the source Internet Protocol address through the Internet Protocol address information library, generating the identification dimension characteristics of the source Internet Protocol address in the identification dimension according to the identification information, and finally generating the comprehensive characteristics for characterizing the Internet Protocol address according to the attack dimension characteristics, behavior dimension characteristics and identification dimension characteristics of the source Internet Protocol address, using the comprehensive characteristics of the source Internet Protocol address of each alarm log as training data, realizing iterative training of the address security assessment model, and obtaining the trained address security assessment model. The trained address security assessment model can efficiently and accurately perform security assessment on the source Internet Protocol address. Compared with the related art that relies on manual judgment of the security of the source Internet Protocol address, the trained address security assessment model in this application has higher security assessment efficiency and more accurate security assessment results for the source Internet Protocol address.

[0039] See also Figure 1 , Figure 1 1 is a schematic diagram of a system framework corresponding to the address security assessment model training method provided in the embodiment of the present application. The address security assessment model training method provided in the embodiment of the present application can be applied to the system framework.

[0040] It includes a terminal 140, the Internet 130, a gateway 120, a server 110, and the like.

[0041] The terminal 140 or the server 110 may be a device for executing the address security assessment model training method.

[0042] The terminal 140 includes but is not limited to mobile phones, computers, intelligent voice interaction devices, smart home appliances, vehicle-mounted terminals, aircraft, etc. The embodiments of the present application can be applied to various scenarios, including but not limited to cloud office, enterprise management, etc. In addition, it can be a single device or a collection of multiple devices. For example, multiple desktop computers are interconnected through a local area network, share a display, etc. to work together, and together constitute a terminal 140. The terminal 140 can communicate with the Internet 130 in a wired or wireless manner to exchange data.

[0043] The server 110 refers to a computer system that can provide certain services to the terminal 140. Compared with the ordinary terminal 140, the server 110 has higher requirements in terms of stability, security, performance, etc. The server 110 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms.

[0044] The gateway 120 is also called an internetwork connector or a protocol converter. The gateway realizes network interconnection at the transport layer and is a computer system or device that acts as a converter. The gateway is a translator between two systems that use different communication protocols, data formats or languages, or even completely different architectures. At the same time, the gateway can also provide filtering and security functions. The message sent by the terminal 140 to the server 110 must be sent to the corresponding server 110 through the gateway 120. The message sent by the server 110 to the terminal 140 must also be sent to the corresponding terminal 140 through the gateway 120.

[0045] The address security assessment model training method in the embodiment of the present application can be applied to a variety of scenarios, such as database security, network security, cloud service security, etc. The scenario to which the address security assessment model training method in the present application is applied is not limited here.

[0046] See also Figure 2 , Figure 2 It is a scenario diagram of the address security assessment model training method provided in an embodiment of the present application.

[0047] Among them, the address security assessment model provided in the embodiment of the present application is mainly used to evaluate the security of the source Internet Protocol address. Since the source Internet Protocol address is the sender of the data and the source Internet Protocol address can also be the receiver of the data, the interaction of data in the Internet inevitably involves the sending and receiving of data. Therefore, the address security assessment model is applicable to the security assessment of all Internet Protocol addresses. In the embodiment of the application itself, it will be explained from the perspective of the source Internet Protocol address.

[0048] First, obtain the alarm log data captured by the security device or security system, such as the User and Entity Behavior Analytics (UEBA) and Security Operations Center (SOC) tools, which can capture security event information in the network to obtain the original alarm log data. The original alarm log data contains multiple original alarm logs, each of which contains important data such as timestamp, source Internet Protocol address, target Internet Protocol address, event type, alarm description, and some redundant data. Therefore, the original alarm log data can be filtered for redundant data to obtain the alarm log data, which contains multiple alarm logs.

[0049] Then, the source Internet Protocol address corresponding to each alarm log can be determined, the event type text and alarm description text corresponding to each alarm log can be determined, and then the event type text and alarm description text corresponding to each alarm log can generate the alarm text of the source Internet Protocol address corresponding to each alarm log, and determine the alarm text vector used to characterize the alarm text.

[0050] Then determine the tactics corresponding to each source Internet Protocol address from the preset network security knowledge base. For example, generate a technical description text for each technology in the preset network security knowledge base, and determine a technical text vector used to characterize the technical description text. By calculating the similarity between each alarm text vector and the technical text vector, the target technical text vector corresponding to each alarm text vector is obtained, the technology corresponding to the target technical text vector is determined, and then the tactics corresponding to the technology are determined. The tactics are determined as the tactics corresponding to each source Internet Protocol address, and the attack dimension features corresponding to each source Internet Protocol address are generated according to the tactics corresponding to each source Internet Protocol address.

[0051] Then obtain a target source Internet Protocol address set, which is a target source Internet Protocol address set captured by a network detection device. The network detection device is a device used to induce external malicious devices to attack it to obtain malicious target Internet Protocol addresses.

[0052] Then determine whether each source Internet Protocol address appears in the target source Internet Protocol address set to obtain the access situation of each source Internet Protocol address to the network detection device, and obtain the access frequency of each source Internet Protocol address to the target website, such as the access frequency to the external network, and the number of logins corresponding to each source Internet Protocol address, such as the number of logins to some specific Internet Protocol addresses. Finally, the access information corresponding to each source Internet Protocol address is generated based on the access situation, access frequency, and login number corresponding to each source Internet Protocol address, and finally the behavioral dimension features corresponding to each source Internet Protocol address are generated based on the access information.

[0053] Then, the tactical identification information corresponding to each source Internet Protocol address is determined through the Internet Protocol address information database. The identification information is used to characterize the malicious label corresponding to the source Internet Protocol address, such as the maliciousness of the source Internet Protocol address, whether the source Internet Protocol address is a proxy Internet Protocol address, whether the source Internet Protocol address is an Internet Protocol address used for scanning, whether the source Internet Protocol address is a crawler Internet Protocol address, etc. Finally, the identification dimension feature corresponding to each source Internet Protocol address is generated through the access information corresponding to each source Internet Protocol address.

[0054] Finally, the comprehensive features corresponding to each source Internet Protocol address are generated through the attack dimension features, identification dimension features and behavior dimension features corresponding to each source Internet Protocol address. The comprehensive features corresponding to each source Internet Protocol address can be used to generate training data, which is used to train the address security assessment model.

[0055] From the above, we can see that since the training data has more evaluation dimensions to characterize each source Internet Protocol address, the training data is more comprehensive and rich. Ultimately, the address security assessment model trained with the training data can perform a more accurate and efficient security assessment of the source Internet Protocol address.

[0056] Finally, the source Internet Protocol address to be detected is input into the trained address security assessment model, and the security score corresponding to the source Internet Protocol address to be detected can be output, and the corresponding processing strategy is executed on the source Internet Protocol address to be detected according to the security score.

[0057] For example, the highest security score is 10 points and the lowest is 0 points. The lower the security score, the more secure the source Internet Protocol address to be detected is, and the higher the security score, the less secure the source Internet Protocol address to be detected is. When the security score of the source Internet Protocol address to be detected is in the range of 0 to 3 points (excluding the maximum value), the source Internet Protocol address to be detected is safe and the source Internet Protocol address to be detected is released; when the security score of the source Internet Protocol address to be detected is in the range of 3 to 6 points (excluding the maximum value), the source Internet Protocol address to be detected is a suspicious Internet Protocol address and a security check is performed on the source Internet Protocol address to be detected; when the security score of the source Internet Protocol address to be detected is in the range of 6 to 8 points (excluding the maximum value), the source Internet Protocol address to be detected is moderately insecure and the source Internet Protocol address to be detected is temporarily blocked; when the security score of the source Internet Protocol address to be detected is in the range of 8 to 10 points, the source Internet Protocol address to be detected is highly insecure and the source Internet Protocol address to be detected is permanently blocked.

[0058] From the above content, it can be seen that in the embodiments of the present application, through the trained address security assessment model, the security assessment of the source Internet Protocol address to be detected can be performed efficiently and quickly, and the corresponding processing strategy can be executed. Compared with the related technology that relies on manual judgment of the security of the source Internet Protocol address, the trained address security assessment model in the present application has higher security assessment efficiency for the source Internet Protocol address to be detected and more accurate security assessment results.

[0059] The above is the training scenario corresponding to the address security assessment model training method provided in the embodiment of the present application. The trained address security assessment model provided in the present application can be applied to multiple fields involving network security.

[0060] For a more detailed understanding of the address security assessment model training method provided in the embodiment of the present application, please refer to Figure 3 , Figure 3 : is a flowchart of an address security assessment model training method provided in an embodiment of the present application. The address security assessment model training method may include the following steps: Step 210: Acquire alarm log data stored in the security system and a source Internet Protocol address corresponding to each alarm log in the alarm log data; Step 220: Determine the tactics corresponding to each source Internet Protocol address based on the alarm log data and the preset network security knowledge base, and generate attack dimension features corresponding to each source Internet Protocol address based on the tactics; Step 230: Determine access information of each source Internet Protocol address within a preset time window, and generate a behavior dimension feature corresponding to each source Internet Protocol address based on the access information; Step 240: Obtain identification information corresponding to each source Internet Protocol address in the Internet Protocol address information database, and generate identification dimension features corresponding to each source Internet Protocol address based on the identification information; Step 250: Generate training data based on the attack dimension features, behavior dimension features, and identification dimension features corresponding to each source Internet Protocol address, and iteratively train the address security assessment model through the training data until the address security assessment model converges to obtain a trained address security assessment model. The trained address security assessment model is used to perform security assessment on the source Internet Protocol address to be detected.

[0061] Steps 210 to 250 will be described in detail below.

[0062] In step 210, the alarm log data stored in the security system and the source Internet Protocol address corresponding to each alarm log in the alarm log data are obtained.

[0063] Among them, the security system can be understood as a security tool that can monitor network security events in the network to obtain original alarm data. The original alarm log data contains multiple original alarm logs. Each original alarm log contains some important data and some redundant data. Therefore, the original alarm log data can be filtered for redundant data to obtain alarm log data containing only important data. Each alarm log in the alarm log data corresponds to a corresponding source Internet Protocol address.

[0064] In some implementations, obtaining alarm log data stored in a security system includes: (1.1) Obtaining original alarm log data in the security system, and determining a target field corresponding to each original alarm log in the original alarm log data; (1.2) Convert the target field into a new format to obtain the alarm log corresponding to each original alarm log; (1.3) The alarm log corresponding to each original alarm log is determined as the alarm log data.

[0065] For example, User and Entity Behavior Analytics (UEBA) and Security Operations Center (SOC) tools can capture security event information in the network to obtain original alarm log data. For another example, firewalls, intrusion detection systems, endpoint security solutions, etc. can all be security tools to collect network alarm logs.

[0066] The original alarm log data contains multiple original alarm logs, each of which contains important data such as timestamp, source Internet Protocol address, target Internet Protocol address, event type, alarm description, etc., and also contains other redundant data, such as some values ​​or definers. Therefore, the original alarm log data can be filtered for redundant data to obtain alarm log data, in which each alarm log corresponds to a corresponding source Internet Protocol address.

[0067] It is understandable that the data formats of the original alarm log data collected by different security systems are different. For example, some original alarm log data is in XML format, and some original alarm log data is in Json format. After obtaining the target fields corresponding to important data in each original alarm log, such as timestamp, source Internet Protocol address, target Internet Protocol address, event type, alarm description and other information, the target fields can be converted into data formats to obtain alarm logs in a unified data format, and the alarm logs corresponding to each original alarm log are determined as alarm log data.

[0068] In step 220, the tactics corresponding to each source Internet Protocol address are determined based on the alarm log data and a preset network security knowledge base, and attack dimension features corresponding to each source Internet Protocol address are generated based on the tactics.

[0069] Among them, each alarm log in the alarm log data corresponds to an alarm description text of a corresponding security event. Each alarm description text can be matched with a technical description text of each technology in a preset network security knowledge base to determine the technical description text corresponding to each alarm description text, and then the technology corresponding to the technical description text is determined as the technology corresponding to each alarm description text, and the tactics corresponding to the technology are determined as the tactics corresponding to each alarm description text. Since each alarm log corresponds to a corresponding source Internet Protocol address, the tactics corresponding to each alarm description text are determined as the tactics corresponding to each source Internet Protocol address, and finally, the attack dimension characteristics corresponding to each source Internet Protocol address are determined according to the tactics corresponding to each source Internet Protocol address.

[0070] The advantage of doing this is that the tactics corresponding to each source Internet Protocol address can be quickly determined, thereby determining the attack dimension characteristics corresponding to each source Internet Protocol address. The attack dimension characteristics are used to describe the attack method corresponding to each source Internet Protocol address, which can increase the feature description of each source Internet Protocol address, so that the security address assessment model trained subsequently can learn the knowledge corresponding to each source Internet Protocol address more comprehensively.

[0071] See also Figure 4 , Figure 4It is a flowchart of step 220 provided in an embodiment of the present application.

[0072] In some implementations, the tactics corresponding to each source Internet Protocol address are determined based on the alarm log data and a preset network security knowledge base, including: Step 301: determining an alarm text vector corresponding to each alarm log in the alarm log data, and determining a technology text vector corresponding to each technology in a preset network security knowledge base; Step 302: Determine the similarity between each warning text vector and each technical text vector; Step 303: Determine the target technology text vector corresponding to each alarm text vector according to the similarity, and determine the tactic to which the technology corresponding to the target technology text vector belongs as the tactic corresponding to the source Internet Protocol address associated with each alarm log.

[0073] Steps 301 to 303 are described in detail below.

[0074] In step 301, an alarm text vector corresponding to each alarm log in the alarm log data is determined, and a technology text vector corresponding to each technology in a preset network security knowledge base is determined.

[0075] Among them, each alarm log can be summarized in a paragraph to generate a summarized text, and then the summarized text is encoded to generate an alarm text vector corresponding to each alarm log. Similarly, each technology in the preset network security knowledge base can also be summarized in a corresponding text, and then the corresponding text is encoded to generate a technical text vector corresponding to each technology.

[0076] In some implementations, determining an alarm text vector corresponding to each alarm log in the alarm log data, and determining a technology text vector corresponding to each technology in a preset network security knowledge base, includes: (1.1) Generate an alarm text according to the event type text and alarm description text corresponding to each alarm log in the alarm log data; (1.2) Input the alarm text into the pre-trained text processing model and output the alarm text vector corresponding to each alarm log in the alarm log data; (1.3) Determine the technical description text corresponding to each technology in the preset cybersecurity knowledge base; (1.4) Input the technical description text into the pre-trained text processing model and output the technical text vector corresponding to each technology in the preset cybersecurity knowledge base.

[0077] Each alarm log contains a corresponding event type text and an alarm description text, wherein the event type text is mainly used to describe the security type of the event reported by the alarm log, and the alarm description text is used to describe the specific content of the event reported by the alarm log. The alarm text corresponding to each alarm log can be generated according to the event type text and the alarm description text corresponding to each alarm log.

[0078] Then, the alarm text is input into the pre-trained text processing model, and the alarm text vector corresponding to each alarm log in the alarm log data is output. The pre-trained text processing model is a model that performs feature extraction processing on text and generates a vector for representing the original text. The pre-trained text processing model can be a word2vec model, which can convert words in the alarm description text into vector representations in a low-dimensional vector space, so that words with similar semantics are close in the vector space, thereby capturing the semantic relationship between words. The generated alarm text vector can represent the alarm text corresponding to each alarm log.

[0079] The preset cybersecurity knowledge base contains multiple technologies, and the technical description text corresponding to each technology can be determined. The technical description text is used to describe the main technical ideas corresponding to the technology, and then the technical description text is input into the pre-trained text processing model to output the technical text vector corresponding to each technology in the preset cybersecurity knowledge base. The technical text vector can be used to represent the technical description text corresponding to each technology.

[0080] The advantage of doing this is that deeper features of the warning text and the technical description text can be extracted through the pre-trained text processing model, so as to facilitate the subsequent accurate determination of the similarity between the warning text and the technical description text.

[0081] In step 302 , the similarity between each warning text vector and each technical text vector is determined.

[0082] The cosine similarity between each warning text vector and each technical text vector may be calculated, and the cosine similarity may be used as the similarity between each warning text vector and each technical text vector.

[0083] In step 303, the target technology text vector corresponding to each alarm text vector is determined according to the similarity, and the tactics to which the technology corresponding to the target technology text vector belongs are determined as the tactics corresponding to the source Internet Protocol address associated with each alarm log.

[0084] Among them, the target technology text vector with the highest similarity corresponding to each alarm text vector can be determined according to the similarity, and then the tactics corresponding to the technology corresponding to the target technology text vector can be determined as the tactics corresponding to the source Internet Protocol address associated with each alarm log.

[0085] For example, the preset network security knowledge base includes 12 tactics: Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact. After determining the technology corresponding to the target technology text vector, the tactic to which the technology belongs can be found based on the mapping relationship between the technology and the tactic, such as the tactic to which it belongs is Initial Access.

[0086] In some implementations, determining the target technology text vector corresponding to each warning text vector according to the similarity includes: (1.1) in the technical text vectors, determining a candidate technical text vector corresponding to each warning text vector whose similarity is greater than a preset similarity threshold; (1.2) Among the candidate technical text vectors, the candidate technical text vector with the greatest similarity is determined as the target technical text vector corresponding to each warning text vector.

[0087] Among them, among the technical text vectors, the candidate technical text vectors corresponding to each warning text vector whose similarity is greater than a preset similarity threshold are determined, so that the technical text vectors that are not similar to the warning text vector can be initially filtered out, and the remaining technical text vectors are determined as candidate technical text vectors. Among the candidate technical text vectors, the candidate technical text vector with the greatest similarity is determined as the target technical text vector corresponding to each warning text vector.

[0088] The advantage of doing this is that the efficiency of screening target technical text vectors among a large number of technical text vectors can be improved.

[0089] It can be seen from steps 301 to 303 that by determining that the alarm text vector corresponding to each alarm log matches the technical text vector of each technology, the technology corresponding to each alarm log can be determined more accurately, and the tactics corresponding to each alarm log can be determined through the technology, which can improve the accuracy of determining the tactics corresponding to each alarm log.

[0090] After obtaining the tactics corresponding to each alarm log, the attack dimension features corresponding to each source Internet Protocol address are generated according to the tactics. For example, the tactics corresponding to each alarm log can be encoded to generate a corresponding vector, which is the attack dimension feature corresponding to each source Internet Protocol address. The attack dimension feature is used to characterize the attack method corresponding to each source Internet Protocol address, and the attack dimension information corresponding to each source Internet Protocol address can be added. Or the attack dimension feature is the description text of the tactics corresponding to each alarm log.

[0091] In step 230, access information of each source Internet Protocol address within a preset time window is determined, and a behavior dimension feature corresponding to each source Internet Protocol address is generated based on the access information.

[0092] Within the preset time window, which can also be understood as the statistical window of each source Internet Protocol address, the access information corresponding to each source Internet Protocol address is determined. The access information can be understood as the access operation of each source Internet Protocol address to the target website or target network device, such as access frequency, number of logins, whether the target network device is accessed, etc. Then, based on the access information, the behavioral dimension features corresponding to each source Internet Protocol address are generated. For example, the access information corresponding to each source Internet Protocol address can be encoded to generate a corresponding vector, which is the behavioral dimension feature corresponding to each source Internet Protocol address. The behavioral dimension feature is used to characterize the behavior mode corresponding to each source Internet Protocol address, such as the access status of each source Internet Protocol address, so that the behavioral dimension information corresponding to each source Internet Protocol address can be increased. Or the behavioral dimension feature is the descriptive text of the behavioral information corresponding to each alarm log.

[0093] In some implementations, determining access information of each source Internet Protocol address within a preset time window includes: (1.1) obtaining a target source Internet Protocol address stored by a target network device after access by an external device, and generating a target source Internet Protocol address set based on the target source Internet Protocol address, wherein the target network device is a network device that induces a network attack; (1.2) matching each source Internet Protocol address with a set of target source Internet Protocol addresses within a preset time window to determine access status of each source Internet Protocol address to the target network device; (1.3) Obtain the frequency of visits to the target website by each source Internet Protocol address and the number of logins corresponding to each source Internet Protocol address; (1.4) Determine the access situation, access frequency and number of logins as the access information of each source Internet Protocol address within a preset time window.

[0094] Among them, first obtain the target source Internet Protocol address saved by the target network device after the external device accesses it. The target network device is a network device that induces network attacks. The target network device can be a four-honey device. The four-honey device has been explained in the above professional terminology. After the external device accesses the target network device, the target network device will record the target source Internet Protocol address corresponding to the external device. These target source Internet Protocol addresses are insecure Internet Protocol addresses. Finally, multiple target source Internet Protocol addresses generate a target source Internet Protocol address set.

[0095] Within a preset time window, each source Internet Protocol address is matched with the target source Internet Protocol address set to determine the access status of each source Internet Protocol address to the target network device. For example, if a source Internet Protocol address successfully matches the target source Internet Protocol address set, it means that the source Internet Protocol address is a target source Internet Protocol address in the target source Internet Protocol address set, and the source Internet Protocol address is unsafe, then the access status corresponding to the source Internet Protocol address is: the target network device has been accessed.

[0096] In the preset time window, the access frequency of each source Internet Protocol address to the target website and the number of logins corresponding to each source Internet Protocol address can also be obtained. For example, if the target website is an overseas website, the access frequency to the overseas website can be determined, and the number of logins to the overseas website by each source Internet Protocol address can also be determined.

[0097] Finally, the access situation, access frequency and login times are determined as the access information of each source Internet Protocol address within the preset time window. The access behavior corresponding to each source Internet Protocol address can be determined through the access information. Finally, the behavior dimension features corresponding to each source Internet Protocol address are generated based on the access information corresponding to each source Internet Protocol address.

[0098] In step 240, identification information corresponding to each source Internet Protocol address is obtained in the Internet Protocol address information library, and identification dimension features corresponding to each source Internet Protocol address are generated based on the identification information.

[0099] The Internet Protocol address information database contains some security information of Internet Protocol addresses, such as the maliciousness of the Internet Protocol address, whether the Internet Protocol address is a proxy Internet Protocol address, whether the Internet Protocol address is a scanning Internet Protocol address, whether the Internet Protocol address is a crawler Internet Protocol address, etc. All of this information is identification information of the Internet Protocol address. The identification information corresponding to each source Internet Protocol address can be obtained in the Internet Protocol address information database, and the identification dimension features corresponding to each source Internet Protocol address can be generated based on the identification information. The identification dimension features can be used to characterize the existing security labels of each source Internet Protocol address, that is, identification information. Or the identification dimension features are the descriptive text of the identification information corresponding to each alarm log.

[0100] In some implementations, obtaining identification information corresponding to each source Internet Protocol address in an Internet Protocol address information database includes: (1.1) matching each source Internet Protocol address with the Internet Protocol address information database to determine the security information, proxy information, scanning information, and crawler information corresponding to each source Internet Protocol address; (1.2) Determine the security information, proxy information, scanning information, and crawler information as identification information corresponding to each source Internet Protocol address.

[0101] Among them, it can be determined in the Internet Protocol address information database whether the currently matched source Internet Protocol address is included, and if so, the security information, proxy information, scanning information, and crawler information corresponding to the current source Internet Protocol address are determined. If not, the security information, proxy information, scanning information, and crawler information corresponding to the current source Internet Protocol address are all determined to be empty.

[0102] After obtaining the security information, proxy information, scanning information, and crawler information corresponding to the source Internet Protocol address, the security information, proxy information, scanning information, and crawler information can be determined as the identification information corresponding to the source Internet Protocol address. And based on the identification information, the identification dimension feature corresponding to each source Internet Protocol address is generated. For example, the identification information corresponding to each source Internet Protocol address is feature-encoded, thereby generating the identification dimension feature corresponding to each source Internet Protocol address.

[0103] In step 250, training data is generated according to the attack dimension features, behavior dimension features, and identification dimension features corresponding to each source Internet Protocol address, and the address security assessment model is iteratively trained using the training data until the address security assessment model converges to obtain a trained address security assessment model. The trained address security assessment model is used to perform security assessment on the source Internet Protocol address to be detected.

[0104] Among them, the attack dimension features, behavior dimension features and identification dimension features are all vectors. For example, a vector under the same dimension can concatenate the attack dimension features, behavior dimension features and identification dimension features corresponding to a source Internet Protocol address to generate a training data.

[0105] For another example, the attack dimension features, behavior dimension features, and identification dimension features are all descriptive texts. The attack dimension features, behavior dimension features, and identification dimension features corresponding to a source Internet Protocol address can be concatenated to generate a piece of training data.

[0106] The address security assessment model is then iteratively trained using the training data until the address security assessment model converges to obtain a trained address security assessment model, which is used to perform security assessment on the source Internet Protocol address to be detected.

[0107] Since the training data contains features of three dimensions: attack dimension, behavior dimension, and identification dimension, it can more comprehensively reflect the characteristics of the source Internet Protocol address, which is conducive to the address security assessment model to more comprehensively learn the information of the source Internet Protocol address, thereby achieving more accurate security assessment of each source Internet Protocol address.

[0108] In some implementations, generating training data according to the attack dimension feature, behavior dimension feature, and identification dimension feature corresponding to each source Internet Protocol address includes: (1.1) Concatenate the attack dimension features, behavior dimension features, and identification dimension features corresponding to each source Internet Protocol address to obtain a feature vector corresponding to each source Internet Protocol address; (1.2) Generate training data based on the feature vector corresponding to each source Internet Protocol address.

[0109] Among them, the attack dimension features, behavior dimension features and identification dimension features corresponding to each source Internet Protocol address are spliced ​​to obtain the feature vector corresponding to each source Internet Protocol address. The feature vector corresponding to each source Internet Protocol address can be considered as a training data. In this way, the feature vector corresponding to each source Internet Protocol address is set in a set, and the data in the set is the training data.

[0110] In some implementations, the address security assessment model is iteratively trained using training data until the address security assessment model converges to obtain a trained address security assessment model, including: (2.1) Input the feature vector corresponding to each source Internet Protocol address in the training data into the address security assessment model and output the predicted security score value; (2.2) determining a loss value between the label security score value and the predicted security score value corresponding to each source Internet Protocol address; (2.3) When the loss value does not meet the preset loss condition, the parameters corresponding to the address security assessment model are adjusted according to the loss value to iterate the address security assessment model, and the feature vector corresponding to each source Internet Protocol address is input into the address security assessment model again until the loss value meets the preset loss condition. The address security assessment model converges and the trained address security assessment model is obtained.

[0111] The address security assessment model can be a linear regression model, or other types of machine learning models can be used. When the address security assessment model is a linear regression model, its corresponding function expression is as follows: .in, Predicted safety score value, is the feature vector corresponding to a source Internet Protocol address, i is the label corresponding to a source Internet Protocol address, are the parameters corresponding to the linear regression model.

[0112] The feature vector corresponding to each source Internet Protocol address in the training data can be input into the address security assessment model to output a predicted security score. Then, the loss value between the label security score and the predicted security score corresponding to each source Internet Protocol address is determined. For example, the label security score and the predicted security score corresponding to each source Internet Protocol address are input into a preset loss function to obtain a loss value. The preset loss function is as follows: .in, is the loss value, is the security score corresponding to a source Internet Protocol address. is the label security score value corresponding to the source Internet Protocol address, and the label security score value is the actual security score value corresponding to the source Internet Protocol address.

[0113] When the loss value is greater than the preset loss value, it is considered that the loss value does not meet the preset loss condition. At this time, the corresponding parameters of the address security assessment model are adjusted according to the loss value to iterate the address security assessment model, and return to execute the input of the feature vector corresponding to each source Internet Protocol address into the address security assessment model to realize the next iteration training of the iterated security assessment model. When the loss value is less than or equal to the preset loss value, the address security assessment model converges and the trained address security assessment model is obtained. The trained address security assessment model is used to perform security assessment on the source Internet Protocol address to be detected.

[0114] From the above content, it can be seen that in the embodiment of the present application, since the characteristics of the three dimensions of attack dimension, behavior dimension and identification dimension are added to the training data of the address security assessment model, the address security assessment model can learn the information related to each source Internet Protocol address more comprehensively, so that the address security assessment model can more quickly and accurately assess the security of each source Internet Protocol address, thereby improving the training speed of the address security assessment model and improving the prediction accuracy of the trained address security assessment model for the security score of the source Internet Protocol address.

[0115] See also Figure 5 , Figure 5 is a processing flow chart of the trained address security assessment model provided in the embodiment of the present application. In some embodiments, after obtaining the trained address security assessment model, the method further includes the following steps: Step 401: Obtain an alarm log to be detected, and determine the source Internet Protocol address to be detected according to the alarm log to be detected; Step 402: Determine the behavior dimension feature, access dimension feature, and identification dimension feature of the Internet Protocol address to be detected; Step 403: Generate input features according to the behavior dimension features, access dimension features, and identification dimension features of the Internet Protocol address to be detected; Step 404: input the input features into the trained address security assessment model to obtain a security score corresponding to the source Internet Protocol address to be detected; Step 405: Execute a corresponding processing strategy on the source Internet Protocol address to be detected according to the security score.

[0116] Steps 401 to 405 will be described in detail below.

[0117] In step 401, the alarm log to be detected is obtained, and the source Internet Protocol address to be detected is determined according to the alarm log to be detected.

[0118] The to-be-detected alarm log may be acquired by the current security system, and the to-be-detected source Internet Protocol address that needs to be subjected to security inspection may be determined in the to-be-detected alarm log.

[0119] In step 402, the behavior dimension features, access dimension features, and identification dimension features of the Internet Protocol address to be detected are determined.

[0120] Among them, the tactics corresponding to the Internet Protocol address to be detected can be determined based on the alarm log to be detected and the preset network security knowledge base, and the attack dimension characteristics corresponding to the Internet Protocol address to be detected can be generated based on the tactics; the access information of the Internet Protocol address to be detected within a preset time window can be determined, and the behavior dimension characteristics corresponding to the Internet Protocol address to be detected can be generated based on the access information; the identification information corresponding to the Internet Protocol address to be detected can be obtained in the Internet Protocol address information library, and the identification dimension characteristics corresponding to the Internet Protocol address to be detected can be generated based on the identification information.

[0121] In step 403, input features are generated according to the behavior dimension features, access dimension features and identification dimension features of the Internet Protocol address to be detected.

[0122] The attack dimension features, behavior dimension features, and identification dimension features corresponding to the Internet Protocol address to be detected are concatenated to obtain the input features corresponding to the Internet Protocol address to be detected.

[0123] In step 404, the input features are input into the trained address security assessment model to obtain a security score corresponding to the source Internet Protocol address to be detected.

[0124] For example, the highest security score is 10 points and the lowest is 0 points. The lower the security score, the more secure the source Internet Protocol address to be detected is, and the higher the security score, the less secure the source Internet Protocol address to be detected is.

[0125] In step 405, a corresponding processing strategy is executed on the source Internet Protocol address to be detected according to the security score.

[0126] When the security score of the source Internet Protocol address to be detected is in the range of 0 to 3 points (excluding the maximum value), the source Internet Protocol address to be detected is safe and is released; when the security score of the source Internet Protocol address to be detected is in the range of 3 to 6 points (excluding the maximum value), the source Internet Protocol address to be detected is a suspicious Internet Protocol address and a security check is performed on the source Internet Protocol address to be detected; when the security score of the source Internet Protocol address to be detected is in the range of 6 to 8 points (excluding the maximum value), the source Internet Protocol address to be detected is moderately insecure and is temporarily blocked; when the security score of the source Internet Protocol address to be detected is in the range of 8 to 10 points, the source Internet Protocol address to be detected is highly insecure and is permanently blocked.

[0127] It can be seen from the above content that in an embodiment of the present application, by obtaining the alarm log data saved by the security system and the source Internet Protocol address corresponding to each alarm log in the alarm log data; according to the alarm log data and the preset network security knowledge base, the tactics corresponding to each source Internet Protocol address are determined, and the attack dimension characteristics corresponding to each source Internet Protocol address are generated according to the tactics; the access information of each source Internet Protocol address within a preset time window is determined, and the behavior dimension characteristics corresponding to each source Internet Protocol address are generated based on the access information; the identification information corresponding to each source Internet Protocol address is obtained in the Internet Protocol address information library, and the identification dimension characteristics corresponding to each source Internet Protocol address are generated based on the identification information; training data is generated according to the attack dimension characteristics, behavior dimension characteristics and identification dimension characteristics corresponding to each source Internet Protocol address, and the address security assessment model is iteratively trained through the training data until the address security assessment model converges to obtain the trained address security assessment model, and the trained address security assessment model is used to perform security assessment on the source Internet Protocol address to be detected.

[0128] In this way, by obtaining the source Internet Protocol address in the alarm log, and then determining the tactics corresponding to the source Internet Protocol address through the preset network security knowledge base, generating the attack dimension characteristics of the source Internet Protocol address in the attack dimension according to the tactics, and then determining the access information of the source Internet Protocol address, determining the behavior dimension characteristics of the source Internet Protocol address in the behavior dimension according to the access information, and then determining the identification information corresponding to the source Internet Protocol address through the Internet Protocol address information library, generating the identification dimension characteristics of the source Internet Protocol address in the identification dimension according to the identification information, and finally generating the comprehensive characteristics for characterizing the Internet Protocol address according to the attack dimension characteristics, behavior dimension characteristics and identification dimension characteristics of the source Internet Protocol address, using the comprehensive characteristics of the source Internet Protocol address of each alarm log as training data, realizing iterative training of the address security assessment model, and obtaining the trained address security assessment model. The trained address security assessment model can efficiently and accurately perform security assessment on the source Internet Protocol address to be detected. Compared with the security of the source Internet Protocol address to be detected in the related art that relies on human judgment, the trained address security assessment model in this application has higher security assessment efficiency and more accurate security assessment results for the source Internet Protocol address to be detected.

[0129] See also Figure 6 , Figure 6 1 is another flow chart of the address security assessment model training method provided in the embodiment of the present application. The address security assessment model training method may include the following steps: Step 501: Acquire alarm log data stored in a security system and a source Internet Protocol address corresponding to each alarm log in the alarm log data; Step 502: determining an alarm text vector corresponding to each alarm log in the alarm log data, and determining a technology text vector corresponding to each technology in a preset network security knowledge base; Step 503: Determine the similarity between each warning text vector and each technical text vector; Step 504: determine the target technology text vector corresponding to each alarm text vector according to the similarity, determine the tactic to which the technology corresponding to the target technology text vector belongs as the tactic corresponding to the source Internet Protocol address associated with each alarm log, and generate the attack dimension feature corresponding to each source Internet Protocol address according to the tactic; Step 505: obtaining a target source Internet Protocol address after access by an external device stored in the target network device, and generating a target source Internet Protocol address set according to the target source Internet Protocol address, wherein the target network device is a network device that induces a network attack; Step 506: Match each source Internet Protocol address with the target source Internet Protocol address set within a preset time window to determine the access status of each source Internet Protocol address to the target network device; Step 507: Obtain the access frequency of each source Internet Protocol address to the target website and the number of logins corresponding to each source Internet Protocol address; Step 508: Determine the access situation, access frequency, and login times as access information of each source Internet Protocol address within a preset time window, and generate a behavior dimension feature corresponding to each source Internet Protocol address based on the access information; Step 509: Match each source Internet Protocol address with an Internet Protocol address information database to determine security information, proxy information, scanning information, and crawler information corresponding to each source Internet Protocol address; Step 510: Determine the security information, proxy information, scanning information, and crawler information as identification information corresponding to each source Internet Protocol address, and generate identification dimension features corresponding to each source Internet Protocol address based on the identification information; Step 511: Generate training data based on the attack dimension features, behavior dimension features, and identification dimension features corresponding to each source Internet Protocol address, and iteratively train the address security assessment model through the training data until the address security assessment model converges to obtain a trained address security assessment model. The trained address security assessment model is used to perform security assessment on the source Internet Protocol address to be detected.

[0130] In the above embodiments, the description of each embodiment has its own focus. For the part that is not described in detail in a certain embodiment, please refer to the detailed description of the above-mentioned address security assessment model training method, which will not be repeated here.

[0131] See also Figure 7 , Figure 7 It is a structural diagram of an address security assessment model training device provided in this embodiment.

[0132] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program that has a predetermined function and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories), or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0133] The address assessment model training device 600 includes: An acquisition module 610, configured to acquire the alarm log data stored in the security system and a source Internet Protocol address corresponding to each alarm log in the alarm log data; A first determination module 620 is used to determine the tactics corresponding to each source Internet Protocol address based on the alarm log data and a preset network security knowledge base, and generate attack dimension features corresponding to each source Internet Protocol address based on the tactics; A second determination module 630 is used to determine access information of each source Internet Protocol address within a preset time window, and generate a behavior dimension feature corresponding to each source Internet Protocol address based on the access information; A third determination module 640 is used to obtain identification information corresponding to each source Internet Protocol address in the Internet Protocol address information database, and generate identification dimension features corresponding to each source Internet Protocol address based on the identification information; The training module 650 is used to generate training data according to the attack dimension characteristics, behavior dimension characteristics and identification dimension characteristics corresponding to each source Internet Protocol address, and iteratively train the address security assessment model through the training data until the address security assessment model converges to obtain the trained address security assessment model. The trained address security assessment model is used to perform security assessment on the source Internet Protocol address to be detected.

[0134] In some implementations, the first determination module 620 includes a first determination submodule, a second determination submodule, and a third determination submodule; A first determination submodule is used to determine an alarm text vector corresponding to each alarm log in the alarm log data, and to determine a technology text vector corresponding to each technology in a preset network security knowledge base; A second determination submodule is used to determine the similarity between each warning text vector and each technical text vector; The third determination submodule is used to determine the target technology text vector corresponding to each alarm text vector according to the similarity, and determine the tactics corresponding to the technology corresponding to the target technology text vector as the tactics corresponding to the source Internet Protocol address associated with each alarm log.

[0135] In some implementations, the first determining submodule is configured to: Generate an alarm text according to the event type text and alarm description text corresponding to each alarm log in the alarm log data; Input the alarm text into the pre-trained text processing model, and output the alarm text vector corresponding to each alarm log in the alarm log data; Determine the technical description text corresponding to each technology in the preset network security knowledge base; The technical description text is input into the pre-trained text processing model, and the technical text vector corresponding to each technology in the preset cybersecurity knowledge base is output.

[0136] In some implementations, the third determining submodule is configured to: In the technical text vectors, a candidate technical text vector corresponding to each warning text vector is determined, the similarity of which is greater than a preset similarity threshold; Among the candidate technical text vectors, the candidate technical text vector with the greatest similarity is determined as the target technical text vector corresponding to each warning text vector.

[0137] In some implementations, the second determination module 630 is configured to: Obtaining a target source Internet Protocol address after access by an external device stored in a target network device, and generating a target source Internet Protocol address set according to the target source Internet Protocol address, wherein the target network device is a network device that induces a network attack; Matching each source Internet Protocol address with a set of target source Internet Protocol addresses within a preset time window to determine access of each source Internet Protocol address to the target network device; Obtain the frequency of visits to the target website by each source Internet Protocol address and the number of logins corresponding to each source Internet Protocol address; The access situation, access frequency and number of logins are determined as the access information of each source Internet Protocol address within a preset time window.

[0138] In some implementations, the third determination module 640 is configured to: Matching each source Internet Protocol address with an Internet Protocol address information database to determine security information, proxy information, scanning information, and crawler information corresponding to each source Internet Protocol address; The security information, proxy information, scanning information, and crawler information are determined as identification information corresponding to each source Internet Protocol address.

[0139] In some embodiments, the training module 650 is used to: The attack dimension features, behavior dimension features, and identification dimension features corresponding to each source Internet Protocol address are concatenated to obtain a feature vector corresponding to each source Internet Protocol address; Generate training data based on the feature vector corresponding to each source Internet Protocol address.

[0140] In some embodiments, the training module 650 is used to: Input the feature vector corresponding to each source Internet Protocol address in the training data into the address security assessment model and output a predicted security score value; Determine a loss value between the label security score value and the predicted security score value corresponding to each source Internet Protocol address; When the loss value does not meet the preset loss condition, the corresponding parameters of the address security assessment model are adjusted according to the loss value to iterate the address security assessment model, and return to execute to input the feature vector corresponding to each source Internet Protocol address into the address security assessment model until the loss value meets the preset loss condition. The address security assessment model converges to obtain the trained address security assessment model.

[0141] In some implementations, the acquisition module 610 is configured to: Obtaining original alarm log data in the security system, and determining a target field corresponding to each original alarm log in the original alarm log data; Perform format conversion on the target field to obtain the alarm log corresponding to each original alarm log; The alarm log corresponding to each original alarm log is determined as the alarm log data.

[0142] In some embodiments, the address security assessment model training device further includes a detection module for: Obtaining the alarm log to be detected, and determining the source Internet Protocol address to be detected according to the alarm log to be detected; Determine the behavior dimension characteristics, access dimension characteristics and identification dimension characteristics of the Internet Protocol address to be detected; Generate input features according to the behavior dimension features, access dimension features and identification dimension features of the Internet Protocol address to be detected; Input the input features into the trained address security assessment model to obtain the security score corresponding to the source Internet Protocol address to be detected; Execute corresponding processing strategies on the source Internet Protocol addresses to be detected based on the security scores.

[0143] In the above embodiments, the description of each embodiment has its own focus. For the part that is not described in detail in a certain embodiment, please refer to the detailed description of the above-mentioned address security assessment model training method, which will not be repeated here.

[0144] As can be seen from the above content, in an embodiment of the present application, the acquisition module 610 acquires the alarm log data saved by the security system and the source Internet Protocol address corresponding to each alarm log in the alarm log data; the first determination module 620 determines the tactics corresponding to each source Internet Protocol address based on the alarm log data and the preset network security knowledge base, and generates the attack dimension characteristics corresponding to each source Internet Protocol address based on the tactics; the second determination module 630 determines the access information of each source Internet Protocol address within a preset time window, and generates the behavior dimension characteristics corresponding to each source Internet Protocol address based on the access information; the third determination module 640 acquires the identification information corresponding to each source Internet Protocol address in the Internet Protocol address information library, and generates the identification dimension characteristics corresponding to each source Internet Protocol address based on the identification information; the training module 650 generates training data according to the attack dimension characteristics, behavior dimension characteristics and identification dimension characteristics corresponding to each source Internet Protocol address, and iteratively trains the address security assessment model through the training data until the address security assessment model converges to obtain the trained address security assessment model, and the trained address security assessment model is used to perform security assessment on the source Internet Protocol address to be detected.

[0145] In this way, by obtaining the source Internet Protocol address in the alarm log, and then determining the tactics corresponding to the source Internet Protocol address through the preset network security knowledge base, generating the attack dimension characteristics of the source Internet Protocol address in the attack dimension according to the tactics, and then determining the access information of the source Internet Protocol address, determining the behavior dimension characteristics of the source Internet Protocol address in the behavior dimension according to the access information, and then determining the identification information corresponding to the source Internet Protocol address through the Internet Protocol address information library, generating the identification dimension characteristics of the source Internet Protocol address in the identification dimension according to the identification information, and finally generating the comprehensive characteristics for characterizing the Internet Protocol address according to the attack dimension characteristics, behavior dimension characteristics and identification dimension characteristics of the source Internet Protocol address, using the comprehensive characteristics of the source Internet Protocol address of each alarm log as training data, realizing iterative training of the address security assessment model, and obtaining the trained address security assessment model. The trained address security assessment model can efficiently and accurately perform security assessment on the source Internet Protocol address to be detected. Compared with the security of the source Internet Protocol address to be detected in the related art that relies on human judgment, the trained address security assessment model in this application has higher security assessment efficiency and more accurate security assessment results for the source Internet Protocol address to be detected.

[0146] The embodiment of the present application also provides a computer device, the computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the above-mentioned address security assessment model training method when executing the computer program. The computer device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0147] See also Figure 8 , Figure 8 The hardware structure of a computer device according to another embodiment is shown, and the computer device includes: The processor 701 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application; The memory 702 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 702 can store an operating system and other applications. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 702, and the processor 701 calls and executes the address security assessment model training method of the embodiment of this application; Input / output interface 703, used to implement information input and output; Communication interface 704, used to realize communication interaction between the device and other devices, which can be realized through wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WIFI, Bluetooth, etc.); A bus 705 that transmits information between various components of the device (e.g., the processor 701, the memory 702, the input / output interface 703, and the communication interface 704); The processor 701 , the memory 702 , the input / output interface 703 and the communication interface 704 are connected to each other in communication within the device via a bus 705 .

[0148] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program, and when the computer program is executed by a processor, the above-mentioned address security assessment model training method is implemented.

[0149] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0150] The embodiment of the present application also provides a computer program product or a computer program, which includes a computer instruction, and the computer instruction is stored in a computer-readable storage medium. The processor of the computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the address security assessment model training method provided in various optional implementations provided in the above embodiments.

[0151] The address security assessment model training method, apparatus, equipment and medium provided in the embodiments of the present application obtain alarm log data stored in a security system and the source Internet Protocol address corresponding to each alarm log in the alarm log data; determine the tactics corresponding to each source Internet Protocol address based on the alarm log data and a preset network security knowledge base, and generate attack dimension features corresponding to each source Internet Protocol address based on the tactics; determine the access information of each source Internet Protocol address within a preset time window, and generate behavior dimension features corresponding to each source Internet Protocol address based on the access information; obtain identification information corresponding to each source Internet Protocol address in an Internet Protocol address information library, and generate identification dimension features corresponding to each source Internet Protocol address based on the identification information; generate training data based on the attack dimension features, behavior dimension features and identification dimension features corresponding to each source Internet Protocol address, and iteratively train the address security assessment model through the training data until the address security assessment model converges to obtain a trained address security assessment model, and the trained address security assessment model is used to perform security assessment on the source Internet Protocol address to be detected.

[0152] In this way, by obtaining the source Internet Protocol address in the alarm log, and then determining the tactics corresponding to the source Internet Protocol address through the preset network security knowledge base, generating the attack dimension characteristics of the source Internet Protocol address in the attack dimension according to the tactics, and then determining the access information of the source Internet Protocol address, determining the behavior dimension characteristics of the source Internet Protocol address in the behavior dimension according to the access information, and then determining the identification information corresponding to the source Internet Protocol address through the Internet Protocol address information library, generating the identification dimension characteristics of the source Internet Protocol address in the identification dimension according to the identification information, and finally generating the comprehensive characteristics for characterizing the Internet Protocol address according to the attack dimension characteristics, behavior dimension characteristics and identification dimension characteristics of the source Internet Protocol address, using the comprehensive characteristics of the source Internet Protocol address of each alarm log as training data, realizing iterative training of the address security assessment model, and obtaining the trained address security assessment model. The trained address security assessment model can efficiently and accurately perform security assessment on the source Internet Protocol address to be detected. Compared with the security of the source Internet Protocol address to be detected in the related art that relies on human judgment, the trained address security assessment model in this application has higher security assessment efficiency and more accurate security assessment results for the source Internet Protocol address to be detected.

[0153] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0154] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0155] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0156] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0157] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0158] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0159] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0160] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0161] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0162] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0163] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

[0164] The above is a detailed introduction to an address security assessment model training method, device, equipment and medium provided in the embodiments of the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for technical personnel in this field, according to the ideas of the present application, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for training an address security assessment model, characterized in that: include: Acquire alarm log data stored in the security system and a source Internet Protocol address corresponding to each alarm log in the alarm log data; Determine the tactics corresponding to each source Internet Protocol address based on the alarm log data and a preset network security knowledge base, and generate attack dimension features corresponding to each source Internet Protocol address based on the tactics; Determine access information of each source Internet Protocol address within a preset time window, and generate a behavior dimension feature corresponding to each source Internet Protocol address based on the access information; Obtaining identification information corresponding to each source Internet Protocol address in an Internet Protocol address information database, and generating identification dimension features corresponding to each source Internet Protocol address based on the identification information; Training data is generated according to the attack dimension feature, the behavior dimension feature and the identification dimension feature corresponding to each source Internet Protocol address, and the address security assessment model is iteratively trained through the training data until the address security assessment model converges, thereby obtaining a trained address security assessment model, which is used to perform security assessment on the source Internet Protocol address to be detected.

2. The address security assessment model training method according to claim 1, characterized in that: Determining the tactics corresponding to each source Internet Protocol address according to the alarm log data and a preset network security knowledge base includes: Determine an alarm text vector corresponding to each alarm log in the alarm log data, and determine a technology text vector corresponding to each technology in a preset network security knowledge base; Determining the similarity between each warning text vector and each technical text vector; The target technology text vector corresponding to each alarm text vector is determined according to the similarity, and the tactics to which the technology corresponding to the target technology text vector belongs are determined as the tactics corresponding to the source Internet Protocol address associated with each alarm log.

3. The address security assessment model training method according to claim 2, characterized in that: The determining of the alarm text vector corresponding to each alarm log in the alarm log data, and the determining of the technology text vector corresponding to each technology in the preset network security knowledge base, include: Generate an alarm text according to the event type text and the alarm description text corresponding to each alarm log in the alarm log data; Inputting the alarm text into a pre-trained text processing model, and outputting an alarm text vector corresponding to each alarm log in the alarm log data; Determine the technical description text corresponding to each technology in the preset network security knowledge base; The technical description text is input into a pre-trained text processing model, and a technical text vector corresponding to each technology in the preset network security knowledge base is output.

4. The address security assessment model training method according to claim 2, characterized in that: The step of determining the target technology text vector corresponding to each warning text vector according to the similarity includes: Determine, among the technical text vectors, a candidate technical text vector corresponding to each of the warning text vectors, the similarity of which is greater than a preset similarity threshold; Among the candidate technical text vectors, the candidate technical text vector with the greatest similarity is determined as the target technical text vector corresponding to each warning text vector.

5. The address security assessment model training method according to claim 1, characterized in that: The determining the access information of each source Internet Protocol address within a preset time window includes: Obtaining a target source Internet Protocol address after access by an external device and stored by a target network device, and generating a target source Internet Protocol address set according to the target source Internet Protocol address, wherein the target network device is a network device that induces a network attack; Matching each source Internet Protocol address with the target source Internet Protocol address set within a preset time window to determine access status of each source Internet Protocol address to the target network device; Obtaining the access frequency of each source Internet Protocol address to the target website and the number of logins corresponding to each source Internet Protocol address; The access situation, the access frequency and the number of logins are determined as access information of each source Internet Protocol address within a preset time window.

6. The address security assessment model training method according to claim 1, characterized in that: The acquiring identification information corresponding to each source Internet Protocol address in an Internet Protocol address information database includes: Matching each of the source Internet Protocol addresses with an Internet Protocol address information database to determine security information, proxy information, scanning information, and crawler information corresponding to each of the source Internet Protocol addresses; The security information, the proxy information, the scanning information and the crawler information are determined as identification information corresponding to each source Internet Protocol address.

7. The address security assessment model training method according to claim 1, characterized in that: Generating training data according to the attack dimension feature, the behavior dimension feature, and the identification dimension feature corresponding to each source Internet Protocol address includes: Concatenate the attack dimension feature, the behavior dimension feature, and the identification dimension feature corresponding to each source Internet Protocol address to obtain a feature vector corresponding to each source Internet Protocol address; Training data is generated according to the feature vector corresponding to each source Internet Protocol address.

8. The address security assessment model training method according to claim 7, characterized in that: The iterative training of the address security assessment model by using the training data until the address security assessment model converges to obtain a trained address security assessment model includes: Inputting the feature vector corresponding to each source Internet Protocol address in the training data into the address security assessment model, and outputting a predicted security score value; Determine a loss value between a label security score value and a predicted security score value corresponding to each source Internet Protocol address; When the loss value does not meet the preset loss condition, the parameters corresponding to the address security assessment model are adjusted according to the loss value to iterate the address security assessment model, and the execution is returned to input the feature vector corresponding to each source Internet Protocol address into the address security assessment model until the loss value meets the preset loss condition. The address security assessment model converges to obtain a trained address security assessment model.

9. The address security assessment model training method according to claim 1, characterized in that: The step of obtaining the alarm log data stored in the security system includes: Acquire original alarm log data in the security system, and determine a target field corresponding to each original alarm log in the original alarm log data; Performing format conversion on the target field to obtain an alarm log corresponding to each original alarm log; The alarm log corresponding to each original alarm log is determined as the alarm log data.

10. The address security assessment model training method according to claim 1, characterized in that: After obtaining the trained address security assessment model, the method further includes: Obtaining an alarm log to be detected, and determining a source Internet Protocol address to be detected according to the alarm log to be detected; Determine the behavior dimension characteristics, access dimension characteristics and identification dimension characteristics of the Internet Protocol address to be detected; Generate input features according to the behavior dimension features, access dimension features and identification dimension features of the Internet Protocol address to be detected; Inputting the input feature into the trained address security assessment model to obtain a security score corresponding to the source Internet Protocol address to be detected; A corresponding processing strategy is executed on the source Internet Protocol address to be detected according to the security score.

11. An address security assessment model training device, characterized in that: include: An acquisition module, used to acquire the alarm log data stored in the security system and the source Internet Protocol address corresponding to each alarm log in the alarm log data; A first determination module is used to determine the tactics corresponding to each source Internet Protocol address according to the alarm log data and a preset network security knowledge base, and generate attack dimension features corresponding to each source Internet Protocol address according to the tactics; A second determination module is used to determine access information of each source Internet Protocol address within a preset time window, and generate a behavior dimension feature corresponding to each source Internet Protocol address based on the access information; A third determination module is used to obtain identification information corresponding to each source Internet Protocol address in an Internet Protocol address information database, and generate identification dimension features corresponding to each source Internet Protocol address based on the identification information; A training module is used to generate training data according to the attack dimension features, the behavior dimension features and the identification dimension features corresponding to each source Internet Protocol address, and iteratively train the address security assessment model through the training data until the address security assessment model converges to obtain a trained address security assessment model, and the trained address security assessment model is used to perform security assessment on the source Internet Protocol address to be detected.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a plurality of instructions, which are suitable for loading by a processor to execute the address security assessment model training method described in any one of claims 1 to 10.

13. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the address security assessment model training method described in any one of claims 1 to 10 is implemented.

Images