Network attack behavior detection method and device, storage medium and computer equipment

Abstract

The invention discloses a network attack behavior detection method and device, a storage medium and computer equipment, and the method comprises the steps: obtaining a plurality of pieces of network data, and constructing a to-be-analyzed graph structure based on the plurality of pieces of network data; based on a preset attack mode pattern, judging whether a first target sub-graph matched with the preset attack mode pattern exists in the to-be-analyzed graph structure, and when the first target sub-graph exists, determining that a network attack behavior indicated by the preset attack mode pattern exists in the to-be-analyzed graph structure; and generating a network attack behavior detection result corresponding to the plurality of pieces of network data according to the first target sub-graph and the corresponding network attack behavior. According to the invention, the attack behavior in the network can be detected more comprehensively and more accurately, and the possibility of false report and missing report is reduced; in addition, potential network attack behaviors can be quickly positioned, the detection efficiency is improved, and timely response to network security threats is facilitated.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network attack behavior detection method and device, storage medium, and computer equipment. Background Art

[0002] With the rapid development of Internet technology, network security issues have become increasingly prominent, and various attack methods have emerged, bringing huge challenges to network security. Therefore, it is very important to be able to detect network attack behaviors in a timely and accurate manner.

[0003] When identifying network attack behaviors, existing technologies mostly extract features from network data based on deep learning models, and then judge whether there is attack behavior in the network data based on the extracted features. However, due to the variety of network attack methods, a large amount of sample data is often required when training the model, and the structure of the deep learning model is complex, and the training process consumes a lot of computing resources and time. In addition, when judging whether there is a network attack behavior through a deep learning model, the accuracy of the judgment result is heavily dependent on the accuracy of the model, and the accuracy and generalization ability of the model are highly dependent on the quality and diversity of the sample data. Sample data deviation is likely to lead to model misjudgment. Summary of the invention

[0004] In view of this, the present application provides a network attack behavior detection method and device, storage medium, and computer equipment. By acquiring multiple network data such as network topology information, network traffic information, system log information, etc., and constructing a graph structure to be analyzed based on the multiple network data, it is possible to more comprehensively detect attack behaviors in the network; by constructing a graph structure to be analyzed and matching it with a preset attack pattern graph, it is possible to more accurately identify network attack behaviors and reduce the possibility of false alarms and missed alarms; through the matching algorithm of the graph structure, potential network attack behaviors can be quickly located, thereby improving the efficiency of detection and helping to respond to network security threats in a timely manner.

[0005] According to one aspect of the present application, a network attack behavior detection method is provided, comprising:

[0006] Acquire multiple pieces of network data, and construct a graph structure to be analyzed based on the multiple pieces of network data;

[0007] Based on a preset attack pattern graph, determining whether there is a first target subgraph matching the preset attack pattern graph in the graph structure to be analyzed, and if so, determining whether there is a network attack behavior indicated by the preset attack pattern graph in the graph structure to be analyzed;

[0008] According to the first target subgraph and the corresponding network attack behavior, network attack behavior detection results corresponding to the multiple network data are generated.

[0009] According to another aspect of the present application, a network attack behavior detection device is provided, comprising:

[0010] A graph structure building module, used to obtain multiple network data and build a graph structure to be analyzed based on the multiple network data;

[0011] A judgment module, used to judge whether there is a first target subgraph matching the preset attack pattern graph in the graph structure to be analyzed based on the preset attack pattern graph, and if so, determine whether there is a network attack behavior indicated by the preset attack pattern graph in the graph structure to be analyzed;

[0012] A detection result generation module is used to generate network attack behavior detection results corresponding to the multiple network data according to the first target subgraph and the corresponding network attack behavior.

[0013] According to another aspect of the present application, a storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the above-mentioned network attack behavior detection method is implemented.

[0014] According to another aspect of the present application, a computer device is provided, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor implements the above-mentioned network attack behavior detection method when executing the program.

[0015] By means of the above technical scheme, the present application provides a network attack behavior detection method and device, storage medium, and computer equipment. First, multiple network data can be obtained from the network environment, and based on these network data, a graph structure to be analyzed can be constructed. Then, a first target subgraph matching the preset attack pattern graph can be found in the graph structure to be analyzed. If the first target subgraph matching the preset attack pattern graph is found in the graph structure to be analyzed, it can be determined that the network attack behavior indicated by the preset attack pattern graph exists in the graph structure to be analyzed. Finally, based on the first target subgraph found and the corresponding network attack behavior, a network attack behavior detection result corresponding to multiple network data is generated. The embodiment of the present application obtains multiple network data such as network topology information, network traffic information, system log information, and constructs a graph structure to be analyzed according to multiple network data, so as to more comprehensively detect attack behaviors in the network; by constructing a graph structure to be analyzed and matching it with a preset attack pattern graph, network attack behaviors can be more accurately identified, reducing the possibility of false positives and false negatives; through the matching algorithm of the graph structure, potential network attack behaviors can be quickly located, the efficiency of detection is improved, and it is helpful to respond to network security threats in a timely manner.

[0016] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 A schematic diagram of a flow chart of a network attack behavior detection method provided in an embodiment of the present application is shown;

[0019] Figure 2 A schematic diagram of converting multiple network data into a graph structure to be analyzed is shown in an embodiment of the present application;

[0020] Figure 3 A preset attack mode diagram provided in an embodiment of the present application is shown;

[0021] Figure 4 A schematic diagram of a process flow of another network attack behavior detection method provided by an embodiment of the present application is shown;

[0022] Figure 5 A schematic diagram of the structure of a network attack behavior detection device provided in an embodiment of the present application is shown;

[0023] Figure 6 A schematic diagram of the device structure of a computer device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0024] The present application will be described in detail below with reference to the accompanying drawings and in combination with embodiments. It should be noted that the embodiments and features in the embodiments of the present application can be combined with each other without conflict.

[0025] In this embodiment, a network attack behavior detection method is provided. Figure 1 As shown, the method includes:

[0026] Step 101: Acquire multiple pieces of network data, and construct a graph structure to be analyzed based on the multiple pieces of network data.

[0027] A network attack behavior detection method provided in an embodiment of the present application can accurately detect network attack behaviors existing in network data. First, multiple network data can be obtained from the network environment. These network data may include network topology information, network traffic information, system log information, etc. Among them, the network topology information describes the connection relationship between network nodes, including information such as the type of node, IP address, MAC address, etc.; the network traffic information describes the transmission of data in the network, including information such as the type of data, source address, destination address, transmission time, etc.; the system log information describes the operation of the network node, including information such as login, logout, and file operations. Based on these network data, a graph structure to be analyzed can be constructed. In this graph structure to be analyzed, nodes can represent entities in the network (such as hosts, servers, users, etc.), and edges can represent interactions or connections between these entities. For example Figure 2 As shown, a graph structure to be analyzed is constructed from multiple network data.

[0028] Step 102, based on a preset attack pattern graph, determines whether there is a first target subgraph matching the preset attack pattern graph in the graph structure to be analyzed, and if so, determines whether there is a network attack behavior indicated by the preset attack pattern graph in the graph structure to be analyzed.

[0029] In this embodiment, the preset attack pattern graph is a predefined graph structure, which represents a certain known network attack behavior pattern. This pattern graph may include specific nodes and edges, as well as the connection relationships between them, which together indicate a specific network attack behavior. Figure 3As shown, a preset attack pattern graph is given. The preset attack pattern graph can be formulated through expert experience. After the structure of the graph to be analyzed is constructed, the first target subgraph matching the preset attack pattern graph can be found in the structure of the graph to be analyzed. Here, the first target subgraph can be a subgraph similar to the preset attack pattern graph in structure and node attributes, or a subgraph with completely consistent structure and node attributes, which can be determined according to actual needs. Among them, the node attributes include one or more of the node unique identifier (ID), node name, node type, node IP address, node MAC address, and the network segment in which the node is located. Optionally, a graph search algorithm such as a subgraph matching algorithm can be used to find the first target subgraph matching the preset attack pattern graph in the graph structure to be analyzed. If the first target subgraph matching the preset attack pattern graph is found in the graph structure to be analyzed, it can be determined that the network attack behavior indicated by the preset attack pattern graph exists in the graph structure to be analyzed. It should be noted that the preset attack pattern graph can include multiple, each preset attack pattern graph is used to indicate a network attack behavior. When the preset attack pattern graph includes multiple, the first target subgraph corresponding to each preset attack pattern graph can be found in the graph structure to be analyzed.

[0030] Step 103: Generate network attack behavior detection results corresponding to the plurality of network data according to the first target subgraph and the corresponding network attack behavior.

[0031] In this embodiment, finally, based on the first target subgraph found and the corresponding network attack behavior, a network attack behavior detection result corresponding to the plurality of network data is generated. The result may include information such as the type of attack, the source and target of the attack, and the time when the attack occurred.

[0032] By applying the technical solution of this embodiment, first, multiple network data can be obtained from the network environment, and based on these network data, a graph structure to be analyzed can be constructed. Then, a first target subgraph matching the preset attack pattern graph can be found in the graph structure to be analyzed. If the first target subgraph matching the preset attack pattern graph is found in the graph structure to be analyzed, it can be determined that the network attack behavior indicated by the preset attack pattern graph exists in the graph structure to be analyzed. Finally, based on the first target subgraph found and the corresponding network attack behavior, a network attack behavior detection result corresponding to multiple network data is generated. The embodiment of the present application obtains multiple network data such as network topology information, network traffic information, system log information, and constructs a graph structure to be analyzed based on multiple network data, so as to more comprehensively detect attack behaviors in the network; by constructing a graph structure to be analyzed and matching it with a preset attack pattern graph, network attack behaviors can be more accurately identified, reducing the possibility of false positives and false negatives; through the matching algorithm of the graph structure, potential network attack behaviors can be quickly located, the efficiency of detection is improved, and it is helpful to respond to network security threats in a timely manner.

[0033] Further, as a refinement and extension of the specific implementation of the above embodiment, in order to fully illustrate the specific implementation process of this embodiment, another network attack behavior detection method is provided, such as Figure 4 As shown, the method includes:

[0034] Step 201, obtain multiple network data, perform entity recognition on each network data to obtain a corresponding target entity, and construct a connection edge corresponding to the target entity based on the behavior data contained in the network data to obtain a target subgraph corresponding to the network data.

[0035] In this embodiment, first, multiple network data are obtained. Here, the acquisition of network data can be real-time or periodic. Real-time acquisition of network data can timely identify network attack behaviors. For each network data, entity recognition is first performed, that is, information representing entities in the network (such as hosts, servers, users, etc.) is extracted from the network data. Then, according to the behavioral data (such as communication, access, data transmission, etc.) contained in the network data, the connection edges between these target entities are constructed. These edges represent the interaction or relationship between entities. Through the above steps, each network data is converted into a target subgraph, in which nodes represent entities and edges represent behavioral relationships between entities. Specifically, for example, in a phishing attack, target entities such as "sender's mailbox" and "link domain name" can be identified from a phishing email; then, according to the content of the phishing email, such as the behavior of "clicking the link to verify account information", a connection edge from "sender's mailbox" to "link domain name" is constructed, indicating that the attacker attacks through the link; finally, the identified entities and connection edges are combined to form a target subgraph representing this phishing attack.

[0036] Step 202, for any two target subgraphs, determine whether the same target entity exists in the any two target subgraphs, and if so, fuse the any two target subgraphs to obtain an updated target subgraph, until any two target subgraphs cannot be fused, and then obtain the graph structure to be analyzed based on each target subgraph.

[0037] In this embodiment, next, for any two target subgraphs, check whether there is the same target entity between them. This step can be achieved by comparing the nodes in the target subgraph. When it is found that the same target entity exists in two target subgraphs, the two target subgraphs are fused. The fusion process can include merging the same nodes, merging or reconnecting edges to ensure that the fused target subgraph accurately reflects the relationship between entities. For example, a ransomware attack initiated by a phishing email occurs in an enterprise network. The attacker first sends a phishing email containing a malicious attachment to an internal employee of the enterprise. When the employee clicks and opens the attachment, the ransomware will be activated and encrypt important files in the enterprise network. For this scenario, first, network data can be collected from multiple sources, such as network traffic logs, mail server logs, endpoint security logs, etc. Each piece of network data may contain entities and behaviors related to the attack. Next, a target subgraph corresponding to each piece of network data is constructed. For example, entity recognition is performed on the first network data, and the target entities are determined to include: mail server (IP: 192.168.1.100), attacker mailbox (email@evilhacker.com), and victim employee (user@corporate.com); the identified behavior data is: an email containing a malicious attachment is sent from the attacker mailbox to the victim employee. Then the target subgraph corresponding to the first network data contains a node representing the mail server, a node representing the attacker mailbox, a node representing the victim employee, and an edge from the attacker mailbox to the victim employee, indicating the email sending behavior. At the same time, entity recognition is performed on the second network data, and the target entities are determined to include: victim employee (user@corporate.com) and file server (IP: 192.168.1.200). The identified behavior data is: the victim employee clicked on the malicious attachment, the ransomware was activated and encrypted the files on the file server. Then the target subgraph corresponding to the second network data contains a node representing the victim employee, a node representing the file server, and an edge from the victim employee to the file server, indicating the file encryption behavior. After that, the two target subgraphs are fused. Specifically, there is a common target entity "victim employee (user@corporate.com)" in both target subgraphs. Then the two target subgraphs can be fused, the same nodes (victim employees) are merged, and edges are added or updated to reflect the complete attack path: from the attacker's mailbox to the victim employee, and then to the file server. After the two target subgraphs are fused, an updated target subgraph can be obtained. The updated target subgraph contains four nodes: the attacker's mailbox, the victim employee, the mail server, and the file server, as well as two edges between them: one represents the email sending behavior, and the other represents the file encryption behavior.

[0038] It should be noted that this fusion process can be carried out until any two target subgraphs can no longer be fused, at which point all target subgraphs have been reasonably connected and combined according to their common entities. Finally, the final graph structure to be analyzed is combined based on the target subgraphs that have undergone the fusion process. This graph structure to be analyzed contains all entities extracted from the network data and the relationships between them, and can be used for subsequent network attack behavior detection. The embodiment of the present application provides an intuitive and easy-to-analyze representation method for the detection of network attack behaviors by extracting entities and the relationships between entities from multiple network data, and combining these relationships into a graph structure. It should be noted that the target subgraphs ultimately included in the graph structure to be analyzed may be mutually isolated subgraphs, such as Figure 2 shown.

[0039] Step 203, based on a preset attack pattern graph, determine whether there is a first target subgraph matching the preset attack pattern graph in the graph structure to be analyzed, and if so, determine whether there is a network attack behavior indicated by the preset attack pattern graph in the graph structure to be analyzed.

[0040] Step 204: obtain target description data corresponding to a preset attack pattern graph that matches the first target subgraph, wherein the target description data includes an attack subject and / or an attack type; obtain the attack time of the network attack behavior corresponding to the first target subgraph; and generate network attack behavior detection results corresponding to the multiple network data based on the target description data, the corresponding network attack behavior and the attack time.

[0041] In this embodiment, further, a preset attack pattern graph matching the first target subgraph can be identified, and the target description data corresponding to the preset attack pattern graph can be obtained. Here, the target description data may include the attack subject (i.e., the entity or source that initiates the attack) and / or the attack type (i.e., the type or method of the attack). This information can be used to indicate the nature and source of the attack. Next, determine the specific time when the network attack behavior represented by the first target subgraph occurs. This can be achieved by analyzing the timestamp in the network data. Afterwards, a complete network attack behavior detection result is generated based on the previously obtained target description data (including the attack subject and / or the attack type), the specific details of the network attack behavior (such as the attack method, the attack path, etc.), and the attack time. Specifically, this detection result can be presented in the form of a report, which describes the attack in detail, including the type, source, target, time, and scope of influence of the attack. Subsequent relevant staff can evaluate the severity of the attack based on this detection result, formulate corresponding response strategies, and take corresponding measures to prevent similar attacks from happening again. The embodiments of the present application can monitor network data in real time, and once abnormal behavior is found, a network attack behavior detection result is immediately generated, which is conducive to improving the response speed of attack events, taking defensive measures in time, and reducing the losses caused by the attack; in addition, the network attack behavior detection result includes key information such as the type, source, time, and scope of impact of the attack. This information provides relevant personnel with a clear panoramic view of the attack, which helps them better understand the attack process, evaluate the impact of the attack, and take targeted defensive measures.

[0042] In an embodiment of the present application, optionally, the method further includes: obtaining a worm attack sample pattern graph, and extracting a target node type, a target edge type, and a target topological structure of the worm attack based on the worm attack sample pattern graph; constructing a worm propagation pattern graph different from the worm attack sample pattern graph based on the target node type, the target edge type, and the target topological structure; traversing the graph structure to be analyzed to determine whether there is a second target subgraph matching the worm propagation pattern graph in the graph structure to be analyzed, and if so, determining the number of the second target subgraphs, and when the number of the second target subgraphs is greater than a first preset number threshold, determining that the worm propagation pattern graph is a pattern graph corresponding to a new worm attack behavior; updating the network attack behavior detection results corresponding to the multiple network data based on the new worm attack behavior and the corresponding second target subgraph, and adding the pattern graph corresponding to the new worm attack behavior to the preset attack pattern graph.

[0043] In the above embodiment, known network attack behaviors can be identified by presetting attack pattern graphs, and the identification of unknown worm attack behaviors can be performed in the following manner. First, a known worm attack sample pattern graph is obtained. These pattern graphs represent typical features of worm attack behaviors that have occurred in history, including the target node type, target edge type, and target topology structure of the attack. Then, according to the worm attack sample pattern graph, the key features of the worm attack are extracted, including the target node type (such as vulnerable servers, terminal devices, etc.), the target edge type (such as network connection, file sharing, etc.) and the target topology structure (such as the propagation path and mode of the attack in the network). Afterwards, the extracted worm attack features can be used to construct a worm propagation pattern graph that is different from the worm attack sample pattern graph. These pattern graphs may represent new variants or unknown patterns of worm attacks for subsequent detection and identification. After obtaining the worm propagation pattern graph, the previously constructed graph structure to be analyzed is traversed to find a second target subgraph that matches the worm propagation pattern graph. If a matching second target subgraph is found in the structure diagram to be analyzed, and the number of the second target subgraphs is greater than the first preset number threshold, it means that the worm attack behavior has a significant impact or scale, and the worm propagation pattern diagram is determined to be a pattern diagram corresponding to the new worm attack behavior. Here, the first preset number threshold can be set based on experience. Subsequently, based on the new worm attack behavior and the corresponding second target subgraph, the network attack behavior detection results corresponding to the multiple network data are updated. Specifically, the description, attack time and other information corresponding to the second target subgraph matching the new worm attack behavior can be added to the previous detection results. Finally, the pattern diagram corresponding to the new worm attack behavior can also be added to the preset attack pattern diagram. In this way, in the future detection process, this new worm attack behavior can be identified, thereby improving the accuracy and efficiency of the detection. The embodiment of the present application realizes the detection, identification, evaluation and updating of unknown worm attack behaviors in an automated manner, which helps relevant staff to respond to new security threats in a timely manner and protect the security of the network system. It should be noted that there may be multiple worm propagation pattern diagrams in the embodiments of the present application. When the number of second target subgraphs corresponding to any worm propagation pattern diagram is greater than a first preset number threshold, the worm propagation pattern diagram may be used as a pattern diagram corresponding to a new worm attack behavior.

[0044] In an embodiment of the present application, optionally, the "constructing a worm propagation pattern graph different from the worm attack sample pattern graph according to the target node type, the target edge type and the target topological structure" includes: constructing at least one basic pattern graph according to the target node type, the target edge type and the target topological structure; mutating the at least one basic pattern graph according to a preset mutation rule to obtain a mutated pattern graph corresponding to each of the basic pattern graphs; assigning values ​​to the nodes and edges contained in the mutated pattern graph to obtain a worm propagation pattern graph, and deduplicating the worm propagation pattern graph and the worm attack sample pattern graph to obtain a worm propagation pattern graph different from the worm attack sample pattern graph.

[0045] In this embodiment, a worm propagation pattern graph can be constructed in the following manner. First, one or more basic pattern graphs are constructed according to the target node type, the target edge type and the target topological structure. These basic pattern graphs represent the core features and basic structure of the worm attack and are the basis for subsequent mutation and expansion. In order to simulate various mutation situations that may occur in the worm attack, the basic pattern graph is processed by applying preset mutation rules. The mutation rules may include the increase or decrease of nodes, the change of edges (such as adding new connection paths, changing the connection direction or type), the fine-tuning of the topological structure, etc. These mutations are intended to generate a series of mutation pattern graphs that are similar to but different from the basic pattern graph. After the mutation process, the nodes and edges in the mutation pattern graph can be further assigned values, that is, specific network parameters or attribute values ​​can be assigned to the nodes and edges, such as IP addresses, port numbers, protocol types, etc., so as to match and identify in the graph structure to be analyzed. The assignment process makes the mutation pattern graph more specific and operable. After the mutation and assignment process, the obtained mutation pattern graph becomes the worm propagation pattern graph. For example, for a worm attack sample, the sample attacks a Web server (target node type) through the HTTP protocol and propagates through specific ports (target edge type) between servers, forming a specific topological structure (such as chain propagation). Then, a basic pattern graph can be constructed based on the characteristics of the worm attack sample. The basic pattern graph shows how the worm propagates from one Web server to another server through HTTP requests and connects through specific ports. Then, the basic pattern graph can be processed by applying mutation rules to generate multiple mutation pattern graphs. Here, the preset mutation rules may include: adding new node types (such as database servers), changing edge types (such as using FTP protocol instead of HTTP), adjusting topological structures (such as introducing branch propagation paths), etc. For example, a mutation pattern graph of the above basic pattern graph shows that the worm attacks the database server through the FTP protocol and propagates through different ports; another mutation pattern graph introduces multiple branch propagation paths, allowing the worm to attack multiple targets at the same time. Afterwards, specific network parameters or attribute values ​​are assigned to the nodes and edges in each mutation pattern graph. For example, IP addresses and HTTP port numbers are assigned to Web server nodes, different IP addresses and FTP port numbers are assigned to database server nodes, and corresponding protocol types and transmission data are assigned to the edges connecting these nodes. After mutation and assignment processing, multiple worm propagation pattern graphs are finally obtained. These pattern graphs not only retain the characteristics of the original worm attack (such as propagation through network protocols), but also introduce new elements and possibilities (such as different node types, edge types, and topological structures) through mutation, which helps to identify potential unknown worm attacks. It should be noted that when there are multiple basic pattern graphs, each basic pattern graph can obtain one or more mutated pattern graphs after mutation processing.

[0046] In order to ensure that the newly constructed worm propagation pattern diagram does not repeat with the known worm attack sample pattern diagram, deduplication processing can be performed. Deduplication processing can include comparing the key features such as the structure, node type, and edge type of the pattern diagram to exclude the pattern diagram that is exactly the same or highly similar to the worm attack sample pattern diagram. Through deduplication processing, it can be ensured that the newly constructed worm propagation pattern diagram has uniqueness and novelty. After the above steps, what is finally obtained is a worm propagation pattern diagram that is different from the worm attack sample pattern diagram. These pattern diagrams can be used in subsequent automated detection processes to identify potential unknown worm attack behaviors. The embodiments of the present application generate a series of worm propagation pattern diagrams that have both retained the original attack characteristics and have a certain variability by constructing basic pattern diagrams, applying mutation rules, assigning values, and deduplication processing. These pattern diagrams help to improve the flexibility and accuracy of automated detection tools, so that they can better cope with ever-changing network threats.

[0047] In an embodiment of the present application, optionally, the method further includes: obtaining a sample pattern graph of a botnet, and determining a node number threshold value based on the sample pattern graph of the botnet; determining a third target subgraph having a node number greater than the node number threshold value from the graph structure to be analyzed based on the node number threshold value; calculating a target score corresponding to the third target subgraph based on a communication structure corresponding to the third target subgraph and a similarity of behavioral characteristics between nodes in the third target subgraph, and when the target score is greater than a preset score, using the third target subgraph as a subgraph to be matched; traversing the graph structure to be analyzed, determining the number of fourth target subgraphs in the graph structure to be analyzed that match the subgraph to be matched, and when the number of the fourth target subgraphs is greater than a second preset number threshold value, determining that the subgraph to be matched is a pattern graph corresponding to a new botnet; updating the network attack behavior detection results corresponding to the multiple network data based on the fourth target subgraph corresponding to the new botnet, and adding the pattern graph corresponding to the new botnet to the preset attack pattern graph.

[0048] In this embodiment, unknown botnets can also be identified, and specifically, the following method can be used for identification. First, a known botnet sample pattern graph is obtained. These botnet sample pattern graphs can be constructed through historical data analysis or expert knowledge, showing the communication structure and behavior characteristics between nodes in the botnet. Then, a node number threshold can be analyzed and determined based on the botnet sample pattern graph, and this node number threshold is used to screen the parts that may constitute the botnet in the subsequent steps, that is, those subgraphs whose number of nodes exceeds this node number threshold. In fact, the graph structure to be analyzed contains a large number of nodes and edges. Directly analyzing the entire graph structure to be analyzed to find potential botnet patterns will consume a lot of computing resources and time. By setting a node number threshold, the embodiment of the present application can first exclude those subgraphs whose number of nodes is obviously not enough to constitute a botnet, thereby greatly narrowing the search range and reducing the computational complexity. In addition, a botnet is usually composed of a large number of infected devices, which appear as multiple interconnected nodes in the network. Therefore, the number of nodes is an important indicator for judging whether a subgraph may constitute a botnet. By setting a node number threshold, those subgraphs with a sufficient number of nodes can be quickly screened out for further analysis, thereby improving the detection efficiency.

[0049] After determining the node number threshold, further, the node number threshold is used to filter out all subgraphs whose node numbers are greater than the node number threshold as the third target subgraph. These third target subgraphs may be potential botnet candidates. Afterwards, for each third target subgraph, a target score is calculated based on the similarity of its communication structure and the behavioral characteristics between nodes, and the target score reflects the degree to which the third target subgraph may belong to the botnet. If the target score is greater than the preset score threshold, it is considered that the third target subgraph is likely to be part of the botnet and is marked as a subgraph to be matched. Then, the entire graph structure to be analyzed is traversed to find a fourth target subgraph that matches the subgraph to be matched. The fourth target subgraph here can be a subgraph that is similar to the subgraph to be matched in structure and node attributes, or a subgraph that is completely consistent in structure and node attributes, which can be determined according to actual needs. If the number of matching fourth target subgraphs found exceeds the second preset number threshold, it means that there are multiple such botnets in the current network, and it is further confirmed that the subgraph to be matched represents a new botnet pattern. Here, the second preset number threshold can be set based on experience. According to the fourth target subgraph corresponding to the new botnet pattern, the network attack behavior detection results corresponding to the plurality of network data are updated so as to timely discover and respond to potential threats. At the same time, this new botnet pattern graph can be added to the preset attack pattern graph library for use in future analysis to improve the detection efficiency and accuracy of the system. The embodiment of the present application automatically detects and identifies new botnet patterns through known botnet sample pattern graphs, and updates the network attack behavior detection results accordingly, which can greatly improve the network security protection capability.

[0050] In an embodiment of the present application, optionally, the "calculating a target score corresponding to the third target subgraph according to the communication structure corresponding to the third target subgraph and the similarity of behavioral characteristics between nodes in the third target subgraph" includes: determining the communication structure corresponding to the third target subgraph according to the third target subgraph, and judging whether the communication structure belongs to the target communication structure, and determining a first score corresponding to the third target subgraph according to the judgment result, wherein the target communication structure includes a structure for sending a communication signal from a central node to a slave node; determining the behavioral characteristics corresponding to each node in the third target subgraph according to the connecting edges corresponding to the node, and calculating the similarity of behavioral characteristics between nodes according to the behavioral characteristics, and calculating the second score corresponding to the third target subgraph based on the behavioral characteristics similarity; and calculating the target score corresponding to the third target subgraph according to the first score and the second score.

[0051] In this embodiment, first, the communication structure, that is, the connection mode and topological relationship between nodes, is extracted from the third target subgraph. Then, this communication structure is compared with the preset target communication structure. The target communication structure may include a structure for sending communication signals from a central node to multiple slave nodes, which is a common communication mode of a botnet. Then, the first score corresponding to the third target subgraph is determined according to the comparison result. Specifically, if the communication structure of the third target subgraph is similar to or matches the target communication structure, a higher first score is given; if they are not similar or the difference is large, a lower first score is given. The first score can be obtained based on the similarity between the communication structure of the third target subgraph and the target communication structure. For example, different scores can be set for different similarity ranges, and then the similarity range to which the calculated similarity belongs is found, and the score corresponding to the similarity range is used as the first score.

[0052] Secondly, for each node in the third target subgraph, its behavior characteristics are determined according to their corresponding connection edges. Connection edges can represent communication activities between two nodes, etc. These behavior characteristics can include communication frequency, communication time, communication protocol, data packet size, etc., which can be marked on the connection edges when constructing the graph structure to be analyzed. Next, the similarity of the behavior characteristics between the nodes is calculated. Specifically, the communication behaviors of different nodes in the same or similar time period can be compared, and the similarity between them can be calculated. When calculating the similarity of the behavior characteristics between the nodes, it can be determined by calculating Euclidean distance, cosine similarity, etc. For example, the behavior characteristics can include (1) communication frequency: the number of times a node communicates in a unit time; (2) communication time: the specific time period or time pattern of the node's communication; (3) data packet size: the size of the data packet transmitted during the communication process; (4) communication protocol: the type of communication protocol used by the node; (5) communication object: which other nodes the node communicates with. Afterwards, the multiple aspects of each node can be converted into a feature vector. Each element in this vector corresponds to a feature value of the node. After obtaining the feature vector, the similarity between the two nodes can be calculated using methods such as Euclidean distance and cosine similarity. Based on the calculation results of the behavioral feature similarity, the second score corresponding to the third target subgraph can be calculated. If the behavioral feature similarity between the nodes is high, it indicates that they may be under the same control or participate in the same malicious activities, so a higher second score can be given. The second score can be determined in the same way as the first score.

[0053] Finally, the first score and the second score are weighted and summed according to certain weights to obtain the target score corresponding to the third target subgraph. The distribution of weights can be adjusted according to actual needs and scenarios to balance the importance of communication structure and behavioral characteristics in the evaluation. The embodiment of the present application provides a comprehensive evaluation for potential botnet candidates by comprehensively considering the similarity of communication structure and the similarity of behavioral characteristics between nodes. The level of the target score directly reflects the possibility of the third target subgraph as a botnet, which is helpful for subsequent screening and confirmation work.

[0054] Further, as Figure 1 The specific implementation of the method, the embodiment of the present application provides a network attack behavior detection device, such as Figure 5 As shown, the device comprises:

[0055] A graph structure building module, used to obtain multiple network data and build a graph structure to be analyzed based on the multiple network data;

[0056] A judgment module, used to judge whether there is a first target subgraph matching the preset attack pattern graph in the graph structure to be analyzed based on the preset attack pattern graph, and if so, determine whether there is a network attack behavior indicated by the preset attack pattern graph in the graph structure to be analyzed;

[0057] A detection result generation module is used to generate network attack behavior detection results corresponding to the multiple network data according to the first target subgraph and the corresponding network attack behavior.

[0058] Optionally, the graph structure building module is used to:

[0059] For each piece of network data, entity recognition is performed on the network data to obtain a corresponding target entity, and a connection edge corresponding to the target entity is constructed according to the behavior data contained in the network data to obtain a target subgraph corresponding to the network data;

[0060] For any two target subgraphs, determine whether there is the same target entity in the two target subgraphs, and if so, fuse the two target subgraphs to obtain an updated target subgraph, until any two target subgraphs cannot be fused, and then obtain the graph structure to be analyzed based on each target subgraph.

[0061] Optionally, the detection result generating module is used to:

[0062] Acquire target description data corresponding to a preset attack pattern graph matching the first target subgraph, wherein the target description data includes an attack subject and / or an attack type;

[0063] Obtaining the attack time of the network attack behavior corresponding to the first target subgraph;

[0064] According to the target description data, the corresponding network attack behavior and the attack time, the network attack behavior detection results corresponding to the multiple network data are generated.

[0065] Optionally, the device further comprises:

[0066] A pattern graph acquisition module is used to acquire a sample pattern graph of a worm attack, and extract a target node type, a target edge type, and a target topological structure of the worm attack according to the sample pattern graph of the worm attack;

[0067] A pattern graph construction module, used to construct a worm propagation pattern graph different from the worm attack sample pattern graph according to the target node type, target edge type and target topology structure;

[0068] A search module, used for traversing the graph structure to be analyzed, determining whether there is a second target subgraph matching the worm propagation pattern graph in the graph structure to be analyzed, and if so, determining the number of the second target subgraphs, and when the number of the second target subgraphs is greater than a first preset number threshold, determining that the worm propagation pattern graph is a pattern graph corresponding to a new worm attack behavior;

[0069] The detection result updating module is used to update the network attack behavior detection results corresponding to the plurality of network data according to the new worm attack behavior and the corresponding second target subgraph, and add the pattern graph corresponding to the new worm attack behavior to the preset attack pattern graph.

[0070] Optionally, the pattern diagram construction module is used to:

[0071] Constructing at least one basic pattern graph according to the target node type, the target edge type, and the target topological structure;

[0072] According to a preset mutation rule, the at least one basic pattern graph is mutated to obtain a mutation pattern graph corresponding to each basic pattern graph;

[0073] The nodes and edges included in the variation pattern graph are assigned values ​​to obtain a worm propagation pattern graph, and the worm propagation pattern graph and the worm attack sample pattern graph are deduplicated to obtain a worm propagation pattern graph different from the worm attack sample pattern graph.

[0074] Optionally, the device further comprises:

[0075] The pattern graph acquisition module is further used to acquire a sample pattern graph of the botnet and determine a node quantity threshold value based on the sample pattern graph of the botnet;

[0076] A subgraph determination module, configured to determine, according to the node number threshold, a third target subgraph having a node number greater than the node number threshold from the graph structure to be analyzed;

[0077] A score calculation module, configured to calculate a target score corresponding to the third target subgraph according to the communication structure corresponding to the third target subgraph and the similarity of the behavior characteristics between the nodes in the third target subgraph, and when the target score is greater than a preset score, use the third target subgraph as a subgraph to be matched;

[0078] The search module is used to traverse the graph structure to be analyzed, determine the number of fourth target subgraphs matching the subgraph to be matched in the graph structure to be analyzed, and when the number of the fourth target subgraphs is greater than a second preset number threshold, determine that the subgraph to be matched is a pattern graph corresponding to a new botnet;

[0079] The detection result updating module is used to update the network attack behavior detection results corresponding to the multiple network data according to the fourth target subgraph corresponding to the new botnet, and add the pattern graph corresponding to the new botnet to the preset attack pattern graph.

[0080] Optionally, the score calculation module is used to:

[0081] According to the third target subgraph, determining a communication structure corresponding to the third target subgraph, and judging whether the communication structure belongs to a target communication structure, and determining a first score corresponding to the third target subgraph according to the judgment result, wherein the target communication structure includes a structure for sending a communication signal from a central node to a slave node;

[0082] Determine the behavior feature corresponding to each node in the third target subgraph according to the connection edge corresponding to the node, calculate the behavior feature similarity between the nodes according to the behavior feature, and calculate the second score corresponding to the third target subgraph based on the behavior feature similarity;

[0083] A target score corresponding to the third target subgraph is calculated based on the first score and the second score.

[0084] It should be noted that for other corresponding descriptions of the functional units involved in the network attack behavior detection device provided in the embodiment of the present application, reference can be made to Figures 1 to 4 The corresponding description in the method will not be repeated here.

[0085] The present application also provides a computer device, which may be a personal computer, a server, a network device, etc. Figure 6As shown, the computer device includes a bus, a processor, a memory and a communication interface, and may also include an input and output interface and a display device. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store location information. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, the steps in each method embodiment are implemented.

[0086] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0087] In one embodiment, a computer-readable storage medium is provided. The computer-readable storage medium may be non-volatile or volatile, and stores a computer program thereon. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0088] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0089] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0090] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0091] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0092] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A network attack behavior detection method, characterized in that: include: Acquire multiple pieces of network data, and construct a graph structure to be analyzed based on the multiple pieces of network data; Based on a preset attack pattern graph, determining whether there is a first target subgraph matching the preset attack pattern graph in the graph structure to be analyzed, and if so, determining whether there is a network attack behavior indicated by the preset attack pattern graph in the graph structure to be analyzed; According to the first target subgraph and the corresponding network attack behavior, network attack behavior detection results corresponding to the multiple network data are generated.

2. The method according to claim 1, characterized in that The step of constructing a graph structure to be analyzed based on the plurality of network data includes: For each piece of network data, entity recognition is performed on the network data to obtain a corresponding target entity, and a connection edge corresponding to the target entity is constructed according to the behavior data contained in the network data to obtain a target subgraph corresponding to the network data; For any two target subgraphs, determine whether there is the same target entity in the two target subgraphs, and if so, fuse the two target subgraphs to obtain an updated target subgraph, until any two target subgraphs cannot be fused, and then obtain the graph structure to be analyzed based on each target subgraph.

3. The method according to claim 1, characterized in that: The generating, according to the first target subgraph and the corresponding network attack behavior, network attack behavior detection results corresponding to the plurality of network data includes: Acquire target description data corresponding to a preset attack pattern graph matching the first target subgraph, wherein the target description data includes an attack subject and / or an attack type; Obtaining the attack time of the network attack behavior corresponding to the first target subgraph; According to the target description data, the corresponding network attack behavior and the attack time, the network attack behavior detection results corresponding to the multiple network data are generated.

4. The method according to claim 1, characterized in that The method further comprises: Obtaining a worm attack sample pattern diagram, and extracting a target node type, a target edge type, and a target topological structure of the worm attack according to the worm attack sample pattern diagram; Constructing a worm propagation pattern graph that is different from the worm attack sample pattern graph according to the target node type, the target edge type, and the target topology structure; Traversing the graph structure to be analyzed, determining whether there is a second target subgraph matching the worm propagation pattern graph in the graph structure to be analyzed, and if so, determining the number of the second target subgraphs, and when the number of the second target subgraphs is greater than a first preset number threshold, determining that the worm propagation pattern graph is a pattern graph corresponding to a new worm attack behavior; According to the new worm attack behavior and the corresponding second target subgraph, the network attack behavior detection results corresponding to the plurality of network data are updated, and the pattern graph corresponding to the new worm attack behavior is added to the preset attack pattern graph.

5. The method according to claim 4, characterized in that The step of constructing a worm propagation pattern graph different from the worm attack sample pattern graph according to the target node type, the target edge type, and the target topology structure includes: Constructing at least one basic pattern graph according to the target node type, the target edge type, and the target topological structure; According to a preset mutation rule, the at least one basic pattern graph is mutated to obtain a mutation pattern graph corresponding to each basic pattern graph; The nodes and edges included in the variation pattern graph are assigned values ​​to obtain a worm propagation pattern graph, and the worm propagation pattern graph and the worm attack sample pattern graph are deduplicated to obtain a worm propagation pattern graph different from the worm attack sample pattern graph.

6. The method according to claim 1, characterized in that The method further comprises: Obtaining a sample pattern diagram of a botnet, and determining a node quantity threshold value according to the sample pattern diagram of the botnet; According to the node number threshold, determining a third target subgraph having a node number greater than the node number threshold from the graph structure to be analyzed; According to the communication structure corresponding to the third target subgraph and the similarity of the behavior characteristics between the nodes in the third target subgraph, the target score corresponding to the third target subgraph is calculated, and when the target score is greater than the preset score, the third target subgraph is used as the subgraph to be matched; Traversing the graph structure to be analyzed, determining the number of fourth target subgraphs in the graph structure to be analyzed that match the subgraph to be matched, and when the number of the fourth target subgraphs is greater than a second preset number threshold, determining that the subgraph to be matched is a pattern graph corresponding to a new botnet; According to the fourth target subgraph corresponding to the new botnet, the network attack behavior detection results corresponding to the plurality of network data are updated, and the pattern graph corresponding to the new botnet is added to the preset attack pattern graph.

7. The method according to claim 6, characterized in that The step of calculating the target score corresponding to the third target subgraph according to the communication structure corresponding to the third target subgraph and the similarity of the behavior characteristics between the nodes in the third target subgraph comprises: According to the third target subgraph, determining a communication structure corresponding to the third target subgraph, and judging whether the communication structure belongs to a target communication structure, and determining a first score corresponding to the third target subgraph according to the judgment result, wherein the target communication structure includes a structure for sending a communication signal from a central node to a slave node; Determine the behavior feature corresponding to each node in the third target subgraph according to the connection edge corresponding to the node, calculate the behavior feature similarity between the nodes according to the behavior feature, and calculate the second score corresponding to the third target subgraph based on the behavior feature similarity; A target score corresponding to the third target subgraph is calculated based on the first score and the second score.

8. A network attack behavior detection device, characterized in that: include: A graph structure building module, used to obtain multiple network data and build a graph structure to be analyzed based on the multiple network data; A judgment module, used to judge whether there is a first target subgraph matching the preset attack pattern graph in the graph structure to be analyzed based on the preset attack pattern graph, and if so, determine whether there is a network attack behavior indicated by the preset attack pattern graph in the graph structure to be analyzed; A detection result generation module is used to generate network attack behavior detection results corresponding to the multiple network data according to the first target subgraph and the corresponding network attack behavior.

9. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

10. A computer device comprising a storage medium, a processor, and a computer program stored in the storage medium and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

Images