Network attack data processing method and device, server, medium and product

Abstract

The invention provides a network attack data processing method and device, a server, a medium and a product. The method comprises the following steps: acquiring all nodes in a target network attack path; according to the historical domain name system data, the network flow data and a predefined heterogeneous graph network mode, obtaining a network heterogeneous graph of a preset order of each node; according to the target network attack path, combining the network heterogeneous graphs of the preset orders of all the nodes to obtain a heterogeneous graph of the target network attack path; obtaining an embedded vector of each node in the heterogeneous graph to obtain the heterogeneous graph with the node embedded vectors; obtaining a vector of the heterogeneous graph according to the heterogeneous graph with the node embedded vector; classifying the heterogeneous graphs according to the vectors of the heterogeneous graphs to obtain the types of the heterogeneous graphs; the heterogeneous graph type is used for performing homology analysis on the network attack. According to the method provided by the invention, the accuracy of homology analysis on the network attack is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, server, medium and product for processing network attack data. Background Art

[0002] Cyber ​​attacks are complex and diverse, and with the development of technology, the means of cyber attacks are also constantly evolving. Cyber ​​attack organizations adopt attack strategies to carry out cyber attacks on qualified targets. This targeted cyber attack not only causes losses to the targets, but also poses a threat to the security of cyberspace. Conducting homology analysis on cyber attacks is one of the important means of identifying cyber attack organizations.

[0003] Currently, existing technologies conduct homology analysis on network attacks by analyzing samples of malicious codes used in network attacks.

[0004] However, cyber attackers usually use techniques such as code obfuscation to hide the true characteristics of malicious code, which increases the difficulty of homology analysis of cyber attacks and reduces the accuracy of homology analysis. Summary of the invention

[0005] The embodiments of the present application provide a method, device, server, medium and product for processing network attack data, so as to achieve the effect of improving the accuracy of network attack homology analysis.

[0006] In a first aspect, an embodiment of the present application provides a data processing method for network attacks, including: receiving a target network attack path, historical domain name system data, and network traffic data sent by a data acquisition device; obtaining all nodes in the target network attack path; obtaining a network heterogeneous graph of a preset order for each node based on the historical domain name system data, network traffic data, and a predefined heterogeneous graph network model; merging the network heterogeneous graphs of preset orders for all nodes according to the target network attack path to obtain a heterogeneous graph corresponding to the target network attack path; obtaining an embedding vector for each node in the heterogeneous graph to obtain a heterogeneous graph with a node embedding vector; obtaining a vector of the heterogeneous graph based on the heterogeneous graph with the node embedding vector; classifying the heterogeneous graph based on the vector of the heterogeneous graph to obtain a heterogeneous graph type; outputting the heterogeneous graph type; the heterogeneous graph type is used to perform homology analysis on network attacks.

[0007] In one possible implementation, a network heterogeneous graph of a preset order is obtained for each node based on historical domain name system data, network traffic data, and a predefined heterogeneous graph network pattern, including: obtaining historical domain name system data related to each node from historical domain name system data; obtaining network traffic data related to each node from network traffic data; and taking each node as the center, obtaining a network heterogeneous graph of a preset order for each node based on historical domain name system and network traffic data related to each node, and a predefined heterogeneous graph network pattern.

[0008] In a possible implementation, obtaining an embedding vector for each node in a heterogeneous graph includes: sampling heterogeneous neighbor nodes of each node in the heterogeneous graph to obtain multiple heterogeneous neighbor nodes; extracting features of each heterogeneous neighbor node according to the type of each heterogeneous neighbor node to obtain features of each heterogeneous neighbor node; encoding the features of each heterogeneous neighbor node to obtain encoded features of each heterogeneous neighbor node; and aggregating the encoded features of multiple heterogeneous neighbor nodes to obtain an embedding vector for each node.

[0009] In a possible implementation, the encoding features of multiple heterogeneous neighbor nodes are aggregated to obtain an embedding vector of each node, including: obtaining the type of each heterogeneous neighbor node; aggregating heterogeneous neighbor nodes of the same type among the multiple heterogeneous neighbor nodes to obtain different types of initial embedding vectors of the multiple heterogeneous neighbor nodes; and aggregating different types of initial embedding vectors of the multiple heterogeneous neighbor nodes to obtain an embedding vector of each node.

[0010] In a possible implementation, obtaining a vector of the heterogeneous graph according to the heterogeneous graph with the node embedding vector includes: performing a convolution operation and a pooling operation on the heterogeneous graph with the node embedding vector to obtain the vector of the heterogeneous graph.

[0011] In a second aspect, an embodiment of the present application provides a network attack data processing device, including:

[0012] A receiving module, used for receiving target network attack paths, historical domain name system data and network traffic data sent by a data collection device;

[0013] The first acquisition module is used to acquire all nodes in the target network attack path;

[0014] A second acquisition module is used to acquire a network heterogeneous graph of a preset order for each node based on the historical domain name system, network traffic data and a predefined heterogeneous graph network pattern;

[0015] A merging module is used to merge the network heterogeneous graphs of preset orders of all nodes according to the target network attack path to obtain a heterogeneous graph corresponding to the target network attack path;

[0016] A third acquisition module is used to acquire an embedding vector of each node in the heterogeneous graph to obtain a heterogeneous graph with node embedding vectors;

[0017] A fourth acquisition module is used to obtain a vector of the heterogeneous graph according to the heterogeneous graph with the node embedding vector;

[0018] A classification module is used to classify the heterogeneous graph according to its vectors and obtain the type of the heterogeneous graph;

[0019] The output module is used to output heterogeneous graph types; heterogeneous graph types are used to perform homology analysis on network attacks.

[0020] In a possible implementation, the second acquisition module is specifically used to: acquire historical domain name system data related to each node from the historical domain name system data; acquire network traffic data related to each node from the network traffic data; and acquire a network heterogeneous graph of a preset order for each node based on the historical domain name system data and network traffic data related to each node and a predefined heterogeneous graph network pattern, with each node as the center.

[0021] In a third aspect, an embodiment of the present application provides a server, including: a memory, a processor;

[0022] The memory stores computer-executable instructions;

[0023] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0024] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect.

[0025] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0026] The network attack data processing method, device, server, medium and product provided in the embodiment of the present application obtain a network heterogeneous graph of a preset order for each node based on historical domain name system data, network traffic data and a predefined heterogeneous graph network model; based on the target network attack path, the network heterogeneous graphs of the preset order of all nodes are merged to obtain a heterogeneous graph of the target network attack path; the embedding vector of each node in the heterogeneous graph is obtained, and the vector of the heterogeneous graph is obtained according to the embedding vector of each node in the heterogeneous graph; based on the vector of the heterogeneous graph, the heterogeneous graph is classified to obtain the heterogeneous graph type; and the network attack is analyzed for homology through the heterogeneous graph type. A heterogeneous graph is obtained by combining the heterogeneous graph network model and all nodes in the target network attack path, which can comprehensively consider all nodes in the target network attack path and the relationship between all nodes. According to the vector of the heterogeneous graph, the heterogeneous graph type is obtained to realize homology analysis of network attacks, thereby improving the accuracy of homology analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0028] Figure 1 A schematic diagram of a scenario of a method for processing network attack data provided in an embodiment of the present application;

[0029] Figure 2 A flowchart of a method for processing network attack data provided in an embodiment of the present application;

[0030] Figure 3 A schematic diagram of a network attack path provided for an embodiment of the present application;

[0031] Figure 4 A schematic diagram of the structure of a device for processing network attack data provided in an embodiment of the present application;

[0032] Figure 5 A schematic diagram of the structure of a server provided in an embodiment of the present application.

[0033] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0034] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0035] Figure 1 A schematic diagram of a scenario of a method for processing network attack data provided in an embodiment of the present application, such as Figure 1 As shown, the specific application scenario of the present application includes a data acquisition device 101 and a server 102 .

[0036] refer to Figure 1 , the data collection device 101 sends the target network attack path, historical domain name system data and network traffic data to the server 102; the server 102 performs a series of processing according to the target network attack path, historical domain name system data and network traffic data to obtain a heterogeneous graph corresponding to the target network attack path, and then obtains the heterogeneous graph type; the server 102 outputs the heterogeneous graph type to the display terminal for display.

[0037] Cyber ​​attacks are complex and diverse, and with the development of technology, the means of cyber attacks are also constantly evolving. Cyber ​​attack organizations adopt attack strategies to carry out cyber attacks on qualified targets. This targeted cyber attack not only causes losses to the targets, but also poses a threat to the security of cyberspace. Conducting homology analysis on cyber attacks is one of the important means of identifying cyber attack organizations. At present, existing technologies conduct homology analysis on cyber attacks by analyzing samples of malicious codes used in cyber attacks. However, cyber attackers usually use techniques such as code obfuscation to hide the true characteristics of malicious codes, which increases the difficulty of conducting homology analysis on cyber attacks and reduces the accuracy of homology analysis.

[0038] In order to solve the above technical problems, the present application proposes the following technical ideas: Considering the samples of malicious codes used in analyzing network attacks, homology analysis of network attacks will reduce the accuracy of homology analysis. The inventor thought of combining the target network attack path and the predefined heterogeneous graph network mode, analyzing all nodes in the target network attack path, constructing a network heterogeneous graph of a preset order for each node, and then obtaining a heterogeneous graph corresponding to the target network attack path; obtaining the vector of the heterogeneous graph, classifying the heterogeneous graph based on the vector of the heterogeneous graph, and obtaining the heterogeneous graph type; performing homology analysis on network attacks through heterogeneous graph types, thereby improving the accuracy of homology analysis.

[0039] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0040] Figure 2 A flowchart of a method for processing network attack data provided by an embodiment of the present application is shown in FIG. Figure 2 As shown, the method includes:

[0041] S201: Receive target network attack paths, historical domain name system data, and network traffic data sent by a data collection device.

[0042] In this embodiment, the network attack is the result of the attacker performing several reconnaissance and attacks through multiple attack springboards. The network attack path is an ordered list of device entities from the first springboard to the target device.

[0043] For example, Figure 3 A schematic diagram of a network attack path provided in an embodiment of the present application. Figure 3 As shown, the attacker conducts a network attack on the target device through n jump board devices via a jump board link, obtains sensitive data from the target device after completing the attack, and transmits the data back to the attacker.

[0044] Among them, Domain Name System (DNS) data records the mapping relationship between domain names and IP addresses; network traffic data is generated by network devices and is used to record detailed information of network traffic, such as source IP address, destination IP address, source port, destination port, protocol type, and traffic size.

[0045] S202: Acquire all nodes in the target network attack path.

[0046] For example, there are n nodes in the target network attack path P, namely .

[0047] S203: Obtain a network heterogeneous graph of a preset order for each node according to historical domain name system data, network traffic data and a predefined heterogeneous graph network model.

[0048] Among them, the predefined heterogeneous graph network pattern is predefined.

[0049] In this embodiment, the predefined heterogeneous graph network model defines three types of nodes, including three entities: IP address, URL and domain name. Table 1 is the node definition in the predefined heterogeneous graph network model.

[0050] Table 1 Node definitions in predefined heterogeneous graph network patterns

[0051]

[0052] In this embodiment, the predefined heterogeneous graph network model defines four types of edges, including: IP address connection IP address, IP address request URL, IP address hosting domain name and URL similarity. Table 2 shows the edge definition in the predefined heterogeneous graph network model.

[0053] Table 2 Edge definitions in predefined heterogeneous graph network patterns

[0054]

[0055] Specifically, historical domain name system data related to each node is obtained from historical domain name system data; network traffic data related to each node is obtained from network traffic data; with each node as the center, based on the historical domain name system data and network traffic data related to each node, and a predefined heterogeneous graph network pattern, a network heterogeneous graph of a preset order is obtained for each node.

[0056] For example, obtain node N C The process of building a heterogeneous network graph of order r is:

[0057] 1st-order network heterogeneous graph: According to N C Related historical domain name system data and network traffic data, obtain C Directly associated nodes are added to the network heterogeneous graph, and corresponding edges are established.

[0058] For each order of heterogeneous network graph (r>1), consider C Indirectly related nodes. These nodes may be connected to N C directly connected to the nodes, or through a longer path to N C Connect these nodes and them with N C or other nodes are added to the network heterogeneous graph. When expanded to the specified order r, node N is obtained. C A network heterogeneous graph of order r.

[0059] According to the above node N C The r-order network heterogeneous graph is obtained by the process of obtaining the r-order network heterogeneous graph of each node in the target network attack path P.

[0060] S204: According to the target network attack path, the network heterogeneous graphs of preset orders of all nodes are merged to obtain a heterogeneous graph corresponding to the target network attack path.

[0061] Exemplarily, the r-order network heterogeneous graphs of each node are merged according to the target attack path to obtain the heterogeneous graph of the target network attack path.

[0062] In this embodiment, the heterogeneous graph of the target network attack path reflects the node characteristics and topological structure characteristics of the attack path.

[0063] S205: Obtain an embedding vector of each node in the heterogeneous graph to obtain a heterogeneous graph with node embedding vectors.

[0064] In this embodiment, an embedding vector of each node in the heterogeneous graph is obtained based on a heterogeneous graph neural network.

[0065] Specifically, step S205 includes S2051-S2054:

[0066] S2051: Sampling heterogeneous neighbor nodes of each node in the heterogeneous graph to obtain multiple heterogeneous neighbor nodes.

[0067] Specifically, a random walk method based on a restart strategy is used to sample a fixed number of heterogeneous neighbor nodes of each node.

[0068] S2052: Extract features of each heterogeneous neighbor node according to the type of each heterogeneous neighbor node to obtain features of each heterogeneous neighbor node.

[0069] Optionally, feature extraction is performed for different types of neighbor nodes, such as extracting traffic statistics features from IP address nodes, and extracting parsing features and text features from domain name nodes.

[0070] S2053: Encode the features of each heterogeneous neighbor node to obtain the encoded features of each heterogeneous neighbor node.

[0071] In this embodiment, a neural network is used to encode the features of each heterogeneous neighbor node.

[0072] S2054: Aggregate the encoding features of multiple heterogeneous neighbor nodes to obtain an embedding vector for each node.

[0073] Specifically, step S2054 includes Sa~Sc:

[0074] Sa: Get the type of each heterogeneous neighbor node.

[0075] Illustratively, the types include domain name, URL, and IP address.

[0076] Sb: Aggregate heterogeneous neighbor nodes of the same type among multiple heterogeneous neighbor nodes to obtain different types of initial embedding vectors of multiple heterogeneous neighbor nodes.

[0077] Optionally, for heterogeneous neighbor nodes of the same type, their encoding features are aggregated using a bidirectional long short-term memory network, and then a pooling layer, such as maximum pooling or average pooling, is used to reduce the dimension of the output of the bidirectional long short-term memory network to obtain an initial embedding vector of the heterogeneous neighbor nodes of this type.

[0078] Sc: Aggregate different types of initial embedding vectors of multiple heterogeneous neighbor nodes to obtain the embedding vector of each node.

[0079] Optionally, an attention mechanism is used to perform weighted summation on the initial embedding vectors of heterogeneous neighbor nodes of different types to obtain the embedding vector of each node.

[0080] S206: Obtain a vector of the heterogeneous graph according to the heterogeneous graph with the node embedding vector.

[0081] S207: Classify the heterogeneous graph according to the vector of the heterogeneous graph to obtain the type of the heterogeneous graph.

[0082] Optionally, based on the vectors of the heterogeneous graph, an unsupervised learning algorithm or a semi-supervised learning algorithm is used to classify the heterogeneous graph.

[0083] S208: Outputting a heterogeneous graph type; the heterogeneous graph type is used to perform homology analysis on network attacks.

[0084] Among them, heterogeneous graphs of the same type have similarities, and their corresponding network attacks come from the same or related attackers.

[0085] In summary, based on historical domain name system data, network traffic data and predefined heterogeneous graph network patterns, a network heterogeneous graph of preset order for each node is obtained; based on the target network attack path, the network heterogeneous graphs of preset order for all nodes are merged to obtain the heterogeneous graph of the target network attack path; the embedding vector of each node in the heterogeneous graph is obtained, and the vector of the heterogeneous graph is obtained according to the embedding vector of each node in the heterogeneous graph; based on the vector of the heterogeneous graph, the heterogeneous graph is classified to obtain the heterogeneous graph type; the network attack is analyzed for homology through the heterogeneous graph type. Combining the heterogeneous graph network pattern and all nodes in the target network attack path, a heterogeneous graph is obtained, which can comprehensively consider all nodes in the target network attack path and the relationship between all nodes. According to the vector of the heterogeneous graph, the heterogeneous graph type is obtained to realize the homology analysis of the network attack, thereby improving the accuracy of the homology analysis.

[0086] On the basis of the above embodiment, in this embodiment, the process of obtaining the vector of the heterogeneous graph according to the heterogeneous graph with the node embedding vector in step S206 in the previous embodiment is introduced, and the details are as follows:

[0087] Convolution and pooling operations are performed on the heterogeneous graph with node embedding vectors to obtain the vector of the heterogeneous graph.

[0088] Specifically, the heterogeneous graph with node embedding vectors is used as the input of the graph convolutional neural network, the node representation is updated through the convolution operation of the graph convolutional neural network, and the updated nodes are pooled and merged into a single vector, namely the heterogeneous graph vector.

[0089] Optionally, the pooling operation includes global average pooling, global maximum pooling, attention pooling, etc.

[0090] In summary, through convolution and pooling operations, we can obtain the vector of heterogeneous graphs. Convolution operation can reduce the number of processing times for nodes and edges and improve efficiency; the vector of heterogeneous graphs obtained through pooling operation usually has a fixed dimension and format, which is convenient for subsequent classification processing and analysis of heterogeneous graphs.

[0091] Figure 4 A schematic diagram of the structure of a network attack data processing device provided in an embodiment of the present application, such as Figure 4 As shown, the network attack data processing device provided by this embodiment includes: a receiving module 401, a first acquisition module 402, a second acquisition module 403, a merging module 404, a third acquisition module 405, a fourth acquisition module 406, a classification module 407 and an output module 408.

[0092] Receiving module 401, used to receive target network attack paths, historical domain name system data and network traffic data sent by data collection equipment;

[0093] A first acquisition module 402 is used to acquire all nodes in the target network attack path;

[0094] The second acquisition module 403 is used to acquire a network heterogeneous graph of a preset order for each node according to historical domain name system data, network traffic data and a predefined heterogeneous graph network mode;

[0095] A merging module 404 is used to merge the network heterogeneous graphs of preset orders of all nodes according to the target network attack path to obtain a heterogeneous graph corresponding to the target network attack path;

[0096] The third acquisition module 405 is used to acquire the embedding vector of each node in the heterogeneous graph to obtain a heterogeneous graph with node embedding vectors;

[0097] A fourth acquisition module 406 is used to obtain a vector of the heterogeneous graph according to the heterogeneous graph with the node embedding vector;

[0098] A classification module 407 is used to classify the heterogeneous graph according to the vectors of the heterogeneous graph and obtain the type of the heterogeneous graph;

[0099] The output module 408 is used to output heterogeneous graph types; the heterogeneous graph types are used to perform homology analysis on network attacks.

[0100] In a possible implementation, the second acquisition module 403 is specifically used to: acquire historical domain name system data related to each node from historical domain name system data; acquire network traffic data related to each node from network traffic data; and acquire a network heterogeneous graph of a preset order for each node based on the historical domain name system data and network traffic data related to each node and a predefined heterogeneous graph network pattern, with each node as the center.

[0101] In a possible implementation, the third acquisition module 405 is specifically used to: sample the heterogeneous neighbor nodes of each node in the heterogeneous graph to obtain multiple heterogeneous neighbor nodes; extract features of each heterogeneous neighbor node according to the type of each heterogeneous neighbor node to obtain features of each heterogeneous neighbor node; encode the features of each heterogeneous neighbor node to obtain the encoded features of each heterogeneous neighbor node; aggregate the encoded features of multiple heterogeneous neighbor nodes to obtain an embedding vector for each node.

[0102] In a possible implementation, the third acquisition module 405 is further used to obtain the type of each heterogeneous neighbor node; aggregate heterogeneous neighbor nodes of the same type among multiple heterogeneous neighbor nodes to obtain different types of initial embedding vectors of the multiple heterogeneous neighbor nodes; aggregate different types of initial embedding vectors of the multiple heterogeneous neighbor nodes to obtain an embedding vector of each node.

[0103] In a possible implementation, the fourth acquisition module 406 is specifically configured to perform convolution and pooling operations on the heterogeneous graph with the node embedding vector to obtain a vector of the heterogeneous graph.

[0104] The network attack data processing device provided in this embodiment can execute the method provided in the above method embodiment, and its implementation principle and technical effect are similar, which will not be described in detail in this embodiment.

[0105] Figure 5 This is a schematic diagram of the structure of the server provided in the embodiment of the present application. Figure 5 As shown, the server provided in this embodiment includes: at least one processor 501 and a memory 502. Optionally, the server also includes a communication component 503. The processor 501, the memory 502 and the communication component 503 are connected via a bus 504.

[0106] In a specific implementation process, at least one processor 501 executes the computer-executable instructions stored in the memory 502, so that at least one processor 501 executes the above method.

[0107] The specific implementation process of the processor 501 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0108] In the above embodiments, it should be understood that the processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the invention can be directly implemented as a hardware processor, or can be implemented by a combination of hardware and software modules in the processor.

[0109] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (NVM), such as at least one disk storage.

[0110] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of this application is not limited to only one bus or one type of bus.

[0111] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0112] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0113] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0114] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0115] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0116] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0117] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0118] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0119] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0120] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A method for processing network attack data, characterized in that: Applicable to servers, including: Receive target network attack paths, historical domain name system data, and network traffic data sent by data collection equipment; Obtain all nodes in the target network attack path; Obtaining a network heterogeneous graph of a preset order for each node according to the historical domain name system data, the network traffic data and a predefined heterogeneous graph network pattern; According to the target network attack path, the network heterogeneous graphs of preset orders of all nodes are merged to obtain a heterogeneous graph corresponding to the target network attack path; Obtaining an embedding vector of each node in the heterogeneous graph to obtain a heterogeneous graph with node embedding vectors; According to the heterogeneous graph with node embedding vectors, obtaining a vector of the heterogeneous graph; Classifying the heterogeneous graph according to the vector of the heterogeneous graph to obtain the type of the heterogeneous graph; Output the heterogeneous graph type; the heterogeneous graph type is used to perform homology analysis on network attacks.

2. The method according to claim 1, characterized in that The method of obtaining a network heterogeneous graph of a preset order for each node according to the historical domain name system, the network traffic data and a predefined heterogeneous graph network mode includes: From the historical domain name system data, obtaining historical domain name system data related to each node; From the network traffic data, obtain network traffic data related to each node; Taking each node as the center, a network heterogeneous graph of a preset order of each node is obtained according to historical domain name system data and network traffic data related to each node and a predefined heterogeneous graph network pattern.

3. The method according to claim 1, characterized in that The obtaining of the embedding vector of each node in the heterogeneous graph includes: Sampling the heterogeneous neighbor nodes of each node in the heterogeneous graph to obtain multiple heterogeneous neighbor nodes; According to the type of each heterogeneous neighbor node, feature extraction is performed on each heterogeneous neighbor node to obtain the feature of each heterogeneous neighbor node; Encoding the feature of each heterogeneous neighbor node to obtain the encoded feature of each heterogeneous neighbor node; The encoded features of the plurality of heterogeneous neighbor nodes are aggregated to obtain an embedding vector of each node.

4. The method according to claim 3, characterized in that The aggregating the encoding features of the plurality of heterogeneous neighbor nodes to obtain the embedding vector of each node includes: Get the type of each heterogeneous neighbor node; Aggregating heterogeneous neighbor nodes of the same type among the multiple heterogeneous neighbor nodes to obtain different types of initial embedding vectors of the multiple heterogeneous neighbor nodes; Aggregate different types of initial embedding vectors of the plurality of heterogeneous neighbor nodes to obtain an embedding vector of each node.

5. The method according to any one of claims 1 to 4, characterized in that: The step of obtaining a vector of the heterogeneous graph according to the heterogeneous graph with the node embedding vector comprises: A convolution operation and a pooling operation are performed on the heterogeneous graph with the node embedding vector to obtain a vector of the heterogeneous graph.

6. A network attack data processing device, characterized in that: Applicable to servers, including: A receiving module, used for receiving target network attack paths, historical domain name system data and network traffic data sent by a data collection device; A first acquisition module is used to acquire all nodes in the target network attack path; A second acquisition module, configured to acquire a network heterogeneous graph of a preset order for each node according to the historical domain name system data, the network traffic data and a predefined heterogeneous graph network pattern; A merging module, used to merge the network heterogeneous graphs of preset orders of all nodes according to the target network attack path to obtain a heterogeneous graph corresponding to the target network attack path; A third acquisition module is used to acquire an embedding vector of each node in the heterogeneous graph to obtain a heterogeneous graph with a node embedding vector; A fourth acquisition module, configured to obtain a vector of the heterogeneous graph according to the heterogeneous graph with the node embedding vector; A classification module, used for classifying the heterogeneous graph according to the vector of the heterogeneous graph to obtain the type of the heterogeneous graph; An output module is used to output the heterogeneous graph type; the heterogeneous graph type is used to perform homology analysis on network attacks.

7. The device according to claim 6, characterized in that The second acquisition module is specifically used to: acquire the historical domain name system data related to each node from the historical domain name system data; acquire the network traffic data related to each node from the network traffic data; Taking each node as the center, a network heterogeneous graph of a preset order of each node is obtained according to historical domain name system data and network traffic data related to each node and a predefined heterogeneous graph network pattern.

8. A server, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 5.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 5 when executed by a processor.

10. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 5 when being executed by a processor.

Images