Network attack data processing method and device, medium and program product

Abstract

The invention provides a network attack data processing method and device, a medium and a program product. The method comprises the following steps: firstly, acquiring network flow data of a preset network section; then, according to a preset network traffic threshold value, threshold value detection is carried out on the traffic size in the network traffic data, and first abnormal traffic is obtained; further, on the basis of a DBSCAN algorithm, clustering processing is carried out on the network flow data according to the flow size, and at least one piece of network flow corresponding to the boundary point and / or the isolated point after clustering processing is obtained; then, respectively performing correlation analysis on the feature data of the at least one network flow and feature data of a plurality of abnormal flows obtained in advance, and taking the flow of which the correlation with any abnormal flow is greater than a preset value as a second abnormal flow; and finally, according to the first abnormal traffic and the second abnormal traffic, training the network defense model to obtain a trained network defense model, thereby improving the defense capability of the network defense model.

Description

Technical Field

[0001] The present application relates to artificial intelligence security technology, and in particular to a method, device, medium and program product for processing network attack data. Background Art

[0002] With the continuous development of network technology in the world, cyber attack and defense wars have become the leading battlefield of modern warfare, and cyberspace security has become a core component of national security. In the face of increasingly severe cyber attack threats, effective network defense models play a vital role. However, in the process of establishing a network defense model, how to effectively process the acquired network attack data to provide more accurate data for the network defense model has become an important issue that needs to be solved urgently.

[0003] In the existing network defense model, the commonly used method for processing network attack data is to obtain abnormal traffic data from network traffic based on known attack traffic patterns, and then use the abnormal traffic data to directly train the network defense model, thereby establishing a network defense model.

[0004] However, existing methods for processing network attack data have low defense efficiency and are unable to defend against unknown attack methods. Summary of the invention

[0005] The embodiments of the present application provide a method for processing network attack data, an electronic device, a storage medium, and a program product to solve the problems of low defense efficiency and inability to defend against unknown attack methods in existing methods for processing network attack data.

[0006] In a first aspect, an embodiment of the present application provides a method for processing network attack data, including:

[0007] Acquire network flow data of a preset network segment, wherein the network flow data includes multiple network flows and characteristic data of each network flow;

[0008] According to a preset network traffic threshold, threshold detection is performed on the traffic size in the network traffic data to obtain a first abnormal traffic;

[0009] Based on the DBSCAN algorithm, clustering is performed on the network traffic data according to the traffic size, and at least one network traffic corresponding to the boundary points and / or isolated points after the clustering is obtained;

[0010] Performing correlation analysis on the characteristic data of the at least one network flow and the characteristic data of the plurality of abnormal flows acquired in advance, respectively, and taking the flow whose correlation with any abnormal flow is greater than a preset value as the second abnormal flow;

[0011] A network defense model is trained according to the first abnormal traffic and the second abnormal traffic to obtain a trained network defense model.

[0012] In a possible implementation, the network traffic data includes: traffic data generated by simulating attacks on the network using SDN technology based on a preset intelligent policy engine.

[0013] In a possible implementation manner, before clustering the network traffic data according to traffic size based on the DBSCAN algorithm, the method further includes:

[0014] If the amount of traffic in the network traffic data is greater than a preset amount, sampling the traffic in the network traffic data according to a random sampling method to obtain sampled network traffic data, and the amount of traffic in the sampled network traffic data is less than the preset amount;

[0015] Accordingly, based on the DBSCAN algorithm, the network traffic data is clustered according to the traffic size, including:

[0016] Based on the DBSCAN algorithm, the sampled network traffic data is clustered according to the traffic size.

[0017] In a possible implementation, the network defense model includes: a BAS model and a CART model;

[0018] Correspondingly, the network defense model is trained according to the first abnormal traffic and the second abnormal traffic to obtain the trained network defense model, including:

[0019] According to the first abnormal traffic and the second abnormal traffic, the BAS model and the CART model are trained respectively to obtain a trained BAS model and a trained CART model; the network defense model includes the trained BAS model and the trained CART model.

[0020] In a possible implementation, it further includes:

[0021] Deploy the network defense model to a network server to perform network attack detection and defense, and obtain feedback data;

[0022] The network defense model is optimized and trained according to the feedback data to obtain an optimized network defense model.

[0023] In a possible implementation, the characteristic data of each network flow includes the following characteristics:

[0024] Traffic packet size, protocol, traffic type, source IP address, destination IP address, port, and network behavior characteristics;

[0025] The network behavior characteristics include at least one of the number of connections, session duration, and packet interval.

[0026] In a second aspect, an embodiment of the present application provides a network attack data processing device, including:

[0027] An acquisition module, used for acquiring network flow data of a preset network segment, wherein the network flow data includes multiple network flows and characteristic data of each network flow;

[0028] A detection module, configured to perform a threshold detection on the flow size in the network flow data according to a preset network flow threshold, and obtain a first abnormal flow;

[0029] A processing module, which is used for clustering the network traffic data according to the traffic size using a density-based clustering DBSCAN algorithm, and obtaining at least one network traffic corresponding to a boundary point and / or an isolated point after the clustering process;

[0030] An analysis module, configured to respectively perform correlation analysis on the characteristic data of the at least one network flow and the characteristic data of a plurality of abnormal flows acquired in advance, and to take the flow having a correlation with any abnormal flow greater than a preset value as the second abnormal flow;

[0031] A training module is used to train a network defense model according to the first abnormal traffic and the second abnormal traffic to obtain a trained network defense model.

[0032] In a possible implementation, the network traffic data includes: traffic data generated by simulating attacks on the network using SDN technology based on a preset intelligent policy engine.

[0033] In a possible implementation manner, before clustering the network traffic data according to traffic size based on the DBSCAN algorithm, the processing module is further used to:

[0034] If the amount of traffic in the network traffic data is greater than a preset amount, sampling the traffic in the network traffic data according to a random sampling method to obtain sampled network traffic data, and the amount of traffic in the sampled network traffic data is less than the preset amount;

[0035] Accordingly, based on the DBSCAN algorithm, the network traffic data is clustered according to the traffic size, including:

[0036] Based on the DBSCAN algorithm, the sampled network traffic data is clustered according to the traffic size.

[0037] In a possible implementation, the network defense model includes: a BAS model and a CART model;

[0038] Correspondingly, the network defense model is trained according to the first abnormal traffic and the second abnormal traffic to obtain the trained network defense model, including:

[0039] According to the first abnormal traffic and the second abnormal traffic, the BAS model and the CART model are trained respectively to obtain a trained BAS model and a trained CART model; the network defense model includes the trained BAS model and the trained CART model.

[0040] In a possible implementation manner, the training module is further used to:

[0041] Deploy the network defense model to a network server to perform network attack detection and defense, and obtain feedback data;

[0042] The network defense model is optimized and trained according to the feedback data to obtain an optimized network defense model.

[0043] In a possible implementation, the characteristic data of each network flow includes the following characteristics:

[0044] Traffic packet size, protocol, traffic type, source IP address, destination IP address, port, and network behavior characteristics;

[0045] The network behavior characteristics include at least one of the number of connections, session duration, and packet interval.

[0046] In a third aspect, an embodiment of the present application provides an electronic device, including: a memory, a processor;

[0047] The memory stores computer-executable instructions;

[0048] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0049] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect.

[0050] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0051] The network attack data processing method, device, medium and program product provided in the embodiments of the present application first obtain network traffic data of a preset network segment; then, according to a preset network traffic threshold, perform threshold detection on the traffic size in the network traffic data to obtain a first abnormal traffic, that is, through network traffic monitoring, if it is found that the current network traffic is greater than the preset network traffic threshold, the network traffic data is marked as the first abnormal traffic; further, based on the DBSCAN algorithm, cluster processing is performed on the network traffic data according to the traffic size to obtain at least one network traffic corresponding to the boundary points and / or isolated points after clustering processing. In this way, the network traffic data can be further detected on the basis of threshold detection. Detection, in-depth mining of hidden abnormal traffic data, so as to provide more comprehensive abnormal traffic data for the network defense model; then, the characteristic data of at least one network flow and the characteristic data of multiple abnormal flows obtained in advance are respectively correlated, and the traffic with a correlation greater than a preset value with any abnormal flow is taken as the second abnormal flow. Through feature correlation comparison, not only known attack patterns can be captured, but also new attack traffic with similar characteristics can be found; finally, according to the obtained first abnormal flow and second abnormal flow, the network defense model is trained to enhance the network defense model's ability to identify various attack behaviors, thereby generating corresponding defense strategies, adapting to real-time changes in network abnormal behaviors, and improving network defense efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0053] Figure 1 A flowchart of a method for processing network attack data provided by an embodiment of the present application;

[0054] Figure 2 A schematic diagram of the structure of a device for processing network attack data provided in an embodiment of the present application;

[0055] Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0056] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0057] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0058] With the continuous development of network technology in the world, cyber attack and defense wars have become the leading battlefield of modern warfare, and cyberspace security has become a core component of national security. In the face of increasingly severe cyber attack threats, effective network defense models play a vital role. However, in the process of establishing a network defense model, how to effectively process the acquired network attack data to provide more accurate data for the network defense model has become an important issue that needs to be solved urgently.

[0059] In the existing network defense model, the commonly used method for processing network attack data is to obtain abnormal traffic from network traffic based on known attack traffic patterns, and then directly perform model training through the abnormal traffic to establish a network defense model.

[0060] However, the existing methods for processing network attack data only rely on known attack traffic, so when other unknown attack modes appear, it is difficult to carry out effective security defense. The defense efficiency is low and it cannot meet the defense needs in different scenarios.

[0061] Based on this, the present application proposes a method for processing network attack data. Considering that the existing abnormal traffic data is only obtained by known traffic attack means, it is difficult to obtain unknown traffic attack means due to the lack of corresponding sample data and feature descriptions, which leads to the inability to obtain the corresponding abnormal traffic data, and the defense efficiency of the network defense model is low. The unsupervised learning algorithm, that is, based on the DBSCAN algorithm, can divide the network traffic according to the density distribution by clustering, so as to further distinguish some abnormal traffic that may be generated by unknown traffic attack means. Further, through correlation analysis, the characteristic data of possible abnormal traffic is analyzed with the characteristic data of known abnormal traffic, and the network defense model is trained after obtaining more comprehensive abnormal traffic, forming a defense system with adaptive capabilities, thereby improving the defense capability of the network defense model.

[0062] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0063] Figure 1 A flowchart of a method for processing network attack data provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the method includes:

[0064] S101, obtaining network traffic data of a preset network segment.

[0065] Among them, the network traffic data includes multiple network flows and characteristic data of each network flow; the characteristic data of each network flow includes: traffic packet size, protocol, traffic type, source Internet Protocol (Internet Protocol, IP) address, destination IP address, port and network behavior characteristics; network behavior characteristics include: number of connections, session duration and at least one of packet interval.

[0066] Specifically, the traffic packet size is the number of bytes in each packet, which is used to determine the network load and protocol overhead; the protocol is used to distinguish traffic types; traffic types can include video streaming, web page requests, file transfers, etc., which are usually determined by the combination of protocol + port number; the source IP address and destination IP address are used to identify the communicating parties, which is convenient for tracking data flow; the port is used to further define the specific service or application of the communication, which can be divided into source port and destination port; the number of connections in the network behavior characteristics is the number of concurrent connections of the same IP or port, reflecting the traffic density; the session duration is used to describe the duration of the session, which is convenient for distinguishing short-term burst traffic from long-term traffic; the packet interval refers to the time interval between the sending of adjacent data packets, which is often used to analyze traffic patterns.

[0067] It should be noted that the preset network segment can be a preset subnet network segment or a set of special IP addresses. The specific network segment is determined based on actual conditions, and the embodiments of the present application do not make specific restrictions here.

[0068] Optionally, the method for obtaining network traffic data can be to define the key device types to be monitored by selecting a preset network segment, such as servers and routers, and then independently copy the network traffic data (incoming traffic and outgoing traffic) of the key devices through network traffic mirroring to facilitate further analysis of the network traffic data; then, deep packet inspection is performed on the copied network traffic data to obtain the characteristic data of each network flow.

[0069] In one achievable method, a method for obtaining more comprehensive network traffic data, i.e., network traffic data including different attack methods, may be:

[0070] Based on the preset intelligent policy engine, SDN technology is used to simulate attacks on the network to generate traffic data.

[0071] Among them, the preset intelligent policy engine is composed of network attack chains, artificial intelligence technology and machine learning algorithms; Software Defined Network (SDN) technology is used to provide centralized traffic control and real-time traffic adjustment.

[0072] Optionally, by utilizing a preset intelligent policy engine and adopting SDN technology to simulate the traffic data generated by attacks on the network, a corresponding distributed attack knowledge base can be established to more efficiently and accurately evaluate the corresponding attack methods, understand the behavior and motivation of the attacks, and thus formulate more effective defense strategies in the future.

[0073] It is understandable that under the control of SDN technology, according to the attack strategy generated by the intelligent policy engine, simulated attack traffic can be injected into the network, and by controlling the network traffic path and attributes, multiple attack types can be simulated. This method can provide a more comprehensive network traffic data foundation for subsequent analysis.

[0074] S102: Perform threshold detection on the traffic size in the network traffic data according to a preset network traffic threshold to obtain a first abnormal traffic.

[0075] Optionally, the preset network traffic threshold can be adjusted according to historical network traffic data. That is, the network traffic threshold of normal network behavior can be adjusted in real time and dynamically for different network traffic data by analyzing the historical network traffic data, so as to achieve the correctness and accuracy of abnormal traffic detection.

[0076] For example, for an e-commerce server, the preset network traffic threshold on ordinary working days is 2,000 requests per second during the day, and can reach 5,000 requests per second during peak hours at night; but when promotions are required on holidays or special dates, the normal user visits will suddenly surge, bringing high traffic. If a fixed network traffic threshold is used (such as a fixed number of requests, traffic size), normal access may be misjudged as abnormal traffic, thereby triggering unnecessary alarms. Therefore, the network traffic threshold needs to be adjusted in real time, such as adjusting the network traffic threshold to 8,000 requests per second to improve the correctness and accuracy of abnormal traffic detection.

[0077] It can be understood that by using a commonly used network traffic threshold detection method, the abnormal traffic corresponding to the known attack method, that is, the first abnormal traffic, can be quickly obtained.

[0078] S103: Based on the DBSCAN algorithm, cluster the network traffic data according to the traffic size, and obtain at least one network traffic corresponding to the boundary points and / or isolated points after the clustering process.

[0079] Among them, the density-based spatial clustering of applications with noise (DBSCAN) algorithm is used to discover clusters of arbitrary shapes from data sets and can effectively handle boundary points and / or isolated points. The core idea of ​​DBSCAN is to define clusters by "density": including core points (i.e. normal network traffic), boundary points (network traffic attached to normal network traffic, i.e. suspicious network traffic), and isolated points (abnormal or outlier points, i.e. abnormal network traffic).

[0080] In one achievable method, before clustering the network traffic data according to the traffic size, the traffic quantity in the network traffic data needs to be processed, specifically including:

[0081] If the amount of traffic in the network traffic data is greater than a preset amount, the traffic in the network traffic data is sampled according to a random sampling method to obtain sampled network traffic data.

[0082] The amount of traffic in the sampled network traffic data is less than a preset amount.

[0083] Optionally, if the amount of traffic in the network traffic data is greater than a preset amount, in order to reduce the amount of calculation, the network traffic data can be analyzed by randomly sampling the data. For example, the network traffic data can be sampled at a sampling ratio of 1000:1 to obtain sampled network traffic data. Accordingly, when the amount of traffic in the network traffic data is less than a preset amount, a full traffic analysis is performed on the network traffic data. The network traffic data can also be stored and analyzed and detected through a database.

[0084] It should be noted that after processing the traffic quantity in the network traffic data, it is also necessary to cluster the sampled network traffic data according to the traffic size based on the DBSCAN algorithm.

[0085] It can be understood that by dividing the traffic into normal traffic, suspicious traffic and abnormal traffic according to density distribution based on the DBSCAN algorithm, the attack traffic corresponding to the unknown attack means can be quickly located by further analyzing the suspicious traffic and abnormal traffic.

[0086] S104: Perform correlation analysis on characteristic data of at least one network flow and characteristic data of multiple abnormal flows obtained in advance, and take flow having a correlation with any abnormal flow greater than a preset value as second abnormal flow.

[0087] It can be understood that the feature data corresponding to at least one network flow corresponding to the boundary point (i.e., suspicious flow) and the isolated point (i.e., abnormal flow) after clustering based on the DBSCAN algorithm is subjected to correlation analysis with the feature data of multiple abnormal flows in the existing abnormal flow feature database, and the flow with a correlation greater than a preset threshold is screened out as the second abnormal flow. This method can not only detect abnormal flows generated by unknown attack means, but also improve the accuracy of the detection results and reduce false positives and false negatives through correlation screening.

[0088] S105. Train a network defense model according to the first abnormal traffic and the second abnormal traffic to obtain a trained network defense model.

[0089] Among them, the network defense model includes the Breach and Attack Simulation (BAS) model and the Classification and Regression Trees (CART) model; the network defense model includes the trained BAS model and the trained CART model.

[0090] Correspondingly, according to the first abnormal flow and the second abnormal flow, the BAS model and the CART model are trained respectively to obtain a trained BAS model and a trained CART model;

[0091] Specifically, the five-tuple (source IP, destination IP, protocol, source port, destination port) and network behavior characteristics (such as traffic size, session duration, packet rate, etc.) in the first abnormal traffic and the second abnormal traffic are first extracted as input features of the network defense model; then, the BAS model uses the characteristics of the abnormal traffic (i.e., the first abnormal traffic and the second abnormal traffic) to construct an attack path and simulate multiple attack scenarios. At the same time, the deep learning eXtreme Language Understanding Transformer model and big data technology are combined to output the corresponding defense measures. The BAS model is further trained based on the attack characteristics and the effects of the defense measures to automatically generate new attack paths and update defense measures; finally, the attack path generated by the BAS model is used as the input of the CART model to further refine the attack classification and defense measures, and the attack risk value assessed by the CART model is fed back to the BAS model to optimize the attack simulation accuracy.

[0092] In one feasible approach, after obtaining the trained network defense model, the network defense model needs to be further optimized, including:

[0093] First, the network defense model is deployed to the network server for network attack detection and defense to obtain feedback data; then, the network defense model is optimized and trained based on the feedback data to obtain an optimized network defense model.

[0094] It is understandable that the network defense model that has been initially trained is deployed to the network server to monitor and defend against potential network attacks in real time. The model identifies and analyzes network traffic, determines attack behavior and triggers defense measures to obtain feedback data. After that, the feedback data is merged with the original training data to generate a training data set containing new features and unknown attack patterns. The new training data set is then used to optimize the network defense model to obtain an optimized network defense model. In this way, the network defense model can effectively enhance its ability to detect and respond to unknown attacks, adapt to changes in the real-time network environment and new defense mechanisms, and improve the success rate and effectiveness of network defense.

[0095] The method for processing network attack data provided in the embodiment of the present application first obtains network traffic data of a preset network segment; then, according to a preset network traffic threshold, performs a threshold detection on the traffic size in the network traffic data to obtain a first abnormal traffic, that is, through network traffic monitoring, if it is found that the current network traffic is greater than the preset network traffic threshold, the network traffic data is marked as the first abnormal traffic; further, based on the DBSCAN algorithm, the network traffic data is clustered according to the traffic size to obtain at least one network traffic corresponding to the boundary points and / or isolated points after clustering. In this way, the network traffic data can be further detected on the basis of threshold detection, and in-depth mining can be carried out. Hidden abnormal traffic data, thereby providing more comprehensive abnormal traffic data for the network defense model; then, the characteristic data of at least one network flow and the characteristic data of multiple abnormal flows obtained in advance are respectively correlated, and the traffic whose correlation with any abnormal flow is greater than a preset value is taken as the second abnormal flow. Through feature correlation comparison, not only known attack patterns can be captured, but also new attack traffic with similar characteristics can be found; finally, according to the obtained first abnormal flow and second abnormal flow, the network defense model is trained to enhance the network defense model's ability to recognize various attack behaviors, thereby generating corresponding defense strategies, adapting to real-time changing network abnormal behaviors, and improving network defense efficiency.

[0096] Figure 2 A schematic diagram of the structure of a network attack data processing device provided in an embodiment of the present application; Figure 2 As shown, the network attack data processing device 20 provided in the embodiment of the present application includes:

[0097] An acquisition module 201 is used to acquire network flow data of a preset network segment, wherein the network flow data includes multiple network flows and characteristic data of each network flow;

[0098] The detection module 202 is used to perform a threshold detection on the flow size in the network flow data according to a preset network flow threshold to obtain a first abnormal flow;

[0099] The processing module 203 is used to perform clustering processing on the network flow data according to the flow size using the density-based clustering DBSCAN algorithm, and obtain at least one network flow corresponding to the boundary points and / or isolated points after the clustering processing;

[0100] The analysis module 204 is used to perform correlation analysis on the characteristic data of at least one network flow and the characteristic data of multiple abnormal flows obtained in advance, and take the flow whose correlation with any abnormal flow is greater than a preset value as the second abnormal flow;

[0101] The training module 205 is used to train the network defense model according to the first abnormal traffic and the second abnormal traffic to obtain a trained network defense model.

[0102] In a possible implementation, the network traffic data includes: traffic data generated by simulating attacks on the network using SDN technology based on a preset intelligent policy engine.

[0103] In a possible implementation, before clustering the network traffic data according to the traffic size based on the DBSCAN algorithm, the processing module 203 is further used to:

[0104] If the amount of traffic in the network traffic data is greater than the preset amount, sampling the traffic in the network traffic data according to the random sampling method to obtain sampled network traffic data, and the amount of traffic in the sampled network traffic data is less than the preset amount;

[0105] Accordingly, based on the DBSCAN algorithm, the network traffic data is clustered according to the traffic size, including:

[0106] Based on the DBSCAN algorithm, the sampled network traffic data is clustered according to the traffic size.

[0107] In a possible implementation, the network defense model includes: a BAS model and a CART model;

[0108] Correspondingly, the network defense model is trained according to the first abnormal traffic and the second abnormal traffic to obtain a trained network defense model, including:

[0109] According to the first abnormal traffic and the second abnormal traffic, the BAS model and the CART model are trained respectively to obtain a trained BAS model and a trained CART model; the network defense model includes the trained BAS model and the trained CART model.

[0110] In a possible implementation, the training module 205 is further configured to:

[0111] Deploy the network defense model to the network server to detect and defend against network attacks and obtain feedback data;

[0112] The network defense model is optimized and trained according to the feedback data to obtain an optimized network defense model.

[0113] In a possible implementation, the characteristic data of each network flow includes the following characteristics:

[0114] Traffic packet size, protocol, traffic type, source IP address, destination IP address, port, and network behavior characteristics;

[0115] The network behavior characteristics include at least one of the number of connections, session duration, and packet interval.

[0116] The network attack data processing device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and this embodiment will not be described in detail here.

[0117] Figure 3 This is a schematic diagram of the structure of the electronic device provided in this application. Figure 3 As shown, the electronic device 30 provided in this embodiment includes: at least one processor 301 and a memory 302. Optionally, the device 30 also includes a communication component 303. The processor 301, the memory 302 and the communication component 303 are connected via a bus 304.

[0118] In a specific implementation process, at least one processor 301 executes the computer-executable instructions stored in the memory 302, so that at least one processor 301 executes the above method.

[0119] The specific implementation process of the processor 301 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0120] In the above embodiments, it should be understood that the processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the invention can be directly implemented as a hardware processor, or can be implemented by a combination of hardware and software modules in the processor.

[0121] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (NVM), such as at least one disk storage.

[0122] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of this application is not limited to only one bus or one type of bus.

[0123] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0124] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0125] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0126] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0127] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0128] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0129] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0130] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0131] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0132] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A method for processing network attack data, characterized in that: include: Acquire network flow data of a preset network segment, wherein the network flow data includes multiple network flows and characteristic data of each network flow; According to a preset network traffic threshold, threshold detection is performed on the traffic size in the network traffic data to obtain a first abnormal traffic; Based on the density clustering DBSCAN algorithm, the network traffic data is clustered according to the traffic size, and at least one network traffic corresponding to the boundary points and / or isolated points after the clustering process is obtained; Performing correlation analysis on the characteristic data of the at least one network flow and the characteristic data of the plurality of abnormal flows acquired in advance, respectively, and taking the flow whose correlation with any abnormal flow is greater than a preset value as the second abnormal flow; A network defense model is trained according to the first abnormal traffic and the second abnormal traffic to obtain a trained network defense model.

2. The method according to claim 1, characterized in that The network traffic data includes: traffic data generated by simulating attacks on the network using software defined network (SDN) technology based on a preset intelligent policy engine.

3. The method according to claim 1, characterized in that Before clustering the network traffic data according to traffic size based on the DBSCAN algorithm, the method further includes: If the amount of traffic in the network traffic data is greater than a preset amount, sampling the traffic in the network traffic data according to a random sampling method to obtain sampled network traffic data, and the amount of traffic in the sampled network traffic data is less than the preset amount; Accordingly, based on the DBSCAN algorithm, the network traffic data is clustered according to the traffic size, including: Based on the DBSCAN algorithm, the sampled network traffic data is clustered according to the traffic size.

4. The method according to any one of claims 1 to 3, characterized in that: The network defense model includes: vulnerability and attack simulation BAS model and classification decision CART model; Correspondingly, the network defense model is trained according to the first abnormal traffic and the second abnormal traffic to obtain the trained network defense model, including: According to the first abnormal traffic and the second abnormal traffic, the BAS model and the CART model are trained respectively to obtain a trained BAS model and a trained CART model; the network defense model includes the trained BAS model and the trained CART model.

5. The method according to claim 4, characterized in that The method further comprises: Deploy the network defense model to a network server to perform network attack detection and defense, and obtain feedback data; The network defense model is optimized and trained according to the feedback data to obtain an optimized network defense model.

6. The method according to any one of claims 1 to 3, characterized in that: The characteristic data of each network flow includes the following characteristics: Traffic packet size, protocol, traffic type, source IP address, destination IP address, port, and network behavior characteristics; The network behavior characteristics include at least one of the number of connections, session duration, and packet interval.

7. A network attack data processing device, characterized in that: include: An acquisition module, used for acquiring network flow data of a preset network segment, wherein the network flow data includes multiple network flows and characteristic data of each network flow; A detection module, configured to perform a threshold detection on the flow size in the network flow data according to a preset network flow threshold, and obtain a first abnormal flow; A processing module, which is used for clustering the network traffic data according to the traffic size using a density-based clustering DBSCAN algorithm, and obtaining at least one network traffic corresponding to a boundary point and / or an isolated point after the clustering process; An analysis module, configured to respectively perform correlation analysis on the characteristic data of the at least one network flow and the characteristic data of a plurality of abnormal flows acquired in advance, and to take the flow having a correlation with any abnormal flow greater than a preset value as the second abnormal flow; A training module is used to train a network defense model according to the first abnormal traffic and the second abnormal traffic to obtain a trained network defense model.

8. An electronic device, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed by a processor.

10. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 6 when being executed by a processor.

Images