Method, device, medium and program product for processing cyber attack data

Abstract

The application provides a network attack data processing method, device, medium and program product. The method comprises the following steps: firstly, obtaining network traffic data of a preset network segment; then, performing threshold detection on the traffic size in the network traffic data according to a preset network traffic threshold to obtain first abnormal traffic; further, performing clustering processing on the network traffic data according to the traffic size based on a DBSCAN algorithm to obtain at least one network traffic corresponding to a boundary point and / or an isolated point after the clustering processing; then, respectively performing correlation analysis on feature data of the at least one network traffic and feature data of a plurality of abnormal traffics obtained in advance, and regarding the traffic with a correlation greater than a preset value with any abnormal traffic as second abnormal traffic; finally, training a network defense model according to the first abnormal traffic and the second abnormal traffic to obtain a trained network defense model, thereby improving the defense capability of the network defense model.

Description

TECHNICAL FIELD

[0001] The present application relates to artificial intelligence security technology, and in particular to a network attack data processing method and device, a medium and a program product. BACKGROUND

[0002] With the continuous development of world network technology, network attack and defense war has become the first battlefield of modern war, and network space security has become a core component of national security. In the face of increasingly severe network attack threats, effective network defense models play a crucial role. However, in the process of establishing a network defense model, how to effectively process the obtained network attack data to provide more accurate data for the network defense model has become an important problem that needs to be solved at present.

[0003] In the existing network defense model, the commonly used network attack data processing method obtains abnormal flow data from network flow based on known attack flow mode, and then directly trains the network defense model using the abnormal flow data, thereby establishing a network defense model.

[0004] However, the existing network attack data processing method has low defense efficiency and cannot defend against unknown attack means. SUMMARY

[0005] The embodiments of the present application provide a network attack data processing method, an electronic device, a storage medium and a program product to solve the problem of low defense efficiency and inability to defend against unknown attack means in the existing network attack data processing method.

[0006] In a first aspect, the embodiments of the present application provide a network attack data processing method, comprising:

[0007] Obtain network flow data of a preset network segment, wherein the network flow data includes a plurality of network flows and feature data of each network flow;

[0008] According to a preset network flow threshold, perform threshold detection on the flow size in the network flow data to obtain first abnormal flow;

[0009] Based on the DBSCAN algorithm, cluster process the network flow data according to the flow size to obtain at least one network flow corresponding to the boundary point and / or isolated point after the clustering process;

[0010] Perform correlation analysis on the feature data of the at least one network flow and the feature data of a plurality of abnormal flows obtained in advance, and take the flow with a correlation greater than a preset value with any abnormal flow as second abnormal flow;

[0011] According to the first abnormal flow and the second abnormal flow, a network defense model is trained to obtain a trained network defense model.

[0012] In a possible implementation, the network flow data includes flow data generated by simulating an attack on the network based on a preset intelligent strategy engine and using SDN technology.

[0013] In a possible implementation, before the network flow data is clustered according to the flow size based on the DBSCAN algorithm, the method further includes:

[0014] If the number of flows in the network flow data is greater than a preset number, the flows in the network flow data are sampled according to a random sampling method to obtain sampled network flow data, and the number of flows in the sampled network flow data is less than the preset number.

[0015] Correspondingly, the clustering of the network flow data according to the flow size based on the DBSCAN algorithm includes:

[0016] The network flow data is clustered according to the flow size based on the DBSCAN algorithm.

[0017] In a possible implementation, the network defense model includes a BAS model and a CART model.

[0018] Correspondingly, the training of the network defense model according to the first abnormal flow and the second abnormal flow to obtain a trained network defense model includes:

[0019] The BAS model and the CART model are trained according to the first abnormal flow and the second abnormal flow to obtain a trained BAS model and a trained CART model; and the network defense model includes the trained BAS model and the trained CART model.

[0020] In a possible implementation, the method further includes:

[0021] The network defense model is deployed to a network server for network attack detection and defense to obtain feedback data.

[0022] The network defense model is optimized and trained according to the feedback data to obtain an optimized network defense model.

[0023] In a possible implementation, the feature data of each network flow includes the following features:

[0024] Traffic packet size, protocol, traffic type, source IP address, target IP address, port, and network behavior characteristics;

[0025] The network behavior characteristics include at least one of the number of connections, session duration, and packet interval.

[0026] In a second aspect, an embodiment of the present application provides a network attack data processing apparatus, comprising:

[0027] A obtaining module is configured to obtain network traffic data of a preset network segment, wherein the network traffic data includes a plurality of network traffics and feature data of each network traffic.

[0028] A detection module is configured to perform threshold detection on traffic size in the network traffic data according to a preset network traffic threshold to obtain first abnormal traffic.

[0029] A processing module is configured to perform clustering processing on the network traffic data according to traffic size based on a density-based spatial clustering of applications with noise (DBSCAN) algorithm to obtain at least one network traffic corresponding to a boundary point and / or an isolated point after the clustering processing.

[0030] An analysis module is configured to perform correlation analysis on feature data of the at least one network traffic and feature data of a plurality of abnormal traffics obtained in advance, and regard traffic with correlation greater than a preset value with any abnormal traffic as second abnormal traffic.

[0031] A training module is configured to train a network defense model according to the first abnormal traffic and the second abnormal traffic to obtain a trained network defense model.

[0032] In a possible implementation, the network traffic data includes traffic data generated by simulating attacks on a network based on a preset intelligent strategy engine and using SDN technology.

[0033] In a possible implementation, before the clustering processing on the network traffic data according to traffic size based on the DBSCAN algorithm, the processing module is further configured to:

[0034] If the number of traffics in the network traffic data is greater than a preset number, the processing module is further configured to sample the traffics in the network traffic data according to a random sampling method to obtain sampled network traffic data, wherein the number of traffics in the sampled network traffic data is less than the preset number.

[0035] Correspondingly, the clustering processing on the network traffic data according to traffic size based on the DBSCAN algorithm includes:

[0036] According to the DBSCAN algorithm, the sampled network traffic data is clustered according to the size of the traffic.

[0037] In a possible implementation, the network defense model comprises a BAS model and a CART model.

[0038] Accordingly, the network defense model is trained according to the first abnormal traffic and the second abnormal traffic to obtain a trained network defense model.

[0039] The BAS model and the CART model are trained according to the first abnormal traffic and the second abnormal traffic to obtain a trained BAS model and a trained CART model.

[0040] In a possible implementation, the training module is further configured to:

[0041] The network defense model is deployed to a network server for network attack detection and defense to obtain feedback data.

[0042] The network defense model is optimized and trained according to the feedback data to obtain an optimized network defense model.

[0043] In a possible implementation, the feature data of each network traffic comprises the following features:

[0044] Traffic packet size, protocol, traffic type, source IP address, destination IP address, port, and network behavior features.

[0045] The network behavior features comprise at least one of the following: connection number, session duration, and packet interval.

[0046] In a third aspect, an electronic device is provided, comprising a memory and a processor.

[0047] The memory stores computer execution instructions.

[0048] The processor executes the computer execution instructions stored in the memory, so that the processor executes the first aspect and / or various possible implementations of the first aspect.

[0049] In a fourth aspect, a computer readable storage medium is provided, which stores computer execution instructions. When the computer execution instructions are executed by a processor, the computer execution instructions are used to implement the first aspect and / or various possible implementations of the first aspect.

[0050] In a fifth aspect, an embodiment of the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the first aspect and / or various possible implementation manners of the first aspect.

[0051] The network attack data processing method, device, medium and program product provided by the embodiments of the present application first acquire network traffic data of a preset network segment; then, according to a preset network traffic threshold, threshold detection is performed on the traffic size in the network traffic data to obtain first abnormal traffic, that is, by network traffic monitoring, if it is found that the current network traffic is greater than the preset network traffic threshold, the network traffic data is marked as first abnormal traffic; further, based on the DBSCAN algorithm, the network traffic data is clustered according to the traffic size to acquire at least one network traffic corresponding to a boundary point and / or an isolated point after clustering processing, in this way, further detection can be performed on the network traffic data based on threshold detection, hidden abnormal traffic data can be further mined, and more comprehensive abnormal traffic data can be provided for a network defense model; then, the feature data of the at least one network traffic and the feature data of a plurality of abnormal traffics acquired in advance are respectively analyzed for correlation, and traffic with a correlation greater than a preset value with any abnormal traffic is taken as second abnormal traffic, by comparing the feature correlation, not only known attack patterns can be captured, but also new attack traffic with similar features can be found; finally, the network defense model is trained according to the acquired first abnormal traffic and second abnormal traffic, the recognition ability of the network defense model to a plurality of attack behaviors can be enhanced, and corresponding defense strategies are generated, the network defense efficiency is improved, and the network abnormal behaviors are adapted to real-time changes. BRIEF DESCRIPTION OF DRAWINGS

[0052] The accompanying drawings, which are incorporated herein and form a part of the specification, illustrate embodiments consistent with the present application and, together with the description, further serve to explain the principles of the present application.

[0053] Figure 1 A network attack data processing method flowchart is provided for the embodiments of the present application;

[0054] Figure 2 A network attack data processing device structure diagram is provided for the embodiments of the present application;

[0055] Figure 3 An electronic device structure diagram is provided for the embodiments of the present application.

[0056] Through the above drawings, the specific embodiments of the present application have been shown, and more detailed descriptions will be given hereinafter. These drawings and textual descriptions are not intended to limit the scope of the concept of the present application by any means, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0057] The exemplary embodiments will be described in detail herein with reference to the attached drawings. The description herein relates to the drawings, in which the same numbers represent the same or similar elements, unless otherwise represented. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of apparatuses and methods consistent with some aspects of the present application as detailed in the appended claims.

[0058] With the continuous development of world network technology, network attack and defense war has become the pre-war battlefield of modern war, and network space security has become a core component of national security. In the face of increasingly severe network attack threats, effective network defense models play a crucial role. However, in the process of establishing network defense models, how to effectively process the obtained network attack data to provide more accurate data for network defense models has become an important problem that needs to be solved.

[0059] In the existing network defense model, the commonly used network attack data processing method adopts the method of obtaining abnormal traffic from network traffic based on known attack traffic mode, and then directly training the model through abnormal traffic to establish a network defense model.

[0060] However, the existing network attack data processing method relies only on known attack traffic, and when other unknown attack patterns occur, it is difficult to effectively defend against security, and the defense efficiency is low, and it cannot meet the defense needs in different scenarios.

[0061] Based on this, the present application proposes a network attack data processing method, considering that the existing abnormal traffic data is only obtained by known traffic attack means, and for unknown traffic attack means, it is difficult to obtain due to the lack of corresponding sample data and feature description, resulting in the inability to obtain corresponding abnormal traffic data, and the defense efficiency of the network defense model is low. Unsupervised learning algorithm, that is, based on DBSCAN algorithm, can divide network traffic according to density distribution through clustering, so as to further distinguish some abnormal traffic that may be generated by unknown traffic attack means. Further, through correlation analysis, the feature data of possible abnormal traffic and the feature data of known abnormal traffic are analyzed, more comprehensive abnormal traffic is obtained, and then the network defense model is trained, forming a defense system with adaptive ability, thereby improving the defense ability of the network defense model.

[0062] The technical solutions of the present application and how the technical solutions of the present application solve the above technical problems will be described in detail below with specific examples. The following specific examples can be combined with each other, and the same or similar concepts or processes can not be described again in some examples. The embodiments of the present application will be described below with reference to the accompanying drawings.

[0063] Figure 1 A flowchart of a method for processing network attack data provided by an embodiment of the present application is shown in FIG. 1, which includes the following steps. Figure 1

[0064] S101, network traffic data of a preset network segment is acquired.

[0065] The network traffic data includes a plurality of network traffic and feature data of each network traffic. The feature data of each network traffic includes traffic packet size, protocol, traffic type, source Internet Protocol (IP) address, target IP address, port, and network behavior feature. The network behavior feature includes at least one of connection number, session duration, and packet interval.

[0066] Specifically, the traffic packet size is the number of bytes of each packet, which is used to judge network load and protocol overhead. The protocol is used to distinguish traffic types. The traffic type can include video streaming, web request, file transfer, etc., which is usually determined by protocol + port number combination. The source IP address and the target IP address are used to identify the communication parties, facilitating the tracking of data flow. The port is used to further define the specific service or application of the communication, which can be divided into source port and target port. The connection number in the network behavior feature is the number of concurrent connections of the same IP or port, reflecting the traffic density. The session duration is used to describe the duration of the session, facilitating the distinction between short-term explosive traffic and long-term traffic. The packet interval refers to the time interval between adjacent data packets, which is commonly used to analyze traffic patterns.

[0067] It should be noted that the preset network segment can be a preset subnetwork segment or a group of special IP addresses. The specific network segment is determined according to the actual situation, and the embodiments of the present application do not make specific limitations here.

[0068] Optionally, the acquisition method of the network traffic data can define the key equipment types to be monitored by selecting a preset network segment, such as servers and routers, etc. Then the network traffic data (inbound traffic and outbound traffic) of the key equipment is independently copied through network traffic mirroring, so as to facilitate further analysis of the network traffic data. Then the feature data of each network traffic is acquired by performing deep packet inspection on the copied network traffic data.

[0069] ​In an implementable manner, the manner of obtaining more comprehensive network traffic data, i.e., network traffic data including different attack modes, can be:

[0070] Based on the preset intelligent strategy engine, the SDN technology is used to simulate the traffic data generated by the network attack.

[0071] The preset intelligent strategy engine is composed of a network attack chain, artificial intelligence technology, and a machine learning algorithm; the software defined network (SDN) technology is used to provide centralized traffic control and real-time traffic adjustment.

[0072] Optionally, after the preset intelligent strategy engine is used to simulate the traffic data generated by the network attack by using the SDN technology, a corresponding distributed attack knowledge base can be established to more efficiently and accurately evaluate the corresponding attack means, understand the behavior and motivation of the attack, and thus formulate more effective defense strategies in the future.

[0073] It can be understood that under the control of the SDN technology, according to the attack strategy generated by the intelligent strategy engine, simulated attack traffic can be injected into the network, and by controlling the network traffic path and attributes, simulation of multiple attack types can be achieved. This way, more comprehensive network traffic data can be provided for subsequent analysis.

[0074] S102, according to the preset network traffic threshold, threshold detection is performed on the traffic size in the network traffic data to obtain first abnormal traffic.

[0075] Optionally, the preset network traffic threshold can be adjusted according to historical network traffic data. That is, for different network traffic data, by analyzing based on historical network traffic data, the network traffic threshold of normal network behavior can be dynamically adjusted in real time to achieve the correctness and accuracy of abnormal traffic detection.

[0076] For example, for an e-commerce server, the preset network traffic threshold is 2000 requests per second during the day and 5000 requests per second during the evening peak on ordinary working days; but when a holiday or special date needs to be promoted, due to the sudden surge in normal user access, high traffic will be caused. If a fixed network traffic threshold (such as a fixed number of requests, traffic size) is used, it may cause a false judgment of normal access as abnormal traffic, thus triggering unnecessary alarms, so the network traffic threshold needs to be adjusted in real time, for example, the network traffic threshold is adjusted to 8000 requests per second to improve the correctness and accuracy of abnormal traffic detection.

[0077] It can be understood that by using the commonly used network flow threshold detection means, the abnormal flow corresponding to the known attack means, i.e., the first abnormal flow, can be quickly obtained.

[0078] In S103, the network flow data is clustered according to the flow size based on the DBSCAN algorithm, and at least one network flow corresponding to the boundary point and / or the isolated point after the clustering is obtained.

[0079] The density-based clustering (Density-Based Spatial Clustering of Applications with Noise, DBSCAN) algorithm is used to find clusters with arbitrary shapes from a data set and can effectively process boundary points and / or isolated points. The core idea of DBSCAN is to define clusters by "density", including core points (i.e., normal network flow), boundary points (network flow attached around the normal network flow, i.e., suspicious network flow), and isolated points (abnormal or outlier points, i.e., abnormal network flow).

[0080] In an implementable manner, before the network flow data is clustered according to the flow size, the number of flows in the network flow data also needs to be processed, specifically including:

[0081] If the number of flows in the network flow data is greater than a preset number, the flows in the network flow data are sampled according to a random sampling method to obtain sampled network flow data.

[0082] The number of flows in the sampled network flow data is less than the preset number.

[0083] Optionally, the number of flows in the network flow data is greater than the preset number, in order to reduce the amount of calculation, the network flow data can be analyzed by random sampling, for example, network flow data with a sampling ratio of 1000:1 is extracted to obtain sampled network flow data. Correspondingly, when the number of flows in the network flow data is less than the preset number, the network flow data is analyzed by full flow analysis, and the network flow data can also be stored and analyzed and detected by a database.

[0084] It should be noted that after the number of flows in the network flow data is processed, the sampled network flow data is clustered according to the flow size based on the DBSCAN algorithm.

[0085] It can be understood that by dividing the flow into normal flow, suspicious flow and abnormal flow based on the DBSCAN algorithm according to the density distribution, the suspicious flow and the abnormal flow can be further analyzed, and the attack flow corresponding to the unknown attack means can be quickly located.

[0086] S104, respectively, the feature data of the at least one network traffic and the feature data of the plurality of abnormal traffics pre-acquired are subjected to correlation analysis, and the traffic with a correlation greater than a preset value with any abnormal traffic is taken as a second abnormal traffic.

[0087] It can be understood that, by performing correlation analysis on the feature data corresponding to the at least one network traffic corresponding to the boundary points (i.e. suspicious traffics) and the isolated points (i.e. abnormal traffics) after clustering processing based on the DBSCAN algorithm, and the feature data of a plurality of abnormal traffics in the existing abnormal traffic feature database, the traffic with a correlation greater than a preset threshold is screened out as a second abnormal traffic. This way not only can discover abnormal traffics generated by unknown attack means, but also can improve the accuracy of detection results, reduce false positives and omissions through correlation screening.

[0088] S105, according to the first abnormal traffic and the second abnormal traffic, the network defense model is trained to obtain a trained network defense model.

[0089] The network defense model includes a breach and attack simulation (BAS) model and a classification and regression tree (CART) model; the network defense model includes a trained BAS model and a trained CART model.

[0090] Correspondingly, according to the first abnormal traffic and the second abnormal traffic, the BAS model and the CART model are trained respectively to obtain a trained BAS model and a trained CART model.

[0091] Specifically, first, the quintuple (source IP, target IP, protocol, source port, target port) and network behavior features (such as traffic size, session duration, packet rate, etc.) in the first abnormal traffic and the second abnormal traffic are extracted as input features of the network defense model; then, the BAS model uses the abnormal traffic (i.e. composed of the first abnormal traffic and the second abnormal traffic) features to construct an attack path, simulates multiple attack scenarios, and outputs corresponding defense means combining an eXtreme Language Understanding Transformer (eXtreme Language Understanding Transformer) model and big data technology, further the BAS model trains the model based on attack features and defense means effects to automatically generate new attack paths and update defense measures; finally, the attack path generated by the BAS model is input into the CART model to further refine attack classification and defense measures, and the attack risk value evaluated by the CART model is fed back to the BAS model to optimize the attack simulation accuracy.

[0092] In an implementable manner, after obtaining the trained network defense model, the network defense model needs to be further optimized, specifically including:

[0093] First, the network defense model is deployed to the network server for network attack detection and defense to obtain feedback data; then, the network defense model is optimized and trained according to the feedback data to obtain an optimized network defense model.

[0094] It can be understood that the network defense model after preliminary training is deployed to the network server to monitor and defend potential network attacks in real time, identify and analyze network traffic through the model, judge attack behavior and trigger defense measures to obtain feedback data; then, the feedback data and the original training data are merged to generate a training data set containing new features and unknown attack patterns, and the network defense model is optimized and trained using the new training data set to obtain an optimized network defense model. In this way, the detection and response capability of the network defense model to unknown attacks can be effectively enhanced, the network environment changes and new defense mechanisms are adapted to improve the success rate and effect of network defense.

[0095] The network attack data processing method provided by the embodiment of the application first acquires network traffic data of a preset network segment; then, according to a preset network traffic threshold, threshold detection is performed on the traffic size in the network traffic data to obtain first abnormal traffic, that is, through network traffic monitoring, if the current network traffic is greater than the preset network traffic threshold, the network traffic data is marked as first abnormal traffic; further, based on the DBSCAN algorithm, the network traffic data is clustered according to the traffic size to acquire at least one network traffic corresponding to a boundary point and / or an isolated point after clustering. In this way, further detection can be performed on the network traffic data on the basis of threshold detection to deeply mine hidden abnormal traffic data, thereby providing more comprehensive abnormal traffic data for the network defense model; then, the feature data of the at least one network traffic and the feature data of a plurality of abnormal traffics acquired in advance are respectively analyzed for correlation, and the traffic with a correlation greater than a preset value with any abnormal traffic is taken as second abnormal traffic. Through feature correlation comparison, not only known attack patterns can be captured, but also new attack traffic with similar features can be found; finally, the network defense model is trained according to the acquired first abnormal traffic and second abnormal traffic, which can enhance the recognition capability of the network defense model to multiple attack behaviors, thereby generating corresponding defense strategies to adapt to real-time changes of network abnormal behaviors and improve network defense efficiency.

[0096] Figure 2 The structure diagram of the network attack data processing device provided by the embodiment of the application is shown in the figure;Figure 2 As shown, the network attack data processing apparatus 20 provided by the embodiments of the present application comprises:

[0097] The acquisition module 201 is configured to acquire network traffic data of a preset network segment, wherein the network traffic data comprises a plurality of network traffics and feature data of each network traffic.

[0098] The detection module 202 is configured to perform threshold detection on the traffic size in the network traffic data according to a preset network traffic threshold to obtain first abnormal traffic.

[0099] The processing module 203 is configured to perform clustering processing on the network traffic data according to the traffic size based on a density-based clustering DBSCAN algorithm to acquire at least one network traffic corresponding to a boundary point and / or an isolated point after the clustering processing.

[0100] The analysis module 204 is configured to perform correlation analysis on the feature data of the at least one network traffic and feature data of a plurality of abnormal traffics acquired in advance, respectively, and take traffic with a correlation greater than a preset value with any abnormal traffic as second abnormal traffic.

[0101] The training module 205 is configured to train a network defense model according to the first abnormal traffic and the second abnormal traffic to obtain a trained network defense model.

[0102] In a possible implementation, the network traffic data comprises traffic data generated by simulating attacks on the network based on a preset intelligent strategy engine and using SDN technology.

[0103] In a possible implementation, before performing clustering processing on the network traffic data according to the traffic size based on the DBSCAN algorithm, the processing module 203 is further configured to:

[0104] If the number of traffics in the network traffic data is greater than a preset number, the processing module 203 is further configured to sample the traffics in the network traffic data according to a random sampling method to obtain sampled network traffic data, wherein the number of traffics in the sampled network traffic data is less than the preset number.

[0105] Correspondingly, the clustering processing on the network traffic data according to the traffic size based on the DBSCAN algorithm comprises:

[0106] The clustering processing on the sampled network traffic data according to the traffic size based on the DBSCAN algorithm.

[0107] In a possible implementation, the network defense model comprises a BAS model and a CART model.

[0108] Correspondingly, the network defense model is trained according to the first abnormal traffic and the second abnormal traffic, to obtain a trained network defense model, including:

[0109] The BAS model and the CART model are trained according to the first abnormal traffic and the second abnormal traffic, to obtain a trained BAS model and a trained CART model; and the network defense model includes the trained BAS model and the trained CART model.

[0110] In a possible implementation, the training module 205 is further configured to:

[0111] The network defense model is deployed to a network server for network attack detection and defense, to obtain feedback data.

[0112] The network defense model is trained according to the feedback data, to obtain an optimized network defense model.

[0113] In a possible implementation, the feature data of each network traffic includes the following features:

[0114] The traffic data packet size, protocol, traffic type, source IP address, target IP address, port, and network behavior feature;

[0115] The network behavior feature includes at least one of the connection number, session duration, and packet interval.

[0116] The network attack data processing apparatus provided in this embodiment can execute the method provided in the method embodiments, and has similar implementation principles and technical effects, which will not be described here again.

[0117] Figure 3 The electronic device provided in this application is shown in a structural schematic diagram. As shown in the figure, Figure 3 The electronic device 30 provided in this embodiment includes at least one processor 301 and a memory 302. Optionally, the device 30 further includes a communication component 303. The processor 301, the memory 302, and the communication component 303 are connected through a bus 304.

[0118] In the specific implementation process, the at least one processor 301 executes the computer execution instructions stored in the memory 302, so that the at least one processor 301 executes the above method.

[0119] The specific implementation process of the processor 301 can refer to the above method embodiments, and has similar implementation principles and technical effects, which will not be described here again.

[0120] In the above embodiments, it should be understood that the processor can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in combination with the application can be directly embodied as hardware processor execution, or executed by a combination of hardware and software modules in the processor.

[0121] The memory can include a random access memory (RAM), and can also include a non-volatile memory (NVM), such as at least one disk memory.

[0122] The bus can be an industry standard architecture (ISA) bus, a peripheral component (PCI) bus, or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application does not limit to only one bus or one type of bus.

[0123] The present application also provides a computer program product, comprising a computer program, which is executed by a processor to implement the above method.

[0124] The present application also provides a computer readable storage medium, which stores computer execution instructions, and when a processor executes the computer execution instructions, the above method is implemented.

[0125] The above readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0126] An example readable storage medium is coupled to the processor such that the processor can read information from the readable storage medium and can write information to the readable storage medium. Of course, the readable storage medium can also be a part of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the readable storage medium can also exist as discrete components in the device.

[0127] The division of units is only a logical functional division, and in actual implementation, there can be another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interfaces, devices or units, and can be electrical, mechanical or other forms.

[0128] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, can be located in one place, or can be distributed on a plurality of network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0129] In addition, the functional units in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit.

[0130] If the functions are realized in the form of software functional units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application or the part of the present application that essentially contributes to the prior art or the part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the embodiments of the present application. The foregoing storage medium includes a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various program code storage media.

[0131] Those skilled in the art can understand that all or part of the steps of the above-mentioned method embodiments can be completed by program instruction related hardware. The foregoing program can be stored in a computer readable storage medium. The program executes to perform the steps of the above-mentioned method embodiments; and the foregoing storage medium includes various media capable of storing program codes, such as ROM, RAM, magnetic disk, or optical disk.

[0132] Finally, it should be noted that other embodiments of the present application will readily occur to those skilled in the art upon consideration of the specification and practice of the present application disclosed herein. The present application is intended to include all such variations and modifications as fall within the scope of the present application, which is defined by the following claims, as well as the full scope of equivalents to which such claims are entitled. It is intended, therefore, that the present application be considered as including all possibilities falling within the scope of the application and their equivalents.

Claims

1. A method for processing network attack data, characterized in that, The method comprises the following steps: acquiring network traffic data of a preset network segment, wherein the network traffic data comprises a plurality of network traffics and feature data of each network traffic; performing threshold detection on the traffic size in the network traffic data according to a preset network traffic threshold to obtain first abnormal traffic; performing clustering processing on the network traffic data according to the traffic size based on a density-based clustering DBSCAN algorithm to obtain at least one network traffic corresponding to a boundary point and / or an isolated point after the clustering processing; performing correlation analysis on the feature data of the at least one network traffic and feature data of a plurality of abnormal traffics acquired in advance, and regarding a traffic with a correlation greater than a preset value with any abnormal traffic as second abnormal traffic; training a network defense model according to the first abnormal traffic and the second abnormal traffic to obtain a trained network defense model; the network defense model comprises a vulnerability and attack simulation BAS model and a classification decision CART model; correspondingly, the training of the network defense model according to the first abnormal traffic and the second abnormal traffic to obtain the trained network defense model comprises: training the BAS model and the CART model respectively according to the first abnormal traffic and the second abnormal traffic to obtain a trained BAS model and a trained CART model; and the network defense model comprises the trained BAS model and the trained CART model; the training of the BAS model and the CART model respectively according to the first abnormal traffic and the second abnormal traffic to obtain the trained BAS model and the trained CART model comprises: extracting a five-tuple and network behavior features in the first abnormal traffic and the second abnormal traffic as input features of the network defense model; the five-tuple comprises a source IP, a target IP, a protocol, a source port and a target port; constructing an attack path by using the BAS model, the first abnormal traffic and the second abnormal traffic to simulate a plurality of attack scenarios, and simultaneously outputting corresponding defense measures by combining a limit language understanding converter model of deep learning and big data technology; training a model to generate a new attack path based on the BAS model, attack features and defense measure effects, and updating the defense measures; inputting the attack path generated by the BAS model into the CART model to obtain an attack risk value; feeding back the attack risk value evaluated by the CART model to the BAS model to optimize attack simulation accuracy.

2. The method of claim 1, wherein, The network traffic data comprises traffic data generated by simulating attacks on the network based on a preset intelligent strategy engine and software defined network SDN technology.

3. The method of claim 1, wherein, Before the clustering processing of the network traffic data according to the traffic size based on the DBSCAN algorithm, the method further comprises the following steps: if the number of traffics in the network traffic data is greater than a preset number, sampling the traffics in the network traffic data according to a random sampling method to obtain sampled network traffic data, wherein the number of traffics in the sampled network traffic data is less than the preset number; Correspondingly, based on the DBSCAN algorithm, the network traffic data is clustered according to the traffic size, including: Based on the DBSCAN algorithm, the network traffic data is clustered according to the traffic size.

4. The method of claim 1, wherein, The method further comprises: Deploying the network defense model to a network server for network attack detection and defense to obtain feedback data; According to the feedback data, the network defense model is optimized and trained to obtain an optimized network defense model.

5. The method according to any one of claims 1 to 3, characterized in that, Each network traffic feature data includes the following features: Traffic packet size, protocol, traffic type, source IP address, target IP address, port and network behavior characteristics; Among them, the network behavior characteristics include at least one of the number of connections, session duration and packet interval.

6. A network attack data processing apparatus, characterized by, Including: An acquisition module for acquiring network traffic data of a preset network segment, the network traffic data including a plurality of network traffic and feature data of each network traffic; A detection module for threshold detection of traffic size in the network traffic data according to a preset network traffic threshold to obtain first abnormal traffic; A processing module for clustering the network traffic data according to the traffic size based on the density-based clustering DBSCAN algorithm to obtain at least one network traffic corresponding to the boundary point and / or isolated point after clustering processing; An analysis module for correlation analysis of the feature data of the at least one network traffic and the feature data of a plurality of abnormal traffic obtained in advance, and for taking the traffic with a correlation greater than a preset value with any abnormal traffic as second abnormal traffic; A training module for training a network defense model according to the first abnormal traffic and the second abnormal traffic to obtain a trained network defense model; The network defense model includes a vulnerability and attack simulation BAS model and a classification decision CART model; The training module is specifically configured to: Train the BAS model and the CART model according to the first abnormal traffic and the second abnormal traffic to obtain a trained BAS model and a trained CART model; the network defense model includes the trained BAS model and the trained CART model; The training module is also configured to: Extract the five-tuple and network behavior characteristics in the first abnormal traffic and the second abnormal traffic as input features of the network defense model; the five-tuple includes source IP, target IP, protocol, source port and target port; Use the BAS model, the first abnormal traffic and the second abnormal traffic to construct an attack path, simulate multiple attack scenarios, and output corresponding defense means by combining a deep learning limit language understanding converter model and big data technology; Based on the BAS model, attack features and defense means effect, train the model to generate a new attack path and update the defense measures; Use the attack path generated by the BAS model as the input of the CART model to obtain an attack risk value; The attack risk value evaluated by the CART model is fed back to the BAS model to optimize the attack simulation accuracy.

7. An electronic device, comprising: Including: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored by the memory, so that the processor executes the method according to any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are executed by the processor to implement the method according to any one of claims 1-5.

9. A computer program product, characterised in that, A computer program is included, and the computer program is executed by the processor to implement the method according to any one of claims 1-5.

Images