Risk assessment method and device and electronic equipment

Abstract

The invention discloses a risk assessment method and apparatus, and an electronic device. The method comprises the steps of obtaining a traffic log set and an event log set which are output by a to-be-analyzed system and last for N hours; calculating a flow event index and an abnormal request index corresponding to each source IP address according to the flow log set and the event log set; and determining a behavior risk index corresponding to each source IP address according to the traffic event index and the abnormal request index corresponding to each source IP address, and evaluating the risk of the corresponding source IP address according to the behavior risk index. Through the technical scheme provided by the embodiment of the invention, the risk assessment of the source IP address is realized, the uncertainty influence on the risk assessment caused by the data quality problem and the timeliness problem of the external intelligence data is effectively made up, and the effectiveness and the accuracy of the risk assessment result of the source IP address are effectively improved.

Description

Technical Field

[0001] The present application relates to the field of network and information security technology, and in particular to a risk assessment method, device and electronic equipment. Background Art

[0002] Internet Protocol (IP) addresses can be used to track and identify every device in a network. However, IP addresses can be forged or abused, which allows criminals to use forged or abused IP addresses to conduct a series of malicious activities, such as distributed denial of service (DDoS) attacks, spam sending, and malware propagation. In addition, legitimate IP addresses may also become part of a botnet due to infection and inadvertently participate in network attacks.

[0003] In order to protect network security, you can conduct a risk assessment on the source IP address to determine the potential threats of the source IP address and prevent potential threats in advance.

[0004] The current IP risk assessment method mainly uses relevant information of the source IP address, such as the location, associated contrast domain name, associated threat intelligence, etc., to conduct risk assessment on the source IP address.

[0005] However, the network environment is changing rapidly, and the cyber attack strategies and techniques of criminals are also constantly evolving, which makes the validity period of the relevant information of the source IP address uncertain, thereby making the above-mentioned IP risk assessment method based on the relevant information of the source IP address for risk assessment low in accuracy.

[0006] For example, after a normal source IP address is controlled by criminals, they can use the source IP address to carry out a series of malicious activities in a very short period of time. However, there is a lag in the update of the relevant information of the source IP address, resulting in the risk assessment results using the relevant information of the source IP address being inconsistent with the actual situation.

[0007] Moreover, the accuracy of the above IP risk assessment method also depends on the quality of the data source. However, the uneven quality of the data source also leads to the low accuracy of the IP risk assessment method.

[0008] For example, the data used for IP risk assessment comes from threat intelligence information from different vendors, but the threat intelligence information from different vendors may contain incomplete records or even erroneous data, which may lead to deviations in the risk assessment results of the source IP address.

[0009] Therefore, the above IP risk assessment method is affected by the timeliness and data quality of the relevant information of the source IP address, resulting in low accuracy of the risk assessment result of the source IP address. Summary of the invention

[0010] This application provides a risk assessment method, device and electronic device to improve the accuracy of IP risk assessment. The specific implementation scheme is as follows:

[0011] In a first aspect, the present application provides a risk assessment method, the method comprising:

[0012] Obtain a flow log set and an event log set output by the system to be analyzed for N hours; wherein the event log in the event log set is a log of an attack event; the flow log set and the event log set both include a source Internet Protocol IP address; N is a positive number;

[0013] According to the traffic log set and the event log set, a traffic event index and an abnormal request index corresponding to each source IP address are calculated; wherein the traffic event index is a parameter reflecting the correlation between traffic and attack events, and the abnormal request index is a parameter reflecting the correlation between traffic and abnormal requests;

[0014] According to the traffic event index and the abnormal request index corresponding to each source IP address, the behavior risk index corresponding to each source IP address is determined, and according to the behavior risk index, the risk of the corresponding source IP address is evaluated.

[0015] Through the above-mentioned application embodiment, the risk assessment analysis is performed using the traffic log set that lasts for N hours and the event log set that includes the log of the attack event output by the system to be analyzed. That is to say, the embodiment of the present application uses real-time source IP address data for analysis, that is, the analysis is performed based on real traffic and attack data, and then after the system to be analyzed outputs the log data, the risk assessment result of the corresponding source IP address will be obtained immediately at the latest N hours, thereby avoiding the problem of expiration of relevant information of the source IP address (such as traffic log data and event log data) and the quality problem of relevant information of the source IP address, thereby solving the timeliness and quality problems of the data, and making the risk assessment result of the source IP address more accurate.

[0016] Furthermore, the above-mentioned application embodiment utilizes the traffic log and event log data related to the source IP address, analyzes the correlation between traffic and events (such as attack events) (i.e., the traffic event index), and analyzes the correlation between traffic and abnormal requests (i.e., the abnormal request index), and then integrates the traffic event index with the abnormal request index, thereby achieving comprehensive consideration from the perspectives of both events (such as attack events) and abnormal requests, making the risk assessment results of the source IP address more credible and the risk assessment results more accurate.

[0017] In a possible implementation, calculating the traffic event index and the abnormal request index corresponding to each source IP address according to the traffic log set and the event log set includes:

[0018] Taking source IP address as a grouping condition, dividing the traffic logs in the traffic log set into a plurality of traffic log subsets, and dividing the event logs in the event log set into a plurality of event log subsets;

[0019] According to each of the traffic log subsets and each of the event log subsets, the traffic event proportion and traffic event relevance corresponding to the corresponding source IP address are calculated, and according to each of the event log subsets, the event type richness corresponding to the corresponding source IP address is calculated, and the traffic event proportion, the traffic event relevance, and the event type richness are integrated to obtain the traffic event index corresponding to the corresponding source IP address; and

[0020] According to each of the traffic log subsets, the abnormal request ratio, abnormal request relevance, and response code type richness corresponding to the corresponding source IP address are calculated, and the abnormal request ratio, abnormal request relevance, and response code type richness are integrated to obtain the abnormal request index corresponding to the corresponding source IP address.

[0021] Through the above-mentioned application embodiment, the traffic logs in the traffic log set and the event logs in the event log set are grouped based on the source IP address. This allows for better analysis of the data corresponding to the source IP address (such as the traffic log subset and the event log subset) in the future to obtain the corresponding behavior risk index.

[0022] Then, the traffic event index of the corresponding source IP address is obtained by combining the traffic event proportion, traffic event correlation and event type richness calculated by the traffic log subset and the event log subset, so as to comprehensively evaluate the IP attack behavior from the perspective of the distribution of attack events in the traffic, making the determination of the traffic event index more accurate.

[0023] At the same time, the abnormal request ratio, abnormal request relevance and response code type richness calculated from the traffic log subset are combined to obtain the abnormal request index of the corresponding source IP address, so as to comprehensively evaluate the IP attack behavior from the distribution perspective of abnormal requests in the traffic, making the determination of the abnormal request index more accurate. In addition, by comprehensively evaluating the IP attack behavior from the distribution perspective of attack events in the traffic and from the distribution perspective of abnormal requests in the traffic, the subsequent behavioral risk index of the source IP address is more accurate.

[0024] In a possible implementation, the calculating, according to each of the traffic log subsets and each of the event log subsets, a proportion of traffic events corresponding to a corresponding source IP address includes:

[0025] In each time window, determine the number of traffic logs in the traffic log subset corresponding to each source IP address, and the number of event logs in the corresponding event log subset; wherein the length of the time window is a preset duration;

[0026] The ratio of the sum of the number of event logs and the first preset value to the sum of the corresponding number of traffic logs and the first preset value is used as the proportion of sub-traffic events of the corresponding source IP address in the corresponding time window;

[0027] The average value of the proportions of the multiple sub-traffic events corresponding to each source IP address is taken as the corresponding proportion of the traffic event.

[0028] Through the above application embodiment, the proportion of sub-flow events of the corresponding source IP address is determined according to the sum of the number of event logs corresponding to the source IP address and the first preset value in each time window, and the proportion of the sum of the number of traffic logs and the first preset value, so that the distribution of attack events in the traffic can be learned according to the proportion of sub-flow events, so as to better understand IP behavior attacks. In addition, when calculating the ratio between the number of event logs and the number of traffic logs, the number of event logs and the number of traffic logs are both added with a first preset value, avoiding the situation where the denominator is 0, and ensuring that the number of event logs and the number of traffic logs can be increased at the same time, so that the calculated sub-flow event proportion is more accurate. Then, the average value between the proportion of sub-flow events in each time window is used to determine the proportion of traffic events corresponding to the corresponding source IP address, so that the final proportion of traffic events takes into account the influence of time on the proportion of traffic events, thereby further improving the accuracy of the proportion of traffic events, which helps to further improve the accuracy of the traffic event index obtained based on the proportion of traffic events.

[0029] In a possible implementation, the calculating, according to each of the traffic log subsets and each of the event log subsets, the traffic event correlation corresponding to the corresponding source IP address includes:

[0030] For each source IP address, according to the sub-traffic event proportions corresponding to each of the two adjacent time windows, calculate the change range of the event proportion corresponding to the corresponding time window; and calculate the average value between the multiple event proportion change ranges corresponding to each source IP address to obtain the average event proportion change range corresponding to the corresponding source IP address; and

[0031] Determine the maximum event percentage change for each source IP address;

[0032] The second preset value and the difference between the ratio of the average event proportion change amplitude to the maximum event proportion change amplitude are used as the traffic event correlation degree corresponding to the corresponding source IP address.

[0033] Through the above-mentioned application embodiment, combined with the sub-traffic event proportion, the change range of the event proportion is analyzed to obtain the corresponding traffic event correlation, so that the correlation between traffic and attack events can be learned based on the traffic event correlation, so as to better understand IP behavior attacks and make the traffic event correlation more accurate, which helps to make the traffic event index obtained based on the traffic event correlation more accurate.

[0034] In a possible implementation, calculating the event type richness corresponding to the corresponding source IP address according to each of the event log subsets includes:

[0035] For each source IP address, determine the total number of event logs and the number of logs corresponding to each event type identification code ID in the corresponding event log subset;

[0036] The richness of the event type corresponding to the corresponding source IP address is calculated based on the ratio of the sum of the number of logs corresponding to each event type ID and the third preset value to the sum of the total number of event logs and the third preset value.

[0037] Through the above application embodiment, the corresponding event type richness is calculated according to the sum of the number of logs corresponding to each determined event type ID and the third preset value, and the ratio of the total number of determined event logs to the sum of the third preset value, so that the event type in the traffic can be learned according to the event type richness, so as to better understand the IP behavior attack, and make the event type richness more accurate, which helps to make the traffic event index obtained based on the event type richness more accurate. In addition, when calculating the ratio between the number of logs corresponding to the event type ID and the total number of event logs, the number of logs corresponding to the event type ID and the total number of event logs are added with a third preset value, avoiding the situation where the denominator is 0, and ensuring that the number of logs corresponding to the event type ID and the total number of event logs can be increased at the same time, thereby further improving the accuracy of the event type richness.

[0038] In a possible implementation, the fusing of the traffic event proportion, the traffic event relevance, and the event type richness to obtain the traffic event index corresponding to the corresponding source IP address includes:

[0039] For each source IP address, the product of the square root of the product of the corresponding traffic event relevance and the event type richness and the corresponding traffic event proportion is taken as the traffic event index corresponding to the corresponding source IP address.

[0040] Through the above-mentioned application embodiments, combined with the correlation of traffic events, the richness of event types and the proportion of traffic events, the accuracy of the calculated traffic event index is further improved, which helps to further improve the accuracy of the behavioral risk index based on the traffic event index.

[0041] In a possible implementation, calculating the abnormal request ratio corresponding to the corresponding source IP address according to each of the traffic log subsets includes:

[0042] For each source IP address, in each time window, calculate the corresponding multiple abnormal response code request ratios, and perform weighted summation on the multiple abnormal response code request ratios to obtain the sub-abnormal request ratio of the corresponding source IP address in the corresponding time window; wherein the abnormal response code request ratio is obtained based on the number of abnormal traffic logs and the number of traffic logs; the abnormal traffic log is a traffic log in which the response code in the traffic log subset is an abnormal response code and the time is within the corresponding time window;

[0043] For each source IP address, the average value of the corresponding sub-abnormal request proportions in each of the time windows is taken as the abnormal request proportion corresponding to the corresponding source IP address.

[0044] Through the above application embodiment, based on the weighted sum of the proportions of multiple abnormal response code requests corresponding to the time window, the proportion of sub-abnormal requests of the corresponding source IP address in the corresponding time window is obtained, so that the distribution of abnormal response codes in the traffic log subset can be learned based on the proportion of sub-abnormal requests, so that the obtained proportion of sub-abnormal requests is more accurate. Then, based on the average value of the proportion of sub-abnormal requests corresponding to the source IP address in different time windows, the final proportion of abnormal requests corresponding to the source IP address is determined, so that the obtained abnormal request proportion takes into account the impact of time on the abnormal request proportion, thereby improving the accuracy of the abnormal request proportion, which helps to further improve the accuracy of the abnormal request index obtained based on the abnormal request proportion.

[0045] In a possible implementation, calculating the abnormal request correlation corresponding to the corresponding source IP address according to each of the traffic log subsets includes:

[0046] For each source IP address, according to the sub-abnormal request proportions corresponding to two adjacent time windows, calculate the change range of the abnormal request proportion corresponding to the corresponding time window; and calculate the average value between the multiple abnormal request proportion change ranges corresponding to each source IP address, to obtain the average abnormal request proportion change range corresponding to the corresponding source IP address; and

[0047] Determine the change in the maximum abnormal request ratio for each source IP address;

[0048] The fourth preset value and the difference between the ratio of the average abnormal request ratio change range and the maximum abnormal request ratio change range are used as the abnormal request correlation corresponding to the corresponding source IP address.

[0049] Through the above-mentioned application embodiment, combined with the sub-abnormal request ratio, the change range of the abnormal request ratio is analyzed to obtain the corresponding abnormal request correlation, so that the correlation of abnormal requests in the traffic can be learned based on the abnormal request correlation, so as to better understand the IP behavior attack and make the abnormal request correlation more accurate, which helps to make the abnormal request index obtained based on the abnormal request correlation more accurate.

[0050] In a possible implementation, calculating the richness of the response code type corresponding to the corresponding source IP address according to each of the traffic log subsets includes:

[0051] For each source IP address, determine the total number of traffic logs and the number of logs corresponding to each response code in the corresponding traffic log subset;

[0052] According to the ratio between the number of logs corresponding to each response code and the total number of traffic logs, the richness of the response code type corresponding to the corresponding source IP address is calculated.

[0053] Through the above-mentioned application embodiment, the corresponding response code type richness is calculated according to the ratio between the number of logs corresponding to each determined response code and the total number of determined traffic logs, so that the situation of the response code in the traffic can be learned according to the response code type richness, so as to better understand the IP behavior attack and make the response code type richness more accurate, which helps to make the abnormal request index obtained based on the response code type richness more accurate.

[0054] In a possible implementation, the integration of the abnormal request ratio, the abnormal request relevance, and the response code type richness to obtain the abnormal request index corresponding to the corresponding source IP address includes:

[0055] For each source IP address, the product of the square root of the product of the corresponding abnormal request relevance and the response code type richness and the corresponding abnormal request proportion is taken as the abnormal request index corresponding to the corresponding source IP address.

[0056] Through the above-mentioned application embodiments, combined with the abnormal request relevance, response code type richness and abnormal request ratio, the accuracy of the calculated abnormal request index is further improved, which helps to further improve the accuracy of the behavioral risk index based on the abnormal request index.

[0057] In a possible implementation, determining the behavior risk index corresponding to each source IP address according to the traffic event index and the abnormal request index corresponding to each source IP address includes:

[0058] Determine a target traffic event index weight and a target abnormal request index weight;

[0059] For each source IP address, the product of the corresponding traffic event index and the target traffic event index weight, and the sum of the product of the corresponding abnormal request index and the target abnormal request index weight are taken as the behavior risk index corresponding to the corresponding source IP address.

[0060] Through the above-mentioned application embodiment, the traffic event index and the abnormal request index are weighted and summed according to the determined target traffic event index weight and the target abnormal request index weight, so that the behavior risk index corresponding to the corresponding source IP address comprehensively considers the impact of the traffic event index and the abnormal request index on the IP risk, thereby making the behavior risk index of the source IP address more accurate.

[0061] In a possible implementation manner, determining a target traffic event index weight and a target abnormal request index weight includes:

[0062] Acquire training data; wherein the training data includes a plurality of historical traffic logs and a plurality of historical event logs;

[0063] Marking malicious behavior and normal behavior for each source IP address in the plurality of the historical traffic logs and the plurality of the historical event logs, and determining that the behavior risk index marking value corresponding to the source IP address marked as malicious behavior is a fifth preset value, and the behavior risk index marking value corresponding to the source IP address marked as normal behavior is a sixth preset value; and

[0064] Initializing the event index weight and the abnormal request index weight; calculating the historical behavior risk index corresponding to each source IP address in the plurality of historical traffic logs and the plurality of historical event logs according to the initialized event index weight and the abnormal request index weight;

[0065] According to the historical behavior risk index and the corresponding behavior risk index mark value corresponding to each source IP address in the multiple historical traffic logs and the multiple historical event logs, the event index weight and the abnormal request index weight are iteratively trained to obtain the target event index weight and the target abnormal request index weight.

[0066] Through the above-mentioned application embodiment, the target event index weight and the target abnormal request index weight are obtained according to the iterative training of the event index weight and the abnormal request index weight, so that the obtained target event index weight and the target abnormal request index weight are the optimal target event index weight and the target abnormal request index weight at the current stage, thereby making the behavioral risk index based on the target event index weight and the target abnormal request index weight more accurate, further improving the accuracy of the risk assessment of the source IP address.

[0067] In a second aspect, the present application further provides a risk assessment device, the device comprising:

[0068] An acquisition module, used to acquire a flow log set and an event log set output by the system to be analyzed for N hours; wherein the event logs in the event log set are logs of attack events; the flow log set and the event log set both include a source Internet Protocol IP address; N is a positive number;

[0069] A calculation module, used to calculate the flow event index and abnormal request index corresponding to each source IP address according to the flow log set and the event log set; wherein the flow event index is a parameter reflecting the correlation between flow and attack events, and the abnormal request index is a parameter reflecting the correlation between flow and abnormal requests;

[0070] The processing module is used to determine the behavior risk index corresponding to each source IP address according to the traffic event index and the abnormal request index corresponding to each source IP address, and evaluate the risk of the corresponding source IP address according to the behavior risk index.

[0071] In a possible implementation, the calculation module is specifically used to divide the traffic logs in the traffic log set into multiple traffic log subsets and divide the event logs in the event log set into multiple event log subsets based on the source IP address as a grouping condition; calculate the traffic event proportion and traffic event correlation corresponding to the corresponding source IP address according to each of the traffic log subsets and each of the event log subsets, and calculate the event type richness corresponding to the corresponding source IP address according to each of the event log subsets, and fuse the traffic event proportion, the traffic event correlation, and the event type richness to obtain the traffic event index corresponding to the corresponding source IP address; and calculate the abnormal request proportion, abnormal request correlation, and response code type richness corresponding to the corresponding source IP address according to each of the traffic log subsets, and fuse the abnormal request proportion, the abnormal request correlation, and the response code type richness to obtain the abnormal request index corresponding to the corresponding source IP address.

[0072] In a possible implementation, the calculation module is also used to determine the number of traffic logs in the traffic log subset corresponding to each source IP address and the number of event logs in the corresponding event log subset within each time window; wherein the length of the time window is a preset duration; the sum of the number of event logs and a first preset value and the ratio of the corresponding number of traffic logs to the sum of the first preset value are used as the sub-traffic event proportion of the corresponding source IP address within the corresponding time window; the average value of the multiple sub-traffic event proportions corresponding to each source IP address is used as the corresponding traffic event proportion.

[0073] In a possible implementation, the calculation module is also used to calculate, for each source IP address, the event proportion change range corresponding to the corresponding time window based on the sub-traffic event proportions corresponding to each of the two adjacent time windows; and calculate the average value between the multiple event proportion change ranges corresponding to each source IP address to obtain the average event proportion change range corresponding to the corresponding source IP address; and determine the maximum event proportion change range corresponding to each source IP address; and use the second preset value and the difference between the ratio of the average event proportion change range and the maximum event proportion change range as the traffic event correlation degree corresponding to the corresponding source IP address.

[0074] In a possible implementation, the calculation module is also used to determine, for each source IP address, in the corresponding event log subset, the total number of event logs and the number of logs corresponding to each event type identification code ID; and calculate the richness of the event type corresponding to the corresponding source IP address based on the ratio between the sum of the number of logs corresponding to each event type ID and a third preset value and the total number of event logs and the sum of the third preset value.

[0075] In a possible implementation, the calculation module is also used to, for each source IP address, take the product of the square root of the product of the corresponding traffic event relevance and the event type richness and the corresponding traffic event proportion as the traffic event index corresponding to the corresponding source IP address.

[0076] In a possible implementation, the calculation module is also used to calculate the corresponding proportions of multiple abnormal response code requests within each time window for each source IP address, and perform weighted summation on the multiple abnormal response code request proportions to obtain the sub-abnormal request proportion of the corresponding source IP address within the corresponding time window; wherein the abnormal response code request proportion is obtained based on the number of abnormal traffic logs and the number of traffic logs; the abnormal traffic log is a traffic log in which the response code in the traffic log subset is an abnormal response code and the time is within the corresponding time window; for each source IP address, the average value between the corresponding sub-abnormal request proportions within each time window is taken as the abnormal request proportion corresponding to the corresponding source IP address.

[0077] In a possible implementation, the calculation module is also used to calculate, for each source IP address, the change range of the abnormal request ratio corresponding to the corresponding time window according to the sub-abnormal request ratios corresponding to each of the two adjacent time windows; and calculate the average value between the multiple abnormal request ratio change ranges corresponding to each source IP address to obtain the average abnormal request ratio change range corresponding to the corresponding source IP address; and determine the maximum abnormal request ratio change range corresponding to each source IP address; and use the fourth preset value and the difference between the ratio of the average abnormal request ratio change range and the maximum abnormal request ratio change range as the abnormal request correlation corresponding to the corresponding source IP address.

[0078] In a possible implementation, the calculation module is also used to determine, for each source IP address, in the corresponding traffic log subset, the total number of traffic logs and the number of logs corresponding to each response code; and calculate the richness of the response code type corresponding to the corresponding source IP address based on the ratio between the number of logs corresponding to each response code and the total number of traffic logs.

[0079] In a possible implementation, the calculation module is also used to, for each source IP address, take the product of the square root of the product of the corresponding abnormal request relevance and the response code type richness and the corresponding abnormal request proportion as the abnormal request index corresponding to the corresponding source IP address.

[0080] In one possible implementation, the processing module is specifically used to determine the target traffic event index weight and the target abnormal request index weight; for each source IP address, the product of the corresponding traffic event index and the target traffic event index weight, and the sum of the corresponding abnormal request index and the target abnormal request index weight are used as the behavior risk index corresponding to the corresponding source IP address.

[0081] In one possible implementation, the processing module is also used to obtain training data; wherein the training data includes multiple historical traffic logs and multiple historical event logs; malicious behavior and normal behavior are marked for each source IP address in the multiple historical traffic logs and the multiple historical event logs, and the behavior risk index mark value corresponding to the source IP address marked as malicious behavior is determined to be a fifth preset value, and the behavior risk index mark value corresponding to the source IP address marked as normal behavior is determined to be a sixth preset value; and initialize event index weights and abnormal request index weights; according to the initialized event index weights and abnormal request index weights, calculate the historical behavior risk index corresponding to each source IP address in the multiple historical traffic logs and the multiple historical event logs; according to the historical behavior risk index corresponding to each source IP address in the multiple historical traffic logs and the multiple historical event logs and the corresponding behavior risk index mark value, iteratively train the event index weights and the abnormal request index weights to obtain the target event index weights and the target abnormal request index weights.

[0082] In a third aspect, the present application provides an electronic device, including:

[0083] Memory, used to store computer programs;

[0084] The processor is used to implement the above-mentioned risk assessment method steps when executing the computer program stored in the memory.

[0085] In a fourth aspect, the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the above-mentioned risk assessment method steps are implemented.

[0086] For each aspect from the second to the fourth aspect and the technical effects that may be achieved by each aspect, please refer to the above description of the technical effects that can be achieved by the first aspect or various possible schemes in the first aspect, and no further details will be given here. BRIEF DESCRIPTION OF THE DRAWINGS

[0087] Figure 1 A schematic diagram of a traditional IP risk assessment method provided in an embodiment of the present application;

[0088] Figure 2 A flow chart of a risk assessment method provided in an embodiment of the present application;

[0089] Figure 3 A schematic diagram of the processing process of the risk assessment method provided in an embodiment of the present application;

[0090] Figure 4A schematic diagram of a risk assessment device provided in an embodiment of the present application;

[0091] Figure 5 A schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0092] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The specific operating methods in the method embodiments can also be applied to device embodiments or system embodiments. It should be noted that in the description of the present application, "multiple" is understood as "at least two". "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A is connected to B, which can represent: A is directly connected to B and A is connected to B through C. In addition, in the description of the present application, words such as "first" and "second" are only used to distinguish the purpose of description, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying order.

[0093] The embodiments of the present application are described in detail below in conjunction with the accompanying drawings.

[0094] Traditional IP risk assessment methods include Figure 1 As shown. First, extract IP features based on the IP address information database and access logs, and then build a feature matrix based on the IP features. Then, determine the IP risk level (such as the risk level of the source IP address) through matrix calculation. Next, label the IP risk based on the IP risk level, so that the risk assessment of the source IP address can be achieved. That is, use the relevant information of the IP address to conduct risk assessment.

[0095] However, traditional IP risk assessment methods are affected by the timeliness and data quality of relevant information of the source IP address, resulting in low accuracy of the risk assessment results of the source IP address.

[0096] At present, World Wide Web (Web) applications are the main network exposure applications. Attacks on Web applications through Hypertext Transfer Protocol (HTTP) are the main attack method used by criminals. Most abnormal behaviors of criminals can be recorded in HTTP logs. Therefore, by analyzing the relevant HTTP log data, risk assessment of source IP addresses can be performed in real time and efficiently.

[0097] Therefore, the present application proposes a risk assessment method, which uses a set of traffic logs output by the system to be analyzed for N hours and an event log set including logs of attack events to calculate the traffic event index and abnormal request index corresponding to each source IP address, and then determines the behavior risk index corresponding to the corresponding source IP address based on the traffic event index and the abnormal request index, thereby evaluating the risk of the corresponding source IP address through the behavior risk index. In this way, the risk behavior of the source IP address is comprehensively considered from the perspectives of events (such as attack events) and abnormal requests, so that the credibility of the risk assessment results of the source IP address is higher and the risk assessment results are more accurate. In addition, a risk assessment analysis is performed using a set of traffic logs that last for N hours and an event log set that includes logs of attack events output by the system to be analyzed. That is, the embodiment of the present application uses real-time source IP address data for analysis, that is, the analysis is performed based on real traffic and attack data, and then after the system to be analyzed outputs the log data, the risk assessment result of the corresponding source IP address will be obtained immediately at the latest N hours, thereby avoiding the problem of expiration of relevant information of the source IP address (such as traffic log data and event log data) and the quality problem of relevant information of the source IP address, thereby solving the timeliness and quality problems of the data, and making the risk assessment result of the source IP address more accurate.

[0098] The risk assessment method proposed in the embodiment of the present application can be applied to full-flow security analysis systems, network intrusion detection systems, and other security systems that mainly support parsing HTTP protocol traffic to improve the accuracy and effectiveness of IP address threat intelligence extraction.

[0099] Reference Figure 2 The figure is a flow chart of a risk assessment method provided by an embodiment of the present application, the method comprising:

[0100] S201, obtaining a set of traffic logs output by the system to be analyzed for N hours and a set of event logs to be analyzed.

[0101] Wherein, N is a positive number.

[0102] S202, calculating the traffic event index and abnormal request index corresponding to each source IP address according to the traffic log set and the event log set.

[0103] S203, determining the behavior risk index corresponding to each source IP address according to the traffic event index and the abnormal request index corresponding to each source IP address, and evaluating the risk of the corresponding source IP address according to the behavior risk index.

[0104] In an embodiment of the present application, the traffic log in the traffic log set includes: session identification code (English: Identity Document, abbreviated as ID), time, source IP address, destination IP address, request uniform resource locator (English: Uniform Resource Locator, abbreviated as URL), request header, request body, response header, response body, response code and other field information.

[0105] The event logs in the above event log set include: session ID, time, source IP, destination IP, request URL, request header, request body, response header, response body, response code, event type ID, event level, event description and other information.

[0106] The above traffic log may be a Hypertext Transfer Protocol (English: Hypertext Transfer Protocol, abbreviated as HTTP) original traffic log. The above event log may be an HTTP attack event log.

[0107] Therefore, after the system to be analyzed outputs the traffic log, a detection tool will be used to detect whether the traffic log is an attack event. If so, the traffic log is saved as an event log, thereby obtaining an event log set.

[0108] The system to be analyzed may be a network traffic analysis device, but is not limited thereto.

[0109] After obtaining the traffic log set and the event log set, the traffic event index and the abnormal request index corresponding to each source IP address are calculated based on the traffic log set and the event log set.

[0110] Specifically, firstly, the traffic logs in the traffic log set are divided into a plurality of traffic log subsets, and the event logs in the event log set are divided into a plurality of event log subsets, based on the source IP address as a grouping condition. Thus, a traffic log subset and an event log subset corresponding to the source IP address can be determined.

[0111] The above-mentioned multiple traffic log subsets can be represented by {FlowSet(IP1), FlowSet(IP2), FlowSet(IP3)...}, where FlowSet(IP1) represents the traffic log included when the source IP address is IP1, that is, the traffic log subset corresponding to the source IP address is IP1.

[0112] The above multiple event log subsets can be represented by {EventSet(IP1), EventSet(IP2), EventSet(IP3)...}, wherein EventSet(IP1) represents the event log included when the source IP address is IP1, that is, the event log subset corresponding to the source IP address is IP1.

[0113] Then, according to each traffic log subset and each event log subset, the traffic event index and abnormal request index corresponding to the corresponding source IP address are calculated.

[0114] Taking a source IP address as an example, according to the traffic log subset and event log subset corresponding to the source IP address, the specific determination process of the traffic event index corresponding to the source IP address can be as follows:

[0115] According to the traffic log subset and event log subset corresponding to the source IP address, the traffic event proportion, traffic event correlation and event type richness corresponding to the source IP address are calculated, and then the traffic event proportion, traffic event correlation and event type richness are integrated to obtain the traffic event index corresponding to the source IP address, so that the traffic event index is more accurate.

[0116] The above traffic event ratio can be determined by the following calculation method:

[0117] First, in each time window, the number of traffic logs in the traffic log subset corresponding to the source IP address and the number of event logs in the corresponding event log subset are determined. The length of the time window is a preset time length, represented by Δt.

[0118] Since the duration of the traffic log subset is not greater than N, the traffic log subset can be divided into n time windows according to the time window. Where n = N / Δt. Assuming that the start time of the traffic log subset is t0, the sliding of the time window is based on t i =t i-1 +Δt. That is, the 0th time window is (t0, t0+Δt), and the 1st time window is (t0+Δt, t1+Δt).

[0119] The calculation method of the above traffic log quantity is as follows: take a time window as an example, such as (t0, t0+Δt), where t0 is the start time of the traffic log subset. In the (t0, t0+Δt) time window, in the traffic log subset corresponding to the source IP address, the session IDs of the traffic logs with a time in the (t0, t0+Δt) time window are deduplicated, and then the number of traffic logs in the (t0, t0+Δt) time window is determined based on the number of deduplicated session IDs.

[0120] Exemplarily, the traffic logs of the traffic log subset FlowSet(IP1) corresponding to IP1 in the time window (t0, t0+Δt) include: traffic log A, traffic log B, traffic log C, traffic log D, and traffic log E, and the session ID of traffic log A is 001, the session ID of traffic log B is 002, the session ID of traffic log C is 003, the session ID of traffic log D is 001, and the session ID of traffic log E is 001.

[0121] Since the session IDs of traffic log A, traffic log D, and traffic log E are all 001, it is determined that traffic log A, traffic log D, and traffic log E are the same traffic log. Therefore, based on deduplication of the three traffic logs, the deduplicated session IDs are 001, 002, and 003. Therefore, the number of traffic logs in the traffic log subset FlowSet(IP1) corresponding to IP1 in the time window (t0, t0+Δt) is 3.

[0122] The method for calculating the number of the above event logs is the same as the method for calculating the number of the above traffic logs, that is, in each time window, the session IDs in the event log subset corresponding to the source IP address are deduplicated, and then the number of event logs in the corresponding time window is determined based on the number of deduplicated session IDs.

[0123] Then, the sum of the number of event logs and the first preset value, and the ratio of the corresponding number of traffic logs and the sum of the first preset value, are used as the sub-traffic event proportion of the source IP address in the corresponding time window, so that the calculation of the sub-traffic event proportion is more accurate, so as to make the traffic event proportion based on the sub-traffic event proportion more accurate. This process can be expressed by the following formula:

[0124]

[0125] Among them, PE v represents the proportion of sub-flow events of the source IP address in the corresponding time window; CntEvent(IP) represents the number of event logs of the source IP address in the corresponding time window; CntFlow(IP) represents the number of flow logs of the source IP address in the corresponding time window; θ1 represents the first preset value. The first preset value can be 0.01.

[0126] In the embodiment of the present application, the sub-flow event ratio is greater than or equal to the seventh preset value and less than or equal to the eighth preset value, the seventh preset value may be 0, and the eighth preset value may be 1, that is, PE v ∈[0,1].

[0127] Through the above method, after calculating the proportion of sub-traffic events of the source IP address in each time window, the average value of the proportion of sub-traffic events corresponding to each time window is used as the proportion of traffic events corresponding to the corresponding source IP address, as shown in the following formula:

[0128]

[0129] Among them, PE represents the average value of the proportion of sub-flow events of the source IP address in each time window, and also represents the proportion of flow events corresponding to the source IP address; n represents the number of time windows; PE vi Indicates the proportion of sub-traffic events of the source IP address in the i-th time window.

[0130] The above traffic event correlation can be determined by the following calculation method:

[0131] For the source IP address, the change range of the event proportion corresponding to the corresponding time window is calculated according to the proportion of sub-traffic events corresponding to each of the two adjacent time windows.

[0132] In the embodiment of the present application, the event proportion change amplitude is the numerical change between the sub-flow event proportions of two adjacent time windows within a unit time.

[0133] Therefore, the above calculation of the change range of the event proportion corresponding to the corresponding time window according to the proportion of sub-traffic events corresponding to each of the two adjacent time windows can be obtained as follows:

[0134] Calculate the absolute value of the difference between the sub-traffic event proportions corresponding to two adjacent time windows, and use the ratio between the absolute value and the length of the time window as the event proportion change amplitude in the corresponding time window, so that the calculated event proportion change amplitude is more accurate, so that the traffic event correlation obtained based on the event ratio change amplitude is more accurate. The calculation process of the event proportion change amplitude can be shown as the following formula:

[0135]

[0136] Among them, ME represents the change in the proportion of events with source IP addresses between the i-1th time window and the i-th time window; PE v(i-1) Indicates the proportion of sub-flow events with source IP addresses in the i-1th time window.

[0137] Next, the average value of the change ranges of multiple event proportions corresponding to the source IP address is calculated to obtain the average change range of the event proportion corresponding to the source IP address, thereby combining the change ranges of the event proportions in each time window, which helps to further improve the accuracy of the correlation of traffic events. The calculation process of the average event proportion change range can be shown as follows:

[0138]

[0139] in, Indicates the change in the average event proportion corresponding to the source IP address.

[0140] At the same time, determine the maximum event proportion change corresponding to the source IP address.

[0141] Due to PE v The value range is: PE v ∈[0,1], then PE v The maximum value of PE is 1. v The minimum value of is 0, and the maximum value of the event proportion change range (that is, the maximum event proportion change range) is:

[0142]

[0143] Among them, max(ME) represents the change range of the maximum event proportion corresponding to the source IP address.

[0144] Further, the second preset value, the difference between the ratio of the average event proportion change amplitude corresponding to the same source IP address and the maximum event proportion change amplitude, is used as the flow event correlation corresponding to the corresponding source IP address. The second preset value can be 1. The process can be shown in the following formula:

[0145]

[0146] CE=1-ME norm

[0147] Among them, CE represents the correlation of the traffic event corresponding to the source IP address; ME norm It indicates the ratio of the average event proportion change corresponding to the source IP address to the maximum event proportion change, and also indicates the normalized average event proportion change; 1 indicates the second preset value.

[0148] The richness of the above event types can be determined in the following ways:

[0149] In the event log subset corresponding to the source IP address, the total number of event logs and the number of logs corresponding to each event type ID are determined.

[0150] In the embodiment of the present application, the specific method for determining the total number of event logs is consistent with the specific method for calculating the number of event logs mentioned above, and is determined based on the number of session IDs after deduplication, which will not be repeated here.

[0151] The above determination of the number of logs corresponding to each event type ID can be as follows: first, the event log subsets corresponding to the source IP address are grouped according to the event type ID, so that each event type ID corresponds to a sub-event log subset. Then, in the sub-event log subset corresponding to the event type ID, the number of logs in the sub-event log subset corresponding to the event type ID is determined according to the deduplicated session ID, thereby obtaining the number of logs corresponding to the event type ID.

[0152] Next, the event type richness corresponding to the corresponding source IP address is calculated based on the ratio between the sum of the number of logs corresponding to each event type ID and the third preset value and the sum of the total number of event logs and the third preset value.

[0153] Specifically, first calculate the ratio between the sum of the number of logs corresponding to each event type ID and the third preset value and the sum of the total number of event logs and the third preset value, then sum the squares of the comparison values, and use the difference between the ninth preset value and the summed value as the event type richness corresponding to the corresponding source IP address, so as to make the event type richness more accurate. The ninth preset value can be 1. The process can be shown in the following formula:

[0154]

[0155] Among them, KE represents the richness of event types corresponding to the source IP address; EventID j Indicates the event type ID in the event log subset corresponding to the source IP address; EventSet(IP) indicates the event log subset corresponding to the source IP address; Cnt(EventID j ) indicates that in the event log subset corresponding to the source IP address, the event type ID is equal to EventID j The number of logs, that is, EventID j The corresponding number of logs; SumCntEvent (IP) represents the total number of event logs in the event log subset corresponding to the source IP address; θ3 represents a third preset value, which may be 0.01, but is not limited thereto.

[0156] In the embodiment of the present application, the above-mentioned fusion of the traffic event proportion, the traffic event correlation and the event type richness to obtain the traffic event index corresponding to the source IP address may be:

[0157] The square root of the product of the traffic event relevance corresponding to the source IP address and the event type richness, and the product of the corresponding traffic event proportion, is used as the traffic event index corresponding to the source IP address, so that the determined traffic event index is more accurate. The process can be shown in the following formula:

[0158]

[0159] Among them, IE represents the flow event index corresponding to the source IP address. Therefore, the flow event index is a parameter that reflects the correlation between flow and attack events.

[0160] Taking a source IP address as an example, the specific process of determining the abnormal request index corresponding to the source IP address according to the traffic log subset corresponding to the source IP address can be as follows:

[0161] According to the traffic log subset corresponding to the source IP address, the abnormal request ratio, abnormal request relevance and response code type richness corresponding to the source IP address are calculated, and then the abnormal request ratio, abnormal request relevance and response code type richness are integrated to obtain the abnormal request index corresponding to the source IP address, thereby making the abnormal request index more accurate.

[0162] The above abnormal request ratio can be determined in the following ways:

[0163] First, in each time window, calculate the proportion of multiple abnormal response code requests corresponding to the source IP address, and perform weighted summation on the proportion of multiple abnormal response code requests to obtain the proportion of sub-abnormal requests of the source IP address in the corresponding time window. The length of this time window is consistent with the length of the time window in the aforementioned process of calculating the proportion of traffic events, and can be Δt.

[0164] In the embodiment of the present application, the multiple abnormal response code request proportions include a first abnormal response code request proportion, a second abnormal response code request proportion, a third abnormal response code request proportion, and a fourth abnormal response code request proportion.

[0165] Among them, the first abnormal response code request ratio is the request ratio corresponding to the first abnormal response code, and the first abnormal response code is a response code starting with 3, such as 301, 302, 303, 304, etc.

[0166] The second abnormal response code request ratio is the request ratio corresponding to the second abnormal response code. The second abnormal response code is a response code starting with 4, such as 401, 402, 403, 404, etc.

[0167] The third abnormal response code request ratio is the request ratio corresponding to the third abnormal response code. The third abnormal response code is a response code starting with 5, such as 501, 502, 503, 504, etc.

[0168] The fourth abnormal response code request ratio is the request ratio corresponding to the fourth abnormal response code. The fourth abnormal response code is an extended abnormal response code, such as 102, 104, etc. The extended response code can be adjusted according to the specific application.

[0169] The specific calculation process of the above-mentioned first abnormal response code request ratio can be as follows:

[0170] First, a first exception response code set is determined, which includes all first exception response codes, such as Code3Set{300, 301, 302...399}.

[0171] Then, from the traffic log subset corresponding to the source IP address, extract the traffic log whose time is within the corresponding time window and whose response code belongs to the first abnormal response code in the first abnormal response code set. This traffic log is the abnormal traffic log, and save the extracted traffic log (i.e., the abnormal traffic log) as the first abnormal response code traffic log set, such as FlowCode3Set(IP1).

[0172] Then calculate the number of logs in the first abnormal response code traffic log set (ie, the number of abnormal traffic logs). The calculation method of the number of logs is consistent with the calculation method of the aforementioned traffic log number, which will not be repeated here.

[0173] Next, the sum of the number of logs in the first abnormal response code traffic log set (i.e., the number of abnormal traffic logs corresponding to the first abnormal response code) and the tenth preset value, and the ratio between the number of traffic logs and the sum of the tenth preset value, are used as the first abnormal response code request ratio, so that the first abnormal response code request ratio is more accurate. This process can be shown in the following formula:

[0174]

[0175] Where Q1 represents the proportion of the first abnormal response code requests of the source IP address in the corresponding time window; CntFlowCode3(IP) represents the number of logs in the first abnormal response code flow log set (that is, the number of abnormal flow logs corresponding to the first abnormal response code); θ 10 Represents the tenth preset value, which may be 0.01.

[0176] In the embodiment of the present application, the calculation process of the second abnormal response code request ratio, the third abnormal response code request ratio and the fourth abnormal response code request ratio is consistent with the calculation process of the first abnormal response code request ratio, and will not be repeated here.

[0177] Among them, in the process of calculating the proportion of second abnormal response code requests, the determined second abnormal response code set includes all second abnormal response codes, such as Code4Set{400,401,402…499}. In the process of calculating the proportion of third abnormal response code requests, the determined third abnormal response code set includes all third abnormal response codes, such as Code5Set{500,501,502…599}. In the process of calculating the proportion of fourth abnormal response code requests, the determined fourth abnormal response code set includes all fourth abnormal response codes, such as CodeXSet{102,104…}.

[0178] The above weighted sum of the proportions of multiple abnormal response code requests is used to obtain the proportion of sub-abnormal requests with source IP addresses in the corresponding time window, which can be expressed as follows:

[0179] PC v =w1×Q1+w2×Q2+w3×Q3+w4×Q4

[0180] Among them, PC v It represents the proportion of sub-abnormal requests of the source IP address in the corresponding time window; Q2 represents the proportion of second abnormal response code requests of the source IP address in the corresponding time window; Q3 represents the proportion of third abnormal response code requests of the source IP address in the corresponding time window; Q4 represents the proportion of fourth abnormal response code requests of the source IP address in the corresponding time window; w1 represents the weight of the proportion of first abnormal response code requests, w1∈[0,1], and the default value is 0.15; w2 represents the weight of the proportion of second abnormal response code requests, w2∈[0,1], and the default value is 0.5; w3 represents the weight of the proportion of third abnormal response code requests, w3∈[0,1], and the default value is 0.3; w4 represents the weight of the proportion of fourth abnormal response code requests, w4∈[0,1], and the default value is 0.05.

[0181] The above weights w1, w2, w3, w4 can be adjusted according to the system conditions, but the sum of w1, w2, w3, w4 is 1, that is, w1+w2+w3+w4=1.

[0182] Through the above method, after calculating the proportion of sub-abnormal requests of the source IP address in each time window, the average value of the proportion of sub-abnormal requests corresponding to each time window is used as the proportion of abnormal requests corresponding to the corresponding source IP address, as shown in the following formula:

[0183]

[0184] Among them, PC represents the average value of the abnormal request proportion of the source IP address in each time window, and also represents the abnormal request proportion corresponding to the corresponding source IP address; PC vi Indicates the proportion of sub-abnormal requests corresponding to the corresponding source IP address in the i time window.

[0185] The relevance of the above abnormal requests can be determined in the following ways:

[0186] First, for the source IP address, the change range of the abnormal request ratio corresponding to the corresponding time window is calculated according to the sub-abnormal request ratios corresponding to the two adjacent time windows;

[0187] In the embodiment of the present application, the variation range of the abnormal request ratio is the numerical variation between the sub-abnormal request ratios of two adjacent time windows within a unit time.

[0188] Therefore, according to the above-mentioned sub-abnormal request proportions corresponding to the two adjacent time windows, the change range of the abnormal request proportion corresponding to the corresponding time window is calculated, which can be:

[0189] Calculate the absolute value of the difference between the sub-abnormal request proportions corresponding to two adjacent time windows, and use the ratio between the absolute value and the duration of the time window as the change range of the abnormal request proportion in the corresponding time window, so that the calculated change range of the abnormal request proportion is more accurate, so that the abnormal request relevance obtained based on the change range of the abnormal request proportion is more accurate. The calculation process of the change range of the abnormal request proportion can be shown as follows:

[0190]

[0191] Among them, MC represents the change in the proportion of abnormal requests of the corresponding source IP address between the i-1th time window and the i-th time window; PC v(i-1) Indicates the proportion of sub-abnormal requests with the corresponding source IP address in the i-1th time window.

[0192] Next, the average value of the change ranges of the proportion of abnormal requests corresponding to the source IP address is calculated to obtain the average change range of the proportion of abnormal requests corresponding to the corresponding source IP address, thereby combining the change range of the proportion of abnormal requests in each time window, which helps to further improve the accuracy of the correlation of abnormal requests. The calculation process of the average change range of the proportion of abnormal requests can be shown in the following formula:

[0193]

[0194] in, Indicates the change in the average proportion of abnormal requests corresponding to the source IP address.

[0195] At the same time, determine the change range of the maximum abnormal request ratio corresponding to the source IP address.

[0196] Since PC v The value range is: PC v ∈[0,1], then PC v The maximum value of PC is 1. v The minimum value of is 0, and the maximum value of the change in the abnormal request ratio (i.e. the maximum change in the abnormal request ratio) is:

[0197]

[0198] Among them, max(MC) represents the change range of the maximum abnormal request ratio corresponding to the source IP address.

[0199] Further, the fourth preset value, the difference between the ratio of the average abnormal request proportion change range corresponding to the same source IP address and the maximum abnormal request proportion change range, is used as the abnormal request correlation corresponding to the corresponding source IP address. The fourth preset value can be 1. The process can be shown in the following formula:

[0200]

[0201] CC=1-MC norm

[0202] Among them, CC represents the correlation of abnormal requests corresponding to the source IP address; MC norm It represents the ratio of the change in the average abnormal request ratio corresponding to the source IP address to the change in the maximum abnormal request ratio, and also represents the normalized change in the average abnormal request ratio; 1 represents the fourth preset value.

[0203] The richness of the above response code types can be determined in the following ways:

[0204] In the traffic log subset corresponding to the source IP address, determine the total number of traffic logs and the number of logs corresponding to each response code.

[0205] In the embodiment of the present application, the specific method for determining the total number of traffic logs is consistent with the specific method for calculating the number of traffic logs mentioned above, and is determined based on the number of deduplicated session IDs, which will not be repeated here.

[0206] The above determination of the number of logs corresponding to each response code can be: first, group the traffic log subsets corresponding to the source IP address according to the response code, so that each response code corresponds to a sub-traffic log subset. Then, in the sub-traffic log subset corresponding to the response code, the number of logs in the sub-traffic log subset corresponding to the response code is determined according to the deduplicated session ID, thereby obtaining the number of logs corresponding to the response code.

[0207] Next, based on the ratio between the number of logs corresponding to each response code and the total number of traffic logs, the richness of the response code type corresponding to the corresponding source IP address is calculated.

[0208] Specifically, first calculate the ratio between the number of logs corresponding to each response code and the total number of traffic logs, then sum the squares of the ratios, and use the eleventh preset value and the summed value as the richness of the response code type corresponding to the source IP address, so that the richness of the response code type is more accurate. The eleventh preset value can be 1. The process can be shown in the following formula:

[0209]

[0210] KC represents the richness of the response code types corresponding to the source IP address; code k Indicates the response code in the traffic log subset corresponding to the source IP address; all indicates all response codes; Cnt(code k ) indicates that in the traffic log subset corresponding to the source IP address, the response code is equal to code k The number of logs; SumCntFlow(IP) indicates the total number of flow logs in the flow log subset corresponding to the source IP address.

[0211] In the embodiment of the present application, the above-mentioned fusion of abnormal request proportion, abnormal request relevance and response code type richness to obtain the abnormal request index corresponding to the source IP address may be:

[0212] The product of the square root of the product of the abnormal request relevance corresponding to the source IP address and the response code type richness and the corresponding abnormal request ratio is taken as the abnormal request index corresponding to the corresponding source IP address, so that the determined abnormal request index is more accurate. The process can be shown in the following formula:

[0213]

[0214] Among them, IC represents the abnormal request index corresponding to the source IP address. Therefore, the abnormal request index is a parameter reflecting the correlation between traffic and abnormal requests, and the abnormal request is the traffic corresponding to the abnormal response code.

[0215] Therefore, the traffic event index and abnormal request index corresponding to each source IP address can be calculated in the above manner.

[0216] Furthermore, after calculating the traffic event index and the abnormal request index corresponding to each source IP address in step S202, the behavior risk index corresponding to the corresponding source IP address is determined based on the traffic event index and the abnormal request index.

[0217] Specifically, first determine the target traffic event index weight and the target abnormal request index weight. Then, for each source IP address, take the product of the corresponding traffic event index and the target traffic event index weight, and the product of the corresponding abnormal request index and the target abnormal request index weight as the behavior risk index corresponding to the corresponding source IP address, so that the behavior risk index of the source IP address considers both the impact of the traffic event index on the IP behavior risk and the impact of the abnormal request index on the IP behavior risk, thereby making the behavior risk index of the source IP address more accurate.

[0218] Taking the time period (t0, t0+N) as an example, the specific determination process of the behavior risk index corresponding to a source IP address in this process can be shown as follows:

[0219] RiskIndex(IP, t0) = ω E ×IE+ω C ×IC

[0220] Among them, RiskIndex(IP, t0) represents the behavior risk index of the source IP address in the time period (t0, t0+N); ω E Represents the target traffic event index weight; ω C Indicates the target abnormal request index weight.

[0221] In the embodiment of the present application, the determination of the above-mentioned target traffic event index weight and the target abnormal request index weight can be obtained through iterative training of the traffic event index weight and the abnormal request index weight.

[0222] Specifically, firstly, training data is obtained. The training data includes multiple historical traffic logs and multiple historical event logs. Then, malicious behavior and normal behavior are marked for each source IP address in the multiple historical traffic logs and multiple historical event logs.

[0223] In an embodiment of the present application, before marking malicious behavior and normal behavior for each source IP address in multiple historical traffic logs and multiple historical event logs, the multiple historical traffic logs and multiple historical event logs can be divided into historical traffic log sets and historical event log sets with a time length of N according to N. Then, malicious behavior and normal behavior are marked for each source IP address in the multiple historical traffic log sets and multiple historical event log sets. For example, the source IP address of normal behavior is marked as IP w , marking the source IP address of malicious behavior as IP b . Then the source IP address set of normal behavior is: {IP w1 , IP w2 , IP w3 , ...}, the source IP address set of malicious behavior is: IP b {IP b1 , IP b2 , IP b3 ,……}.

[0224] Next, determine that the behavior risk index value corresponding to the source IP address marked as malicious behavior is the fifth preset value, and the behavior risk index value corresponding to the source IP address marked as normal behavior is the sixth preset value. The fifth preset value can be 1, and the sixth preset value can be 0. That is, RiskIndex(IP b )=1,RiskIndex(IP b2 )=1,RiskIndex(IP b3 )=1,…….RiskIndex(IP w1 )=0,RiskIndex(IP w2 )=0,RiskIndex(IP w3 )=0,……。

[0225] Then, the event index weight and the abnormal request index weight are initialized. For example, the initial value of the event index weight is set to 0.5, and the initial value of the abnormal request index weight is set to 0.5.

[0226] Then, according to the initialized event index weight and abnormal request index weight, the historical behavior risk index corresponding to each source IP address in multiple historical traffic log sets and multiple historical event log sets is calculated.

[0227] The calculation process of the historical behavior risk index is consistent with the calculation process of the behavior risk index of the aforementioned source IP address in the time period (t0, t0+N). The specific calculation process of the historical traffic event index and the historical abnormal request index corresponding to the source IP address in the historical risk index calculation process is consistent with the specific calculation process of the traffic event index and the abnormal request index corresponding to the source IP address in the aforementioned step S202, and will not be repeated here.

[0228] Furthermore, according to the historical behavior risk index and the corresponding behavior risk index mark value corresponding to each source IP address in multiple historical traffic logs and multiple historical event logs (for example, if the source IP address is marked as malicious behavior, the behavior risk index mark value is 1, if the source IP address is marked as normal behavior, the behavior risk index mark value is 0), the event index weight and the abnormal request index weight are iteratively trained to obtain the target event index weight and the target abnormal request index weight.

[0229] However, it should be noted that during the training process of the event index weight and the abnormal request index weight, when the historical behavior risk index corresponding to the source IP address is calculated for the first time, ω E With ω C The initial event index weight and abnormal request index weight may be used for calculation, and then the event index weight and abnormal request index weight obtained during the training process may be used for calculation.

[0230] In an embodiment of the present application, the loss function in the iterative training process of the event index weight and the abnormal request index weight can adopt a cross entropy loss function, a mean square error loss function, etc., and the specific loss function can be selected according to the specific application scenario.

[0231] The iterative optimization algorithm in the iterative training process of the event index weight and the abnormal request index weight can adopt a gradient descent algorithm, a stochastic gradient descent algorithm, etc., and the specific iterative optimization algorithm can be selected according to the specific application scenario.

[0232] The above-mentioned historical behavior risk index can represent the predicted value calculated in the loss function, and the behavior risk index mark value (such as the fifth preset value and the sixth preset value) can represent the true value in the loss function.

[0233] Furthermore, after calculating the behavior risk index corresponding to each source IP address, the risk corresponding to the corresponding source IP address can be evaluated based on the behavior risk index.

[0234] Since the behavior risk index can indicate the degree of abnormality of the behavior of the source IP address within the time period to be analyzed (such as (t0, t0+N)), the larger the value of the behavior risk index, the more abnormal the behavior of the source IP address is and the higher the potential risk is.

[0235] Optionally, the behavior risk index is compared with a risk index threshold to classify the corresponding source IP address into risk levels.

[0236] Exemplarily, if it is determined that the behavior risk index is less than the first risk index threshold, the risk level of the corresponding IP address is determined to be low risk.

[0237] If it is determined that the behavior risk index is greater than or equal to the first risk index threshold and less than the second risk index threshold, the risk level of the corresponding IP address is determined to be medium risk.

[0238] If it is determined that the behavior risk index is greater than or equal to the second risk index threshold, the risk level of the corresponding IP address is determined to be high risk.

[0239] The first risk index threshold is lower than the second risk index threshold.

[0240] In addition, in an embodiment of the present application, if the duration of multiple traffic logs and multiple event logs output by the system to be analyzed is greater than N, the multiple traffic logs and multiple event logs are first divided into multiple traffic log sets and multiple event log sets with a time length of N (or not greater than N), so that the duration of each traffic log set and each event log set does not exceed N, so as to better solve the timeliness problem of the data. Then, for each traffic log set and each event log set, perform the above steps S201-S203 respectively to obtain the behavior risk index of the corresponding source IP address. Finally, take the maximum value of the behavior risk index of the same source IP address in the multiple traffic log sets and the multiple event log sets, and use the maximum value as the behavior risk index of the corresponding source IP address in the time period to be analyzed.

[0241] Exemplarily, the duration of the multiple traffic logs and multiple event logs output by the system to be analyzed is 3N. Then the multiple traffic logs and multiple event logs are divided into three traffic log sets and event log sets, the time in the first traffic log set and the first event log set are both within the time period (t0, t0+N); the time in the second traffic log set and the second event log set are both within the time period (t0+N, t0+2N); the time in the third traffic log set and the third event log set are both within the time period (t0+2N, t0+3N). Then for each traffic log set and each event log set, the behavioral risk index of each source IP address is obtained through the aforementioned steps S201-S203.

[0242] Among them, if the source IP address of IP1 exists in all three traffic log sets and event log sets, then the IP1 will calculate three behavior risk indexes, namely RiskIndex(IP1, t0), RiskIndex(IP1, t0+N), and RiskIndex(IP1, t0+2N). The maximum value of the three behavior risk indexes is used as the behavior risk index of the source IP1 address during the time period to be analyzed, so that the behavior risk index of the source IP1 address is more accurate, and the maximum value of multiple behavior risk indexes is selected to avoid false positives of IP1 behavior risks to the greatest extent, so as to improve network security.

[0243] However, it should be noted that in the aforementioned training process, after multiple historical traffic logs and multiple historical event logs are divided into historical traffic log sets and historical event log sets with a time length of N according to N, when the historical behavior risk index corresponding to each source IP address is calculated, the historical behavior risk index calculated in each time period (such as the (t0, t0+N) time period, (t0+N, t0+2N) time period) is a sample value corresponding to the corresponding source IP address, and it is necessary to input the iterative optimization algorithm to train the traffic event index weight and the abnormal request index weight. There is no need to take the maximum value of the historical behavior risk index corresponding to the same source IP address in multiple time periods (such as the (t0, t0+N) time period, (t0+N, t0+2N) time period).

[0244] In summary, the risk assessment method proposed in this application uses a traffic log set and an event log set (i.e., a log set of attack events) to calculate the proportion of events (i.e., attack events) in the traffic (i.e., the proportion of traffic events), and further analyzes the event proportion variable amplitude to obtain the traffic event correlation, and analyzes the event type richness in combination with the distribution of various events in the event log set, and then integrates the traffic event proportion, traffic event correlation, and event type richness to calculate the traffic event index corresponding to the corresponding source IP address, so that the traffic event index is more accurate, and realizes the comprehensive evaluation of IP attack behavior from the distribution perspective of attack events in the traffic.

[0245] In addition, the traffic log collection is used to analyze the proportion of abnormal response codes in the traffic from the source IP address (i.e., the abnormal request proportion), and the changing trend of the abnormal response codes (i.e., the change range of the abnormal request proportion) is further analyzed to obtain the abnormal request relevance, and the distribution of various response codes in the traffic log collection is further analyzed to obtain the response code type richness, and then the abnormal request proportion, abnormal request relevance, and response code type richness are integrated to calculate the abnormal request index corresponding to the corresponding source IP address, so that the abnormal request index is more accurate, and a comprehensive evaluation of IP attack behavior is achieved from the distribution angle of abnormal requests in the traffic.

[0246] The calculated traffic event index and abnormal request index are combined to calculate the behavioral risk index corresponding to the corresponding source IP address, so as to comprehensively evaluate the IP attack behavior from the perspective of the distribution of abnormal requests in the traffic and calculate the corresponding behavioral risk index, making the behavioral risk index more accurate.

[0247] In addition, the embodiment of the present application utilizes a set of traffic logs lasting N hours and an event log set including logs of attack events output by the system to be analyzed to perform risk assessment analysis, thereby avoiding the problem of expiration of relevant information of the source IP address (such as traffic log data and event log data) and the quality problem of relevant information of the source IP address, thereby solving the timeliness and quality problems of the data, and making the risk assessment results of the source IP address more accurate.

[0248] In addition, in an embodiment of the present application, based on the above steps S201-S203, an IP behavior risk model can be constructed, which includes a traffic event analysis module that calculates the traffic event index corresponding to the source IP address using the method in the above step S202, an abnormal request analysis module that calculates the abnormal request index corresponding to the source IP address, and a fusion module that fuses the traffic event index and the abnormal request index in the above step S203.

[0249] like Figure 3 As shown, the IP behavior risk model includes an abnormal request analysis module, a traffic event analysis module, and a fusion module.

[0250] First, in the data preprocessing module, multiple historical HTTP original traffic logs and multiple historical HTTP attack event logs in the training data are divided into multiple historical HTTP original traffic log sets and historical HTTP attack event log sets, each of which has a time length of N (or not greater than N). Then, for each historical HTTP original traffic log set and each historical HTTP attack event log set, the subsequent steps are performed.

[0251] According to the source IP address, the historical HTTP original traffic log set and the historical HTTP attack event log set are grouped to obtain multiple historical HTTP original traffic log subsets and multiple historical HTTP attack event log subsets.

[0252] Furthermore, in the training preprocessing module, each source IP address in multiple historical HTTP original traffic log subsets and multiple historical HTTP attack event log subsets is marked as malicious behavior or normal behavior. The behavior risk index mark value corresponding to the source IP address marked as malicious behavior is determined to be 1, and the behavior risk index mark value corresponding to the source IP address marked as normal behavior is determined to be 0. In addition, the event index weight and the abnormal request index weight are initialized, and both the event index weight and the abnormal request index weight are initialized to 0.5.

[0253] Then, in the abnormal request analysis module, for each source IP address, according to the corresponding historical HTTP original traffic log subset, the corresponding abnormal request proportion, abnormal request relevance and response code type richness are analyzed and calculated, and then the abnormal request proportion, abnormal request relevance and response code richness are integrated to obtain the abnormal request index corresponding to the corresponding source IP address.

[0254] At the same time, in the traffic event analysis module, for each source IP address, the corresponding traffic event proportion, traffic event correlation and event type richness are analyzed and calculated according to the corresponding historical HTTP original traffic log subset and the historical HTTP attack event log subset. The traffic event proportion, traffic event correlation and event type richness are then fused to obtain the traffic event index corresponding to the corresponding source IP address.

[0255] Next, in the fusion module, the corresponding historical behavior risk index is calculated based on the traffic event index and abnormal request index corresponding to each source IP address, as well as the event index weight and abnormal request index weight.

[0256] Then in the training module, the event index weight and the abnormal request index weight are iteratively trained according to the historical behavior risk index and the behavior risk index mark value to obtain the target event index weight and the target abnormal request index weight, thereby realizing the training of the IP behavior risk model. The trained model is the target IP behavior risk model.

[0257] Finally, in the evaluation module, for the logs to be analyzed of the system to be analyzed (such as the HTTP original traffic logs and HTTP attack event logs to be analyzed), the logs to be analyzed are preprocessed by the data preprocessing module to obtain multiple HTTP original traffic log subsets and HTTP attack event log subsets. Then, the multiple HTTP original traffic log subsets and multiple HTTP attack event log subsets are input into the target IP behavior risk model, and the multiple HTTP original traffic log subsets and multiple HTTP attack event log subsets are processed by the abnormal request analysis module, the traffic event analysis module and the fusion module in the target IP behavior risk model to obtain the behavior risk index corresponding to each source IP address, so that the risk assessment of the source IP address can be achieved through the behavior risk index.

[0258] Through the above method, the traffic log data and event log data related to the source IP address are used to construct an IP behavior risk model by analyzing the correlation between traffic and events (such as the traffic event index) and abnormal requests (such as the abnormal request index) in the source IP address, realizing real-time evaluation of the source IP address, enhancing the adaptability of the IP behavior risk model to different system environments, and effectively compensating for the uncertainty of the risk assessment model caused by data quality and timeliness problems in external intelligence data, thereby avoiding the interference of quality problems of external intelligence data sources on the model, improving the versatility and accuracy of the IP behavior assessment model, and then effectively improving the effectiveness of the risk assessment results of the source IP address, providing a data basis for IP to build a high-quality threat intelligence library.

[0259] Based on the same inventive concept, a risk assessment device is also provided in the embodiment of the present application, such as Figure 4 The figure shows a schematic diagram of the structure of a risk assessment device provided by the present application, the device comprising:

[0260] The acquisition module 401 is used to acquire a flow log set and an event log set output by the system to be analyzed for N hours; wherein the event log in the event log set is a log of an attack event; the flow log set and the event log set both include a source Internet Protocol IP address; N is a positive number;

[0261] The calculation module 402 is used to calculate the flow event index and the abnormal request index corresponding to each source IP address according to the flow log set and the event log set; wherein the flow event index is a parameter reflecting the correlation between the flow and the attack event, and the abnormal request index is a parameter reflecting the correlation between the flow and the abnormal request;

[0262] Processing module 403 is used to determine the behavior risk index corresponding to each source IP address according to the traffic event index and the abnormal request index corresponding to each source IP address, and evaluate the risk of the corresponding source IP address according to the behavior risk index.

[0263] In one possible implementation, the calculation module 402 is specifically used to divide the traffic logs in the traffic log set into multiple traffic log subsets and divide the event logs in the event log set into multiple event log subsets based on the source IP address as a grouping condition; calculate the traffic event proportion and traffic event correlation corresponding to the corresponding source IP address according to each of the traffic log subsets and each of the event log subsets, and calculate the event type richness corresponding to the corresponding source IP address according to each of the event log subsets, and fuse the traffic event proportion, the traffic event correlation, and the event type richness to obtain the traffic event index corresponding to the corresponding source IP address; and calculate the abnormal request proportion, abnormal request correlation, and response code type richness corresponding to the corresponding source IP address according to each of the traffic log subsets, and fuse the abnormal request proportion, the abnormal request correlation, and the response code type richness to obtain the abnormal request index corresponding to the corresponding source IP address.

[0264] In one possible implementation, the calculation module 402 is also used to determine, within each time window, the number of traffic logs in the traffic log subset corresponding to each source IP address, and the number of event logs in the corresponding event log subset; wherein the length of the time window is a preset duration; the sum of the number of event logs and a first preset value, and the ratio of the corresponding number of traffic logs to the sum of the first preset value, are used as the sub-traffic event proportion of the corresponding source IP address within the corresponding time window; the average value of the multiple sub-traffic event proportions corresponding to each source IP address is used as the corresponding traffic event proportion.

[0265] In one possible implementation, the calculation module 402 is also used to calculate, for each source IP address, the event proportion change range corresponding to the corresponding time window based on the sub-traffic event proportions corresponding to each of the two adjacent time windows; and calculate the average value between the multiple event proportion change ranges corresponding to each source IP address to obtain the average event proportion change range corresponding to the corresponding source IP address; and determine the maximum event proportion change range corresponding to each source IP address; and use the second preset value and the difference between the ratio of the average event proportion change range and the maximum event proportion change range as the traffic event correlation degree corresponding to the corresponding source IP address.

[0266] In one possible implementation, the calculation module 402 is also used to determine, for each source IP address, in the corresponding event log subset, the total number of event logs and the number of logs corresponding to each event type identification code ID; based on the ratio between the sum of the number of logs corresponding to each event type ID and a third preset value and the total number of event logs and the sum of the third preset value, calculate the richness of the event type corresponding to the corresponding source IP address.

[0267] In a possible implementation, the calculation module 402 is also used to, for each source IP address, take the product of the square root of the product of the corresponding traffic event relevance and the event type richness and the corresponding traffic event proportion as the traffic event index corresponding to the corresponding source IP address.

[0268] In a possible implementation, the calculation module 402 is also used to calculate the corresponding proportions of multiple abnormal response code requests within each time window for each source IP address, and perform weighted summation on the multiple abnormal response code request proportions to obtain the sub-abnormal request proportion of the corresponding source IP address within the corresponding time window; wherein the abnormal response code request proportion is obtained based on the number of abnormal traffic logs and the number of traffic logs; the abnormal traffic log is a traffic log in which the response code in the traffic log subset is an abnormal response code and the time is within the corresponding time window; for each source IP address, the average value between the corresponding sub-abnormal request proportions within each time window is taken as the abnormal request proportion corresponding to the corresponding source IP address.

[0269] In one possible implementation, the calculation module 402 is also used to calculate, for each source IP address, the change range of the abnormal request ratio corresponding to the corresponding time window according to the sub-abnormal request ratios corresponding to each of the two adjacent time windows; and calculate the average value between the multiple abnormal request ratio change ranges corresponding to each source IP address to obtain the average abnormal request ratio change range corresponding to the corresponding source IP address; and determine the maximum abnormal request ratio change range corresponding to each source IP address; and use the fourth preset value and the difference between the ratio of the average abnormal request ratio change range and the maximum abnormal request ratio change range as the abnormal request correlation corresponding to the corresponding source IP address.

[0270] In a possible implementation, the calculation module 402 is also used to determine, for each source IP address, in the corresponding traffic log subset, the total number of traffic logs and the number of logs corresponding to each response code; and calculate the richness of the response code type corresponding to the corresponding source IP address based on the ratio between the number of logs corresponding to each response code and the total number of traffic logs.

[0271] In a possible implementation, the calculation module 402 is also used to, for each source IP address, take the product of the square root of the product of the corresponding abnormal request relevance and the response code type richness and the corresponding abnormal request proportion as the abnormal request index corresponding to the corresponding source IP address.

[0272] In one possible implementation, processing module 403 is specifically used to determine the target traffic event index weight and the target abnormal request index weight; for each source IP address, the product of the corresponding traffic event index and the target traffic event index weight, and the product of the corresponding abnormal request index and the target abnormal request index weight are summed as the behavior risk index corresponding to the corresponding source IP address.

[0273] In one possible implementation, the processing module 403 is also used to obtain training data; wherein the training data includes multiple historical traffic logs and multiple historical event logs; malicious behavior and normal behavior are marked for each source IP address in the multiple historical traffic logs and the multiple historical event logs, and the behavior risk index mark value corresponding to the source IP address marked as the malicious behavior is determined to be a fifth preset value, and the behavior risk index mark value corresponding to the source IP address marked as the normal behavior is determined to be a sixth preset value; and initialize event index weights and abnormal request index weights; according to the initialized event index weights and abnormal request index weights, calculate the historical behavior risk index corresponding to each source IP address in the multiple historical traffic logs and the multiple historical event logs; according to the historical behavior risk index corresponding to each source IP address in the multiple historical traffic logs and the multiple historical event logs and the corresponding behavior risk index mark value, iteratively train the event index weights and the abnormal request index weights to obtain the target event index weights and the target abnormal request index weights.

[0274] Based on the same inventive concept, an electronic device is also provided in the embodiment of the present application. The electronic device can realize the functions of the risk assessment device. Figure 5 , the electronic equipment includes:

[0275] At least one processor 501, and a memory 502 connected to the at least one processor 501. The specific connection medium between the processor 501 and the memory 502 is not limited in the embodiment of the present application. Figure 5 In the example, the processor 501 and the memory 502 are connected via a bus 500. The bus 500 is Figure 5 The connections between other components are shown in bold lines, and are not intended to be limiting. The bus 500 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 501 can also be called a controller, and there is no limitation on the name.

[0276] In the embodiment of the present application, the memory 502 stores instructions that can be executed by at least one processor 501. The at least one processor 501 can execute the risk assessment method discussed above by executing the instructions stored in the memory 502. The processor 501 can implement Figure 4 The functions of each module in the device shown.

[0277] Among them, the processor 501 is the control center of the device, and can use various interfaces and lines to connect the various parts of the entire control device. By running or executing instructions stored in the memory 502 and calling data stored in the memory 502, the various functions of the device and processing data, the device can be monitored as a whole.

[0278] In one possible design, the processor 501 may include one or more processing units, and the processor 501 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 501. In some embodiments, the processor 501 and the memory 502 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.

[0279] Processor 501 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the risk assessment method disclosed in the embodiments of the present application can be directly embodied as a hardware processor, or can be executed by a combination of hardware and software modules in the processor.

[0280] The memory 502 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 502 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (English: Random Access Memory, abbreviated as RAM), a static random access memory (English: Static Random Access Memory, abbreviated as SRAM), a programmable read-only memory (English: Programmable Read Only Memory, abbreviated as PROM), a read-only memory (English: Read Only Memory, abbreviated as ROM), an electrically erasable programmable read-only memory (English: Electrically Erasable Programmable Read-Only Memory, abbreviated as EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 502 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 502 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0281] By programming the processor 501, the code corresponding to the risk assessment method described in the above embodiment can be fixed into the chip, so that the chip can execute the code when running. Figure 2 The steps of the risk assessment method of the embodiment shown are as follows: How to design and program the processor 501 is a technique known to those skilled in the art and will not be described in detail here.

[0282] Based on the same inventive concept, an embodiment of the present application further provides a storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes the risk assessment method discussed above.

[0283] In some possible implementations, various aspects of the risk assessment method provided by the present application may also be implemented in the form of a program product, which includes a program code. When the program product is run on an apparatus, the program code is used to enable the control device to execute the steps of the risk assessment method according to various exemplary embodiments of the present application described above in this specification.

[0284] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0285] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0286] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0287] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0288] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A risk assessment method, characterized in that: include: Obtain a flow log set and an event log set output by the system to be analyzed for N hours; wherein the event log in the event log set is a log of an attack event; the flow log set and the event log set both include a source Internet Protocol IP address; N is a positive number; According to the traffic log set and the event log set, a traffic event index and an abnormal request index corresponding to each source IP address are calculated; wherein the traffic event index is a parameter reflecting the correlation between traffic and attack events, and the abnormal request index is a parameter reflecting the correlation between traffic and abnormal requests; According to the traffic event index and the abnormal request index corresponding to each source IP address, the behavior risk index corresponding to each source IP address is determined, and according to the behavior risk index, the risk of the corresponding source IP address is evaluated.

2. The method according to claim 1, characterized in that The calculating, according to the traffic log set and the event log set, the traffic event index and the abnormal request index corresponding to each source IP address respectively includes: Taking source IP address as a grouping condition, dividing the traffic logs in the traffic log set into a plurality of traffic log subsets, and dividing the event logs in the event log set into a plurality of event log subsets; According to each of the traffic log subsets and each of the event log subsets, the traffic event proportion and traffic event relevance corresponding to the corresponding source IP address are calculated, and according to each of the event log subsets, the event type richness corresponding to the corresponding source IP address is calculated, and the traffic event proportion, the traffic event relevance, and the event type richness are integrated to obtain the traffic event index corresponding to the corresponding source IP address; and According to each of the traffic log subsets, the abnormal request ratio, abnormal request relevance, and response code type richness corresponding to the corresponding source IP address are calculated, and the abnormal request ratio, abnormal request relevance, and response code type richness are integrated to obtain the abnormal request index corresponding to the corresponding source IP address.

3. The method according to claim 2, characterized in that The calculating, according to each of the traffic log subsets and each of the event log subsets, a proportion of traffic events corresponding to a corresponding source IP address includes: In each time window, determine the number of traffic logs in the traffic log subset corresponding to each source IP address, and the number of event logs in the corresponding event log subset; wherein the length of the time window is a preset duration; The ratio of the sum of the number of event logs and the first preset value to the sum of the corresponding number of traffic logs and the first preset value is used as the proportion of sub-traffic events of the corresponding source IP address in the corresponding time window; The average value of the proportions of the multiple sub-traffic events corresponding to each source IP address is taken as the corresponding proportion of the traffic event.

4. The method according to claim 2, characterized in that The calculating, according to each of the traffic log subsets and each of the event log subsets, the traffic event correlation corresponding to the corresponding source IP address comprises: For each source IP address, according to the sub-traffic event proportions corresponding to each of the two adjacent time windows, calculate the change range of the event proportion corresponding to the corresponding time window; and calculate the average value between the multiple event proportion change ranges corresponding to each source IP address to obtain the average event proportion change range corresponding to the corresponding source IP address; and Determine the maximum event percentage change for each source IP address; The second preset value and the difference between the ratio of the average event proportion change amplitude to the maximum event proportion change amplitude are used as the traffic event correlation degree corresponding to the corresponding source IP address.

5. The method according to claim 2, characterized in that The calculating, according to each of the event log subsets, the event type richness corresponding to the corresponding source IP address includes: For each source IP address, determine the total number of event logs and the number of logs corresponding to each event type identification code ID in the corresponding event log subset; The richness of the event type corresponding to the corresponding source IP address is calculated based on the ratio of the sum of the number of logs corresponding to each event type ID and the third preset value to the sum of the total number of event logs and the third preset value.

6. The method according to claim 2, characterized in that The fusing of the traffic event proportion, the traffic event relevance, and the event type richness to obtain the traffic event index corresponding to the corresponding source IP address includes: For each source IP address, the product of the square root of the product of the corresponding traffic event relevance and the event type richness and the corresponding traffic event proportion is taken as the traffic event index corresponding to the corresponding source IP address.

7. The method according to claim 2, characterized in that The calculating, according to each of the traffic log subsets, a proportion of abnormal requests corresponding to a corresponding source IP address includes: For each source IP address, in each time window, calculate the corresponding multiple abnormal response code request ratios, and perform weighted summation on the multiple abnormal response code request ratios to obtain the sub-abnormal request ratio of the corresponding source IP address in the corresponding time window; wherein the abnormal response code request ratio is obtained based on the number of abnormal traffic logs and the number of traffic logs; the abnormal traffic log is a traffic log in which the response code in the traffic log subset is an abnormal response code and the time is within the corresponding time window; For each source IP address, the average value of the corresponding sub-abnormal request proportions in each of the time windows is taken as the abnormal request proportion corresponding to the corresponding source IP address.

8. The method according to claim 2, characterized in that The calculating, according to each of the traffic log subsets, the abnormal request correlation corresponding to the corresponding source IP address includes: For each source IP address, according to the sub-abnormal request proportions corresponding to two adjacent time windows, calculate the change range of the abnormal request proportion corresponding to the corresponding time window; and calculate the average value between the multiple abnormal request proportion change ranges corresponding to each source IP address, to obtain the average abnormal request proportion change range corresponding to the corresponding source IP address; and Determine the change in the maximum abnormal request ratio for each source IP address; The fourth preset value and the difference between the ratio of the average abnormal request ratio change range and the maximum abnormal request ratio change range are used as the abnormal request correlation corresponding to the corresponding source IP address.

9. The method according to claim 2, characterized in that The calculating, according to each of the traffic log subsets, the richness of the response code type corresponding to the corresponding source IP address includes: For each source IP address, determine the total number of traffic logs and the number of logs corresponding to each response code in the corresponding traffic log subset; According to the ratio between the number of logs corresponding to each response code and the total number of traffic logs, the richness of the response code type corresponding to the corresponding source IP address is calculated.

10. The method according to claim 2, characterized in that The integration of the abnormal request ratio, the abnormal request relevance, and the response code type richness to obtain the abnormal request index corresponding to the corresponding source IP address includes: For each source IP address, the product of the square root of the product of the corresponding abnormal request relevance and the response code type richness and the corresponding abnormal request proportion is taken as the abnormal request index corresponding to the corresponding source IP address.

11. The method according to claim 1, characterized in that Determining the behavior risk index corresponding to each source IP address according to the traffic event index and the abnormal request index corresponding to each source IP address includes: Determine a target traffic event index weight and a target abnormal request index weight; For each source IP address, the product of the corresponding traffic event index and the target traffic event index weight, and the sum of the product of the corresponding abnormal request index and the target abnormal request index weight are taken as the behavior risk index corresponding to the corresponding source IP address.

12. The method according to claim 11, characterized in that The determining of the target traffic event index weight and the target abnormal request index weight includes: Acquire training data; wherein the training data includes a plurality of historical traffic logs and a plurality of historical event logs; Marking malicious behavior and normal behavior for each source IP address in the plurality of the historical traffic logs and the plurality of the historical event logs, and determining that the behavior risk index marking value corresponding to the source IP address marked as malicious behavior is a fifth preset value, and the behavior risk index marking value corresponding to the source IP address marked as normal behavior is a sixth preset value; and Initializing the event index weight and the abnormal request index weight; calculating the historical behavior risk index corresponding to each source IP address in the plurality of historical traffic logs and the plurality of historical event logs according to the initialized event index weight and the abnormal request index weight; According to the historical behavior risk index and the corresponding behavior risk index mark value corresponding to each source IP address in the multiple historical traffic logs and the multiple historical event logs, the event index weight and the abnormal request index weight are iteratively trained to obtain the target event index weight and the target abnormal request index weight.

13. A risk assessment device, characterized in that: include: An acquisition module, used to acquire a flow log set and an event log set output by the system to be analyzed for N hours; wherein the event logs in the event log set are logs of attack events; the flow log set and the event log set both include a source Internet Protocol IP address; N is a positive number; A calculation module, used to calculate the flow event index and abnormal request index corresponding to each source IP address according to the flow log set and the event log set; wherein the flow event index is a parameter reflecting the correlation between flow and attack events, and the abnormal request index is a parameter reflecting the correlation between flow and abnormal requests; The processing module is used to determine the behavior risk index corresponding to each source IP address according to the traffic event index and the abnormal request index corresponding to each source IP address, and evaluate the risk of the corresponding source IP address according to the behavior risk index.

14. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to implement the method steps of any one of claims 1 to 12 when executing a computer program stored in the memory.

15. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any one of claims 1 to 12 are implemented.

Images