Network threat detection method and related hardware

Abstract

The embodiment of the invention provides a network threat detection method and related hardware, and the method comprises the steps: carrying out the feature extraction of target network traffic corresponding to a target node according to a preset time window, and obtaining at least one network traffic feature sequence; respectively executing the following steps for each network flow characteristic: determining a corresponding main evaluation factor sequence by adopting a main evaluation model according to a network flow characteristic sequence corresponding to the current type of network flow characteristic; obtaining an evaluation deviation sequence according to the difference between the network traffic feature sequence and the main evaluation factor sequence; determining a corresponding auxiliary evaluation factor sequence by adopting an auxiliary evaluation model according to the evaluation deviation sequence; determining an evaluation parameter sequence according to the main evaluation factor sequence and the auxiliary evaluation factor sequence; and determining a detection result for the target node according to the network traffic feature sequence and the evaluation parameter sequence, wherein the detection result is used for representing whether the target node has a network threat.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network threat detection method and related hardware. Background Art

[0002] Advanced Persistent Threat (APT), also known as advanced persistent threat, advanced persistent threat, etc., refers to a hidden and long-lasting computer intrusion process. For commercial or political motives, attackers will maintain a highly concealed and continuous attack on specific targets for a long time.

[0003] At present, due to the large differences in business data characteristics of different business systems, network connection relationships of hardware equipment and other factors, the existing network threat detection technology is difficult to effectively detect network threats represented by APT, and the misjudgment rate is high. Summary of the invention

[0004] The embodiment of the present invention provides a network threat detection method and related hardware, which are used to effectively detect network threats from a target node to a specific device.

[0005] An embodiment of the present invention provides a network threat detection method, including:

[0006] Extracting features of target network traffic corresponding to the target node according to a preset time window to obtain at least one network traffic feature sequence;

[0007] For each network traffic feature, perform the following steps:

[0008] According to the network traffic feature sequence corresponding to the network traffic feature of the current type, a corresponding main evaluation factor sequence is determined using a main evaluation model; each main evaluation factor in the main evaluation factor sequence represents: when there is no network threat to the target node, the preliminary estimated characteristic value of the network traffic feature of the current type in the corresponding time window;

[0009] Obtaining an evaluation deviation sequence according to the difference between the network traffic feature sequence and the main evaluation factor sequence;

[0010] According to the evaluation deviation sequence, a corresponding auxiliary evaluation factor sequence is determined using an auxiliary evaluation model; each auxiliary evaluation factor in the auxiliary evaluation factor sequence represents: when there is no network threat to the target node, a correction parameter of the preliminary estimated characteristic value in the corresponding time window;

[0011] Determine an evaluation parameter sequence according to the primary evaluation factor sequence and the secondary evaluation factor sequence;

[0012] A detection result for the target node is determined according to the network traffic feature sequence and the evaluation parameter sequence, and the detection result is used to indicate whether there is a network threat to the target node.

[0013] Optionally, the main evaluation model is an autoregressive integrated moving average (ARIMA) model, and the auxiliary evaluation model is a long short-term memory (LSTM) network model;

[0014] The method of determining the corresponding main evaluation factor sequence using the main evaluation model according to the network traffic feature sequence corresponding to the network traffic feature of the current type includes:

[0015] The network traffic feature sequence of the current type is modeled using the ARIMA model to obtain an evaluation formula, and the main evaluation factors corresponding to each time window in the network traffic feature sequence are determined according to the evaluation formula, and the main evaluation factors are combined into the main evaluation factor sequence in the order of the time windows;

[0016] The step of using the auxiliary evaluation model to determine a corresponding auxiliary evaluation factor sequence according to the evaluation deviation sequence includes:

[0017] The evaluation deviation sequence is input into the pre-trained LSTM model to obtain the auxiliary evaluation factor sequence output by the LSTM model.

[0018] As an optional implementation manner, determining the detection result for the target node according to the network traffic feature sequence and the evaluation parameter sequence includes:

[0019] Determine the actual deviation value corresponding to each time window respectively; for any time window, the actual deviation value is the difference between the network traffic characteristic value and the evaluation parameter;

[0020] If there is a target actual deviation value greater than a preset detection threshold, a detection result indicating that a network threat exists at the target node is determined.

[0021] As another optional implementation, the determining the detection result for the target node according to the network traffic feature sequence and the evaluation parameter sequence includes:

[0022] Determine the actual deviation value corresponding to each time window respectively; for any time window, the actual deviation value is the difference between the network traffic characteristic value and the evaluation parameter;

[0023] If the network threat score is greater than a preset score threshold, a detection result indicating that the target node has a network threat is determined; wherein the network threat score is determined based on a ratio of each target actual deviation value to a corresponding evaluation parameter, and the target actual deviation value is an actual deviation value greater than a preset detection threshold.

[0024] Optionally, before extracting features of target network traffic corresponding to the target node according to a preset time window, the method further includes:

[0025] Using threat intelligence to match each data packet in the target network traffic to determine that there is no successfully matched data packet;

[0026] The method further comprises:

[0027] If it is determined that there is a successfully matched data packet, it is determined that there is a network threat to the target node.

[0028] Further optionally, the method further comprises:

[0029] If it is determined that the target node has a network threat, a network protection operation is performed;

[0030] The network protection operation includes at least one of the following:

[0031] Send alarm information to network administrators;

[0032] Controlling a controlled node in communication connection with the target node to perform a preset processing operation;

[0033] The device usage permission of the target account is adjusted, wherein the target account is an account corresponding to the controlled node that is in communication connection with the target node.

[0034] Further optionally, the performing of the network protection operation specifically includes:

[0035] Determining a network threat level of the target node, and performing a network protection operation corresponding to the network threat level;

[0036] If it is determined that the target node has a network threat based on a data packet that successfully matches the threat intelligence, the network threat level of the target node is determined based on the successfully matched threat intelligence;

[0037] If it is determined that the target node has a network threat according to the network traffic feature sequence and the evaluation parameter sequence, a network threat score is determined according to the actual deviation value corresponding to each time window, and a network threat level of the target node is determined according to the network threat score;

[0038] For any time window, the actual deviation value is the difference between the network traffic characteristic value and the evaluation parameter, and the evaluation parameter is the sum of the main evaluation factor and the auxiliary evaluation factor.

[0039] Based on the same inventive concept, an embodiment of the present invention further provides a network threat detection device, including:

[0040] A feature analysis module is used to extract features of the target network traffic corresponding to the target node according to a preset time window to obtain at least one network traffic feature sequence; for each network traffic feature, the following steps are performed respectively: according to the network traffic feature sequence corresponding to the network traffic feature of the current type, a main evaluation model is used to determine the corresponding main evaluation factor sequence; each main evaluation factor in the main evaluation factor sequence represents: when the target node does not have a network threat, the preliminary estimated characteristic value of the network traffic feature of the current type in the corresponding time window; according to the difference between the network traffic feature sequence and the main evaluation factor sequence, an evaluation deviation sequence is obtained; according to the evaluation deviation sequence, a secondary evaluation model is used to determine the corresponding secondary evaluation factor sequence; each secondary evaluation factor in the secondary evaluation factor sequence represents: when the target node does not have a network threat, the correction parameter of the preliminary estimated characteristic value in the corresponding time window; according to the main evaluation factor sequence and the secondary evaluation factor sequence, an evaluation parameter sequence is determined;

[0041] The determination module is used to determine the detection result for the target node according to the network traffic feature sequence and the evaluation parameter sequence, and the detection result is used to indicate whether the target node has a network threat.

[0042] Based on the same inventive concept, an embodiment of the present invention further provides an electronic device, comprising: a processor and a memory for storing instructions executable by the processor;

[0043] The processor is configured to execute the instructions to implement the network threat detection method.

[0044] Based on the same inventive concept, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program code. When the computer program code runs on a computer, the computer executes the network threat detection method.

[0045] Based on the same inventive concept, an embodiment of the present invention further provides a computer program product, which includes: a computer program code, and when the computer program code runs on a computer, the computer executes the network threat detection method.

[0046] The beneficial effects of the present invention are as follows:

[0047] The network threat detection method and related hardware provided by the embodiments of the present invention analyze the target network traffic of the target node, use the main evaluation model to evaluate the characteristic value of the target network traffic when there is no network threat to the target node, and use the auxiliary evaluation model to correct the evaluation result of the main evaluation model, so as to minimize the evaluation deviation of the single model, fit the network traffic more accurately to give more accurate evaluation parameters, and judge whether the target network traffic is abnormal based on the evaluation parameters, so as to adapt to the business differences of different network systems, effectively detect whether there is a network threat to the target node, reduce the occurrence of false alarms and missed alarms, and improve network security protection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 One of the flow charts of the network threat detection method provided by an embodiment of the present invention;

[0049] Figure 2 A second flowchart of the network threat detection method provided by an embodiment of the present invention;

[0050] Figure 3 One of the partial flow charts of the network threat detection method provided by an embodiment of the present invention;

[0051] Figure 4 A second partial flow chart of the network threat detection method provided by an embodiment of the present invention;

[0052] Figure 5 A schematic diagram of the structure of a network threat detection device provided by an embodiment of the present invention;

[0053] Figure 6 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0054] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and understandable, the present invention will be further described below with reference to the accompanying drawings and examples. However, the exemplary embodiments can be implemented in various forms and should not be understood as being limited to the embodiments described herein; on the contrary, these embodiments are provided to make the present invention more comprehensive and complete, and to fully convey the concepts of the exemplary embodiments to those skilled in the art. The same figure marks in the figures represent the same or similar structures, and thus their repeated descriptions will be omitted. The words expressing position and direction described in the present invention are all explained using the accompanying drawings as examples, but changes can be made as needed, and the changes made are all included in the scope of protection of the present invention. The drawings of the present invention are only used to illustrate the relative position relationship and do not represent the true proportions.

[0055] It should be noted that specific details are described in the following description to facilitate a full understanding of the present invention. However, the present invention can be implemented in a variety of other ways different from those described herein, and those skilled in the art can make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below. The subsequent description of the specification is a preferred embodiment of the present application, but the description is for the purpose of illustrating the general principles of the present application and is not intended to limit the scope of the present application. The scope of protection of the present application shall be determined by the definition of the attached claims.

[0056] The network threat detection method and related hardware provided by the embodiments of the present invention are described in detail below in conjunction with the accompanying drawings.

[0057] The embodiment of the present invention provides a network threat detection method, such as Figure 1 and Figure 2 As shown, the specific steps include:

[0058] S100: Obtain target network traffic corresponding to the target node.

[0059] In the specific implementation process, for network attacks of types such as APT, other nodes that have been connected to the controlled nodes that need to be protected from network attacks can be used as target nodes, and then the network traffic generated by the communication between the target node and the controlled node that needs to be protected from network attacks is determined as the target network traffic. For example, for a large network system that needs to be protected from network attacks, the internal nodes of the network system are the controlled nodes that need to be protected from network attacks, then the external nodes of the network system that communicate with the internal nodes of the network system belong to the target nodes. Specifically, the network traffic generated by the controlled nodes that need to be protected from network attacks can be monitored in real time, and the network traffic of the internal controlled nodes communicating with the external network system is determined as the target network traffic, and the external nodes corresponding to the target network traffic are determined as the target nodes and updated to the target node table of persistent storage. The target network traffic can be collected and obtained by the controlled nodes themselves that need to be protected from network attacks, the switches, routers, network defense servers and other devices that the target network traffic passes through during the communication process. Among them, a network traffic collection probe (such as Zeek) can be deployed in the above-mentioned device, and the target network traffic is collected by the traffic collection probe and transmitted to the device that implements the network threat detection method of the embodiment of the present invention using a message distribution program (such as Kafka, RabbitMQ, etc.). The device implementing the network threat detection method of the embodiment of the present invention obtains the target network traffic through the Flink distributed computing engine, etc., and updates the target node corresponding to the target network traffic to a structured query language (SQL) database.

[0060] S120: Extract features of target network traffic according to a preset time window to obtain at least one network traffic feature sequence.

[0061] Among them, different network traffic feature sequences contain different types of network traffic features.

[0062] In the specific implementation process, the size of the time window can be set as needed. For example, if the target network traffic corresponds to a long period of time (for example, the target network traffic corresponds to several months), the time window can be set to 1 hour.

[0063] For example, the types of network traffic characteristics that can be set include at least one of the following:

[0064] The number of data packets in the target network traffic, the number of source IP addresses involved in the target network traffic, the number of source ports involved in the target network traffic, the number of target IP addresses involved in the target network traffic, the number of target ports involved in the target network traffic, the number of data packets of the preset communication protocol in the target network traffic, the proportion of the number of data packets of the preset communication protocol in the target network traffic, the data volume of the target network traffic, and the number of connection requests initiated to each target node.

[0065] Afterwards, for each type of network traffic feature set, feature extraction is performed according to the preset time window to obtain the network traffic feature value of the type, and the network traffic feature values ​​of the same type are combined into a network traffic feature sequence according to the time window sequence, thereby obtaining network traffic feature sequences of different network traffic feature types.

[0066] For each network traffic feature, perform the following steps respectively ( Figure 1 and Figure 2 The figure only illustrates the steps of one network traffic feature sequence, and the steps of other network traffic feature sequences are the same and can be deduced accordingly):

[0067] S130. For a network traffic feature sequence corresponding to the current type of network traffic feature, a main evaluation model is used to determine a corresponding main evaluation factor sequence.

[0068] The main evaluation factor sequence is composed of main evaluation factors corresponding to each time window arranged in the order of the time window. For any main evaluation factor in the main evaluation factor sequence, the main evaluation factor represents the preliminary estimated characteristic value of the current type of network traffic characteristics in the corresponding time window when there is no network threat to the target node.

[0069] In the specific implementation process, the main evaluation model can adopt a linear relationship fitting model such as an autoregressive integrated moving average (ARIMA) model and a seasonal autoregressive integrated moving average (SARIMA) model. In this way, for any main evaluation factor in the main evaluation factor sequence, the main evaluation factor represents the linear change characteristic value of the current type of network traffic characteristics in the corresponding time window when there is no network threat to the target node.

[0070] Optionally, the main evaluation model is an ARIMA model. Accordingly, the step S130 is specifically as follows:

[0071] The ARIMA model is used to model the current type of network traffic feature sequence to obtain an evaluation formula, and the main evaluation factors corresponding to each time window in the network traffic feature sequence are determined according to the evaluation formula, and the main evaluation factors are combined into the main evaluation factor sequence in the order of the time windows.

[0072] In the process of modeling using the ARIMA model, the autoregressive order can be set according to the period of the periodic change law of normal network traffic when no network attack occurs. For example, if the time window is set to 1 hour, then in the process of modeling using the ARIMA model, considering that the normal network traffic characteristics generally change periodically in units of weeks, the autoregressive order can be set to 240 based on the time length of 10 days. In addition, in the process of modeling using the ARIMA model, the difference order can be set to 2 and the moving average order can be set to 1. After obtaining the evaluation formula for modeling using the ARIMA model, each time window is used as the input of the evaluation formula, so as to obtain the main evaluation factors corresponding to each time window given by the evaluation formula.

[0073] S140. Obtain an evaluation deviation sequence based on the difference between the network traffic feature sequence and the main evaluation factor sequence.

[0074] The evaluation deviation sequence is composed of evaluation deviation values ​​corresponding to each time window arranged in the order of the time windows.

[0075] As an optional implementation, for any evaluation deviation value in the evaluation deviation sequence, the evaluation deviation value is: the difference between the current network traffic characteristic value and the main evaluation factor in the corresponding time window. As another optional implementation, for any evaluation deviation value in the evaluation deviation sequence, the evaluation deviation value is: the difference between the current network traffic characteristic value and the main evaluation factor in the corresponding time window, and the current network traffic characteristic value, and the ratio of the difference to the current network traffic characteristic value. Of course, the evaluation deviation value can also be implemented in other ways, and the embodiments of the present invention are not limited in detail here.

[0076] S150. Determine a corresponding auxiliary evaluation factor sequence using an auxiliary evaluation model according to the evaluation deviation sequence.

[0077] Among them, the auxiliary evaluation factor sequence is composed of auxiliary evaluation factors corresponding to each time window arranged in the order of time windows. For any auxiliary evaluation factor in the auxiliary evaluation factor sequence, the auxiliary evaluation factor represents the correction parameter of the preliminary estimated characteristic value of the current type of network traffic characteristics in the corresponding time window when there is no network threat to the target node. If the main evaluation model can adopt a linear relationship fitting model such as an ARIMA model and a SARIMA model, so that the main evaluation factor represents the linear change characteristic value of the current type of network traffic characteristics in the corresponding time window when there is no network threat to the target node, then for any auxiliary evaluation factor in the auxiliary evaluation factor sequence, the auxiliary evaluation factor represents the nonlinear change characteristic value of the current type of network traffic characteristics in the corresponding time window when there is no network threat to the target node.

[0078] In the specific implementation process, the auxiliary evaluation model can adopt pre-trained recurrent neural network (RNN), long short-term memory network (LSTM), transformer and other machine learning models.

[0079] Optionally, the auxiliary evaluation model adopts an LSTM model, and the step S150 specifically includes:

[0080] The evaluation deviation sequence is input into the pre-trained LSTM model to obtain the auxiliary evaluation factor sequence output by the LSTM model.

[0081] In the specific implementation process, the architecture of the LSTM model can be set as needed. For example, a two-layer LSTM can be used as an auxiliary evaluation model, where the number of neurons in the first layer of LSTM is 80 and the number of neurons in the second layer of LSTM is 50.

[0082] In the specific implementation process, the training samples can be set according to the periodic change law of normal network traffic when no network attack occurs. For example, if the time window is set to 1 hour, then in the process of training the LSTM model, considering that the normal network traffic characteristics generally change periodically in units of weeks, the sequence length of the training samples can be set to 240 according to the time length of 10 days. In addition, for the two-layer LSTM, the dropout rate of the first layer LSTM can be set to 0.25 and the dropout rate of the second layer LSTM can be set to 0.2 during the training process to better implement the training of the two-layer LSTM.

[0083] S160: Determine an evaluation parameter sequence according to the primary evaluation factor sequence and the secondary evaluation factor sequence.

[0084] The evaluation parameter sequence is composed of evaluation parameter values ​​corresponding to each time window arranged in the order of the time windows.

[0085] As an optional implementation, for any evaluation parameter value in the evaluation parameter sequence, the evaluation parameter value is: the sum of the main evaluation factor and the auxiliary evaluation factor in the corresponding time window. As another optional implementation, for any evaluation parameter value in the evaluation parameter sequence, the evaluation parameter value is: the product of the main evaluation factor and the auxiliary evaluation factor in the corresponding time window. Of course, the evaluation parameter value can also be implemented in other ways, and the embodiment of the present invention does not make too many restrictions here.

[0086] S170: Determine a detection result for the target node according to the network traffic feature sequence and the evaluation parameter sequence.

[0087] S181. The detection result is that there is no network threat to the target node.

[0088] S182: The detection result is that the target node has a network threat.

[0089] As an optional implementation, the detection result for the target node can be determined based on the difference between the network traffic characteristic value and the evaluation parameter of the same time window in each time window (hereinafter referred to as the actual deviation value). As another optional implementation, the detection result for the target node can be determined based on the ratio of the network traffic characteristic value to the evaluation parameter of the same time window in each time window. Of course, other parameters can also be determined based on the network traffic characteristic sequence and the evaluation parameter sequence to determine the detection result for the target node, and the embodiment of the present invention does not make too many restrictions here.

[0090] For example, for an implementation method of determining the detection result for the target node according to the actual deviation value corresponding to each time window, the detection result for the target node may be determined in any of the following ways:

[0091] (1) Figure 3 As shown, the specific steps include:

[0092] S171. Determine the actual deviation value corresponding to each time window respectively.

[0093] For any time window, the actual deviation value is the difference between the network traffic characteristic value and the evaluation parameter.

[0094] S172. Determine whether there is a target actual deviation value greater than a preset detection threshold.

[0095] If the result of step S172 is no, execute step S181; if the result of step S172 is yes, execute step S182.

[0096] (2) Figure 4 As shown, the specific steps include:

[0097] S171. Determine the actual deviation value corresponding to each time window respectively.

[0098] For any time window, the actual deviation value is the difference between the network traffic characteristic value and the evaluation parameter, and the evaluation parameter is the sum of the main evaluation factor and the auxiliary evaluation factor.

[0099] S173. Determine a target actual deviation value that is greater than a preset detection threshold.

[0100] S174. Determine a network threat score according to a ratio of the actual deviation value of each target to the evaluation parameter corresponding to the same time window.

[0101] As an optional implementation, the network threat score S may be determined by the following formula:

[0102]

[0103] Among them, t is the time window, a t is the actual deviation value corresponding to the time window t, p t is the evaluation parameter corresponding to the time window t, and δ is the preset detection threshold.

[0104] As another optional implementation, the network threat score S may be determined by the following formula:

[0105]

[0106] Among them, t is the time window, a t is the actual deviation value corresponding to the time window t, p t is the evaluation parameter corresponding to the time window t, δ is the preset detection threshold, is the number of actual deviations from the target.

[0107] By using the above network threat score calculation formula, a normalized score value can be obtained, which has high readability. Of course, the network threat score can also be determined in other ways, and the embodiment of the present invention does not make too many limitations here.

[0108] S175: Determine whether the network threat score is greater than a preset score threshold.

[0109] If the result of step S175 is no, execute step S181; if the result of step S175 is yes, execute step S182.

[0110] For normal network traffic, the characteristics of network traffic have certain regularity, but because there are many factors affecting the change of characteristics and the law of characteristic change is relatively complex, the law of characteristic change is difficult to determine. The embodiment of the present invention analyzes the target network traffic of the target node, uses the main evaluation model to evaluate the characteristic value of the target network traffic when there is no network threat to the target node, and uses the auxiliary evaluation model to correct the evaluation result of the main evaluation model, so as to reduce the evaluation deviation of the single model as much as possible, fit the network traffic more accurately to give more accurate evaluation parameters, and judge whether the target network traffic is abnormal based on the evaluation parameters, so as to adapt to the business differences of different network systems, and effectively detect whether the target node has a network threat in real time according to the current target network traffic, reduce the occurrence of false alarms and missed alarms, and improve network security protection capabilities.

[0111] If the main evaluation model adopts a linear relationship fitting model such as ARIMA, and the auxiliary evaluation model adopts a machine learning model such as LSTM, the main evaluation model can be used to evaluate the linear change characteristic values ​​of the target node when there is no network threat, and the auxiliary evaluation model can be used to evaluate the nonlinear change characteristic values ​​of the target node when there is no network threat. In this way, the linear change angle and the nonlinear change angle can be more accurately fitted for normal network traffic with more complex characteristic change patterns to give more accurate evaluation parameters, thereby identifying APT attacks with characteristics such as long-term low-frequency communication or intermittent communication with the target node.

[0112] Alternatively, if Figure 2 As shown, before step S120, the method further includes:

[0113] S110, using threat intelligence to match each data packet in the target network traffic, and determining whether there is a successfully matched data packet.

[0114] In the specific implementation process, threat intelligence may include at least one of the following:

[0115] Threat domain name, threat Internet Protocol (IP) address, threat Media Access Control Address (MAC) address, threat Uniform Resource Locator (URL), threat Uniform Resource Identifier (URI), threat User Agent (UA), threat cookies, threat Transport Layer Security (TLS) fingerprint.

[0116] During the specific implementation process, threat intelligence can be obtained from a threat intelligence sharing platform on the Internet, or manually imported by a network administrator, or automatically generated based on locally recorded network traffic with attack behaviors (for example, the relevant information of the target node determined to have a network threat through step S170 is updated to the threat intelligence). The embodiments of the present invention do not make too many limitations here.

[0117] Optionally, the threat intelligence may also include a corresponding threat level, so that when a data packet with attack behavior is matched according to the threat intelligence, the network threat level of the corresponding target node can be determined, so that corresponding network defense operations can be performed according to the network threat level.

[0118] In the specific implementation process, a distributed computing engine such as Flink may be used to execute step S110.

[0119] If the result of step S110 is yes, execute step S182; if the result of step S110 is no, execute step S120.

[0120] In this way, by using threat intelligence to match data packets in the target network traffic, it is directly determined that there is a network threat in the target node after a successful match, thereby achieving the first level of filtering of the target network traffic, being able to quickly detect some network threats and reduce the number of data packets that require subsequent detection processes, thereby effectively reducing the complexity of the network threat detection solution.

[0121] Further optionally, after determining that the detection result is that the target node has a network threat, such as Figure 1 and Figure 2 As shown, the method may also include:

[0122] S190. Execute network protection operations.

[0123] Specifically, the network protection operation may include at least one of the following:

[0124] (1) Send an alarm message to the network administrator.

[0125] During the specific implementation process, alarm information can be sent to the network administrator via email, phone, instant messaging software (such as QQ, WeChat, DingTalk, Feishu, etc.) message, short message service (SMS), message push of special software on the network administrator terminal, etc.

[0126] (2) Controlling the controlled node that is in communication connection with the target node to perform a preset processing operation.

[0127] Furthermore, the preset disposal operations may include: ① controlling the controlled node to block the communication connection with the target node, ② controlling the controlled node to limit the communication with the target node, ③ controlling the controlled node to shut down, ④ controlling the controlled node to collect its own operation status log, the communication log of the communication connection with the target node, and the data packet of communication with the target node.

[0128] (3) Adjust the device usage permissions of the target account.

[0129] The target account is an account corresponding to the controlled node that is in communication connection with the target node. For example, the target account is a user account logged in when the controlled node is in communication connection with the target node, and / or the target user is a device administrator account of the controlled node.

[0130] During the specific implementation process, the target user's device usage permissions can be adjusted by disabling the target user's account, modifying the target account's usage permissions, etc.

[0131] For example, when the technical solution of the embodiment of the present invention is applied to an internal network system, the target node is an external node that does not belong to the internal network system. Although it may not be possible to directly manipulate the external target node, subsequent network attacks can be avoided by performing preset disposal operations on the controlled nodes within the network system that have been in communication with the target node and adjusting the device usage permissions of the target account.

[0132] Furthermore, in the process of executing the network protection operation, the network protection operation corresponding to the network threat level can be executed according to the network threat level of the target node, so as to maintain the smooth operation of the network system as much as possible and reduce the interference with normal business processing. Accordingly, if it is determined that the target node has a network threat by executing the step S110, the network threat level of the target node can be determined according to the network threat level corresponding to the successfully matched threat intelligence. If it is determined that the target node has a network threat by executing the step S170, the network threat score can be determined according to the actual deviation value corresponding to each time window, and the network threat level of the target node can be determined according to the network threat score. For example, it can be set that the higher the network threat score, the higher the network threat level of the target node, and the network protection operation corresponding to the higher network threat level needs to be executed accordingly. The network threat score can be determined using the formula given in the previous text, or it can be determined in other ways, and the embodiment of the present invention does not make too many restrictions here.

[0133] Based on the same inventive concept, an embodiment of the present invention further provides a network threat detection device, such as Figure 5 As shown, including:

[0134] The feature analysis module M2 is used to extract features of the target network traffic corresponding to the target node according to a preset time window to obtain at least one network traffic feature sequence; for each network traffic feature, the following steps are performed respectively: according to the network traffic feature sequence corresponding to the network traffic feature of the current type, the main evaluation model is used to determine the corresponding main evaluation factor sequence; each main evaluation factor in the main evaluation factor sequence represents: when the target node does not have a network threat, the preliminary estimated characteristic value of the network traffic feature of the current type in the corresponding time window; according to the difference between the network traffic feature sequence and the main evaluation factor sequence, an evaluation deviation sequence is obtained; according to the evaluation deviation sequence, the auxiliary evaluation model is used to determine the corresponding auxiliary evaluation factor sequence; each auxiliary evaluation factor in the auxiliary evaluation factor sequence represents: when the target node does not have a network threat, the correction parameter of the preliminary estimated characteristic value in the corresponding time window; the evaluation parameter sequence is determined according to the main evaluation factor sequence and the auxiliary evaluation factor sequence;

[0135] The determination module M3 is used to determine the detection result for the target node according to the network traffic feature sequence and the evaluation parameter sequence, and the detection result is used to indicate whether there is a network threat to the target node.

[0136] Optionally, the main evaluation model is an autoregressive integrated moving average (ARIMA) model, and the auxiliary evaluation model is a long short-term memory (LSTM) network model;

[0137] The method of determining the corresponding main evaluation factor sequence using the main evaluation model according to the network traffic feature sequence corresponding to the network traffic feature of the current type includes:

[0138] The network traffic feature sequence of the current type is modeled using the ARIMA model to obtain an evaluation formula, and the main evaluation factors corresponding to each time window in the network traffic feature sequence are determined according to the evaluation formula, and the main evaluation factors are combined into the main evaluation factor sequence in the order of the time windows;

[0139] The step of using the auxiliary evaluation model to determine a corresponding auxiliary evaluation factor sequence according to the evaluation deviation sequence includes:

[0140] The evaluation deviation sequence is input into the pre-trained LSTM model to obtain the auxiliary evaluation factor sequence output by the LSTM model.

[0141] Optionally, determining the detection result for the target node according to the network traffic feature sequence and the evaluation parameter sequence includes:

[0142] Determine the actual deviation value corresponding to each time window respectively; for any time window, the actual deviation value is the difference between the network traffic characteristic value and the evaluation parameter;

[0143] If there is a target actual deviation value greater than a preset detection threshold, a detection result that a network threat exists at the target node is determined;

[0144] Alternatively, if the network threat score is greater than a preset score threshold, a detection result indicating that the target node has a network threat is determined; wherein the network threat score is determined based on a ratio of an actual deviation value of each target to a corresponding evaluation parameter.

[0145] Optionally, the device further comprises:

[0146] Intelligence analysis module M1, used to match each data packet in the target network traffic using threat intelligence;

[0147] If it is determined that there is a successfully matched data packet, it is determined that there is a network threat to the target node.

[0148] Optionally, the device further comprises:

[0149] A response module M4 is used to perform a network protection operation if it is determined that the target node has a network threat;

[0150] The network protection operation includes at least one of the following:

[0151] Send alarm information to network administrators;

[0152] Controlling a controlled node in communication connection with the target node to perform a preset processing operation;

[0153] The device usage permission of the target account is adjusted, wherein the target account is an account corresponding to the controlled node that is in communication connection with the target node.

[0154] Optionally, the response module M4 is specifically configured to: if it is determined that the target node has a network threat, determine the network threat level of the target node, and perform a network protection operation corresponding to the network threat level;

[0155] If it is determined that the target node has a network threat based on a data packet that successfully matches the threat intelligence, the network threat level of the target node is determined based on the successfully matched threat intelligence;

[0156] If it is determined that the target node has a network threat according to the network traffic feature sequence and the evaluation parameter sequence, a network threat score is determined according to the actual deviation value corresponding to each time window, and a network threat level of the target node is determined according to the network threat score;

[0157] For any time window, the actual deviation value is the difference between the network traffic characteristic value and the evaluation parameter, and the evaluation parameter is the sum of the main evaluation factor and the auxiliary evaluation factor.

[0158] In the several embodiments provided by the present invention, it should be understood that the device embodiments described above are only schematic, for example, the division of the modules is only a logical function division, and there may be other division methods in actual implementation, for example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0159] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0160] In addition, each functional module in each embodiment of the present invention may be integrated into a processing module, or each module may exist physically separately, or two or more modules may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may be stored in a computer-readable storage medium.

[0161] Since the specific manner in which each module of the network threat detection device performs operations has been described in detail in the content of the corresponding network threat detection method, it will not be repeated here.

[0162] Based on the same inventive concept, the present application embodiment also provides an electronic device, such as Figure 6 As shown, it includes: a processor 110 and a memory 120 for storing executable instructions of the processor 110; wherein the processor 110 is configured to execute the instructions to implement the network threat detection method.

[0163] In the specific implementation process, the device may have relatively large differences due to different configurations or performances, and may include one or more processors 110, memory 120, and computer-readable storage medium 130. The memory 120 and / or computer-readable storage medium 130 include one or more applications 131 or data 132. The memory 120 and / or computer-readable storage medium 130 may also include one or more operating systems 133, such as Windows, Mac OS, Linux, IOS, Android, Unix, FreeBSD, etc. Among them, the memory 120 and the computer-readable storage medium 130 may be short-term storage or persistent storage. The application 131 may include one or more modules ( Figure 6 ), each module may include a series of instruction operations. Further, the processor 110 may be configured to communicate with the computer-readable storage medium 130, and execute a series of instruction operations in the computer-readable storage medium 130 on the device. The device may also include one or more power supplies ( Figure 6 one or more network interfaces 140, wherein the network interface 140 includes a wired network interface 141 and / or a wireless network interface 142; and one or more input / output interfaces 143.

[0164] Based on the same inventive concept, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program code. When the computer program code runs on a computer, the computer implements the network threat detection method.

[0165] The computer-readable storage medium may be any available medium that can be stored by a computer or a data storage device such as a server or a data center that includes one or more available media. The available medium may be a magnetic medium (such as a floppy disk, a hard disk, a USB flash drive, a magnetic tape, a read-only memory (ROM), a random access memory (RAM)), an optical medium (such as a high-density digital video disc (DVD), a video compact disc (VCD)), or a semiconductor medium (such as a solid-state drive (SSD)).

[0166] Since the principle of solving the problem by the above-mentioned computer-readable storage medium is consistent with the network threat detection method described above, the implementation of the above-mentioned computer-readable storage medium can refer to the implementation of the method, and the repeated parts will not be repeated.

[0167] Based on the same inventive concept, an embodiment of the present application further provides a computer program product, which includes: a computer program code, and when the computer program code runs on a computer, the computer implements the network threat detection method.

[0168] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from a computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, a computer, a server, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server, or data center.

[0169] Since the principle of solving the problem by the above-mentioned computer program product is consistent with the network threat detection method described above, the implementation of the above-mentioned computer program product can refer to the implementation of the method, and the repeated parts will not be repeated.

[0170] The network threat detection method and related hardware provided by the embodiments of the present invention analyze the target network traffic of the target node, use the main evaluation model to evaluate the characteristic value of the target network traffic when there is no network threat to the target node, and use the auxiliary evaluation model to correct the evaluation result of the main evaluation model, so as to minimize the evaluation deviation of the single model, fit the network traffic more accurately to give more accurate evaluation parameters, and judge whether the target network traffic is abnormal based on the evaluation parameters, so as to adapt to the business differences of different network systems, effectively detect whether there is a network threat to the target node, reduce the occurrence of false alarms and missed alarms, and improve network security protection capabilities.

[0171] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0172] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0173] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0174] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0175] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A network threat detection method, characterized in that: include: Extracting features of target network traffic corresponding to the target node according to a preset time window to obtain at least one network traffic feature sequence; For each network traffic feature, perform the following steps: According to the network traffic feature sequence corresponding to the network traffic feature of the current type, a corresponding main evaluation factor sequence is determined using a main evaluation model; each main evaluation factor in the main evaluation factor sequence represents: when there is no network threat to the target node, the preliminary estimated characteristic value of the network traffic feature of the current type in the corresponding time window; Obtaining an evaluation deviation sequence according to the difference between the network traffic feature sequence and the main evaluation factor sequence; According to the evaluation deviation sequence, a corresponding auxiliary evaluation factor sequence is determined using an auxiliary evaluation model; each auxiliary evaluation factor in the auxiliary evaluation factor sequence represents: when there is no network threat to the target node, a correction parameter of the preliminary estimated characteristic value in the corresponding time window; Determine an evaluation parameter sequence according to the primary evaluation factor sequence and the secondary evaluation factor sequence; A detection result for the target node is determined according to the network traffic feature sequence and the evaluation parameter sequence, and the detection result is used to indicate whether there is a network threat to the target node.

2. The method according to claim 1, characterized in that The main evaluation model is an autoregressive integrated moving average (ARIMA) model, and the auxiliary evaluation model is a long short-term memory (LSTM) network model; The method of determining the corresponding main evaluation factor sequence using the main evaluation model according to the network traffic feature sequence corresponding to the network traffic feature of the current type includes: The network traffic feature sequence of the current type is modeled using the ARIMA model to obtain an evaluation formula, and the main evaluation factors corresponding to each time window in the network traffic feature sequence are determined according to the evaluation formula, and the main evaluation factors are combined into the main evaluation factor sequence in the order of the time windows; The step of using the auxiliary evaluation model to determine a corresponding auxiliary evaluation factor sequence according to the evaluation deviation sequence includes: The evaluation deviation sequence is input into the pre-trained LSTM model to obtain the auxiliary evaluation factor sequence output by the LSTM model.

3. The method according to claim 1, characterized in that The determining the detection result for the target node according to the network traffic feature sequence and the evaluation parameter sequence includes: Determine the actual deviation value corresponding to each time window respectively; for any time window, the actual deviation value is the difference between the network traffic characteristic value and the evaluation parameter; If there is a target actual deviation value greater than a preset detection threshold, a detection result that a network threat exists at the target node is determined; Alternatively, if the network threat score is greater than a preset score threshold, a detection result indicating that the target node has a network threat is determined; wherein the network threat score is determined based on a ratio of an actual deviation value of each target to a corresponding evaluation parameter.

4. The method according to claim 1, characterized in that Before extracting features of the target network traffic corresponding to the target node according to the preset time window, the method further includes: Using threat intelligence to match each data packet in the target network traffic to determine that there is no successfully matched data packet; The method further comprises: If it is determined that there is a successfully matched data packet, it is determined that there is a network threat to the target node.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: If it is determined that the target node has a network threat, a network protection operation is performed; The network protection operation includes at least one of the following: Send alarm information to network administrators; Controlling a controlled node in communication connection with the target node to perform a preset processing operation; The device usage permission of the target account is adjusted, wherein the target account is an account corresponding to the controlled node that is in communication connection with the target node.

6. The method according to claim 5, characterized in that The network protection operation is specifically performed including: Determining a network threat level of the target node, and performing a network protection operation corresponding to the network threat level; If it is determined that the target node has a network threat based on a data packet that successfully matches the threat intelligence, the network threat level of the target node is determined based on the successfully matched threat intelligence; If it is determined that the target node has a network threat according to the network traffic feature sequence and the evaluation parameter sequence, a network threat score is determined according to the actual deviation value corresponding to each time window, and a network threat level of the target node is determined according to the network threat score; For any time window, the actual deviation value is the difference between the network traffic characteristic value and the evaluation parameter, and the evaluation parameter is the sum of the main evaluation factor and the auxiliary evaluation factor.

7. A network threat detection device, characterized in that: include: A feature analysis module is used to extract features of target network traffic corresponding to the target node according to a preset time window to obtain at least one network traffic feature sequence; For each network traffic feature, the following steps are performed respectively: according to the network traffic feature sequence corresponding to the network traffic feature of the current type, the corresponding main evaluation factor sequence is determined using the main evaluation model; each main evaluation factor in the main evaluation factor sequence represents: when there is no network threat to the target node, the linear change characteristic value of the network traffic feature of the current type in the corresponding time window; According to the difference between the network traffic feature sequence and the main evaluation factor sequence, an evaluation deviation sequence is obtained; according to the evaluation deviation sequence, a corresponding auxiliary evaluation factor sequence is determined using an auxiliary evaluation model; each auxiliary evaluation factor in the auxiliary evaluation factor sequence represents: when there is no network threat to the target node, the nonlinear change characteristic value of the current type of network traffic characteristics in the corresponding time window; according to the main evaluation factor sequence and the auxiliary evaluation factor sequence, an evaluation parameter sequence is determined; The determination module is used to determine the detection result for the target node according to the network traffic feature sequence and the evaluation parameter sequence, and the detection result is used to indicate whether the target node has a network threat.

8. An electronic device, characterized in that: include: a processor and a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the network threat detection method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program code, and when the computer program code runs on a computer, the computer executes the network threat detection method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The computer program product comprises: a computer program code, and when the computer program code is run on a computer, the computer is enabled to execute the network threat detection method according to any one of claims 1 to 6.

Images