Network threat detection methods and related hardware

Abstract

The embodiment of the present application provides a network threat detection method and related hardware, comprising: extracting features of target network traffic corresponding to a target node according to a preset time window to obtain at least one network traffic feature sequence; for each network traffic feature, the following steps are executed respectively: determining a corresponding main evaluation factor sequence by using a main evaluation model according to the network traffic feature sequence corresponding to the current network traffic feature; obtaining an evaluation deviation sequence according to the difference between the network traffic feature sequence and the main evaluation factor sequence; determining a corresponding auxiliary evaluation factor sequence by using an auxiliary evaluation model according to the evaluation deviation sequence; determining an evaluation parameter sequence according to the main evaluation factor sequence and the auxiliary evaluation factor sequence; and determining a detection result for the target node according to the network traffic feature sequence and the evaluation parameter sequence, wherein the detection result is used to represent whether the target node has a network threat.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a network threat detection method and related hardware. BACKGROUND

[0002] Advanced Persistent Threat (APT), also known as Advanced Persistent Threat, Advanced Persistent Threat, etc., refers to a hidden and persistent computer intrusion process. Attackers will maintain a high level of concealment and continuous attack on specific targets for a long time due to commercial or political motives.

[0003] At present, due to the great differences in business data characteristics of different business systems, network connection relationship of hardware devices and other factors, the existing network threat detection technology is difficult to effectively detect the network threat represented by APT, and the misjudgment rate is high. SUMMARY

[0004] The embodiments of the present application provide a network threat detection method and related hardware to effectively detect the network threat of a target node to a specific device.

[0005] The embodiments of the present application provide a network threat detection method, which comprises:

[0006] According to the preset time window, the target network traffic corresponding to the target node is subjected to feature extraction, and at least one network traffic feature sequence is obtained;

[0007] For each network traffic feature, the following steps are performed respectively:

[0008] According to the network traffic feature sequence corresponding to the current type of network traffic feature, a main evaluation model is used to determine a corresponding main evaluation factor sequence; each main evaluation factor in the main evaluation factor sequence represents a preliminary estimated feature value of the current type of network traffic feature in the corresponding time window when the target node has no network threat;

[0009] According to the difference between the network traffic feature sequence and the main evaluation factor sequence, an evaluation deviation sequence is obtained;

[0010] According to the evaluation deviation sequence, a secondary evaluation model is used to determine a corresponding secondary evaluation factor sequence; each secondary evaluation factor in the secondary evaluation factor sequence represents a correction parameter of the preliminary estimated feature value in the corresponding time window when the target node has no network threat;

[0011] According to the main evaluation factor sequence and the secondary evaluation factor sequence, an evaluation parameter sequence is determined;

[0012] According to the network traffic feature sequence and the evaluation parameter sequence, a detection result of the target node is determined, and the detection result is used to indicate whether the target node has a network threat.

[0013] Optionally, the main evaluation model is an autoregressive integrated moving average (ARIMA) model, and the auxiliary evaluation model is a long short-term memory (LSTM) network model.

[0014] According to the network traffic feature sequence corresponding to the current category of network traffic features, a main evaluation model is used to determine a corresponding main evaluation factor sequence, which includes:

[0015] An ARIMA model is used to model the network traffic feature sequence of the current category to obtain an evaluation formula, and according to the evaluation formula, a main evaluation factor corresponding to each time window in the network traffic feature sequence is determined, and the main evaluation factors are arranged in time window order to form the main evaluation factor sequence.

[0016] According to the evaluation deviation sequence, an auxiliary evaluation model is used to determine a corresponding auxiliary evaluation factor sequence, which includes:

[0017] The evaluation deviation sequence is input into a pre-trained LSTM model to obtain the auxiliary evaluation factor sequence output by the LSTM model.

[0018] As an optional implementation, according to the network traffic feature sequence and the evaluation parameter sequence, a detection result of the target node is determined, which includes:

[0019] An actual deviation value corresponding to each time window is determined respectively; for any time window, the actual deviation value is the difference between the network traffic feature value and the evaluation parameter;

[0020] If there is a target actual deviation value greater than a preset detection threshold, it is determined that the target node has a network threat detection result.

[0021] As another optional implementation, according to the network traffic feature sequence and the evaluation parameter sequence, a detection result of the target node is determined, which includes:

[0022] An actual deviation value corresponding to each time window is determined respectively; for any time window, the actual deviation value is the difference between the network traffic feature value and the evaluation parameter;

[0023] If the network threat score is greater than a preset score threshold, it is determined that the target node has a network threat detection result; wherein, the network threat score is determined according to the ratio of each target actual deviation value to the corresponding evaluation parameter, and the target actual deviation value is an actual deviation value greater than a preset detection threshold.

[0024] Optionally, before the feature extraction of the target network traffic corresponding to the target node according to the preset time window, the method further comprises:

[0025] The threat intelligence is adopted to match each data packet in the target network traffic, and a data packet without a matching success is determined.

[0026] The method further comprises:

[0027] If it is determined that there is a data packet with a matching success, it is determined that the target node has a network threat.

[0028] Further optionally, the method further comprises:

[0029] If it is determined that the target node has a network threat, a network protection operation is performed.

[0030] The network protection operation comprises at least one of the following:

[0031] Sending an alarm information to a network administrator;

[0032] Controlling a controlled node in communication connection with the target node to perform a preset disposal operation;

[0033] Adjusting a device usage permission of a target account corresponding to the controlled node in communication connection with the target node.

[0034] Further optionally, the performing of the network protection operation specifically comprises:

[0035] Determining a network threat level of the target node, and performing a network protection operation corresponding to the network threat level;

[0036] If it is determined that the target node has a network threat according to the data packet matched with the threat intelligence, the network threat level of the target node is determined according to the threat intelligence with a matching success.

[0037] If it is determined that the target node has a network threat according to the network traffic feature sequence and the evaluation parameter sequence, a network threat score is determined according to the actual deviation value corresponding to each time window, and the network threat level of the target node is determined according to the network threat score.

[0038] For any time window, the actual deviation value is the difference between the network traffic feature value and the evaluation parameter, and the evaluation parameter is the sum of the main evaluation factor and the auxiliary evaluation factor.

[0039] Based on the same inventive concept, the embodiments of the present application also provide a network threat detection device, comprising:

[0040] The feature analysis module is configured to extract features of target network traffic corresponding to the target node according to a preset time window to obtain at least one network traffic feature sequence; for each network traffic feature, the following steps are performed: according to a network traffic feature sequence corresponding to the current network traffic feature, a main evaluation model is used to determine a corresponding main evaluation factor sequence; each main evaluation factor in the main evaluation factor sequence represents a preliminary estimated feature value of the current network traffic feature in the corresponding time window when the target node is free of network threats; an evaluation deviation sequence is obtained according to a difference between the network traffic feature sequence and the main evaluation factor sequence; a secondary evaluation model is used to determine a corresponding secondary evaluation factor sequence according to the evaluation deviation sequence; each secondary evaluation factor in the secondary evaluation factor sequence represents a correction parameter of the preliminary estimated feature value in the corresponding time window when the target node is free of network threats; and an evaluation parameter sequence is determined according to the main evaluation factor sequence and the secondary evaluation factor sequence.

[0041] The determination module is configured to determine a detection result for the target node according to the network traffic feature sequence and the evaluation parameter sequence, and the detection result is used to indicate whether the target node is free of network threats.

[0042] Based on the same inventive concept, an embodiment of the present application also provides an electronic device, comprising: a processor and a memory for storing instructions executable by the processor;

[0043] The processor is configured to execute the instructions to implement the network threat detection method.

[0044] Based on the same inventive concept, an embodiment of the present application also provides a computer-readable storage medium, which stores computer program code, and when the computer program code is executed on a computer, the computer program code causes the computer to execute the network threat detection method.

[0045] Based on the same inventive concept, an embodiment of the present application also provides a computer program product, which comprises computer program code, and when the computer program code is executed on a computer, the computer program code causes the computer to execute the network threat detection method.

[0046] The present application has the following advantages:

[0047] The network threat detection method and related hardware provided by the embodiment of the present application can reduce the evaluation deviation of a single model as much as possible, accurately fit the network traffic to give more accurate evaluation parameters, and determine whether the target network traffic is abnormal based on the evaluation parameters, thereby adapting to the business differences of different network systems, effectively detecting whether the target node has network threats, reducing the occurrence of false positives and false negatives, and improving the network security protection capability. BRIEF DESCRIPTION OF DRAWINGS

[0048] Figure 1 One of the flowcharts of the network threat detection method provided by the embodiment of the present application is provided.

[0049] Figure 2 The second flowchart of the network threat detection method provided by the embodiment of the present application is provided.

[0050] Figure 3 One of the partial flowcharts of the network threat detection method provided by the embodiment of the present application is provided.

[0051] Figure 4 The second partial flowchart of the network threat detection method provided by the embodiment of the present application is provided.

[0052] Figure 5 The structural schematic diagram of the network threat detection device provided by the embodiment of the present application is provided.

[0053] Figure 6 The structural schematic diagram of the electronic device provided by the embodiment of the present application is provided. DETAILED DESCRIPTION

[0054] In order to make the above objectives, features and advantages of the present application more apparent, comprehensible and easier to understand, the present application will be further described below with reference to the drawings and embodiments. However, the example embodiments can be implemented in various forms, and should not be understood as being limited to the embodiments described herein; on the contrary, these embodiments are provided to make the present application more comprehensive and complete, and to fully convey the ideas of the example embodiments to those skilled in the art. The same reference numerals in the drawings represent the same or similar structures, and thus repeated descriptions thereof will be omitted. The expressions of position and direction described in the present application are described with reference to the drawings, but can be changed as needed, and the changes made are included in the protection scope of the present application. The drawings of the present application are only used to illustrate the relative positional relationship and do not represent the true proportions.

[0055] It is to be understood that the details set forth herein do not construe a complete description of the application, but rather only a possible embodiment thereof. The application is particularly susceptible to variations in the art, which would be recognized by those of ordinary skill in the art and having the benefit of this disclosure. Accordingly, the concrete embodiments of the application as set forth are not to be taken as restrictive but are to be understood to cover all variations falling within the broad framework of the application. The application is to be limited only by the claims set forth below.

[0056] The network threat detection method and related hardware provided by the embodiments of the application are specifically described below with reference to the accompanying drawings.

[0057] The embodiments of the application provide a network threat detection method, which specifically includes the following steps. Figure 1 Figure 2 As shown in the drawings, the network threat detection method specifically includes the following steps.

[0058] S100, obtaining target network traffic corresponding to a target node.

[0059] In the specific implementation process, for the network attack of APT and the like, other nodes that have communicated with the controlled node needing to be protected against network attacks can be taken as the target node, and then the network traffic generated by the mutual communication between the target node and the controlled node needing to be protected against network attacks is determined as the target network traffic. For example, for a large network system needing to be protected against network attacks, the internal nodes of the network system are the controlled nodes needing to be protected against network attacks, and then the external nodes of the network system that have network communication with the internal nodes of the network system belong to the target nodes. Specifically, the network traffic generated by the controlled node needing to be protected against network attacks can be monitored in real time, and the network traffic of the internal controlled node and the external communication of the network system is determined as the target network traffic, and the external node corresponding to the target network traffic is determined as the target node and updated to the target node table stored persistently. The target network traffic can be collected and acquired through the controlled node needing to be protected against network attacks itself, the switches, routers, network defense servers and the like devices through which the target network traffic passes in the communication process. Among them, the network traffic collection probe (for example, Zeek) can be deployed in the above-mentioned devices, the target network traffic is collected through the traffic collection probe and transmitted to the device implementing the network threat detection method of the embodiments of the application by using the message distribution program (for example, Kafka, RabbitMQ and the like). The device implementing the network threat detection method of the embodiments of the application acquires the target network traffic through the Flink distributed computing engine and the like, and updates the target node corresponding to the target network traffic to the structured query language (Structured Query Language, SQL) database.

[0060] ​S120, according to the preset time window, the target network traffic is extracted, and at least one network traffic feature sequence is obtained.

[0061] Different network traffic feature sequences contain different types of network traffic features.

[0062] In the implementation process, the size of the time window can be set as needed. For example, if the target network traffic corresponds to a long time (for example, the target network traffic corresponds to several months), the time window can be set to 1 hour.

[0063] For example, the type of network traffic feature can include at least one of the following:

[0064] The number of data packets of the target network traffic, the number of source IP addresses involved in the target network traffic, the number of source ports involved in the target network traffic, the number of target IP addresses involved in the target network traffic, the number of target ports involved in the target network traffic, the number of data packets of the preset communication protocol in the target network traffic, the number of data packets of the preset communication protocol in the target network traffic, the data volume of the target network traffic, and the number of connection requests initiated by each target node.

[0065] Then, for each type of network traffic feature set, the feature is extracted according to the preset time window to obtain the network traffic feature value of the type. The network traffic feature values of the same type are arranged in time window order to form a network traffic feature sequence. Thus, the network traffic feature sequences of different network traffic feature types are obtained.

[0066] For each network traffic feature, the following steps are performed respectively Figure 1 and Figure 2 Only the steps of one network traffic feature sequence are shown in the above steps, and the steps of the remaining network traffic feature sequences are the same, so they can be inferred accordingly.

[0067] S130, for the network traffic feature sequence corresponding to the current type of network traffic feature, a main evaluation model is used to determine the corresponding main evaluation factor sequence.

[0068] The main evaluation factor sequence is composed of main evaluation factors corresponding to each time window arranged in time window order. For any main evaluation factor in the main evaluation factor sequence, the main evaluation factor represents the preliminary estimated feature value of the current type of network traffic feature in the corresponding time window when the target node is free of network threats.

[0069] In a specific implementation process, the main evaluation model can adopt a linear relationship fitting model such as an autoregressive integrated moving average (ARIMA) model, a seasonal autoregressive integrated moving average (SARIMA) model, and the like. In this way, for any main evaluation factor in the main evaluation factor sequence, the main evaluation factor represents a linear variation characteristic value of the network traffic feature of the current category in the corresponding time window when the target node is free of network threats.

[0070] Optionally, the main evaluation model is an ARIMA model. Correspondingly, the step S130 is specifically:

[0071] The ARIMA model is used to model the network traffic feature sequence of the current category to obtain an evaluation formula, the main evaluation factor corresponding to each time window in the network traffic feature sequence is determined according to the evaluation formula, and the main evaluation factors are arranged in the order of time windows to form the main evaluation factor sequence.

[0072] In the modeling process using the ARIMA model, the autoregressive order can be set according to the period of the periodic variation rule of the normal network traffic when no network attack occurs. For example, if the time window is set to 1 hour, the autoregressive order can be set to 240 according to a period of 10 days in the modeling process using the ARIMA model, considering that the normal network traffic feature generally varies periodically in a week. In addition, in the modeling process using the ARIMA model, the difference order can be set to 2 and the moving average order can be set to 1. After obtaining the evaluation formula modeled using the ARIMA model, each time window is taken as an input of the evaluation formula, so as to obtain the main evaluation factor corresponding to each time window given by the evaluation formula.

[0073] S140, obtaining an evaluation deviation sequence according to the difference between the network traffic feature sequence and the main evaluation factor sequence.

[0074] The evaluation deviation sequence is composed of evaluation deviation values corresponding to each time window arranged in the order of time windows.

[0075] As an optional implementation, for any evaluation deviation value in the evaluation deviation sequence, the evaluation deviation value is a difference between the current network traffic feature value and the main evaluation factor in the corresponding time window. As another optional implementation, for any evaluation deviation value in the evaluation deviation sequence, the evaluation deviation value is a ratio of a difference between the current network traffic feature value and the main evaluation factor in the corresponding time window to the current network traffic feature value. Of course, the evaluation deviation value can also be implemented in other manners, and the embodiments of the present application do not make too many limitations here.

[0076] S150, determining a corresponding auxiliary evaluation factor sequence according to the evaluation deviation sequence by using the auxiliary evaluation model.

[0077] The auxiliary evaluation factor sequence is composed of auxiliary evaluation factors corresponding to respective time windows in time window order. For any auxiliary evaluation factor in the auxiliary evaluation factor sequence, the auxiliary evaluation factor represents a correction parameter of the preliminary estimated feature value of the current category of network traffic in the corresponding time window when the target node is free of network threats. If the main evaluation model can use a linear relationship fitting model such as an ARIMA model or a SARIMA model, so that the main evaluation factor represents a linear change feature value of the current category of network traffic in the corresponding time window when the target node is free of network threats, then for any auxiliary evaluation factor in the auxiliary evaluation factor sequence, the auxiliary evaluation factor represents a nonlinear change feature value of the current category of network traffic in the corresponding time window when the target node is free of network threats.

[0078] In the specific implementation process, the auxiliary evaluation model can use a pre-trained machine learning model such as a recurrent neural network (RNN), a long short-term memory (LSTM), or a transformer.

[0079] Optionally, the auxiliary evaluation model uses an LSTM model, and the step S150 specifically includes:

[0080] inputting the evaluation deviation sequence into the pre-trained LSTM model to obtain an auxiliary evaluation factor sequence output by the LSTM model.

[0081] In the specific implementation process, the architecture of the LSTM model can be set as needed. For example, a double-layer LSTM can be used as the auxiliary evaluation model, where the number of neurons of the first-layer LSTM is 80, and the number of neurons of the second-layer LSTM is 50.

[0082] In a specific implementation process, the training sample can be set according to the periodic change rule of the normal network traffic when no network attack occurs. For example, if the time window is set to 1 hour, in the process of training the LSTM model, considering that the normal network traffic features generally change periodically in a week, the sequence length of the training sample can be set to 240 according to a time length of 10 days. In addition, for the double-layer LSTM, the dropout rate of the first-layer LSTM can be set to 0.25 and the dropout rate of the second-layer LSTM can be set to 0.2 in the training process, so as to better realize the training of the double-layer LSTM.

[0083] S160, determining an evaluation parameter sequence according to the main evaluation factor sequence and the auxiliary evaluation factor sequence.

[0084] The evaluation parameter sequence is composed of evaluation parameter values corresponding to each time window in sequence.

[0085] As an optional implementation, for any evaluation parameter value in the evaluation parameter sequence, the evaluation parameter value is the sum of the main evaluation factor and the auxiliary evaluation factor in the corresponding time window. As another optional implementation, for any evaluation parameter value in the evaluation parameter sequence, the evaluation parameter value is the product of the main evaluation factor and the auxiliary evaluation factor in the corresponding time window. Of course, the evaluation parameter value can also be implemented in other ways, and the embodiments of the present application do not make too many limitations here.

[0086] S170, determining a detection result for the target node according to the network traffic feature sequence and the evaluation parameter sequence.

[0087] S181, the detection result is that the target node does not exist network threat.

[0088] S182, the detection result is that the target node exists network threat.

[0089] As an optional implementation, the detection result for the target node can be determined according to the difference (hereinafter referred to as actual deviation value) between the network traffic feature value and the evaluation parameter of the same time window in each time window. As another optional implementation, the detection result for the target node can be determined according to the ratio of the network traffic feature value to the evaluation parameter of the same time window in each time window. Of course, other parameters can also be determined according to the network traffic feature sequence and the evaluation parameter sequence to determine the detection result for the target node, and the embodiments of the present application do not make too many limitations here.

[0090] For example, for the implementation of determining the detection result for the target node according to the actual deviation value corresponding to each time window, the detection result for the target node can be determined in any of the following ways:

[0091] (1) As shown in the following formula (1), the method specifically comprises the following steps: Figure 3

[0092] S171, respectively determining actual deviation values corresponding to each time window.

[0093] For any time window, the actual deviation value is the difference between the network traffic feature value and the evaluation parameter.

[0094] S172, judging whether there is a target actual deviation value greater than a preset detection threshold.

[0095] If the result of the step S172 is no, the step S181 is executed; if the result of the step S172 is yes, the step S182 is executed.

[0096] (2) As shown in the following formula (2), the method specifically comprises the following steps: Figure 4

[0097] S171, respectively determining actual deviation values corresponding to each time window.

[0098] For any time window, the actual deviation value is the difference between the network traffic feature value and the evaluation parameter, and the evaluation parameter is the sum of the main evaluation factor and the auxiliary evaluation factor.

[0099] S173, determining a target actual deviation value greater than a preset detection threshold.

[0100] S174, determining a network threat score according to the ratio of each target actual deviation value to the evaluation parameter corresponding to the same time window.

[0101] As an optional implementation manner, the network threat score S can be determined by the following formula:

[0102]

[0103] Wherein, t is a time window, a t is the actual deviation value corresponding to the time window t, p t is the evaluation parameter corresponding to the time window t, and δ is a preset detection threshold.

[0104] As another optional implementation manner, the network threat score S can be determined by the following formula:

[0105]

[0106] Wherein, t is a time window, a t is the actual deviation value corresponding to the time window t, p t is the evaluation parameter corresponding to the time window t, and δ is a preset detection threshold, ​​The number of target actual deviation values.

[0107] Through the above calculation formula of the network threat score, a normalized score value can be obtained, which has high readability. Of course, the network threat score can also be determined in other ways, and the embodiments of the present application do not make too many limitations here.

[0108] S175, determining whether the network threat score is greater than a preset score threshold.

[0109] If the result of step S175 is no, step S181 is executed; if the result of step S175 is yes, step S182 is executed.

[0110] For normal network traffic, the characteristics of network traffic have certain regularity, but due to many factors affecting the change of characteristics and the complexity of the change regularity of characteristics, it is difficult to determine the change regularity of characteristics. The embodiments of the present application analyze the target network traffic of the target node, use the main evaluation model to evaluate the characteristic value of the target network traffic when the target node does not exist network threat, and use the auxiliary evaluation model to correct the evaluation result of the main evaluation model, so as to reduce the evaluation deviation of a single model as much as possible, accurately fit the network traffic to give more accurate evaluation parameters, and judge whether the target network traffic is abnormal based on the evaluation parameters, so as to adapt to the business differences of different network systems, effectively detect whether the target node exists network threat in real time according to the current target network traffic, reduce the occurrence of false positives and false negatives, and improve the network security protection capability.

[0111] If the main evaluation model uses a linear relationship fitting model such as ARIMA, and the auxiliary evaluation model uses a machine learning model such as LSTM, the linear change characteristic value of the target node when there is no network threat can be evaluated by using the main evaluation model, and the nonlinear change characteristic value of the target node when there is no network threat can be evaluated by using the auxiliary evaluation model, so that the normal network traffic with complex change regularity of characteristics can be accurately fitted by linear change angle and nonlinear change angle to give more accurate evaluation parameters, so as to identify APT attacks with characteristics such as long-time low-frequency communication or intermittent communication with the target node.

[0112] Optionally, as shown in Figure 2 Before step S120, the method further includes:

[0113] S110, matching each data packet in the target network traffic by using threat intelligence to determine whether there is a successfully matched data packet.

[0114] In the specific implementation process, the threat intelligence can specifically include at least one of the following:

[0115] a threat domain name, a threat Internet Protocol (IP) address, a threat Media Access Control (MAC) address, a threat Uniform Resource Location (URL), a threat Uniform Resource Identifier (URI), a threat User Agent (UA), a threat cookie, and a threat Transport Layer Security (TLS) fingerprint.

[0116] In a specific implementation, the threat intelligence can be obtained from a threat intelligence sharing platform in the Internet, or manually imported by a network administrator, or automatically generated according to network traffic with an attack behavior recorded locally (for example, updating information about a target node determined to have a network threat by the step S170 to the threat intelligence), which is not limited herein.

[0117] Optionally, the threat intelligence can further include a corresponding threat level, so as to determine a network threat level of the corresponding target node when matching the data packet with an attack behavior according to the threat intelligence, so as to make a corresponding network defense operation according to the network threat level subsequently.

[0118] In a specific implementation, the step S110 can be executed by using a distributed computing engine such as Flink.

[0119] If the result of the step S110 is yes, the step S182 is executed; if the result of the step S110 is no, the step S120 is executed.

[0120] In this way, by matching the data packet in the target network traffic according to the threat intelligence, the network threat of the target node is directly determined after the matching is successful, so as to realize the first heavy filtering of the target network traffic, to quickly detect part of the network threats, and to reduce the number of data packets that need to be detected subsequently, thereby effectively reducing the complexity of the network threat detection scheme.

[0121] Further optionally, after determining that the detection result is that the target node has a network threat, the method can further include: Figure 1 and Figure 2 as shown, the method can further include:

[0122] S190, performing a network protection operation.

[0123] Specifically, the network protection operation can include at least one of the following:

[0124] (1) sending an alarm information to a network administrator.

[0125] In the implementation process, the alarm information can be sent to the network administrator through an email, a phone call, a message of instant messaging software (such as QQ, WeChat, DingTalk, and Feishu), a short message (SMS), a message push of a special software on a terminal of the network administrator, and the like.

[0126] (2) controlling a controlled node connected with the target node to perform a preset disposal operation.

[0127] Further, the preset disposal operation can include: ① controlling the controlled node to block the communication connection with the target node, ② controlling the controlled node to limit the communication with the target node, ③ controlling the controlled node to shut down, ④ controlling the controlled node to collect a running state log of itself, a communication log of the communication connection with the target node, and a data packet communicated with the target node.

[0128] (3) adjusting a device use permission of a target account.

[0129] The target account is an account corresponding to the controlled node connected with the target node. For example, the target account is a user account logged in when the controlled node is connected with the target node, and / or the target user is a device administrator account of the controlled node.

[0130] In the implementation process, the device use permission of the target user can be adjusted by disabling the account of the target user, modifying the use permission of the target account, and the like.

[0131] For example, when the technical scheme of the embodiment of the present application is applied to an internal network system, the target node is an external node not belonging to the internal network system. Although it is possible to directly manipulate the external target node, the subsequent network attack behavior can be avoided by performing the preset disposal operation on the controlled node inside the network system connected with the target node and adjusting the device use permission of the target account.

[0132] Further, in the process of performing the network protection operation, a network protection operation corresponding to the network threat level can be performed according to the network threat level of the target node, so as to maintain the smooth running of the network system as much as possible and reduce the interference on the normal business processing. Accordingly, if it is determined that the target node has a network threat through the step S110, the network threat level of the target node can be determined according to the network threat level corresponding to the threat information matched successfully. If it is determined that the target node has a network threat through the step S170, the network threat score can be determined according to the actual deviation value corresponding to each time window, and the network threat level of the target node can be determined according to the network threat score. For example, the higher the network threat score, the higher the network threat level of the target node, and accordingly, the network protection operation corresponding to the higher network threat level needs to be performed. The network threat score can be determined by using the formula given in the foregoing, or can be determined by using other manners, which is not limited herein by the embodiments of the present application.

[0133] Based on the same inventive concept, the embodiments of the present application also provide a network threat detection device, as shown in the following. Figure 5 The device comprises:

[0134] a feature analysis module M2, configured to perform feature extraction on target network traffic corresponding to a target node according to a preset time window, to obtain at least one network traffic feature sequence; for each network traffic feature, the following steps are performed respectively: according to the network traffic feature sequence corresponding to the current type of network traffic feature, a main evaluation factor sequence corresponding to the current type of network traffic feature is determined by using a main evaluation model; each main evaluation factor in the main evaluation factor sequence represents a preliminary estimated feature value of the current type of network traffic feature in the corresponding time window when the target node has no network threat; an evaluation deviation sequence is obtained according to the difference between the network traffic feature sequence and the main evaluation factor sequence; a secondary evaluation factor sequence corresponding to the evaluation deviation sequence is determined by using a secondary evaluation model according to the evaluation deviation sequence; each secondary evaluation factor in the secondary evaluation factor sequence represents a correction parameter of the preliminary estimated feature value in the corresponding time window when the target node has no network threat; and an evaluation parameter sequence is determined according to the main evaluation factor sequence and the secondary evaluation factor sequence.

[0135] a determination module M3, configured to determine a detection result for the target node according to the network traffic feature sequence and the evaluation parameter sequence, the detection result being used to represent whether the target node has a network threat.

[0136] Optionally, the main evaluation model is an autoregressive integrated moving average (ARIMA) model, and the secondary evaluation model is a long short-term memory (LSTM) network model.

[0137] The network traffic feature sequence corresponding to the current category of network traffic features adopts a main evaluation model to determine a corresponding main evaluation factor sequence, which includes:

[0138] The network traffic feature sequence of the current category adopts an ARIMA model to obtain an evaluation formula, and the main evaluation factor corresponding to each time window in the network traffic feature sequence is determined according to the evaluation formula. Each main evaluation factor is arranged in time window order to form the main evaluation factor sequence;

[0139] The auxiliary evaluation model is used to determine a corresponding auxiliary evaluation factor sequence according to the evaluation deviation sequence, which includes:

[0140] The evaluation deviation sequence is input into a pre-trained LSTM model to obtain the auxiliary evaluation factor sequence output by the LSTM model.

[0141] Optionally, the detection result for the target node is determined according to the network traffic feature sequence and the evaluation parameter sequence, which includes:

[0142] The actual deviation value corresponding to each time window is determined respectively. For any time window, the actual deviation value is the difference between the network traffic feature value and the evaluation parameter;

[0143] If there is a target actual deviation value greater than a preset detection threshold, it is determined that the target node has a network threat detection result;

[0144] Or, if the network threat score is greater than a preset score threshold, it is determined that the target node has a network threat detection result; wherein the network threat score is determined according to the ratio of each target actual deviation value to the corresponding evaluation parameter.

[0145] Optionally, the device further includes:

[0146] The intelligence analysis module M1 is used to match each data packet in the target network traffic using threat intelligence;

[0147] If it is determined that there is a matching successful data packet, it is determined that the target node has a network threat.

[0148] Optionally, the device further includes:

[0149] The response module M4 is used to perform a network protection operation if it is determined that the target node has a network threat;

[0150] The network protection operation includes at least one of the following:

[0151] Sending an alarm information to a network administrator;

[0152] The controlled node in communication connection with the target node is controlled to perform a preset handling operation;

[0153] The device usage permission of a target account corresponding to the controlled node in communication connection with the target node is adjusted.

[0154] Optionally, the response module M4 is specifically configured to: if it is determined that the target node has a network threat, determining a network threat level of the target node, and performing a network protection operation corresponding to the network threat level.

[0155] If it is determined that the target node has a network threat according to the data packet matched with the threat intelligence, the network threat level of the target node is determined according to the threat intelligence matched successfully.

[0156] If it is determined that the target node has a network threat according to the network traffic feature sequence and the evaluation parameter sequence, a network threat score is determined according to the actual deviation value corresponding to each time window, and the network threat level of the target node is determined according to the network threat score.

[0157] For any time window, the actual deviation value is the difference between the network traffic feature value and the evaluation parameter, and the evaluation parameter is the sum of the main evaluation factor and the auxiliary evaluation factor.

[0158] In several embodiments provided in the present application, it should be understood that the above-described device embodiments are only illustrative, for example, the division of the modules is only a logical function division, and actual implementation can have another division mode, for example, a plurality of modules or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed modules can be indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0159] The modules described as separate components can or can not be physically separated, and the components displayed as modules can or can not be physical modules, that is, they can be located in one place, or can be distributed on a plurality of network modules. According to actual needs, some or all of the modules can be selected to achieve the purpose of the present embodiment scheme.

[0160] In addition, each of the functional modules in the various embodiments of the present application can be integrated in one processing module, or each module can be physically present alone, or two or more modules can be integrated in one module. The integrated module can be realized in the form of hardware or in the form of a software functional module. The integrated module, if realized in the form of a software functional module and sold or used as an independent product, can be stored in a computer readable storage medium.

[0161] Since the specific manner in which each of the modules of the network threat detection apparatus performs operations has been described in detail in the content of the corresponding network threat detection method, further description is not repeated here.

[0162] Based on the same inventive concept, the embodiments of the present application also provide an electronic device, as shown in Figure 6 The processor 110 is configured to execute instructions to implement the network threat detection method.

[0163] In the specific implementation process, the device can have great differences due to different configurations or performances, and can include one or more processors 110, memories 120, computer readable storage media 130, one or more application programs 131 or data 132 included in the memory 120 and / or computer readable storage medium 130. One or more operating systems 133, such as Windows, Mac OS, Linux, IOS, Android, Unix, FreeBSD, etc., can also be included in the memory 120 and / or computer readable storage medium 130. Among them, the memory 120 and the computer readable storage medium 130 can be temporary storage or persistent storage. The application program 131 can include one or more modules (not shown in the above), and each module can include a series of instruction operations. Further, the processor 110 can be configured to communicate with the computer readable storage medium 130 and execute a series of instruction operations in the computer readable storage medium 130 on the device. The device can also include one or more power supplies (not shown in the above), one or more network interfaces 140, the network interface 140 including a wired network interface 141 and / or a wireless network interface 142, and one or more input / output interfaces 143. Figure 6 Figure 6

[0164] ​​Based on the same inventive concept, the embodiment of the present application provides a computer readable storage medium, which stores computer program codes, and when the computer program codes are run on a computer, the computer is caused to implement the network threat detection method.

[0165] The computer readable storage medium can be any available medium or a data storage device such as a server, data center, etc. integrated with one or more available medium sets. The available medium can be a magnetic medium (such as a floppy disk, a hard disk, a U disk, a magnetic tape, a read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM)), an optical medium (such as a high-density digital video disc (Digital Video Disc, DVD), a video compact disc (Video Compact Disc, VCD)), or a semiconductor medium (such as a solid state disk (Solid State Disk, SSD)) and the like.

[0166] Since the problem-solving principle of the above computer readable storage medium is consistent with the network threat detection method described above, the implementation of the above computer readable storage medium can refer to the implementation of the method, and the repeated parts will not be described.

[0167] Based on the same inventive concept, the embodiment of the present application also provides a computer program product, which comprises computer program codes, and when the computer program codes are run on a computer, the computer is caused to implement the network threat detection method.

[0168] The computer program product comprises one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another, for example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line (Digital Subscriber Line, DSL)) or wireless (such as infrared, wireless, microwave, etc.).

[0169] Since the problem-solving principle of the above computer program product is consistent with the network threat detection method described above, the implementation of the above computer program product can refer to the implementation of the method, and the repeated parts will not be described.

[0170] The network threat detection method and related hardware provided by the embodiment of the present application can reduce the evaluation deviation of a single model as much as possible, accurately fit the network traffic to give more accurate evaluation parameters, and determine whether the target network traffic is abnormal based on the evaluation parameters, thereby adapting to the business differences of different network systems, effectively detecting whether the target node has a network threat, reducing the occurrence of false positives and false negatives, and improving the network security protection capability.

[0171] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can adopt a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program codes.

[0172] The present application is described with reference to flowcharts and / or block diagrams according to the methods, devices (systems), and computer program products of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to produce a machine, so that the instructions executed by the computer or other programmable data processing devices produce a device that implements the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in one or more flows and / or blocks. Figure 1 The devices that implement the functions specified in one or more flows and / or blocks.

[0173] These computer program instructions can also be stored in a computer-readable memory that can guide the computer or other programmable data processing devices to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including instruction devices that implement the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in one or more flows and / or blocks. Figure 1 The devices that implement the functions specified in one or more flows and / or blocks.

[0174] These computer program instructions can also be loaded into a computer or other programmable data processing device, so that a series of operation steps are performed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide a process for implementing the functions specified in the flowcharts and / or block diagrams.Figure 1 one or more processes and / or functions specified in one or more blocks Figure 1 one or more blocks or any combination thereof.

[0175] It will be apparent to those skilled in the art that various modifications and variations can be made to the present application without departing from the spirit or scope of the application. Thus, it is intended that the present application cover modifications and variations of this application provided they come within the scope of the appended claims and their equivalents.

Claims

1. A network threat detection method, characterized by, The method comprises the following steps: feature extraction is performed on the target network traffic corresponding to the target node according to a preset time window, and at least one network traffic feature sequence is obtained; for each network traffic feature, the following steps are performed: a main evaluation factor sequence corresponding to the current category of network traffic features is determined by using a main evaluation model according to the network traffic feature sequence corresponding to the current category of network traffic features; each main evaluation factor in the main evaluation factor sequence represents a preliminary estimated feature value of the current category of network traffic features in the corresponding time window when the target node is free of network threats; an evaluation deviation sequence is obtained according to the difference between the network traffic feature sequence and the main evaluation factor sequence; a secondary evaluation factor sequence corresponding to the evaluation deviation sequence is determined by using a secondary evaluation model; each secondary evaluation factor in the secondary evaluation factor sequence represents a correction parameter of the preliminary estimated feature value in the corresponding time window when the target node is free of network threats; an evaluation parameter sequence is determined according to the main evaluation factor sequence and the secondary evaluation factor sequence; a detection result for the target node is determined according to the network traffic feature sequence and the evaluation parameter sequence, and the detection result is used to represent whether the target node has a network threat.

2. The method of claim 1, wherein, The main evaluation model is an ARIMA model, and the secondary evaluation model is an LSTM model; the main evaluation factor sequence corresponding to the current category of network traffic features is determined by using a main evaluation model according to the network traffic feature sequence corresponding to the current category of network traffic features, which comprises the following steps: an evaluation formula is obtained by modeling the network traffic feature sequence of the current category by using an ARIMA model, the main evaluation factor corresponding to each time window in the network traffic feature sequence is determined according to the evaluation formula, and the main evaluation factors are arranged in the order of time windows to form the main evaluation factor sequence; the secondary evaluation factor sequence corresponding to the evaluation deviation sequence is determined by using a secondary evaluation model, which comprises the following steps: the evaluation deviation sequence is input into a pre-trained LSTM model to obtain the secondary evaluation factor sequence output by the LSTM model.

3. The method of claim 1, wherein, the detection result for the target node is determined according to the network traffic feature sequence and the evaluation parameter sequence, which comprises the following steps: actual deviation values corresponding to each time window are determined respectively; for any time window, the actual deviation value is the difference between the network traffic feature value and the evaluation parameter; if there is a target actual deviation value greater than a preset detection threshold, it is determined that the target node has a network threat; or, if a network threat score is greater than a preset score threshold, it is determined that the target node has a network threat; wherein the network threat score is determined according to the ratio of each target actual deviation value to the corresponding evaluation parameter.

4. The method of claim 1, wherein, Before the feature extraction is performed on the target network traffic corresponding to the target node according to the preset time window, the method further comprises the following steps: each data packet in the target network traffic is matched by using threat intelligence to determine data packets without successful matching; the method further comprises the following steps: If it is determined that there is a matching successful data packet, it is determined that the target node has a network threat.

5. The method according to any one of claims 1 to 4, characterized in that, The method further includes: If it is determined that the target node has a network threat, a network protection operation is performed. The network protection operation includes at least one of the following: sending an alarm message to a network administrator; controlling a controlled node in communication connection with the target node to perform a preset handling operation; adjusting a device usage permission of a target account corresponding to the controlled node in communication connection with the target node.

6. The method of claim 5, wherein, The network protection operation specifically includes: determining a network threat level of the target node, and performing a network protection operation corresponding to the network threat level; If the target node is determined to have a network threat according to the data packet matching the threat intelligence, the network threat level of the target node is determined according to the matching threat intelligence. If the target node is determined to have a network threat according to the network traffic feature sequence and the evaluation parameter sequence, a network threat score is determined according to the actual deviation value corresponding to each time window, and the network threat level of the target node is determined according to the network threat score. For any time window, the actual deviation value is the difference between the network traffic feature value and the evaluation parameter, and the evaluation parameter is the sum of the main evaluation factor and the auxiliary evaluation factor.

7. A network threat detection apparatus, characterized by, It includes: a feature analysis module configured to extract features of target network traffic corresponding to a target node according to a preset time window to obtain at least one network traffic feature sequence; For each network traffic feature, the following steps are performed respectively: a main evaluation factor sequence corresponding to the current type of network traffic feature is determined using a main evaluation model according to the network traffic feature sequence corresponding to the current type of network traffic feature; each main evaluation factor in the main evaluation factor sequence represents a linear change characteristic value of the current type of network traffic feature in the corresponding time window when the target node has no network threat; an evaluation deviation sequence is obtained according to the difference between the network traffic feature sequence and the main evaluation factor sequence; an auxiliary evaluation factor sequence corresponding to the evaluation deviation sequence is determined using an auxiliary evaluation model; each auxiliary evaluation factor in the auxiliary evaluation factor sequence represents a nonlinear change characteristic value of the current type of network traffic feature in the corresponding time window when the target node has no network threat; and an evaluation parameter sequence is determined according to the main evaluation factor sequence and the auxiliary evaluation factor sequence; a determination module configured to determine a detection result for the target node according to the network traffic feature sequence and the evaluation parameter sequence, the detection result being used to indicate whether the target node has a network threat.

8. An electronic device, comprising: It includes: a processor and a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the network threat detection method of any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program code which, when executed on a computer, causes the computer to perform the network threat detection method of any one of claims 1-6.

10. A computer program product, characterised in that, The computer program product comprises computer program code which, when run on a computer, causes the computer to perform the network threat detection method as claimed in any of claims 1-6.

Images