Malicious IP processing method and device, electronic equipment and storage medium

Abstract

The invention discloses a malicious IP processing method and device, electronic equipment and a storage medium. The method comprises the steps of performing preprocessing according to acquired source data; performing machine learning feature extraction according to the preprocessed source data to obtain a first feature set, and inputting the first feature set into a machine learning model to obtain a first malicious IP set; performing deep learning feature extraction according to the preprocessed source data to obtain a second feature set, and inputting the second feature set into a deep learning model to obtain a second malicious IP set; determining an attack graph according to the source data, and performing attack evaluation according to the attack graph to obtain an evaluation result; a forbidding strategy is determined according to the evaluation and the malicious IP, the malicious IP is forbidden according to the forbidding strategy, and the malicious IP comprises a first malicious IP set and a second malicious IP set. The malicious IP can be identified through a machine learning model and a deep learning model. On the basis of accurately identifying the malicious IP, the malicious IP is automatically forbidden.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence technology, and specifically relates to a method, device, electronic device and storage medium for processing malicious IP. Background Art

[0002] With the continuous development and evolution of network attack technology, traditional network security defense methods have been unable to cope with increasingly complex attack scenarios.

[0003] Currently, it is necessary to manually check malicious IP addresses based on network logs. After the malicious IP is identified, it is necessary to manually isolate and notify the malicious IP attack. How to automatically and accurately identify malicious IPs and automatically ban malicious IPs has become an urgent problem to be solved. Summary of the invention

[0004] The purpose of the present invention is to provide a method, device, electronic device and storage medium for processing malicious IP, which can automatically and accurately identify and block malicious IP.

[0005] According to a first aspect of the present invention, a method for processing a malicious IP is provided, comprising:

[0006] Preprocessing is performed according to the acquired source data, wherein the source data includes network traffic data;

[0007] Perform machine learning feature extraction based on the preprocessed source data to obtain a first feature set, and input the first feature set into a machine learning model to obtain a first malicious IP set;

[0008] Perform deep learning feature extraction based on the preprocessed source data to obtain a second feature set, and input the second feature set into a deep learning model to obtain a second malicious IP set;

[0009] Determine an attack graph according to the source data, perform attack evaluation according to the attack graph, and obtain an evaluation result;

[0010] A banning strategy is determined based on the evaluation and malicious IPs, and malicious IPs are banned based on the banning strategy. The malicious IPs include the first malicious IP set and the second malicious IP set.

[0011] According to a second aspect of the present invention, a malicious IP processing device is provided, comprising:

[0012] A preprocessing module, used for preprocessing according to the acquired source data, wherein the source data includes network flow data;

[0013] A machine learning identification module, used to perform machine learning feature extraction based on the preprocessed source data to obtain a first feature set, and input the first feature set into a machine learning model to obtain a first malicious IP set;

[0014] A deep learning identification module, used for performing deep learning feature extraction based on the preprocessed source data to obtain a second feature set, and inputting the second feature set into a deep learning model to obtain a second malicious IP set;

[0015] An attack assessment module, used to determine an attack graph according to the source data, perform attack assessment according to the attack graph, and obtain an assessment result;

[0016] A blocking module is used to determine a blocking strategy based on the evaluation and malicious IPs, and to block malicious IPs based on the blocking strategy. The malicious IPs include the first malicious IP set and the second malicious IP set.

[0017] According to a third aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0018] at least one processor; and

[0019] a memory communicatively connected to the at least one processor; wherein,

[0020] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method for processing malicious IP described in any embodiment.

[0021] According to a fourth aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method for processing malicious IP described in any embodiment of the present invention when executed.

[0022] The technical solution provided by the present invention performs preprocessing according to the acquired source data, performs machine learning feature extraction according to the preprocessed source data, obtains a first feature set, inputs the first feature set into the machine learning model, obtains a first malicious IP set; performs deep learning feature extraction according to the preprocessed source data, obtains a second feature set, inputs the second feature set into the deep learning model, obtains a second malicious IP set; determines an attack graph according to the source data, performs attack evaluation according to the attack graph, and obtains an evaluation result; determines a banning strategy according to the evaluation and malicious IP, bans malicious IP according to the banning strategy, and the malicious IP includes the first malicious IP set and the second malicious IP set. Compared with the current manual malicious IP identification, the present invention can identify malicious IPs respectively through machine learning models and deep learning models. In addition, in addition to identifying malicious IPs, the present invention can also determine an attack graph according to source data, and perform attack evaluation according to the attack graph, combine the evaluation result and the malicious IP to determine the banning strategy, and ban the malicious IP according to the banning strategy. On the basis of accurately identifying malicious IPs, the automated banning of malicious IPs is achieved to improve the efficiency of malicious IP banning.

[0023] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 It is a flowchart of a method for processing a malicious IP provided by an embodiment of the present invention;

[0026] Figure 2 It is a schematic diagram of the structure of a malicious IP processing device provided by an embodiment of the present invention;

[0027] Figure 3 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] With the continuous development and evolution of network attack technology, traditional network security defense methods have been unable to cope with increasingly complex attack scenarios.

[0031] Currently, it is necessary to manually check malicious IP addresses based on network logs. Malicious IP is also called malicious IP address (Internet Protocol Address). After the malicious IP is determined, it is necessary to manually isolate and notify the malicious IP attack. Manual intervention cannot achieve automated response, resulting in low defense efficiency. It is difficult to effectively identify new attack methods and covert attacks, such as using encrypted traffic for covert attacks. Traditional methods are difficult to detect malicious encrypted traffic in covert tunnels, such as TLS encrypted traffic. Traditional response methods require manual confirmation and operation, resulting in slow response speed and failure to prevent attacks in time.

[0032] In order to solve the above problems, the present invention provides a solution for processing malicious IPs, so as to realize automatic identification and blocking of malicious IPs.

[0033] Figure 1 : is a flowchart of a method for processing malicious IPs provided by an embodiment of the present invention. This embodiment is applicable to the situation of identifying and blocking malicious IPs in the field of network security. The method can be executed by a malicious IP processing device, which can be implemented in the form of hardware and / or software. The method includes:

[0034] S101. Preprocessing is performed according to acquired source data, where the source data includes network traffic data.

[0035] You can use network traffic analysis tools to collect network traffic data, including but not limited to: TLS handshake phase data, certificate data, network connection information or network traffic content. Among them, TLS handshake phase data includes encryption suite type, certificate length, certificate authority, etc. Certificate data includes: certificate validity period, certificate signature algorithm, etc. Network connection information, including: source IP address, destination IP address, port number, etc. Network traffic content, including: HTTP request, DNS request, etc. The collected data can be stored in a database.

[0036] In addition, source data may also include other data sources. The other data sources include, but are not limited to: host information, user behavior data, device information or threat intelligence data. Host information includes operating system version, hardware configuration, open ports, etc. User behavior data includes access mode, login behavior, browsing habits, etc. Device information includes location, network type, device type, etc. Threat intelligence data includes known malicious IPs, malware samples, etc. Using multiple source data can more comprehensively characterize the characteristics of malicious IPs, thereby improving the recognition ability of the model.

[0037] Preprocessing the collected network traffic data includes data cleaning and data standardization. Data cleaning includes removing redundant data, abnormal data, etc. Data standardization includes converting data into a unified format and range.

[0038] The preprocessing process of data from other data sources includes data cleaning and data standardization. Specifically, data cleaning includes removing redundant data, abnormal data, etc. to ensure data quality. Data standardization includes converting data into a unified format and range, such as normalizing different types of data.

[0039] S102. Perform machine learning feature extraction based on the preprocessed source data to obtain a first feature set, and input the first feature set into a machine learning model to obtain a first malicious IP set.

[0040] Optionally, use machine learning feature extraction methods to extract handshake features and certificate features of TLS traffic, such as encryption suite type, certificate length, certificate authority, certificate validity period, etc.

[0041] Furthermore, a machine learning algorithm (eg, random forest, support vector machine, etc.) may be used to train the extracted features and establish a machine learning model for identifying malicious IPs.

[0042] S103. Perform deep learning feature extraction based on the preprocessed source data to obtain a second feature set, and input the second feature set into a deep learning model to obtain a second malicious IP set.

[0043] Optionally, deep learning feature extraction methods are used to convert traffic data into images, without the need for manual feature engineering, and the algorithm automatically learns data features.

[0044] For other data sources used in deep learning models, when performing deep learning feature extraction, appropriate feature extraction methods can be selected based on the data type and characteristics. For example, for host information, features such as operating system version, hardware configuration, and open ports can be extracted; for user behavior data, features such as access mode, login behavior, and browsing habits can be extracted.

[0045] Since deep learning models usually require image data as input, the source data needs to be converted into image data. When converting data from other data sources into image data, there are several ways to achieve it.

[0046] Data visualization: Present the data in the form of graphs or charts and convert them into image data. Feature map generation: Use deep learning models to convert features from other data sources into feature maps and input them into deep learning models as image data. Embedding technology: Use embedding technology to map features from other data sources into a low-dimensional space and input them into deep learning models as image data.

[0047] In the context of malicious IP identification, the purpose of classification is to determine whether the input IP address is a malicious IP. The deep learning model obtains whether the IP address is a malicious IP.

[0048] After obtaining the classification result of whether the IP is a malicious IP. In the subsequent execution steps, you can participate in the following processes. Banning strategy: According to the classification results, select the appropriate banning strategy, such as short-term ban, long-term ban or observation. Threat intelligence update: Add the identified malicious IP to the threat intelligence library for subsequent security protection. Security incident analysis: Analyze the behavior patterns of malicious IPs, understand their attack methods, and formulate corresponding defense measures. Security policy optimization: According to the results of malicious IP identification, optimize the security policy and improve the security of the system.

[0049] In malicious IP identification, the purpose of classification is to determine whether the input IP address is a malicious IP. The classified data can be used for blocking strategies, threat intelligence updates, security incident analysis, and security policy optimization to improve system security.

[0050] Furthermore, deep learning algorithms (e.g., convolutional neural networks, recurrent neural networks, etc.) can be used to train image features and establish a deep learning model for identifying malicious IPs. After the deep learning model is trained, the trained model is evaluated. The evaluation can be performed based on accuracy, recall rate, or F1 value, and then optimized.

[0051] The training of deep learning models can be enhanced in the following ways.

[0052] Optionally, before inputting the second feature set into the deep learning model to obtain the second malicious IP set, the method further includes:

[0053] Graph features are determined based on the graph neural network and the preprocessed source data; and the deep learning model is trained using the graph features based on the end-to-end learning mechanism.

[0054] Graph Neural Networks (GNN) is a deep learning model specifically designed to process graph structured data. It can effectively learn the representation of nodes, edges, and the entire graph in graph structured data, and can be applied to a variety of tasks, such as node classification, link prediction, and graph classification.

[0055] For other data sources, such as host information, user behavior data, device information, etc., they can be represented as graph structures, and graph neural networks can be used for feature extraction. Graph structure data refers to data with connection relationships between nodes, such as social networks, knowledge graphs, molecular structures, etc.

[0056] Represent other data sources as graph structures. Specifically, for host information, you can consider hosts as nodes, network connections between hosts as edges, and build a host information graph. For user behavior data, you can consider users as nodes, interactions between users as edges, and build a user behavior graph. For device information, you can consider devices as nodes, communications between devices as edges, and build a device information graph.

[0057] Through graph neural networks, we can learn the representation of nodes, edges, and the entire graph, thereby extracting more effective features. Graph neural networks can capture the relationship between nodes in graph structured data, such as network connections between hosts, interactions between users, and communications between devices. These features can be used for tasks such as malicious IP identification to improve the recognition ability of the model.

[0058] In the above implementation, graph neural networks can be used to extract features from other data sources, but the premise is that the data can be represented as a graph structure. After other data sources are represented as a graph structure, graph neural networks can be used to learn the representation of nodes, edges, and the entire graph, thereby extracting more effective features and improving the recognition ability of the model.

[0059] The above implementation method can improve the performance of the malicious IP identification model. The end-to-end learning method can better utilize the advantages of graph neural networks, thereby improving the recognition accuracy and efficiency of the model.

[0060] Graph neural networks can learn representations of nodes, edges, and entire graphs, thereby extracting more comprehensive features that can better characterize the characteristics of network traffic data, improve the recognition ability of the model, and achieve more comprehensive feature representation.

[0061] The end-to-end learning approach can fuse the features extracted by graph neural networks with machine learning or deep learning models to more effectively utilize these features, improve model performance, and achieve more effective feature fusion.

[0062] The end-to-end learning method can avoid the process of converting features into image data, thereby speeding up the training of the model and achieving faster model training.

[0063] Graph neural networks can learn the representation of nodes, edges, and the entire graph, thereby extracting more comprehensive features. For example, in network traffic data, graph neural networks can learn the connection relationship between IP addresses, communication traffic characteristics, etc. These features can better characterize the behavior patterns of malicious IPs and improve the recognition accuracy of the model.

[0064] End-to-end learning can integrate the features extracted by graph neural networks with machine learning or deep learning models. For example, the features extracted by graph neural networks can be used as input to convolutional neural networks for classification, thereby making more effective use of these features and improving the performance of the model.

[0065] The end-to-end learning method can avoid the process of converting features into image data, thereby speeding up the training of the model. For example, the features extracted by the graph neural network can be directly input into the machine learning or deep learning model for training, thereby avoiding the additional computation caused by feature conversion and speeding up the training of the model.

[0066] The above implementation combines a graph neural network with a machine learning or deep learning model for end-to-end learning. For example, a graph neural network can be used to extract features of network traffic data, which can then be used as input to a machine learning or deep learning model for classification.

[0067] Furthermore, after determining the graph features based on the graph neural network and the preprocessed source data, it also includes: determining the target graph features from the graph features based on the attention mechanism.

[0068] Accordingly, according to the end-to-end learning mechanism, the deep learning model is trained using graph features, including: according to the end-to-end learning mechanism, the deep learning model is trained using target graph features.

[0069] The above implementation method can improve the performance of the malicious IP identification model. The end-to-end learning method can better utilize the advantages of graph neural networks, thereby improving the recognition accuracy and efficiency of the model.

[0070] The above implementation method can improve the performance of the malicious IP identification model. The end-to-end learning method can better utilize the advantages of graph neural networks, thereby improving the recognition accuracy and efficiency of the model.

[0071] There is a close relationship between the attention mechanism and the malicious IP identification model. The attention mechanism can be used as an auxiliary tool to improve the performance and efficiency of the malicious IP identification model.

[0072] The functions of the attention mechanism include: Focusing on key information: The attention mechanism can help the model identify key information in the input data, such as abnormal patterns and features in network traffic data. Highlighting important features: The attention mechanism can increase the model's attention to key information and reduce the attention to non-key information, thereby highlighting important features. Improving model performance: The attention mechanism can help the model better learn the characteristics of malicious IPs and improve the model's recognition accuracy. Improving model efficiency: The attention mechanism can help the model identify malicious IPs faster, thereby improving the efficiency of the model.

[0073] The attention mechanism can play the following roles in deep learning models: Network traffic data analysis: The attention mechanism can be used to analyze network traffic data and identify abnormal patterns, such as abnormal connection behavior, abnormal data packet content, etc. Feature extraction: The attention mechanism can be used to extract key features in network traffic data, such as features in the TLS handshake phase, certificate features, etc. Model training: The attention mechanism can be used to train malicious IP recognition models and improve the recognition accuracy of the models.

[0074] In the above real-time method, the attention mechanism can help the model identify key information in the input data, thereby improving the performance and efficiency of the model. In the malicious IP identification model, the attention mechanism can be used as an auxiliary tool to analyze network traffic data.

[0075] Furthermore, after the deep learning model is trained using the graph features, the method further includes: performing adversarial training on the trained deep learning model according to adversarial samples.

[0076] Adversarial training is to further train the deep learning model or machine learning model after the model training is completed, so that it can identify and defend against adversarial attacks, thereby improving the robustness of the model.

[0077] The adversarial training process includes the following steps. Step 1: Generate adversarial samples: Use adversarial sample generation methods, such as FGSM (Fast Gradient Sign Method) or PGD (Projected Gradient Descent) to generate adversarial samples. Step 2: Adversarial sample training: Use the generated adversarial samples to train the model so that the model can recognize and defend against adversarial attacks. Step 3: Evaluate model robustness: Use adversarial samples to evaluate the robustness of the model, such as using indicators such as accuracy and recall of adversarial samples.

[0078] Adversarial training is performed after model training is completed to improve the robustness of the model. Adversarial training uses adversarial samples for training, enabling the model to identify and defend against adversarial attacks. Adversarial training can be combined with the model training process, for example, adding adversarial sample training to the model training process to improve the robustness of the model.

[0079] The adversarial training process is complementary to the previous model training process. Adversarial training is performed after model training is completed to improve the robustness of the model. Adversarial training uses adversarial samples for training, enabling the model to identify and defend against adversarial attacks. Adversarial training can be combined with the model training process to improve the robustness of the model.

[0080] Adversarial training can help models identify and defend against adversarial attacks, thereby improving the robustness of the model. Adversarial training methods can be used to train malicious IP identification models so that they can identify adversarial attacks and make accurate judgments.

[0081] Furthermore, before inputting the second feature set into the deep learning model to obtain the second malicious IP set, it also includes: obtaining a trained malicious IP identification model based on transfer learning; and adjusting the trained malicious IP identification model to obtain a deep learning model.

[0082] Transfer learning refers to fine-tuning a trained model on a new task to improve the model's performance on the new task. You can consider using a malicious IP identification model trained on a public dataset and then migrating it to a malicious IP identification scenario for fine-tuning. Transfer learning can accelerate the model training process and improve the model's generalization ability in specific scenarios.

[0083] Generalization capability refers to improving the generalization ability of the above deep learning model or machine learning model. Generalization capability means that the model can still maintain a high accuracy rate on new and unseen data.

[0084] When new malicious IPs appear, the model can accurately identify them and ban them in a timely manner, thereby protecting network security and achieving rapid identification of new malicious IPs.

[0085] The model can maintain a high accuracy in different network environments, such as different network scales, network topologies, etc., and adapt to different network environments.

[0086] When new attack methods emerge, the model can adapt to the new attack patterns and still accurately identify malicious IPs to respond to new attack methods.

[0087] The generalization learning process can include the following steps:

[0088] Step 1. Select a public dataset: Select a public malicious IP identification dataset that contains a large number of known malicious IPs and normal IPs.

[0089] Step 2: Train the initial model: Use the public dataset to train an initial malicious IP identification model, such as using a convolutional neural network or a recurrent neural network.

[0090] Step 3. Collect data for specific scenarios: Collect network traffic data for your specific scenario and mark the malicious IPs and normal IPs.

[0091] Step 4: Transfer learning: Use the collected scenario-specific data to fine-tune the initial model, such as training with a small number of samples or using knowledge distillation techniques.

[0092] Step 5: Evaluate model performance: Use specific scenario data to evaluate the performance of the fine-tuned model, such as using indicators such as accuracy and recall.

[0093] Step 6. Deploy the model: Deploy the fine-tuned model to your system for malicious IP identification.

[0094] Transfer learning can improve the generalization ability of the malicious IP identification model, enabling it to identify new malicious IPs, adapt to different network environments, and respond to new attack methods. The specific generalization learning process includes selecting public data sets, training initial models, collecting specific scenario data, transfer learning, evaluating model performance, and deploying models.

[0095] S104: determining an attack graph according to the source data, performing attack evaluation according to the attack graph, and obtaining an evaluation result.

[0096] The output of the deep learning model and the generation of the attack path are two independent processes. The deep learning model is used to identify malicious IPs, and the generation of the attack path is based on the analysis of network traffic data and attack graphs / attack trees. The features extracted by the deep learning model can assist in attack path analysis.

[0097] Optionally, determining an attack graph according to the source data, performing attack evaluation according to the attack graph, and obtaining an evaluation result includes:

[0098] Determine an attack path based on source data; calculate a comprehensive score for each path based on the CVSS score and path length of each vulnerability on the attack path; and determine an attack level based on the comprehensive score.

[0099] Determine the attack graph or attack tree based on the source data. Based on the attack graph or attack tree, evaluate the attack impact, such as attack target, attack path, attack intensity, etc. Perform weighted summation on the comprehensive scores of all attack paths to obtain the attack surface value. Based on the attack surface value, classify the attack impact level into different levels, such as low, medium, high, and very high.

[0100] A vulnerability refers to every hole on the attack path, which is a weakness that an attacker may exploit, such as software vulnerabilities, configuration errors, security policy flaws, etc.

[0101] Methods for determining vulnerabilities include but are not limited to the following:

[0102] 1. Vulnerability scanning tools: Use vulnerability scanning tools to scan the system and find potential vulnerabilities. For example, you can use vulnerability scanning tools such as Nessus, OpenVAS, and AWVS.

[0103] 2. Security assessment: Conduct security assessments, such as penetration testing and code audits, to identify potential vulnerabilities.

[0104] 3. Security announcements and notices: Pay attention to vulnerability announcements and notices released by security vendors and vulnerability databases to learn about known vulnerability information.

[0105] 4. Security Community: Pay attention to security communities, such as vulnerability bounty platforms, security forums, etc., to learn the latest vulnerability information and vulnerability trends.

[0106] CVSS (Common Vulnerability Scoring System) is a scoring system used to assess the severity of vulnerabilities. It takes into account the attack complexity, attack vector, attack impact and other indicators of the vulnerability and gives a score from 0 to 10. The CVSS score reflects the severity of the vulnerability, and the path length reflects the number of steps an attacker needs to go through. The weighted sum of the comprehensive scores of all attack paths is used to obtain the attack surface value. The attack surface value reflects the potential degree of harm that an attacker may cause to the system.

[0107] The composite score combines the CVSS score and path length to assess the overall risk of each attack path. Below is a simplified example of how the composite score for an attack path is calculated.

[0108] Step 1: Determine the CVSS score for each vulnerability.

[0109] First, you need to determine the CVSS base score for each vulnerability in the attack path. This score is usually provided by vulnerability databases or security experts.

[0110] Step 2: Consider path length.

[0111] Path length refers to the number of vulnerabilities that need to be passed from the attack starting point to the target. Generally, the longer the path, the more difficult the attack is to execute.

[0112] Step 3: Calculate the composite score.

[0113] The comprehensive score can be calculated using the following formula:

[0114] Comprehensive score = (sum of CVSS scores / path length) * attenuation factor

[0115] Alternatively, if you want to give different weights to the CVSS score and path length, you can use the following formula:

[0116] Comprehensive score = (sum of CVSS scores * CVSS weight) / (path length * path length weight)

[0117] in:

[0118] The sum of CVSS scores is the sum of the CVSS scores of all vulnerabilities on the attack path. The attenuation factor is a value less than 1 that is used to reduce the impact of long paths. The CVSS weight and path length weight are set based on specific situations and are used to adjust the relative importance of the CVSS score and path length in the combined score.

[0119] For example, suppose there are three vulnerabilities on an attack path, with CVSS scores of 7.8, 6.5, and 5.9, and a path length of 3. The sum of the CVSS scores is 7.8+6.5+5.9=20.2. The path length is 3. The combined score is 20.2 / 3=6.73 (if there is no attenuation factor or weight). If weights are used, assuming the CVSS weight is 0.7 and the path length weight is 0.3, the combined score is (20.2*0.7) / (3*0.3)=4.73.

[0120] Step 4: Calculate the attack surface constant.

[0121] The comprehensive scores of all attack paths are weighted and summed to obtain the attack surface value. This weighted summation may need to consider the attack probability of different paths or other factors.

[0122] Step 5: Assess the attack impact level.

[0123] Based on the attack surface value, the attack impact level can be divided into different levels. For example, thresholds can be set to distinguish between low, medium, high, and very high levels.

[0124] S105. Determine a banning strategy based on the evaluation and malicious IPs, and ban malicious IPs based on the banning strategy. The malicious IPs include the first malicious IP set and the second malicious IP set.

[0125] Optionally, determining a banning strategy based on the evaluation and malicious IPs includes: obtaining a banning strategy corresponding to an attack level of an attack path, wherein the banning strategy includes a banning operation on malicious IPs included in the attack path.

[0126] You can choose different blocking strategies based on the attack impact level, including:

[0127] Low impact level: You can adopt an observation or recording strategy, such as recording the behavior of malicious IPs, but do not ban them.

[0128] Medium impact level: A temporary ban strategy can be adopted, such as banning the malicious IP for a period of time and then lifting the ban.

[0129] High impact level: A permanent ban strategy can be adopted, such as permanently banning the malicious IP to prevent it from attacking again.

[0130] Extreme impact level: More severe actions may be taken, such as notifying users or relevant authorities and taking other safety measures.

[0131] Optionally, different blocking strategies can be selected based on the attacker's goals.

[0132] For example, if the attacker's goal is to obtain user information, a stricter blocking policy can be adopted to protect user privacy.

[0133] Optionally, when selecting a blocking strategy, the blocking strategy can also be selected based on the cost and benefit of the blocking strategy. For example, a permanent blocking strategy has a higher cost but can more effectively protect system security.

[0134] In addition, the blocking strategy can be adjusted dynamically. The blocking strategy can be adjusted dynamically based on the attack trend and the attacker's behavior. For example, if a certain attack method is found to be more common, a stricter blocking strategy can be adopted.

[0135] You can also combine the blocking strategy with other security measures, such as intrusion detection systems, firewalls, etc., to improve the overall security of the system.

[0136] Through the above steps, you can evaluate the impact of attacks based on attack graphs or attack trees and select appropriate blocking strategies to effectively protect system security.

[0137] The blocking strategies provided by the present invention include but are not limited to the following blocking methods.

[0138] 1. Dynamic blocking based on threat intelligence, including: Integrate threat intelligence data sources: Combine known malicious IPs, malware samples and other information with the attack graph or attack tree in the system to update the blocking list in real time. Dynamically adjust the blocking strategy: Dynamically adjust the blocking strategy according to changes in threat intelligence, such as adding stricter blocking rules for specific types of attacks. Improve the accuracy of blocking: By analyzing threat intelligence, malicious IPs can be identified more accurately to avoid blocking normal visitors by mistake.

[0139] 2. Abnormal behavior detection and blocking, including: Based on machine learning or deep learning models, identify abnormal behavior patterns in network traffic. Combine abnormal behavior with attack graphs or attack trees to assess its potential attack risk. Based on the assessment results, automatically block abnormal behaviors that pose attack risks.

[0140] 3. Automatic unblocking based on machine learning, including: Building a machine learning model to learn the behavior patterns of normal users. Conducting behavioral analysis on the blocked IP to determine whether it is a normal user. If the model determines that the IP is a normal user, the block will be automatically lifted.

[0141] 4. Adaptive blocking strategy, including: dynamically adjusting the blocking threshold and rules according to system load, network traffic, etc. For example, during peak system load periods, the blocking threshold can be lowered to avoid affecting normal visitors.

[0142] 5. Visualization of blocking policies, including: displaying blocking policies to users in a visual way to facilitate user understanding and management. For example, a graphical interface can be used to display attack graphs or attack trees and annotate blocking rules.

[0143] 6. User notification after being banned, including: after being banned, send a notification to the user, explain the reason for the ban and provide a way to unblock. For example, you can send an email or SMS to notify the user and provide a complaint channel.

[0144] 7. Evaluation and optimization of the ban effect, including: establishing an evaluation system to evaluate the effectiveness of the ban strategy. Based on the evaluation results, optimize the ban strategy to improve the accuracy and efficiency of the ban.

[0145] Through the above technical points, the accuracy, efficiency and user experience of automatic blocking of malicious IP addresses can be improved, and the security of the system can be enhanced.

[0146] The method for processing malicious IP provided by the embodiment of the present invention comprises the following steps: Data collection: using a network traffic analysis tool to collect network traffic data. Feature extraction: preprocessing the collected data and extracting features. Model training: using machine learning and deep learning algorithms to train features and establish a malicious IP recognition model. Strategy selection: based on the attack graph or attack tree, assess the impact of the attack and select an appropriate blocking strategy. Blocking execution: automatically block malicious IPs according to the selected blocking strategy.

[0147] The method for processing malicious IP provided by the present invention performs preprocessing according to the acquired source data, performs machine learning feature extraction according to the preprocessed source data, obtains a first feature set, inputs the first feature set into the machine learning model, obtains a first malicious IP set; performs deep learning feature extraction according to the preprocessed source data, obtains a second feature set, inputs the second feature set into the deep learning model, obtains a second malicious IP set; determines an attack graph according to the source data, performs attack evaluation according to the attack graph, and obtains an evaluation result; determines a banning strategy according to the evaluation and the malicious IP, bans the malicious IP according to the banning strategy, and the malicious IP includes the first malicious IP set and the second malicious IP set. Compared with the current manual malicious IP identification, the present invention can identify malicious IPs respectively through machine learning models and deep learning models. In addition, in addition to identifying malicious IPs, the present invention can also determine an attack graph according to source data, and perform attack evaluation according to the attack graph, combine the evaluation result and the malicious IP to determine the banning strategy, and ban the malicious IP according to the banning strategy. On the basis of accurately identifying malicious IPs, automatic banning of malicious IPs is achieved to improve the efficiency of malicious IP banning. With a high degree of automation, no human intervention is required, and malicious IPs can be automatically identified and blocked, thus improving defense efficiency. With strong detection capabilities, new attack methods and covert attacks can be effectively identified, such as covert attacks using encrypted traffic. With fast response speed, attacks can be blocked in a timely manner, preventing attackers from causing greater harm to the network.

[0148] The automated malicious IP identification method based on machine learning and deep learning adopted by the present invention significantly improves the accuracy and efficiency of identification. Traditional technologies often rely on manually set rules or fixed signature matching, which is not only powerless in the face of ever-changing network attack methods, but also difficult to process large-scale network data. Through an intelligent learning process, the present invention can automatically learn and extract features from complex data, thereby more effectively identifying malicious IPs, and maintaining a high recognition rate even in the face of unknown or variant attacks.

[0149] Secondly, the adaptive model training mechanism and intelligent strategy selection system of the present invention provide a more flexible and dynamic network security defense strategy. Compared with the prior art, the present invention can automatically adjust the recognition model and blocking strategy according to the real-time network environment and attack mode, which not only reduces the need for manual intervention, but also can minimize interference with normal network activities while ensuring network security. In addition, the efficiency of the blocking execution module ensures that once a malicious IP is detected, measures can be taken quickly to effectively prevent potential network security threats, thereby protecting network resources and services from damage.

[0150] The present invention has been subjected to a series of experiments and simulation tests to verify its feasibility and effectiveness. The following is a summary of the results of the experiments and simulations:

[0151] Experimental conditions: A simulated network was built in a laboratory environment, which included a variety of services and applications to simulate real network traffic. A variety of known malware and attack scripts were used to simulate the behavior of malicious IPs, while ensuring that normal traffic data existed in the network. The malicious IP automatic identification system of the present invention was tested under these conditions.

[0152] Simulation results: In the simulation test, the present invention can accurately identify more than 95% of malicious IPs, with a false alarm rate of less than 1%, showing a very high recognition accuracy. The system's response time is in milliseconds on average, proving the efficiency of the ban execution module. The adaptive model training mechanism can quickly adjust the model and keep the recognition rate stable when encountering new attack methods.

[0153] Actual use: The present invention was deployed in an actual network environment to protect the internal network of a certain enterprise. In actual use, the system successfully detected and blocked multiple unknown network attack attempts, effectively preventing potential data leaks and security incidents. The operation of the system did not significantly affect network performance, and users did not report normal service interruptions caused by blocking operations.

[0154] In summary, the experimental and simulation results of the present invention show that its technical solution is feasible in practical applications and can effectively improve the protection capability of network security.

[0155] Figure 2 A schematic diagram of the structure of a malicious IP processing device provided in an embodiment of the present invention, wherein the malicious IP processing device is used to implement the malicious IP processing method described above, including:

[0156] A preprocessing module 21, used for preprocessing according to the acquired source data, wherein the source data includes network flow data;

[0157] A machine learning identification module 22, configured to perform machine learning feature extraction based on the preprocessed source data to obtain a first feature set, and input the first feature set into a machine learning model to obtain a first malicious IP set;

[0158] A deep learning identification module 23 is used to perform deep learning feature extraction based on the preprocessed source data to obtain a second feature set, and input the second feature set into a deep learning model to obtain a second malicious IP set;

[0159] An attack evaluation module 24 is used to determine an attack graph according to the source data, perform attack evaluation according to the attack graph, and obtain an evaluation result;

[0160] The blocking module 25 is used to determine a blocking strategy based on the evaluation and malicious IPs, and to block malicious IPs based on the blocking strategy. The malicious IPs include the first malicious IP set and the second malicious IP set.

[0161] On the basis of the above implementation, optionally, a model training module is further included, which is used to determine the graph features according to the graph neural network and the preprocessed source data before inputting the second feature set into the deep learning model to obtain the second malicious IP set;

[0162] According to the end-to-end learning mechanism, the deep learning model is trained using graph features.

[0163] On the basis of the above implementation, optionally, an attention mechanism module is further included, which is used to determine the target graph features from the graph features according to the attention mechanism after determining the graph features according to the graph neural network and the preprocessed source data;

[0164] Correspondingly, the model training module is used to train the deep learning model using graph features according to the end-to-end learning mechanism, including: training the deep learning model using target graph features according to the end-to-end learning mechanism.

[0165] Based on the above implementation, optionally, the model training module is also used to perform adversarial training on the trained deep learning model according to adversarial samples after training the deep learning model using graph features.

[0166] On the basis of the above implementation mode, optionally, a transfer learning module is further included, which is used to obtain a trained malicious IP recognition model according to transfer learning before inputting the second feature set into the deep learning model to obtain the second malicious IP set;

[0167] Adjustments are made according to the trained malicious IP identification model to obtain a deep learning model.

[0168] Based on the above implementation, optionally, the attack assessment module 24 is used to:

[0169] Determine attack paths based on source data;

[0170] Calculate the composite score of each path based on the CVSS score and path length of each vulnerability on the attack path;

[0171] An attack level is determined based on the comprehensive score.

[0172] Based on the above implementation, optionally, the attack assessment module 24 is used to determine a blocking strategy according to the assessment and the malicious IP, including:

[0173] Obtain a blocking strategy corresponding to the attack level of the attack path, wherein the blocking strategy includes a blocking operation on malicious IPs included in the attack path.

[0174] The malicious IP processing device provided by the present invention comprises a preprocessing module 21 for preprocessing according to the acquired source data, wherein the source data includes network traffic data; a machine learning identification module 22 for performing machine learning feature extraction according to the preprocessed source data to obtain a first feature set, inputting the first feature set into the machine learning model to obtain a first malicious IP set; a deep learning identification module 23 for performing deep learning feature extraction according to the preprocessed source data to obtain a second feature set, inputting the second feature set into the deep learning model to obtain a second malicious IP set; an attack evaluation module 24 for determining an attack graph according to the source data, performing attack evaluation according to the attack graph, and obtaining an evaluation result; a blocking module 25 for determining a blocking strategy according to the evaluation and the malicious IP, and blocking the malicious IP according to the blocking strategy, wherein the malicious IP includes the first malicious IP set and the second malicious IP set. Compared with the current manual malicious IP identification, the present invention can identify malicious IPs through machine learning models and deep learning models respectively. In addition to identifying malicious IPs, the present invention can also determine an attack graph based on source data, and perform attack evaluation based on the attack graph, combine the evaluation results with the malicious IP to determine a banning strategy, and ban the malicious IP according to the banning strategy. On the basis of accurately identifying malicious IPs, automated banning of malicious IPs is achieved to improve the efficiency of malicious IP banning. The degree of automation is high, and no human intervention is required. Malicious IPs can be automatically identified and banned, thereby improving defense efficiency. The detection capability is strong, and new attack methods and covert attacks can be effectively identified, such as covert attacks using encrypted traffic. The response speed is fast, and attacks can be stopped in time to prevent attackers from causing greater harm to the network. The malicious IP processing device provided in the embodiment of the present invention can execute the malicious IP processing method provided in any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method.

[0175] Figure 3 1 is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0176] like Figure 3 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0177] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0178] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a method for processing malicious IP.

[0179] In some embodiments, the method for processing malicious IP may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the method for processing malicious IP described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the method for processing malicious IP in any other appropriate manner (e.g., by means of firmware).

[0180] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0181] The computer program for implementing the method for processing malicious IP of the present invention can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program can be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0182] The embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions can be used to enable a processor to execute a method for processing malicious IP, the method comprising:

[0183] Preprocessing is performed according to the acquired source data, wherein the source data includes network traffic data;

[0184] Perform machine learning feature extraction based on the preprocessed source data to obtain a first feature set, and input the first feature set into a machine learning model to obtain a first malicious IP set;

[0185] Perform deep learning feature extraction based on the preprocessed source data to obtain a second feature set, and input the second feature set into a deep learning model to obtain a second malicious IP set;

[0186] Determine an attack graph according to the source data, perform attack evaluation according to the attack graph, and obtain an evaluation result;

[0187] A banning strategy is determined based on the evaluation and malicious IPs, and malicious IPs are banned based on the banning strategy. The malicious IPs include the first malicious IP set and the second malicious IP set.

[0188] Based on the above implementation, optionally, before inputting the second feature set into the deep learning model to obtain the second malicious IP set, the method further includes:

[0189] Determine graph features based on the graph neural network and preprocessed source data;

[0190] According to the end-to-end learning mechanism, the deep learning model is trained using graph features.

[0191] Based on the above implementation, optionally, after determining the graph features according to the graph neural network and the preprocessed source data, the method further includes:

[0192] Determine the target graph features from the graph features according to the attention mechanism;

[0193] Accordingly, according to the end-to-end learning mechanism, the deep learning model is trained using graph features, including:

[0194] According to the end-to-end learning mechanism, the deep learning model is trained using the target graph features.

[0195] Based on the above implementation, optionally, after the deep learning model is trained using the graph features, the method further includes:

[0196] The trained deep learning model is subjected to adversarial training based on adversarial samples.

[0197] Based on the above implementation, optionally, before inputting the second feature set into the deep learning model to obtain the second malicious IP set, the method further includes:

[0198] Obtain the trained malicious IP identification model based on transfer learning;

[0199] Adjustments are made according to the trained malicious IP identification model to obtain a deep learning model.

[0200] On the basis of the above implementation, optionally, determining an attack graph according to the source data, performing attack evaluation according to the attack graph, and obtaining an evaluation result includes:

[0201] Determine attack paths based on source data;

[0202] Calculate the composite score of each path based on the CVSS score and path length of each vulnerability on the attack path;

[0203] An attack level is determined based on the comprehensive score.

[0204] On the basis of the above implementation, optionally, determining a blocking strategy according to the evaluation and malicious IP addresses includes:

[0205] Obtain a blocking strategy corresponding to the attack level of the attack path, wherein the blocking strategy includes a blocking operation on malicious IPs included in the attack path.

[0206] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0207] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0208] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0209] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0210] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0211] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for processing malicious IP, characterized in that: include: Preprocessing is performed according to the acquired source data, wherein the source data includes network traffic data; Perform machine learning feature extraction based on the preprocessed source data to obtain a first feature set, and input the first feature set into a machine learning model to obtain a first malicious IP set; Perform deep learning feature extraction based on the preprocessed source data to obtain a second feature set, and input the second feature set into a deep learning model to obtain a second malicious IP set; Determine an attack graph according to the source data, perform attack evaluation according to the attack graph, and obtain an evaluation result; A banning strategy is determined based on the evaluation and malicious IPs, and malicious IPs are banned based on the banning strategy. The malicious IPs include the first malicious IP set and the second malicious IP set.

2. The method according to claim 1, characterized in that Before inputting the second feature set into the deep learning model to obtain the second malicious IP set, the method further includes: Determine graph features based on the graph neural network and preprocessed source data; According to the end-to-end learning mechanism, the deep learning model is trained using graph features.

3. The method according to claim 2, characterized in that After determining the graph features based on the graph neural network and preprocessed source data, it also includes: Determine the target graph features from the graph features according to the attention mechanism; Accordingly, according to the end-to-end learning mechanism, the deep learning model is trained using graph features, including: According to the end-to-end learning mechanism, the deep learning model is trained using the target graph features.

4. The method according to claim 2, characterized in that: After training the deep learning model using graph features, it also includes: The trained deep learning model is subjected to adversarial training based on adversarial samples.

5. The method according to claim 1, characterized in that: Before inputting the second feature set into the deep learning model to obtain the second malicious IP set, the method further includes: Obtain the trained malicious IP identification model based on transfer learning; Adjustments are made according to the trained malicious IP identification model to obtain a deep learning model.

6. The method according to claim 1, characterized in that Determining an attack graph according to the source data, performing attack evaluation according to the attack graph, and obtaining an evaluation result, including: Determine attack paths based on source data; Calculate the composite score of each path based on the CVSS score and path length of each vulnerability on the attack path; An attack level is determined based on the comprehensive score.

7. The method according to claim 6, characterized in that Determine the blocking strategy based on the assessment and malicious IP, including: Obtain a blocking strategy corresponding to the attack level of the attack path, wherein the blocking strategy includes a blocking operation on malicious IPs included in the attack path.

8. A malicious IP processing device, characterized in that: include: A preprocessing module, used for preprocessing according to the acquired source data, wherein the source data includes network flow data; A machine learning identification module, used to perform machine learning feature extraction based on the preprocessed source data to obtain a first feature set, and input the first feature set into a machine learning model to obtain a first malicious IP set; A deep learning identification module, used for performing deep learning feature extraction based on the preprocessed source data to obtain a second feature set, and inputting the second feature set into a deep learning model to obtain a second malicious IP set; An attack assessment module, used to determine an attack graph according to the source data, perform attack assessment according to the attack graph, and obtain an assessment result; A blocking module is used to determine a blocking strategy based on the evaluation and malicious IPs, and to block malicious IPs based on the blocking strategy. The malicious IPs include the first malicious IP set and the second malicious IP set.

9. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method for processing malicious IPs according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method for processing malicious IPs according to any one of claims 1 to 7 when executed.

Images