Network information security protection method and electronic equipment

Abstract

According to the network information security protection method and the electronic equipment, the network attack tendency of the session content is determined by using the corresponding security detection result, so that the network attack tendency of the session content introduces the abnormal request to respond to the content change in the session information. In view of the fact that the abnormal request response session information attribute and the network attack tendency expression are both used for reflecting the risk behavior preference of the abnormal request response session information, the abnormal request response session information attribute and the network attack tendency expression are introduced into the attribute relation in the abnormal request response session information, so that the risk behavior preference of the abnormal request response session information is reflected. In the process of analyzing the network attack tendency of the abnormal request response session information, analysis can be performed by using content change and attribute relation, so that the precision and credibility of determining the network attack tendency of the abnormal request response session information are improved.

Description

Technical Field

[0001] The present application relates to the field of information security protection technology, and in particular to a network information security protection method and electronic equipment. Background Art

[0002] In the process of information security protection analysis of abnormal request response session information, how to improve the accuracy and credibility of determining the network attack tendency of abnormal request response session information is one of the technical difficulties that needs to be overcome at present. Summary of the invention

[0003] In order to improve the technical problems existing in the related technologies, the present application provides a network information security protection method and electronic equipment.

[0004] In a first aspect, an embodiment of the present application provides a network information security protection method, which is applied to an electronic device, and the method includes: Obtaining target abnormal request response session information for determining the tendency of network attack; generating an abnormal request response session information attribute for the target abnormal request response session information by using a decision tree algorithm, wherein the abnormal request response session information attribute is used to reflect the risk behavior preference of the target abnormal request response session information; Obtaining at least two network attack tendency expressions, wherein the network attack tendency expressions are used to reflect the risk behavior preference of the session content under the corresponding network attack tendency, and the network attack tendency of the session content is determined by using the security detection result of the session content; Based on the abnormal request response session information attributes and each network attack tendency expression, a network attack tendency factor between the target abnormal request response session information and the session content corresponding to each network attack tendency is determined, and the network attack tendency factor is used to determine the final network attack tendency of the target abnormal request response session information.

[0005] Preferably, obtaining at least two network attack tendency expressions includes: Obtaining an auxiliary abnormal request response session information set, wherein the auxiliary abnormal request response session information set includes auxiliary abnormal request response session information for determining the tendency of network attack; Extracting security detection results of each auxiliary abnormal request response session information in the auxiliary abnormal request response session information set, wherein the security detection results are used to reflect changes in security levels in the auxiliary abnormal request response session information; Based on the security detection results of each auxiliary abnormal request response session information in the auxiliary abnormal request response session information set, determining session contents corresponding to at least two network attack tendencies in the auxiliary abnormal request response session information set; A decision tree algorithm is used to generate features of the conversation content corresponding to each network attack tendency, and at least two network attack tendency expressions are obtained.

[0006] Preferably, the determining of the session contents corresponding to at least two network attack tendencies in the auxiliary abnormal request response session information set based on the security detection results of each auxiliary abnormal request response session information in the auxiliary abnormal request response session information set includes: Based on the security detection results of each auxiliary abnormal request response session information, a network attack tendency analysis algorithm is used to determine a network attack tendency element set of each auxiliary abnormal request response session information; Based on the network attack tendency element set of each auxiliary abnormal request response session information, the session contents corresponding to at least two network attack tendencies are determined in the auxiliary abnormal request response session information set.

[0007] Preferably, the auxiliary abnormal request response session information includes categories, and the network attack tendency element set of each auxiliary abnormal request response session information is determined by using a network attack tendency analysis algorithm based on the security detection results of each auxiliary abnormal request response session information, including: Based on the security detection results of each auxiliary abnormal request response session information and the category of each auxiliary abnormal request response session information, a network attack tendency element set of each auxiliary abnormal request response session information is determined using a network attack tendency analysis algorithm with elements.

[0008] Preferably, the network attack tendency element set based on each auxiliary abnormal request response session information, determining the session contents corresponding to at least two network attack tendencies in the auxiliary abnormal request response session information set, includes: Determine, by using the network attack tendency element set of each auxiliary abnormal request response session information, that the network attack tendency of each auxiliary abnormal request response session information is a network attack tendency element of a target network attack tendency, wherein the target network attack tendency is any one of the at least two network attack tendencies; According to a descending rule, the network attack tendency elements of each auxiliary abnormal request response session information whose network attack tendency is the target network attack tendency are sorted; The network attack tendency elements are selected to organize the auxiliary abnormal request response session information within the first set number constraint set, and the session content corresponding to the target network attack tendency is determined.

[0009] Preferably, the feature of the conversation content corresponding to each network attack tendency is generated by using a decision tree algorithm to obtain at least two network attack tendency expressions, including: For each target network attack tendency of the at least two network attack tendencies, using a decision tree algorithm to generate features of a first set number of session contents corresponding to the target network attack tendency; The features of the first set number of conversation contents are processed to obtain a network attack tendency expression corresponding to the target network attack tendency.

[0010] Preferably, the determining, based on the abnormal request response session information attribute and each network attack tendency expression, a network attack tendency factor between the target abnormal request response session information and the session content corresponding to each network attack tendency comprises: Determining the difference between the abnormal request response session information attribute and each network attack tendency expression; Based on the difference, a network attack tendency factor between the target abnormal request response session information and the session content corresponding to each network attack tendency is determined, and the network attack tendency factor is related to the difference.

[0011] Preferably, after determining the network attack tendency factor between the target abnormal request response session information and the session content corresponding to each network attack tendency, the method further includes: Determine, from among the session contents corresponding to the various network attack tendencies, the session content having the largest network attack tendency factor with respect to the target abnormal request response session information; The network attack tendency corresponding to the session content having the largest network attack tendency factor is determined as the network attack tendency of the target abnormal request response session information.

[0012] Preferably, after determining the network attack tendency factor between the target abnormal request response session information and the session content corresponding to each network attack tendency, the method further includes: Based on the network attack tendency factor between the target abnormal request response session information and the session content corresponding to each network attack tendency, a network attack tendency element set of the target abnormal request response session information is determined.

[0013] In a second aspect, the present application also provides an electronic device, comprising a processor and a memory; the processor and the memory are communicatively connected, and the processor is used to read a computer program from the memory and execute it to implement the above method.

[0014] In a third aspect, the present application also provides a computer-readable storage medium on which a program is stored, and the program implements the above method when executed by a processor.

[0015] Applied to the present application, in view of the fact that the network attack tendency of the session content is determined by using the corresponding security detection results, the network attack tendency of the session content introduces the content changes in the abnormal request response session information. In view of the fact that both the abnormal request response session information attributes and the network attack tendency expression are used to reflect the risk behavior preference of the abnormal request response session information, the abnormal request response session information attributes and the network attack tendency expression introduce the attribute connection in the abnormal request response session information. In this way, in the process of analyzing the network attack tendency of the abnormal request response session information, not only the content changes can be used for analysis, but also the attribute connection can be used for analysis, thereby improving the accuracy and credibility of determining the network attack tendency of the abnormal request response session information. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The accompanying drawings herein are incorporated in and constitute a part of the specification, illustrate embodiments consistent with the present application, and together with the description, are used to explain the principles of the present application.

[0017] Figure 1 It is a flow chart of a network information security protection method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0018] The method embodiments provided in the embodiments of the present application can be executed in an electronic device, an electronic device or a similar computing device. Taking running on an electronic device as an example, the electronic device may include one or more processors and a memory for storing data. Optionally, the electronic device may also include a transmission device for communication functions. It can be understood by those of ordinary skill in the art that the above structure is only for illustration and does not limit the structure of the above electronic device. For example, the electronic device may also include more or fewer components than shown above, or have a configuration different from that shown above. The memory may be used to store computer programs, for example, software programs and modules of application software, such as a computer program corresponding to one of the above methods in the embodiments of the present application, and the processor executes various functional applications and data processing by running the computer program stored in the memory, that is, implementing the above method. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the electronic device via a network. Examples of the above network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof. The transmission device is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the electronic device.

[0019] Based on the above introduction of electronic equipment, please refer to Figure 1, Figure 1 This is an exemplary implementation scheme of a network information security protection method provided in an embodiment of the present application, and the scheme may further include steps 10 to 40.

[0020] Step 10: Obtain target abnormal request response session information for determining network attack tendency.

[0021] Step 20: Generate abnormal request response session information attributes for the target abnormal request response session information using a decision tree algorithm, wherein the abnormal request response session information attributes are used to reflect the risk behavior preference of the target abnormal request response session information.

[0022] Step 30: Obtain at least two network attack tendency expressions, wherein the network attack tendency expressions are used to reflect the risk behavior preference of the session content under the corresponding network attack tendency, and the network attack tendency of the session content is determined by using the security detection result of the session content.

[0023] Step 40: Based on the abnormal request response session information attributes and each network attack tendency expression, determine the network attack tendency factor between the target abnormal request response session information and the session content corresponding to each network attack tendency, and the network attack tendency factor is used to determine the final network attack tendency of the target abnormal request response session information.

[0024] In some exemplary embodiments, obtaining at least two network attack tendency expressions includes: obtaining an auxiliary abnormal request response session information set, the auxiliary abnormal request response session information set including auxiliary abnormal request response session information for determining the network attack tendency; extracting security detection results of each auxiliary abnormal request response session information in the auxiliary abnormal request response session information set, the security detection results being used to reflect changes in security levels in the auxiliary abnormal request response session information; determining session contents corresponding to at least two network attack tendencies in the auxiliary abnormal request response session information set based on the security detection results of each auxiliary abnormal request response session information in the auxiliary abnormal request response session information set; and generating features for the session contents corresponding to each network attack tendency using a decision tree algorithm to obtain at least two network attack tendency expressions.

[0025] In some exemplary embodiments, the determining of session contents corresponding to at least two network attack tendencies in the auxiliary abnormal request response session information set based on the security detection results of each auxiliary abnormal request response session information in the auxiliary abnormal request response session information set comprises: determining a network attack tendency element set for each auxiliary abnormal request response session information by using a network attack tendency analysis algorithm based on the security detection results of each auxiliary abnormal request response session information; and determining session contents corresponding to at least two network attack tendencies in the auxiliary abnormal request response session information set based on the network attack tendency element set for each auxiliary abnormal request response session information.

[0026] In some exemplary embodiments, the auxiliary abnormal request response session information includes categories, and the network attack tendency element set of each auxiliary abnormal request response session information is determined by using a network attack tendency analysis algorithm based on the security detection results of each auxiliary abnormal request response session information, including: based on the security detection results of each auxiliary abnormal request response session information and the categories of each auxiliary abnormal request response session information, the network attack tendency element set of each auxiliary abnormal request response session information is determined by using a network attack tendency analysis algorithm with elements.

[0027] In some exemplary embodiments, the network attack tendency element set based on each auxiliary abnormal request response session information determines the session content corresponding to at least two network attack tendencies in the auxiliary abnormal request response session information set, including: using the network attack tendency element set of each auxiliary abnormal request response session information to determine that the network attack tendency of each auxiliary abnormal request response session information is a network attack tendency element of a target network attack tendency, wherein the target network attack tendency is any one of the at least two network attack tendencies; according to a descending rule, sorting the network attack tendency elements of each auxiliary abnormal request response session information whose network attack tendency is the target network attack tendency; selecting the auxiliary abnormal request response session information within a first set number constraint set for sorting the network attack tendency elements, and determining it as the session content corresponding to the target network attack tendency.

[0028] In some exemplary embodiments, the use of a decision tree algorithm to generate features of session content corresponding to each network attack tendency to obtain at least two network attack tendency expressions includes: for each target network attack tendency among the at least two network attack tendencies, using a decision tree algorithm to generate features of a first set number of session contents corresponding to the target network attack tendency; and processing the features of the first set number of session contents to obtain a network attack tendency expression corresponding to the target network attack tendency.

[0029] In some exemplary embodiments, determining the network attack tendency factor between the target abnormal request response session information and the session content corresponding to each network attack tendency based on the abnormal request response session information attributes and each network attack tendency expression includes: determining the difference between the abnormal request response session information attributes and each network attack tendency expression; based on the difference, determining the network attack tendency factor between the target abnormal request response session information and the session content corresponding to each network attack tendency, the network attack tendency factor being related to the difference.

[0030] In some exemplary embodiments, after determining the network attack tendency factor between the target abnormal request response session information and the session content corresponding to each network attack tendency, the method further includes: determining the session content having the largest network attack tendency factor with the target abnormal request response session information among the session contents corresponding to each network attack tendency; and determining the network attack tendency corresponding to the session content having the largest network attack tendency factor as the network attack tendency of the target abnormal request response session information.

[0031] In some exemplary embodiments, after determining the network attack tendency factor between the target abnormal request response session information and the session content corresponding to each network attack tendency, the method further includes: determining a network attack tendency element set of the target abnormal request response session information based on the network attack tendency factor between the target abnormal request response session information and the session content corresponding to each network attack tendency.

[0032] It can be seen that, in step 10 to step 40, since the network attack tendency of the session content is determined by using the corresponding security detection results, the network attack tendency of the session content introduces the content changes in the abnormal request response session information. In addition, since both the abnormal request response session information attributes and the network attack tendency expression are used to reflect the risk behavior preference of the abnormal request response session information, the abnormal request response session information attributes and the network attack tendency expression introduce the attribute connection in the abnormal request response session information. In this way, in the process of analyzing the network attack tendency of the abnormal request response session information, not only the content changes can be used for analysis, but also the attribute connection can be used for analysis, thereby improving the accuracy and credibility of determining the network attack tendency of the abnormal request response session information.

[0033] Based on the same inventive concept, a computer-readable storage medium is also provided, on which a program is stored, and when the program is executed by a processor, the above method is implemented.

[0034] Based on the same inventive concept, an electronic device is also provided, comprising a processor and a memory; the processor and the memory are communicatively connected, and the processor is used to read a computer program from the memory and execute it to implement the above method.

[0035] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A network information security protection method, characterized in that: Applied to electronic equipment, the method comprises: Obtain target abnormal request response session information for determining the tendency of network attack; generating an abnormal request response session information attribute for the target abnormal request response session information by using a decision tree algorithm, wherein the abnormal request response session information attribute is used to reflect the risk behavior preference of the target abnormal request response session information; Obtaining at least two network attack tendency expressions, wherein the network attack tendency expressions are used to reflect the risk behavior preference of the session content under the corresponding network attack tendency, and the network attack tendency of the session content is determined by using the security detection result of the session content; Based on the abnormal request response session information attributes and each network attack tendency expression, a network attack tendency factor between the target abnormal request response session information and the session content corresponding to each network attack tendency is determined, and the network attack tendency factor is used to determine the final network attack tendency of the target abnormal request response session information.

2. The method according to claim 1, characterized in that The obtaining of at least two network attack tendency expressions includes: Obtaining an auxiliary abnormal request response session information set, wherein the auxiliary abnormal request response session information set includes auxiliary abnormal request response session information for determining the tendency of network attack; Extracting security detection results of each auxiliary abnormal request response session information in the auxiliary abnormal request response session information set, wherein the security detection results are used to reflect changes in security levels in the auxiliary abnormal request response session information; Based on the security detection results of each auxiliary abnormal request response session information in the auxiliary abnormal request response session information set, determining session contents corresponding to at least two network attack tendencies in the auxiliary abnormal request response session information set; A decision tree algorithm is used to generate features of the conversation content corresponding to each network attack tendency, and at least two network attack tendency expressions are obtained.

3. The method according to claim 2, characterized in that The determining of the session contents corresponding to at least two network attack tendencies in the auxiliary abnormal request response session information set based on the security detection results of each auxiliary abnormal request response session information in the auxiliary abnormal request response session information set includes: Based on the security detection results of each auxiliary abnormal request response session information, a network attack tendency analysis algorithm is used to determine a network attack tendency element set of each auxiliary abnormal request response session information; Based on the network attack tendency element set of each auxiliary abnormal request response session information, the session contents corresponding to at least two network attack tendencies are determined in the auxiliary abnormal request response session information set.

4. The method according to claim 3, characterized in that: The auxiliary abnormal request response session information includes categories, and the network attack tendency element set of each auxiliary abnormal request response session information is determined by using a network attack tendency analysis algorithm based on the security detection results of each auxiliary abnormal request response session information, including: Based on the security detection results of each auxiliary abnormal request response session information and the category of each auxiliary abnormal request response session information, a network attack tendency element set of each auxiliary abnormal request response session information is determined using a network attack tendency analysis algorithm with elements.

5. The method according to claim 3, characterized in that: The network attack tendency element set based on each auxiliary abnormal request response session information, determining the session contents corresponding to at least two network attack tendencies in the auxiliary abnormal request response session information set, includes: Determine, by using the network attack tendency element set of each auxiliary abnormal request response session information, that the network attack tendency of each auxiliary abnormal request response session information is a network attack tendency element of a target network attack tendency, wherein the target network attack tendency is any one of the at least two network attack tendencies; According to a descending rule, the network attack tendency elements of each auxiliary abnormal request response session information whose network attack tendency is the target network attack tendency are sorted; Selecting network attack tendency elements to sort out auxiliary abnormal request response session information within a first set number constraint set, and determining the session content corresponding to the target network attack tendency; The method of using a decision tree algorithm to generate features of the conversation content corresponding to each network attack tendency to obtain at least two network attack tendency expressions includes: For each target network attack tendency of the at least two network attack tendencies, using a decision tree algorithm to generate features of a first set number of session contents corresponding to the target network attack tendency; The features of the first set number of conversation contents are processed to obtain a network attack tendency expression corresponding to the target network attack tendency.

6. The method according to claim 1, characterized in that The determining, based on the abnormal request response session information attribute and each network attack tendency expression, a network attack tendency factor between the target abnormal request response session information and the session content corresponding to each network attack tendency comprises: Determining the difference between the abnormal request response session information attribute and each network attack tendency expression; Based on the difference, a network attack tendency factor between the target abnormal request response session information and the session content corresponding to each network attack tendency is determined, and the network attack tendency factor is related to the difference.

7. The method according to claim 1, characterized in that After determining the network attack tendency factor between the target abnormal request response session information and the session content corresponding to each network attack tendency, the method further includes: Determine, from among the session contents corresponding to the various network attack tendencies, the session content having the largest network attack tendency factor with respect to the target abnormal request response session information; The network attack tendency corresponding to the session content having the largest network attack tendency factor is determined as the network attack tendency of the target abnormal request response session information.

8. The method according to claim 1, characterized in that: After determining the network attack tendency factor between the target abnormal request response session information and the session content corresponding to each network attack tendency, the method further includes: determining a network attack tendency element set of the target abnormal request response session information based on the network attack tendency factor between the target abnormal request response session information and the session content corresponding to each network attack tendency.

9. A computer-readable storage medium, characterized in that: A program is stored thereon, and when the program is executed by a processor, the method described in any one of claims 1 to 8 is implemented.

10. An electronic device, characterized in that: It comprises a processor and a memory; the processor and the memory are communicatively connected, and the processor is used to read a computer program from the memory and execute it to implement the method described in any one of claims 1 to 8.

Images