Attack detection method and system based on multi-technology fusion

Abstract

The invention discloses an attack detection method and system based on multi-technology fusion, and relates to the technical field of network security detection, and the method comprises the steps: carrying out the backup, decryption and deep decoding of a received first access flow, and forming a deep decoding packet; performing first-stage detection and second-stage detection on the deep decoding packet; and integrating the detected flow to complete flow detection. According to the method provided by the invention, the first-stage detection and the second-stage detection are carried out on the deep decoding packet, so that a multi-dimensional detection mechanism for the traffic is realized, and multiple detection modes are fused for use, so that the detection mode for the access traffic is more comprehensive, hidden attack behaviors hidden in the access traffic can be discovered, and the security of the access traffic is improved. According to the method and the device, a hot deployment mode is adopted during intelligent detection, so that different models can be dynamically loaded for detection, the hidden attack behavior discovery opportunity is increased, and the intelligent detection effect is enhanced.

Description

Technical Field

[0001] The present invention relates to the technical field of network security detection, and in particular to an attack detection method and system based on multi-technology fusion. Background Art

[0002] With the rapid development of power systems, the network environment is becoming increasingly complex. The needs of various businesses have brought unprecedented challenges to network security. Traditional network security equipment usually relies on static rule-based detection technology, that is, identifying network attacks through pre-set rule libraries. However, this method is powerless in dealing with increasingly complex and changeable network attack methods. The limitation of the static rule library is that it responds slowly to emerging attack patterns and often requires manual rule updates, which affects the timeliness and accuracy of the detection system. In addition, the single static rule-based detection method has relatively weak recognition capabilities for hidden attacks. When faced with multi-level modern attacks, this method can only provide limited protection.

[0003] Moreover, most of the current methods for detecting attack behaviors in network traffic rely on a single technical means, such as methods based on simple feature rules or relying on intelligent models. These methods sacrifice the breadth and depth of detection to some extent, resulting in incomplete recognition of certain types of attacks. A single detection method not only affects the overall detection performance, but also greatly reduces its recognition ability when the attack behavior mutates. In recent years, researchers have begun to explore the integration of multiple detection methods, but because both traffic processing performance and application operation efficiency must be considered at the same time, there is currently no effective method for integrating multiple detection methods. Summary of the invention

[0004] In view of the above-mentioned problems, the present invention is proposed.

[0005] Therefore, the technical problem solved by the present invention is: the existing network attack detection methods have problems such as incomplete detection effect, slow response time, false alarms and missed alarms, and how to achieve more efficient and accurate network attack detection by integrating multiple technologies.

[0006] To solve the above technical problems, the present invention provides the following technical solutions: an attack detection method based on multi-technology fusion, comprising backing up, decrypting and deeply decoding the received first access traffic to form a deeply decoded packet; performing first-level detection and second-level detection on the deeply decoded packet; integrating the traffic that has passed the detection to complete the traffic detection.

[0007] As a preferred solution of the attack detection method based on multi-technology fusion described in the present invention, the backup, decryption and deep decoding include backing up the received first access traffic, decrypting the backup traffic, and then deep decoding the decrypted traffic packet.

[0008] As a preferred solution of the attack detection method based on multi-technology fusion described in the present invention, wherein: the forming of the deep decoding packet includes forwarding the decoded traffic and performing two-level detection.

[0009] As a preferred solution of the attack detection method based on multi-technology fusion described in the present invention, the first-level detection includes comparing and detecting the deep decoding packets through the feature library to mark the attack behavior.

[0010] As a preferred solution of the attack detection method based on multi-technology fusion described in the present invention, the second-level detection includes detecting the deep decoding packet through plug-in detection and intelligent detection to mark the attack behavior.

[0011] As a preferred solution of the attack detection method based on multi-technology fusion described in the present invention, the first-level detection and the second-level detection also include passing the decoded traffic in the deep decoding packet through the first-level detection, marking it if an attack behavior is detected, generating an alarm message, and forwarding the alarm message; if no attack behavior is detected, forwarding it to the second-level detection; the decoded traffic that is not marked with attack behavior in the first-level detection is forwarded to the plug-in detection and intelligent detection in the second-level detection respectively, and the hot deployment of the detection model is set in the intelligent detection link, and the plug-in detection and the intelligent detection are set to be asynchronously carried out. If any of the plug-in detection and the intelligent detection detects an attack behavior, it is marked, and an alarm message is generated and forwarded. If no attack behavior is detected, the decoded traffic that is not marked with attack behavior is marked as passed and forwarded.

[0012] As a preferred solution of the attack detection method based on multi-technology fusion described in the present invention, wherein: the completion of traffic detection includes integrating the alarm information forwarded by the first level detection and the second level detection to form comprehensive alarm information; integrating the decoded traffic marked as passed forwarded by the second level detection, and releasing the original traffic before the normal traffic is backed up.

[0013] Another object of the present invention is to provide an attack detection system based on multi-technology fusion, which can detect attack behaviors by performing deep decoding packets, identify and mark potential attack behaviors through first-level detection and second-level detection, and solve the problem of incomplete detection effect of current network attack detection.

[0014] As a preferred solution of the attack detection system based on multi-technology fusion described in the present invention, it includes: a decryption and decoding module, an attack detection module, and a result processing module; the decryption and decoding module is used to back up, decrypt and deeply decode the received first access traffic to form a deep decoding package; the attack detection module is used to detect attack behavior on the deep decoding package, and identify and mark potential attack behavior through first-level detection and second-level detection; the result processing module is used to process according to the results of the attack detection module, generate alarm information for the detected attack behavior, and release normal traffic.

[0015] A computer device includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement a step of an attack detection method based on multi-technology fusion.

[0016] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of an attack detection method based on multi-technology fusion.

[0017] Beneficial effects of the present invention: The attack detection method based on multi-technology fusion provided by the present invention forms a deep decoding package by backing up, decrypting and deeply decoding the received first access traffic, thereby realizing a comprehensive analysis of the original encrypted traffic. By performing the first-level detection and the second-level detection on the deep decoding package, a multi-dimensional detection mechanism for the traffic is realized. The fusion of multiple detection methods makes the detection method for the access traffic more comprehensive, so that the covert attack behavior hidden in the access traffic can be discovered, and then an opportunity for disposal can be provided. When performing intelligent detection, a hot deployment method is adopted, so that different models can be dynamically loaded for detection, which increases the opportunity for discovering hidden attack behaviors and enhances the effect of intelligent detection. The adoption of hot deployment enables the switching of detection models in the running state, which enhances the availability of intelligent detection. The asynchronous working mechanism of plug-in detection and intelligent detection ensures the working performance of the two detections, thereby improving the working efficiency of the entire detection. By integrating the detected traffic, the consistency of alarm management is improved, the alarms from the two-level detection are integrated and converted into comprehensive alarm information, and the system can respond to high-risk threats first and take countermeasures more effectively. The present invention achieves better results in terms of efficiency, accuracy and adaptability. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0019] Figure 1 An overall flow chart of an attack detection method based on multi-technology fusion provided for the first embodiment of the present invention.

[0020] Figure 2 A flowchart of HTTPS traffic decryption of an attack detection method based on multi-technology fusion provided in the first embodiment of the present invention.

[0021] Figure 3 A deep decoding flow chart of an attack detection method based on multi-technology fusion provided in the first embodiment of the present invention.

[0022] Figure 4 A plug-in detection flow chart of an attack detection method based on multi-technology fusion provided in the first embodiment of the present invention.

[0023] Figure 5 A flowchart of intelligent detection based on a machine learning method for an attack detection method based on multi-technology fusion provided in the first embodiment of the present invention.

[0024] Figure 6 A technical logic flow chart of an attack detection method based on multi-technology fusion provided for the first embodiment of the present invention.

[0025] Figure 7 A schematic diagram of modules of an attack detection system based on multi-technology fusion provided in the third embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0027] Example 1, reference Figure 1-6 , is an embodiment of the present invention, and provides an attack detection method based on multi-technology fusion, including:

[0028] S1: backing up, decrypting and deeply decoding the received first access traffic to form a deeply decoded packet.

[0029] Furthermore, forming a deep decoding package includes backing up the received first access traffic, decrypting the backup traffic, deeply decoding the decrypted traffic packet, and forwarding the decoded traffic, wherein the first access traffic is network access traffic, including but not limited to HTTPS access traffic, HTTP access traffic and other protocol access traffic.

[0030] It should be noted that, in this embodiment, the first access traffic is HTTPS access traffic, and the received HTTPS access traffic is decrypted into HTTP access traffic. The HTTPS traffic decryption process is as follows: Figure 2 As shown, the specific steps include:

[0031] J1, the establishment of an SSL / TLS connection between a client and a server includes, first, the client sends a list of supported cipher suites to the server, and the server then selects a cipher suite and responds to the client.

[0032] J2, dynamic defense device intervention includes that when SSL / TLS communication passes through the dynamic defense device, the dynamic defense device intercepts the encrypted data.

[0033] J3, the dynamic defense device obtains the server certificate, including: the dynamic defense device obtains the digital certificate of the server, and the digital certificate of the server includes the public key of the server.

[0034] J4, the dynamic defense device uses the server public key to decrypt the preliminary master key, including: the dynamic defense device uses the public key extracted from the server certificate to decrypt the preliminary master key sent by the client.

[0035] J5, the dynamic defense device obtains the session key including: after the dynamic defense device obtains the preliminary master key, it uses the preliminary master key to participate in the key exchange protocol in the handshake phase to obtain the session key.

[0036] J6, the dynamic defense device decrypts the communication data, including: the dynamic defense device uses the acquired session key to decrypt the communication data transmitted through the SSL / TLS protocol, so that the data is decrypted into HTTP access traffic.

[0037] It should also be noted that the depth decoding process is as follows Figure 3 As shown, the specific steps include:

[0038] D1,captures data packets flowing through the network through the network card and records the data packets for further analysis.

[0039] D2, using the corresponding filtering rules configured by the rule file, using a data packet filter to filter the data packets recorded in step D1.

[0040] D3, decoding the data packets filtered in step D2 by adopting the method of protocol decoding, data decoding or data packet reassembly.

[0041] D4, analyzing the content of the data packet decoded in step D3, thereby obtaining information contained in the data packet.

[0042] The data packet information obtained in step D4 at least includes the header information (source address, destination address, port number and protocol type) and the effective load of the data packet.

[0043] Filters include but are not limited to HTTP scheme filters, URL filters, HTTP status code filters, and HTTP response body filters.

[0044] Packet filters allow administrators to control packets for specific protocols, restrict packets to specific parts of the network, isolate email domains, and perform other packet transmission management functions.

[0045] S2: Perform first-level detection and second-level detection on the deep decoding packet.

[0046] Furthermore, the first-level detection includes comparing and detecting deep decoded packets through a feature library to mark attack behaviors. The first-level detection can be performed through a feature library in a variety of ways, such as using a feature rule detection engine combined with the Boyer-Moore algorithm to quickly match network packets with feature library rules or traffic classification anomaly detection based on deep learning.

[0047] As a preferred embodiment, in this embodiment, the first-level detection is performed by comparing the feature library, and the feature rule detection engine is combined with the Boyer-Moore algorithm to quickly match the network message with the feature library rules. The principle steps are as follows:

[0048] Specifically, before the actual rule matching, the feature rule detection engine first preprocesses and cleans the traffic, converts the original network data packets into a form that is easier for the feature rule detection engine to process, and performs preprocessing operations to improve the accuracy and performance of rule matching. For example, when processing HTTP traffic, the feature rule detection engine will analyze HTTP requests and responses, extract key information such as URL, Cookie, User-Agent, etc. Next, it will process, record, and alarm the matched network traffic, and then output the processed results to the corresponding destination, such as log files, databases, etc.

[0049] Among them, the feature rule detection engine combines the Boyer-Moore algorithm to optimize the rule base. Unlike the conventional matching algorithm that moves the pattern string and compares from left to right, the Boyer-Moore algorithm still moves the pattern string from left to right, but compares characters from right to left. The main advantage is that the Boyer-Moore algorithm can skip multiple characters during the comparison process, thereby reducing the number of comparisons and improving matching efficiency.

[0050] When matching the rule base, the string matching uses the Aho-Corasick multi-mode matching algorithm to improve the matching speed. The Aho-Corasick algorithm's efficient multi-mode matching can match multiple keywords at the same time and does not repeatedly check the text during the matching process, thereby improving the matching speed. The Aho-Corasick algorithm builds a state machine that contains all the keywords to be matched and has an effective transfer function, so that the state can be switched quickly during the matching process.

[0051] The signature library is stored in text, each line represents a rule, and each rule consists of one or more fields. When reading, the rules are read directly from the text file line by line, so that they can be efficiently searched and compared when matching rules. The structure of a typical signature library rule consists of rule action + packet protocol type + source IP address or port number + rule options.

[0052] In another feasible embodiment, the first-level detection is performed by comparing the feature library and adopting a traffic classification anomaly detection method based on deep learning, and the principle steps are as follows:

[0053] First, a feature library is established, which contains detailed features of normal traffic and known attack traffic. When constructing the feature library, basic statistical information such as the size of each data packet (the average value should be 1250 bytes), protocol type (the proportion of TCP or UDP), and the distribution of source and destination addresses (for example, more than 90% of normal traffic comes from a specific network segment) are taken into consideration. In addition, high-level features are extracted from the traffic by using convolutional neural networks (CNN), including the time and space dimension features of the traffic. For example, high-frequency request patterns are identified by time series analysis. After thousands of iterations of training, the model can achieve a classification accuracy of more than 95% on the test set, thereby enhancing the reliability of the feature library. In the actual detection process, when new traffic arrives, the system The system first performs data cleaning to remove noise and irrelevant data, then extracts the corresponding features and calculates the similarity between the feature vector and the normal traffic features in the feature library. If the calculated similarity score is lower than 0.7, this indicates that there is a significant difference between the new traffic and the normal traffic features. The traffic is marked as suspicious and the alarm mechanism is triggered immediately. In the simulation test, this method can identify and respond to the surge in abnormal request frequency from the same IP address within 10 seconds (300% beyond the normal range), effectively avoiding potential network attacks and ensuring the stability of the system and business continuity. By continuously updating the feature library, deep learning-based traffic detection can continuously improve its adaptability to new attack modes, thereby further improving the effectiveness of network security protection.

[0054] It should be noted that the second level detection includes detecting deep decoding packets through plug-in detection and intelligent detection, marking attack behaviors, and the plug-in detection process is as follows: Figure 4 As shown, the following specific steps are included:

[0055] P1, receives network traffic packet files stored in tcpdump format.

[0056] P2, load the pre-written plug-in running logic code. After loading the plug-in running logic code, first perform a syntax check on the running logic code to ensure that the code conforms to the syntax specifications of the programming language and avoids basic syntax errors. You can decide whether to modify the logic code based on the check results.

[0057] P3, the plug-in in the data package relies on the plug-in to run the logic code for functional testing and then outputs the execution results. When performing functional testing on the plug-in, it also verifies whether the behavior of the code in the expected usage scenario meets the requirements. If it does not meet the requirements, it can decide whether to modify the logic code based on the inspection results.

[0058] P4, compare the execution result in step P3 with the effect expected by the user. If the two operation results do not match, an alarm message is generated and forwarded, and the detection is completed. If the two operation results match, the detection is completed.

[0059] The running process of the plug-in running logic code includes:

[0060] Traffic forwarding, importing the network traffic corresponding to the plug-in running logic code as input data into the plug-in detection engine. The system will read each IP data packet in sequence and analyze and process the network traffic.

[0061] Plugin loading dynamically loads the written plugin code into the application so that the application can implement the functions of the plugin code without stopping or recompiling.

[0062] Detect and run, execute the plug-in running logic code, and obtain the test results of the plug-in running logic code.

[0063] Result output: the execution status is detected according to the plug-in running logic code to complete the execution result output.

[0064] It should also be noted that the second-level detection can detect the deep decoding packet through intelligent detection in a variety of ways, such as methods based on machine learning methods or deep learning algorithms.

[0065] As a preferred embodiment, in this embodiment, the second level detection detects the deep decoding packet through intelligent detection, and adopts the intelligent detection process based on the machine learning method as follows: Figure 5 As shown, the following specific steps are included:

[0066] M1, first, save several trained models available for detection as multiple separate files. The models available for detection are specifically used to identify different types of attack behaviors.

[0067] M2, loads the model from the file in step M1 to form a detection model. During the loading process, ensure that all necessary models are correctly introduced.

[0068] M3,receives the packet files of network traffic as input data for analysis and detection.

[0069] M4, through the model loaded in step M2, asynchronously consumes the traffic of step M3. After consumption, if any model loaded in step M2 finds attack behavior, it will be marked and an alarm will be generated. If none of the models loaded in step M2 detects attack behavior, the detection is completed and the data packet is accessed normally.

[0070] The model files are stored in a specified directory, and the model files at least include a webshell model, a SQL injection model, an XSS threat model, and a deserialization attack model.

[0071] In the process of model building, data preprocessing, model selection, training and verification, and performance evaluation are carried out. Data preprocessing includes the following steps:

[0072] (1) Data collection: Data is collected from multiple network traffic data sources, including normal requests and requests containing malicious behaviors (such as Webshell, deserialization attacks, SQL injection, and XSS attacks).

[0073] (2) Feature extraction: The TF-IDF statistical method is used to evaluate the importance of each requested feature in the entire dataset, and adjustments are made based on the differences between the actual task domain and large amounts of text data.

[0074] (3) Data labeling: assigning a corresponding label to each network request to indicate whether it contains malicious behavior and the type of malicious behavior.

[0075] (4) Data segmentation: divide the data set into three subsets. Usually, 70% of the data is used as the training set, 15% of the data is used as the validation set, and 15% of the data is used as the test set to facilitate model training, parameter tuning, and final performance evaluation.

[0076] Among them, in step M4, the model files can be loaded and tested in sequence until all model files are loaded and tested. If each loaded model file detects an attack behavior, an alarm message is immediately generated and forwarded, and all saved detection models are used for detection to ensure that the identification of attack behaviors is more comprehensive and the network security protection capabilities are effectively enhanced.

[0077] In another feasible embodiment, the second level detection detects the deep decoding packet through intelligent detection, using a deep learning algorithm, and its principle steps are as follows:

[0078] First, the deep learning model is trained and constructed. Several neural network-based models are specially designed for network attack detection. The model aims to identify complex data features and attack patterns. Therefore, several key steps of data preprocessing are crucial. The data collection stage needs to obtain data from multiple network traffic sources to ensure that normal requests and requests for various malicious behaviors are covered, including Webshell, SQL injection and XSS attacks. High-quality data collation and cleaning can remove noise and irrelevant data. In addition, the feature extraction stage uses convolutional neural networks (CNN) and recurrent neural networks (RNN) to deeply model network traffic, which can automatically learn to formulate features from the data and extract patterns related to attack behaviors. At this stage, the data labeling strategy is used to classify and label each request to clarify whether the request contains malicious behavior and its specific type, and then To promote the subsequent model training process, the data set is divided into 70% as a training set, 15% as a validation set, and 15% as a test set. Through iterative training and tuning, the model is continuously updated to improve the accuracy of attack pattern recognition. After training, the model is saved in the specified directory in the form of multiple files, and attack detection is achieved through dynamic loading. When the network traffic data packet is input, the system applies the trained model to detect attack behavior. If a model fails to identify the attack behavior, other models will continue to be loaded for detection until all models have been applied. If an attack behavior is detected in any model, an alarm message will be generated immediately to achieve a rapid response. The use of deep learning algorithms can effectively utilize the powerful capabilities of neural networks in dealing with nonlinear problems and automatic feature extraction, thereby not only improving the response speed to potential network attacks, but also enhancing the overall network security protection capabilities.

[0079] It should also be noted that the first-level detection and the second-level detection also include passing the decoded traffic in the deep decoding packet through the first-level detection. If an attack behavior is detected, it is marked, and an alarm information is generated and forwarded. If no attack behavior is detected, it is forwarded to the second-level detection; the decoded traffic that is not marked with attack behavior in the first-level detection is forwarded to the plug-in detection and intelligent detection in the second-level detection respectively, and the hot deployment of the detection model is set in the intelligent detection link, and the plug-in detection and intelligent detection are set to be carried out asynchronously. If any detection in the plug-in detection and the intelligent detection finds an attack behavior, it is marked, and an alarm information is generated and forwarded. If no attack behavior is detected, the decoded traffic that is not marked with attack behavior is marked as passed and forwarded.

[0080] S3: Integrate the traffic that has passed the detection to complete the traffic detection.

[0081] Furthermore, completing the traffic detection includes integrating the alarm information forwarded by the first-level detection and the second-level detection to form comprehensive alarm information; integrating the decoded traffic marked as passed forwarded by the second-level detection, and releasing the original traffic before the normal traffic is backed up.

[0082] It should be noted that the process of completing the flow detection is as follows Figure 6 As shown, first, the traffic is received for backup, and the traffic data is preliminarily processed through decoding and forwarding. Next, the system enters the feature detection stage to determine whether the traffic meets specific features. If it meets the features, the traffic is judged as a potential threat and enters the alarm generation step. If it does not meet the features, the process continues to the intelligent detection and plug-in detection stages. When no abnormalities are found in either of them, the system directly enters the detection end. If any abnormality is found in any detection link, an alarm message is generated.

[0083] Example 2 is an embodiment of the present invention, which provides an attack detection method based on multi-technology fusion. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation experiments.

[0084] This experiment selected a large enterprise network as the test object. The network mainly contains HTTPS access traffic. In the experimental environment, an experimental platform simulating the enterprise network environment was built, including network switches, routers, firewalls, servers, etc. The multi-technology fusion attack detection system of the present invention was deployed on the experimental platform, and the corresponding hardware and software environment was configured. This experiment also selected high-performance dynamic defense equipment that can effectively handle the decryption and analysis of encrypted traffic.

[0085] Before the experiment began, a large amount of network traffic data was collected, including normal access and potential attack traffic. The traffic data was divided into 70% as a training set, 15% as a validation set, and 15% as a test set to ensure that each data set was diverse and comprehensive to adapt to subsequent model training and performance evaluation.

[0086] During the implementation process, in the first decryption and deep decoding stage, dynamic defense devices were used to decrypt HTTPS traffic and convert it into HTTP traffic, successfully processing a large number of concurrent requests. Then, the first level of detection was performed through the feature rule detection engine combined with the Boyer-Moore algorithm to filter and mark potential attack behaviors. The second level of detection used a combination of plug-in detection and intelligent detection to conduct in-depth analysis of different types of attack modes. Finally, the detected traffic was integrated to generate a comprehensive alarm report to ensure that it can be traced and verified in subsequent data analysis.

[0087] Refer to Table 1 for a comparative analysis of the experimental data.

[0088] Table 1 Experimental data record table

[0089]

[0090] From the data in Table 1, we can see the advantages and innovations of the multi-technology fusion attack detection method of the present invention. First, for traffic sizes between 100 and 150 Mbps, the average processing time is 1.24 seconds, which is much lower than the processing time of other traditional methods in the same industry, which is usually more than 2 seconds. This improvement shows that through the solution based on multi-technology fusion, the decryption and processing speed of access traffic is improved, thereby improving the overall responsiveness of the system.

[0091] Secondly, the detection pass rate continued to remain above 95%, reaching a maximum of 99%, which is higher than the 85% to 90% pass rate of common security detection solutions on the market. It can be seen from the experimental data that the number of labeled attack behaviors is on an upward trend, verifying the effective combination of feature rule detection engine and deep learning algorithm, which can more quickly and accurately identify various attack patterns, especially those new attacks that have not yet been recorded in the rule base.

[0092] Finally, the false alarm rate is relatively low, with an average reference of approximately 1.5%, which lays a good foundation for network security management. Compared with traditional detection methods on the market, which usually have a false alarm rate of between 3% and 5%, the present invention significantly reduces false alarms and ensures that security managers can focus on real risks.

[0093] In summary, the present invention provides a more efficient, accurate and flexible network attack detection solution, which fully demonstrates the great advantages and feasibility in the modern network environment. Therefore, our invention is creative.

[0094] Example 3, reference Figure 7 , is an embodiment of the present invention, and provides an attack detection system based on multi-technology fusion, including a decryption and decoding module, an attack detection module, and a result processing module.

[0095] The decryption and decoding module is used to back up, decrypt and deeply decode the received first access traffic to form a deeply decoded packet; the attack detection module is used to detect attack behaviors on the deeply decoded packets, and identify and mark potential attack behaviors through first-level detection and second-level detection; the result processing module is used to process according to the results of the attack detection module, generate alarm information for the detected attack behaviors, and release normal traffic.

[0096] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0097] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0098] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering, or processing in another suitable manner as necessary, and then stored in a computer memory.

[0099] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc. It should be noted that the above embodiments are only used to illustrate the technical solution of the present invention and are not limited. Although the present invention is described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention, which should be included in the scope of the claims of the present invention.

[0100] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. An attack detection method based on multi-technology fusion, characterized in that: include: Backing up, decrypting and deeply decoding the received first access traffic to form a deeply decoded packet; Perform first-level detection and second-level detection on deep decoding packets; Integrate the traffic that passes the detection to complete the traffic detection.

2. The attack detection method based on multi-technology fusion as claimed in claim 1, characterized in that: The backup, decryption and deep decoding include backing up the received first access traffic, decrypting the backup traffic, and then deep decoding the decrypted traffic packet.

3. The attack detection method based on multi-technology fusion as claimed in claim 2, characterized in that: The forming of the deep decoding packet includes forwarding the decoded traffic and performing two-level detection.

4. The attack detection method based on multi-technology fusion as claimed in claim 3, characterized in that: The first level of detection includes comparing the deep decoding packets with the feature library to mark the attack behavior.

5. The attack detection method based on multi-technology fusion as claimed in claim 4, characterized in that: The second level detection includes detecting deep decoding packets through plug-in detection and intelligent detection to mark attack behaviors.

6. The attack detection method based on multi-technology fusion as claimed in claim 5, characterized in that: The first level detection and the second level detection also include passing the decoded traffic in the deep decoding packet through the first level detection, marking it if an attack behavior is detected, forming an alarm information, forwarding the alarm information, and forwarding it to the second level detection if no attack behavior is detected; The decoded traffic that is not marked as an attack behavior in the first-level detection is forwarded to the plug-in detection and intelligent detection in the second-level detection respectively. In the intelligent detection link, the hot deployment of the detection model is set, and the plug-in detection and intelligent detection are set to be carried out asynchronously. If any of the plug-in detection and intelligent detection detects an attack behavior, it will be marked, and an alarm information will be generated and forwarded. If no attack behavior is detected, the decoded traffic that is not marked as an attack behavior will be marked as passed and forwarded.

7. The attack detection method based on multi-technology fusion as claimed in claim 6, characterized in that: The completion of the flow detection includes integrating the alarm information forwarded by the first level detection and the second level detection to form comprehensive alarm information; The decoded traffic marked as passed by the second-level detection forwarding is integrated, and the original traffic before the normal traffic backup is released.

8. A system using the attack detection method based on multi-technology fusion as claimed in any one of claims 1 to 7, characterized in that: Including decryption and decoding module, attack detection module, and result processing module; The decryption and decoding module is used to back up, decrypt and deeply decode the received first access traffic to form a deeply decoded packet; The attack detection module is used to perform attack behavior detection on the deep decoding packet, and identify and mark potential attack behaviors through the first level detection and the second level detection; The result processing module is used to process according to the result of the attack detection module, generate alarm information for the detected attack behavior, and release normal traffic.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the attack detection method based on multi-technology fusion described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the attack detection method based on multi-technology fusion described in any one of claims 1 to 7 are implemented.

Images