Network intrusion detection method, device, equipment and data security product

Abstract

The invention discloses a network intrusion detection method, device and equipment and a data security product, and the method comprises the steps: firstly, obtaining network attack information, an equipment use state and a network performance index of to-be-detected equipment in a historical time period; then, the current network situation is calculated according to the equipment use state and the network performance index, and the danger value of the equipment to be detected is determined according to the network attack information; and finally, when the danger value is greater than a set danger threshold value or the current network risk value is greater than a set situation threshold value, initiating intrusion early warning. Wherein the current network risk value is in positive correlation with the risk value and the current network situation. Therefore, according to the embodiment of the invention, the current situation of the network is analyzed according to the equipment use state and the network performance index, the intrusion risk of the current network is analyzed in combination with the previous network attack information, and early warning is carried out in time when the intrusion risk is relatively large, so that the aim of early warning in time before the network intrusion occurs is fulfilled.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network intrusion detection method, device, equipment and data security product. Background Art

[0002] Intrusion detection technology is the result of the continuous development of network technology. The current network intrusion detection solution monitors the information of computer networks and determines whether a network attack has occurred based on the monitored information. This type of network intrusion detection solution can only determine that a network intrusion has occurred after a network attack has occurred, and cannot provide timely warnings before a network intrusion occurs. Summary of the invention

[0003] Based on this, the present invention provides a network intrusion detection method, device, equipment and data security product to solve the defect of the prior art that it is impossible to provide timely warning before network intrusion.

[0004] To achieve the above object, an embodiment of the present invention provides a network intrusion detection method, comprising:

[0005] Obtain network attack information, device usage status, and network performance indicators of the device to be detected within a historical period of time;

[0006] Calculate the current network situation according to the device usage status and the network performance index;

[0007] Determine the danger value of the device to be detected according to the network attack information;

[0008] When the danger value is greater than a set danger threshold or the current network risk value is greater than a set situation threshold, an intrusion warning is initiated; wherein the current network risk value is positively correlated with the danger value and the current network situation, respectively.

[0009] To achieve the above object, an embodiment of the present invention further provides a network intrusion detection device, comprising:

[0010] An information acquisition module is used to obtain network attack information, device usage status, and network performance indicators of the device to be detected within a historical period of time;

[0011] A network situation calculation module, used to calculate the current network situation according to the device usage status and the network performance index;

[0012] A danger value calculation module, used to determine the danger value of the device to be detected according to the network attack information;

[0013] The early warning module is used to initiate an intrusion early warning when the danger value is greater than a set danger threshold or the current network risk value is greater than a set situation threshold; wherein the current network risk value is positively correlated with the danger value and the current network situation, respectively.

[0014] To achieve the above object, an embodiment of the present invention further provides a data security product, the data security product is a data center, the data center includes a data sharing service layer, and the network intrusion detection method as described in any of the above embodiments is applied to a data sharing security function module of the data sharing service layer;

[0015] Alternatively, the data security product is a data middle platform, and the data middle platform is used to execute the network intrusion detection method as described in any of the above embodiments;

[0016] Alternatively, the data security product is a capability sharing platform, and the capability sharing platform is used to execute the network intrusion detection method as described in any of the above embodiments.

[0017] To achieve the above objectives, an embodiment of the present invention further provides a network intrusion detection device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, the network intrusion detection method as described in any of the above embodiments is implemented.

[0018] To achieve the above objectives, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the network intrusion detection method as described in any of the above embodiments.

[0019] To achieve the above objectives, an embodiment of the present invention further provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the network intrusion detection method as described in any of the above embodiments.

[0020] Compared with the prior art, the network intrusion detection method, device, equipment, data security product, computer-readable storage medium and computer program product disclosed in the embodiments of the present invention first obtain the network attack information, equipment usage status and network performance indicators of the equipment to be detected in the historical time period; then, calculate the current network situation according to the equipment usage status and the network performance indicators, and determine the danger value of the equipment to be detected according to the network attack information; finally, when the danger value is greater than the set danger threshold or the current network risk value is greater than the set situation threshold, initiate an intrusion warning; wherein the current network risk value is positively correlated with the danger value and the current network situation, respectively. It can be seen that the embodiments of the present invention analyze the current situation of the network according to the equipment usage status and network performance indicators, and analyze the intrusion risk of the current network in combination with previous network attack information, so as to issue a warning in time when the intrusion risk is large, thereby achieving the purpose of being able to issue a warning in time before the network intrusion occurs. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solution of the present invention, the drawings required for use in the implementation mode will be briefly introduced below. Obviously, the drawings described below are only some implementation modes of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0022] Figure 1 It is a flowchart of a network intrusion detection method provided by an embodiment of the present invention;

[0023] Figure 2 It is a structural schematic diagram of a network intrusion detection device provided by an embodiment of the present invention;

[0024] Figure 3 It is a structural diagram of a network intrusion detection device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0025] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0026] See also Figure 1 , Figure 1 1 is a flow chart of a network intrusion detection method provided by an embodiment of the present invention. Specifically, the network intrusion detection method comprises steps S11 to S14:

[0027] S11. Obtain network attack information, device usage status, and network performance indicators of the device to be detected within a historical period of time.

[0028] Specifically, the network intrusion detection method can be executed in real time or in response to a network intrusion detection instruction. The network intrusion detection instruction can be automatically triggered periodically, such as automatically triggered once a month, and the network intrusion detection method is executed at midnight on the first day of each month; the instruction can also be triggered by the user, such as providing a trigger control, and the network intrusion instruction is triggered when the user clicks the trigger control. Whenever the network intrusion detection method is executed, detection is performed based on network data from a recent period of time (i.e., a historical period of time). For example, by responding to the network intrusion detection instruction, network data from the past month is obtained, wherein the network data includes network attack information, device usage status, and network performance indicators.

[0029] S12. Calculate the current network situation according to the device usage status and the network performance index.

[0030] Specifically, the device usage status is used to characterize the resource utilization of the device to be detected. The network performance index is a key parameter for measuring the efficiency of a computer network, which determines the transmission capacity and data processing efficiency of the network. The current network situation is evaluated by combining the device usage status and network performance index in the recent period.

[0031] S13. Determine the danger value of the device to be detected according to the network attack information.

[0032] Specifically, attack behavior is an important indicator of whether the network is safe. Being attacked means that the network is unsafe, and the more attacks it suffers, the more unsafe the network is, and the greater the risk value of the device to be detected. When obtaining attack data (i.e., network attack information), the time range can be appropriately expanded. For example, obtaining attack data for the last two months can improve the accuracy of the final intrusion detection. It is worth noting that the length of the time period for obtaining parameters such as network attack information, device usage status, and network performance indicators is determined by relevant security personnel at their discretion based on the accuracy of intrusion detection, and is not specifically limited here.

[0033] S14. When the danger value is greater than the set danger threshold or the current network risk value is greater than the set situation threshold, initiate an intrusion warning; wherein the current network risk value is positively correlated with the danger value and the current network situation, respectively.

[0034] Specifically, if the danger value AS is greater than the set danger threshold, or the danger value AS is not greater than the set danger threshold, but the current network risk value calculated based on the danger value AS and the current network situation is greater than the set situation threshold, then the intrusion risk is considered to be high and an early warning is issued, otherwise, no early warning is issued. Among them, the set danger threshold and the set situation threshold are both empirical values, and the specific values ​​of the two are set according to the actual situation and are not limited here.

[0035] Compared with the existing technology, this implementation analyzes the current situation of the network based on the device usage status and network performance indicators, and analyzes the intrusion risk of the current network in combination with previous network attack information, so as to provide timely warnings when the intrusion risk is high, thereby achieving the purpose of being able to provide timely warnings before network intrusion occurs.

[0036] Further, the current network risk value is equal to the product of the danger value and the current network situation;

[0037] Alternatively, the current network risk value is calculated in the following manner: add a set deviation value to the current network situation, and then multiply by the danger value to obtain the current network risk value; wherein the set deviation value is greater than zero.

[0038] It is understandable that if the danger value AS is greater than the set danger threshold, it means that the device itself is at risk. At this time, there is a risk of intrusion regardless of the network situation, so an early warning is required. If the danger value AS is not greater than the set danger threshold, it means that the risk of the device itself is not great, but the risk of the network will have an impact on the device. For example, if the network risk is large, although the device itself is relatively safe, it is possible that it will be successfully attacked. Therefore, the danger value of the device will be adjusted upward based on the current network situation to obtain the current network risk value. For example, the current network risk value is equal to AS*(set deviation value + current network situation) or the current network risk value is equal to AS*current network situation. If the current network risk value is greater than the set situation threshold, it means that although the device itself is safe, it may be attacked in the current network situation. Therefore, an alarm is also issued. If the current network risk value is not greater than the set situation threshold, it means that the device can still operate safely in the current network situation. At this time, no alarm is issued. The set deviation value can be 1, 2, 3 or 4, etc., which is not limited here.

[0039] It is worth noting that the calculation method of calculating the current network risk value based on the danger value and the current network situation is not limited to the above specific examples, and can be set according to the actual situation, as long as the current network risk value is positively correlated with the danger value and the current network situation, such as the current network risk value is positively correlated with the product of the danger value and the current network situation, or the current network risk value is positively correlated with the sum of the danger value and the current network situation, or other calculation methods. Preferably, the current network risk value is positively correlated with the product of the danger value and the current network situation.

[0040] This implementation not only performs intrusion detection based on the network attack situation, but also analyzes the current network situation based on the device usage status and network performance indicators. If the comprehensive situation of the network attack situation and the current network situation meets the warning conditions, even if the current network attack situation is normal, it will be considered that there is an intrusion risk and a warning will be issued. This makes intrusion detection no longer rely solely on abnormal information that has occurred, but can also make predictions based on the network situation, ensuring the reliability and foresight of the warning.

[0041] In a preferred embodiment, the network attack information includes at least the total number of attacks, the number of attack types and the attack duration, and the danger value of the device to be detected is positively correlated with the total number of attacks, the attack duration and the number of attack types, respectively.

[0042] Specifically, network attack information can be obtained from the attack logs in the recent period, and the total number of attacks received in the recent period, the number of attack types, and the duration of each attack, AT. i , where i is the attack identifier. For example, if the device has been infected by a worm virus and attacked by a forgery in the recent period, then AY=2. For any attack, the time of the attack is taken as the initial time, and the first time it is detected that it is not attacked is taken as the end time of the attack. The end time minus the initial time is the duration of the attack. The more the total number of attacks, the higher the risk value of the device to be detected; the longer the attack duration, the higher the risk value of the device to be detected; the more the number of attack types, the higher the risk value of the device to be detected. The risk value of the device to be detected is calculated by combining the total number of attacks, the attack duration and the attack types.

[0043] In one implementation, determining the risk value of the device to be detected according to the network attack information includes:

[0044] Calculate the discreteness and average attack duration of the attack duration according to the attack duration of all attacks in the historical time period;

[0045] The danger value of the device to be detected is calculated according to the discrete degree of the attack duration, the average attack duration, the total number of attacks and the number of attack types; wherein the danger value of the device to be detected is positively correlated with the average attack duration, the total number of attacks and the number of attack types, respectively, and the danger value of the device to be detected is negatively correlated with the discrete degree of the attack duration.

[0046] It is understandable that the longer the average attack duration and the greater the total number of attacks, the more frequently the device is attacked, and the higher the risk value of the device to be detected will be. The greater the number of attack types, the more complex the attack, and the higher the risk value of the device to be detected. The greater the dispersion of the attack duration, the more irregular the attack duration, and the lower the risk value of the device to be detected.

[0047] In one implementation, the calculating the risk value of the device to be detected according to the discrete degree of the attack duration, the average attack duration, the total number of attacks, and the number of attack types includes:

[0048] Divide the difference between the average attack duration and the minimum attack duration by the difference between the maximum attack duration and the minimum attack duration to obtain a normalized value of the average duration;

[0049] The normalized value of the average duration, the number of attack types and the total number of attacks are multiplied together, and the resultant value is divided by the discrete degree of the attack duration to obtain the danger value of the device to be detected.

[0050] Exemplarily, the objective risk value of the device to be detected is determined based on historical network attack information:

[0051]

[0052] Among them, AS is the risk value, σ AT AT for all attacks i The standard deviation of avg i {AT i} is the average attack duration of each attack, min i {AT i} is the minimum duration of each attack, max i {AT i} is the maximum duration of each attack. It is the normalized value of the average attack duration in the recent period (i.e., the average duration normalized value). The larger the value, the longer the attack duration and the more dangerous it is. AS is proportional to AT. AY represents the number of types of attacks received. The larger the value, the more dangerous it is. AS is proportional to AT. ATIt indicates the difference between different durations and is used to characterize the discreteness of the attack duration. The larger the value, the more irregular the attack duration is, and the less dangerous it is compared to regular attacks. AT Inversely proportional.

[0053] It is worth noting that the discreteness of the attack duration is not limited to the above specific calculation method, and the variance and other parameters can also be used to characterize the discreteness of the attack duration, which is not specifically limited here. The specific calculation formula of the danger value is not limited to the above specific calculation method, and the specific calculation formula can be set according to the actual situation, as long as the danger value is positively correlated with the average attack duration, the total number of attacks and the number of attack types, and the danger value is negatively correlated with the discreteness of the attack duration.

[0054] In a preferred embodiment, the device usage status includes at least CPU utilization, and the network performance index includes at least bandwidth, network speed and flow data;

[0055] The calculating the current network situation according to the device usage status and the network performance indicator includes:

[0056] The state value of the minimum time period is calculated according to the network speed, CPU utilization and bandwidth within the minimum time period; the state value is positively correlated with the network speed and the bandwidth, respectively, and the state value is negatively correlated with the CPU utilization; the historical time period is divided into a plurality of minimum time periods;

[0057] Calculate the state dispersion degree according to all the state values ​​in the historical time period, and calculate the network impact value according to the state dispersion degree and the total number of the state values;

[0058] Analyze the uplink traffic change trend and the downlink traffic change trend between the device to be detected and each interactive device according to the traffic data, and calculate the data impact value according to the uplink traffic change trend and the downlink traffic change trend of the device to be detected;

[0059] The current network situation is calculated according to the network impact value and the data impact value.

[0060] Specifically, the device usage status includes CPU utilization, which is used to characterize the CPU resource utilization of the device to be detected. The device usage status may also include memory utilization or disk utilization, etc. Memory utilization is used to characterize the memory resource utilization of the device to be detected, and disk utilization is used to characterize the disk resource utilization of the device to be detected. The status values ​​are negatively correlated with CPU utilization, memory utilization, and disk utilization, respectively; network performance indicators include bandwidth, network speed, and traffic data, where traffic data can be data packets, and network performance indicators are used to characterize network status. The following is a brief introduction to these parameters:

[0061] 1. CPU utilization, bandwidth, and network speed

[0062] The network risk can be perceived through the increase of CPU utilization. For example, when a distributed denial of service (DDoS) is provided, the attacker will send a large amount of request traffic through multiple controllers at the same time, causing the device to be tested to be unable to process all requests normally. Since the device to be tested needs to process a large number of requests, the CPU utilization will definitely increase significantly. Therefore, the CPU utilization is used as the detection data.

[0063] Similarly, network risks can also be perceived through bandwidth and network speed. For example, when a DDoS attack occurs, a large number of requests will exhaust the bandwidth, causing it to be unable to process requests normally, thus interrupting the service. Therefore, bandwidth and network speed are used as detection data.

[0064] The three parameters of CPU utilization, bandwidth and network speed change dynamically. Therefore, the three parameters obtained above are in the form of sequences, and each sequence includes X elements.

[0065] Taking CPU utilization as an example, CPU utilization is: CPU = {CPU1, CPU2, …CPU x}.

[0066] The element is determined as follows:

[0067] 1) Divide the detection time period into X parts evenly, that is, the historical time period is divided into X minimum time periods;

[0068] 2) For time period i, get the average CPU utilization CPU in this time period i .

[0069] 2. Data Packet

[0070] Data packets are used to characterize traffic data. Specifically, data packets can reflect network traffic. The more data packets there are, the greater the network traffic is. Through network traffic, we can perceive network risks. For example, when a DDoS attack occurs, the attacker will send a large amount of request traffic through multiple controllers at the same time, which will significantly increase network traffic.

[0071] Data packets are obtained from traffic logs in the recent period. Data packets include upstream traffic data packets and downstream traffic data packets. Upstream traffic data packets exist in the form of triples [destination IP, data packet size, sending time], and downstream traffic data packets exist in the form of triples [source IP, data packet size, received data].

[0072] Specifically, the current network situation is calculated as follows:

[0073] 1. Use CPU utilization, bandwidth, and network speed to form a detection data matrix

[0074] For CPU utilization, bandwidth, and network speed, the detection time period is divided into X parts, each of which corresponds to a minimum time period, and then x value sequences are obtained. The following matrix is ​​constructed based on these three parameters:

[0075]

[0076] Among them, CPU1 is the CPU utilization corresponding to the first share, WB1 is the bandwidth corresponding to the first share, and IS1 is the network speed corresponding to the first share. x is the CPU utilization corresponding to the xth share, WB x is the bandwidth corresponding to the xth part, IS x The network speed corresponding to the xth portion.

[0077] In addition, in order to improve the comparability of the data, the values ​​of this matrix can also be normalized values, such as the following matrix:

[0078]

[0079] Among them, minCPU is the minimum CPU utilization of all shares, and maxCPU is the maximum CPU utilization of all shares. minWB is the minimum bandwidth of all shares, and maxWB is the maximum bandwidth of all shares. minIS is the minimum network rate of all shares, and maxIS is the maximum network rate of all shares.

[0080] 2. Determine the status value of each column based on the value of each column

[0081] Specifically, the state value of the minimum time period is calculated in the following manner:

[0082] The bandwidth in the minimum time period is multiplied by the network speed in the minimum time period, and the resultant is divided by the CPU utilization in the minimum time period to obtain a state value for the minimum time period.

[0083] Starting from the first column in the matrix, select a column of data in sequence, for example, select the first column of data CPU1, WB1 and IS1. The status value of this column is:

[0084] For example, select the xth column data CPU x 、WB x and IS x The status values ​​of this column are:

[0085] The status value represents the device status, which represents the security status of the device to be detected. The higher the CPU utilization, the greater the attack level and the worse the security status. x With ST x The smaller the bandwidth and network speed, the greater the attack level and the worse the security status. x and IS x Both with ST x Directly proportional.

[0086] It is worth noting that the calculation method of the status value is not limited to the above specific formula and can be set according to actual conditions. It is not limited here, but the following conditions need to be met: the status value is positively correlated with the network speed and bandwidth respectively, and the status value is negatively correlated with the CPU utilization.

[0087] 3. Calculate the network impact value W

[0088] The state dispersion degree is calculated based on all the calculated state values. The state dispersion degree can be characterized by parameters such as standard deviation and variance, which are not limited here. Then the network impact value W is calculated based on the state dispersion degree and the total number of state values. It is worth noting that the greater the state dispersion degree, the greater the network impact value; the greater the total number of state values, the smaller the network impact value. It can be understood that the total number of state values ​​is X.

[0089] 4. Calculate the data impact value D

[0090] First, the data packets are classified into uplink data and downlink data; for uplink data packets (i.e., uplink traffic data packets), the data are classified according to the target IP address; for downlink data packets (i.e., downlink traffic data packets), the data are classified according to the source IP address; after the above two classifications, the uplink traffic change trend and the downlink traffic change trend between the device to be detected and the interactive device corresponding to each IP address are analyzed, and the data impact value D is calculated by combining the uplink traffic change trend and the downlink traffic change trend.

[0091] 5. Calculate the current network situation based on the network impact value W and the data impact value D; for example, multiply the network impact value W and the data impact value D to obtain the current network situation. It is worth noting that the calculation method of the current network situation is not limited to the above specific example, and the calculation formula can be designed according to the actual situation, but the following conditions must be met: The current network situation is positively correlated with the network impact value W and the data impact value D respectively.

[0092] In a preferred embodiment, the data impact value is calculated in the following manner:

[0093] Classify the uplink traffic data packets of the device to be detected according to the destination IP address, and classify the downlink traffic data packets of the device to be detected according to the source IP address; wherein the traffic data of the device to be detected includes the uplink traffic data packets and the downlink traffic data packets;

[0094] Determine the sending time and receiving time involved in all data packets of each type of IP address in the historical time period, form a target time period for each type of IP address according to the sending time and the receiving time, and calculate the amount of data packets per unit time length of each type of IP address in the target time period;

[0095] For each type of IP address, obtain the amount of data packets per unit time length in a first preset time period before the target time period, and obtain the amount of data packets per unit time length in a second preset time period after the target time period;

[0096] Calculate a first flow change trend of the amount of data packets per unit time between a first preset time period before the target time period and the target time period, and calculate a second flow change trend of the amount of data packets per unit time between the target time period and a second preset time period after the target time period;

[0097] Count the first number, the second number and the third number respectively; wherein the first number is the number of IP addresses whose first traffic change trend is consistent with the second traffic change trend, the second number is the number of IP addresses whose first traffic change trend is opposite to the second traffic change trend, and the third number is the number of IP addresses whose first traffic change trend has no obvious change or the second traffic change trend has no obvious change;

[0098] The data impact value is calculated according to the first quantity, the second quantity and the third quantity; wherein the data impact value is positively correlated with the second quantity and the third quantity respectively, and the data impact value is negatively correlated with the first quantity.

[0099] Specifically, the data impact value is calculated as follows:

[0100] (1) Each data packet carries a destination IP address and a source IP address. First, the data packets are divided into upstream traffic data packets and downstream traffic data packets. Then, the upstream traffic data packets are classified according to the destination IP address, and the downstream data packets are classified according to the source IP address.

[0101] (2) Parse the data packets, and for each type of data packet classified in step (1), form a target time period according to the sending time involved.

[0102] The start time of the target time period is the earliest time involved in the sending time of the data packets of the corresponding category, and the end time is the latest time involved in the receiving time of the data packets of the corresponding category.

[0103] (3) For each type of data packet, determine the total amount of data packets in a first preset time period ΔT1 before the earliest time, and the total amount of data packets in a second preset time period ΔT2 after the latest time.

[0104] Among them, ΔT1 and ΔT2 are preset time periods, which may be included in the time period for obtaining the detection data (ie, in the historical time period), may be partially included in the time period for obtaining the detection data, or may be outside the time period for obtaining the detection data.

[0105] Considering that the data transmission of an IP address is not necessarily a single continuous transmission, but may also be multiple non-continuous transmissions, the target time period formed in step (2) only obtains the transmission behavior in the most recent period, not necessarily all the transmission behaviors of the IP. Therefore, on this basis, ΔT1 and ΔT2 will be extended forward and backward to obtain the data transmission status of all the extended time periods, and all the data packets of a single transmission behavior of an IP address will be obtained as completely as possible to ensure the accuracy of subsequent intrusion detection.

[0106] The duration of ΔT1 and ΔT2 is set by relevant personnel and can be determined based on the monitoring accuracy. The greater the accuracy, the larger ΔT1 and ΔT2 are, and the greater the integrity of the acquired data is.

[0107] In addition, the values ​​of ΔT1 and ΔT2 may be the same or different, and may be specifically set by the user.

[0108] In this way, for each type of data packet, three time periods are formed, which are the total number of data packets before ΔT1 (i.e. the total amount of data packets in the left adjacent time period), the total amount of data packets after ΔT2 (i.e. the total amount of data packets in the right adjacent time period), target time period T j The amount of data packets Wherein, j is the IP address identifier.

[0109] (4) For each type of data packet, calculate

[0110] is the number of packets per unit time before ΔT1, is the amount of data packets per unit time in the target time period, is the number of data packets per unit time after ΔT2.

[0111] It is the change of the total amount of data packets per unit time before ΔT and the amount of data packets per unit time in the time period involved by the data, that is, the first traffic change trend. is the change of the amount of data packets per unit time in the time period involved in the data and the total amount of data packets per unit time after ΔT, that is, the second flow change trend. ε is a preset minimum value, which is set to prevent the denominator from being zero.

[0112] It shows the changing trend of the total amount of data packets of the jth IP address. If is a positive number, the flow change trend is consistent. If If it is a negative number, the flow rate change trend changes. 0 or If it is infinite, it means that the absolute value of the first flow rate change trend or the absolute value of the second flow rate change trend is less than the set lower threshold, and there is no significant change in one direction.

[0113] It is worth mentioning that The specific calculation method is not limited to the above specific formula, and other methods can also be used for calculation. It is sufficient to be able to reflect to a certain extent whether the flow rate change trends are consistent and whether there is a large change between the first flow rate change trend and the second flow rate change trend.

[0114] (5) Statistics is a positive number (i.e. the first number), is a negative quantity (i.e., the second quantity), and The data impact value is calculated based on the first number, the second number and the third number when the number is 0 or infinite (ie, the third number).

[0115] Further, calculating the data impact value according to the first number, the second number and the third number includes: adding the second number and the third number and dividing the sum by the first number to obtain the data impact value.

[0116] Specifically, the specific calculation formula of the data impact value D is as follows:

[0117]

[0118] in, For all destination IP addresses and all source IP addresses, The total number of negative numbers. For all destination IP addresses and all source IP addresses, The total number of positive numbers. For all destination IP addresses and all source IP addresses, The total amount is either 0 or infinite.

[0119] It is understandable that the data impact value is the degree of impact on network security from the perspective of the data packet, and the larger the value, the greater the impact. The specific calculation formula of the data impact value is not limited to the above specific formula, and can be set according to actual conditions. When it is necessary to ensure that the data impact value is positively correlated with the second quantity and the third quantity respectively, the data impact value is negatively correlated with the first quantity.

[0120] In a preferred embodiment, the calculating of the network impact value according to the state discreteness and the total number of the state values ​​comprises: when the average value of the data packets is not greater than a set minimum threshold or is greater than or equal to a set maximum threshold, calculating the network impact value according to the total number of the data packets, the state discreteness and the total number of the state values; wherein the network impact value is positively correlated with the total number of the data packets and the state discreteness, respectively, and the network impact value is negatively correlated with the total number of the state values;

[0121] When the average value of the data packets is greater than the set minimum threshold and less than the set maximum threshold, the network impact value is calculated according to the state discreteness and the total number of the state values; wherein the network impact value is positively correlated with the state discreteness, and the network impact value is negatively correlated with the total number of the state values.

[0122] Furthermore, the network impact value is calculated in the following manner:

[0123] When the average value of the data packets is not greater than a preset minimum threshold or not less than a preset maximum threshold, dividing the state discreteness by the cube root of the total number of the state values ​​and multiplying the result by the total number of the data packets to obtain the network impact value;

[0124] When the average value of the data packets is between the preset minimum threshold and the preset maximum threshold, the state dispersion degree is divided by the cube root of the total number of the state values ​​to obtain the network impact value.

[0125] For example, assuming that the minimum threshold is set to 64 bytes and the maximum threshold is set to 1518 bytes, the specific calculation method of the network impact value W is as follows:

[0126] like Byte or but

[0127] like but

[0128] in, The state value is STi The mean value, P u is the average size of the upstream traffic data packets (i.e., the average value of the upstream traffic data packets), P d is the average size of the downlink traffic data packets (i.e., the average value of the downlink traffic data packets).

[0129] It is the cubic difference of all status values. This value indicates the degree of difference between status values ​​(i.e., the degree of discreteness). The greater the difference, the greater the fluctuation of device status in the previous period of time, which has a greater impact on the network. The smaller the difference, the more stable the device status in the previous period of time, which has a smaller impact on the network.

[0130] n D is the total number of packets, (P u +P d ) / 2 is the average size of a data packet. Under normal circumstances, the average size of a data packet is between 64 bytes and 1518 bytes. If it is not larger than 64 bytes, it means that a fragmentation attack may occur. Therefore, n D The larger the value, the greater the impact on the network. If it is not less than 1518 bytes, it means that an attack with a very large data packet may occur. Therefore, n D The larger it is, the greater the impact on the network.

[0131] It is worth noting that the network impact value is the degree of impact on network security obtained from network-related detection data. The larger the value, the greater the impact. The specific calculation method of the network impact value is not limited to the above specific formula and can be set according to actual conditions.

[0132] Compared with the prior art, the method provided by the embodiment of the present invention first obtains the network attack information, device usage status and network performance indicators of the device to be detected in the historical time period; then, the current network situation is calculated according to the device usage status and the network performance indicators, and the danger value of the device to be detected is determined according to the network attack information; finally, when the danger value is greater than the set danger threshold or the current network risk value is greater than the set situation threshold, an intrusion warning is initiated; wherein the current network risk value is positively correlated with the danger value and the current network situation, respectively. It can be seen that the embodiment of the present invention analyzes the current situation of the network according to the device usage status and network performance indicators, and analyzes the intrusion risk of the current network in combination with previous network attack information, so as to issue a warning in time when the intrusion risk is relatively high, thereby achieving the purpose of being able to issue a warning in time before a network intrusion occurs.

[0133] See also Figure 2 The embodiment of the present invention further provides a network intrusion detection device, including:

[0134] Information acquisition module 21, used to obtain network attack information, device usage status and network performance indicators of the device to be detected in the historical time period;

[0135] A network situation calculation module 22, used to calculate the current network situation according to the device usage status and the network performance index;

[0136] A risk value calculation module 23, used to determine the risk value of the device to be detected according to the network attack information;

[0137] The warning module 24 is used to initiate an intrusion warning when the danger value is greater than a set danger threshold or the current network risk value is greater than a set situation threshold; wherein the current network risk value is positively correlated with the danger value and the current network situation, respectively.

[0138] In one implementation, the network attack information includes at least the total number of attacks, the number of attack types and the attack duration, and the danger value of the device to be detected is positively correlated with the total number of attacks, the attack duration and the number of attack types, respectively.

[0139] In one implementation, the risk value calculation module 23 is specifically used to:

[0140] Calculate the discreteness and average attack duration of the attack duration according to the attack duration of all attacks in the historical time period;

[0141] The danger value of the device to be detected is calculated according to the discrete degree of the attack duration, the average attack duration, the total number of attacks and the number of attack types; wherein the danger value of the device to be detected is positively correlated with the average attack duration, the total number of attacks and the number of attack types, respectively, and the danger value of the device to be detected is negatively correlated with the discrete degree of the attack duration.

[0142] In one implementation, the calculating the risk value of the device to be detected according to the discrete degree of the attack duration, the average attack duration, the total number of attacks, and the number of attack types includes:

[0143] Divide the difference between the average attack duration and the minimum attack duration by the difference between the maximum attack duration and the minimum attack duration to obtain a normalized value of the average duration;

[0144] The normalized value of the average duration, the number of attack types and the total number of attacks are multiplied together, and the resultant value is divided by the discrete degree of the attack duration to obtain the danger value of the device to be detected.

[0145] In one embodiment, the device usage status includes at least CPU utilization, and the network performance index includes at least bandwidth, network speed and flow data;

[0146] The network situation calculation module 22 is specifically used for:

[0147] Calculating the state value of the minimum time period according to the network speed, CPU utilization and bandwidth within the minimum time period; wherein the historical time period is divided into a plurality of minimum time periods, the state value is positively correlated with the network speed and the bandwidth, and the state value is negatively correlated with the CPU utilization;

[0148] Calculate the state dispersion degree according to all the state values ​​in the historical time period, and calculate the network impact value according to the state dispersion degree and the total number of the state values;

[0149] Analyze the uplink traffic change trend and the downlink traffic change trend between the device to be detected and each interactive device according to the traffic data, and calculate the data impact value according to the uplink traffic change trend and the downlink traffic change trend of the device to be detected;

[0150] The current network situation is calculated according to the network impact value and the data impact value.

[0151] In one implementation, the state value of the minimum time period is calculated in the following manner:

[0152] The bandwidth in the minimum time period is multiplied by the network speed in the minimum time period, and the result is divided by the CPU utilization in the minimum time period to obtain the state value of the minimum time period;

[0153] The network impact value is calculated in the following way:

[0154] When the average value of the data packets is not greater than a preset minimum threshold or not less than a preset maximum threshold, dividing the state discreteness by the cube root of the total number of the state values ​​and multiplying the result by the total number of the data packets to obtain the network impact value;

[0155] When the average value of the data packets is between the preset minimum threshold and the preset maximum threshold, dividing the state dispersion degree by the cube root of the total number of the state values ​​to obtain the network impact value;

[0156] The current network situation is calculated in the following manner: multiplying the network impact value and the data impact value to obtain the current network situation.

[0157] In one embodiment, the data impact value is calculated in the following manner:

[0158] Classify the uplink traffic data packets of the device to be detected according to the destination IP address, and classify the downlink traffic data packets of the device to be detected according to the source IP address; wherein the traffic data of the device to be detected includes the uplink traffic data packets and the downlink traffic data packets;

[0159] Determine the sending time and receiving time involved in all data packets of each type of IP address in the historical time period, form a target time period for each type of IP address according to the sending time and the receiving time, and calculate the amount of data packets per unit time length of each type of IP address in the target time period;

[0160] For each type of IP address, obtain the amount of data packets per unit time length in a first preset time period before the target time period, and obtain the amount of data packets per unit time length in a second preset time period after the target time period;

[0161] Calculate a first flow change trend of the amount of data packets per unit time between a first preset time period before the target time period and the target time period, and calculate a second flow change trend of the amount of data packets per unit time between the target time period and a second preset time period after the target time period;

[0162] Count the first number, the second number and the third number respectively; wherein the first number is the number of IP addresses whose first traffic change trend is consistent with the second traffic change trend, the second number is the number of IP addresses whose first traffic change trend is opposite to the second traffic change trend, and the third number is the number of IP addresses whose first traffic change trend has no obvious change or the second traffic change trend has no obvious change;

[0163] The data impact value is calculated according to the first quantity, the second quantity and the third quantity; wherein the data impact value is positively correlated with the second quantity and the third quantity respectively, and the data impact value is negatively correlated with the first quantity.

[0164] In one implementation, calculating the data impact value according to the first quantity, the second quantity, and the third quantity includes:

[0165] The second number and the third number are added and then divided by the first number to obtain the data impact value.

[0166] In one implementation, the current network risk value is equal to the product of the danger value and the current network situation;

[0167] Alternatively, the current network risk value is calculated in the following manner: add a set deviation value to the current network situation, and then multiply by the danger value to obtain the current network risk value; wherein the set deviation value is greater than zero.

[0168] It is worth noting that the working principle of the network intrusion detection device provided in the above embodiments can refer to the working process of the network intrusion detection method provided in any of the above embodiments, which will not be described in detail here.

[0169] Compared with the prior art, the network intrusion detection device provided by the embodiment of the present invention first obtains the network attack information, device usage status and network performance indicators of the device to be detected in the historical time period; then, the current network situation is calculated according to the device usage status and the network performance indicators, and the danger value of the device to be detected is determined according to the network attack information; finally, when the danger value is greater than the set danger threshold or the current network risk value is greater than the set situation threshold, an intrusion warning is initiated; wherein the current network risk value is positively correlated with the danger value and the current network situation, respectively. It can be seen that the embodiment of the present invention analyzes the current situation of the network according to the device usage status and network performance indicators, and analyzes the intrusion risk of the current network in combination with previous network attack information, so as to issue a warning in time when the intrusion risk is relatively high, thereby achieving the purpose of being able to issue a warning in time before a network intrusion occurs.

[0170] An embodiment of the present invention further provides a data security product, the data security product is a data center, the data center includes a data sharing service layer, and the network intrusion detection method as described in any of the above embodiments is applied to a data sharing security function module of the data sharing service layer;

[0171] Alternatively, the data security product is a data middle platform, and the data middle platform is used to execute the network intrusion detection method as described in any of the above embodiments;

[0172] Alternatively, the data security product is a capability sharing platform, and the capability sharing platform is used to execute the network intrusion detection method as described in any of the above embodiments. Optionally, the capability sharing platform is a general capability sharing platform.

[0173] Exemplarily, it is assumed that the data security product is a security data center applied to the field of China Mobile Information Technology (IT). The architecture of the security data center includes a data sharing service layer, and the data sharing service layer has a data sharing security function, which is implemented by a data sharing security function module. The network intrusion detection method described in any of the above embodiments is executed by a data sharing security function module. The security data center is a unified collection and aggregation platform for security data, including a data collection layer, a data preprocessing layer, a data storage and computing layer, a data development layer, a data mart layer, and a data sharing service layer, etc., which can realize the centralized operation and internal sharing of security data. When the security data center receives a sharing request for security data from a user to be shared, it determines whether to share the security data with the user based on the level of the user and the value of the security data requested by the user.

[0174] See also Figure 3 The embodiment of the present invention further provides a network intrusion detection device, including a processor 31, a memory 32, and a computer program stored in the memory 32 and configured to be executed by the processor 31. When the processor 31 executes the computer program, the steps in the above-mentioned network intrusion detection method embodiment are implemented, for example Figure 1 S11 to S14 in the above description; or, the processor 31 implements the functions of each module in the above-mentioned device embodiments when executing the computer program.

[0175] Exemplarily, the computer program can be divided into one or more modules, and the one or more modules are stored in the memory 32 and executed by the processor 31 to complete the present invention. The one or more modules can be a series of computer program instruction segments that can complete specific functions, and the instruction segments are used to describe the execution process of the computer program in the network intrusion detection device. For example, the computer program can be divided into multiple modules. The specific working process of each module can refer to the working process of the network intrusion detection device described in the above embodiment, and will not be repeated here.

[0176] The network intrusion detection device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The network intrusion detection device may include, but is not limited to, a processor 31 and a memory 32. Those skilled in the art may understand that the network intrusion detection device may also include input and output devices, network access devices, buses, etc.

[0177] The processor 31 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor 31 is the control center of the network intrusion detection device, and uses various interfaces and lines to connect various parts of the entire network intrusion detection device.

[0178] The memory 32 can be used to store the computer program and / or module. The processor 31 realizes various functions of the network intrusion detection device by running or executing the computer program and / or module stored in the memory 32 and calling the data stored in the memory 32. The memory 32 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone, etc. In addition, the memory 32 can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0179] Wherein, if the module integrated in the network intrusion detection device is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor 31, the steps of the above-mentioned method embodiments can be implemented. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium, etc.

[0180] An embodiment of the present invention further provides a computer program product, including a computer program / instruction, wherein when the computer program / instruction is executed by a processor, the network intrusion detection method as described in any of the above embodiments is implemented.

[0181] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A network intrusion detection method, characterized in that: include: Obtain network attack information, device usage status, and network performance indicators of the device to be detected within a historical period of time; Calculate the current network situation according to the device usage status and the network performance index; Determine the danger value of the device to be detected according to the network attack information; When the danger value is greater than a set danger threshold or the current network risk value is greater than a set situation threshold, an intrusion warning is initiated; wherein the current network risk value is positively correlated with the danger value and the current network situation, respectively.

2. The network intrusion detection method according to claim 1, characterized in that: The network attack information includes at least the total number of attacks, the number of attack types and the attack duration, and the danger value of the device to be detected is positively correlated with the total number of attacks, the attack duration and the number of attack types respectively.

3. The network intrusion detection method according to claim 2, characterized in that: Determining the risk value of the device to be detected according to the network attack information includes: Calculate the discreteness and average attack duration of the attack duration according to the attack duration of all attacks in the historical time period; The danger value of the device to be detected is calculated according to the discrete degree of the attack duration, the average attack duration, the total number of attacks and the number of attack types; wherein the danger value of the device to be detected is positively correlated with the average attack duration, the total number of attacks and the number of attack types, respectively, and the danger value of the device to be detected is negatively correlated with the discrete degree of the attack duration.

4. The network intrusion detection method according to claim 3, characterized in that: The calculating the danger value of the device to be detected according to the discrete degree of the attack duration, the average attack duration, the total number of attacks and the number of attack types includes: Divide the difference between the average attack duration and the minimum attack duration by the difference between the maximum attack duration and the minimum attack duration to obtain a normalized value of the average duration; The normalized value of the average duration, the number of attack types and the total number of attacks are multiplied together, and the resultant value is divided by the discrete degree of the attack duration to obtain the danger value of the device to be detected.

5. The network intrusion detection method according to claim 1, characterized in that: The device usage status includes at least CPU utilization, and the network performance indicators include at least bandwidth, network speed and flow data; The calculating the current network situation according to the device usage status and the network performance indicator includes: The state value of the minimum time period is calculated according to the network speed, CPU utilization and bandwidth within the minimum time period; the state value is positively correlated with the network speed and the bandwidth, and negatively correlated with the CPU utilization; the historical time period is divided into a plurality of minimum time periods; Calculate the state dispersion degree according to all the state values ​​in the historical time period, and calculate the network impact value according to the state dispersion degree and the total number of the state values; Analyze the uplink traffic change trend and the downlink traffic change trend between the device to be detected and each interactive device according to the traffic data, and calculate the data impact value according to the uplink traffic change trend and the downlink traffic change trend of the device to be detected; The current network situation is calculated according to the network impact value and the data impact value.

6. The network intrusion detection method according to claim 5, characterized in that: The state value of the minimum time period is calculated as follows: The bandwidth in the minimum time period is multiplied by the network speed in the minimum time period, and the result is divided by the CPU utilization in the minimum time period to obtain the state value of the minimum time period; The network impact value is calculated in the following way: When the average value of the data packets is not greater than a preset minimum threshold or not less than a preset maximum threshold, the state discreteness is divided by the cube root of the total number of the state values, and the result is multiplied by the total number of the data packets to obtain the network impact value; When the average value of the data packets is between the preset minimum threshold and the preset maximum threshold, dividing the state discreteness by the cube root of the total number of the state values ​​to obtain the network impact value; The current network situation is calculated in the following manner: multiplying the network impact value and the data impact value to obtain the current network situation.

7. The network intrusion detection method according to claim 5, characterized in that: The data impact value is calculated in the following way: Classify the uplink traffic data packets of the device to be detected according to the destination IP address, and classify the downlink traffic data packets of the device to be detected according to the source IP address; wherein the traffic data of the device to be detected includes the uplink traffic data packets and the downlink traffic data packets; Determine the sending time and receiving time involved in all data packets of each type of IP address in the historical time period, form a target time period for each type of IP address according to the sending time and the receiving time, and calculate the amount of data packets per unit time length of each type of IP address in the target time period; For each type of IP address, obtain the amount of data packets per unit time length in a first preset time period before the target time period, and obtain the amount of data packets per unit time length in a second preset time period after the target time period; Calculate a first flow change trend of the amount of data packets per unit time between a first preset time period before the target time period and the target time period, and calculate a second flow change trend of the amount of data packets per unit time between the target time period and a second preset time period after the target time period; Count the first number, the second number and the third number respectively; wherein the first number is the number of IP addresses whose first traffic change trend is consistent with the second traffic change trend, the second number is the number of IP addresses whose first traffic change trend is opposite to the second traffic change trend, and the third number is the number of IP addresses whose first traffic change trend has no obvious change or the second traffic change trend has no obvious change; The data impact value is calculated according to the first quantity, the second quantity and the third quantity; wherein the data impact value is positively correlated with the second quantity and the third quantity respectively, and the data impact value is negatively correlated with the first quantity.

8. The network intrusion detection method according to claim 7, characterized in that: The calculating the data impact value according to the first quantity, the second quantity and the third quantity includes: The second number and the third number are added and then divided by the first number to obtain the data impact value.

9. A network intrusion detection device, characterized in that: include: An information acquisition module is used to obtain network attack information, device usage status, and network performance indicators of the device to be detected within a historical period of time; A network situation calculation module, used to calculate the current network situation according to the device usage status and the network performance index; A danger value calculation module, used to determine the danger value of the device to be detected according to the network attack information; The early warning module is used to initiate an intrusion early warning when the danger value is greater than a set danger threshold or the current network risk value is greater than a set situation threshold; wherein the current network risk value is positively correlated with the danger value and the current network situation, respectively.

10. A data security product, characterized in that: The data security product is a data center, the data center includes a data sharing service layer, and the network intrusion detection method according to any one of claims 1 to 8 is applied to a data sharing security function module of the data sharing service layer; Alternatively, the data security product is a data middle platform, and the data middle platform is used to execute the network intrusion detection method according to any one of claims 1 to 8; Alternatively, the data security product is a capability sharing platform, and the capability sharing platform is used to execute the network intrusion detection method as described in any one of claims 1 to 8.

11. A network intrusion detection device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the network intrusion detection method according to any one of claims 1 to 8 when executing the computer program.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located is controlled to execute the network intrusion detection method according to any one of claims 1 to 8.

13. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the network intrusion detection method according to any one of claims 1 to 8 is implemented.

Images