Network state determination method and device, equipment, medium and program product

Abstract

The invention discloses a network state determination method and device, equipment, a medium and a program product. The method comprises the following steps: network state determination equipment acquires a first set; wherein the first set comprises a set of original data packets associated with at least one network address translation device arranged in a target network; determining a kth identifier corresponding to a kth payload carried by a kth original data packet in the first set; wherein k is an integer greater than or equal to 1 and less than or equal to K; k is the number of the original data packets in the first set; integrating the original data packets in the first set based on the first identifier to the Kth identifier to obtain a second set; wherein the mth data packet in the second set corresponds to at least two original data packets in the first set; m is an integer greater than or equal to 1; and determining the network state of the target network based on the data packets in the second set.

Description

Technical Field

[0001] The present application relates to the field of network detection technology, and in particular to a network status determination method, device, equipment, medium and program product. Background Art

[0002] For a network that is equipped with both a Network Address Translation (NAT) and a network security device, the network security device can achieve a secure state for data transmission between a source device and a NAT device and between a NAT device and a target device. Therefore, data packets input and output from the NAT device may trigger multiple alarm data. In the related art, in order to determine the security state of the network, it is necessary to analyze each of the above alarm data one by one through the network security device. However, the above method for determining the complete state of the network is inefficient and cannot meet the actual network state determination requirements. Summary of the invention

[0003] Based on the above technical problems, the embodiments of the present application provide a network status determination method, apparatus, device, medium and program product.

[0004] The technical solution provided by the embodiment of the present application is as follows:

[0005] The present invention provides a method for determining a network status, the method comprising:

[0006] The network status determination device acquires a first set; wherein the first set includes a set of original data packets associated with at least one network address translation device set in the target network;

[0007] Determine a kth identifier corresponding to a kth payload carried by a kth original data packet in the first set; wherein k is an integer greater than or equal to 1 and less than or equal to K; and K is the number of the original data packets in the first set;

[0008] Integrate the original data packets in the first set based on the first identifier to the Kth identifier to obtain a second set; wherein the mth data packet in the second set corresponds to at least two original data packets in the first set; m is an integer greater than or equal to 1;

[0009] Based on the data packets in the second set, a network status of the target network is determined.

[0010] In some embodiments, the integrating the original data packets in the first set based on the first identifier to the Kth identifier to obtain the second set includes:

[0011] If the xth identifier is the same as the yth identifier, at least the xth original data packet corresponding to the xth identifier and the yth original data packet corresponding to the yth identifier are integrated to obtain the nth data packet; wherein x is different from y, and both x and y are integers greater than or equal to 1 and less than or equal to K; and n is an integer greater than or equal to 1 and less than or equal to N;

[0012] Determine that the second set includes the first data packet to the Nth data packet; wherein N is an integer greater than 1, and N is used to represent the number of data packets obtained by integrating the original data packets in the first set.

[0013] In some embodiments, determining the kth identifier corresponding to the kth payload carried by the kth original data packet in the first set includes:

[0014] Processing at least the device authentication identifier and / or the path parameter contained in the kth payload by a hash function to obtain a kth hash value;

[0015] The k-th identifier is determined to be the k-th hash value.

[0016] In some embodiments, determining the network status of the target network based on the data packets in the second set includes:

[0017] Obtaining initial logs associated with at least two original data packets corresponding to the mth data packet;

[0018] Determine time information associated with at least two original data packets corresponding to the mth data packet;

[0019] Integrate the initial log based on the time information to obtain an mth log corresponding to the mth data packet; wherein the data volume of the mth log is smaller than the data volume of the initial log;

[0020] The mth log is analyzed to obtain the network status of the target network.

[0021] In some embodiments, after determining the network status of the target network based on the data packets in the second set, the method further includes:

[0022] If the network status includes a threat status, obtaining a source address set and a destination address set of at least two original data packets corresponding to the mth data packet;

[0023] Determine an association relationship between at least two original data packets corresponding to the mth data packet and the at least one address translation device;

[0024] Based on the association relationship, the source address set and the target address set, a target device corresponding to the threat state is determined; wherein the target device includes an attacking device and / or an attacked device associated with the threat state.

[0025] In some embodiments, the network status determination device obtains the first set, including:

[0026] If the alarm information is detected, the network status determination device is controlled to obtain the first set.

[0027] The embodiment of the present application further provides a network status determination device, the network status determination device comprising:

[0028] An acquisition module, configured to acquire a first set; wherein the first set includes a set of original data packets associated with at least one network address translation device set in the target network;

[0029] A determination module, configured to determine a kth identifier corresponding to a kth payload carried by a kth original data packet in the first set; wherein k is an integer greater than or equal to 1 and less than or equal to K; and K is the number of the original data packets in the first set;

[0030] a processing module, configured to integrate the original data packets in the first set based on the first identifier to the Kth identifier to obtain a second set; wherein the mth data packet in the second set corresponds to at least two original data packets in the first set; m is an integer greater than or equal to 1;

[0031] The determination module is further used to determine the network status of the target network based on the data packets in the second set.

[0032] An embodiment of the present application also provides a network status determination device, which includes a processor and a memory; wherein a computer program is stored in the memory; when the computer program is executed by the processor, it can implement any of the network status determination methods described above.

[0033] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored; when the computer program is executed by a processor of an electronic device, it can implement any of the above-described methods for determining a network status.

[0034] An embodiment of the present application also provides a computer program product, which includes a computer program; when the computer program is executed by a processor of an electronic device, it can implement any of the network status determination methods described above.

[0035] The network status determination method provided in the embodiment of the present application obtains a set of original data packets associated with at least one NAT device set in the target network, namely, a first set, through a network status determination device, so as to realize real-time tracking and aggregation of original data packets associated with the NAT device set in the target network; and determines the kth identifier corresponding to the kth payload carried by the kth original data packet in the first set, and k is an integer greater than or equal to 1 and less than or equal to K, and K is the number of original data packets in the first set. In this way, through the above operation, not only the real-time analysis of the kth payload carried by the kth original data packet in the first set is realized, but also the kth identifier can be associated with the kth payload, so that the kth identifier can completely and accurately characterize the data characteristics of the kth payload; on this basis, the original data packets in the first set are integrated based on the first identifier to the Kth identifier to obtain the second set, and the mth data packet in the second set corresponds to at least two original data packets in the first set, such as Therefore, through the above operation, not only the targeted integration of the original data packets in the first set is achieved, but also the consistency between the data packets in the second set and the original data packets in the first set is retained; further, since the mth data packet in the second set corresponds to at least two original data packets in the first set, the data volume of the data packets included in the second set can be reduced relative to the first set; on this basis, by determining the network status of the target network based on the data packets in the second set, the data volume of the data packets associated in the network status determination process can be reduced, thereby achieving the merging and reduction of different security events associated with multiple data packets that may occur in the target network. Therefore, the network status determination method provided in the embodiment of the present application is relative to the method in the related art of analyzing each data packet associated with the NAT device to determine the network status. The above method can effectively improve the efficiency and accuracy of determining the network status of the target network, thereby meeting the actual network status determination needs. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 This is a schematic diagram of the structure of setting up NAT equipment in the internal network;

[0037] Figure 2 A flowchart of a method for determining a network status provided in an embodiment of the present application;

[0038] Figure 3 A schematic diagram of a structure in which a client implements data transmission between the client and the server through a proxy device;

[0039] Figure 4 A schematic diagram of the structure of a network status determination device provided in an embodiment of the present application;

[0040] Figure 5A schematic diagram of the structure of a network status determination device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0041] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0042] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0043] The concept of NAT was proposed in 1994, and it is used to achieve address conversion between devices in the internal network and devices in the external network. For example, when the host device in the internal network has been configured with a local Internet Protocol (IP), when the host device in the internal network needs to access the host device set in the external network, the NAT software can be configured in the router of the internal network to convert the router into a NAT router, and the NAT router has at least one valid global IP address; at this time, the local IP address of the host device set in the internal network can be converted to a global IP address through the NAT router, and a communication connection is established with the external network through the global IP address, so that the host device in the internal network can access the host device set in the external network. Among them, the local IP address is used to represent a special IP address used only in the internal network.

[0044] Therefore, by converting the internal IP addresses of host devices in the internal network into global IP addresses through a NAT router, not only can the shortage of IP address resources be alleviated, but also, by hiding and protecting the internal IP addresses of host devices in the internal network, the risk of attacks from host devices in the external network on host devices set in the internal network can be effectively reduced.

[0045] Figure 1 This is a schematic diagram of the structure of setting up NAT equipment in the internal network. Figure 1 As shown, the internal network 1 includes not only the first device 101, the second device 102, the first NAT 103 and the second NAT 104, but also network security devices respectively arranged at the first position 105, the second position 106 and the third position 107. In the internal network 1, assuming that the data stream is transmitted from the first device 101 to the second device via the first NAT 103 and the second NAT 104, then, in the above process, the source address and / or the destination address of the data packet in the data stream are converted respectively via the first NAT 103 and the second NAT 104, so that the source address and / or the destination address of the data packet at the first position 105 to the third position 107 are different.

[0046] During the above-mentioned data stream transmission process, if the network security device detects the transmission status of the above-mentioned data packet between the first device 101 and the second device 102, three alarm data can be generated respectively at the first position 105 to the third position 107; and, in order to reduce network security risks, the network security device not only needs to analyze the three alarm data respectively, but also needs to push the three alarm data to the network administrator respectively, so that the network security device and the network administrator need to analyze the three alarm data respectively, which causes the network security device and the network administrator to believe that three attack events have occurred in the network; further, since the source addresses and / or target addresses in the data packets corresponding to the three alarm data are different, the network security device and the network administrator cannot accurately identify whether there is a correlation between the three attack events, nor can they determine the real attack source host and the attack target host corresponding to the three attack events, and therefore cannot accurately and real-time process the security status in network 1.

[0047] Therefore, the security status detection method for a network equipped with a NAT device in the related art is inefficient and cannot meet the actual network status determination requirements.

[0048] Based on the above technical problems, the embodiments of the present application provide a network status determination method, apparatus, device, medium and program product.

[0049] Figure 2 A flowchart of a method for determining a network status provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, the method may include the following steps:

[0050] Step 201: The network status determination device obtains a first set.

[0051] The first set includes a set of original data packets associated with at least one NAT device set in the target network.

[0052] In one implementation, the network status determination device may include a network security device; illustratively, the network security device may include a firewall or a situational awareness device.

[0053] In one embodiment, the number of network status determination devices may be at least one, and the network security device may be set at at least one node and / or device in the target network to track and detect the data transmission status of at least one node and / or device; exemplarily, the above-mentioned nodes and / or devices may include at least one NAT device and at least one network status determination device.

[0054] In one implementation, the network security device may include a physical machine device or a virtual machine device.

[0055] In one implementation, the NAT device may include a physical machine device or a virtual machine device having a NAT function; illustratively, the NAT device may perform a Basic NAT operation or a Port Address Translation (PAT) operation.

[0056] Among them, when performing Basic NAT operations, the NAT device performs IP address conversion on the data packets it receives, but does not perform port mapping operations; when performing PAT operations, the NAT device not only performs IP address conversion on the data packets it receives, but also maps ports to map multiple internal addresses in the target network to at least a certain number or even one external IP address.

[0057] In one embodiment, the NAT device can perform static NAT operations or dynamic NAT operations; wherein, the static NAT operation is used to permanently map the IP address of each node or device in the target network to a valid IP address in the external network, and this operation is mostly used to convert the server address; while the dynamic NAT operation uses a dynamic allocation method to map one or more valid IP addresses in the external network to the IP address of a node or device in the target network.

[0058] In one embodiment, the target network may include an internal network.

[0059] In one embodiment, the first set may include a set of data packets transmitted between at least one node and / or device of the target network and at least one NAT device; exemplarily, when the target network includes multiple NAT devices, the first set may also include a set of data packets transmitted between NAT devices.

[0060] In one embodiment, the original data packets in the first set may include data packets sent or received by at least one node and / or device, and data packets after at least one NAT device performs address translation on data packets sent or received by at least one node and / or device.

[0061] In one implementation, the first set may be obtained by any of the following methods:

[0062] The network status determination device collects and aggregates data packets transmitted by at least one NAT device in the target network to obtain a first set.

[0063] The network status determination device samples data packets transmitted by at least one NAT device based on a specified frequency or a specified time interval, thereby obtaining a first set.

[0064] Step 202: Determine the kth identifier corresponding to the kth payload carried by the kth original data packet in the first set.

[0065] Wherein, k is an integer greater than or equal to 1 and less than or equal to K; K is the number of original data packets in the first set.

[0066] In one implementation, the kth effective payload carried by the kth original data packet may include valid data carried by the kth original data packet; illustratively, the valid data may include data or requestBody in the kth original data packet excluding the header.

[0067] In one implementation, the kth identifier may include the number and / or data amount of the kth payload.

[0068] In one implementation, the kth identifier may represent the number of the data transmission event represented by the kth payload; illustratively, the data transmission event may include at least one of the type, time, and data volume of the data transmitted by the kth payload.

[0069] In one implementation, the kth identifier may be in the form of numbers, characters, a combination of numbers and characters, and a character string.

[0070] In one implementation, the kth identifier may be obtained in the following manner:

[0071] At least part of the data included in the kth effective load is converted through a preset data conversion model or data conversion function to obtain a processing result, and the processing result is determined as the kth identifier.

[0072] Step 203: Integrate the original data packets in the first set based on the first identifier to the Kth identifier to obtain a second set.

[0073] The mth data packet in the second set corresponds to at least two original data packets in the first set; m is an integer greater than or equal to 1.

[0074] In one implementation, the second set may include at least one data packet.

[0075] In one implementation, the second set may be obtained by any of the following methods:

[0076] According to the coherence, consistency or completeness of the data transmission events represented by the first to Kth identifiers, the original data packets in the first set are aggregated to obtain a first aggregation result, and the first aggregation result is determined as the data packet in the second set.

[0077] According to the correlation of the data transmission contents represented by the first to Kth identifiers, the effective loads carried by the original data packets in the first set are aggregated to obtain a second aggregation result, and the second aggregation result is determined as the data packet in the second set.

[0078] Step 204: Determine the network status of the target network based on the data packets in the second set.

[0079] In one implementation, the network status may include whether the target network is in a secure state.

[0080] In one implementation, the network status may indicate whether the network is in an attacked state and the threat level of the attacked state.

[0081] In one implementation, the network status of the target network may be determined by:

[0082] Analyze the payload carried by the mth data packet in the second set, determine the operation performed by the mth data packet, and determine the above-mentioned network status according to the type and / or result of the operation; exemplarily, the type of the above-mentioned operation may include data access type and attack type, etc.; exemplarily, the result of the above-mentioned operation may include at least one of successful data access, failed data access, successful attack and failed attack.

[0083] As can be seen from the above, the network status determination method provided in the embodiment of the present application obtains a set of original data packets associated with at least one NAT device set in the target network, namely, a first set, through a network status determination device, so as to realize real-time tracking and aggregation of original data packets associated with the NAT device set in the target network; and, determines the kth identifier corresponding to the kth payload carried by the kth original data packet in the first set, and k is an integer greater than or equal to 1 and less than or equal to K, and K is the number of original data packets in the first set. In this way, through the above operation, not only the real-time analysis of the kth payload carried by the kth original data packet in the first set is realized, but also the kth identifier can be associated with the kth payload, so that the kth identifier can completely and accurately characterize the data characteristics of the kth payload; on this basis, the original data packets in the first set are integrated based on the first identifier to the Kth identifier to obtain a second set, and the mth data packet in the second set corresponds to at least two original data packets in the first set. Packet, thus, through the above operation, not only the targeted integration of the original data packets in the first set is achieved, but also the consistency between the data packets in the second set and the original data packets in the first set is retained; further, since the mth data packet in the second set corresponds to at least two original data packets in the first set, thus, relative to the first set, the data volume of the data packets contained in the second set can be reduced; on this basis, by determining the network status of the target network based on the data packets in the second set, the data volume of the data packets associated in the network status determination process can be reduced, thereby achieving the merging and reduction of different security events associated with multiple data packets that may occur in the target network. Therefore, the network status determination method provided in the embodiment of the present application is relative to the method in the related art of analyzing each data packet associated with the NAT device to determine the network status. The above method can effectively improve the efficiency and accuracy of determining the network status of the target network, thereby meeting the actual network status determination needs.

[0084] Based on the foregoing embodiment, in the network status determination method provided in the embodiment of the present application, the original data packets in the first set are integrated based on the first identifier to the Kth identifier to obtain the second set, which can be implemented in the following manner:

[0085] If the xth identifier is the same as the yth identifier, at least the xth original data packet corresponding to the xth identifier and the yth original data packet corresponding to the yth identifier are integrated to obtain the nth data packet; and it is determined that the second set includes the first data packet to the Nth data packet.

[0086] Among them, x is different from y, and both x and y are integers greater than or equal to 1 and less than or equal to K; n is an integer greater than or equal to 1 and less than or equal to N; N is an integer greater than 1, and N is used to represent the number of data packets obtained by integrating the original data packets in the first set.

[0087] Correspondingly, if the xth identifier is different from the yth identifier, the xth original data packet and the yth original data packet may not be integrated to obtain the nth data packet.

[0088] In one implementation, the xth identifier is the same as the yth identifier, which may indicate that the data transmission events corresponding to the xth original data packet and the yth original data packet are the same transmission event.

[0089] In one embodiment, when the xth identifier includes identifiers of at least two payloads and the yth identifier includes identifiers of at least two payloads, the xth original data packet and the yth original data packet are integrated so that the nth data packet can correspond to at least four original data packets in the first set.

[0090] From the above, it can be seen that in the network status determination method provided by the embodiment of the present application, if the xth identifier is the same as the yth identifier, at least the xth original data packet corresponding to the xth identifier and the yth original data packet corresponding to the yth identifier are integrated to obtain the nth data packet, and then the first data packet to the Nth data packet are determined as the second set, and n is an integer greater than or equal to 1 and less than or equal to N, and N is an integer greater than 1 and is used to characterize the number of data packets obtained by integrating the original data packets in the first set. In this way, through the above operation, not only the targeted and controllable integration of the original data packets in the first set is achieved, but also, when the xth identifier and the yth identifier are the same, the xth original data packet and the yth original data packet are integrated, and the xth identifier and the yth identifier correspond to the xth payload and the yth payload, respectively, so as to achieve the integration of the original data packets in the first set from the perspective of the payload of the original data packets, thereby improving the consistency between the data transmission status represented by the data packets in the second set and the original data packets in the first set, and also improving the simplicity of the data packets in the second set in representing the above-mentioned data transmission status dimension.

[0091] Based on the foregoing embodiment, in the network status determination method provided in the embodiment of the present application, determining the kth identifier corresponding to the kth payload carried by the kth original data packet in the first set can be implemented in the following manner:

[0092] At least the device authentication identifier and / or path parameter contained in the kth payload is processed by a hash function to obtain a kth hash value; and the kth identifier is determined to be the kth hash value.

[0093] In one implementation, the device authentication identifier may be used to authenticate the device during the transmission of the kth original data packet; illustratively, the device authentication identifier may include a token and / or a cookie.

[0094] In one embodiment, the path parameter may include the transmission path of the kth original data packet and / or the address of the resource requested to be accessed by the kth original data packet; exemplarily, the transmission path may be represented by a path, and the address of the resource requested to be accessed by the kth original data packet may include a Uniform Resource Locator (URL).

[0095] In one implementation, all data included in the requestBody of the kth original data packet may be processed using a hash function to obtain the kth hash value.

[0096] From the above, it can be seen that the network status determination method provided by the embodiment of the present application processes at least the device authentication identifier and / or path parameter contained in the kth payload through a hash function to obtain the kth hash value, and determines the kth hash value as the kth identifier. In this way, through the above operation, not only can the device authentication identifier and / or path parameter in the kth payload be compressed in the data volume dimension, the data volume of the kth identifier can be reduced, and the device authentication identifier and / or path parameter in the kth payload can be accurately represented through the kth identifier, thereby improving the accuracy of the kth identifier.

[0097] Based on the foregoing embodiment, in the network status determination method provided in the embodiment of the present application, determining the network status of the target network based on the data packets in the second set can also be implemented by the following steps:

[0098] Step A1: Obtain initial logs associated with at least two original data packets corresponding to the mth data packet.

[0099] In one implementation, the initial log may include information such as the time, process, and associated nodes and / or devices of the initial data packets in the first set being transmitted in the target network.

[0100] Step A2: Determine the time information associated with at least two original data packets corresponding to the mth data packet.

[0101] In one implementation, the time information may include the timestamps carried by at least two original data packets corresponding to the mth data packet, or a set of timestamps carried by at least two original data packets corresponding to the mth data packet, that is, time period information.

[0102] In one implementation, the time information may be obtained by extracting and integrating the timestamps carried by at least two original data packets corresponding to the mth data packet.

[0103] Step A3: Integrate the initial logs based on the time information to obtain the mth log corresponding to the mth data packet.

[0104] The data volume of the mth log is smaller than the data volume of the initial log.

[0105] In one implementation, the mth log may be obtained by any of the following methods:

[0106] Based on the moment information or time period information included in the time information, redundant data in the initial log is removed to obtain an intermediate log, and then the logs in the intermediate log involving the transmission process of the mth data packet are aggregated to obtain the mth log; wherein the redundant data may include data in which the degree of association between at least two original data packets associated with the mth data packet is less than or equal to an association threshold.

[0107] The log data corresponding to any original data packet in the initial log is determined as the mth log.

[0108] Step A4: Analyze the mth log to obtain the network status of the target network.

[0109] In one implementation, the network status of the target network can be obtained in the following manner:

[0110] The mth log is analyzed to determine the type of data transmission event corresponding to the payload carried by the data packet in the mth data packet, and then the network status of the target network is determined based on the above type; exemplarily, the above type may include an attack type or a non-attack type, and may also include an attack result return type or a security response type.

[0111] From the above, it can be seen that the network status determination method provided in the embodiment of the present application, after obtaining the initial log associated with at least two original data packets corresponding to the mth data packet, determines the time information associated with at least two original data packets corresponding to the mth data packet, and then integrates the initial log based on the time information to obtain the mth log corresponding to the mth data packet. In this way, through the above operations, the initial logs corresponding to the first set are accurately screened, segmented and integrated from the dimension of the mth data packet, thereby improving the consistency between the data transmission status represented by the mth log and the at least two original data packets corresponding to the mth data packet; and, analyzing the mth log to obtain the network status of the target network can reduce the amount of data in the log analyzed in the process of determining the network status of the target network, thereby shortening the time for determining the network status of the target network and improving the efficiency of determining the network status of the target network.

[0112] Based on the foregoing embodiment, in the network status determination method provided in the embodiment of the present application, after determining the network status of the target network based on the data packets in the second set, the following operations may be performed:

[0113] Step B1: If the network status includes a threat status, obtain a source address set and a target address set of at least two original data packets corresponding to the mth data packet.

[0114] Accordingly, if the network status does not include a threat status, the operation of obtaining the source address set and the destination address set of at least two data packets corresponding to the mth data packet may not be performed.

[0115] In one implementation, the source address set may include a set of source addresses carried by all original data packets corresponding to the mth data packet.

[0116] In one implementation, the target address set may include a set of target addresses carried by all original data packets corresponding to the mth data packet.

[0117] In one embodiment, the addresses in the source address set and / or the addresses in the target address set may be addresses set for a device that sends a first original data packet, and may also include addresses converted by a NAT device that processes intermediate original data packets; illustratively, the first original data packet may include the original data packet with the earliest timestamp among all original data packets corresponding to the mth data packet, and the intermediate original data packets may include at least part of the original data packets among all original data packets corresponding to the mth data packet excluding the first original data packet.

[0118] For example, the target network is Figure 1 Taking the network shown in as an example, the source address set and the destination address set are explained.

[0119] exist Figure 1 In the embodiment, the source address of the first original data packet sent by the first device 101 can be the first address, and the destination address can be the second address of the second device; when the first original data packet is transmitted to the first NAT 103, the first NAT 103 can convert the destination address in the first data packet and convert the second address into a third address; and the first original data packet after conversion by the first NAT 103 can be recorded as the second original data packet.

[0120] Exemplarily, when the second original data packet is transmitted to the second NAT 104, the second NAT 104 can convert the destination address of the second original data packet into a third address, and convert the source address of the second original data packet into a fourth address to obtain a third original data packet, and then transmit the third original data packet to the second device 102.

[0121] Accordingly, through the process provided by the aforementioned embodiment, the first original data packet to the third original data packet can be integrated into one data packet, and by collecting the data transmission log between the first device 101 and the second device 102, an initial log recording the transmission process of the first original data packet to the third original data packet can be obtained.

[0122] Exemplarily, in the above process, the source address set may include the first address and the fourth address, and the target address set may include the second address and the third address.

[0123] Step B2: Determine the association relationship between at least two original data packets corresponding to the mth data and at least one NAT device.

[0124] In one embodiment, the association relationship can represent the sequential relationship of at least two original data packets corresponding to the mth data packet in at least one NAT device; exemplarily, when at least two NAT devices are set in the target network, the association relationship can also represent the setting relationship of the at least two NAT devices in the target network; wherein the setting relationship can include whether the at least two NAT devices are adjacent in the data transmission path of the target network and the identification of the adjacent NAT devices, and the above identification number may include the name and / or number of the NAT device.

[0125] In one embodiment, when at least two NAT devices are set in the target network, the setting relationship can also characterize the request and response relationship between the tth device and the t+1th device in the at least two NAT devices during the data transmission process; wherein t can be an integer greater than or equal to 1.

[0126] Step B3: Determine the target device corresponding to the threat status based on the association relationship, the source address set, and the target address set.

[0127] The target device includes an attacking device and / or an attacked device associated with a threat state.

[0128] In one implementation, the attacking device may include a device in the target network, or may include a device in an external network other than the target network.

[0129] In one embodiment, when the attacking device is a device in an external network, the NAT device in the target network used to send data packets can be a proxy device for the source device in the external network that triggers the sending of the above data packets, and provide network proxy services for the source device that triggers the sending of the above data packets.

[0130] The NAT device used to perform network proxy can perform data transmission operations and allow the above-mentioned source device to communicate with the server on the network side through the NAT device.

[0131] Figure 3 The schematic diagram is a structural diagram of the client using a proxy device to implement data transmission between the client and the server. Figure 3 As shown, the client 301 may be the source device in the above embodiment, the proxy device 302 may be the NAT device in the above embodiment, and the server 303 may be the above attack device set in the external network.

[0132] Exemplarily, for the client 301, the proxy device 302 can be a server device, and the client 301 can send a request message to the proxy device 302, so that the proxy device 302 sends a request message to the server 303; and the proxy device 302 can also receive a response message returned by the server 303 and send the response message to the client 301.

[0133] In the above process, for the server 303 , the proxy device 302 is equivalent to the client device of the server 303 .

[0134] In one implementation, the target device may be determined by:

[0135] Based on the association relationship, the first NAT device in the target network is determined, and then the device corresponding to the source address carried by the original data packet received by the first NAT device is determined as the attacking device; wherein the first NAT device can be the first NAT device in the target network for processing the original data packet corresponding to the mth data packet.

[0136] Based on the association relationship, the second NAT device in the target network is determined, and then the device corresponding to the target address carried by the original data packet sent by the second NAT device is determined as the attacked device; wherein the second NAT device can be the last NAT device in the target network for processing the original data packet corresponding to the mth data packet.

[0137] In one implementation, the number of the attacked device may be at least one.

[0138] From the above, it can be seen that in the network status determination method provided in the embodiment of the present application, if the network status includes a threat status, the source address set and the target address set of at least two original data packets corresponding to the mth data packet are obtained, thereby realizing the control of the operation of obtaining the above-mentioned source address set and the target address set; and, the association relationship between the at least two original data packets corresponding to the mth data packet and at least one NAT device is determined, so that the above-mentioned association relationship can reflect the transmission status of the at least two original data packets corresponding to the mth data packet between the at least one NAT device; on this basis, based on the association relationship, the source address set and the target address set, the attacking device and / or the attacked device corresponding to the threat status is determined, thereby realizing the precise positioning of the attacking device and / or the attacked device.

[0139] Based on the foregoing embodiment, in the network status determination method provided in the embodiment of the present application, the network status determination device obtains the first set, which can be implemented in the following manner:

[0140] If the alarm information is detected, the network status determination device is controlled to obtain the first set.

[0141] Accordingly, if no alarm information is detected, the operation of controlling the network status determination device to obtain the first set may not be performed.

[0142] In one embodiment, the alarm information can be automatically generated by the network status determination device; illustratively, the network status determination device can perform a preliminary analysis on the log stream corresponding to the data stream transmitted in the target network to obtain an analysis result, and determine whether to generate the alarm information based on the risk level represented by the analysis result.

[0143] As can be seen from the above, the network status determination method provided in the embodiment of the present application controls the network status determination device to obtain the first set if the alarm information is detected. In this way, through the above operation, the precise control of the operation of the network status determination device to obtain the first set is achieved, thereby reducing the time cost and data processing resource cost caused by constantly obtaining the first set and performing subsequent processing on the first set.

[0144] Based on the foregoing embodiments, the embodiments of the present application further provide a network status determination device. Figure 4 A schematic diagram of the structure of a network status determination device provided in an embodiment of the present application, such as Figure 4 As shown, the network status determining device 4 may include:

[0145] The acquisition module 401 is used to acquire a first set; wherein the first set includes a set of original data packets associated with at least one network address translation device set in the target network;

[0146] The determination module 402 is used to determine the kth identifier corresponding to the kth payload carried by the kth original data packet in the first set; wherein k is an integer greater than or equal to 1 and less than or equal to K; K is the number of original data packets in the first set;

[0147] The processing module 403 is used to integrate the original data packets in the first set based on the first identifier to the Kth identifier to obtain a second set; wherein the mth data packet in the second set corresponds to at least two original data packets in the first set; m is an integer greater than or equal to 1;

[0148] The determination module 402 is further configured to determine the network status of the target network based on the data packets in the second set.

[0149] In some embodiments, the processing module 403 is used to integrate at least the xth original data packet corresponding to the xth identifier and the yth original data packet corresponding to the yth identifier to obtain the nth data packet if the xth identifier is the same as the yth identifier; wherein x is different from y, and x and y are both integers greater than or equal to 1 and less than or equal to K; and n is an integer greater than or equal to 1 and less than or equal to N;

[0150] The determination module 402 is used to determine that the second set includes the first data packet to the Nth data packet; wherein N is an integer greater than 1, and N is used to represent the number of data packets obtained by integrating the original data packets in the first set.

[0151] In some embodiments, the processing module 403 is used to process at least the device authentication identifier and / or the path parameter included in the kth payload through a hash function to obtain a kth hash value;

[0152] The determination module 402 is configured to determine that the kth identifier is the kth hash value.

[0153] In some embodiments, the acquisition module 401 is used to acquire an initial log associated with at least two original data packets corresponding to the mth data packet;

[0154] A determination module 402, configured to determine time information associated with at least two original data packets corresponding to the mth data packet;

[0155] The processing module 403 is used to integrate the initial log based on the time information to obtain an mth log corresponding to the mth data packet; wherein the data volume of the mth log is smaller than the data volume of the initial log;

[0156] The processing module 403 is further used to analyze the mth log to obtain the network status of the target network.

[0157] In some embodiments, the acquisition module 401 is used to acquire a source address set and a target address set of at least two original data packets corresponding to the mth data packet if the network status includes a threat status;

[0158] The determination module 402 is used to determine the association relationship between at least two original data packets corresponding to the mth data packet and at least one address translation device; based on the association relationship, the source address set and the target address set, determine the target device corresponding to the threat state; wherein the target device includes an attacking device and / or an attacked device associated with the threat state.

[0159] In some embodiments, the processing module 403 is used to control the network status determination device to obtain the first set if alarm information is detected.

[0160] Based on the above embodiments, the present application also provides a network status determination device. Figure 5 This is a schematic diagram of the structure of the network status determination device provided in the embodiment of the present application. Figure 5 As shown, the network status determination device 5 may include a processor 501 and a memory 502; wherein the memory 502 stores a computer program; when the computer program is executed by the processor 501, it can implement the network status determination method provided in any of the previous embodiments.

[0161] Based on the foregoing embodiments, an embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored; when the computer program is executed by a processor of an electronic device, it can implement a network status determination method as described in any of the foregoing.

[0162] Based on the foregoing embodiments, the embodiments of the present application also provide a computer program product, which includes a computer program; when the computer program is executed by a processor of an electronic device, it can implement any of the network status determination methods described above.

[0163] The above description of various embodiments tends to emphasize the differences between the various embodiments. The same or similar aspects can be referenced to each other, and for the sake of brevity, they will not be repeated herein.

[0164] The methods disclosed in the various method embodiments provided in this application can be combined arbitrarily without conflict to obtain new method embodiments.

[0165] The features disclosed in the various product embodiments provided in this application can be combined arbitrarily without conflict to obtain new product embodiments.

[0166] The features disclosed in the various method or device embodiments provided in this application can be combined arbitrarily without conflict to obtain new method embodiments or device embodiments.

[0167] It should be noted that the above-mentioned computer-readable storage medium can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory (Flash Memory), a magnetic surface memory, an optical disk, or a compact disc read-only memory (CD-ROM) and other memories; it can also be various electronic devices including one or any combination of the above-mentioned memories, such as mobile phones, computers, tablet devices, personal digital assistants, etc.

[0168] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0169] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0170] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus necessary general hardware nodes, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0171] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0172] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0173] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0174] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for determining a network status, characterized in that: The method comprises: The network status determination device acquires a first set; wherein the first set includes a set of original data packets associated with at least one network address translation device set in the target network; Determine a kth identifier corresponding to a kth payload carried by a kth original data packet in the first set; wherein k is an integer greater than or equal to 1 and less than or equal to K; and K is the number of the original data packets in the first set; Integrate the original data packets in the first set based on the first identifier to the Kth identifier to obtain a second set; wherein the mth data packet in the second set corresponds to at least two original data packets in the first set; m is an integer greater than or equal to 1; Based on the data packets in the second set, a network status of the target network is determined.

2. The method according to claim 1, characterized in that The step of integrating the original data packets in the first set based on the first identifier to the Kth identifier to obtain the second set includes: If the xth identifier is the same as the yth identifier, at least the xth original data packet corresponding to the xth identifier and the yth original data packet corresponding to the yth identifier are integrated to obtain the nth data packet; wherein x is different from y, and both x and y are integers greater than or equal to 1 and less than or equal to K; and n is an integer greater than or equal to 1 and less than or equal to N; Determine that the second set includes the first data packet to the Nth data packet; wherein N is an integer greater than 1, and N is used to represent the number of data packets obtained by integrating the original data packets in the first set.

3. The method according to claim 1, characterized in that The determining the kth identifier corresponding to the kth payload carried by the kth original data packet in the first set includes: Processing at least the device authentication identifier and / or the path parameter contained in the kth payload by a hash function to obtain a kth hash value; The k-th identifier is determined to be the k-th hash value.

4. The method according to claim 1, characterized in that: The determining the network status of the target network based on the data packets in the second set includes: Obtaining initial logs associated with at least two original data packets corresponding to the mth data packet; Determine time information associated with at least two original data packets corresponding to the mth data packet; Integrate the initial log based on the time information to obtain an mth log corresponding to the mth data packet; wherein the data volume of the mth log is smaller than the data volume of the initial log; The mth log is analyzed to obtain the network status of the target network.

5. The method according to claim 1, characterized in that After determining the network status of the target network based on the data packets in the second set, the method further includes: If the network status includes a threat status, obtaining a source address set and a destination address set of at least two original data packets corresponding to the mth data packet; Determine an association relationship between at least two original data packets corresponding to the mth data packet and the at least one address translation device; Based on the association relationship, the source address set and the target address set, a target device corresponding to the threat state is determined; wherein the target device includes an attacking device and / or an attacked device associated with the threat state.

6. The method according to claim 1, characterized in that The network status determination device acquires a first set, including: If the alarm information is detected, the network status determination device is controlled to obtain the first set.

7. A network status determination device, characterized in that: The network status determining device comprises: An acquisition module, configured to acquire a first set; wherein the first set includes a set of original data packets associated with at least one network address translation device set in the target network; A determination module, configured to determine a kth identifier corresponding to a kth payload carried by a kth original data packet in the first set; wherein k is an integer greater than or equal to 1 and less than or equal to K; and K is the number of the original data packets in the first set; a processing module, configured to integrate the original data packets in the first set based on the first identifier to the Kth identifier to obtain a second set; wherein the mth data packet in the second set corresponds to at least two original data packets in the first set; m is an integer greater than or equal to 1; The determination module is further used to determine the network status of the target network based on the data packets in the second set.

8. A network status determination device, characterized in that: The network status determination device includes a processor and a memory; wherein a computer program is stored in the memory; when the computer program is executed by the processor, the network status determination method according to any one of claims 1 to 6 can be implemented.

9. A computer-readable storage medium, characterized in that: The storage medium stores a computer program; when the computer program is executed by a processor of an electronic device, the network status determination method according to any one of claims 1 to 6 can be implemented.

10. A computer program product, characterized in that The program product includes a computer program; when the computer program is executed by a processor of an electronic device, the network status determination method according to any one of claims 1 to 6 can be implemented.

Images