Attack event detection method and device for network equipment and processing equipment

Abstract

The invention provides an attack event detection method and device for network equipment and processing equipment, which are used for specifically performing version updating processing on the network equipment, and establishing a tamper-proof mechanism for file attributes of executable files before and after version updating so as to ensure that whether an attack event occurs or not is checked at the first time, and the efficiency of detecting the attack event is improved. Therefore, response can be made at the first time, and the network security of the network equipment and the network architecture is guaranteed. The method comprises the following steps: before target network equipment performs network equipment version updating processing, determining a current executable file used by the target network equipment in a working process; generating a corresponding executable file list based on the executable file determination result; after the version updating processing of the network equipment is completed, determining the current attribute of the current executable file according to the executable file list; matching the current attribute of the current executable file with the executable file list; and if not, determining that the attack event occurs in the version updating period of the target network equipment.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a method, device and processing equipment for detecting attack events on network devices. Background Art

[0002] In the enterprise network architecture, a lot of network devices (or network nodes) are involved to meet the needs of normal enterprise operations.

[0003] In specific applications, it is easy to understand that network equipment will have version updates to prevent new vulnerabilities from causing corresponding network attacks and avoid losses caused by internal data leakage, network interruptions, etc.

[0004] The inventors of the present application have discovered that the prior art usually focuses on how to configure / update more accurate vulnerability information to perform vulnerability detection, but this is aimed at the normal operation of network devices. During the idle period when network devices are performing version updates, they are prone to fall into an unsafe state, and the processing effect of the existing vulnerability detection mechanism is unstable. Relevant vulnerabilities may be exploited and corresponding attack incidents may occur. In this case, the attack incidents are prone to not being discovered in time. Summary of the invention

[0005] The present application provides a method, apparatus and processing device for detecting attack events for network devices, which are used for version update processing of network devices. An anti-tampering mechanism is established for the file attributes of executable files before and after the version update to ensure that whether an attack event occurs can be detected in the first time, so that a response can be made in the first time to ensure the network security of network devices and network architecture.

[0006] In a first aspect, the present application provides a method for detecting attack events on a network device, the method comprising:

[0007] Before the target network device performs a network device version update process, determining a current executable file used by the target network device during operation;

[0008] Based on the executable file determination result, a corresponding executable file list is generated, wherein each item in the executable file list represents a different legal attribute of the current executable file, and the different legal attributes are identified by a unique key value;

[0009] After the target network device completes the network device version update process, determining the current attribute of the current executable file according to the executable file list;

[0010] Match the current properties of the current executable file with the executable file list;

[0011] If there is no match, it is determined that an attack event occurred during the version update of the target network device.

[0012] In combination with the first aspect of the present application, in a first possible implementation manner of the first aspect of the present application, after determining that an attack event occurs on the target network device, the method further includes:

[0013] In response to attack events during version updates, the corresponding executable files of the target network device are stopped and deleted after the target network device completes the network device version update process, and restored to the system's own security files.

[0014] In combination with the first aspect of the present application, in a second possible implementation of the first aspect of the present application, the executable file list adopts a hash linked list mechanism and is encrypted with a secret key.

[0015] In combination with the second possible implementation method of the first aspect of the present application, in the third possible implementation method of the first aspect of the present application, different legal attributes include the executable file path, the unique characteristic value of the original file, whether an external connection is generated, and the IP and port of the external connection.

[0016] In combination with the third possible implementation of the first aspect of the present application, in a fourth possible implementation of the first aspect of the present application, determining the current attribute of the current executable file according to the executable file list includes:

[0017] After the device is started, the executable file list is decrypted;

[0018] After the process is started, the file path of the started corresponding process determined by the user state process is used to search whether there is a matching file entry in the executable file list;

[0019] If it exists, the corresponding executable file is located based on the file path of the corresponding process started, and the current attribute of the current executable file is determined.

[0020] In combination with the first aspect of the present application, in a fifth possible implementation manner of the first aspect of the present application, the method further includes:

[0021] When the target network device is put into normal operation, the network function status of at least one process is collected;

[0022] According to the process path of the process, determine the corresponding target executable file list feature table item;

[0023] Determine whether the network function status matches the target executable file list feature table item;

[0024] If there is no match, it is determined that the target network device has an illegal socket connection.

[0025] In combination with the fifth possible implementation of the first aspect of the present application, in a sixth possible implementation of the first aspect of the present application, determining whether the network function state matches the target executable file list feature entry includes:

[0026] According to whether external connection is allowed, the service when external connection is allowed, and the port when external connection is allowed, it is determined whether the socket connection marked by the network function status is legal;

[0027] After determining that the target network device has an illegal socket connection, the method further includes:

[0028] Kill the corresponding process of the illegal socket connection and calculate the corresponding file feature value. If the file feature value does not match the executable file list, restore it to the system's built-in safe file.

[0029] In a second aspect, the present application provides an attack event detection device for a network device, the device comprising:

[0030] A determination unit, used to determine the current executable file used by the target network device during operation before the target network device performs a network device version update process;

[0031] A generating unit, configured to generate a corresponding executable file list based on the executable file determination result, wherein each item in the executable file list represents a different legal attribute of the current executable file, and the different legal attributes are identified by a unique key value;

[0032] The determination unit is further used to determine the current attribute of the current executable file according to the executable file list after the target network device completes the network device version update process;

[0033] The matching unit is used to match the current attribute of the current executable file with the executable file list, and if there is no match, the determination unit is triggered;

[0034] The determination unit is further used to determine whether an attack event occurs during a version update of the target network device.

[0035] In conjunction with the second aspect of the present application, in a first possible implementation manner of the second aspect of the present application, the device further includes a response unit, which is used to:

[0036] In response to attack events during version updates, the corresponding executable files of the target network device are stopped and deleted after the target network device completes the network device version update process, and restored to the system's own security files.

[0037] In combination with the second aspect of the present application, in a second possible implementation of the second aspect of the present application, the executable file list adopts a hash linked list mechanism and is encrypted with a secret key.

[0038] In combination with the second possible implementation of the second aspect of the present application, in the third possible implementation of the second aspect of the present application, different legal attributes include the executable file path, the unique characteristic value of the original file, whether an external connection is generated, and the IP and port of the external connection.

[0039] In combination with the third possible implementation of the second aspect of the present application, in a fourth possible implementation of the second aspect of the present application, the determining unit is specifically used to:

[0040] After the device is started, the executable file list is decrypted;

[0041] After the process is started, the file path of the started corresponding process determined by the user state process is used to search whether there is a matching file entry in the executable file list;

[0042] If it exists, the corresponding executable file is located based on the file path of the corresponding process started, and the current attribute of the current executable file is determined.

[0043] In combination with the second aspect of the present application, in a fifth possible implementation manner of the second aspect of the present application, the determining unit is further configured to:

[0044] When the target network device is put into normal operation, the network function status of at least one process is collected;

[0045] According to the process path of the process, determine the corresponding target executable file list feature table item;

[0046] Determine whether the network function status matches the target executable file list feature table item;

[0047] If there is no match, it is determined that the target network device has an illegal socket connection.

[0048] In combination with the fifth possible implementation manner of the second aspect of the present application, in a sixth possible implementation manner of the second aspect of the present application, the determining unit is specifically used to:

[0049] According to whether external connection is allowed, the service when external connection is allowed, and the port when external connection is allowed, it is determined whether the socket connection marked by the network function status is legal;

[0050] The device also includes a response unit for:

[0051] Kill the corresponding process of the illegal socket connection and calculate the corresponding file feature value. If the file feature value does not match the executable file list, restore it to the system's built-in safe file.

[0052] In a third aspect, the present application provides a processing device, including a processor and a memory, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the method provided in the first aspect of the present application or any possible implementation method of the first aspect of the present application is executed.

[0053] In a fourth aspect, the present application provides a computer-readable storage medium, which stores multiple instructions, and the instructions are suitable for a processor to load to execute the method provided by the first aspect of the present application or any possible implementation of the first aspect of the present application.

[0054] From the above content, it can be concluded that the present application has the following beneficial effects:

[0055] Under the goal of network security protection involving network devices, this application specifically targets version update processing of network devices, and builds an anti-tampering mechanism for the file attributes of executable files before and after the version update to ensure that whether an attack incident occurs can be detected at the first time, so that a response can be made at the first time to ensure the network security of network devices and network architecture. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0057] Figure 1 A flowchart of a method for detecting attack events on network devices in the present application;

[0058] Figure 2 A schematic diagram of a scenario of the network topology of this application;

[0059] Figure 3 This is a schematic diagram of an example of an executable file list of this application;

[0060] Figure 4 A schematic diagram of a structure of an attack event detection device for network equipment in the present application;

[0061] Figure 5 A schematic diagram of the structure of the processing equipment of this application. DETAILED DESCRIPTION

[0062] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0063] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described here can be implemented in an order other than that illustrated or described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or modules is not necessarily limited to those steps or modules clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products or devices. The naming or numbering of steps in this application does not mean that the steps in the method flow must be executed in the time / logical sequence indicated by the naming or numbering. The process steps that have been named or numbered can change the execution order according to the technical purpose to be achieved, as long as the same or similar technical effects can be achieved.

[0064] The division of modules in this application is a logical division. There may be other division methods when it is implemented in actual applications. For example, multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection between modules can be electrical or other similar forms, which are not limited in this application. In addition, the modules or submodules described as separate components may or may not be physically separated, may or may not be physical modules, or may be distributed in multiple circuit modules, and some or all of the modules may be selected according to actual needs to achieve the purpose of the present application.

[0065] Before introducing the attack event detection method for network devices provided by the present application, the background content involved in the present application is first introduced.

[0066] The attack event detection method, device and computer-readable storage medium for network devices provided in the present application can be applied to processing devices for version update processing specifically for network devices. An anti-tampering mechanism is established for the file attributes of executable files before and after the version update to ensure that whether an attack event occurs can be detected in the first time so that a response can be made in the first time to ensure the network security of network devices and network architecture.

[0067] The attack event detection method for network devices mentioned in the present application can be executed by an attack event detection device for network devices, or a server, physical host or user equipment (UE) and other different types of processing devices integrated with the attack event detection device for network devices. Among them, the attack event detection device for network devices can be implemented in hardware or software, and the UE can be a terminal device such as a smart phone, a tablet computer, a laptop computer, a desktop computer or a personal digital assistant (PDA), and the processing device can be set in a device cluster.

[0068] In specific applications, the processing device that executes the attack event detection method for network devices of the present application or is equipped with the application service corresponding to the attack event detection method for network devices of the present application is usually a device in the enterprise network architecture (for example, the network device itself involved in the network device version update or a network device other than the network device involved in the network device version update), or it can also be a device outside the enterprise network architecture, that is, a third-party device. It can be understood that the specific device type and device deployment form of the processing device can be adaptively adjusted according to the flexible and changeable application requirements in actual situations, and the present application does not make specific limitations.

[0069] Next, we will introduce the attack event detection method for network devices provided by this application.

[0070] First, see Figure 1 , Figure 1 A schematic diagram of a flow chart of a method for detecting attack events on a network device provided by the present application is shown. The method for detecting attack events on a network device provided by the present application may specifically include the following steps S101 to S105:

[0071] Step S101, before the target network device performs a network device version update process, determining a current executable file used by the target network device during operation;

[0072] For network devices (such as routers, switches, firewall devices, and other device nodes responsible for corresponding network services in the network architecture), for easier understanding, a set of examples can also be combined to help understand the network security risks they face.

[0073] refer to Figure 2 A scenario diagram of the networking topology of the present application is shown. For network devices in the network architecture, a public IP address can be configured and some services can be enabled. The device can be scanned by the external network and can communicate directly with the public network. The network device is invisible to the public network, but visible to the intranet, which has Internet access rights. Therefore, after the intranet device terminal is compromised and infected, it may spread to the network devices, using the terminal as a springboard to transmit data to the outside, causing data leakage or downtime risks.

[0074] In this context, it is understandable that network devices usually involve multiple executable files during their operation, and this application specifically focuses on the differences in executable files used by network devices during their operation to determine whether an attack has occurred during a version update of the network device.

[0075] In this regard, before the target network device performs a network device version update process, or when it is determined that the target network device has a network device version update requirement, a current executable file corresponding to the current situation is determined.

[0076] The determination and processing of the current executable file used by the target network device during its operation can be performed in the initial task stage when it is determined that a network device version update task has been generated, or it can be a prerequisite task for the network device version update task, or it can be unrelated to the network device version update task. The target network device can periodically / randomly / manually determine the current executable file, which is also possible in actual applications and can be configured based on corresponding user needs.

[0077] It is easy to understand that for the convenience of explanation, this application records the currently targeted network device as the target network device.

[0078] Step S102, generating a corresponding executable file list based on the executable file determination result, wherein each item in the executable file list represents a different legal attribute of the current executable file, and the different legal attributes are identified by a unique key value;

[0079] It can be understood that after the current executable file is determined and the executable file determination result is obtained, a first executable file list matching the current executable file (or current version) can be generated based on the legal attributes of the current executable file. The list records the corresponding legal attributes through the feature table items of the executable file list in the table, and is configured and identified in the form of specific unique key values.

[0080] Step S103, after the target network device completes the network device version update process, determining the current attribute of the current executable file according to the executable file list;

[0081] After determining that the target network device has completed the previously planned network device version update process, the executable file recorded in the previously generated executable file list can be followed immediately to obtain the attributes in the current situation, that is, the current attributes. The attributes themselves correspond to the legal attributes recorded in the executable file list, and for the sake of convenience, they are distinguished in name. In this way, subsequent matching and comparison of file attributes before and after the version update can be carried out.

[0082] Among them, in specific operations, the current attributes of the current executable file can be determined according to the executable file list directly after the network device version update process is completed, or the current attributes of the current executable file can be quickly triggered according to a preset short waiting time after the network device version update process is completed, or the process of determining the current attributes of the current executable file according to the executable file list can itself be included in the last processing stage of the network device version update process. Obviously, how to trigger the determination of the current attributes of the current executable file according to the executable file list in terms of details is relatively flexible. In actual applications, it is sufficient to meet the solution goal of triggering the determination of the current attributes of the current executable file according to the executable file list as soon as possible.

[0083] As an example, the reconstruction of the fork process implementation in the network device kernel can trigger the added trusted process detection mechanism and promote the data processing and subsequent processing of determining the current attributes of the current executable file according to the executable file list.

[0084] In addition, for the current attributes of the current executable file, the attribute form is relatively flexible, and its main purpose is to be used for matching. In specific operations, it can be processed in the same form as the previous executable file list, that is, there are the first and second executable file lists before and after the corresponding version update, or it can be processed in other forms.

[0085] Step S104, matching the current attribute of the current executable file with the executable file list;

[0086] In this way, after obtaining a concise and efficient reflection of the executable file status of the target network device before and after the version update, a matching process can be performed on the two (i.e., the current attributes of the current executable file and the executable file list). According to common sense, even if a version update occurs, it will not affect the executable file, so the two will match or remain consistent. Therefore, the matching result is a match or the list content will remain consistent, which means that the target network device has not experienced an attack incident against the executable file during the version update, and the target network device can work normally.

[0087] On the contrary, if the matching result is no match or the list content is not consistent, it means that an attack event against the executable file has occurred in the target network device during the version update, and the attacker has overwritten and disguised the executable file existing in the system itself. At this time, it is necessary to respond immediately to avoid further losses and / or resolve the attack. In this regard, the subsequent step S105 can be triggered.

[0088] Step S105: If there is no match, it is determined that an attack event occurs during the version update of the target network device.

[0089] It can be understood that when a mismatch result is obtained through the matching process of the previous step S104, a corresponding response process can be carried out. In this regard, the present application can promote the response process by determining the event triggering method of the attack event during the version update of the target network device.

[0090] In the response processing process, it can be understood that the response method is relatively flexible, which may involve both manual response and automatic response based on a pre-configured automatic response strategy. Considering that the focus of this application is to accurately discover whether an attack incident occurs during the network device version update at the first time, the content of the response processing is not specifically described here. In other words, the response processing that can be carried out here can refer to the existing related technologies.

[0091] So, from Figure 1 It can be seen from the content of the illustrated embodiment that, under the goal of network security protection involving network devices, the present application specifically targets version update processing of network devices, and builds an anti-tampering mechanism for the file attributes of executable files before and after the version update to ensure that whether an attack incident occurs can be detected at the first time, so that a response can be made at the first time to ensure the network security of network devices and network architecture.

[0092] Continue to the above Figure 1 Each step of the illustrated embodiment and possible implementation methods thereof in practical applications are described in detail.

[0093] Specifically, corresponding to the aforementioned response processing for the attack event, as an exemplary embodiment, after determining in step S104 that the target network device has an attack event, the method of the present application may further include:

[0094] In response to attack events during version updates, the corresponding executable files of the target network device are stopped and deleted after the target network device completes the network device version update process, and restored to the system's own security files.

[0095] In layman's terms, the response operation involved in the embodiment here is, on the one hand, to directly delete the process use of the executable file that has an abnormal problem in the current situation, and on the other hand, to directly delete the executable file that has an abnormal problem in the current situation, and on the other hand, to take the system's own security file (the file itself is a preset executable file or a backup file) to replace the deleted executable file for the normal operation of the target network device.

[0096] Among them, the stop operation can also be understood as the kill operation.

[0097] In some operations, it is understandable that the executable file to be deleted can be directly overwritten with the system's own security file, which also achieves the operational goal of deleting the executable file to be deleted.

[0098] Among them, the system's own security files can be pre-stored locally or in other file systems to implement the automatic recovery mechanism involved here.

[0099] Furthermore, in order to promote the data security of the present application in specific applications and to prevent the data of the executable file list used by the present application to detect whether an attack event has occurred from being tampered with, as an exemplary embodiment, the executable file list involved in the present application can specifically adopt a hash linked list mechanism and be encrypted with a secret key.

[0100] It can be understood that the hash list mechanism means that the data in the executable file list involves calculating the corresponding unique feature value through a preset hash algorithm, which can not only hide the real data but also perform efficient matching. In addition, this application continues to introduce a key-based encryption mechanism on the basis of introducing hash processing (data archiving and recording require encryption and decryption through a secret key) to further improve data security.

[0101] Among them, it can be understood that the specific hash algorithm and secret key used can be fixed, can be adjusted manually, or can be dynamically adjusted according to the corresponding replacement strategy, and can be adjusted according to actual needs.

[0102] In addition, the settings of these two aspects can adopt existing solutions in specific operations, or further optimize and improve the existing solutions, or adopt novel self-developed solutions.

[0103] The different legal attributes recorded in the executable file list of this application also correspond to the current attributes that may be involved in subsequent matching. As an exemplary embodiment, it may specifically include the executable file path, the unique characteristic value of the original file, whether an external connection is generated, the IP (i.e., IP address) and port of the external connection, etc.

[0104] For ease of understanding, for the list contents involved in the embodiments herein, you can also refer to Figure 3 An example schematic diagram of an executable file list of the present application is shown, from Figure 3 As you can see, in the list, each row corresponds to a scanned / identified executable file (and also corresponds to a process), and from left to right it involves the executable file path, the unique feature value of the original file, whether an external connection is generated, and the port of the external connection.

[0105] It can be seen that in this embodiment, a specific implementation scheme is provided for the relevant attributes that may be involved in the actual application of the specific executable file of this application, and also lays the foundation for the subsequent further supporting scheme setting.

[0106] In addition, for the executable file attribute determination process performed after the target network device completes the network device version update process, as an exemplary embodiment, determining the current attribute of the current executable file according to the executable file list may specifically include:

[0107] 1) After the device is started, the executable file list is decrypted;

[0108] It can be understood that, as mentioned earlier, the executable file list is encrypted with a secret key to improve data security. In this case, after the target network device is started, the executable file list originally encrypted and stored can be decrypted using the corresponding secret key to obtain a list file that can read the contents of the list.

[0109] 2) After the process is started, the file path of the started corresponding process determined by the user state process is searched to see if there is a matching file entry in the executable file list;

[0110] After obtaining a list of executable files in a decrypted state (if a hash list is used, the files are still encrypted after decryption due to the characteristics of the hash algorithm itself, but the legal attributes in the list, i.e., the unique characteristic values, can be learned), the file items that can be matched by the file path can be obtained.

[0111] For file items, refer to Figure 3 ,exist Figure 3 In the executable file list shown, each line corresponds to an executable file and its related legal attributes. Correspondingly, the record content of each executable file in the executable file list can be understood as a file item.

[0112] The processing here can also be understood by whether the executable file list is hit.

[0113] Specifically, when configuring the executable file list, the present application includes the attribute of the executable file path because the legal attributes in the list include the attribute of the executable file path. If the executable file corresponding to the started corresponding process (i.e., the process in the started state) determined by the user-mode process in the current situation is the executable file of the target network device before the version update (i.e., no attack incident occurred during the version update), then the executable file path of the started corresponding process in the current situation follows the recording method of the executable file list (such as the unique feature value obtained by the hash operation based on the hash algorithm), and can be matched with the corresponding file item in the previously recorded executable file list. The specific matching relationship is obviously achieved based on the executable file path recorded for each file item in the executable file list.

[0114] If no matching file entry is found, it can be considered that the process currently captured from the user mode process is not the device's own security process, and a response can be made, such as directly returning failure and deleting the corresponding executable file.

[0115] On the contrary, if it is found, further file positioning can be performed to determine the corresponding file attributes to obtain the current attributes of the current executable file for subsequent matching.

[0116] 3) If it exists, locate the corresponding executable file based on the file path of the corresponding process started, and determine the current attributes of the current executable file.

[0117] It can be understood that when it is determined that the current process has file items corresponding to the previously recorded executable file list and there may be normal corresponding executable files, the executable files specifically stored in the storage space can be located based on their file paths, and their corresponding file attributes can be collected to form current attributes including the executable file path.

[0118] Among them, if the executable file list involves the application of a hash linked list, the current attribute of the current executable file may also involve the processing of a hash operation based on a hash algorithm to form a corresponding unique feature value data form that can be used for subsequent matching.

[0119] It can be seen that in the embodiment here, the present application involves two specific situations: the restart of the target network device and the start of related processes when determining the current attributes of the executable file for the first time, and builds a specific and complete processing architecture to efficiently and accurately promote the subsequent matching processing involved, thereby achieving efficient and accurate attack event detection during version updates.

[0120] At the same time, after the above series of processing allows the target network device to work normally after completing the version update, this application can also involve monitoring and processing of attack events against executable files to further ensure network security.

[0121] In this regard, as an exemplary embodiment, whether the matching result is obtained in step S104 and the normal operation continues, or the unmatched result is obtained in step S104 and the response processing is performed, the method of the present application may further include:

[0122] When the target network device is put into normal operation, the network function status of at least one process is collected;

[0123] According to the process path of the process, determine the corresponding target executable file list feature table item;

[0124] Determine whether the network function status matches the target executable file list feature table item;

[0125] If there is no match, it is determined that the target network device has an illegal socket connection.

[0126] For the embodiments here, it can be understood that the present application believes that when the system is compromised and a script or executable file is uploaded, non-device programs will be run to implement some special functions. If some sensitive data is to be spread or transmitted, the network function must be used to initiate the corresponding socket connection. In this regard, the goal of continuous monitoring can be achieved by continuing to monitor whether the socket connection of the network device is legal.

[0127] In this case, the present application has established a regular sampling and detection mechanism for illegal connections to obtain the network function status of the currently monitored process corresponding to the feature table item of the executable file list involving network functions in the executable file list, so that a match can be performed. If there is no abnormality, then when the process has a socket connection, it will be in compliance with the legal situation. Conversely, when the process has a socket connection, it will be in compliance with the legal situation, which means that there is an abnormality and corresponding response processing needs to be performed on the currently monitored process.

[0128] As an example, netstat can be sampled periodically, and the process path can be obtained from / proc / $pid / cmdline according to the process ID.

[0129] Further, as an exemplary embodiment, the determination of whether the network function status matches the target executable file list feature entry may specifically include:

[0130] According to whether external connection is allowed, the service when external connection is allowed, and the port when external connection is allowed, it is determined whether the socket connection marked by the network function status is legal;

[0131] It can be understood that a specific processing solution is given here for this application to determine whether the file / process attributes match and whether the socket connection is legal. It is also worth noting that this application does not consider illegal socket connections to be equivalent to attack events, and further analysis and processing are required to accurately respond to attack events.

[0132] Correspondingly, after determining that the target network device has an illegal socket connection, the method of the present application may further include:

[0133] Kill the corresponding process of the illegal socket connection and calculate the corresponding file feature value. If the file feature value does not match the executable file list, restore it to the system's built-in safe file.

[0134] In the case of illegality, the present application can continue to match the previously recorded executable file list based on the file feature value (corresponding to the legal attributes and current attributes mentioned above, but for the convenience of explanation, the file feature names in different situations are different) to determine whether there is an attack event. If there is a match, there is no attack event after the version update. Otherwise, if there is no match, it exists and needs to be restored to the system's built-in security file as mentioned above.

[0135] Thus, in the embodiment herein, a more specific and practical implementation scheme is provided for how to realize the goal of continuous monitoring by monitoring whether the socket connection of the network device is legal in detail.

[0136] The above is an introduction to the attack event detection method for network devices provided by the present application. In order to better implement the attack event detection method for network devices provided by the present application, the present application also provides an attack event detection device for network devices from the perspective of functional modules.

[0137] See also Figure 4 , Figure 4 This is a schematic diagram of a structure of an attack event detection device for a network device in the present application. In the present application, the attack event detection device 400 for a network device may specifically include the following structure:

[0138] The determination unit 401 is used to determine the current executable file used by the target network device during the working process before the target network device performs the network device version update process;

[0139] A generating unit 402 is used to generate a corresponding executable file list based on the executable file determination result, wherein each item in the executable file list represents a different legal attribute of the current executable file, and the different legal attributes are identified by a unique key value;

[0140] The determining unit 401 is further configured to determine the current attribute of the current executable file according to the executable file list after the target network device completes the network device version update process;

[0141] The matching unit 403 is used to match the current attribute of the current executable file with the executable file list, and if there is no match, trigger the determination unit 401;

[0142] The determination unit 401 is further configured to determine whether an attack event occurs during a version update of the target network device.

[0143] In an exemplary embodiment, the apparatus further includes a response unit 404, configured to:

[0144] In response to attack events during version updates, the corresponding executable files of the target network device are stopped and deleted after the target network device completes the network device version update process, and restored to the system's own security files.

[0145] In yet another exemplary embodiment, the executable file list adopts a hash linked list mechanism and is encrypted using a secret key.

[0146] In another exemplary embodiment, different legal attributes include executable file path, original file unique feature value, whether to generate an external connection, and the IP and port of the external connection.

[0147] In yet another exemplary embodiment, the determining unit 401 is specifically configured to:

[0148] After the device is started, the executable file list is decrypted;

[0149] After the process is started, the file path of the started corresponding process determined by the user state process is used to search whether there is a matching file entry in the executable file list;

[0150] If it exists, the corresponding executable file is located based on the file path of the corresponding process started, and the current attribute of the current executable file is determined.

[0151] In yet another exemplary embodiment, the determining unit 401 is further configured to:

[0152] When the target network device is put into normal operation, the network function status of at least one process is collected;

[0153] According to the process path of the process, determine the corresponding target executable file list feature table item;

[0154] Determine whether the network function status matches the target executable file list feature table item;

[0155] If there is no match, it is determined that the target network device has an illegal socket connection.

[0156] In yet another exemplary embodiment, the determining unit 401 is specifically configured to:

[0157] According to whether external connection is allowed, the service when external connection is allowed, and the port when external connection is allowed, it is determined whether the socket connection marked by the network function status is legal;

[0158] The device further comprises a response unit 404, configured to:

[0159] Kill the corresponding process of the illegal socket connection and calculate the corresponding file feature value. If the file feature value does not match the executable file list, restore it to the system's built-in safe file.

[0160] This application also provides a processing device from the perspective of hardware structure, see Figure 5 , Figure 5 501, a memory 502, and an input / output device 503. The processor 501 is used to execute the computer program stored in the memory 502 to implement the following Figure 1 The steps of the attack event detection method for a network device in the corresponding embodiment; or, the processor 501 is used to execute the computer program stored in the memory 502 to implement the following Figure 4 Corresponding to the functions of each unit in the embodiment, the memory 502 is used to store the processor 501 executing the above Figure 1 The computer program required by the attack event detection method for network devices in the corresponding embodiment.

[0161] Exemplarily, the computer program may be divided into one or more modules / units, one or more modules / units are stored in the memory 502, and executed by the processor 501 to complete the present application. One or more modules / units may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program in the computer device.

[0162] The processing device may include, but is not limited to, a processor 501, a memory 502, and an input / output device 503. Those skilled in the art will appreciate that the illustration is merely an example of a processing device and does not constitute a limitation on the processing device, and may include more or fewer components than shown in the illustration, or a combination of certain components, or different components. For example, the processing device may also include a network access device, a bus, etc., and the processor 501, the memory 502, the input / output device 503, etc. are connected via a bus.

[0163] The processor 501 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the processing device, and uses various interfaces and lines to connect various parts of the entire device.

[0164] The memory 502 can be used to store computer programs and / or modules. The processor 501 implements various functions of the computer device by running or executing the computer programs and / or modules stored in the memory 502 and calling the data stored in the memory 502. The memory 502 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created according to the use of the processing device, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0165] When the processor 501 is used to execute the computer program stored in the memory 502, the following functions can be implemented:

[0166] Before the target network device performs a network device version update process, determining a current executable file used by the target network device during operation;

[0167] Based on the executable file determination result, a corresponding executable file list is generated, wherein each item in the executable file list represents a different legal attribute of the current executable file, and the different legal attributes are identified by a unique key value;

[0168] After the target network device completes the network device version update process, determining the current attribute of the current executable file according to the executable file list;

[0169] Match the current properties of the current executable file with the executable file list;

[0170] If there is no match, it is determined that an attack event occurred during the version update of the target network device.

[0171] Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process of the attack event detection device for network devices, the processing device and its corresponding units described above can refer to the following. Figure 1 The description of the attack event detection method for the network device in the corresponding embodiment will not be repeated here.

[0172] A person of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0173] To this end, the present application provides a computer-readable storage medium, in which a plurality of instructions are stored, and the instructions can be loaded by a processor to execute the present application as follows: Figure 1 The steps of the attack event detection method for network devices in the corresponding embodiment, the specific operations can refer to the following Figure 1 The description of the attack event detection method for the network device in the corresponding embodiment will not be repeated here.

[0174] The computer-readable storage medium may include: a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0175] Due to the instructions stored in the computer-readable storage medium, the present application can be executed. Figure 1The steps of the attack event detection method for network devices in the corresponding embodiment, therefore, the present application can be implemented as follows Figure 1 The beneficial effects that can be achieved by the attack event detection method for network devices in the corresponding embodiments are detailed in the previous description and will not be repeated here.

[0176] The above is a detailed introduction to the attack event detection method, device, processing device and computer-readable storage medium for network devices provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the core idea of ​​the present application; at the same time, for technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for detecting attack events on network devices, characterized in that: The method comprises: Before the target network device performs a network device version update process, determining a current executable file used by the target network device during operation; Based on the executable file determination result, a corresponding executable file list is generated, wherein each item in the executable file list represents a different legal attribute of the current executable file, and the different legal attributes are identified by a unique key value; After the target network device completes the network device version update process, determining the current attribute of the current executable file according to the executable file list; Matching the current attribute of the current executable file with the executable file list; If there is no match, it is determined that an attack event occurs during the version update of the target network device.

2. The method according to claim 1, characterized in that After determining that the attack event occurs on the target network device, the method further includes: In response to the attack event during the version update, the corresponding executable file of the target network device is stopped and deleted after the target network device completes the network device version update process, and restored to the system's own security file.

3. The method according to claim 1, characterized in that The executable file list adopts a hash linked list mechanism and is encrypted with a secret key.

4. The method according to claim 3, characterized in that The different legal attributes include executable file path, original file unique feature value, whether to generate external connection, and the IP and port of the external connection.

5. The method according to claim 4, characterized in that The determining the current attribute of the current executable file according to the executable file list includes: After the device is started, the executable file list is decrypted; After the process is started, searching whether there is a matching file entry in the executable file list according to the file path of the started corresponding process determined by the user state process; If it exists, the corresponding executable file is located based on the file path of the corresponding process started, and the current attribute of the current executable file is determined.

6. The method according to claim 1, characterized in that The method further comprises: During the process of the target network device being put into normal operation, collecting the network function status of at least one process; Determining a corresponding target executable file list feature table item according to the process path of the process; Determining whether the network function status matches the target executable file list feature entry; If there is no match, it is determined that an illegal socket connection exists in the target network device.

7. The method according to claim 6, characterized in that The determining whether the network function status matches the target executable file list feature entry includes: Determine whether the socket connection identified by the network function status is legal according to whether external connection is allowed, the service when external connection is allowed, and the port when external connection is allowed in the feature table item of the target executable file list; After determining that the target network device has an illegal socket connection, the method further includes: The corresponding process of the illegal socket connection is killed, and the corresponding file feature value is calculated. If it is determined in combination with the executable file list that the file feature value does not match, the system's built-in security file is restored.

8. A device for detecting attack events on network equipment, characterized in that: The device comprises: A determination unit, used to determine a current executable file used by the target network device during operation before the target network device performs a network device version update process; A generating unit, configured to generate a corresponding executable file list based on the executable file determination result, wherein each item in the executable file list represents a different legal attribute of the current executable file, and the different legal attributes are identified by a unique key value; The determining unit is further configured to determine the current attribute of the current executable file according to the executable file list after the target network device completes the network device version update process; a matching unit, configured to match the current attribute of the current executable file with the executable file list, and trigger the determining unit if there is a mismatch; The determining unit is further configured to determine whether an attack event occurs during a version update of the target network device.

9. A processing device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a computer program, and the processor executes the method according to any one of claims 1 to 7 when calling the computer program in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the method according to any one of claims 1 to 7.

Images