Method and device for responding to network attack

Abstract

The embodiment of the invention provides a method and device for responding to a network attack, and the method comprises the steps: obtaining the attribute characteristics of the network attack through a network attack data package, and enabling a target attacker to initiate the network attack through the network attack data package; determining the attack type of the network attack according to the attribute characteristics, and determining a response mode according to the attack type of the network attack; and executing a response action of the network attack according to the response mode. According to the invention, the problem that differential response cannot be carried out on the network attacks due to the fact that the same response is adopted for all the network attacks in the prior art is solved, and the effect of carrying out differential response on different network attacks is further achieved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of network security technology, and in particular to a method and device for responding to network attacks. Background Art

[0002] Attacks in cyberspace currently generally come from two source scenarios: one is low-interaction security scanning achieved by automated security tools, and the other is highly interactive network penetration attacks conducted manually. Existing security detection and defense methods use the same response content for all request behaviors, making it difficult to effectively identify different source scenarios. Therefore, it is impossible to respond to attack behaviors in a differentiated manner to obtain more attack behavior information, nor is it possible to perform differentiated processing for different types of attack sources. There is no maximum use of existing security resources to further obtain security threat information for differentiated processing and internal security risk investigation.

[0003] There is currently no effective solution to the above problems. Summary of the invention

[0004] The embodiments of the present invention provide a method and device for responding to a network attack, so as to at least solve the problem in the related art that the same response is adopted for all network attacks and a differentiated response cannot be made to the network attacks.

[0005] According to one embodiment of the present invention, a method for responding to a network attack is provided, comprising: obtaining attribute characteristics of the network attack through a network attack data packet, wherein the network attack data packet is a data packet used by a target attacker to initiate the network attack; determining an attack type of the network attack based on the attribute characteristics, and determining a response mode based on the attack type of the network attack; and executing a response action to the network attack according to the response mode.

[0006] In an exemplary embodiment, determining a response mode according to the attack type of the network attack includes: when the network attack includes one attack type, determining the response mode to be a repeated response; when the network attack includes multiple attack types, determining the response mode to be a sequential response.

[0007] In an exemplary embodiment, executing the response action of the network attack according to the response mode includes: when the response mode is the repeated response, repeatedly executing the response action; when the response mode is the sequential response, executing the response action of each attack type in sequence.

[0008] In an exemplary embodiment, when the response mode is the repeated response, the response action is repeatedly executed, including: repeatedly executing the response action on all attackers, and the all attackers include the target attacker and other attackers; when the response mode is the sequential response, the response action of each attack type is executed in sequence, including: when the network attack occurs within a preset time range and there is a session for the network attack, the response action of each attack type is executed in sequence on the target attacker.

[0009] In an exemplary embodiment, determining the attack type of the network attack according to the attribute characteristics includes: determining the attack type according to at least one of the following attribute characteristics: attack utilization path, attack method, attack source, and attacked object.

[0010] In an exemplary embodiment, the method further includes: in the case where the attack type is determined according to the attack utilization path and the attack method, the attack type is determined in the following manner: in the case where the attack utilization path satisfies a first condition and the attack method satisfies a second condition, the attack type is determined as a first attack type, wherein the first condition includes at least one of the following: the target attacker attacks using a request header, the target attacker attacks using an out-of-band, and the second condition includes at least one of the following: structured query language injection, cross-site scripting attack, command execution, server-side request forgery, blind extensible markup language external entity attack; ... When the attack is an attack payload in the request body and the attack method is at least one of unauthorized access and command execution, the attack type is determined as the second attack type; when the attack exploitation path is the attack payload in the request body and the attack method is structured query language injection, the attack type is determined as the third attack type; when the attack exploitation path is the attack payload in the request body and the attack method is at least one of directory traversal and uniform resource locator jump, the attack type is determined as the fourth attack type; when the attack exploitation path is various vulnerabilities or attack methods and the attack method is command execution, the attack type is determined as the fifth attack type.

[0011] In an exemplary embodiment, the method further includes: modifying parameters in the network attack data packet to obtain a modified network attack data packet; and performing risk detection through the modified network attack data packet.

[0012] According to another embodiment of the present invention, there is provided a device for responding to a network attack, comprising: an acquisition module, used to acquire attribute characteristics of the network attack through a network attack data packet, wherein the network attack data packet is a data packet used by a target attacker to initiate the network attack; a determination module, used to determine the attack type of the network attack according to the attribute characteristics, and determine a response mode according to the attack type of the network attack; and an execution module, used to execute a response action of the network attack according to the response mode.

[0013] According to yet another embodiment of the present invention, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, wherein the computer program implements the steps of any of the above methods when executed by a processor.

[0014] According to yet another embodiment of the present invention, there is provided an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0015] According to yet another embodiment of the present invention, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, the steps of any of the above methods are implemented.

[0016] According to yet another embodiment of the present invention, a computer program product is provided, comprising computer instructions, wherein when the computer instructions are executed by a processor, the steps of any of the above methods are implemented.

[0017] Through the present invention, the attribute characteristics of the network attack are obtained through the network attack data packet, wherein the network attack data packet is the data packet of the target attacker launching the network attack; the attack type of the network attack is determined according to the attribute characteristics, and the response mode is determined according to the attack type of the network attack; and the response action of the network attack is executed according to the response mode. Therefore, the problem that the same response is adopted for all network attacks in the related art and the network attacks cannot be responded to in a differentiated manner can be solved, and the effect of responding to different network attacks in a differentiated manner can be achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 is a hardware structure block diagram of a mobile terminal of a method for responding to a network attack according to an embodiment of the present invention;

[0019] Figure 2 is a flow chart of a method for responding to a network attack according to an embodiment of the present invention;

[0020] Figure 3 is a diagram of basic deception types of network attacks according to an embodiment of the present invention;

[0021] Figure 4 is a schematic diagram of a deception defense response strategy according to an embodiment of the present invention;

[0022] Figure 5 is a schematic diagram of selecting network attack behaviors for active risk detection according to an embodiment of the present invention;

[0023] Figure 6 is a schematic diagram of a proactive risk detection strategy according to an embodiment of the present invention;

[0024] Figure 7 is a schematic diagram of a network attack deception defense system according to an embodiment of the present invention;

[0025] Figure 8 is a flow chart of a network attack deception defense method according to an embodiment of the present invention;

[0026] Fig. 9 is a schematic diagram of attribute characteristics of a network attack according to an embodiment of the present invention;

[0027] Fig.10 4 is a structural block diagram of a device for responding to a network attack according to an embodiment of the present invention. DETAILED DESCRIPTION

[0028] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings and in combination with the embodiments.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0030] The method embodiment of responding to network attacks provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 FIG. 1 is a hardware structure block diagram of a mobile terminal of a method for responding to a network attack according to an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1Different configurations are shown.

[0031] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the method for responding to network attacks in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the mobile terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0032] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0033] In this embodiment, a method for responding to a network attack running on the above mobile terminal or network architecture is provided. Figure 2 is a flow chart of a method for responding to a network attack according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0034] Step S202, obtaining attribute characteristics of the network attack through a network attack data packet, wherein the network attack data packet is a data packet from which the target attacker initiates the network attack;

[0035] The above-mentioned network attack data packets are data packets launched by the target attacker to launch network attacks, which contain malicious codes, instructions or data, and are intended to damage, invade or steal sensitive information from the target system. The attribute characteristics of the above-mentioned network attacks include attack utilization channels, attack methods, attack sources, and attacked objects.

[0036] Step S204, determining the attack type of the network attack according to the attribute characteristics, and determining a response mode according to the attack type of the network attack;

[0037] The above-mentioned determining the attack type of the network attack according to the attribute characteristics is to determine the attack type according to at least one of the following in the attribute characteristics: attack utilization path, attack method, attack source, and attacked object.

[0038] The above-mentioned attack exploitation means are the methods or paths used by the above-mentioned target attackers to enter the target system or network to attack, such as through vulnerability exploitation, social engineering and other means. The above-mentioned attack methods are the specific means or technologies adopted by the above-mentioned target attackers to implement attacks on the target system or network. Common attack methods include structured query language (SQL) injection, cross-site scripting (XSS) attacks, phishing attacks, etc. The above-mentioned attack source is the specific source or source type of the network attack. The attack source can be hackers, malware, botnets, etc. from the outside, or it can be internal employees, partners, etc. The above-mentioned attacked objects are specific objects or targets that suffer from network attacks. The attacked objects can be individual users, corporate organizations, government agencies, network systems, etc.

[0039] Specifically, Figure 3 is a diagram of basic deception types of network attacks according to an embodiment of the present invention, such as Figure 3 As shown, when the attack type is determined according to the attack utilization path and the attack method, the attack type is determined in the following manner:

[0040] In the case where the attack utilization path satisfies the first condition and the attack method satisfies the second condition, the attack type is determined as the first attack type, wherein the first condition includes at least one of the following: the target attacker attacks using the request header, the target attacker attacks using the out-of-band, and the second condition includes at least one of the following: structured query language injection, cross-site scripting attack, command execution, server-side request forgery, blind extensible markup language external entity attack;

[0041] The above-mentioned attack using the request header is that the target attacker uses the malicious request header to carry the Domain Name System log record (DNS logging, referred to as DNSlog) to carry out the attack. Among them, DNSlog is a tool for recording DNS query requests and responses. The attacker can carry DNSlog in the malicious request header to track and record the Domain Name System (Domain Name System, referred to as DNS) query activities during the attack. By carrying DNSlog in the request header, the target attacker can obtain some sensitive information of the target system, such as domain name resolution, network configuration of the target system, etc. The above-mentioned attack using out-of-band is that the target attacker uses some method to carry malicious code or malicious data in normal requests or communications in order to bypass security detection or carry out attacks.

[0042] The structured query language injection mentioned above is an attack method against the database. The target attacker bypasses the input validation of the application by injecting malicious SQL code into the application and performs malicious database operations. The cross-site scripting attack mentioned above is a common web page (Web) security vulnerability. The attacker injects malicious script code into the web page, so that the user is attacked when accessing the page. The command execution mentioned above is that the target attacker executes malicious commands or scripts on the target system to gain control of the system or perform malicious operations. The server-side request forgery (SSRF) mentioned above is that the target attacker uses the target system's access function to external resources to launch an attack against the internal system or local resources by constructing malicious requests. The target attacker can use the SSRF vulnerability to access the internal system, bypass the firewall, execute remote commands, etc. The blind XML External Entity attack (Blind XXE) mentioned above is an extensible markup language (XML) external entity injection attack. The attacker injects malicious external entities into the XML document to try to leak sensitive information from the target system.

[0043] like Figure 3 As shown in the figure, when the target attacker uses the request header DNSlog or an external attack path to launch a network attack using one of the attack methods such as SQL injection, XSS, command execution, SSRF, Blind XXE, etc., it is classified as the A00001 network attack type.

[0044] When the attack exploitation path is the attack payload in the request body, and the attack method is at least one of unauthorized access and command execution, determining the attack type as the second attack type;

[0045] The attack payload in the request body is the process by which the target attacker constructs a malicious request using a malicious payload and carries the malicious payload in the request body of the network request to carry out the attack. The above-mentioned privilege escalation is the act of the target attacker obtaining a higher level of privilege than his normal privilege range by exploiting vulnerabilities or weaknesses in the system or application. Privilege escalation attacks can occur at different levels, including various systems and services such as operating systems, applications, and databases.

[0046] like Figure 3 As shown, when the target attacker uses the attack path of the attack payload in the request body and adopts one of the attack methods such as overstepping authority and command execution to launch a network attack, it is classified as the A00002 network attack type.

[0047] In a case where the attack exploitation path is the attack payload in the request body, and the attack method is structured query language injection, determining the attack type as a third attack type;

[0048] like Figure 3 As shown, when the target attacker uses the attack path of the attack payload in the request body and uses the SQL injection attack method to launch a network attack, it is classified as the A00003 network attack type.

[0049] When the attack exploitation path is the attack payload in the request body, and the attack method is at least one of directory traversal and uniform resource locator jump, determining the attack type as a fourth attack type;

[0050] The above-mentioned directory traversal is a vulnerability that exploits the improper file path handling of a web application. The target attacker attempts to access or execute unauthorized files or directories in the system. The target attacker bypasses the application's access control by injecting special characters or paths into the URL and accesses sensitive files or directories in the system. The above-mentioned Uniform Resource Locator (URL) jump is a vulnerability that exploits the URL redirection function in a web application. The target attacker constructs a malicious URL to trick users into clicking on a malicious website or address.

[0051] like Figure 3 As shown, when the target attacker uses the attack path of the attack payload in the request body and adopts one of the attack methods such as directory traversal and URL jump to launch a network attack, it is classified as A00004 network attack type.

[0052] When the attack exploitation path is various vulnerabilities or attack methods, and the attack method is command execution, the attack type is determined as the fifth attack type.

[0053] The various vulnerabilities or attack methods mentioned above are "all", which means that the target attacker attempts to exploit all available attack paths or all possible vulnerabilities to carry out network attacks.

[0054] like Figure 3 As shown in the figure, when the target attacker uses the ALL attack path and adopts the command execution attack method to launch a network attack, it is classified as the A00005 network attack type.

[0055] Step S206: executing a response action to the network attack according to the response mode.

[0056] As an optional implementation, determining a response mode according to the attack type of the network attack includes: when the network attack includes one attack type, determining the response mode to be a repeated response; when the network attack includes multiple attack types, determining the response mode to be a sequential response.

[0057] Specifically, when the response mode is the repeated response, the response action is repeatedly executed, including: repeatedly executing the response action on all attackers, and the all attackers include the target attacker and other attackers; when the response mode is the sequential response, the response action of each attack type is executed in sequence, including: when the network attack occurs within a preset time range and there is a session for the network attack, the response action of each attack type is executed in sequence on the target attacker.

[0058] Figure 4 Schematic diagram of a deception defense response strategy according to an embodiment of the present invention. Figure 4 As shown, A00003 network attacks will trigger the above-mentioned repeated response, which will respond to network attacks from all sources. Specifically, if the system is attacked by multiple attackers at the same time, all attacks will be repeatedly responded to. The above-mentioned repeated response can act on different sessions. The above-mentioned session is one or more communication interaction processes in a network attack, including interactions between users and servers, interactions between users, etc. Any network attack of A00001, A00002, and A00005 will trigger the above-mentioned sequential response, which will respond to the target attacker with an IP address of 12.0.0.0 / 24. The preset time range of the above-mentioned sequential response is 00:00:00-12:00:00, and the above-mentioned sequential response can only act on the same session.

[0059] As an optional implementation manner, the parameters in the network attack data packet are modified to obtain a modified network attack data packet; and risk detection is performed using the modified network attack data packet.

[0060] Specifically, the parameters in the above network attack package are replaced as needed, such as the source Internet Protocol (IP), source domain name, source port, destination IP, destination domain name, destination port, protocol, etc., and the network attack payload is directly loaded as needed or attenuated through variants, parameter adjustments, etc. to initiate risk exploration behavior to the internal target assets, and the risk exploration results are identified to determine whether the target assets have vulnerable vulnerabilities.

[0061] For example, Figure 5 FIG. 1 is a schematic diagram of selecting network attack behaviors for active risk detection according to an embodiment of the present invention. Figure 5 As shown, the communication numbers of the selected network attacks are TX202409100001 and TX202409100002. Figure 6 is a schematic diagram of a risk active detection strategy according to an embodiment of the present invention. Figure 6 As shown, the original request source IP of TX202409100001 is replaced by 1.1.1.2 to 10.1.1.1, the original destination IP is replaced by 1.1.1.1 to 10.1.1.0 / 24, and the original destination port is replaced by 8080 to 0-65535. The risk exploration of the network attack against TX202409100001 is immediately performed in the risk exploration method of attack load variant attenuation. The original request source IP of TX202409100002 is replaced by 1.1.2 to 10.1.1.1, the original destination IP is replaced by 1.1.1 to 10.1.2.0 / 24, and the original destination port is replaced by 8080 to 433. The risk exploration method of directly loading the attack load is planned to initiate the risk exploration at 2024-09-25 14:00:00.

[0062] Figure 7 Schematic diagram of a network attack deception defense system according to an embodiment of the present invention. Figure 7 As shown, the above network attack deception defense system consists of a network data acquisition module, a data analysis module, a deception defense module, a deception scenario customization module, and an active detection module. Among them:

[0063] Network data acquisition module: obtain network attack data packets.

[0064] Data parsing and processing module: 1) Format the acquired network attack data packets first, and identify the basic information such as source IP, source port, destination IP, destination port, protocol, data content details, session information, etc. 2) Further identify, parse and process the basic information of the identified network data packets, and identify various attributes of network attack requests, including but not limited to attack object type (specific objects, such as log4j, tomcat, etc.), attack type (such as remote command execution attack, directory traversal attack, XSS attack, SQL injection attack, etc.), attack application type (application system type, such as JAVA application, WEB application, human resources WEB application system, database system, etc.), attack characteristics, whether the attack is executable, whether the attack is destructive, and other attributes.

[0065] Deception scenario customization module: defines basic deception scenario rules based on the basic steps and characteristics of network attacks. The deception scenario settings include but are not limited to attack type, attack exploitation method, attacked object type, attack source type (manual penetration, interactive scanner, semi-interactive scanner), response action, etc.

[0066] Deception defense response module: 1) Define response modes (random response, polling response, sequential response, repeated response, blocking, release, etc.); 2) Combine basic deception response scenarios according to parameters such as time, attack source, and same-source session, determine the response mode to form a deception defense response strategy, achieve differentiated response to network attacks, and perform scenario-customized deception response and disposal of network attacks as needed.

[0067] Active risk detection module: parses the captured attack behavior according to the data parsing processing template, identifies the attribute characteristics of the network attack, and then replaces the source IP, source port, destination IP, source port and other parameters as needed, loads the network attack payload or attenuates or expands it through variants, parameter changes, etc., and then actively detects the safe and controllable risks of internal assets, so as to realize on-demand safe and controllable security detection and vulnerability identification of internal assets.

[0068] Figure 8 is a flow chart of a network attack deception defense method according to an embodiment of the present invention. Figure 8 As shown, the process includes the following steps:

[0069] S801, setting basic deception scenario rules for network attacks based on network attack steps and characteristics;

[0070] S802, combining basic deception scenario rules as needed and setting response modules to form a deception defense response strategy;

[0071] Specifically, basic deception scenario rules are referenced and combined as needed, and the deception defense response mode is set, and parameters such as the policy object and time are applied to form a deception defense response strategy.

[0072] S803, obtaining a network attack data packet;

[0073] S804, the network attack data packet is parsed and processed according to a predetermined format specification;

[0074] Specifically, the network attack data packet is parsed and processed according to the predetermined format specification, and the basic information of the network data packet (source IP, destination IP, source port, destination port, protocol, data content details, etc.) is identified. The basic information of the network data packet includes: communication number, communication time, whether it is a request, request line, source IP, source port, destination IP, destination port, protocol, request / response line, datagram header, datagram body, session identifier, complete message, etc.

[0075] S805, identifying the attribute characteristics of network attacks;

[0076] Specifically, the basic information of the network data packet identified by S804 is further identified, parsed and processed to identify various attributes of the network attack request, including but not limited to the attack object type (specific objects, such as log4j, tomcat, etc.), attack type (such as remote command execution attack, directory traversal attack, XSS attack, SQL injection attack, etc.), attack application type (application system type, such as JAVA application, WEB application, human resources WEB application system, database system, etc.), attack characteristics, whether the attack is executable, whether the attack is destructive, and other attributes.

[0077] Fig. 9 is a schematic diagram of attribute characteristics of a network attack according to an embodiment of the present invention, such as Fig. 9 As shown, the target of this type of network attack is Log4j, the attack type is remote command execution RCE, the attack application type is JAVA application, and the attack request is executable and destructive.

[0078] S806, determine whether the deception defense response strategy is hit, if so, jump to S807, if not, jump to S808;

[0079] Specifically, the network attack matches the deception defense response strategy, and the deception defense response action is executed for those that match the strategy. For those that do not match the strategy, the conventional security disposal response (release or block) action is executed.

[0080] S807, executing a deception defense response action according to the deception defense response strategy;

[0081] S808, executing a conventional response action;

[0082] S809, determine whether to perform active risk detection, if yes, jump to S810, if no, end;

[0083] Specifically, users can select and proactively explore risks of identified network attack behaviors as needed.

[0084] S810, replace the source IP, source domain name, source port, destination IP, destination domain name, destination port, protocol and other parameters, and launch risk detection to the target asset after loading or attenuating the network attack payload as needed;

[0085] Specifically, the source IP, source domain name, source port, destination IP, destination domain name, destination port, protocol and other parameters in the network attack package are replaced as needed, and the network attack payload is directly loaded or attenuated through variants, parameter adjustments, etc., and risk exploration behavior is initiated to the internal target assets, and the risk exploration results are identified to determine whether the target assets have vulnerable vulnerabilities.

[0086] S811, receiving the risk detection result returned by the target asset, and identifying whether the target asset has a vulnerability.

[0087] Optionally, the executor of the above steps may be a background processor, or other devices with similar processing capabilities, or a machine that integrates at least an image acquisition device and a data processing device, wherein the image acquisition device may include a graphics acquisition module such as a camera, and the data processing device may include a computer, a mobile phone or other terminal, but is not limited thereto.

[0088] Through the above steps, the problem that the same response is adopted for all network attacks in the related technology and differentiated responses to network attacks cannot be made is solved, thereby improving the effect of differentiated responses to different network attacks.

[0089] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0090] In this embodiment, a device for responding to a network attack is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0091] Fig.10 is a structural block diagram of a device for responding to a network attack according to an embodiment of the present invention, such as Fig.10 As shown, the device includes an acquisition module 1002, which is used to obtain attribute characteristics of the network attack through a network attack data packet, wherein the network attack data packet is a data packet initiated by the target attacker to initiate the network attack; a determination module 1004, which is used to determine the attack type of the network attack according to the attribute characteristics, and determine a response mode according to the attack type of the network attack; and an execution module 1006, which is used to execute a response action of the network attack according to the response mode.

[0092] In an exemplary embodiment, the above-mentioned device is also used to determine that the response mode is a repeated response when the network attack includes one attack type; and determine that the response mode is a sequential response when the network attack includes multiple attack types.

[0093] In an exemplary embodiment, the above-mentioned device is also used to repeatedly execute the response action when the response mode is the repeated response; when the response mode is the sequential response, execute the response action of each attack type in sequence.

[0094] In an exemplary embodiment, the above-mentioned device is also used to repeatedly execute the response action when the response mode is the repeated response, including: repeatedly executing the response action on all attackers, and the all attackers include the target attacker and other attackers; when the response mode is the sequential response, executing the response action of each attack type in sequence, including: when the network attack occurs within a preset time range and there is a session for the network attack, executing the response action of each attack type in sequence on the target attacker.

[0095] In an exemplary embodiment, the above-mentioned device is also used to determine the attack type according to at least one of the following among the attribute characteristics: attack utilization path, attack method, attack source, and attacked object.

[0096] In an exemplary embodiment, the above-mentioned device is also used to determine the attack type in the following manner when the attack type is determined according to the attack utilization path and the attack method: when the attack utilization path satisfies a first condition and the attack method satisfies a second condition, the attack type is determined as a first attack type, wherein the first condition includes at least one of the following: the target attacker uses a request header to attack, the target attacker uses an out-of-band attack, and the second condition includes at least one of the following: structured query language injection, cross-site scripting attack, command execution, server-side request forgery, blind extensible markup language external entity attack; when the attack utilization path is When the attack payload is in the request body and the attack method is at least one of unauthorized access and command execution, the attack type is determined as the second attack type; when the attack exploitation path is the attack payload in the request body and the attack method is structured query language injection, the attack type is determined as the third attack type; when the attack exploitation path is the attack payload in the request body and the attack method is at least one of directory traversal and uniform resource locator jump, the attack type is determined as the fourth attack type; when the attack exploitation path is various vulnerabilities or attack methods and the attack method is command execution, the attack type is determined as the fifth attack type.

[0097] In an exemplary embodiment, the above-mentioned device is also used to modify the parameters in the network attack data packet to obtain a modified network attack data packet; and perform risk detection through the modified network attack data packet.

[0098] It should be noted that the above modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0099] An embodiment of the present invention further provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above methods are implemented.

[0100] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0101] An embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0102] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0103] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

[0104] An embodiment of the present invention further provides a computer program product, including a computer program, which implements the steps of the method described in each embodiment of the present application when executed by a processor.

[0105] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0106] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for responding to a network attack, characterized in that: include: Acquiring attribute characteristics of a network attack through a network attack data packet, wherein the network attack data packet is a data packet from which a target attacker initiates the network attack; Determining the attack type of the network attack according to the attribute characteristics, and determining a response mode according to the attack type of the network attack; The response action of the network attack is executed according to the response mode.

2. The method according to claim 1, characterized in that: Determining a response mode according to the attack type of the network attack includes: In a case where the network attack includes one attack type, determining the response mode to be a repeated response; In the case that the network attack includes multiple attack types, the response mode is determined to be a sequential response.

3. The method according to claim 2, characterized in that Executing a response action to the network attack according to the response mode includes: When the response mode is the repeated response, repeatedly performing the response action; When the response mode is the sequential response, the response actions of each attack type are executed in sequence.

4. The method according to claim 3, characterized in that In the case where the response mode is the repeated response, repeatedly executing the response action includes: repeatedly executing the response action on all attackers, wherein all attackers include the target attacker and other attackers; When the response mode is the sequential response, the response actions of each attack type are executed in sequence, including: when the network attack occurs within a preset time range and there is a session for the network attack, the response actions of each attack type are executed in sequence on the target attacker.

5. The method according to claim 1, characterized in that: Determining the attack type of the network attack according to the attribute characteristics includes: The attack type is determined according to at least one of the following attribute characteristics: attack utilization path, attack method, attack source, and attacked object.

6. The method according to claim 5, characterized in that The method further comprises: In the case where the attack type is determined according to the attack utilization path and the attack method, the attack type is determined in the following manner: In the case where the attack utilization path satisfies the first condition and the attack method satisfies the second condition, the attack type is determined as the first attack type, wherein the first condition includes at least one of the following: the target attacker attacks using the request header, the target attacker attacks using the out-of-band, and the second condition includes at least one of the following: structured query language injection, cross-site scripting attack, command execution, server-side request forgery, blind extensible markup language external entity attack; When the attack exploitation path is the attack payload in the request body, and the attack method is at least one of unauthorized access and command execution, determining the attack type as a second attack type; In a case where the attack exploitation path is the attack payload in the request body, and the attack method is structured query language injection, determining the attack type as a third attack type; When the attack exploitation path is the attack payload in the request body, and the attack method is at least one of directory traversal and uniform resource locator jump, determining the attack type as a fourth attack type; When the attack exploitation path is various vulnerabilities or attack methods, and the attack method is command execution, the attack type is determined as the fifth attack type.

7. The method according to claim 1, characterized in that The method further comprises: Modifying the parameters in the network attack data packet to obtain a modified network attack data packet; Perform risk detection through modified network attack data packets.

8. A device for responding to a network attack, characterized in that: include: An acquisition module, used to acquire attribute characteristics of a network attack through a network attack data packet, wherein the network attack data packet is a data packet used by a target attacker to initiate the network attack; A determination module, used to determine the attack type of the network attack according to the attribute characteristics, and determine a response mode according to the attack type of the network attack; An execution module is used to execute a response action of the network attack according to the response mode.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program implements the steps of the method described in any one of claims 1 to 7 when executed by a processor.

10. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to run the computer program to perform the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 7 are implemented.

Images