Network risk processing method and device, equipment and storage medium

Abstract

The invention discloses a network risk processing method and device, equipment and a storage medium. The method comprises the following steps: capturing request data, and generating a traffic message according to the request data; acquiring a to-be-determined risk IP address from the flow message by using a preset job in a flow calculation engine; determining a risk IP address from the to-be-determined risk IP address according to a matching result of a prior risk IP address in a preset risk database and the to-be-determined risk IP address, and according to information of a preset position of the traffic message; and sending alarm information based on the risk IP address in the preset time window. According to the technical scheme provided by the embodiment of the invention, whether the received request comes from a hostile attacker or not is quickly and accurately judged from massive requests, and a user is assisted to determine whether the user is subjected to the network attack or not.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a network risk processing method, device, equipment and storage medium. Background Art

[0002] With the rapid development of network technology, cyber crime has become an issue that cannot be ignored. In recent years, cyber crime has continued to occur frequently, causing significant economic losses and data security risks. First, ransomware attacks are becoming more and more intense. Ransomware is a popular network attack tool that extorts users by encrypting their files. Major ransomware attack groups continue to improve their attack methods and modes, making the new generation of ransomware attacks more complex and targeted, showing trends such as intelligent ransomware and normalized multiple ransomware.

[0003] In most of these attacks, attackers do not use their own computers to carry out attacks directly, but instead use multiple disguises to hide their identities, making it more difficult to identify and track them. Currently, the identification of network risks is not effective. Summary of the invention

[0004] The present invention provides a network risk processing method, device, equipment and storage medium to solve the problem of poor effect in identifying network risks.

[0005] In a first aspect, the present invention provides a network risk management method, comprising:

[0006] Capture request data, and generate traffic packets according to the request data;

[0007] Using a preset job in the stream computing engine, obtain the risky IP address to be determined from the traffic message;

[0008] Determine the risk IP address from the risk IP addresses to be determined according to the matching result between the prior risk IP address in the preset risk database and the risk IP address to be determined, and according to the information of the preset position of the traffic message;

[0009] Send alerts based on risky IP addresses within a preset time window.

[0010] In a second aspect, the present invention provides a network risk processing device, comprising:

[0011] A flow message generation module, used to capture request data and generate flow messages according to the request data;

[0012] A module for obtaining risky addresses to be determined, used to obtain risky IP addresses to be determined from the traffic message by using a preset job in the stream computing engine;

[0013] A risky address determination module, configured to determine a risky IP address from the risky IP addresses to be determined according to a matching result between a priori risky IP address in a preset risk database and the risky IP address to be determined, and according to information of a preset location of the traffic message;

[0014] The alarm information sending module is used to send alarm information based on risky IP addresses within a preset time window.

[0015] In a third aspect, the present invention provides an electronic device, the electronic device comprising:

[0016] at least one processor;

[0017] and a memory communicatively coupled to the at least one processor;

[0018] Among them, the memory stores a computer program that can be executed by at least one processor, and the computer program is executed by at least one processor so that the at least one processor can execute the network risk handling method of the first aspect mentioned above.

[0019] In a fourth aspect, the present invention provides a computer-readable storage medium storing computer instructions, which are used to implement the network risk handling method of the first aspect when executed by a processor.

[0020] The network risk processing solution provided by the present invention uses the powerful computing power of the stream computing engine to provide support for the analysis of massive network request data. Through pre-configured jobs, it is possible to obtain IP addresses suspected of being at risk from numerous traffic messages, and then accurately determine the risky IP addresses from the suspected risky IP addresses based on the pre-configured risk database and information in the traffic messages, and alert users by sending alarm information. This solution can quickly and accurately determine whether the received request comes from a malicious attacker from a massive number of requests, and assist users in determining whether they have been attacked by the network.

[0021] It should be understood that the content described in this section is not intended to identify the key or important features of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 is a flow chart of a network risk processing method provided according to Embodiment 1 of the present invention;

[0024] Figure 2 is a flow chart of a network risk processing method provided according to Embodiment 2 of the present invention;

[0025] Figure 3 is a schematic diagram of the structure of a network risk processing device provided according to Embodiment 3 of the present invention;

[0026] Figure 4 It is a schematic diagram of the structure of an electronic device provided according to Embodiment 4 of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In the description of the present invention, unless otherwise specified, "multiple" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects associated before and after are an "or" relationship. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] Embodiment 1

[0030] Figure 1A flowchart of a network risk handling method is provided for the first embodiment of the present invention. This embodiment is applicable to the case of identifying network risk IPs. The method can be executed by a network risk handling device. The network risk handling device can be implemented in the form of hardware and / or software. The network risk handling device can be configured in an electronic device. The electronic device can be composed of two or more physical entities or one physical entity.

[0031] like Figure 1 As shown, a network risk processing method provided in the first embodiment of the present invention specifically includes the following steps:

[0032] S101, capturing request data, and generating a traffic message according to the request data.

[0033] In this embodiment, a network packet capture tool such as Tshark deployed on a server for traffic exchange can be used to capture request data, and the request data can be converted into a file in a preset format. By parsing the file, a traffic message can be generated.

[0034] S102: Using a preset job in the stream computing engine, obtain the risky IP address to be determined from the traffic message.

[0035] In this embodiment, a job can be configured in advance in the stream computing engine. The job is used to process the traffic message, such as extracting the IP address in the traffic message header, and mining the IP address suspected of being at risk from the traffic message, that is, the risk IP address to be determined. The number of traffic messages is usually multiple.

[0036] S103: Determine a risky IP address from the risky IP addresses to be determined according to a matching result between a priori risky IP addresses in a preset risk database and the risky IP addresses to be determined, and according to information of a preset location of the traffic message.

[0037] In this embodiment, the risk IP addresses determined based on prior experience or prior knowledge can be stored in a database in advance to obtain a risk database. The prior risk IP addresses in the preset risk database can be matched with the risk IP addresses to be determined to obtain a matching result. And based on the characteristics of the information at the preset position of the traffic message, such as the characteristics of the request header in the message header, and the matching result, the risk IP addresses among the multiple risk IP addresses to be determined are determined. For example, the risk IP addresses to be determined that have been successfully matched are determined as risk IP addresses, and the risk IP addresses to be determined of the traffic messages with abnormal characteristics are determined as risk IP addresses. Among them, the judgment criteria for abnormal characteristics can be preset.

[0038] S104: Send warning information based on risky IP addresses within a preset time window.

[0039] In this embodiment, the alarm information can be sent to the preset client according to the number and frequency of risky IP addresses in the preset time window. For example, when the number of risky IP addresses in the preset time window meets the first preset condition, the first information is sent, and when the frequency of risky IP addresses in the preset time window meets the second preset condition, the second information is sent. The first information may be different from the second information.

[0040] The technical solution of the embodiment of the present invention uses the powerful computing power of the stream computing engine to provide support for the analysis of massive network request data. Through pre-configured jobs, it is possible to obtain IP addresses suspected of being at risk from numerous traffic messages, and then accurately determine the risky IP addresses from the suspected risky IP addresses based on the pre-configured risk database and information in the traffic messages, and alert the user by sending an alarm message. This solution can quickly and accurately determine whether the received request comes from a malicious attacker from a massive number of requests, and assist users in determining whether they have been attacked by the network.

[0041] Optionally, utilizing a preset job in the stream computing engine to obtain the risk IP address to be determined from the traffic message includes: utilizing a preset job in the Flink stream computing engine to obtain the risk IP address to be determined from a target location of the traffic message, wherein the target location is determined according to a communication protocol followed by the request data.

[0042] Exemplarily, when the communication protocol followed by the request data is the HTTP protocol, the target location may be a request header in the message header.

[0043] Optionally, generating a traffic message according to the request data includes: using the request data to generate a Kafka message containing the traffic message, and sending the Kafka message to a Kafka queue; wherein, after generating the traffic message according to the request data, it also includes: obtaining the traffic message from the Kafka queue by monitoring the Topic of the Kafka queue using a stream computing engine.

[0044] Specifically, you can use a network packet capture tool such as Tshark deployed on the traffic exchange server to capture the request data and convert the request data into a file in a preset format. By parsing the file, you can generate a Kafka message containing the traffic message, and send the Kafka message to the Kafka queue monitored by the stream computing engine. The stream computing engine can obtain the traffic message from the monitored Kafka queue.

[0045] Embodiment 2

[0046] Figure 2This is a flow chart of a network risk handling method provided in the second embodiment of the present invention. The technical solution of the embodiment of the present invention is further optimized on the basis of the above-mentioned optional technical solutions, and provides a specific method for identifying network risk IPs.

[0047] Optionally, the method of determining the risk IP address from the risk IP addresses to be determined based on the matching result between the prior risk IP address in the preset risk database and the risk IP address to be determined, and based on the information of the preset position of the traffic message, includes: determining the IP address in the risk IP addresses to be determined that meets the proxy service matching rule in the preset risk database as the first risk IP address, wherein the preset risk database also includes the proxy service matching rule; determining the IP address in the risk IP addresses to be determined that is consistent with the prior risk IP address in the preset risk database as the second risk IP address; determining the target traffic message from multiple traffic messages within a preset time length, and determining the risk IP address to be determined in the target traffic message as the third risk IP address, wherein the similarity of the information of the preset position of the target traffic message meets the first preset requirement, and the number of traffic messages meeting the first preset requirement meets the second preset requirement. The advantage of this setting is that it can use proxy service matching rules, prior risk IP addresses, and information features of traffic packets to specifically and quickly screen out risk IP addresses from those to be determined, for risk IP addresses that have been hidden by proxies, risk IP addresses that have appeared, and risk IP addresses that have been manually tampered with.

[0048] Optionally, the sending of warning information based on risky IP addresses within a preset time window includes: sending a first warning message when the number of risky IP addresses within the preset time window is greater than a first preset threshold; sending a second warning message when the number of risky IP addresses within the preset time window is greater than a second preset threshold, less than or equal to the first preset threshold, and the current moment has reached the end moment of the current preset time window. The advantage of such a setting is that the number of risky IP addresses is accumulated by setting a time window, thereby achieving reasonable sending of warning information of risky IP addresses.

[0049] Optionally, before using the preset job in the stream computing engine to obtain the risk IP address to be determined from the traffic message, it also includes: using the preset job in the Flink stream computing engine to determine the exempted traffic message from the target position of the traffic message; removing the exempted traffic message from the traffic message to obtain an updated traffic message. The advantage of this setting is that by using the Flink stream computing engine to determine the exempted traffic message, the computing resources for subsequent determination of the risk IP address are saved.

[0050] like Figure 2As shown, a network risk processing method provided by Embodiment 2 of the present invention specifically includes the following steps:

[0051] S201, capture request data, and use the request data to generate a Kafka message containing a traffic message, and send the Kafka message to the Kafka queue; by using the stream computing engine to monitor the Topic of the Kafka queue, obtain the traffic message from the Kafka queue.

[0052] S202: using a preset job in the Flink stream computing engine, determine the inspection-free traffic message from the target location of the traffic message.

[0053] S203: Remove the inspection-exempt flow message from the flow message to obtain an updated flow message.

[0054] For example, the target location of the traffic message can be a message header. The user can add specific header information "hello" through the plug-in and configure the information to the preset job, such as {"allow":"hello"}. The preset job can detect the traffic message with the header information, and the message is the exempted traffic message. The exempted traffic message can be removed from multiple traffic messages to obtain an updated traffic message.

[0055] S204. Utilize a preset job in the Flink stream computing engine to obtain the risk IP address to be determined from the target location of the traffic message, wherein the target location is determined according to the communication protocol followed by the request data.

[0056] Specifically, the locations where IP addresses may appear in the request header of the message header of the traffic message can be enumerated in advance, and the IP addresses at these locations can be obtained by using the preset job in the Flink stream computing engine. These addresses are the risk IP addresses to be determined.

[0057] S205: Determine, among the risky IP addresses to be determined, an IP address that meets the proxy service matching rule in the preset risk database as a first risky IP address, wherein the preset risk database also includes the proxy service matching rule.

[0058] Specifically, for risky IP addresses hidden by proxies, matching rules for proxy service addresses can be configured in advance in a preset risk database, and the rules can be similar to regular matching rules. Then, it is determined whether there are any risky IP addresses to be determined that meet the proxy service matching rules. If so, the risky IP addresses to be determined that meet the rules are determined as the first risky IP addresses.

[0059] S206: Determine, among the risk IP addresses to be determined, an IP address that is consistent with a priori risk IP address in the preset risk database as a second risk IP address.

[0060] S207. Determine a target traffic message from multiple traffic messages within a preset time length, and determine the to-be-determined risk IP address in the target traffic message as a third risk IP address, wherein the similarity of information at a preset position of the target traffic message meets a first preset requirement, and the number of traffic messages meeting the first preset requirement meets a second preset requirement.

[0061] Specifically, for manually tampered risk IP addresses, traffic packets in which risk IP addresses are not detected can be temporarily stored, that is, packets in traffic packets except for the first risk IP address and the second risk IP address. Whenever a preset time length is accumulated, or whenever a preset number of traffic packets are accumulated, the characteristics of the information at the preset positions of these accumulated traffic packets can be analyzed. If the similarity of the information at the preset positions of these packets meets the first preset requirement, such as the similarity is greater than the first set value, and the number of traffic packets that meet the first preset requirement meets the second preset requirement, such as the number is greater than the second set value, these packets can be determined as target traffic packets. The to-be-determined risk IP address in the target traffic packet can be determined as the third risk IP address.

[0062] Optionally, the similarity of the information at the preset position of the target traffic message satisfies the first preset requirement, including: at least one of the similarity of agent information contained in the information at the preset position of the target traffic message, the similarity of timestamps, and the similarity of parameter structures satisfies the first preset requirement.

[0063] Exemplarily, the similarity of information in the request header of the target traffic message satisfies the first preset requirement, including: at least one of the similarity of agent information contained in the request header of the target traffic message, the similarity of timestamps, and the similarity of parameter structure in the request header is greater than a first set value.

[0064] S208. When the number of risky IP addresses within the preset time window is greater than the first preset threshold, a first alarm message is sent; when the number of risky IP addresses within the preset time window is greater than the second preset threshold, less than or equal to the first preset threshold, and the current time has reached the end time of the current preset time window, a second alarm message is sent.

[0065] Specifically, a time window can be preset in advance, such as a time window at the level of seconds, minutes, hours or days. The current time window can be determined first, and the number of risky IP addresses determined in the current time window can be counted, and the count is increased by one for each additional risky IP address. When the count is greater than 5, that is, greater than the first preset threshold, a first alarm message can be sent. When the count is less than or equal to 5, but greater than zero, that is, greater than the second preset threshold, and the current moment has reached the end time of the current time window, a second alarm message can be sent. Among them, the alarm message can be a kafka message, and the kafka can be sent to the kafka queue, and then the alarm service that monitors the kafka queue can be used to send the prompt message generated according to the alarm message to the client through a preset method (such as sending an email, etc.).

[0066] The network risk processing method provided by the embodiment of the present invention uses the Flink stream computing engine to determine the exempted traffic messages, thereby saving computing resources for subsequently determining the risky IP addresses. The method also uses the proxy service matching rules, the prior risky IP addresses, and the information characteristics of the traffic messages to specifically and quickly screen out the risky IP addresses from the risky IP addresses to be determined. Finally, the number of risky IP addresses is accumulated by setting a time window, thereby realizing the reasonable issuance of early warning information of risky IP addresses.

[0067] Embodiment 3

[0068] Figure 3 This is a schematic diagram of the structure of a network risk processing device provided by Embodiment 3 of the present invention. Figure 3 As shown, the device includes: a flow message generation module 301, a to-be-determined risk address acquisition module 302, a risk address determination module 303 and an alarm information sending module 304, wherein:

[0069] A flow message generation module, used to capture request data and generate flow messages according to the request data;

[0070] A module for obtaining risky addresses to be determined, used to obtain risky IP addresses to be determined from the traffic message by using a preset job in the stream computing engine;

[0071] A risky address determination module, configured to determine a risky IP address from the risky IP addresses to be determined according to a matching result between a priori risky IP address in a preset risk database and the risky IP address to be determined, and according to information of a preset location of the traffic message;

[0072] The alarm information sending module is used to send alarm information based on risky IP addresses within a preset time window.

[0073] The network risk processing device provided by the embodiment of the present invention uses the powerful computing power of the stream computing engine to provide support for the analysis of massive network request data. Through pre-configured jobs, it is possible to obtain IP addresses suspected of being at risk from numerous traffic messages, and then accurately determine the risky IP addresses from the suspected risky IP addresses based on the pre-configured risk database and information in the traffic messages, and alert the user by sending an alarm message. This device can quickly and accurately determine whether the received request comes from a malicious attacker from a massive number of requests, and assist users in determining whether they have been attacked by the network.

[0074] Optionally, the risk address determination module includes:

[0075] A first risk address determination unit, configured to determine, among the risk IP addresses to be determined, an IP address that meets a proxy service matching rule in a preset risk database as a first risk IP address, wherein the preset risk database also includes the proxy service matching rule;

[0076] A second risk address determination unit, configured to determine, among the risk IP addresses to be determined, an IP address that is consistent with a priori risk IP address in the preset risk database as a second risk IP address;

[0077] The third risk address determination unit is used to determine a target traffic message from multiple traffic messages within a preset time length, and determine the to-be-determined risk IP address in the target traffic message as a third risk IP address, wherein the similarity of the information at the preset position of the target traffic message meets the first preset requirement, and the number of traffic messages that meet the first preset requirement meets the second preset requirement.

[0078] Furthermore, the similarity of the information of the preset position of the target traffic message satisfies the first preset requirement, including: at least one of the similarity of the agent information contained in the information of the preset position of the target traffic message, the similarity of the timestamp, and the similarity of the parameter structure satisfies the first preset requirement.

[0079] Optionally, the module for obtaining the risk address to be determined is specifically used to obtain the risk IP address to be determined from the target location of the traffic message by using a preset job in the Flink stream computing engine, wherein the target location is determined according to the communication protocol followed by the request data.

[0080] Optionally, the alarm information sending module includes:

[0081] A first alarm information sending unit, configured to send a first alarm information when the number of risky IP addresses within a preset time window is greater than a first preset threshold;

[0082] The second alarm information sending unit is used to send the second alarm information when the number of risky IP addresses in the preset time window is greater than the second preset threshold, less than or equal to the first preset threshold, and the current time has reached the end time of the current preset time window.

[0083] Optionally, the traffic message generation module includes:

[0084] A message sending unit is used to generate a Kafka message containing a traffic message using the request data, and send the Kafka message to a Kafka queue.

[0085] Optionally, the device further comprises:

[0086] The flow message acquisition module is used to acquire the flow message from the Kafka queue by using the stream computing engine to monitor the Topic of the Kafka queue after the flow message is generated according to the request data.

[0087] Optionally, the device further comprises:

[0088] An inspection-free message determination module, used to determine the inspection-free flow message from the target location of the flow message by using the preset job in the Flink flow computing engine before obtaining the risk IP address to be determined from the flow message by using the preset job in the flow computing engine;

[0089] The updating module is used to remove the inspection-free flow message from the flow message to obtain an updated flow message.

[0090] The network risk processing device provided in the embodiment of the present invention can execute the network risk processing method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0091] Embodiment 4

[0092] Figure 4 A schematic diagram of the structure of an electronic device 40 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0093] like Figure 4As shown, the electronic device 40 includes at least one processor 41, and a memory connected to the at least one processor 41, such as a read-only memory (ROM) 42, a random access memory (RAM) 43, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 41 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 42 or the computer program loaded from the storage unit 48 to the random access memory (RAM) 43. In the RAM 43, various programs and data required for the operation of the electronic device 40 can also be stored. The processor 41, the ROM 42, and the RAM 43 are connected to each other through a bus 44. An input / output (I / O) interface 45 is also connected to the bus 44.

[0094] A number of components in the electronic device 40 are connected to the I / O interface 45, including: an input unit 46, such as a keyboard, a mouse, etc.; an output unit 47, such as various types of displays, speakers, etc.; a storage unit 48, such as a disk, an optical disk, etc.; and a communication unit 49, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 49 allows the electronic device 40 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0095] The processor 41 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 41 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 41 performs the various methods and processes described above, such as a network risk processing method.

[0096] In some embodiments, the network risk handling method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 48. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 40 via the ROM 42 and / or the communication unit 49. When the computer program is loaded into the RAM 43 and executed by the processor 41, one or more steps of the network risk handling method described above may be performed. Alternatively, in other embodiments, the processor 41 may be configured to execute the network risk handling method in any other appropriate manner (e.g., by means of firmware).

[0097] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0098] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0099] The computer device provided above can be used to execute the network risk handling method provided in any of the above embodiments, and has corresponding functions and beneficial effects.

[0100] Embodiment 5

[0101] In the context of the present invention, a computer-readable storage medium may be a tangible medium, wherein the computer-executable instructions, when executed by a computer processor, are used to perform a network risk processing method, the method comprising:

[0102] Capture request data, and generate traffic packets according to the request data;

[0103] Using a preset job in the stream computing engine, obtain the risky IP address to be determined from the traffic message;

[0104] Determine the risk IP address from the risk IP addresses to be determined according to the matching result between the prior risk IP address in the preset risk database and the risk IP address to be determined, and according to the information of the preset position of the traffic message;

[0105] Send alerts based on risky IP addresses within a preset time window.

[0106] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by an instruction execution system, device or equipment or used with an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0107] The computer device provided above can be used to execute the network risk handling method provided in any of the above embodiments, and has corresponding functions and beneficial effects.

[0108] It is worth noting that in the embodiment of the above-mentioned network risk handling device, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0109] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A network risk management method, characterized in that: include: Capture request data, and generate traffic packets according to the request data; Using a preset job in the stream computing engine, obtain the risky IP address to be determined from the traffic message; Determine the risk IP address from the risk IP addresses to be determined according to the matching result between the prior risk IP address in the preset risk database and the risk IP address to be determined, and according to the information of the preset position of the traffic message; Send alerts based on risky IP addresses within a preset time window.

2. The method according to claim 1, characterized in that The method of determining the risk IP address from the risk IP address to be determined according to the matching result between the prior risk IP address in the preset risk database and the risk IP address to be determined, and according to the information of the preset position of the traffic message, comprises: Determine, among the risky IP addresses to be determined, an IP address that meets the proxy service matching rule in the preset risk database as a first risky IP address, wherein the preset risk database also includes the proxy service matching rule; Determine, among the risk IP addresses to be determined, an IP address that is consistent with a priori risk IP address in the preset risk database as a second risk IP address; Determine a target traffic message from multiple traffic messages within a preset time length, and determine the to-be-determined risk IP address in the target traffic message as a third risk IP address, wherein the similarity of information at a preset position of the target traffic message meets a first preset requirement, and the number of traffic messages meeting the first preset requirement meets a second preset requirement.

3. The method according to claim 2, characterized in that The similarity of the information of the preset position of the target traffic message meets the first preset requirement, including: At least one of the similarity of agent information, the similarity of timestamps, and the similarity of parameter structures included in the information of the preset position of the target traffic message meets the first preset requirement.

4. The method according to claim 1, characterized in that: The using a preset job in the stream computing engine to obtain the risky IP address to be determined from the traffic message includes: By using a preset job in the Flink stream computing engine, the risk IP address to be determined is obtained from the target location of the traffic message, wherein the target location is determined according to the communication protocol followed by the request data.

5. The method according to claim 1, characterized in that The sending of warning information based on the risky IP address within the preset time window includes: When the number of risky IP addresses within the preset time window is greater than a first preset threshold, sending a first alarm message; When the number of risky IP addresses within the preset time window is greater than the second preset threshold, less than or equal to the first preset threshold, and the current time has reached the end time of the current preset time window, a second alarm message is sent.

6. The method according to any one of claims 1 to 5, characterized in that The generating a traffic message according to the request data includes: Generate a Kafka message containing a traffic message using the request data, and send the Kafka message to a Kafka queue; Wherein, after generating the traffic message according to the request data, the method further includes: By using the stream computing engine to monitor the Topic of the Kafka queue, traffic messages are obtained from the Kafka queue.

7. The method according to claim 1 or 4, characterized in that: Before obtaining the risky IP address to be determined from the traffic message by using the preset job in the stream computing engine, the method further includes: Using the preset job in the Flink stream computing engine, determine the inspection-free traffic message from the target location of the traffic message; The inspection-free flow message is removed from the flow message to obtain an updated flow message.

8. A network risk processing device, characterized in that: include: A flow message generation module, used to capture request data and generate flow messages according to the request data; A module for obtaining risky addresses to be determined, used to obtain risky IP addresses to be determined from the traffic message by using a preset job in the stream computing engine; A risky address determination module, configured to determine a risky IP address from the risky IP addresses to be determined according to a matching result between a priori risky IP address in a preset risk database and the risky IP address to be determined, and according to information of a preset location of the traffic message; The alarm information sending module is used to send alarm information based on risky IP addresses within a preset time window.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the network risk handling method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the network risk handling method according to any one of claims 1 to 7 when executed.

Images