Network traffic detection method and device, storage medium and computer program product

Abstract

The invention discloses a network traffic detection method and device, a storage medium and a computer program product. The method comprises the following steps: determining a file restoration sample of network traffic; the first analysis agent processes the file restoration sample to obtain sensitive information in the file restoration sample; the first analysis agent generates a query statement corresponding to the external query tool according to the sensitive information; calling an external query tool according to the query statement, and returning a query result which is output by the external query tool and corresponds to the query statement to the first analysis agent; the first analysis agent transmits the query result and the file restoration sample to a second analysis agent; and the second analysis agent determines a detection decision corresponding to the query result so as to determine whether to perform sandbox detection on the file restoration sample according to the detection decision. According to the scheme, the probability of missing report of real illegal samples can be reduced.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and specifically to a network traffic detection method, device, storage medium and computer program product. Background Art

[0002] Traditional security equipment such as firewalls, intrusion prevention equipment, and network auditing equipment will capture and detect samples transmitted on the network. Some abnormal samples can be detected by conventional methods. However, unknown abnormal samples and APT attack samples are difficult to detect based on feature matching and heuristic detection engines, and need to be detected with the help of sandboxes. However, because traditional network devices have a fast detection speed (millisecond level) in a high-traffic network environment and a large number of restored samples, and the sandbox needs to restore the operating environment when detecting samples, stimulate the runtime behavior of malicious samples, and wait for the sample to run. The speed is slow (30 seconds to 1 minute), causing the samples restored by traditional network devices to enter the queue waiting for detection. When the number is large, the queue is backlogged, and a large number of samples to be detected cannot be detected in time and may be discarded. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a network traffic detection method, device, storage medium and computer program product to solve the technical problems of slow sandbox detection speed and sample discard in the prior art.

[0004] In order to achieve the above-mentioned object, the first aspect of the present application provides a network traffic detection method, the method comprising:

[0005] Identify file restore samples of network traffic;

[0006] The first analysis agent processes the file restoration sample to obtain sensitive information in the file restoration sample;

[0007] The first analysis agent generates a query statement corresponding to the external query tool based on the sensitive information;

[0008] Calling an external query tool according to the query statement, and returning the query result corresponding to the query statement output by the external query tool to the first analysis agent;

[0009] The first analysis agent transmits the query result and the file restoration sample to the second analysis agent;

[0010] The second analysis agent determines a detection decision corresponding to the query result to determine whether to perform sandbox detection on the file restoration sample based on the detection decision.

[0011] In an embodiment of the present application, the first analysis agent generates a query statement corresponding to an external query tool based on sensitive information, including: determining a tool type of the external query tool; determining a target format of the query statement based on the tool type; and generating a query statement corresponding to the external query tool according to the target format based on the sensitive information by the first analysis agent.

[0012] In an embodiment of the present application, the method also includes: when it is determined that there are multiple file restoration samples that need to be sandbox tested, determining the detection priority of each file restoration sample by a second analysis agent; adding each file restoration sample to a detection queue corresponding to the detection priority according to the detection priority; and performing sandbox testing on the file restoration samples in each detection queue in turn according to the detection priority.

[0013] In an embodiment of the present application, determining the detection priority of each file restoration sample through the second analysis agent includes: determining the generation time or harm degree of each file restoration sample through the second analysis agent; determining the detection priority of each file restoration sample according to the generation time or harm degree of each file restoration sample.

[0014] In an embodiment of the present application, processing a file restoration sample by a first analysis agent to obtain sensitive information in the file restoration sample includes: determining a first query statement with the first analysis agent; and determining the sensitive information in the file restoration sample according to the first query statement by the first analysis agent.

[0015] In an embodiment of the present application, the external query tool includes a threat intelligence library and / or a security knowledge library, and the query results include suspicious historical behaviors output by the security knowledge library and suspicious threat information output by the threat intelligence library.

[0016] In an embodiment of the present application, the sensitive information includes at least one of the IP address, port, file name, domain name, uniform resource identifier, and parsed suspicious string information of the file restoration sample.

[0017] A second aspect of the present application provides a network traffic detection device, comprising:

[0018] a memory configured to store instructions;

[0019] The processor is configured to call instructions from the memory and implement the above-mentioned network traffic detection method when executing the instructions.

[0020] A third aspect of the present application provides a machine-readable storage medium, on which instructions are stored, and the instructions are used to enable a machine to execute the above-mentioned network traffic detection method.

[0021] A fourth aspect of the present application provides a computer program product, which implements the above-mentioned network traffic detection method when executed by a processor.

[0022] Through the above technical solution, among the massive amount of original samples captured, samples that may be risky are prioritized for screening and entering the sandbox for testing. This can solve the problem that in the actual production environment, the security detection equipment has a fast detection speed, a large number of samples in the intercepted and restored network, and the sandbox equipment has a slow detection speed, making it difficult to match the speed between the two. This can reduce the probability of missing reports of truly illegal samples.

[0023] Other features and advantages of the embodiments of the present application will be described in detail in the subsequent specific implementation section. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the following specific implementations, they are used to explain the embodiments of the present application, but do not constitute a limitation on the embodiments of the present application. In the accompanying drawings:

[0025] Figure 1 A schematic diagram of a flow chart of a network traffic detection method according to an embodiment of the present application is schematically shown;

[0026] Figure 2 A schematic diagram of a flow chart of a network traffic detection method according to another embodiment of the present application is shown;

[0027] Figure 3 The structure block diagram of a network traffic detection device according to an embodiment of the present application is schematically shown;

[0028] Figure 4 The schematic diagram shows a structure of a computer device according to an embodiment of the present application. DETAILED DESCRIPTION

[0029] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the specific implementation methods described herein are only used to illustrate and explain the embodiments of the present application, and are not used to limit the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0030] It should be noted that if the embodiments of the present application involve directional indications (such as up, down, left, right, front, back...), the directional indications are only used to explain the relative position relationship, movement status, etc. between the components under a certain specific posture (as shown in the accompanying drawings). If the specific posture changes, the directional indication will also change accordingly.

[0031] In addition, if there are descriptions involving "first", "second", etc. in the embodiments of the present application, the descriptions of "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or suggesting their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0032] Figure 1 The flowchart of a network traffic detection method according to an embodiment of the present application is schematically shown. Figure 1 As shown, an embodiment of the present application provides a network traffic detection method, which may include the following steps.

[0033] S102, determining a file restoration sample of network traffic.

[0034] It is understandable that file restoration samples in network traffic can be collected through front-end network security devices. File restoration samples have corresponding network log information, including but not limited to HTTP protocol logs, FTP protocol logs, SMTP / ICMP mail protocol logs, etc. Front-end devices include but are not limited to firewalls, network intrusion prevention devices, traffic auditing devices, etc. Front-end devices can capture different types of file restoration samples in network traffic.

[0035] S104: The first analysis agent processes the file restoration sample to obtain sensitive information in the file restoration sample.

[0036] It can be understood that an agent refers to an agent that can perceive the environment and take actions to achieve specific goals. It can be software, hardware or a system with autonomy, adaptability and interaction capabilities. The agent perceives changes in the environment (such as through sensors or data input), makes judgments and decisions based on the knowledge and algorithms it has learned, and then performs actions to affect the environment or achieve predetermined goals. The first analysis agent is used to process the network log information corresponding to the file restoration sample and analyze the sensitive information in the network log information. Specifically, the network log information can be sorted to generate input forms that can be received by the first analysis agent, including but not limited to text form, json form, etc. Sensitive information includes but is not limited to the IP address, port, file name, domain name, uniform resource identifier and parsed suspicious string information of the file restoration sample. The first analysis agent can use a large language model as a base model for training, and fine-tune the training based on the base model to build the ability of network log analysis. For example, chatglm or Qianwen 2.5 can be selected as the base model. Specifically, the base model can be fine-tuned in the form of instruction fine-tuning or supervised fine-tuning.

[0037] S106, the first analysis agent generates a query statement corresponding to the external query tool according to the sensitive information.

[0038] S108, calling an external query tool according to the query statement, and returning the query result corresponding to the query statement output by the external query tool to the first analysis agent.

[0039] refer to Figure 2 , the ability to call tools can be designed for the first analysis agent. The external query tool includes a threat intelligence library and a security knowledge base. Among them, the threat intelligence library includes a lot of specific threat information, and the security knowledge base includes a lot of specific abnormal behavior information. The external query tool can determine the input format and output format of the calling tool through the corresponding API function, so that the first analysis agent can correctly interpret the data returned by the tool. Specifically, it can be executed according to the specified template in the form of instruction fine-tuning or supervision fine-tuning, so that the first analysis agent generates a query statement that can be received by the external query tool. After the external query tool performs a query based on the query statement and obtains the query result, it returns the query result to the first analysis agent. Among them, the query results include but are not limited to the threat intelligence database query results, the security knowledge database query results, and the generation results of the threat intelligence and security knowledge large model.

[0040] S110, the first analysis agent transmits the query result and the file restoration sample to the second analysis agent.

[0041] S112, the second analysis agent determines a detection decision corresponding to the query result to determine whether to perform sandbox detection on the file restoration sample according to the detection decision.

[0042] It can be understood that the second analysis agent is relative to the first analysis agent. The second analysis agent processes the network log information corresponding to the file restoration sample based on the query result to generate a detection decision on whether to perform sandbox detection on the file restoration sample. The second analysis agent can use a large language model as a base model for training, and fine-tune the training on the basis of the base model to form the ability to output decision information autonomously according to the input. For example, chatglm or Qianwen 2.5 can be selected as the base model. Specifically, you can write code by yourself or use a third-party library (langchain, etc.) to form an execution chain with the output of the first analysis agent and the input of the second analysis agent, and finally obtain an executable program that can realize the function. Then, the first analysis agent transmits the query results and the file restoration sample to the second analysis agent. It can be executed according to the specified template in the form of instruction fine-tuning or supervision fine-tuning, so that the second analysis agent determines the detection decision corresponding to the query result to determine whether to perform sandbox detection on the file restoration sample according to the detection decision. Specifically, the second analysis agent can be guided to make decisions by designing a thinking chain.

[0043] Through the above technical solution, among the massive amount of original samples captured, samples that may be risky are prioritized for screening and entering the sandbox for testing. This can solve the problem that in the actual production environment, the security detection equipment has a fast detection speed, a large number of samples in the intercepted and restored network, and the sandbox equipment has a slow detection speed, making it difficult to match the speed between the two. This can reduce the probability of missing reports of truly illegal samples.

[0044] In an embodiment of the present application, the first analysis agent generates a query statement corresponding to an external query tool based on sensitive information, including: determining a tool type of the external query tool; determining a target format of the query statement based on the tool type; and generating a query statement corresponding to the external query tool according to the target format based on the sensitive information by the first analysis agent.

[0045] The external query tool includes a threat intelligence library and a security knowledge base. The threat intelligence library includes a lot of specific threat information, and the security knowledge base includes a lot of specific abnormal behavior information. The external query tool can determine the input format and output format of the calling tool through the corresponding API function, and generate the external query tool according to the target format so that the first analysis agent can correctly interpret the data returned by the tool.

[0046] In an embodiment of the present application, the method also includes: when it is determined that there are multiple file restoration samples that need to be sandbox tested, determining the detection priority of each file restoration sample by a second analysis agent; adding each file restoration sample to a detection queue corresponding to the detection priority according to the detection priority; and performing sandbox testing on the file restoration samples in each detection queue in turn according to the detection priority.

[0047] It can be understood that network security equipment can capture a large number of original samples, and give priority to screening samples that may be risky to enter the sandbox for detection, and intelligently rate the priority of samples entering the sandbox. Specifically, after the second analysis agent makes a decision, if there are multiple file restoration samples that need to be sandboxed, the second analysis agent can analyze the generation time or degree of harm of each file restoration sample, and then determine the detection priority of each file restoration sample according to the generation time or degree of harm of each file restoration sample. Sandbox detection is performed on the file restoration samples in each detection queue in order of detection priority. The above scheme uses a large model agent to make coordinated decisions, and can autonomously optimize and select the most appropriate and high-priority restoration samples to enter the sandbox detection, meeting the needs of detecting obfuscated malicious samples and APT attacks.

[0048] In an embodiment of the present application, processing a file restoration sample by a first analysis agent to obtain sensitive information in the file restoration sample includes: determining a first query statement with the first analysis agent; and determining the sensitive information in the file restoration sample according to the first query statement by the first analysis agent.

[0049] Specifically, a suitable prompt (a first query statement input to the first analysis agent) is established and transmitted to the first analysis agent. The first analysis agent first analyzes the network transmission log of the original sample and searches for suspicious sensitive information in the log that needs further inspection, including but not limited to IP, domain name, URI, suspicious character string, etc. According to the type of external query tool, a query statement is generated and transmitted to the corresponding tool.

[0050] In an embodiment of the present application, the second analysis agent may also establish a suitable prompt (a second query statement input to the second analysis agent), transmit the prompt to the second analysis agent, generate an answer, and take action based on the answer result, including but not limited to loading a sandbox detection module to detect the sample, or deleting the sample to be detected and the original log corresponding to the sample in the queue to be detected.

[0051] In an embodiment of the present application, the external query tool includes a threat intelligence library and / or a security knowledge library, and the query results include suspicious historical behaviors output by the security knowledge library and suspicious threat information output by the threat intelligence library.

[0052] In an embodiment of the present application, the sensitive information includes at least one of the IP address, port, file name, domain name, uniform resource identifier, and parsed suspicious string information of the file restoration sample.

[0053] refer to Figure 2 A specific embodiment of the present application provides a network traffic detection method, which uses AI-agent to make decisions. Among the massive original samples captured by the network security device, samples that may be risky are preferentially screened to enter the sandbox for detection, and the priority of samples entering the sandbox is intelligently rated. The specific steps are as follows.

[0054] Step 1: Collect network log information corresponding to the file restoration sample, including but not limited to HTTP protocol logs, FTP protocol logs, SMTP / ICMP mail protocol logs, etc.

[0055] Taking HTTP protocol log as an example, a sample restoration log needs to contain the following fields: time, protocol, source address and source port, request header, request body, response header and response body. Specifically, the time is the specific time when the sample is captured; the protocol is the sample transmission protocol (HTTP / TCP); the source address and source port are IPv4 or IPv6 addresses and ports; the destination address and destination port are IPv4 or IPv6 addresses and ports; the request header includes fields such as request method (Get, Post, Put, etc.), uri, cookie, referer, etc.; the request body is usually the request content carried by the post or put method, and the response header and response body are the response data returned after the HTTP protocol request is sent to the server.

[0056] Step 2: Construct the first analysis agent and the second analysis agent. You can choose the commonly used chatglm or Qianwen 2.5 as the base model.

[0057] Sub-step 2.1: Construct the "thinking" ability of the first and second analytical agents. By manually preparing training data templates, provide the base model with sufficient fine-tuning training data to form correct analysis and decision-making capabilities.

[0058] Training data template for the first analysis agent: {'system': 'The first analysis agent extracts sensitive information from the input log', 'src_log': ['http_log_sample', 'ftp_log_sample', 'smtp_log_sample'], 'query': 'Please extract the sensitive information that should be further paid attention to', 'answer': 'data_string1', 'data_string2', 'data_string3'…]}.

[0059] Training data template for the second analysis agent: {'system': 'The second analysis agent is used to decide whether the restored sample should enter the sandbox detection', 'src_log': 'Analysis_LLM_log1', 'Analysis_LLM_log2', ..., 'query': 'Please give a decision on whether the sample should undergo deep detection and give a priority', 'decision_result': 'Yes / No', 'severity_level': 'A / B / C'.

[0060] Based on the above training template, the base model can be fine-tuned by supervised fine-tuning (SFT) or manual instruction fine-tuning so that the corresponding intelligent agent meets the usage requirements.

[0061] Sub-step 2.2: Build the “action” capabilities of analytical agents and decision-making agents.

[0062] In the embodiment of the present application, the external query tools that the first analysis agent can use are preset as the security knowledge big model and the threat intelligence big model. The following query template is designed: {'system': 'The first analysis agent calls the security knowledge big model (threat intelligence big model) input interface', 'query': "Please search the threat intelligence and security knowledge base to check", "parameters[0]", "parameters[1]" ... whether there is any suspicious historical behavior', 'parameters': [data_string1, data_string2 ...]}.

[0063] In the embodiment of the present application, the second analysis agent can output the function and related parameters of calling the sandbox product, and the following action output template is designed: {'system': 'The second analysis agent calls the sandbox product to run the script', 'file_path': '[path1, path2...]', 'script_name': 'start_sandbox_scan.py', 'parameters': 'params'}.

[0064] According to the output of the second analysis agent, an action {'action':"pythonstart_sandbox_scan.py--parameters path1, path2..."} can be generated to call the sandbox product. Ensure that the second analysis agent outputs according to the above action template by means of supervised fine-tuning or instruction fine-tuning.

[0065] Sub-step 2.3: In order to form an action chain involving large model agents, you can write your own code or use existing third-party libraries (such as langchain) to form a complete agent action chain. Through code execution, the original log and query are input into the first analysis agent to obtain the answer field of the first analysis agent. Through sub-step 2.2, the external query tool is called to receive the returned query results after retrieval. Through the code, the output of the first analysis agent is used as the input of the second analysis agent, and the output of the second analysis agent is received, and the detection results of the sandbox are received at the same time.

[0066] Step 3: The input of the first analysis agent is the original sample transmission log generated in step 1, and the output is the sensitive information that needs to be focused on after analysis by the first analysis agent, including but not limited to IP, port, file name, and suspicious string information after analysis.

[0067] Sub-step 3.1: Convert the network log data in step 1 into an input format that can be received by the first analysis agent, such as JSON format.

[0068] Example: The network transmission log of the original sample obtained in step 1 is converted into the JSON format as follows, {'source address': '1.2.3.4', 'source port': '56015', 'destination address': '5.6.7.8', 'destination port': '80', 'request header': 'GET / client / autoupdate / Ran-Som-Ware.exe HTTP / 1.1', 'response header': 'HTTP / 1.1 200OK\r\nServer: Tengine\r\nContent-Type: application / x-msdownload\r\nContent-Length: 165104\r\nConnection: keep-alive\r\nDate: Thu, 19Sep 2024 01:08:07GMT\r\nx-oss-request-id::66EB79775587F731383D3F05'}.

[0069] Sub-step 3.2: Create a suitable prompt (referring to the first query statement input to the first analysis agent), transmit the prompt to the first analysis agent, and the first analysis agent first analyzes the network transmission log of the original sample, and generates suspicious sensitive information in the log that needs further inspection, including but not limited to IP, domain name string, suspicious string, etc. According to the types of existing external tools, generate query statements transmitted to the corresponding tools. External tools available for use and query include but are not limited to: threat intelligence library (threat intelligence big model), security knowledge base (security knowledge big model), etc.

[0070] prompt example:

[0071] query="Please analyze the log, extract the data information that you should pay attention to, and generate it in the form of a string list."

[0072] The first analysis agent receives the above query and generates an answer.

[0073] Example answer:

[0074] answer=['1.2.3.4','5.6.7.8',' / client / autoupdate','Ran-Som-Ware.exe','66EB79775587F731383D3F05'].

[0075] Step 4: The first analysis agent selects the correct action based on the sensitive information that needs further verification generated in step 3. Based on the available external tools (threat intelligence big model / library, security knowledge big model / library, etc.), it generates the specific input or database query statement required to call the external tool.

[0076] Example: If the external tools are threat intelligence big model and security knowledge big model, the generated prompt is:

[0077] query1 = {'tool': "Threat Intelligence Big Model", 'conversation': "Please retrieve threat intelligence historical data to see whether IP 1.2.3.4 and IP 5.6.7.8 have suspicious historical behaviors"}.

[0078] query2 = {"tool": "Security Knowledge Big Model", 'conversation': "Please search the following strings in the security knowledge base, ' / client / autoupdate', 'Co-balt-Str-ike.exe', '66EB79775587F731383D3F05', to see if there is the same or similar suspicious threat information"}.

[0079] The first analysis agent receives query results returned by external tools, including but not limited to threat intelligence database query results, security knowledge database query results, and threat intelligence and security knowledge big model generation results.

[0080] Example: answer1 = {'tool': "Threat Intelligence Big Model", 'conversation': "No suspicious historical behavior was found for IP 1.2.3.4 and IP 5.6.7.8"}.

[0081] answer2 = {'tool': "Security Knowledge Big Model", 'conversation': "The string Ran-Som-Ware.exe in the log URI is removed - followed by ransomware, which is the English name of ransomware and is suspected to be an executable (exe) file"}.

[0082] Step 5: Use the second analysis agent built in step 2 to collect and finally decide whether the restored samples after the above steps should enter the sandbox for further inspection.

[0083] Sub-step 5.1: Design appropriate prompts to form inputs for the second analytical agent based on the data in step 4. The second analytical agent can be guided to make decisions by designing a thinking chain.

[0084] Example: query = {'tool': "Second analysis agent", 'conversation': "The string Ran-Som-Ware.exe in the log URI is removed - followed by ransomware, which is the English name of ransomware and is suspected to be an executable (exe) file. Please determine whether the restored sample should be further detected by the sandbox and take appropriate actions"}.

[0085] Sub-step 5.2: The second analysis agent receives the query of sub-step 5.1, generates an answer, and takes action based on the answer, including but not limited to loading a sandbox detection module to detect the sample, or deleting the sample to be detected and the original log corresponding to the sample in the queue to be detected.

[0086] Example: answer = {'tool': "Second analysis agent", 'conversation': "This sample should be further tested after entering the sandbox because it may be suspected to be ransomware and has a PE executable format.", 'action': "python start_sandbox_scan.py –pfilepath_to_sample"}.

[0087] Sub-step 5.3: If there are multiple samples to be entered into the sandbox for detection after sub-step 5.2, the second analysis agent will determine their priority based on factors including but not limited to time sequence, severity of sample harm, etc.

[0088] Example: If there are three samples A, B, and C that are respectively judged by the second analysis agent as having priority levels of "Severe-3", "Medium-2", and "Minor-1", the second analysis agent will add them to their respective queues for sandbox detection for further detection in subsequent sandboxes.

[0089] answer1 = {'tool': 'Decision-making Model', 'action': "severity_list_1.append(filepath_to_C)"};

[0090] answer2 = {'tool': 'Decision-making Model', 'action': "severity_list_2.append(filepath_to_B)"};

[0091] answer3 = {'tool': 'Decision-making Model', 'action': 'severity_list_3.append(filepath_to_A)'}.

[0092] The above technical solution can solve the problem that in the actual production environment, the security detection equipment has a fast detection speed and intercepts a large number of samples in the restored network, while the sandbox equipment has a slow detection speed, and it is difficult to match the speed between the two. Using a large model intelligent agent for coordinated decision-making, it can autonomously optimize and select the most appropriate and high-priority restored samples to enter the sandbox detection, meeting the needs of detecting obfuscated malicious samples and APT attacks.

[0093] Figure 1 FIG. 1 is a flow chart of a network traffic detection method in one embodiment. It should be understood that although Figure 1 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 1 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0094] Figure 3 The structure block diagram of a network traffic detection device according to an embodiment of the present application is schematically shown. Figure 2 As shown, the embodiment of the present application provides a network traffic detection device, which may include:

[0095] a memory configured to store instructions;

[0096] The processor is configured to call instructions from the memory and implement the above-mentioned network traffic detection method when executing the instructions.

[0097] Specifically, in the embodiment of the present application, the processor may be configured to:

[0098] Identify file restore samples of network traffic;

[0099] The first analysis agent processes the file restoration sample to obtain sensitive information in the file restoration sample;

[0100] The first analysis agent generates a query statement corresponding to the external query tool based on the sensitive information;

[0101] Calling an external query tool according to the query statement, and returning the query result corresponding to the query statement output by the external query tool to the first analysis agent;

[0102] The first analysis agent transmits the query result and the file restoration sample to the second analysis agent;

[0103] The second analysis agent determines a detection decision corresponding to the query result to determine whether to perform sandbox detection on the file restoration sample based on the detection decision.

[0104] In an embodiment of the present application, the first analysis agent generates a query statement corresponding to an external query tool based on sensitive information, including: determining a tool type of the external query tool; determining a target format of the query statement based on the tool type; and generating a query statement corresponding to the external query tool according to the target format based on the sensitive information by the first analysis agent.

[0105] In an embodiment of the present application, the method also includes: when it is determined that there are multiple file restoration samples that need to be sandbox tested, determining the detection priority of each file restoration sample by a second analysis agent; adding each file restoration sample to a detection queue corresponding to the detection priority according to the detection priority; and performing sandbox testing on the file restoration samples in each detection queue in turn according to the detection priority.

[0106] In an embodiment of the present application, determining the detection priority of each file restoration sample through the second analysis agent includes: determining the generation time or harm degree of each file restoration sample through the second analysis agent; determining the detection priority of each file restoration sample according to the generation time or harm degree of each file restoration sample.

[0107] In an embodiment of the present application, processing a file restoration sample by a first analysis agent to obtain sensitive information in the file restoration sample includes: determining a first query statement with the first analysis agent; and determining the sensitive information in the file restoration sample according to the first query statement by the first analysis agent.

[0108] In an embodiment of the present application, the external query tool includes a threat intelligence library and / or a security knowledge library, and the query results include suspicious historical behaviors output by the security knowledge library and suspicious threat information output by the threat intelligence library.

[0109] In an embodiment of the present application, the sensitive information includes at least one of the IP address, port, file name, domain name, uniform resource identifier, and parsed suspicious string information of the file restoration sample.

[0110] An embodiment of the present application also provides a machine-readable storage medium, on which instructions are stored, and the instructions are used to enable a machine to execute the above-mentioned network traffic detection method.

[0111] An embodiment of the present application also provides a computer program product, which implements the above-mentioned network traffic detection method when executed by a processor.

[0112] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 4 As shown. The computer device includes a processor A01, a network interface A02, a memory (not shown in the figure) and a database (not shown in the figure) connected through a system bus. Among them, the processor A01 of the computer device is used to provide computing and control capabilities. The memory of the computer device includes an internal memory A03 and a non-volatile storage medium A04. The non-volatile storage medium A04 stores an operating system B01, a computer program B02 and a database (not shown in the figure). The internal memory A03 provides an environment for the operation of the operating system B01 and the computer program B02 in the non-volatile storage medium A04. The database of the computer device is used to store network traffic detection data. The network interface A02 of the computer device is used to communicate with an external terminal through a network connection. When the computer program B02 is executed by the processor A01, a network traffic detection method is implemented.

[0113] Those skilled in the art will understand that Figure 4 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0114] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0115] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0116] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0117] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0118] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0119] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0120] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0121] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0122] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A network traffic detection method, characterized in that: The method comprises: Identify file restore samples of network traffic; The first analysis agent processes the file restoration sample to obtain sensitive information in the file restoration sample; The first analysis agent generates a query statement corresponding to an external query tool according to the sensitive information; Calling the external query tool according to the query statement, and returning the query result corresponding to the query statement output by the external query tool to the first analysis agent; The first analysis agent transmits the query result and the file restoration sample to the second analysis agent; The second analysis agent determines a detection decision corresponding to the query result to determine whether to perform sandbox detection on the file restoration sample according to the detection decision.

2. The network traffic detection method according to claim 1, characterized in that: The first analysis agent generates a query statement corresponding to the external query tool according to the sensitive information, including: Determining a tool type of the external query tool; Determining a target format of the query statement according to the tool type; The first analysis agent generates a query statement corresponding to an external query tool according to the sensitive information and the target format.

3. The network traffic detection method according to claim 1, characterized in that: The method further comprises: When it is determined that there are multiple file restoration samples that need to be sandbox detected, the second analysis agent determines the detection priority of each file restoration sample; According to the detection priority, each file restoration sample is added to a detection queue corresponding to the detection priority; The file restoration samples in each detection queue are subjected to sandbox detection in turn according to the detection priority.

4. The network traffic detection method according to claim 3, characterized in that: The second analysis agent determines the detection priority of each file restoration sample including: The second analysis agent determines the generation time or harm level of each file restoration sample; The detection priority of each file restoration sample is determined according to the generation time or harm degree of each file restoration sample.

5. The network traffic detection method according to claim 1, characterized in that: The first analysis agent processes the file restoration sample to obtain sensitive information in the file restoration sample, including: Determining a first query statement with the first analysis agent; The first analysis agent determines sensitive information in the file restoration sample based on the first query statement.

6. The network traffic detection method according to claim 1, characterized in that: The external query tool includes a threat intelligence library and / or a security knowledge library, and the query result includes suspicious historical behaviors output by the security knowledge library and suspicious threat information output by the threat intelligence library.

7. The network traffic detection method according to claim 1, characterized in that: The sensitive information includes at least one of the IP address, port, file name, domain name, uniform resource identifier and parsed suspicious string information of the file restoration sample.

8. A network traffic detection device, characterized in that: include: a memory configured to store instructions; A processor is configured to call the instructions from the memory and implement the network traffic detection method according to any one of claims 1 to 7 when executing the instructions.

9. A machine-readable storage medium, characterized in that: The machine-readable storage medium stores instructions, which are used to enable a machine to execute the network traffic detection method according to any one of claims 1 to 7.

10. A computer program product, characterized in that When the computer program is executed by a processor, the computer program implements the network traffic detection method according to any one of claims 1 to 7.

Images