Network traffic detection method, apparatus, storage medium, and computer program product

Abstract

The application discloses a network traffic detection method and device, a storage medium and a computer program product. The method comprises the following steps: determining a file restoration sample of network traffic; a first analysis agent processes the file restoration sample to obtain sensitive information in the file restoration sample; the first analysis agent generates a query statement corresponding to an external query tool according to the sensitive information; the external query tool is called according to the query statement, and a query result corresponding to the query statement output by the external query tool is returned to the first analysis agent; the first analysis agent transmits the query result and the file restoration sample to a second analysis agent; and the second analysis agent determines a detection decision corresponding to the query result, so as to determine whether to perform sandbox detection on the file restoration sample according to the detection decision. The above scheme can reduce the probability of missing a real violation sample.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a network traffic detection method and device, a storage medium and a computer program product. BACKGROUND

[0002] Traditional security devices such as firewalls, intrusion prevention devices, network audit devices, etc. will capture transmitted samples on the network and perform detection, and some abnormal samples can be detected by conventional methods. However, unknown abnormal samples and APT attack samples are difficult to detect by feature matching and heuristic detection engine, and need to be detected by means of a sandbox. However, due to the fast detection speed (millisecond level) of traditional network devices in a large flow network environment, the number of restored samples is large, and the sandbox needs to restore the running environment when detecting the sample, trigger the runtime behavior of the malicious sample, wait for the sample to run, etc., which is slow (30 seconds-1 minute), resulting in that the samples restored by the traditional network device enter the queuing queue for detection, and a large number of samples are accumulated in the queue, and a large number of samples to be detected cannot be detected in time and may be discarded. SUMMARY

[0003] The purpose of the embodiments of the present application is to provide a network traffic detection method, device, storage medium and computer program product, to solve the technical problems of slow sandbox detection speed and sample discarding in the prior art.

[0004] In order to achieve the above-mentioned purpose, the first aspect of the present application provides a network traffic detection method, the method comprising:

[0005] determining a file restoration sample of network traffic;

[0006] a first analysis agent processes the file restoration sample to obtain sensitive information in the file restoration sample;

[0007] The first analysis agent generates a query statement corresponding to an external query tool according to the sensitive information;

[0008] According to the query statement, the external query tool is called, and the query result corresponding to the query statement output by the external query tool is returned to the first analysis agent;

[0009] The first analysis agent transmits the query result and the file restoration sample to a second analysis agent;

[0010] The second analysis agent determines a detection decision corresponding to the query result, so as to determine whether to perform sandbox detection on the file restoration sample according to the detection decision.

[0011] In the embodiments of this application, the first analytical agent generating a query statement corresponding to an external query tool based on sensitive information includes: determining the tool type of the external query tool; determining the target format of the query statement based on the tool type; and generating the query statement corresponding to the external query tool according to the target format based on the sensitive information by the first analytical agent.

[0012] In embodiments of this application, the method further includes: when it is determined that there are multiple file restoration samples that need to be sandboxed, determining the detection priority of each file restoration sample through a second analysis agent; adding each file restoration sample to a detection queue corresponding to the detection priority according to the detection priority; and performing sandboxed detection on the file restoration samples in each detection queue in sequence according to the detection priority.

[0013] In the embodiments of this application, determining the detection priority of each file restoration sample by the second analytical agent includes: determining the generation time or degree of harm of each file restoration sample by the second analytical agent; and determining the detection priority of each file restoration sample based on the generation time or degree of harm of each file restoration sample.

[0014] In embodiments of this application, processing a file restoration sample by a first analytical agent to obtain sensitive information in the file restoration sample includes: determining a first query statement for the first analytical agent; and determining the sensitive information in the file restoration sample by the first analytical agent based on the first query statement.

[0015] In the embodiments of this application, the external query tool includes a threat intelligence database and / or a security knowledge base, and the query results include suspicious historical behaviors output by the security knowledge base and suspicious threat information output by the threat intelligence database.

[0016] In embodiments of this application, sensitive information includes at least one of the following: the IP address, port, file name, domain name, Uniform Resource Identifier, and parsed suspicious string information of the file restoration sample.

[0017] A second aspect of this application provides a network traffic detection device, comprising:

[0018] The memory is configured to store instructions;

[0019] The processor is configured to retrieve instructions from memory and, when executing instructions, to implement the network traffic detection method described above.

[0020] A third aspect of this application provides a machine-readable storage medium storing instructions that cause a machine to perform the network traffic detection method described above.

[0021] The fourth aspect of the present application provides a computer program product, the computer program realizes the network traffic detection method according to the above when being executed by a processor.

[0022] Through the above technical solution, in the captured mass of original samples, the samples that may have risks are preferentially screened into the sandbox for detection, which can solve the problem that the detection speed of the security detection equipment is fast, the number of intercepted samples in the restored network is large, and the detection speed of the sandbox equipment is slow, and the speed matching between the two is difficult, and the probability of missing the real violation sample report is reduced.

[0023] Other features and advantages of the embodiments of the present application will be described in detail in the subsequent specific embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0024] The accompanying drawings are included to provide a further understanding of the embodiments of the present application, and constitute a part of the specification, and are used to explain the embodiments of the present application together with the following specific embodiments, but do not constitute a limitation on the embodiments of the present application. In the drawings:

[0025] Figure 1 The flowchart of the network traffic detection method according to the embodiments of the present application is schematically shown;

[0026] Figure 2 The flowchart of the network traffic detection method according to another embodiment of the present application is schematically shown;

[0027] Figure 3 The structural block diagram of the network traffic detection device according to the embodiments of the present application is schematically shown;

[0028] Figure 4 The structural diagram of the computer device according to the embodiments of the present application is schematically shown. DETAILED DESCRIPTION

[0029] In order to make the purpose, technical scheme and advantages of the embodiments of the present application more clear, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application, and it should be understood that the specific embodiments described here are only used to illustrate and explain the embodiments of the present application, and are not used to limit the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0030] It should be noted that if the embodiments of this application involve directional indicators (such as up, down, left, right, front, back, etc.), the directional indicators are only used to explain the relative positional relationship and movement of the components in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicators will also change accordingly.

[0031] Furthermore, if the embodiments of this application involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.

[0032] Figure 1 The illustration shows a schematic flowchart of a network traffic detection method according to an embodiment of this application. Figure 1 As shown in the figure, this application provides a network traffic detection method, which may include the following steps.

[0033] S102, determine the file restoration sample of network traffic.

[0034] It is understandable that front-end network security devices can collect file recovery samples from network traffic. These file recovery samples have corresponding network log information, including but not limited to HTTP protocol logs, FTP protocol logs, and SMTP / ICMP email protocol logs. Front-end devices include, but are not limited to, firewalls, network intrusion prevention devices, and traffic auditing devices. These devices can capture different types of file recovery samples from network traffic.

[0035] S104, the first analytical agent processes the file restoration sample to obtain sensitive information from the file restoration sample.

[0036] It can be understood that an agent refers to an agent that can perceive the environment and take actions to achieve specific goals. It can be software, hardware or a system, with autonomy, adaptability and interaction ability. The agent perceives changes in the environment (such as through sensors or data input), makes judgments and decisions according to the knowledge and algorithms learned by itself, and then performs actions to affect the environment or achieve predetermined goals. The first analysis agent is used to process the network log information corresponding to the file restore sample, and analyze the sensitive information in the network log information. Specifically, the network log information can be data-arranged to generate an input form that the first analysis agent can receive, including but not limited to text form, json form, etc. The sensitive information includes but is not limited to the IP address, port, file name, domain name, uniform resource identifier and parsed suspicious string information of the file restore sample. The first analysis agent can use a large language model as a base model for training, and fine-tune the base model to build the ability of network log analysis. For example, chatglm or Q2.5 can be selected as the base model. Specifically, the base model can be fine-tuned through instruction fine-tuning or supervised fine-tuning.

[0037] In S106, the first analysis agent generates a query statement corresponding to the external query tool according to the sensitive information.

[0038] In S108, the external query tool is called according to the query statement, and the query result corresponding to the query statement output by the external query tool is returned to the first analysis agent.

[0039] Reference Figure 2 The ability of calling tools can be designed for the first analysis agent. The external query tool includes a threat intelligence library and a security knowledge library. The threat intelligence library includes many specific threat information, and the security knowledge library includes many specific abnormal behavior information. The external query tool can determine the input format and output format of the calling tool through the corresponding API function, so that the first analysis agent can correctly interpret the data returned by the tool. Specifically, the first analysis agent can be executed according to the specified template through instruction fine-tuning or supervised fine-tuning, so that the first analysis agent generates a query statement that can be received by the external query tool. After the external query tool queries the query result according to the query statement, the query result is returned to the first analysis agent. The query result includes but is not limited to threat intelligence database query result, security knowledge database query result, and generation result of threat intelligence and security knowledge large model.

[0040] In S110, the first analysis agent transmits the query result and the file restore sample to the second analysis agent.

[0041] S112, the second analysis agent determines a detection decision corresponding to the query result, to determine whether to perform sandbox detection on the file restoration sample according to the detection decision.

[0042] It can be understood that the second analysis agent is relative to the first analysis agent. The second analysis agent processes the network log information corresponding to the file restoration sample based on the query result to generate a detection decision of whether to perform sandbox detection on the file restoration sample. The second analysis agent can use a large language model as a base model for training, and fine-tune the base model to form the ability to autonomously output decision information according to input. For example, chatglm or Q2.5 can be selected as the base model. Specifically, the output of the first analysis agent and the input of the second analysis agent can be formed into an execution chain by self-written code or third-party libraries (langchain, etc.), and an executable program capable of realizing the function is finally obtained. Then, the first analysis agent transmits the query result and the file restoration sample to the second analysis agent. The second analysis agent can be executed according to the specified template in the form of instruction fine-tuning or supervised fine-tuning, so that the second analysis agent determines a detection decision corresponding to the query result, to determine whether to perform sandbox detection on the file restoration sample according to the detection decision. Specifically, the second analysis agent can be guided to make a decision by designing a thought chain.

[0043] Through the above technical solutions, in the captured mass of original samples, the samples that may have risks are preferentially screened into the sandbox for detection, which can solve the problem that the detection speed of the security detection device is fast, the number of intercepted samples in the restored network is large, and the detection speed of the sandbox device is slow, and it is difficult to match the speed between the two, reducing the probability of missing reports of real violation samples.

[0044] In the embodiments of the present application, the first analysis agent generates a query statement corresponding to the external query tool according to the sensitive information, including: determining the tool type of the external query tool; determining the target format of the query statement according to the tool type; and generating a query statement corresponding to the external query tool according to the sensitive information in the first analysis agent according to the target format.

[0045] The external query tool includes a threat intelligence library and a security knowledge base. The threat intelligence library includes a lot of specific threat information, and the security knowledge base includes a lot of specific abnormal behavior information. The external query tool can determine the input format and output format of the calling tool through the corresponding API function, and generate the external query tool according to the target format, so that the first analysis agent can correctly interpret the data returned by the tool.

[0046] In the embodiments of the present application, the method further comprises: in the case where it is determined that multiple file restoration samples need to be subjected to sandbox detection, determining, by the second analysis agent, a detection priority of each file restoration sample; adding each file restoration sample to a detection queue corresponding to the detection priority according to the detection priority; and sequentially performing sandbox detection on the file restoration samples in each detection queue according to the detection priority.

[0047] It can be understood that the network security device can capture a large number of original samples, and preferentially screen samples that may have risks to enter the sandbox for detection, and intelligently rate the priority of the samples entering the sandbox. Specifically, after the second analysis agent makes a decision, in the case where it is determined that multiple file restoration samples need to be subjected to sandbox detection, the generation time or the degree of harm of each file restoration sample can be analyzed by the second analysis agent, and then the detection priority of each file restoration sample can be determined according to the generation time or the degree of harm of each file restoration sample. The file restoration samples in each detection queue are sequentially subjected to sandbox detection according to the order of the detection priority. The above scheme uses a large model agent to make a coordinated decision, which can autonomously optimize the selection of the most suitable and high-priority restoration samples to enter the sandbox for detection, and meet the needs of detecting obfuscated malicious samples and APT attacks.

[0048] In the embodiments of the present application, the sensitive information in the file restoration sample is obtained by processing the file restoration sample by the first analysis agent, and the processing comprises: determining a first inquiry sentence for the first analysis agent; and determining, by the first analysis agent, the sensitive information in the file restoration sample according to the first inquiry sentence.

[0049] Specifically, a suitable prompt (a first inquiry sentence input to the first analysis agent) is established, and the prompt is transmitted to the first analysis agent. The first analysis agent first analyzes the network transmission log of the original sample, and queries suspicious and further verified sensitive information in the log, including but not limited to IP, domain name, URI, suspicious string, etc. According to the types of external query tools, a query sentence is generated and transmitted to the corresponding tool.

[0050] In the embodiments of the present application, the second analysis agent can also establish a suitable prompt (a second inquiry sentence input to the second analysis agent), transmit the prompt to the second analysis agent, generate an answer, and take actions according to the answer result, including but not limited to loading a sandbox detection module to detect the sample, or deleting the sample and the original log corresponding to the sample in the detection queue.

[0051] In the embodiments of the present application, the external query tools include a threat intelligence library and / or a security knowledge base, and the query results include suspicious historical behaviors output by the security knowledge base and suspicious threat information output by the threat intelligence library.

[0052] In an embodiment of the present application, the sensitive information includes at least one of the IP address, port, file name, domain name, uniform resource identifier, and parsed suspicious string information of the file restoration sample.

[0053] Reference Figure 2 In an embodiment of the present application, a network traffic detection method is provided, which uses an AI-agent to make decisions. In the massive original samples captured by a network security device, samples that may have risks are preferentially screened to enter a sandbox for detection, and the priority of the samples entering the sandbox is intelligently rated. The specific steps are as follows.

[0054] Step 1: Collect network log information corresponding to the file restoration sample, including but not limited to HTTP protocol log, FTP protocol log, SMTP / ICMP mail protocol log, etc.

[0055] Taking the HTTP protocol log as an example, a sample restoration log needs to include the following fields: time, protocol, source address and source port, request header, request body, response header, and response body. Specifically, the time is the specific time when the sample is captured; the protocol is the sample transmission protocol (HTTP / TCP); the source address and the source port are IPv4 or IPv6 address and port; the destination address and the destination port are IPv4 or IPv6 address and port; the request header includes the request method (Get, Post, Put, etc.), uri, cookie, referer, etc. fields; the request body is usually the request content carried by the post or put method, and the response header and the response body are the response data returned after the HTTP protocol request to the server.

[0056] Step 2: Construct a first analysis agent and a second analysis agent, which can select commonly used chatglm or Qianwen 2.5 as a base model.

[0057] Sub-step 2.1: Build the “thinking” ability of the first analysis agent and the second analysis agent. Prepare training data templates manually to provide sufficient fine-tuning training data for the base large model to form correct analysis and decision-making capabilities.

[0058] The training data template of the first analysis agent: {‘system’: ‘The first analysis agent extracts sensitive information from the input log’, ‘src_log’: [’http_log_sample’, ‘ftp_log_sample’, ‘smtp_log_sample’], ‘query’: ‘Please extract the sensitive information that should be further focused on’, ‘answer’: ‘data_string1’, ‘data_string2’, ‘data_string3’……}.

[0059] The training data template of the second analysis agent: {‘system’: ‘The second analysis agent uses to determine whether the restored sample should enter sandbox detection’, ‘src_log’: ‘Analysis_LLM_log1’, ‘Analysis_LLM_log2’, …, ‘query’: ‘Please give the decision of whether the sample should be subjected to deep detection, and give the priority’, ‘decision_result’: ‘Yes / No’, ‘severity_level’: ‘A / B / C’.

[0060] Based on the above training template, the base model can be supervised fine-tuned (SFT) or manually instructed fine-tuned so as to make the corresponding agent meet the use requirements.

[0061] Sub-step 2.2: Build the analysis agent and the decision agent “action” capability.

[0062] In the embodiments of the present application, the external query tools that the first analysis agent can use are preset to be the security knowledge large model and the threat intelligence large model. The following query template is designed: {‘system’: ‘The first analysis agent calls the security knowledge large model (threat intelligence large model) input interface’, ‘query’: “Please search the threat intelligence and security knowledge base to see whether “parameters[0]”, “parameters[1]”…… have suspicious historical behaviors”, ‘parameters’: [data_string1, data_string2……]}.

[0063] In the embodiments of the present application, the second analysis agent can output the function of calling the sandbox product and the related parameters, and the following action output template is designed: {‘system’: ‘The second analysis agent calls the sandbox product to run the script’, ‘file_path’: ‘[path1, path2……]’, ‘script_name’: ‘start_sandbox_scan.py’, ‘parameters’: ‘params’}.

[0064] According to the output of the second analysis agent, the action of calling the sandbox product {‘action’: “python start_sandbox_scan.py–parameters path1, path2……”} can be formed. The second analysis agent is ensured to output according to the above action template through supervised fine-tuning or instruction fine-tuning.

[0065] Sub-step 2.3: In order to constitute the action chain of the large model agent, the code can be written by itself or the existing third-party library (such as langchain) can be used to constitute the complete agent action chain. Through code execution, the original log and query are input into the first analysis agent to obtain the answer field of the first analysis agent. The external query tool is called through sub-step 2.2 to receive the returned query result after retrieval. The output of the first analysis agent is input into the second analysis agent through the code, and the output of the second analysis agent is received, and the detection result of the sandbox is received.

[0066] Step 3: The input of the first analysis agent is the original sample transmission log generated in step 1, and the output is sensitive information that needs to be focused on after analysis by the first analysis agent, including but not limited to IP, port, file name, and suspicious string information after analysis.

[0067] Sub-step 3.1: The network log data of step 1 can be input into the first analysis agent in the form of, for example, json.

[0068] Example: The original sample network transmission log obtained in step 1 is converted to json as follows, {‘source address’:‘1.2.3.4’,‘source port’:‘56015’,‘destination address’:‘5.6.7.8’,‘destination port’:‘80’,‘request header’:‘GET / client / autoupdate / Ran-Som-Ware.exe HTTP / 1.1’,‘response header’:‘HTTP / 1.1 200OK\r\nServer:Tengine\r\nContent-Type:application / x-msdownload\r\nContent-Length:165104\r\nConnection:keep-alive\r\nDate:Thu,19Sep 2024 01:08:07GMT\r\nx-oss-request-id::66EB79775587F731383D3F05”}。

[0069] Sub-step 3.2: A suitable prompt (i.e. the first inquiry statement input into the first analysis agent) is established, and the prompt is transmitted to the first analysis agent. The first analysis agent analyzes the original sample network transmission log to generate sensitive information that is suspicious and needs further verification, including but not limited to IP, domain name string, suspicious string, etc. According to the existing types of external tools, a query statement is generated for transmission to the corresponding tool. The external tools that can be used and queried include but are not limited to threat intelligence library (threat intelligence large model), security knowledge base (security knowledge large model), etc.

[0070] Example of a prompt:

[0071] query = "Please analyze this log, extract the data information that should be of interest, and generate it as a list of strings".

[0072] The first analytical agent receives the above query and generates an answer.

[0073] Example answer:

[0074] answer=['1.2.3.4','5.6.7.8',' / client / autoupdate','Ran-Som-Ware.exe','66EB79775587F731383D3F05'].

[0075] Step 4: Based on the sensitive information requiring further verification generated in Step 3, the first analytical agent selects the correct action. It generates the specific inputs or database query statements needed to invoke these external tools, based on available external tools (threat intelligence models / libraries, security knowledge models / libraries, etc.).

[0076] Example: If the external tools are a threat intelligence model and a security knowledge model, the generated prompt will be:

[0077] query1 = {'tool': "Threat Intelligence Big Model", 'conversation': "Please retrieve historical threat intelligence data to see if IPs 1.2.3.4 and 5.6.7.8 have suspicious historical behavior"}.

[0078] query2 = {"tool": "Security Knowledge Model", 'conversation": "Please search the following strings in the security knowledge base: ' / client / autoupdate', 'Co-balt-Str-ike.exe', '66EB79775587F731383D3F05', and check if there is any identical or similar suspicious threat information"}.

[0079] The first analytical agent receives query results returned by external tools, including but not limited to query results from threat intelligence databases, security knowledge databases, and large-scale threat intelligence and security knowledge models.

[0080] Example: answer1 = {'tool': "Threat Intelligence Big Model", 'conversation': "No suspicious historical behavior found in IP 1.2.3.4 and IP 5.6.7.8"}.

[0081] answer2={‘tool’:“security knowledge large model”,‘conversation’:“The string Ran-Som-Ware.exe in the log URI is removed, followed by ransomware, which is the English name of ransomware, and is suspected to be an executable (exe) file.”}.

[0082] Step 5: Use the second analysis agent constructed in step 2 to collect and finally decide whether the restored sample after the above steps should enter the sandbox for further detection.

[0083] Sub-step 5.1: Design a suitable prompt based on the data in step 4 to form the input provided to the second analysis agent. The second analysis agent can be guided to make decisions through the design of a thought chain.

[0084] Example: query={‘tool’:“second analysis agent”,‘conversation’:“The string Ran-Som-Ware.exe in the log URI is removed, followed by ransomware, which is the English name of ransomware, and is suspected to be an executable (exe) file. Please determine whether this restored sample should be further detected by the sandbox and take appropriate action.”}.

[0085] Sub-step 5.2: The second analysis agent receives the query in sub-step 5.1, generates an answer (answer), and takes action (action) based on the answer result, including but not limited to loading a sandbox detection module to detect the sample, or deleting the sample and the original log corresponding to the sample in the detection queue.

[0086] Example: answer={‘tool’:“second analysis agent”,‘conversation’:“The sample should be further detected by the sandbox because it may be a suspected ransomware and has PE executable format.”,‘action’:“python start_sandbox_scan.py–pfilepath_to_sample”}.

[0087] Sub-step 5.3: If there are multiple samples to be detected by the sandbox after sub-step 5.2, the second analysis agent determines their priority based on factors including but not limited to time sequence, sample danger severity, etc.

[0088] Example: If there are 3 samples A, B, C respectively determined by the second analysis intelligent agent as priority "serious-3", "moderate-2", "mild-1", they are added to the respective sandbox detection queue by the second analysis intelligent agent for further detection by the subsequent sandbox.

[0089] answer1 = { 'tool' : 'decision large model', 'action' : "severity_list_1.append(filepath_to_C)"};

[0090] answer2 = { 'tool' : 'decision large model', 'action' : "severity_list_2.append(filepath_to_B)"};

[0091] answer3 = { 'tool' : 'decision large model', 'action' : "severity_list_3.append(filepath_to_A)"}.

[0092] Through the above technical solutions, the problem that the detection speed of the security detection device is fast, the number of intercepted samples in the network is large, and the detection speed of the sandbox device is slow, and it is difficult to match the speed between the two, can be solved. Using a large model intelligent agent to make coordinated decisions can autonomously optimize the selection of the most suitable and high-priority restored samples to enter the sandbox detection, meeting the needs of detecting obfuscated malicious samples and APT attacks.

[0093] Figure 1 A flowchart of a network traffic detection method in one embodiment. It should be understood that although the steps in the flowchart are shown in a certain order according to the direction of the arrows, these steps are not necessarily executed in the order of the arrows. Unless otherwise specified herein, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, Figure 1 At least part of the steps in the flowchart can include multiple sub-steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or sub-steps or stages of other steps. Figure 1

[0094] Figure 3 An illustrative structural block diagram of a network traffic detection device according to an embodiment of the present application is shown. As shown in Figure 2 The present application provides a network traffic detection device, which can include: ​

[0095] a memory configured to store instructions;

[0096] a processor configured to invoke the instructions from the memory and implement the network traffic detection method as described above when executing the instructions.

[0097] Specifically, in the embodiments of the present application, the processor can be configured to:

[0098] determine a file restore sample of the network traffic;

[0099] the first analysis agent processes the file restore sample to obtain sensitive information in the file restore sample;

[0100] the first analysis agent generates a query statement corresponding to the external query tool according to the sensitive information;

[0101] the external query tool is invoked according to the query statement, and a query result corresponding to the query statement output by the external query tool is returned to the first analysis agent;

[0102] the first analysis agent transmits the query result and the file restore sample to the second analysis agent;

[0103] the second analysis agent determines a detection decision corresponding to the query result to determine whether to perform sandbox detection on the file restore sample according to the detection decision.

[0104] In the embodiments of the present application, the first analysis agent generates a query statement corresponding to the external query tool according to the sensitive information, which includes: determining a tool type of the external query tool; determining a target format of the query statement according to the tool type; and generating the query statement corresponding to the external query tool according to the sensitive information in the target format through the first analysis agent.

[0105] In the embodiments of the present application, the method further includes: in the case that the file restore sample that needs to be subjected to sandbox detection is multiple, determining a detection priority of each file restore sample through the second analysis agent; adding each file restore sample to a detection queue corresponding to the detection priority according to the detection priority; and performing sandbox detection on the file restore sample in each detection queue in turn according to the detection priority.

[0106] In the embodiments of the present application, the second analysis agent determines the detection priority of each file restore sample, which includes: determining a generation time or a harm degree of each file restore sample through the second analysis agent; and determining the detection priority of each file restore sample according to the generation time or the harm degree of each file restore sample.

[0107] In the embodiments of the present application, the processing of the file restoration sample by the first analysis intelligent agent to obtain sensitive information in the file restoration sample comprises: determining a first inquiry sentence of the first analysis intelligent agent; and determining, by the first analysis intelligent agent, the sensitive information in the file restoration sample according to the first inquiry sentence.

[0108] In the embodiments of the present application, the external query tool comprises a threat intelligence library and / or a security knowledge base, and the query result comprises suspicious historical behaviors output by the security knowledge base and suspicious threat information output by the threat intelligence library.

[0109] In the embodiments of the present application, the sensitive information comprises at least one of an IP address, a port, a file name, a domain name, a uniform resource identifier and parsed suspicious string information of the file restoration sample.

[0110] The embodiments of the present application also provide a machine readable storage medium, which stores instructions for causing a machine to execute the network traffic detection method.

[0111] The embodiments of the present application also provide a computer program product, which, when executed by a processor, implements the network traffic detection method.

[0112] In one embodiment, a computer device, which can be a server, is provided, and an internal structure diagram of the computer device can be as shown in FIG. Figure 4 The computer device comprises a processor A01, a network interface A02, a memory (not shown in the figure) and a database (not shown in the figure) connected through a system bus. The processor A01 of the computer device is configured to provide computing and control capabilities. The memory of the computer device comprises an internal memory A03 and a non-volatile storage medium A04. The non-volatile storage medium A04 stores an operating system B01, a computer program B02 and a database (not shown in the figure). The internal memory A03 provides an environment for the operating system B01 and the computer program B02 in the non-volatile storage medium A04. The database of the computer device is configured to store network traffic detection data. The network interface A02 of the computer device is configured to communicate with an external terminal through a network connection. The computer program B02 is executed by the processor A01 to implement a network traffic detection method.

[0113] Those skilled in the art can understand that Figure 4 The structure shown in FIG.

[0114] Those skilled in the art will appreciate that embodiments of the application can be readily used as a method, a system or a computer program product. Accordingly, the application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the application can take the form of a computer program product on one or more computer readable storage media (including, but not limited to, disk memory, CD-ROMs, optical storage devices, etc.) embodying computer readable program code.

[0115] The application is described herein with reference to the Figures, which illustrate the embodiments of the application. The drawings described are diagrammatic and schematic representations of actual or contemplated embodiments of the application, which are described below, and should not necessarily be construed as limiting the scope of the application. Figure 1 one or more processes and / or blocks Figure 1 means for carrying out the function specified by the block or blocks.

[0116] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the Figure 1 one or more processes and / or blocks Figure 1 means for carrying out the function specified by the block or blocks.

[0117] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the Figure 1 one or more processes and / or blocks Figure 1 means for carrying out the function specified by the block or blocks.

[0118] In one typical configuration, the computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0119] The memory can include non-persistent memory and / or persistent memory, such as flash memory, read-only memory (ROM), and / or the like, in the form of one or more computer-readable media. The memory is an example of computer-readable media.

[0120] Computer-readable media includes permanent and non-permanent, movable and non-movable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers.

[0121] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to cover non-exclusive inclusions, so that a process, method, article or apparatus that includes a list of elements does not only include those elements, but also includes other elements not explicitly listed, or further includes elements inherent in such a process, method, article or apparatus. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or apparatus that includes the element.

[0122] The above only is an embodiment of the present application, and is not used to limit the present application. For those skilled in the art, the present application can have various changes and variations. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the present application shall be included in the scope of claims of the present application.

Claims

1. A network traffic detection method, characterized by, The method comprises: determining a file restoration sample of network traffic; a first analysis agent processing the file restoration sample to obtain sensitive information in the file restoration sample; the first analysis agent generating a query statement corresponding to an external query tool according to the sensitive information; calling the external query tool according to the query statement, and returning a query result corresponding to the query statement output by the external query tool to the first analysis agent; the first analysis agent transmitting the query result and the file restoration sample to a second analysis agent; the second analysis agent determining a detection decision corresponding to the query result to determine whether to perform sandbox detection on the file restoration sample according to the detection decision.

2. The network traffic detection method of claim 1, wherein, The first analysis agent generates a query statement corresponding to an external query tool according to the sensitive information, which comprises: determining the tool type of the external query tool; determining the target format of the query statement according to the tool type; the first analysis agent generates a query statement corresponding to an external query tool according to the sensitive information in the target format.

3. The network traffic detection method of claim 1, wherein, The method further comprises: in the case of multiple file restoration samples that need to be sandboxed, the second analysis agent determines the detection priority of each file restoration sample; according to the detection priority, each file restoration sample is added to a detection queue corresponding to the detection priority; according to the detection priority, each file restoration sample in each detection queue is sequentially sandboxed.

4. The network traffic detection method of claim 3, wherein, The second analysis agent determines the detection priority of each file restoration sample, which comprises: the second analysis agent determines the generation time or harm degree of each file restoration sample; according to the generation time or harm degree of each file restoration sample, the detection priority of each file restoration sample is determined.

5. The network traffic detection method of claim 1, wherein, The first analysis agent processes the file restoration sample to obtain sensitive information in the file restoration sample, which comprises: determining a first query statement of the first analysis agent; the first analysis agent determines the sensitive information in the file restoration sample according to the first query statement.

6. The network traffic detection method of claim 1, wherein, The external query tool comprises a threat intelligence library and / or a security knowledge base, and the query result comprises suspicious historical behavior output by the security knowledge base and suspicious threat information output by the threat intelligence library.

7. The network traffic detection method of claim 1, wherein, The sensitive information comprises at least one of the IP address, port, file name, domain name, uniform resource identifier and parsed suspicious string information of the file restoration sample.

8. A network traffic detection apparatus, characterized by, It comprises: a memory configured to store instructions; a processor configured to call the instructions from the memory and capable of implementing the network traffic detection method according to any one of claims 1 to 7 when executing the instructions.

9. A machine-readable storage medium, characterized in that, The machine readable storage medium stores instructions for causing a machine to perform the network traffic detection method according to any one of claims 1 to 7.

10. A computer program product, characterised in that, The computer program, when executed by a processor, implements the network traffic detection method according to any one of claims 1 to 7.

Images