Traceability analysis method for network attack
Through algorithms based on RBF neural network model, potential network attacks are identified and traceable with collaborative packets are used to solve the problem of internal network attack tracking and traceability, efficient threat discovery and response are achieved, and network security is improved.
Patent Information
- Application Number
- CN202411939808.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-26
- Publication Date
- 2025-04-11
AI Technical Summary
It is difficult for the existing technology to effectively track and trace internal cyber attacks, especially when attackers use normal traffic to mix in, traditional methods are difficult to discover and respond in real time.
The algorithm based on the RBF neural network model is used to identify potential network attack behaviors, and through the internal network attack tracking and traceability architecture of collaborative packets, data is collected in regions according to the attack type, the proportion of potential attack data is calculated, and multi-target tracking and traceability nodes are deployed to realize the traceability of network attacks.
Improves network security, promptly detects and responds to threats, prevents sensitive data breaches and business interruptions, and protects the business operations and security of sensitive information of enterprises and organizations.
Smart Images
Figure CN119814428A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of network security, and in particular to a method for tracing and analyzing a network attack. Background Art
[0002] With the rapid development of information technology, enterprises and organizations are facing increasingly complex and diverse network attack risks, and the attack techniques and means used by network attackers have also shown new development trends. Therefore, network security issues also require network users to continue to pay attention and take effective security protection measures. Traditional network security protection mainly achieves the purpose of protection by setting up security tools such as firewalls at the network boundary points to isolate the internal network that needs to be defended from the external network.
[0003] Internal network attacks are difficult to detect and track because attackers can conduct activities within the organization and blend into normal traffic. In the existing technology, network attack tracking and tracing methods have made certain progress. The commonly used methods are mainly based on log analysis tracking and tracing methods, IDS tracking and tracing methods, threat intelligence and intelligence sharing tracking and tracing methods, and user behavior analysis tracking and tracing methods. Among them, the log analysis method has too many and complex logs, requiring a lot of manual analysis and screening, and it is difficult to detect and respond to attacks in real time. The IDS method is easily restricted by the rule base and cannot effectively deal with novel and unknown attack methods. It is also easily interfered by the attacker's evasion methods. The difficulty of intelligence acquisition and integration in the threat intelligence and intelligence sharing method is relatively large, and the effectiveness of this method is also limited by limited intelligence sources. The user behavior analysis method requires the establishment of an accurate user behavior model, and it is difficult to distinguish the subtle differences between normal business activities and malicious behaviors. Summary of the invention
[0004] The present invention provides a method for tracing and analyzing the source of network attacks, which identifies potential network attack behaviors and uses a collaborative approach to track and trace the source of network attacks in collaborative groups according to the type of network attacks, thereby improving network security, timely discovering and responding to threats, and protecting the security of network information.
[0005] The present invention provides a method for tracing and analyzing a network attack, comprising:
[0006] Obtain network traffic and input it into the algorithm based on the RBF neural network model to identify potential network attack behaviors;
[0007] Collect information and data on network traffic and security incidents by region based on the type of network attack, and calculate the proportion of potential attack data;
[0008] Deploy multi-target network attack tracking and tracing nodes according to the potential attack data ratio, so as to utilize the nodes to transmit relevant data and information to a preset location;
[0009] Build an internal network attack tracking and tracing architecture for collaborative groups to achieve the tracing of network attacks.
[0010] Furthermore, the step of obtaining network traffic and inputting it into an algorithm based on an RBF neural network model to identify potential network attack behaviors includes:
[0011] Obtain network traffic and use an improved completely fair scheduling algorithm to extract network traffic features, obtain the original feature data for standardization and format conversion;
[0012] The processed raw feature data is input into the preset RBF neural network model to identify potential network attack behaviors;
[0013] The improved AdaBoost algorithm is used for intelligent adaptive learning to dynamically update the parameters of the RBF neural network by continuously monitoring the network behavior.
[0014] Furthermore, the step of obtaining network traffic and extracting network traffic features using an improved completely fair scheduling algorithm to obtain original feature data for standardization and format conversion includes:
[0015] Let the feature set be F = {f 1 , f 2 , ..., f n}, the category label is C, and the completely fair scheduling algorithm is to find a feature subset The average correlation between the features and the category labels in S is maximized, while the average correlation between the features is minimized. The evaluation function of the completely fair scheduling algorithm is:
[0016]
[0017] Among them, k is the size of the feature subset S, is the average correlation between features and category labels in S, is the average correlation between features in S, by maximizing Merit s , get the most representative and least redundant feature subset as the original feature data;
[0018] The original feature data is normalized, features of different dimensions are mapped to a unified scale space, and discrete features are encoded using One-Hot encoding, so that the processed feature data is packaged according to a predefined format.
[0019] Furthermore, the step of using the improved AdaBoost algorithm to perform intelligent adaptive learning to dynamically update the parameters of the RBF neural network by continuously monitoring the network behavior includes:
[0020] The RBF neural network is used as a weak classifier, and the forgetting factor is introduced to adapt to the concept drift, that is, the dynamic change of network behavior. After each round of iteration, the parameters of the RBF neural network are updated by weighted average, that is:
[0021] θ t+1 =λθ t +(1-λ)θ′ t
[0022] Among them, θ′ t is the parameter obtained in this round of training, and the parameter λ controls the degree of retention of old knowledge.
[0023] Furthermore, the step of collecting information and data of network traffic and security events by region according to the type of network attack and calculating the proportion of potential attack data includes:
[0024] Determine the current common types of network attacks; wherein the network attack types include network traffic anomalies, vulnerability exploits, and malware;
[0025] Collect information and data on network traffic and security events by region, and calculate the proportion of potential attack data. The calculation formula is:
[0026]
[0027] Where G represents the proportion of potential attack data; h u Indicates the recognizable range; Indicates network traffic.
[0028] Furthermore, the step of deploying a multi-target network attack tracking and tracing node according to the potential attack data ratio to transmit relevant data and information to a preset location by using the node includes:
[0029] Divide the network coverage area into multiple independent tracking and tracing blocks, and set a set number of monitoring nodes to form a multi-target tracking and tracing structure to ensure that each stage can cover the network range that needs to be monitored;
[0030] Calculate the identifiable attack range of a single node using the following formula:
[0031]
[0032] Where M represents the identifiable attack range of a single node; τ represents the data collection area; m and n represent the matching area and non-matching area of the node, respectively; Indicates the number of node matches;
[0033] Extract attack-related features and information, match and compare the extracted attack features with known attack identification nodes, and implement basic tracking and tracing of locations where potential network attacks exist.
[0034] Furthermore, the step of constructing an internal network attack tracking and tracing architecture of a collaborative group to achieve the tracing of the network attack includes:
[0035] Identify the attack behaviors in the current internal network, determine the threat point at this time, and calculate the sensing distance of the threat point. The calculation formula is:
[0036]
[0037] Where K represents the sensing distance of the threat point; ρ represents the collaborative controllable area; R 1 and R 2 They represent the threat range and overlapping threat area respectively; β represents the traceable identification distance; μ represents the tracing difference; v represents the tracing time;
[0038] According to the calculation results, collaboratively mark the threat points, establish multiple identification, tracking and tracing targets, and deploy them in the actual network environment. Set up the collaborative group tracking and tracing auxiliary structure, and set the basic tracing items and parameters.
[0039] Based on the collaborative group tracking and tracing mode, the internal execution standards of tracing are adjusted, and the location of the current network attack is recalibrated to obtain the network attacker's IP amplitude, information, tracking location, tracing traffic and other data to achieve tracing of the network attack.
[0040] The present invention also provides a network attack source tracing analysis device, comprising:
[0041] The acquisition module is used to acquire network traffic and input it into the algorithm based on the RBF neural network model to identify potential network attack behaviors;
[0042] The calculation module is used to collect information and data on network traffic and security events by region according to the type of network attack, and calculate the proportion of potential attack data;
[0043] A deployment module, used to deploy multi-target network attack tracking and tracing nodes according to the potential attack data ratio, so as to use the nodes to transmit relevant data and information to a preset location;
[0044] The tracing module is used to build an internal network attack tracking and tracing architecture for collaborative groups to achieve the tracing of network attacks.
[0045] The present invention also provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above method when executing the computer program.
[0046] The present invention also provides a computer-readable storage medium on which a computer program is stored, and the computer program implements the steps of the above method when executed by a processor.
[0047] The beneficial effects of the present invention are:
[0048] The present invention first obtains network traffic and inputs it into an algorithm based on an RBF neural network model to identify potential network attack behaviors. For the identified network attack behaviors, the main characteristics of the network attack are determined, and the proportion of potential attack data is calculated for different attack types. Then, by marking normal network traffic data and potential attack data, the method of deploying multi-target network attack tracking and tracing nodes is determined, and the network monitoring range of the tracking and tracing nodes is clarified. Finally, a collaborative approach is adopted to track and trace the network attacks of collaborative groups, improve the security of the network, timely discover and respond to threats, prevent sensitive data leakage, business interruption or other potential losses, and protect the business operations and sensitive information security of enterprises and organizations. BRIEF DESCRIPTION OF THE DRAWINGS
[0049] Figure 1 The figure is a schematic diagram of a method flow according to an embodiment of the present invention.
[0050] Figure 2 FIG. 1 is a schematic diagram of a device structure according to an embodiment of the present invention.
[0051] Figure 3 The figure is a schematic diagram of the internal structure of a computer device according to an embodiment of the present invention.
[0052] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION
[0053] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.
[0054] like Figure 1 As shown, the present invention provides a method for tracing and analyzing a network attack, comprising:
[0055] S1. Obtain network traffic and input it into an algorithm based on the RBF neural network model to identify potential network attack behaviors;
[0056] Step S1 specifically includes:
[0057] S101, obtaining network traffic and using an improved completely fair scheduling algorithm to extract network traffic features, obtaining original feature data for standardization and format conversion;
[0058] S1011. In the feature extraction process, an improved correlation based feature selection (CFS) algorithm is used. Let the feature set be F = {f 1 , f 2 , ..., f n}, the category label is C, and the completely fair scheduling algorithm is to find a feature subset The average correlation between the features and the category labels in S is maximized, while the average correlation between the features is minimized. Mathematically, the evaluation function of the completely fair scheduling algorithm is:
[0059]
[0060] Among them, k is the size of the feature subset S, is the average correlation between features and category labels in S, is the average correlation between features in S, by maximizing Merit s , and obtain the most representative and least redundant feature subset as the original feature data. In practical applications, the CFS algorithm can quickly extract the most valuable features for intrusion detection from massive network traffic, such as connection duration, average packet length, protocol type distribution, etc., laying the foundation for RBF neural network detection. The extracted feature data is standardized and formatted, and finally input into the RBF neural network for intrusion discrimination.
[0061] S1012, normalizing the original feature data, mapping features of different dimensions to a unified scale space, and encoding discrete features using One-Hot encoding, and packaging the processed feature data according to a predefined format.
[0062] The processed raw feature data is standardized and converted to prepare for the subsequent RBF neural network detection. In the processing stage, the raw feature data is first normalized to map features of different dimensions to a unified scale space. Let the original value of the i-th feature be x i , the normalized value is x′ i , then the normalization formula is:
[0063]
[0064] Among them, min(x i ) and max(x i) represent the minimum and maximum values of the i-th feature, respectively. Normalization can eliminate the impact of feature dimension differences on subsequent detection performance. Next, the One-Hot encoding technique is used to encode discrete features (such as protocol types) and convert them into numerical features that are easy for RBF neural networks to process. For example, for protocol type features, TCP is encoded as [1, 0, 0], UDP is encoded as [0, 1, 0], and ICMP is encoded as [0, 0, 1]. Finally, the processed feature data is packaged in a predefined format and sent to the RBF neural network through a high-speed transmission channel (such as InfiniBand), achieving seamless connection from feature data extraction to detection.
[0065] S102: Input the processed original feature data into a preset RBF neural network model to identify potential network attack behaviors.
[0066] The RBF neural network is responsible for analyzing the input features to achieve real-time identification of network intrusion behavior. That is, the improved RBF neural network algorithm is used for intrusion detection. The output of the traditional RBF network is:
[0067]
[0068] Where φ is the radial basis function, w i is the weight of the i-th hidden layer neuron, c i is the center vector of the i-th hidden layer neuron, and h is the number of hidden layer neurons. In order to improve the detection accuracy, the regularization term is introduced to construct the following objective function, namely:
[0069]
[0070] in, is the training sample, and λ is the regularization coefficient. By minimizing E(W), the optimal weight matrix W can be obtained. After determining the network structure (such as the number of neurons in the hidden layer h = 100), the gradient descent method is used to iteratively optimize the weight matrix W. The weight update amount for each iteration is where η is the learning rate. After training, the RBF neural network can quickly distinguish the input features and output an alarm indicator representing the probability of intrusion. When the alarm indicator exceeds the preset threshold, an alarm is triggered immediately.
[0071] S103. An improved AdaBoost algorithm is used for intelligent adaptive learning to dynamically update the parameters of the RBF neural network by continuously monitoring network behavior, so as to adapt to the ever-changing threat environment.
[0072] The improved AdaBoost algorithm is used to achieve adaptive learning. Different from the traditional AdaBoost algorithm, the RBF neural network is used as a weak classifier, and the forgetting factor is introduced to adapt to the concept drift, that is, the dynamic change of network behavior. After each round of iteration, the parameters of the RBF neural network are updated by weighted average, that is:
[0073] θ t+1 =λθ t +(1-λ)θ′ t
[0074] Among them, θ′ t is the parameter obtained in this round of training, and the parameter λ controls the degree of retention of old knowledge. Through adaptive learning, new intrusion patterns can be continuously mined from massive network traffic, and the decision boundary of the RBF neural network can be adjusted in real time to accurately identify unknown intrusion behaviors. The model update data generated by the learning process is transmitted to the RBF neural network through an encrypted channel to guide the next stage of intrusion detection tasks.
[0075] S2. Collect information and data on network traffic and security incidents by region based on the type of network attack, and calculate the proportion of potential attack data;
[0076] Step S2 specifically includes:
[0077] S201, determining the current common network attack types; wherein the network attack types include network traffic anomalies, vulnerability exploits, and malware;
[0078] S202. Collect information and data on network traffic and security events by region, and calculate the proportion of potential attack data. The calculation formula is:
[0079]
[0080] Where G represents the proportion of potential attack data; h u Indicates the recognizable range; Represents network traffic.
[0081] As in the above steps S201-S202, the purpose of network attack feature sensing and identification is to effectively prevent and respond to intrusions and range attacks of various networks by sensing and identifying the features of network attacks, minimize damage to the network, and ensure its normal operation. First, determine the main features of common current network attacks, including common attack types such as network traffic anomalies, vulnerability exploits, and malware. Next, use auxiliary measurement tools such as directional monitoring, intrusion detection systems (IDS), and security event information management (SIEM) for different attack types, collect information and data on network traffic and security events by region, and calculate the proportion of potential attack data. According to the calculation results of the proportion of potential attack data, mark the normal network traffic data and potential attack data for subsequent processing and application.
[0082] S3. Deploy multi-target network attack tracking and tracing nodes according to the potential attack data ratio, so as to utilize the nodes to transmit relevant data and information to a preset location;
[0083] Step S3 specifically includes:
[0084] S301, dividing the network coverage area into multiple independent tracking and tracing blocks, and setting a set number of monitoring nodes to form a multi-target tracking and tracing structure to ensure that each stage can cover the network range that needs to be monitored;
[0085] S302: Calculate the identifiable attack range of a single node, using the following formula:
[0086]
[0087] Where M represents the identifiable attack range of a single node; τ represents the data collection area; m and n represent the matching area and non-matching area of the node, respectively; Indicates the number of node matches;
[0088] S303: Extract attack-related features and information, match and compare the extracted attack features with known attack identification nodes, and perform basic tracking and tracing of locations where potential network attacks exist.
[0089] As described in the above steps S301-S303, the deployment structure of traditional network attack tracking and tracing nodes is mostly target-based or regional. Although the expected tracing tasks and goals can be achieved, the lack of stability and flexibility will lead to errors in the tracing results. To this end, multi-target network attack tracking and tracing nodes are deployed based on the calculation results of the potential attack data ratio, and the goals such as the network monitoring range of the tracking and tracing nodes, the tracking target type, and the possible attack type are clearly defined. Timestamps, data packet tracking, session tracking and other technologies are selected to determine the tracking and tracing range. The network coverage area is divided into multiple independent tracking and tracing blocks, and a certain number of monitoring nodes are set to form a multi-target tracking and tracing structure to ensure that each stage can cover the network range that needs to be monitored. In this process, the node needs to have sufficient data processing capabilities and storage space to cope with the possible data traffic and storage requirements. At this point, the identifiable attack range of a single node is calculated. After the identifiable attack range of a single node is calculated, the features and information related to the attack are extracted through in-depth analysis and processing of the data. The extracted attack features are matched and compared with the known attack identification nodes to achieve basic tracking and tracing of the location where potential network attacks exist. The specific process is as follows:
[0090] Based on the attack characteristics and identification results, analyze the path and source of the attack, trace the source of the attack, make multi-target marks, use network topology maps and other tools to search for the attacker's location, mark the attacker's network address, domain name and other information, perform target sensing and identification, and identify the attacker.
[0091] According to the above process, the deployment of nodes for tracking and tracing multi-target network attacks is realized. Once a network attack is identified, the node can be used to transmit relevant data and information to a preset location, laying the foundation for subsequent tracking and tracing analysis.
[0092] S4. Build an internal network attack tracking and tracing architecture for collaborative groups to achieve the tracing of network attacks.
[0093] After completing the deployment of multi-target network attack tracking and tracing nodes, the collaborative group network attack tracking and tracing is carried out. The current network attack tracking and tracing methods are mostly set as target-based, and the tracking and tracing efficiency is low. It is difficult to deal with multi-target and multi-region intrusion situations. For this reason, a collaborative structure is adopted to enhance the application effect and comprehensive response capability of the method. The above has identified the attack type, collected relevant network traffic data and potential attack data, and combined with the above information, established an internal network attack tracking and tracing architecture for collaborative groups.
[0094] Step S4 specifically includes:
[0095] S401, identifying the attack behavior existing in the current internal network, determining the threat point at this time, and calculating the sensing distance of the threat point, the calculation formula is:
[0096]
[0097] Where K represents the sensing distance of the threat point; ρ represents the collaborative controllable area; R 1 and R 2 They represent the threat range and overlapping threat area respectively; β represents the traceable identification distance; μ represents the tracing difference; v represents the tracing time;
[0098] S402: collaboratively mark the threat points according to the calculation results, establish multiple identification, tracking and tracing targets, and deploy them in the actual network environment, set up a collaborative group tracking and tracing auxiliary structure, and set basic tracing items and parameters;
[0099] S403. Based on the collaborative group tracking and tracing mode, adjust the internal execution standard of tracing, perform secondary calibration on the location where the current network attack occurs, obtain the network attacker's IP amplitude, information, tracking location, tracing traffic and other data, and realize the tracing of the network attack.
[0100] As described in the above steps S401-S403, the internal network attack tracking and tracing is performed under the premise of knowing the normal traffic and attack identification program. First, the possible attack behaviors in the current internal network are identified, the threat points at this time are determined, and the sensing distance of the threat points is calculated. According to the calculation results, the threat points are collaboratively marked, multiple identification, tracking and tracing targets are established, and deployed in the actual network environment, and a collaborative group tracking and tracing auxiliary structure is set to set basic tracing items and parameters. For example, the traceable distance is 30.5m, the collaborative controllable identification difference is 1.13, the backdoor tracing frequency is 10 times, the network load average ratio is 3.24, and the log data processing takes 0.25s. Combined with the above data, the setting of collaborative group tracking and tracing items and parameters under various intrusions is realized. Subsequently, based on the current collaborative group tracking and tracing mode, the internal execution standard of the tracing is adjusted, the location where the current network attack occurs is secondary calibrated, and the IP amplitude, information, tracking location and tracing traffic of the network attacker are obtained to achieve the tracing of the network attack.
[0101] The present invention first obtains network traffic and inputs it into an algorithm based on an RBF neural network model to identify potential network attack behaviors. For the identified network attack behaviors, the main characteristics of the network attack are determined, and the proportion of potential attack data is calculated for different attack types. Then, by marking normal network traffic data and potential attack data, the method of deploying multi-target network attack tracking and tracing nodes is determined, and the network monitoring range of the tracking and tracing nodes is clarified. Finally, a collaborative approach is adopted to track and trace the network attacks of collaborative groups, improve the security of the network, timely discover and respond to threats, prevent sensitive data leakage, business interruption or other potential losses, and protect the business operations and sensitive information security of enterprises and organizations.
[0102] like Figure 2 As shown, the present invention also provides a network attack source tracing analysis device, including:
[0103] Acquisition module 1, used to acquire network traffic and input it into an algorithm based on the RBF neural network model to identify potential network attack behaviors;
[0104] Calculation module 2, used to collect information and data on network traffic and security events by region according to the type of network attack, and calculate the proportion of potential attack data;
[0105] Deployment module 3, used to deploy multi-target network attack tracking and tracing nodes according to the potential attack data ratio, so as to use the nodes to transmit relevant data and information to a preset location;
[0106] The traceability module 4 is used to build an internal network attack tracking and tracing architecture for collaborative groups to achieve the traceability of network attacks.
[0107] In one embodiment, the acquisition module 1 includes:
[0108] An extraction unit is used to obtain network traffic and use an improved completely fair scheduling algorithm to extract network traffic features, obtain original feature data for standardization and format conversion;
[0109] The recognition unit is used to input the processed original feature data into a preset RBF neural network model to realize the recognition of potential network attack behaviors;
[0110] The updating unit is used for performing intelligent adaptive learning using the improved AdaBoost algorithm to dynamically update the parameters of the RBF neural network by continuously monitoring the network behavior.
[0111] In one embodiment, the extraction unit comprises:
[0112] Calculate the subunit, and set the feature set as F = {f 1 , f2 , ..., f n}, the category label is C, and the completely fair scheduling algorithm is to find a feature subset The average correlation between the features and the category labels in S is maximized, while the average correlation between the features is minimized. The evaluation function of the completely fair scheduling algorithm is:
[0113]
[0114] Among them, k is the size of the feature subset S, is the average correlation between features and category labels in S, is the average correlation between features in S, by maximizing Merit s , get the most representative and least redundant feature subset as the original feature data;
[0115] The processing subunit is used to normalize the original feature data, map features of different dimensions to a unified scale space, and encode discrete features using One-Hot encoding, so as to package the processed feature data in a predefined format.
[0116] In one embodiment, the updating unit includes:
[0117] The RBF neural network is used as a weak classifier, and the forgetting factor is introduced to adapt to the concept drift, that is, the dynamic change of network behavior. After each round of iteration, the parameters of the RBF neural network are updated by weighted average, that is:
[0118] θ t+1 =λθ t +(1-λ)θ′ t
[0119] Among them, θ′ t is the parameter obtained in this round of training, and the parameter λ controls the degree of retention of old knowledge.
[0120] In one embodiment, the calculation module 2 includes:
[0121] A determination unit, used to determine the current common network attack types; wherein the network attack types include network traffic anomalies, vulnerability exploits, and malware;
[0122] The ratio calculation unit is used to collect information and data on network traffic and security events by region and calculate the ratio of potential attack data. The calculation formula is:
[0123]
[0124] Where G represents the proportion of potential attack data; h u Indicates the recognizable range; Represents network traffic.
[0125] In one embodiment, the deployment module 3 includes:
[0126] The division unit is used to divide the network coverage area into multiple independent tracking and tracing blocks, and set a set number of monitoring nodes to form a multi-target tracking and tracing structure to ensure that each stage can cover the network range that needs to be monitored;
[0127] The range calculation unit is used to calculate the identifiable attack range of a single node. The calculation formula is:
[0128]
[0129] Where M represents the identifiable attack range of a single node; τ represents the data collection area; m and n represent the matching area and non-matching area of the node, respectively; Indicates the number of node matches;
[0130] The matching unit is used to extract features and information related to the attack, match and compare the extracted attack features with known attack identification nodes, and implement basic tracking and tracing of locations where potential network attacks exist.
[0131] In one embodiment, the traceability module 4 includes:
[0132] The distance calculation unit is used to identify the attack behavior existing in the current internal network, determine the threat point at this time, and calculate the sensing distance of the threat point. The calculation formula is:
[0133]
[0134] Where K represents the sensing distance of the threat point; ρ represents the collaborative controllable area; R 1 and R 2 They represent the threat range and overlapping threat area respectively; β represents the traceable identification distance; μ represents the tracing difference; v represents the tracing time;
[0135] The setting unit is used to collaboratively mark threat points according to the calculation results, establish multiple identification, tracking and tracing targets, and deploy them to the actual network environment, set the collaborative group tracking and tracing auxiliary structure, and set the basic tracing items and parameters;
[0136] The tracing unit is used to adjust the internal execution standard of tracing based on the collaborative group tracking tracing mode, perform secondary calibration on the location where the current network attack occurs, obtain the network attacker's IP amplitude, information, tracking location, tracing traffic and other data, and realize the tracing of the network attack.
[0137] The above modules, units, and sub-units are used to execute the corresponding steps in the above-mentioned network attack source tracing analysis method. The specific implementation method thereof is described in the above-mentioned method embodiment and will not be repeated here.
[0138] like Figure 3 As shown, the present invention also provides a computer device, which can be a server, and its internal structure can be as shown in Figure 3 As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor designed by the computer is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store all data required for the process of the tracing analysis method of the network attack. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, the tracing analysis method of the network attack is implemented.
[0139] Those skilled in the art will understand that Figure 3 The structure shown in is merely a block diagram of a portion of the structure related to the present application solution and does not constitute a limitation on the computer device to which the present application solution is applied.
[0140] An embodiment of the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, any of the above-mentioned network attack source tracing analysis methods is implemented.
[0141] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing related hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media provided in this application and used in the embodiments may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.
[0142] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, device, article or method including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, device, article or method. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the presence of other identical elements in the process, device, article or method including the element.
[0143] The above description is only a preferred embodiment of the present invention, and does not limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made by using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.
Claims
1. A method for tracing the source of a network attack, characterized in that: include: Obtain network traffic and input it into the algorithm based on the RBF neural network model to identify potential network attack behaviors; Collect information and data on network traffic and security incidents by region based on the type of network attack, and calculate the proportion of potential attack data; Deploy multi-target network attack tracking and tracing nodes according to the potential attack data ratio, so as to utilize the nodes to transmit relevant data and information to a preset location; Build an internal network attack tracking and tracing architecture for collaborative groups to achieve the tracing of network attacks.
2. The method for tracing the source of a network attack according to claim 1, characterized in that: The step of obtaining network traffic and inputting it into an algorithm based on an RBF neural network model to identify potential network attack behaviors includes: Obtain network traffic and use an improved completely fair scheduling algorithm to extract network traffic features, obtain the original feature data for standardization and format conversion; The processed raw feature data is input into the preset RBF neural network model to identify potential network attack behaviors; The improved AdaBoost algorithm is used for intelligent adaptive learning to dynamically update the parameters of the RBF neural network by continuously monitoring the network behavior.
3. The method for tracing the source of a network attack according to claim 2, characterized in that: The steps of obtaining network traffic and extracting network traffic features using an improved completely fair scheduling algorithm to obtain original feature data for standardization and format conversion include: Assume that the feature set is F = {f1,f2,…,f n }, the category label is C, and the completely fair scheduling algorithm is to find a feature subset The average correlation between the features and the category labels in S is maximized, while the average correlation between the features is minimized. The evaluation function of the completely fair scheduling algorithm is: Among them, k is the size of the feature subset S, is the average correlation between features and category labels in S, is the average correlation between features in S, by maximizing Merit s , get the most representative and least redundant feature subset as the original feature data; The original feature data is normalized, features of different dimensions are mapped to a unified scale space, and discrete features are encoded using One-Hot encoding, so that the processed feature data is packaged according to a predefined format.
4. The method for tracing the source of a network attack according to claim 3, characterized in that: The step of using the improved AdaBoost algorithm to perform intelligent adaptive learning to dynamically update the parameters of the RBF neural network by continuously monitoring the network behavior includes: The RBF neural network is used as a weak classifier, and the forgetting factor is introduced to adapt to the concept drift, that is, the dynamic change of network behavior. After each round of iteration, the parameters of the RBF neural network are updated by weighted average, that is: i t+1 =λθ t +(1―λ)θ′ t Among them, θ ′ t is the parameter obtained in this round of training, and the parameter λ controls the degree of retention of old knowledge.
5. The method for tracing the source of a network attack according to claim 4, characterized in that: The step of collecting information and data of network traffic and security events by region according to the type of network attack and calculating the proportion of potential attack data includes: Determine the current common types of network attacks; wherein the network attack types include network traffic anomalies, vulnerability exploits, and malware; Collect information and data on network traffic and security events by region, and calculate the proportion of potential attack data. The calculation formula is: Where G represents the proportion of potential attack data; h u Indicates the recognizable range; Indicates network traffic.
6. The method for tracing the source of a network attack according to claim 5, characterized in that: The step of deploying a multi-target network attack tracking and tracing node according to the potential attack data ratio to transmit relevant data and information to a preset location by using the node includes: Divide the network coverage area into multiple independent tracking and tracing blocks, and set a set number of monitoring nodes to form a multi-target tracking and tracing structure to ensure that each stage can cover the network range that needs to be monitored; Calculate the identifiable attack range of a single node using the following formula: Where M represents the identifiable attack range of a single node; τ represents the data collection area; m and n represent the matching area and non-matching area of the node, respectively; Indicates the number of node matches; Extract attack-related features and information, match and compare the extracted attack features with known attack identification nodes, and implement basic tracking and tracing of locations where potential network attacks exist.
7. The method for tracing the source of a network attack according to claim 6, characterized in that: The steps of constructing an internal network attack tracking and tracing architecture of collaborative groups to achieve the tracing of the network attack include: Identify the attack behaviors in the current internal network, determine the threat point at this time, and calculate the sensing distance of the threat point. The calculation formula is: Among them, K represents the sensing distance of the threat point; ρ represents the collaborative controllable area; R1 and R2 represent the threat range and overlapping threat area respectively; β represents the traceable identification distance; μ represents the traceability difference; v represents the traceability time; According to the calculation results, collaboratively mark the threat points, establish multiple identification, tracking and tracing targets, and deploy them in the actual network environment. Set up the collaborative group tracking and tracing auxiliary structure, and set the basic tracing items and parameters. Based on the collaborative group tracking and tracing mode, the internal execution standards of tracing are adjusted, and the location of the current network attack is recalibrated to obtain the network attacker's IP amplitude, information, tracking location, tracing traffic and other data to achieve tracing of the network attack.
8. A network attack source tracing analysis device, characterized in that: include: The acquisition module is used to acquire network traffic and input it into the algorithm based on the RBF neural network model to identify potential network attack behaviors; The calculation module is used to collect information and data on network traffic and security events by region according to the type of network attack, and calculate the proportion of potential attack data; A deployment module, used to deploy multi-target network attack tracking and tracing nodes according to the potential attack data ratio, so as to use the nodes to transmit relevant data and information to a preset location; The tracing module is used to build an internal network attack tracking and tracing architecture for collaborative groups to achieve the tracing of network attacks.
9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.