Network security attack trace detection method and system

Abstract

The invention discloses a network security attack trace detection method and system, and the method comprises the steps: obtaining a first historical parameter of a target network, and carrying out the first preprocessing of the first historical parameter, and obtaining a second historical parameter; presetting a first detection rule, detecting the second historical parameter, and recording the detected data as first detection data; and training the first attack detection model by taking the first detection data as a training sample. According to the method, network attack behaviors can be effectively identified and analyzed, so that more accurate defense measures are provided for network security. And detection rules and models can be automatically updated according to detected attack traces so as to adapt to continuously changing network attack modes. An efficient data processing flow is designed, manual intervention can be reduced, the detection efficiency is improved, and the false alarm rate is reduced. And the system also has good expansibility, can support various network environments and networks of different scales, and meets the requirements of different users.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security attack trace detection method and system. Background Art

[0002] Attack trace detection method is a method for network security detection and maintenance. The semantic gap between security knowledge graph and log is the key to restricting the application of security knowledge graph to attack path investigation. The main reason is that security knowledge graph is an abstract knowledge describing security events, while log information records network traffic and system behavior, etc. It not only contains information related to attack events, but also contains information about the normal operation of the system. Only by supplementing relevant knowledge can this semantic gap problem be solved, and the semantic association between security knowledge graph and log can be realized, so that the knowledge graph and the underlying log data are in the same semantic space, and then the attack path analysis can be realized through graph analysis methods. With the continuous development of science and technology, people's requirements for attack trace detection methods are getting higher and higher.

[0003] Existing attack trace detection methods have certain drawbacks when used. Attack event investigation is based on the confirmed attack event to trace back the entire attack process. Ideally, the entire attack path can be investigated based on the knowledge graph. Due to the large amount of alarm data, the number of entities involved in the relevant path increases exponentially. It is unrealistic to manually check the attack path from a large number of paths. In addition, due to the incompleteness of data collection and knowledge extraction, there will be missing paths. Summary of the invention

[0004] The purpose of this section is to summarize some aspects of embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the specification abstract and the invention title of this application to avoid blurring the purpose of this section, the specification abstract and the invention title, and such simplifications or omissions cannot be used to limit the scope of the present invention.

[0005] In view of the above existing problems, the present invention is proposed.

[0006] Therefore, the present invention provides a network security attack trace detection method and system, which can solve the problems mentioned in the background technology.

[0007] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0008] In a first aspect, the present invention provides a network security attack trace detection method, comprising:

[0009] Acquire a first historical parameter of the target network, and perform a first preprocessing on the first historical parameter to obtain a second historical parameter;

[0010] Preset a first detection rule, detect the second historical parameter, and record the detected data as first detection data;

[0011] The first detection rule includes a first malicious traffic detection rule and a first association detection rule;

[0012] The first detection data is used as a training sample to train a first attack detection model.

[0013] As a preferred solution of the network security attack trace detection method described in the present invention, it also includes:

[0014] Obtain different types of first attack samples;

[0015] performing a second preprocessing on the first attack sample to obtain a second attack sample;

[0016] The first attack detection model is tested according to the second sample to obtain a second attack detection model.

[0017] As a preferred solution of the network security attack trace detection method of the present invention, wherein: the first attack detection model includes:

[0018] The first attack detection model inputs the first detection data, and outputs an arbitrary model of network malicious traffic and attack behavior patterns.

[0019] As a preferred solution of the network security attack trace detection method of the present invention, wherein: the different types of first attack samples include known malware, attack tools, and vulnerability exploitation information;

[0020] The first attack sample and the first detection data have an intersection;

[0021] The first detection data includes abnormal data in target network traffic, system logs, and application log data, and the abnormal data includes data generated when attacked and data generated when not attacked.

[0022] As a preferred solution of the network security attack trace detection method of the present invention, wherein: the obtaining of the first historical parameter of the target network and performing a first preprocessing on the first historical parameter to obtain the second historical parameter comprises:

[0023] The first historical parameter includes at least target network traffic, system log, and application log data;

[0024] The first preprocessing at least includes extracting features from the first historical parameters.

[0025] As a preferred solution of the network security attack trace detection method of the present invention, wherein: testing the first attack detection model according to the second sample and obtaining the second attack detection model includes:

[0026] If the result of testing the first attack detection model according to the second sample is satisfied, the first attack detection model is used as the second attack detection model;

[0027] If the result of testing the first attack detection model according to the second sample is not satisfied, the first attack detection model is retrained, and the training sample of the retrained first attack detection model is a new data set composed of the first detection data and the second sample.

[0028] As a preferred solution of the network security attack trace detection method described in the present invention, the new data set includes: the training set in the new data set at least includes all the second samples.

[0029] In a second aspect, the present invention provides a network security attack trace detection system, comprising:

[0030] A data processing module, used for acquiring a first historical parameter of a target network, and performing a first preprocessing on the first historical parameter to obtain a second historical parameter;

[0031] A data acquisition module, used for presetting a first detection rule, detecting the second historical parameter, and recording the detected data as first detection data;

[0032] The first detection rule includes a first malicious traffic detection rule and a first association detection rule;

[0033] The model building module is used to train a first attack detection model by using the first detection data as a training sample.

[0034] In a third aspect, the present invention provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above-mentioned method when executing the computer program.

[0035] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of the method described above when executed by a processor.

[0036] Compared with the prior art, the present invention has the following beneficial effects: the present invention proposes a network security attack trace detection method and system, which obtains a first historical parameter of a target network, performs a first preprocessing on the first historical parameter, and obtains a second historical parameter; presets a first detection rule, detects the second historical parameter, and records the detected data as the first detection data; the first detection rule includes a first malicious traffic detection rule and a first association detection rule; uses the first detection data as a training sample to train a first attack detection model. This method can effectively identify and analyze network attack behaviors, thereby providing more accurate defense measures for network security. It can also automatically update detection rules and models based on the detected attack traces to adapt to the ever-changing network attack patterns. An efficient data processing process is designed to reduce manual intervention, improve detection efficiency, and reduce false alarm rates. It also has good scalability and can support a variety of network environments and networks of different sizes to meet the needs of different users. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. Among them:

[0038] Figure 1 A method flow chart of a network security attack trace detection method and system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0039] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0040] Example 1

[0041] Reference Figure 1 , which is the first embodiment of the present invention, and provides a network security attack trace detection method and system, including:

[0042] There are some problems and shortcomings in the existing related technologies, such as low detection accuracy, slow detection speed, high false alarm rate, and difficulty in adapting to rapid changes in the network environment.

[0043] This application provides a method that can effectively solve the above-mentioned problems. Next, we will explain in detail how to implement the network security attack trace detection method in combination with multiple embodiments;

[0044] Figure 1 A method flow chart of a network security attack trace detection method and system is shown, including:

[0045] S100: Acquire a first historical parameter of a target network, and perform a first preprocessing on the first historical parameter to obtain a second historical parameter;

[0046] In an optional embodiment, the first historical parameter includes a lot of relatively messy data, such as network traffic data, system log data, application log data and other related network activity log data under normal or abnormal conditions, etc. In order to improve the accuracy and efficiency of detection, it is necessary to effectively pre-process these data.

[0047] In an embodiment of the present application, the first historical parameter includes at least target network traffic, system logs, and application log data, because these data can provide detailed information about network status and activities and can reflect potential security threats in the network.

[0048] It should be noted that more types of first historical parameter data are not obtained because the acquisition and preprocessing process of the first historical parameters is already complex enough, and adding more types of data will significantly increase the difficulty of processing and the consumption of computing resources. In addition, too many data types may introduce unnecessary noise and affect the efficiency and accuracy of model training. Through the comprehensive analysis of these data, it is sufficient to fully understand the network environment and potential security threats.

[0049] In the embodiment of the present application, obtaining a first historical parameter of the target network, and performing a first preprocessing on the first historical parameter to obtain a second historical parameter includes:

[0050] The first historical parameter includes at least target network traffic, system log, and application log data;

[0051] The first preprocessing at least includes extracting features from the first historical parameter.

[0052] In an optional embodiment, the first preprocessing step includes data cleaning, data normalization, data dimension reduction, etc., to ensure data quality and reduce the amount of computation for subsequent processing. Feature extraction is a key step in preprocessing, which involves extracting features from raw data that are helpful for attack detection, such as statistical features of traffic, abnormal behavior patterns in logs, etc.

[0053] In an optional embodiment, the feature extraction process can use a variety of algorithms, such as principal component analysis, linear discriminant analysis, or deep learning-based methods to extract the most valuable features for attack detection. Such preprocessing steps help improve the accuracy and efficiency of subsequent attack detection models.

[0054] In an embodiment of the present application, the first preprocessing includes cleaning, data conversion, data normalization and feature extraction of the data, removing irrelevant information and redundant data, and processing missing values. Methods such as interpolation, deletion or filling constants can be used. Unstructured data (such as log text) is converted into structured data. For example, word embedding technology can be used to convert text into vectors, network traffic data can be converted into time series, and a format suitable for CNN processing (such as a heat map) can be generated. Numerical data is normalized so that its range is between 0 and 1 to accelerate model convergence. Min-Max scaling or Z-score standardization can be used.

[0055] In an optional embodiment, feature extraction is to extract abnormal traffic data from the first historical parameter, and the extracted features may include average traffic rate, peak rate, packet size distribution, protocol type distribution, source and destination IP address distribution, etc. Through these features, abnormal behaviors in the network can be effectively identified, providing strong support for subsequent attack detection.

[0056] In the embodiment of the present application, feature extraction uses a combination algorithm. Specifically, the principal component analysis algorithm is applied to reduce the dimension of the data to reduce the complexity of the data and highlight the main features. The principal component analysis finds the main change directions in the data and projects the data onto these directions to obtain a new feature space. In this new feature space, the variance of the data is the largest, which helps the subsequent attack detection model to better identify attack behaviors.

[0057] In the embodiment of the present application, the feature space is further optimized using a linear discriminant analysis algorithm. Linear discriminant analysis aims to find the features of a linear combination so that the projections of different categories of data on this linear combination are as separate as possible. In this way, the distinction between different network attack behaviors can be enhanced, thereby improving the accuracy of detection.

[0058] In the embodiments of the present application, a method based on deep learning, such as a convolutional neural network (CNN) or a recurrent neural network (RNN), is combined to further extract and learn the deep features of the attack behavior. The deep learning model can automatically learn the complex structure and pattern of the data, and is particularly effective for identifying complex network attack behaviors. By training the deep learning model, automatic identification and classification of network attack behaviors can be achieved, thereby providing more accurate defense measures for network security.

[0059] It should be noted that through the comprehensive use of multiple data preprocessing and feature extraction technologies, as well as deep learning models, it is possible to effectively identify and analyze network attack behaviors, automatically update detection rules and models, reduce manual intervention, improve detection efficiency, reduce false alarm rates, and have good scalability to adapt to ever-changing network attack patterns and network environments of different sizes.

[0060] S200: Preset a first detection rule, detect the second historical parameter, and record the detected data as first detection data;

[0061] In an embodiment of the present application, the first detection rule includes a first malicious traffic detection rule and a first association detection rule;

[0062] It should be noted that the purpose of detecting the second historical parameter is to obtain malicious traffic and potential attack behaviors in the target network.

[0063] In an optional embodiment, the first malicious traffic detection rule can identify abnormal traffic based on statistical characteristics of traffic, such as packet arrival rate, packet size distribution, protocol type distribution, etc. These rules can help detect potential attack behaviors in the network, such as DDoS attacks, port scans, etc.

[0064] In an optional embodiment, the first correlation detection rule is used to analyze the correlation between different network events. For example, by analyzing the correlation between system logs and application logs, potential attack links and attacker behavior patterns can be discovered. By using these detection rules in combination, network attack behaviors can be more comprehensively identified, improving the accuracy and efficiency of detection.

[0065] In an optional embodiment, the first malicious traffic detection rule can be further refined, for example, by setting a threshold to distinguish between normal traffic and abnormal traffic. When the packet arrival rate exceeds the set threshold, the system can mark the traffic as abnormal and trigger further analysis. In addition, for the packet size distribution, a normal range can be set, and packets outside this range may indicate abnormal behavior. Anomaly detection of protocol type distribution can be based on statistical analysis of protocol usage frequency in historical data, and abnormal protocol usage patterns may indicate potential attacks.

[0066] In the embodiment of the present application, a normal range of the packet arrival rate is set based on historical data statistics. For example, under normal circumstances, the packet arrival rate per second is between 100 and 500. When the packet arrival rate exceeds the set threshold, the system marks the traffic as abnormal and triggers further analysis.

[0067] For example, assuming that the normal packet arrival rate is 100 to 500 packets / second, the threshold is set to 500 packets / second. If the packet arrival rate reaches 600 packets / second within a certain period of time, the system will mark the traffic as abnormal and record relevant information.

[0068] In an optional embodiment, the implementation of the first association detection rule can use graph analysis technology to represent network events as nodes and edges in a graph, and identify potential attack links by analyzing the connection patterns between nodes. For example, if an IP address frequently appears in system logs and application logs and is associated with known attack behaviors, then this IP address may be the source of the attack. Through such association analysis, the behavior patterns of attackers can be revealed, providing powerful clues for the network security team.

[0069] In the embodiment of the present application, system logs, application logs, network traffic data, etc. are collected. Ensure that the data covers various network events, including but not limited to login attempts, file access, network requests, etc. Remove irrelevant information and redundant data, and handle missing values. Interpolation, deletion, or filling constants can be used. Convert the log data into a format suitable for graph analysis. For example, represent each event as a node in the graph, and the relationship between events as edges.

[0070] Furthermore, the node types in the node definition include IP address, user name, file path, application name, and timestamp, and the edge types in the edge definition include login attempt, file access, network request, and abnormal behavior.

[0071] For example, assume that there is the following log data:

[0072] System log: User user1 logged in from IP address 192.168.1.1.

[0073] Application Log: User user1 accessed the file / home / user1 / sensitive_file.txt.

[0074] Network traffic: IP address 192.168.1.1 sent an unusually large packet to external IP address 10.0.0.1.

[0075] Create nodes user1, 192.168.1.1, / home / user1 / sensitive_file.txt, 10.0.0.1.

[0076] Create edge user1->192.168.1.1 (login attempt)

[0077] Create edge user1-> / home / user1 / sensitive_file.txt (file access)

[0078] Create edge 192.168.1.1->10.0.0.1 (network request)

[0079] Frequently appearing IP addresses, count the number of times each IP address appears in the graph. If an IP address frequently appears in multiple events and is associated with known attack behaviors, then this IP address may be the source of the attack.

[0080] Abnormal behavior patterns: Analyze the connection patterns between nodes and look for abnormal behavior patterns. For example, if a certain IP address frequently accesses sensitive files and sends a large number of data packets, this may indicate an attack.

[0081] In an optional embodiment, a community detection algorithm (such as Louvain method) is used to identify communities in the graph. Nodes in a community may have similar behavior patterns, which helps to discover potential attack links.

[0082] In an optional embodiment, the centrality indexes of the nodes (such as degree centrality, betweenness centrality, and closeness centrality) are calculated to find the most important nodes in the graph. These nodes may be the key points of the attack.

[0083] It should be noted that the preset detection rules are dynamically updated, which means that the system can automatically adjust the detection rules according to the latest network attack trends and historical detection results. This adaptive detection mechanism can ensure that the detection system can always respond to the latest threats and improve the timeliness and effectiveness of network security protection. Through machine learning algorithms, the system can learn the patterns of attack behaviors and automatically adjust the detection strategy when similar patterns are detected, thereby achieving rapid response and defense against unknown attacks.

[0084] S300: Using the first detection data as training samples to train a first attack detection model.

[0085] In the application embodiment, the first attack detection model includes:

[0086] The first attack detection model inputs the first detection data, and outputs an arbitrary model of network malicious traffic and attack behavior patterns.

[0087] In an optional embodiment, the first attack detection model can be constructed using deep learning techniques, such as convolutional neural networks (CNN) or recurrent neural networks (RNN), to process and analyze large-scale network data. These models can automatically learn complex feature representations from data, thereby improving the ability to identify network attack behaviors. Through training, the model can identify the subtle differences between normal network behaviors and abnormal behaviors, and maintain a high detection rate even in the face of new types of attacks.

[0088] In an optional embodiment, the first attack detection model can also use a support vector machine (SVM) or a random forest algorithm, which performs well in processing classification problems and can effectively identify attack behaviors. In addition, the model can also integrate multiple algorithms to improve the accuracy of detection by taking advantage of their respective advantages. For example, ensemble learning methods such as gradient boosted decision trees (GBDT) or extreme random trees (ExtraTrees) can be used, which combine multiple weak learners to build a strong learner, thereby improving the generalization ability and robustness of the model.

[0089] In an optional embodiment, the first attack detection model can also adopt an attack detection method based on graph analysis technology. This method constructs a graph model of network events and represents the relationship between events in the form of a graph, so that potential attack links can be analyzed and identified more intuitively. In the graph model, nodes can represent various entities, such as IP addresses, user accounts, file paths, etc., while edges represent the interactive relationships between these entities, such as login attempts, file access, network requests, etc. By analyzing the patterns of nodes and edges, abnormal behaviors can be discovered, such as a node frequently appearing in multiple attack events, or the pattern of edges matching a known attack pattern.

[0090] In the application embodiment, an attack detection method based on graph analysis technology is used to establish a first attack detection model, which can identify abnormal behaviors and potential attack links in the network through graph analysis technology. For example, if a node appears frequently in the graph and is associated with known attack behaviors, then this node may be the key point of the attack. By analyzing the connection pattern between nodes, abnormal behavior patterns can be found. For example, a node frequently accesses sensitive files and sends a large number of data packets, which may indicate the presence of attack behavior. At this time, network malicious traffic and attack behavior patterns are output.

[0091] It should be noted that the model can effectively reveal the complex relationships between network events through graph analysis technology, thereby providing deeper insights into network security. For example, by identifying key nodes and key paths in the network, early warning and rapid response to potential attacks can be provided.

[0092] In an optional embodiment, the model can also learn the normal pattern of network traffic, thereby issuing an alarm when detecting behavior that deviates from the normal pattern, further enhancing the network's security protection capabilities. In practical applications, the model can be integrated into existing network security systems and work in conjunction with other security components such as firewalls and intrusion detection systems to jointly build a multi-level, comprehensive network security protection system.

[0093] S400: Acquire first attack samples of different types;

[0094] In the application embodiment, the first attack sample is subjected to a second preprocessing to obtain a second attack sample;

[0095] The first attack detection model is tested according to the second sample, and a second attack detection model is obtained.

[0096] In the application embodiment, different types of first attack samples include known malware, attack tools, and vulnerability exploitation information;

[0097] The first attack sample and the first detection data have an intersection;

[0098] The first detection data includes abnormal data in target network traffic, system logs, and application log data, and the abnormal data includes data generated when attacked and data generated when not attacked.

[0099] In an optional embodiment, different types of first attack samples may also include characteristic signatures of malicious traffic, lists of known attacker IP addresses, and records of phishing attempts. These samples can help the model learn various manifestations of attack behaviors, so that more types of threats can be identified during detection. However, considering the amount of computation, this application only selects data related to the target network traffic, system logs, and application log data, and relevant data other than the target network traffic, system logs, and application log data has been removed during the second preprocessing process.

[0100] In an optional embodiment, the attacker's attack activities are converted into a mathematical model that can be quantified and analyzed. Generally speaking, hierarchical models, probabilistic finite state machines and other models can be used to describe the attacker's activities, so as to determine the attacker's goals, behaviors, and strategies. The modeling of the attacked network structure is a description of the network security model to correctly simulate various attack scenarios in the network. The relevant data of these scenarios is the first attack sample.

[0101] In the application embodiment, the first attack detection model is tested according to the second sample, and the second attack detection model is obtained including:

[0102] If the result of testing the first attack detection model according to the second sample is satisfied, the first attack detection model is used as the second attack detection model;

[0103] If the result of testing the first attack detection model according to the second sample is not satisfied, the first attack detection model is retrained, and the training sample of the retrained first attack detection model is a new data set composed of the first detection data and the second sample.

[0104] In the application embodiment, the new data set includes: the training set in the new data set at least includes all the second samples.

[0105] In an optional embodiment, assuming that there is already a preliminarily trained first attack detection model, which can predict whether there is an attack behavior based on the input network event data, a new set of sample data, called the second sample, is collected. The sample data contains known normal behaviors and attack behaviors and is used to test the performance of the first attack detection model.

[0106] Furthermore, in the application embodiment, the second sample is used to test the first attack detection model to evaluate the model's accuracy, recall rate, F1 score and other indicators.

[0107] Furthermore, if the test result shows that the performance of the first attack detection model meets the predetermined standard (for example, the accuracy rate reaches above 95%), the first attack detection model can be directly used as the second attack detection model.

[0108] If the test results show that the performance of the first attack detection model does not meet the predetermined standard (for example, the accuracy is lower than 95%), the model needs to be retrained.

[0109] Furthermore, the new data set is composed of the first detection data (ie, the original training data) and the second samples, and it is ensured that the training set in the new data set at least includes all the second samples to ensure that the model can learn the latest attack patterns.

[0110] Furthermore, the first attack detection model is retrained using the new data set to generate a second attack detection model.

[0111] Furthermore, an independent validation set is used to verify the second attack detection model to ensure that its performance meets the expected standards, and the verified second attack detection model is deployed in the production environment for real-time detection of network attacks.

[0112] Exemplarily, a new set of sample data is collected, including 1,000 known normal behavior samples and 1,000 known attack behavior samples.

[0113] The first attack detection model was tested using these 2,000 samples, and the following results were obtained: accuracy: 90%, recall: 85%, and F1 score: 87%.

[0114] Furthermore, since the accuracy is less than 95%, the model needs to be retrained.

[0115] Furthermore, the first detection data includes 5000 normal behavior samples and 5000 attack behavior samples.

[0116] Furthermore, the second sample collected 1,000 normal behavior samples and 1,000 attack behavior samples.

[0117] Furthermore, the new dataset contains a total of 6,000 normal behavior samples and 6,000 attack behavior samples, ensuring that all second samples are included in the new training set.

[0118] Furthermore, the first attack detection model is retrained using the new data set to generate a second attack detection model.

[0119] Furthermore, the second attack detection model was verified using an independent validation set (e.g., 1000 normal behavior samples and 1000 attack behavior samples), and the following results were obtained: accuracy: 96%, recall: 92%, and F1 score: 94%.

[0120] Furthermore, the verified second attack detection model is deployed in the production environment for real-time detection of network attacks.

[0121] In an optional embodiment, the attack trace detection technology is studied, and different attack samples and test tools are used to simulate attacks, and the collected trace data is tested to test the ability and accuracy of the attack trace detection model to detect attack traces in real time. The APT advanced threat intrusion detection technology is studied, and trace data is collected from the terminal to provide real-time data input for the advanced threat intrusion detection model. For the real-time detection results of the model, false positive and false negative tests are performed to evaluate the accuracy of the model; behavior-based alarm research, behavior-based alarm provides a more flexible and fine-grained security monitoring method that can identify unknown attack behaviors and variant attacks. It does not rely on known attack signatures, but detects potential attack behaviors by focusing on behavior patterns, behavior sequences, and abnormal behaviors. This method can help improve the detection capability of unknown attacks and provide better network and system security; based on the alarm research of the loss indicator, the alarm based on the loss indicator provides a method to quickly identify security incidents or system losses that have occurred. It relies on a known loss indicator library to detect known attack patterns and malicious behaviors by matching these indicators. This method can help to detect and respond to security incidents that have occurred early, reduce potential losses, and provide better network and system security protection. At the same time, timely updating and sharing of compromise indicator libraries is also key to ensure that the system can respond to new attacks and threats in a timely manner; ATT&CK is a knowledge base developed and maintained by MITRE Corporation, designed to help security teams understand and respond to various threat behaviors and attack techniques. ATT&CK classifies and organizes attack techniques to help security teams better understand and identify techniques and methods that attackers may use. It provides a hierarchical structure to describe the behavior of attackers at different stages and levels, divided into 14 tactical points and several technical points in each tactical point. It has become a de facto standard in the security industry; IOA is an indicator or sign used to detect and identify network attacks, used to indicate signs of possible attack activities. IOA focuses more on the behavior and activities of attacks, not just the results or consequences of attacks. Based on the understanding of the attacker's behavior patterns and attack processes, IOA identifies behavioral indicators that match known attack patterns by monitoring and analyzing network traffic, system logs, event data, etc. Common IOAs include abnormal login behavior, malicious file transfer, command injection, lateral movement and other attack behavior indicators. In the attack trace detection model, a behavior detection engine is built to detect trace data based on the tactical and technical point framework of ATT&CK, identify attack traces and generate IOA alerts; IOC is an alert based on compromise indicators. Common IOCs include hash values, IP addresses, domain names, URLs, etc. of malicious files. In the attack trace detection model, a compromise detection engine is built to detect trace data based on the self-developed threat intelligence library, identify attack traces and generate IOC alerts.

[0122] In summary, the present invention proposes a method for detecting network security attack traces, obtaining a first historical parameter of a target network, and performing a first preprocessing on the first historical parameter to obtain a second historical parameter; presetting a first detection rule, detecting the second historical parameter, and recording the detected data as the first detection data; the first detection rule includes a first malicious traffic detection rule and a first association detection rule; using the first detection data as a training sample to train a first attack detection model. This method can effectively identify and analyze network attack behaviors, thereby providing more accurate defense measures for network security. It can also automatically update detection rules and models based on the detected attack traces to adapt to the ever-changing network attack patterns. An efficient data processing process is designed to reduce manual intervention, improve detection efficiency, and reduce false alarm rates. It also has good scalability and can support a variety of network environments and networks of different sizes to meet the needs of different users.

[0123] This embodiment also provides a network security attack trace detection system, including:

[0124] A data processing module, used for acquiring a first historical parameter of a target network, and performing a first preprocessing on the first historical parameter to obtain a second historical parameter;

[0125] A data acquisition module, used for presetting a first detection rule, detecting the second historical parameter, and recording the detected data as first detection data;

[0126] The first detection rule includes a first malicious traffic detection rule and a first association detection rule;

[0127] The model building module is used to train a first attack detection model by using the first detection data as a training sample.

[0128] The above-mentioned unit modules may be embedded in or independent of a processor in a computer device in the form of hardware, or may be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to the above-mentioned modules.

[0129] This embodiment also provides a computer device, which may be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen, and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, an operator network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a method for detecting traces of network security attacks is implemented. The display screen of the computer device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device may be a touch layer covered on the display screen, or a button, a trackball or a touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse, etc.

[0130] This embodiment further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented:

[0131] Acquire a first historical parameter of the target network, and perform a first preprocessing on the first historical parameter to obtain a second historical parameter;

[0132] Preset a first detection rule, detect the second historical parameter, and record the detected data as first detection data;

[0133] The first detection rule includes a first malicious traffic detection rule and a first association detection rule;

[0134] The first detection data is used as a training sample to train a first attack detection model.

[0135] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

[0136] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code. The scheme in the embodiments of the present application can be implemented in various computer languages, for example, object-oriented programming language Java and literal scripting language JavaScript, etc.

[0137] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0138] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0139] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0140] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0141] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A network security attack trace detection method, characterized in that: include: Acquire a first historical parameter of the target network, and perform a first preprocessing on the first historical parameter to obtain a second historical parameter; Preset a first detection rule, detect the second historical parameter, and record the detected data as first detection data; The first detection rule includes a first malicious traffic detection rule and a first association detection rule; The first detection data is used as a training sample to train a first attack detection model.

2. The network security attack trace detection method according to claim 1, characterized in that: Also includes: Obtain different types of first attack samples; performing a second preprocessing on the first attack sample to obtain a second attack sample; The first attack detection model is tested according to the second sample to obtain a second attack detection model.

3. The network security attack trace detection method according to claim 2, characterized in that: The first attack detection model includes: The first attack detection model inputs the first detection data, and outputs an arbitrary model of network malicious traffic and attack behavior patterns.

4. The network security attack trace detection method according to claim 3, characterized in that: The different types of first attack samples include known malware, attack tools, and vulnerability exploitation information; The first attack sample and the first detection data have an intersection; The first detection data includes abnormal data in target network traffic, system logs, and application log data, and the abnormal data includes data generated when attacked and data generated when not attacked.

5. The network security attack trace detection method according to claim 4, characterized in that: The acquiring the first historical parameter of the target network and performing a first preprocessing on the first historical parameter to obtain the second historical parameter includes: The first historical parameter includes at least target network traffic, system log, and application log data; The first preprocessing at least includes extracting features from the first historical parameters.

6. The network security attack trace detection method according to claim 5, characterized in that: The step of testing the first attack detection model according to the second sample and obtaining the second attack detection model includes: If the result of testing the first attack detection model according to the second sample is satisfied, the first attack detection model is used as the second attack detection model; If the result of testing the first attack detection model according to the second sample is not satisfied, the first attack detection model is retrained, and the training sample of the retrained first attack detection model is a new data set composed of the first detection data and the second sample.

7. The network security attack trace detection method according to claim 6, characterized in that: The new data set includes: a training set in the new data set at least includes all second samples.

8. A network security attack trace detection system, characterized in that: include: A data processing module, used for acquiring a first historical parameter of a target network, and performing a first preprocessing on the first historical parameter to obtain a second historical parameter; A data acquisition module, used for presetting a first detection rule, detecting the second historical parameter, and recording the detected data as first detection data; The first detection rule includes a first malicious traffic detection rule and a first association detection rule; The model building module is used to train a first attack detection model by using the first detection data as a training sample.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images