Detection method and device, equipment and storage medium

Abstract

The embodiment of the invention provides a detection method and device. The method comprises the steps that a selected target detection instruction is determined in a preset instruction set; the preset instruction set comprises a plurality of detection instructions, and each detection instruction is used for detecting an attack means for network attacks; performing kernel executable instruction conversion processing on the target detection instruction to obtain a first control instruction corresponding to the target detection instruction; according to the first control instruction, controlling the kernel to execute the following operations to obtain a detection result of the target detection instruction: collecting a data packet passing through the network interface; and according to the data packet, performing detection processing on the target attack means indicated by the target detection instruction to obtain a detection result, so as to improve the detection flexibility and save detection resources in allusion to a specific network attack means.

Description

Technical Field

[0001] This document relates to the field of data processing technology, and in particular to a detection method and device. Background Art

[0002] With the rapid development of Internet technology, the importance of network security and performance management is growing. Detection of network traffic data is an important means to ensure network security, optimize resource allocation, and prevent abnormal behavior.

[0003] Taking the system as an example, during the operation of the system, by detecting network traffic data, the network attacks suffered by the system can be discovered in time, so as to take countermeasures against network attacks and ensure the network security of the system. However, in actual applications, if the network traffic data is continuously detected, the long-term detection work is likely to consume a lot of computing resources, but network attacks are likely not so frequent, which makes the detection waste more resources and the detection flexibility is poor. Summary of the invention

[0004] The purpose of an embodiment of the present specification is to provide a detection method and device to solve the problem of how to target specific network attack methods while improving detection flexibility and saving detection resources.

[0005] To solve the above technical problems, an embodiment of this specification is implemented as follows: In a first aspect, an embodiment of the present specification provides a detection method, comprising: Determining a selected target detection instruction in a preset instruction set; the preset instruction set includes a plurality of detection instructions, wherein each detection instruction is used to detect an attack method used for a network attack; Converting the target detection instruction into a kernel executable instruction to obtain a first control instruction corresponding to the target detection instruction; According to the first control instruction, the control core performs the following operations to obtain the detection result of the target detection instruction: Collect data packets passing through the network interface; According to the data packet, the target attack means indicated by the target detection instruction is detected and processed to obtain the detection result.

[0006] In a second aspect, another embodiment of the present specification provides a detection device, comprising: A determination unit, configured to determine a selected target detection instruction in a preset instruction set; the preset instruction set includes a plurality of detection instructions, wherein each detection instruction is used to detect an attack method used for a network attack; A conversion unit, configured to convert the target detection instruction into a kernel executable instruction to obtain a first control instruction corresponding to the target detection instruction; A control unit is used to control the kernel to perform the following operations according to the first control instruction to obtain a detection result of the target detection instruction: Collect data packets passing through the network interface; According to the data packet, the target attack means indicated by the target detection instruction is detected and processed to obtain the detection result.

[0007] In a third aspect, another embodiment of the present specification provides a detection device, comprising: a memory, a processor, and computer executable instructions stored in the memory and executable on the processor, wherein the computer executable instructions, when executed by the processor, implement the steps of the detection method described in the first aspect above.

[0008] In a fourth aspect, another embodiment of the present specification provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store computer-executable instructions, and when the computer-executable instructions are executed by a processor, the steps of the detection method described in the first aspect above are implemented.

[0009] The detection method provided in this embodiment, first, determines the selected target detection instruction in the preset instruction set; the preset instruction set includes multiple detection instructions, each of which is used to detect an attack means for network attack; then, the target detection instruction is converted into a kernel executable instruction to obtain a first control instruction corresponding to the target detection instruction; finally, according to the first control instruction, the kernel is controlled to perform the following operations to obtain the detection result of the target detection instruction: collect data packets passing through the network interface; according to the data packets, the target attack means indicated by the target detection instruction is detected and processed to obtain the detection result. In this way, the target detection instruction is a detection instruction selected from the multiple detection instructions included in the preset instruction set. By determining the selected target detection instruction in the preset instruction set, the detection can be flexibly started for the specific attack means when there is a specific network attack means detection requirement; on the other hand, the target detection instruction is converted into a first control instruction that can be used to control the kernel, and the kernel is controlled to collect data packets according to the first control instruction and detect the target attack means according to the data packets. In this way, there is no need to collect data packets continuously for a long time, which is more conducive to saving the computing resources consumed by the detection. In summary, the detection method provided in this embodiment can target specific network attack methods while improving detection flexibility and saving detection resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the technical solutions in one or more embodiments of the present specification, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0011] Figure 1 A processing flow chart of a detection method provided in one embodiment of this specification; Figure 2 Another detection method processing flow chart provided for one embodiment of this specification; Figure 3 A system interaction diagram provided for one embodiment of this specification; Figure 4 A processing flow chart of the preparatory work of a detection method provided in one embodiment of this specification; Figure 5 A processing flow chart of another detection method provided in one embodiment of this specification; Figure 6 A schematic diagram of a detection device provided for one embodiment of this specification; Figure 7 A schematic diagram of the structure of a detection device provided in one embodiment of this specification. DETAILED DESCRIPTION

[0012] In order to enable those skilled in the art to better understand the technical solutions in one or more embodiments of this specification, the technical solutions in one or more embodiments of this specification will be clearly and completely described below in conjunction with the drawings in one or more embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. Based on one or more embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this document.

[0013] This specification provides a detection method embodiment: Reference Figure 1 The detection method provided in this embodiment specifically includes the following steps S102 to S106.

[0014] Step S102, determining a selected target detection instruction in a preset instruction set; the preset instruction set includes a plurality of detection instructions, wherein each detection instruction is used to detect an attack method used for a network attack.

[0015] Before executing step S102, some preparations may be done in advance.

[0016] In the process of executing the detection method provided by one or more embodiments of the present application, the preparation work is exemplarily described by taking the network detection system as the execution subject of the detection method as an example.

[0017] The network detection system may include an application layer, a transit layer, and a kernel layer, and the preparation work may be to initialize the components of the application layer, the transit layer, and the kernel layer. When the system starts, the system will automatically load the programming library files that the necessary functions of the application layer, the transit layer, and the kernel layer need to rely on during the initialization process to ensure that the network detection system is ready.

[0018] The structural names "application layer", "transit layer" and "kernel layer" included in the above-mentioned network detection system are merely exemplary. In actual applications, system layers with the same or similar functions can also be used to replace one or more of the application layer, transit layer and kernel layer.

[0019] The application layer is a layer in the computer network architecture, usually located at the top of the network protocol stack. It is the interface between the user and the network, responsible for providing network services and communication between applications. The main functions of the application layer include data formatting, encryption, decryption, user authentication, session management, etc.

[0020] The application layer is responsible for providing the interface between users and the network, as well as the communication between applications. The application layer is the network service layer that users can directly access, providing users with rich network functions and application experience.

[0021] The application layer lowers the technical threshold for network detection, allowing non-professional users to manage the network. The application layer components can provide users with a calling interface or an intuitive interactive interface to help users configure and detect network status.

[0022] The kernel layer is the core part of the operating system, responsible for managing system resources, providing basic services, and controlling hardware devices. It interacts directly with the hardware and provides abstractions and interfaces for upper-layer applications. The main functions of the kernel layer include process management, memory management, file system management, device management, network management, interrupt and exception handling, and system call interface. The types of kernel layers include single kernel, microkernel, hybrid kernel, and exokernel. Through the kernel layer, the operating system can efficiently, safely, and stably manage system resources and hardware devices, and provide a reliable operating environment for applications.

[0023] Kernel layer components can directly interact with the underlying network hardware interface to obtain network status and traffic data. The kernel layer can achieve high-performance packet capture and analysis, and provide real-time network detection capabilities. Kernel layer components usually run at the core of the operating system, can efficiently process network data, and provide stable detection services.

[0024] The transit layer can be a system layer located between the application layer and the kernel layer. The transit layer components can be used to transfer data between the application layer and the kernel layer to ensure data transmission and command execution. The transit layer can be used to forward data between the application layer and the kernel layer to ensure that the detection request of the application layer can be correctly passed to the kernel layer, and return the network traffic data collected by the kernel layer to the application layer for further processing and display.

[0025] The preset instruction set may include multiple detection instructions, wherein each detection instruction is used to detect an attack method used for network attack.

[0026] Cyber ​​attack refers to malicious operations against computer systems, network infrastructure, data or users through network means. The goal of cyber attacks is usually to gain unauthorized access, damage systems, steal sensitive information, interrupt services or conduct other forms of malicious activities. The means and techniques of cyber attacks are very diverse.

[0027] Exemplarily, attack methods used for network attacks include but are not limited to: replay attacks, denial of service attacks, buffer overflows, and remote procedure call attacks.

[0028] Among them, replay attack is a network attack method in which the attacker captures and resends the communication data packets of legitimate users to deceive the system or gain unauthorized access. Replay attacks usually exploit vulnerabilities in communication protocols. The attacker does not need to crack encryption or decrypt data, but can simply replay the captured data packets to achieve the attack purpose.

[0029] A denial of service attack is a network attack in which the attacker sends a large number of requests or traffic to the target system, overloading the target system and causing the service to become unavailable. The goal of a denial of service attack is usually to make the target system unable to provide services normally, affecting user experience and business continuity.

[0030] Buffer overflow is a common software security vulnerability. An attacker writes data exceeding the capacity of a program's buffer, causing the data to overwrite adjacent memory areas, thereby disrupting the normal execution flow of the program or even executing malicious code.

[0031] RPC (Remote Procedure Call) is a computer communication protocol that allows programs to execute code in different address spaces, just like calling local functions. RPC attacks are attacks that exploit vulnerabilities or improper configurations in the RPC protocol to perform malicious operations on the system or gain unauthorized access.

[0032] The above-mentioned methods of network attack are merely exemplary.

[0033] Each detection instruction in the preset instruction set may be pre-configured for some common attack methods. For example, the preset instruction set includes detection instruction 1, detection instruction 2, and detection instruction 3. Among them, detection instruction 1 is used to detect an attack method "replay attack", detection instruction 2 is used to detect an attack method "denial of service attack", detection instruction 3 is used to detect an attack method "PRC attack", and so on.

[0034] In specific implementation, the application layer in the network detection system can determine the selected target detection instruction in the preset instruction set. In the preset instruction set, each detection instruction can be a functional instruction of the application layer related to network traffic detection.

[0035] The application layer can be used to process user input and requests. Determining the selected target detection instruction in the preset instruction set can be to determine the target detection instruction selected by the user in the preset instruction set according to the user input.

[0036] For example, the system interface viewable by the user shows controls of three functional instructions, control 1 is used to trigger detection instruction 1, control 2 is used to trigger detection instruction 2, and control 3 is used to trigger detection instruction 3. After the user clicks control 2 in the system interface, the network detection system can determine detection instruction 2 as the target detection instruction selected by the user according to the user input.

[0037] The selected target detection instruction is determined in the preset instruction set, and the selected target detection instruction is determined in the preset instruction set when it is detected that a preset detection trigger condition is met.

[0038] For example, the pre-configured detection trigger condition 1 is: when the time reaches 9 o'clock every day, the network detection system automatically triggers the detection instruction 1.

[0039] For another example, the pre-configured detection trigger condition 2 is: after the network detection system receives the alarm information, if it is determined that there is a risk based on the analysis result of the alarm information, the network detection system automatically triggers the detection instruction 2.

[0040] The preset detection trigger conditions can be customized according to needs, and this manual does not impose any special restrictions on this.

[0041] In a specific implementation method, a selected target detection instruction is determined in a preset instruction set, including: determining the risk level of the business to be processed; when the risk level is greater than a preset level threshold, querying the target attack means corresponding to the business to be processed in the correspondence between the pre-configured business type and the attack means according to the target business type of the business to be processed; and determining the detection instruction indicating the target attack means in the preset instruction set as the target detection instruction.

[0042] The pending business can be any business that has not been processed yet.

[0043] For example, the pending business may be a limited-time promotion activity initiated by the transaction business platform, or the pending business may be an identity verification business, and so on.

[0044] Determining the risk level of the pending business may include reading a pre-configured risk level of the pending business from configuration information of the pending business.

[0045] Determining the risk level of the pending business may also be to conduct a risk assessment on the pending business to obtain the risk level of the pending business.

[0046] Risk level refers to a method of quantifying and classifying risks, which is used to evaluate and describe the size, severity or potential impact of risks. Specifically in this implementation, the risk level of the pending business can be used to describe the risk of the pending business being attacked by a network during operation. For example, the higher the risk level, the higher the possibility that the pending business will be attacked by a network during operation; the lower the risk level, the lower the possibility that the pending business will be attacked by a network during operation.

[0047] After the risk level is determined, the risk level may be numerically compared with a preset level threshold to obtain a comparison result.

[0048] If the risk level is greater than the preset level threshold, it can be regarded that the pending business may be greatly affected by the network attack during its operation, and it is necessary to detect the attack means before the pending business is run. Specifically, the target attack means corresponding to the pending business can be queried in the pre-configured correspondence between the business type and the attack means according to the target business type of the pending business; if the risk level is less than or equal to the preset level threshold, it can be regarded that the pending business is almost not affected by the network attack, and there is no need to detect the attack means before the pending business is run.

[0049] The correspondence between business types and attack methods can be customized.

[0050] For example, each service of service type 1 has the characteristic of a large number of participating users. In order to avoid service downtime, it is necessary to detect whether there is an attack method "denial of service attack". The corresponding relationship between service type 1 and the attack method "denial of service attack" can be established in advance.

[0051] According to the target service type of the service to be processed, the target attack means corresponding to the service to be processed is queried in the pre-configured correspondence between the service type and the attack means.

[0052] For example, the pre-configured correspondence between service types and attack methods includes: Business type 1<——>attack method 1; Business type 2<——>Attack method 1; Business type 3<——>attack method 2, and so on.

[0053] The service type of the service to be processed is "service type 2". According to "service type 2", the target attack means corresponding to the service to be processed is searched in the aforementioned correspondence between service types and attack means to obtain "attack means 1".

[0054] The preset instruction set may include detection instructions, each detection instruction is used to detect an attack method. Determining the detection instruction indicating the target attack method in the preset instruction set as the target detection instruction may be to query the detection instruction used to detect the target attack method in the preset instruction set according to the target attack method to obtain the target detection instruction.

[0055] By determining the target attack means corresponding to the pending business before it runs, and then determining the target detection instruction indicating the target attack means in the preset instruction set, personalized attack means detection can be performed for the business that is about to start running, to prevent problems before they occur and reduce business operation risks.

[0056] Step S104 , converting the target detection instruction into a kernel executable instruction to obtain a first control instruction corresponding to the target detection instruction.

[0057] Kernel executable instructions are the machine instructions contained in the operating system kernel.

[0058] The kernel is the core part of the operating system, responsible for managing system resources, providing basic services, and controlling hardware devices. The kernel is the part of the operating system closest to the hardware, interacting directly with the hardware and providing abstractions and interfaces for upper-level applications.

[0059] In addition, it should be noted that the aforementioned kernel layer is not the same as the kernel: the kernel layer is a specific level or module in the kernel, responsible for implementing specific functions or services. The kernel contains multiple kernel layers, and the kernel layer is part of the kernel. Through the kernel layer, the kernel provides interfaces and abstractions with other system components, allowing applications to access the functions provided by the kernel through a unified interface.

[0060] In specific implementation, the application layer may send the target detection instruction to the transit layer, and the transit layer executes step S104, that is, the transit layer converts the target detection instruction into a kernel executable instruction to obtain a first control instruction corresponding to the target detection instruction.

[0061] In some implementations, the transit layer converts the target detection instruction into a kernel executable instruction to obtain a first control instruction corresponding to the target detection instruction. This can be understood as: the target detection instruction reflecting the user's actual functional requirement request is converted into a command that the kernel layer can directly execute and understand, i.e., the first control instruction, through the transit layer. The conversion of the kernel executable instruction means that each instruction of the application layer has a corresponding application layer function interface, and by establishing a mapping relationship between the application layer function interface and the system call number, there is a one-to-one correspondence between the application layer function interface and the kernel executable instruction identified by the system call number, and then, the application layer instructions can be converted into kernel executable instructions according to the one-to-one correspondence. In this way, it is possible to manipulate the kernel executable instructions through the application layer instructions.

[0062] The above system call number is a set of identifiers provided by the operating system kernel to the application program to identify different system calls. When the application program requests the kernel layer to perform a specific operation through the system call interface, it needs to specify a system call number. The kernel layer searches for the corresponding kernel executable instruction based on the system call number and executes it.

[0063] For example, a mapping relationship between the application layer function interface and the system call number is established in advance, including: Function interface 1<——>system call number 1; Function interface 2<——>system call number 2; Function interface 3<——>system call number 3, and so on.

[0064] Among them, the functional interface 1 of the application layer corresponds to the detection instruction 1 in the preset instruction set; the functional interface 2 of the application layer corresponds to the detection instruction 2 in the preset instruction set; and the functional interface 3 of the application layer corresponds to the detection instruction 3 in the preset instruction set.

[0065] In the process of converting the target detection instruction into a kernel executable instruction to obtain the first control instruction corresponding to the target detection instruction, assuming that the target detection instruction is "detection instruction 2", the "detection instruction 2" can be converted into "system call number 2" according to the aforementioned mapping relationship, and then, "system call number 2" can be used by the kernel to search for the corresponding kernel executable instruction and execute it. The first control instruction can be the kernel executable instruction corresponding to "system call number 2".

[0066] In other implementations, there may be a pre-established correspondence between an application layer function interface and one or more kernel executable instructions. In the case where there is a correspondence between an application layer function interface and multiple kernel executable instructions, the multiple kernel executable instructions may respectively use different detection methods to detect the same attack method for network attacks.

[0067] For example, function interface 1<——> system call number 1; Function interface 1<——>system call number 2; Function interface 1<——>system call number 3; Function interface 2 <——> system call number 4, and so on.

[0068] Among them, system call number 1 can be used by the kernel to search for and execute the corresponding kernel executable instruction 1, system call number 2 can be used by the kernel to search for and execute the corresponding kernel executable instruction 2, and system call number 3 can be used by the kernel to search for and execute the corresponding kernel executable instruction 3. Kernel executable instruction 1 can detect attack means 1 through the first detection method, kernel executable instruction 2 can detect attack means 1 through the second detection method, and kernel executable instruction 3 can detect attack means 1 through the third detection method.

[0069] Different types of detection methods may be applicable to different interfaces.

[0070] For example, the amount of data passing through the first interface is in a first numerical range, and the amount of data passing through the second interface is in a second numerical range. According to the amount of data passing through each interface, it can be determined that the first detection method is applicable to the first interface, and the second detection method is applicable to the second interface.

[0071] For another example, the interface type of the first interface is the first interface type, and the interface type of the second interface is the second interface type. According to the interface types of the respective interfaces, it can be determined that the first detection method is applicable to the first interface, and the second detection method is applicable to the second interface.

[0072] Therefore, the interface parameters can be used to select a detection mode that is most suitable for the current interface from multiple detection modes.

[0073] The target detection instruction may carry an interface identifier, in which case the target detection instruction is converted into a kernel executable instruction to obtain a first control instruction corresponding to the target detection instruction. Alternatively, the target function interface corresponding to the target detection instruction is determined, and one or more kernel executable instructions corresponding to the target interface are determined based on the correspondence between the target function interface and a pre-established function interface and the kernel executable instruction, and interface parameters of the corresponding interface are obtained based on the interface identifier, and one or more kernel executable instructions corresponding to the target interface are selected based on the interface parameters to obtain the first control instruction corresponding to the target detection instruction.

[0074] Step S106, according to the first control instruction, the control kernel performs the following operations to obtain the detection result of the target detection instruction: collect data packets passing through the network interface; according to the data packets, detect and process the target attack means indicated by the target detection instruction to obtain the detection result.

[0075] The first control instruction may be a control instruction that is recognizable and executable by the kernel.

[0076] When the kernel receives the first control instruction, it performs the following operations: collecting data packets passing through the network interface; and detecting and processing the target attack means indicated by the target detection instruction according to the data packets to obtain the detection result.

[0077] Data packets are the basic unit of data transmission in computer networks. When data packets are transmitted in the network, they are divided into multiple small data blocks, each of which is called a data packet. Data packets contain the data to be transmitted and control information, such as source address, destination address, protocol type, checksum, etc. Data packets are encapsulated and decapsulated through the network protocol stack and finally transmitted in the network.

[0078] A network interface is a physical or logical connection point between a computer or network device and a network. Network interfaces allow devices to send and receive packets and communicate with other devices. Network interfaces can be hardware devices, such as network cards, or they can be software implementations, such as virtual network interfaces, which play a key role in network communications.

[0079] Collecting data packets passing through a network interface can be understood as capturing data packets passing through a network interface using a packet capture tool.

[0080] According to the data packet, the target attack means indicated by the target detection instruction is detected and processed to obtain the detection result. The data packet can be analyzed and processed to obtain the analysis result of the data packet, and the target attack means is detected and processed according to the analysis result to obtain the detection result.

[0081] A packet analysis module can be pre-created in the kernel layer. The packet analysis module can match and identify abnormal behaviors or potential security threats in network traffic based on predefined rules or patterns.

[0082] For example, when performing packet acquisition operations, the scapy framework is used to capture packets passing through the network interface. The system defines a packet processing callback function that is used to analyze and output the source MAC (Media Access Control Address, Media Access Control Address) address, destination MAC address, source IP (Internet Protocol) address, and destination IP address of each captured packet in real time. These addresses can be used as a reference for identifying abnormal behavior or potential security threats in network traffic.

[0083] The above-mentioned Scapy is a network packet processing tool that can be used to create, send, parse, capture network data packets and interact with network protocols.

[0084] In addition, the kernel layer can also support historical records and trend analysis of traffic statistics, and can generate reports or visual displays. Specifically, the kernel layer can capture inbound and outbound data packets through the HOOK function and use the statistical structure provided by the kernel to record traffic data.

[0085] In some implementations, the detection method further includes: performing traffic statistics processing on the data packets to obtain traffic statistics results, and performing trend analysis processing on the data packets to obtain trend analysis results; and visually displaying the traffic statistics results and trend analysis results.

[0086] HOOK refers to the technical operation of intercepting, tampering or monitoring functions or methods in the field of software development or security. Through HOOK technology, you can intercept the call of a specified function when the program is running, modify its parameters, monitor or replace the return value, etc., so as to achieve control over the target program.

[0087] In a specific implementation method, the target detection instruction carries a network interface identifier; data packets passing through the network interface are collected, including: determining the corresponding target network interface based on the network interface identifier; obtaining status information of the target network interface; and collecting data packets passing through the target network interface when the status information meets a preset status condition.

[0088] The target network interface participating in data packet collection can be specified through a target detection instruction. For example, the application interface displays multiple interface options, and the user actively checks one or more of them, and then clicks the button "Detect replay attack". In this way, the target detection instruction will carry the network interface identifier corresponding to the checked interface option.

[0089] In addition, an interface set may be preconfigured as the maximum detection range for the detection of attack means, and the maximum detection range may be represented by a corresponding identifier, such as "all". In this way, if the detection is for a single interface, the target detection instruction may carry the network interface identifier of a single interface. For example, the target detection instruction carries the network interface identifier "001", and the network interface 1 identified by "001" is determined as the target network interface. If the user selects multiple interfaces at the same time (but not all interfaces in the interface set), the target detection instruction may carry the network interface identifier of each of the multiple interfaces. For example, the target detection instruction carries the network interface identifier "001, 002, 003", and the network interface 1 identified by "001", the network interface 2 identified by "002", and the network interface 3 identified by "003" are all determined as target network interfaces. If all interfaces in the interface set participate in the detection, the target detection instruction may carry "all", and each network interface in the interface set is determined as the target network interface. In this way, the kernel can use the network interface identifier to determine which network interfaces to collect data packets.

[0090] In addition, it can also be pre-configured that if the network interface identifier in the target detection instruction is empty, that is, the target detection instruction does not carry any network interface identifier, then the aforementioned target detection instruction carries the network interface identifier "all" and each network interface in the interface set is determined as the target network interface.

[0091] There is a corresponding relationship between the network interface identifier and the network interface, and the network interface identifier can be used to determine the corresponding network interface.

[0092] According to the network interface identifier, the target network interface corresponding to the network interface identifier can be determined. The target network interface can be regarded as the network interface indicated by the target detection instruction for executing the data packet collection operation.

[0093] When the target network interface is determined and the state information of the target network interface meets the preset state condition, all data packets passing through the target network interface can be collected, or a portion of data packets passing through the target network interface that meet the collection conditions of the target detection instruction can be collected.

[0094] The status information of the network interface refers to the various properties and states of the network interface in the operating system, including connection status, transmission rate, error rate, IP address configuration, network protocol configuration, etc. This status information can help users understand the working status of the network interface, diagnose network problems, and optimize network performance.

[0095] For example, the target network interface is “wireless network interface 1”, and the status information of the target network interface includes a network service set identifier, a signal strength, or a MAC address.

[0096] When the status information meets the preset status conditions, the data packets passing through the target network interface can be collected; when the status information does not meet the preset status conditions, a prompt information can be generated, which is used to prompt the user that the target network interface is not suitable for performing data packet collection operations.

[0097] Preset status conditions can be custom configured.

[0098] For example, if the target network interface is determined to be in a working state according to the state information of the target network interface, in which case there is a data packet passing through the target network interface, then it is determined that the state information meets the preset state condition. Conversely, if the target network interface is determined to be in a non-working state according to the state information of the target network interface, in which case there is no data packet passing through the target network interface, then it is determined that the state information does not meet the preset state condition.

[0099] For another example, the state information of the target network interface includes a packet loss rate. If the packet loss rate is less than or equal to a preset probability threshold, it is determined that the state information meets the preset state condition. On the contrary, if the packet loss rate is greater than the preset probability threshold, it is determined that the state information does not meet the preset state condition.

[0100] By first obtaining the status information of the target network interface and then performing data packet collection operations on the target network interface, network interface anomalies can be discovered in a timely manner and ineffective packet capture operations can be reduced.

[0101] In a specific implementation, obtaining the state information of the target network interface includes: determining a target functional component corresponding to the target network interface among multiple functional components of the kernel; and obtaining the state information of the target network interface through the target functional component.

[0102] Among the multiple functional components of the kernel, each functional component can be a component pre-established in the kernel layer and can be used to perform a specific function.

[0103] Exemplarily, the kernel layer may include a system call component, a driver component, and a system file component.

[0104] The system call component allows user space applications to query the status of the network interface or change its configuration by implementing the ioctl system call. The ioctl (Input / Output Control) system call is a mechanism used in Unix and Unix-like operating systems for communication between device drivers and user space programs. The ioctl system call allows user space programs to send control commands to device drivers to perform specific operations or obtain device status information. The ioctl system call is usually used to handle device-specific control operations, such as configuring device parameters, obtaining device status, and performing device operations.

[0105] Driver file components can be used to directly communicate and control hardware devices. Driver files are software components in the kernel layer used for specific hardware device interfaces. This type of file allows the operating system to identify and use various hardware devices, such as network device driver files, which are used to control network interface cards to send and receive data packets.

[0106] The system file component can obtain the structure and status information of the network interface, such as the MAC address and IP address of the interface, by accessing the struct_net_device structure.

[0107] Among the multiple functional components of the kernel, determining the target functional component corresponding to the target network interface can be performed by selecting and processing among the multiple functional components according to the target network interface to obtain the target functional component.

[0108] For example, each functional component may be used to obtain status information, but each functional component is suitable for different scenarios. The scenario in which the target network interface is located matches functional component 1, so functional component 1 can be selected as the target functional component.

[0109] Obtain the status information of the target network interface through the target functional component.

[0110] Next, we take the target functional component as a system call component as an example to illustrate how to obtain the status information of the target network interface through the target functional component: The system call component is used to communicate with the kernel space and execute system read and write calls to read the status information of the target network interface.

[0111] Specifically, in the process of obtaining the status information of the target network interface through the system call component, the following steps may be performed: (a1) Device file reading: Open the device file corresponding to the target network interface, for example, / dev / wlan0, to read the device status and write the configuration to the device file.

[0112] (a2) System read and write call communication transfer: Build a system read / write call request according to the command. Fill a structure containing the data to be sent to the kernel. The system read / write call communication transfer module is used to build and execute the system read / write call. The transfer module includes a system read / write call request, creates a system read / write call request structure according to the configuration request, and passes it to the operating system. The transfer module is also responsible for processing the return result of the system read / write call and extracting the relevant configuration information.

[0113] (a3) Sending a system read / write call request: Use the system read / write call system call to send a request to the kernel. The parameters of the system read / write call include the file descriptor, the system read / write call command code, and a pointer to a data structure.

[0114] (a4) Processing system read and write call responses: receiving kernel responses and obtaining network interface status information, including the network service identification number, signal strength, and link quality information of the network connection.

[0115] In a specific implementation, the target attack means corresponding to the target detection instruction is detected and processed according to the data packet to obtain the detection result, including: determining the target detection method corresponding to the target attack means; detecting and processing the target attack means according to the data packet through the target detection method to obtain the detection result.

[0116] For each attack method, a corresponding detection method can be pre-designed according to the characteristics of the attack method.

[0117] Determining the target detection method corresponding to the target attack method may include querying the target detection method corresponding to the target attack method in the correspondence relationship between the pre-configured attack method and the detection method.

[0118] Through the target detection method, the target attack means are detected and processed according to the data packet to obtain the detection result.

[0119] The detection result can be used to indicate whether the target attack method exists.

[0120] For example, the detection method of attack means 1 is to determine whether the specified parameter value carried by the data packet belongs to the preset numerical range. If the specified parameter value belongs to the preset numerical range, it means that attack means 1 is not detected. If the specified parameter value does not belong to the preset numerical range, it means that attack means 1 is detected.

[0121] For another example, the attack means 2 may be detected by performing statistical processing on the number of data packets within a preset time range, and determining whether the attack means 2 exists based on the statistical result and a preset number threshold.

[0122] In a specific implementation, the detection method also includes: obtaining first time information of a data packet arriving at a network interface; through a target detection method, detecting and processing the target attack means indicated by a target detection instruction according to the data packet to obtain a detection result, including: determining, according to the first time information of the data packet, an arrangement order in which the data packets arrive at the network interface; in the arrangement order, when there are K consecutive data packets and the time interval between any two adjacent data packets arriving at the network interface is less than or equal to a preset time threshold, and the data content of the K data packets is the same, determining that the detection result of the target detection instruction is the first preset result; K is an integer greater than or equal to a preset number threshold.

[0123] This implementation method takes the use of a target detection instruction to detect a replay attack as an example, and illustrates how to detect and process the target attack means indicated by the target detection instruction according to the data packet through the target detection method to obtain a detection result.

[0124] For replay attack methods, you can pre-configure the corresponding detection method: Replay attack detection: {Description: Identify the same data packets that appear repeatedly in a very short period of time, the characteristics of replay attacks. Conditions: Data packet content: exactly the same data packet, time interval: 3ms, number of occurrences: more than 3 times.} When each data packet passes through a network interface, a timestamp may be generated. The timestamp is used to indicate the first time information when the data packet arrives at the network interface.

[0125] The arrangement order of the data packets arriving at the network interface is determined according to the first time information of the data packets.

[0126] For example, the first time information of data packet 1 is T1, the first time information of data packet 2 is T2, the first time information of data packet 3 is T3, and so on. T1, T2, and T3 are sorted in chronological order to obtain: T1—>T3—>T2. That is, T1 is the earliest, T3 is the second, and T2 is the latest. Then, according to the sorting result of the first time information, the order of the data packets reaching the network interface is determined: data packet 1—>data packet 3—>data packet 2.

[0127] In the arrangement order, if the time interval between any two adjacent data packets among K consecutive data packets arriving at the network interface is less than or equal to the preset duration threshold, and the data content of the K data packets is the same, the detection result of the target detection instruction can be determined to be the first preset result.

[0128] K is an integer greater than or equal to a preset number threshold. For example, if the preset number threshold is 3, K can be 3, 4, or any integer greater than 2 that is not listed.

[0129] Assuming K=3, in the arrangement order, if there are three consecutive data packets whose time intervals between any two adjacent data packets arriving at the network interface are less than or equal to the preset time threshold, and the data contents of the three data packets are the same, then the detection result of the target detection instruction is determined to be the first preset result.

[0130] For example, in the order of arrangement, data packet 1 -> data packet 3 -> data packet 2 -> ... Among them, data packet 1 is adjacent to data packet 3, and data packet 3 is adjacent to data packet 2. The time interval (T3-T1) between data packet 1 and data packet 3 arriving at the network interface can be determined by the first time information T1 of data packet 1 and the first time information T3 of data packet 3, and the time interval (T2-T3) between data packet 3 and data packet 2 arriving at the network interface can be determined by the first time information T2 of data packet 2 and the first time information T3 of data packet 3. If (T3-T1) is less than or equal to the preset time threshold, and (T2-T3) is less than or equal to the preset time threshold, and the data contents of data packet 1, data packet 2 and data packet 3 are the same, then it can be determined that the detection result of the target detection instruction is the first preset result, and the first preset result indicates that the replay attack means are detected.

[0131] In the arrangement order, if the following conditions are not met at the same time: "The time interval between any two adjacent data packets among K consecutive data packets arriving at the network interface is less than or equal to the preset time threshold, and the data contents of the K data packets are the same", then the detection result of the target detection instruction is determined to be the second preset result, and the second preset result indicates that no replay attack means are detected.

[0132] In a specific implementation, the detection method also includes: receiving a status information reading instruction for a network interface; converting the status information reading instruction into a kernel executable instruction to obtain a second control instruction corresponding to the status information reading instruction; and controlling the kernel to obtain the status information of the network interface according to the second control instruction.

[0133] For receiving the status information reading instruction for the network interface, reference may be made to the corresponding description of the aforementioned step S102 .

[0134] Receiving the status information reading instruction for the network interface may be generating the status information reading instruction for the network interface according to user input.

[0135] The state information reading instruction is converted into a kernel executable instruction to obtain a second control instruction corresponding to the state information reading instruction, and reference may be made to the corresponding description of the aforementioned step S104.

[0136] According to the second control instruction, controlling the kernel to obtain the status information of the network interface may refer to the corresponding description of the aforementioned step S106.

[0137] To obtain the status information of the network interface, reference may be made to the corresponding description section of obtaining the status information of the target network interface in the aforementioned implementation.

[0138] For example, a network status acquisition request initiates a request through the application layer to obtain specific network interface status information. The user may want to view the network service set identifier, signal strength, or MAC address of the wireless network interface. After receiving the user request, the application calls the high-level interface function in the transit layer API, which is responsible for converting the user request into a format that the system can understand.

[0139] Going further, develop a user space daemon process which will communicate with the kernel module to receive the captured packet information. Develop user space daemon processes using multiple programming languages. The daemon process communicates with the kernel module through socket programming to receive packets. The daemon process listens on a specific port or file descriptor and waits for packets from the kernel module.

[0140] The system call request builder in the transit layer API creates a system call request structure based on the parameters of the high-level interface function. The request result contains the requested command code and a pointer to a data buffer, which is used to receive information about the network interface. The execute system call function in the transit layer API uses the previously constructed request structure to communicate with the operating system kernel layer through a system call, open the device file of the network interface, and call the system call function, passing the file descriptor, the request code, and a pointer to the data buffer. After receiving the system call, the operating system kernel recognizes the requested command code and calls the corresponding network device driver interface. The network device driver parses the request and communicates directly with the hardware device to obtain the status information of the request.

[0141] Implement a module or HOOK in the kernel to intercept packets passing through the network interface. Capture traffic by using the kernel's network monitoring function, such as the netfilter framework. Develop a kernel module using C language and register it with the netfilter framework's function HOOK. For example, through the function registration HOOK, implement the netfilter callback function, which is called when a packet passes through. In the callback, use the skb_copy() function to copy the packet content so that it can be sent to user space. Once the driver obtains the status information from the hardware device, fill the status information into the data buffer previously specified by the system call request structure. Then, the driver notifies the kernel, and the kernel returns the result to the application layer program. The component in the transit layer API that handles the system call return value extracts the status information from the data buffer and converts it into a format that the application can understand. For example, convert the raw value of the signal strength into a more readable percentage representation.

[0142] In summary, the detection method provided in this embodiment, first, determines the selected target detection instruction in the preset instruction set; the preset instruction set includes multiple detection instructions, each of which is used to detect an attack means for network attack; then, the target detection instruction is converted into a kernel executable instruction to obtain a first control instruction corresponding to the target detection instruction; finally, according to the first control instruction, the kernel is controlled to perform the following operations to obtain the detection result of the target detection instruction: collect data packets passing through the network interface; according to the data packets, the target attack means indicated by the target detection instruction is detected and processed to obtain the detection result. In this way, the target detection instruction is a detection instruction selected from the multiple detection instructions included in the preset instruction set. By determining the selected target detection instruction in the preset instruction set, the detection can be flexibly started for the specific attack means when there is a specific network attack means detection requirement; on the other hand, the target detection instruction is converted into a first control instruction that can be used to control the kernel, and the kernel is controlled to collect data packets according to the first control instruction and detect the target attack means according to the data packets. In this way, there is no need to collect data packets continuously for a long time, which is more conducive to saving the computing resources consumed by the detection. In summary, the detection method provided in this embodiment can target specific network attack methods while improving detection flexibility and saving detection resources.

[0143] Based on the same technical concept, the embodiments of the present application also provide another detection method. Figure 2 A processing flow chart of another detection method provided for one embodiment of this specification.

[0144] like Figure 2 As shown, in step S202, components of the application layer, transit layer, and kernel layer are initialized.

[0145] Step S204: Application layer instructions are issued.

[0146] The instructions may refer to the aforementioned target detection instructions.

[0147] For details of this step, please refer to the corresponding description of the aforementioned step S102.

[0148] The application layer instruction is sent, which means sending the application layer function instructions that the user actually needs to execute to the transit layer. In the specific implementation process: first, the application layer function requirements submitted by the user are received through the API (Application Programming Interface). Then, after the application layer receives the user's requirements, it encapsulates the request content into an application layer instruction. The application layer instruction includes the file operations and network targets that need to be executed by the function requirements.

[0149] Step S206, transit layer instruction parsing.

[0150] The transfer layer can convert the instructions of the application layer into instructions that can be recognized and executed by the kernel, and transmit them to the kernel layer. For details of this step, please refer to the corresponding description part of the aforementioned step S104.

[0151] Step S208: kernel layer instruction execution.

[0152] For details of this step, please refer to the corresponding description of the aforementioned step S106.

[0153] Exemplarily, the kernel layer can register with the netfilter framework of the network stack to capture data packets. The netfilter framework is a network subsystem in the Linux kernel, and the network packet protocol filtering is implemented by means of the subsystem. Then register the network HOOK, and use the preset HOOK function to register a HOOK in the kernel. The HOOK will be called when the data packet arrives. The preset HOOK function can be a function provided by the netfilter framework. Capture the data packet, and process each passing data packet in the HOOK function. Parse the data packet and write a parsing function that can parse the data packet content according to the protocol type of the data packet.

[0154] Among them, netfilter is a network packet filtering framework in the Linux kernel, which is used to implement functions such as packet filtering, modification and forwarding. Netfilter provides a mechanism for processing network packets in the Linux kernel, allowing user space programs to register callback functions to handle different network packet events.

[0155] Since the technical concept is the same, the description in this embodiment is relatively simple, and the relevant parts may refer to the corresponding description of the method embodiment provided above.

[0156] Next, combine Figure 3 and Figure 4 The preparation work before executing the detection method is illustrated.

[0157] Figure 3 A system interaction diagram provided for one embodiment of this specification.

[0158] like Figure 3 The network detection system shown can execute the detection methods provided by various method embodiments in this specification. The network detection system includes an application layer 302 , a transit layer 304 and a kernel layer 306 .

[0159] Before executing the detection method provided by each method embodiment in this specification, an application layer component may be created in the application layer 302. The application layer component includes but is not limited to: a user interface 3022, a high-level interface 3024, and an error handling 3026.

[0160] The user interface 3022 is used to interact with the user, and can be a command line based interface or a graphical user interface. The advanced interface 3024 provides configuration options for network detection, such as selecting the network interface to be detected and setting detection parameters. The error handling 3026 implements error handling and user feedback mechanisms to ensure the accuracy and friendliness of user operations.

[0161] In addition, the application layer 302 may also include a component for writing application logic, through which the logic of the application is written, user input is processed, and the user's configuration request is passed to the transit layer 304.

[0162] Before executing the detection methods provided by various method embodiments in this specification, a transit layer component may be created in the transit layer 304. The transit layer component includes but is not limited to: a system call builder 3042, a component for executing a system call, and a component for processing an investigation result.

[0163] The system call builder 3042 is used to manage system calls, error handling and exception management: During the data forwarding process, the transit layer 304 needs to handle possible errors and exceptions, such as system call failures and data format errors. Provide error feedback and logging to help debug and optimize the network monitoring system. The component used to execute system calls interacts with the kernel layer through system calls and library functions, such as using call methods such as ioctl in the Linux system. The component used to process the call results is data format conversion, which designs and implements the logic of data format conversion, converting the binary data of the kernel layer into structured data that can be understood by the application layer. For example, convert the header information of the data packet captured by the kernel layer into a format that is easy to read and analyze.

[0164] Before executing the detection method provided by each method embodiment in this specification, a kernel layer component may be created in the kernel layer 306. The kernel layer component includes but is not limited to: system call 2062, driver 3064 and system file 3066.

[0165] For the various kernel layer components listed above, please refer to the corresponding description section above.

[0166] Figure 4 A processing flow chart of the preliminary preparation work of a detection method provided in one embodiment of this specification.

[0167] like Figure 4 As shown, step S402, creating an application layer component.

[0168] Step S404, creating a transit layer component.

[0169] Step S406, creating a kernel layer component.

[0170] Since the technical concept is the same, the description in this embodiment is relatively simple, and the relevant parts may refer to the corresponding description of the method embodiment provided above.

[0171] Figure 5 A processing flow chart of another detection method provided for an embodiment of this specification.

[0172] like Figure 5 As shown, step S502 initializes the application layer, transit layer and kernel layer components.

[0173] When the system is started, the network monitoring includes application layer, transit layer and kernel layer components, calls the initialization subroutine to load the necessary software libraries and prepare system resources. The software libraries include but are not limited to network interface identification library, data processing library, command line parameter parsing library, process management library and data packet capture and analysis library.

[0174] Step S504: Identify the network interface.

[0175] Execute the network interface identification module, which identifies network information based on the network interface information acquisition mechanism provided by the operating system by calling the operating system interface, and further reads network files and other related system files to obtain network interface information. This type of file contains the status and configuration information of all network interfaces on the system. To identify all network interfaces connected to the host. The system creates and maintains a list containing the identified network interface identifiers.

[0176] Step S506: reading network status information.

[0177] Step S508: network traffic monitoring.

[0178] Steps S506 to S508 may refer to the corresponding description of the aforementioned step 106 .

[0179] Since the technical concept is the same, the description in this embodiment is relatively simple, and the relevant parts may refer to the corresponding description of the method embodiment provided above.

[0180] Figure 6 A schematic diagram of a detection device provided by an embodiment of the present invention is shown in FIG. Figure 6 As shown, the detection device 600 includes: A determination unit 602 is used to determine a selected target detection instruction in a preset instruction set; the preset instruction set includes a plurality of detection instructions, wherein each detection instruction is used to detect an attack method used for a network attack; The conversion unit 604 is used to convert the target detection instruction into a kernel executable instruction to obtain a first control instruction corresponding to the target detection instruction; The control unit 606 is configured to control the kernel to perform the following operations according to the first control instruction to obtain a detection result of the target detection instruction: Collect data packets passing through the network interface; According to the data packet, the target attack means indicated by the target detection instruction is detected and processed to obtain the detection result.

[0181] Optionally, the target detection instruction carries a network interface identifier; when the control core collects data packets passing through the network interface, the control unit 606 performs the following steps: Determine the corresponding target network interface according to the network interface identifier; Obtaining status information of the target network interface; When the state information satisfies a preset state condition, data packets passing through the target network interface are collected.

[0182] Optionally, the control unit 606 performs the following steps when controlling the kernel to obtain the status information of the target network interface: Determine, among the plurality of functional components of the kernel, a target functional component corresponding to the target network interface; The state information of the target network interface is obtained through the target functional component.

[0183] Optionally, the control unit 606 performs the following steps when the control kernel detects and processes the target attack means corresponding to the target detection instruction according to the data packet and obtains the detection result: Determine a target detection method corresponding to the target attack means; Through the target detection method, the target attack means is detected and processed according to the data packet to obtain the detection result.

[0184] Optionally, the detection device 600 further includes: An acquiring unit, configured to acquire first time information of the data packet arriving at the network interface; The control unit 606 performs the following steps when the control kernel detects and processes the target attack means indicated by the target detection instruction according to the data packet through the target detection method and obtains the detection result: Determining, according to the first time information of the data packets, an arrangement order in which the data packets arrive at the network interface; In the arrangement order, when the time interval between any two adjacent data packets among K consecutive data packets arriving at the network interface is less than or equal to a preset duration threshold, and the data contents of the K data packets are the same, the detection result of the target detection instruction is determined to be the first preset result; K is an integer greater than or equal to a preset number threshold.

[0185] Optionally, the detection device 600 further includes: A receiving unit, configured to receive a status information reading instruction for the network interface; The conversion unit 604 is further configured to convert the state information reading instruction into a kernel executable instruction to obtain a second control instruction corresponding to the state information reading instruction; The control unit 606 is further configured to control the kernel to obtain the status information of the network interface according to the second control instruction.

[0186] Optionally, when determining the selected target detection instruction in the preset instruction set, the determining unit 602 performs the following steps: Determine the risk level of the business to be processed; When the risk level is greater than a preset level threshold, querying the target attack means corresponding to the service to be processed in the pre-configured correspondence between the service type and the attack means according to the target service type of the service to be processed; A detection instruction indicating the target attack means is determined in a preset instruction set as the target detection instruction.

[0187] The detection device provided in this embodiment includes: a determination unit, which is used to determine the selected target detection instruction in the preset instruction set; the preset instruction set includes multiple detection instructions, wherein each detection instruction is used to detect an attack means for network attack; a conversion unit, which is used to convert the target detection instruction into a kernel executable instruction to obtain a first control instruction corresponding to the target detection instruction; a control unit, which is used to control the kernel to perform the following operations according to the first control instruction to obtain the detection result of the target detection instruction; collect data packets passing through the network interface; and detect the target attack means indicated by the target detection instruction according to the data packet to obtain the detection result. In this way, the target detection instruction is a detection instruction selected from the multiple detection instructions included in the preset instruction set. By determining the selected target detection instruction in the preset instruction set, the detection can be flexibly started for the specific attack means when there is a specific network attack means detection requirement; on the other hand, the target detection instruction is converted into a first control instruction that can be used to control the kernel, and the kernel is controlled to collect data packets according to the first control instruction and detect the target attack means according to the data packets. In this way, there is no need to collect data packets continuously for a long time, which is more conducive to saving the computing resources consumed by the detection. In summary, the detection method provided in this embodiment can target specific network attack methods while improving detection flexibility and saving detection resources.

[0188] The detection device provided in an embodiment of this specification can implement each process in the aforementioned method embodiment and achieve the same functions and effects, which will not be repeated here.

[0189] Furthermore, an embodiment of the present specification also provides a detection device, Figure 7 A schematic diagram of a detection device provided in an embodiment of this specification is shown in FIG. Figure 7 As shown, the device includes: a memory 701, a processor 702, a bus 703 and a communication interface 704. The memory 701, the processor 702 and the communication interface 704 communicate through the bus 703, and the communication interface 704 may include an input and output interface, which includes but is not limited to a keyboard, a mouse, a display, a microphone, a loudspeaker, etc.

[0190] Figure 7In the embodiment, the memory 701 stores computer executable instructions that can be run on the processor 702, and when the computer executable instructions are executed by the processor 702, the following process is implemented: Determining a selected target detection instruction in a preset instruction set; the preset instruction set includes a plurality of detection instructions, wherein each detection instruction is used to detect an attack method used for a network attack; Converting the target detection instruction into a kernel executable instruction to obtain a first control instruction corresponding to the target detection instruction; According to the first control instruction, the control core performs the following operations to obtain the detection result of the target detection instruction: Collect data packets passing through the network interface; According to the data packet, the target attack means indicated by the target detection instruction is detected and processed to obtain the detection result.

[0191] The detection device provided in an embodiment of this specification can implement each process in the aforementioned method embodiment and achieve the same functions and effects, which will not be repeated here.

[0192] Furthermore, another embodiment of the present specification provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store computer-executable instructions, and when the computer-executable instructions are executed by a processor, the following process is implemented: Determining a selected target detection instruction in a preset instruction set; the preset instruction set includes a plurality of detection instructions, wherein each detection instruction is used to detect an attack method used for a network attack; Converting the target detection instruction into a kernel executable instruction to obtain a first control instruction corresponding to the target detection instruction; According to the first control instruction, the control core performs the following operations to obtain the detection result of the target detection instruction: Collect data packets passing through the network interface; According to the data packet, the target attack means indicated by the target detection instruction is detected and processed to obtain the detection result.

[0193] The computer-readable storage medium includes a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0194] The computer-readable storage medium provided in an embodiment of this specification can implement each process in the aforementioned method embodiment and achieve the same functions and effects, which will not be repeated here.

[0195] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0196] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0197] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0198] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0199] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0200] Memory may include non-permanent storage in a computer-readable storage medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable storage medium.

[0201] Computer-readable storage media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer-readable storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable storage media does not include temporary computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0202] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0203] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0204] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A detection method, characterized in that: include: Determining a selected target detection instruction in a preset instruction set; the preset instruction set includes a plurality of detection instructions, wherein each detection instruction is used to detect an attack method used for a network attack; Converting the target detection instruction into a kernel executable instruction to obtain a first control instruction corresponding to the target detection instruction; According to the first control instruction, the control core performs the following operations to obtain the detection result of the target detection instruction: Collect data packets passing through the network interface; According to the data packet, the target attack means indicated by the target detection instruction is detected and processed to obtain the detection result.

2. The method according to claim 1, characterized in that The target detection instruction carries a network interface identifier; The collecting of data packets passing through the network interface includes: Determine the corresponding target network interface according to the network interface identifier; Obtaining status information of the target network interface; When the state information satisfies a preset state condition, data packets passing through the target network interface are collected.

3. The method according to claim 2, characterized in that The obtaining the status information of the target network interface includes: Determine, among the plurality of functional components of the kernel, a target functional component corresponding to the target network interface; The state information of the target network interface is obtained through the target functional component.

4. The method according to claim 1, characterized in that: The detecting and processing the target attack means corresponding to the target detection instruction according to the data packet to obtain the detection result includes: Determine a target detection method corresponding to the target attack means; Through the target detection method, the target attack means is detected and processed according to the data packet to obtain the detection result.

5. The method according to claim 4, characterized in that The method further comprises: Acquire first time information of the data packet arriving at the network interface; The target attack means indicated by the target detection instruction is detected and processed according to the data packet to obtain the detection result, including: Determining, according to the first time information of the data packets, an arrangement order in which the data packets arrive at the network interface; In the arrangement order, when the time interval between any two adjacent data packets among K consecutive data packets arriving at the network interface is less than or equal to a preset duration threshold, and the data contents of the K data packets are the same, the detection result of the target detection instruction is determined to be the first preset result; K is an integer greater than or equal to a preset number threshold.

6. The method according to claim 1, characterized in that The method further comprises: Receiving a status information reading instruction for the network interface; Convert the state information reading instruction into a kernel executable instruction to obtain a second control instruction corresponding to the state information reading instruction; According to the second control instruction, the control kernel obtains the status information of the network interface.

7. The method according to claim 1, characterized in that The step of determining the selected target detection instruction in the preset instruction set includes: Determine the risk level of the business to be processed; When the risk level is greater than a preset level threshold, querying the target attack means corresponding to the service to be processed in the pre-configured correspondence between the service type and the attack means according to the target service type of the service to be processed; A detection instruction indicating the target attack means is determined in a preset instruction set as the target detection instruction.

8. A detection device, characterized in that: include: A determination unit, configured to determine a selected target detection instruction in a preset instruction set; the preset instruction set includes a plurality of detection instructions, wherein each detection instruction is used to detect an attack method used for a network attack; A conversion unit, configured to convert the target detection instruction into a kernel executable instruction to obtain a first control instruction corresponding to the target detection instruction; A control unit is used to control the kernel to perform the following operations according to the first control instruction to obtain a detection result of the target detection instruction: Collect data packets passing through the network interface; According to the data packet, the target attack means indicated by the target detection instruction is detected and processed to obtain the detection result.

9. A detection device, characterized in that: It comprises a memory and a processor, wherein the memory stores computer executable instructions, and when the computer executable instructions are executed on the processor, the steps of the detection method according to any one of claims 1 to 7 can be implemented.

10. A computer-readable storage medium having computer-executable instructions stored therein, characterized in that: When the computer executable instructions are executed by a processor, the steps of the detection method described in any one of claims 1 to 7 can be implemented.

Images