Attack source positioning method and device and storage medium
By calculating the reliability score of the data source and selecting the target data source to locate the attack source, the problem of manual experience affecting the location accuracy in the existing technology is solved, and a higher accuracy of the attack source positioning is achieved.
Patent Information
- Application Number
- CN202510059486.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-01-14
- Publication Date
- 2025-04-18
AI Technical Summary
In the prior art, attack source positioning methods rely on manual experience for comparison and evaluation, and are susceptible to the blind spots of analyst experience, bias and knowledge, resulting in misjudgment or misjudgment, and it is difficult to improve the accuracy of attack source positioning.
By determining the data source set for reference threat object location based on the suspicious data source positioned by the suspicious threat object, calculate the reliability scores of each data source based on the location attribute information of each reference data source in the data source set, select the target data source with high reliability, and locate the attack source of the suspicious threat object.
No manual empirical analysis of suspicious data sources is required, which avoids the objectivity of human factors affecting judgments and improves the accuracy of attack source positioning.
Smart Images
Figure CN119854020A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of communications, and in particular to an attack source locating method, device and storage medium. Background Art
[0002] With the widespread application of emerging technologies such as cloud computing, the Internet of Things, and big data, the complexity of the network environment has increased, providing more opportunities for cyber attackers. In the highly interconnected digital age, the high frequency and variability of cyber attacks pose a serious threat to network security, corporate operations, and personal privacy.
[0003] Faced with the increasingly severe situation of cyber attacks, the relevant technologies use the subject positioning method to locate the attack source. However, the subject positioning method requires manual experience to compare and evaluate multiple potential subjects, and select the subject that best matches the logic of the evidence chain and the attack characteristics as the final positioning result. In the process of manually comparing and evaluating multiple subject information, the analyst's experience, bias, or knowledge blind spot may affect the objectivity of the judgment, resulting in misjudgment or missed judgment. Therefore, how to improve the accuracy of attack source positioning is a technical problem that still needs to be solved. Summary of the invention
[0004] The present application provides an attack source locating method, device and storage medium for improving the accuracy of attack source locating.
[0005] In order to achieve the above objectives, this application adopts the following technical solutions:
[0006] In a first aspect, the present application provides a method for locating an attack source, including: determining a data source set for locating a reference threat object based on a suspicious data source for locating a suspicious threat object; the data source set for locating a reference threat object includes the suspicious data source for locating the suspicious threat object; determining a target data source that meets the positioning requirements based on the positioning attribute information of each reference data source in the data source set; and locating the attack source of the suspicious threat object based on the positioning attribute information of the target data source.
[0007] In one possible implementation, for each reference data source, a first reliability score of the reference data source is determined based on the positioning attribute information and the reference data source type of the reference data source, and a second reliability score of the reference data source is determined based on the number of data sources with the same positioning attribute information in the data source set; and a target data source is determined based on the first reliability score and the second reliability score.
[0008] In a possible implementation, for each data source, the sum of the first reliability score and the second reliability score is determined as the target reliability score of the reference data source; and the target data source is determined according to the target reliability score of the reference data source.
[0009] In a possible implementation manner, a data source with the highest target reliability score in the data source set is determined as the target data source.
[0010] In one possible implementation, an initial parameter value of the suspicious data source is obtained; the initial parameter value of the suspicious data source is positively correlated with the number of data sources with the same positioning attribute information in the suspicious data source; the initial parameter value of the suspicious data source is determined as the weight of the reference data source; and the target data source is determined based on the product of the weight of the reference data source and the target reliability score of the reference data source.
[0011] In a possible implementation, the first reliability score of the data source is positively correlated with the attribute information of the data source and the degree of association with the data source type.
[0012] In a possible implementation, the second reliability score of the data source is positively correlated with the number of data sources with the same attribute information in the data source set.
[0013] In a second aspect, the present application provides an attack source locating device, including: a processing unit, the processing unit is used to determine a data source set for locating a reference threat object based on a suspicious data source for locating a suspicious threat object; the data source set for locating a reference threat object includes a suspicious data source for locating a suspicious threat object; the processing unit is used to determine a target data source that meets the positioning requirements based on the positioning attribute information of each reference data source in the data source set; the processing unit is used to locate the attack source of the suspicious threat object based on the positioning attribute information of the target data source.
[0014] In one possible implementation, the processing unit is further used to determine, for each reference data source, a first reliability score of the reference data source based on the positioning attribute information and the reference data source type of the reference data source, and to determine a second reliability score of the reference data source based on the number of data sources with the same positioning attribute information in the data source set; the processing unit is further used to determine the target data source based on the first reliability score and the second reliability score.
[0015] In one possible implementation, the processing unit is further used to determine, for each data source, the sum of the first reliability score and the second reliability score as the target reliability score of the reference data source; the processing unit is further used to determine the target data source based on the target reliability score of the reference data source.
[0016] In a possible implementation, the processing unit is further configured to determine a data source with the highest target reliability score in the data source set as the target data source.
[0017] In a possible implementation, the attack source locating device also includes: an acquisition unit; the acquisition unit is used to acquire the initial parameter value of the suspicious data source; the initial parameter value of the suspicious data source is positively correlated with the number of data sources with the same positioning attribute information in the suspicious data source; the processing unit is also used to determine the initial parameter value of the suspicious data source as the weight of the reference data source; the processing unit is also used to determine the target data source based on the product of the weight of the reference data source and the target reliability score of the reference data source.
[0018] In a possible implementation, the first reliability score of the data source is positively correlated with the attribute information of the data source and the degree of association with the data source type.
[0019] In a possible implementation, the second reliability score of the data source is positively correlated with the number of data sources with the same attribute information in the data source set.
[0020] In a third aspect, an embodiment of the present application provides an attack source locating device, which includes: a processor and a memory; wherein the memory is used to store computer execution instructions, and when the attack source locating device is running, the processor executes the computer execution instructions stored in the memory to enable the attack source locating device to perform the attack source locating method described in the first aspect and any possible implementation method of the first aspect.
[0021] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which instructions are stored. When the instructions in the computer-readable storage medium are executed by a processor of an attack source locating device, the attack source locating device is enabled to execute the attack source locating method described in the first aspect and any possible implementation method of the first aspect.
[0022] In a fifth aspect, an embodiment of the present application provides a chip, the chip including a processor and a communication interface, the communication interface and the processor are coupled, and the processor is used to run a computer program or instructions to implement the attack source locating method described in the above-mentioned first aspect and any possible implementation method of the first aspect.
[0023] In a sixth aspect, a computer program product comprising instructions is provided, which, when executed on a computer, enables the computer to execute the attack source locating method described in the first aspect and any possible implementation manner of the first aspect.
[0024] In the present disclosure, the name of the attack source location device does not limit the device or functional module itself. In actual implementation, these devices or functional modules may appear with other names. As long as the functions of each device or functional module are similar to those of the present disclosure, they fall within the scope of the claims of the present disclosure and their equivalent technologies.
[0025] These and other aspects of the present application will become more apparent from the following description.
[0026] The above scheme brings at least the following beneficial effects: In the embodiment of the present application, the reliability of each data source in the suspicious data source can be evaluated by taking into account the positioning attribute information of the historical data source corresponding to the suspicious data source. The attack source positioning device determines the data source set for locating the reference threat object based on the suspicious data source for locating the suspicious threat object. Since the data source set for locating the reference threat object includes the suspicious data source for locating the suspicious threat object, the attack source positioning device can determine the reliability of each reference data source based on the positioning attribute information of each reference data source in the data source set for locating the reference threat object. Then, a target data source with high reliability is selected from each reference data source, and the attack source of the suspicious threat object is located according to the positioning attribute information of the target data source. Compared with the prior art, in the present application, there is no need for the staff to analyze the suspicious data source based on experience, which avoids the staff's judgment affecting objectivity, resulting in misjudgment or missed judgment, and improves the accuracy of attack source positioning. BRIEF DESCRIPTION OF THE DRAWINGS
[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.
[0028] Figure 1 A schematic diagram of the structure of an attack source positioning system provided in an embodiment of the present application;
[0029] Figure 2 A schematic diagram of the structure of an attack source locating device provided in an embodiment of the present application;
[0030] Figure 3 A flowchart of an attack source location method provided in an embodiment of the present application;
[0031] Figure 4 A flowchart of another attack source location method provided in an embodiment of the present application;
[0032] Figure 5 A flowchart of another attack source location method provided in an embodiment of the present application;
[0033] Figure 6 A flowchart of another attack source location method provided in an embodiment of the present application;
[0034] Figure 7 A flowchart of another attack source location method provided in an embodiment of the present application;
[0035] Figure 8 A flowchart of another attack source location method provided in an embodiment of the present application;
[0036] Fig. 9 A schematic diagram of the structure of another attack source locating device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0037] The term "and / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.
[0038] The terms "first" and "second" and the like in the specification and drawings of this application are used to distinguish different objects, or to distinguish different processing of the same object, rather than to describe a specific order of objects.
[0039] In addition, the terms "including" and "having" and any variations thereof mentioned in the description of this application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.
[0040] It should be noted that, in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.
[0041] In the description of the present application, unless otherwise specified, “plurality” means two or more.
[0042] With the widespread application of emerging technologies such as cloud computing, the Internet of Things, and big data, the complexity of the network environment has increased, providing more opportunities for cyber attackers. In the highly interconnected digital age, the high frequency and variability of cyber attacks pose a serious threat to network security, corporate operations, and personal privacy.
[0043] Faced with the increasingly severe situation of cyber attacks, the relevant technologies use the subject positioning method to locate the attack source. However, the subject positioning method requires manual experience to compare and evaluate multiple potential subjects, and select the subject that best matches the logic of the evidence chain and the attack characteristics as the final positioning result. In the process of manually comparing and evaluating multiple subject information, the analyst's experience, bias, or knowledge blind spot may affect the objectivity of the judgment, resulting in misjudgment or missed judgment. Therefore, how to improve the accuracy of attack source positioning is a technical problem that still needs to be solved.
[0044] In the embodiment of the present application, the reliability of each data source in the suspicious data source can be evaluated by taking into account the positioning attribute information of the historical data source corresponding to the suspicious data source. The attack source positioning device determines the data source set for locating the reference threat object based on the suspicious data source for locating the suspicious threat object. Since the data source set for locating the reference threat object includes the suspicious data source for locating the suspicious threat object, the attack source positioning device can determine the reliability of each reference data source based on the positioning attribute information of each reference data source in the data source set for locating the reference threat object. Then, a target data source with high reliability is selected from each reference data source, and the attack source of the suspicious threat object is located according to the positioning attribute information of the target data source. Compared with the prior art, in the present application, there is no need for the staff to analyze the suspicious data source based on experience, which avoids the staff's judgment affecting objectivity, resulting in misjudgment or missed judgment, and improves the accuracy of attack source positioning.
[0045] The implementation of the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings.
[0046] Below, combined with the attached Figure 1 An attack source positioning system 10 provided in an embodiment of the present application is described in detail. Figure 1 As shown, the attack source positioning system 10 includes: an attack source positioning device 11 and an attacked object 12.
[0047] The attack source locating device 11 may be deployed inside the attacked object 12 or outside the attacked object 12 .
[0048] The attack source positioning device 11 can obtain the suspicious data source for positioning the suspicious threat object from the attacked object 12, and then determine the data source set for positioning the reference threat object according to the suspicious data source for positioning the suspicious threat object. Subsequently, the attack source positioning device 11 can refer to the positioning attribute information of each reference data source in the data source set to determine the target data source that meets the positioning requirements. Finally, the attack source positioning device 11 locates the attack source of the suspicious threat object based on the positioning attribute information of the target data source.
[0049] It should be noted that the attack source positioning device 11 is a device with wireless communication function, which can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted. It can also be deployed on the water surface (such as ships, etc.). It can also be deployed in the air (for example, on airplanes, balloons and satellites, etc.). User terminal equipment is also called mobile station (MS), terminal equipment (MT) and terminal equipment, etc., which is a device that provides voice and / or data connectivity to users. For example, terminal equipment includes handheld devices with wireless connection function, vehicle-mounted equipment, etc. At present, the terminal device can be: a mobile phone, a tablet computer, a laptop computer, a PDA, a mobile internet device (MID), a wearable device (such as a smart watch, a smart bracelet, a pedometer, etc.), an in-vehicle device (such as a car, a bicycle, an electric car, an airplane, a ship, a train, a high-speed train, etc.), a virtual reality (VR) device, an augmented reality (AR) device, a wireless terminal device in industrial control, a smart home device (such as a refrigerator, a television, an air conditioner, an electric meter, etc.), an intelligent robot, a workshop device, a wireless terminal device in self-driving, a wireless terminal device in remote medical surgery, a wireless terminal device in a smart grid, a wireless terminal device in transportation safety, a wireless terminal device in a smart city, or a wireless terminal device in a smart home, a flying device (such as an intelligent robot, a hot air balloon, a drone, an airplane), etc. In a possible application scenario of the present application, the attack source positioning device 11 is a terminal device that often works on the ground, such as a vehicle-mounted device. In the present application, for the convenience of description, the chip deployed in the above-mentioned device, such as the system-on-a-chip (SOC), baseband chip, etc., or other chips with communication functions can also be referred to as user terminal devices.
[0050] Optionally, the attack source locating device 11 may be an embedded communication device, or a user's handheld communication device, including a mobile phone, a tablet computer, etc.
[0051] As an example, in an embodiment of the present application, the attack source positioning device 11 can also be a wearable device. Wearable devices can also be called wearable smart devices, which are a general term for wearable devices that use wearable technology to intelligently design and develop wearable devices for daily wear, such as glasses, gloves, watches, clothing and shoes. A wearable device is a portable device that is worn directly on the body or integrated into the user's clothes or accessories. Wearable devices are not only hardware devices, but also powerful functions achieved through software support, data interaction, and cloud interaction. Broadly speaking, wearable smart devices include full-featured, large-sized, and independent of smartphones to achieve complete or partial functions, such as smart watches or smart glasses, as well as those that only focus on a certain type of application function and need to be used in conjunction with other devices such as smartphones, such as various types of smart bracelets and smart jewelry for vital sign monitoring.
[0052] Optionally, the physical device of the attacked object 12 may be a server.
[0053] Optionally, the above-mentioned server can be a server in a server cluster (consisting of multiple servers), or a chip in the server, or a system on a chip in the server, or can be implemented by a virtual machine (VM) deployed on a physical machine, which is not limited in the embodiments of the present application.
[0054] The embodiment of the present application provides an attack source locating device, which is used to execute the attack source locating system provided by the embodiment of the present application. Figure 2 This is a schematic diagram of the structure of an attack source positioning device provided in an embodiment of the present application. Figure 2 As shown, the attack source location device 200 includes a processor 201, a communication line 202, and a communication interface 204, and may also include a memory 203. The processor 201, the memory 203 and the communication interface 204 may be connected via the communication line 202.
[0055] The processor 201 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application, such as one or more digital signal processors (DSP), or one or more field programmable gate arrays (FPGA).
[0056] The communication link 202 may include a pathway for transmitting information between the above-mentioned components.
[0057] The communication interface 204 is used to communicate with other devices or communication networks, and can use any transceiver-like device, such as Ethernet, radio access network (RAN), WLAN, etc.
[0058] The memory 203 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, an optical disc storage (including compressed optical discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to include or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these.
[0059] In one possible design, the memory 203 can exist independently of the processor 201, that is, the memory 203 can be a memory outside the processor 201. In this case, the memory 203 can be connected to the processor 201 through the communication line 202, and is used to store execution instructions or application code, and the processor 201 controls the execution to implement the attack source location method provided in the following embodiment of the present application. In another possible design, the memory 203 can also be integrated with the processor 201, that is, the memory 203 can be the internal memory of the processor 201, for example, the memory 203 is a high-speed cache, which can be used to temporarily store some data and instruction information.
[0060] As an implementation method, the processor 201 may include one or more CPUs, for example Figure 2 As another achievable method, the attack source locating device 200 may include multiple processors, such as Figure 2 Processor 201 and processor 207 in.
[0061] As another possible implementation manner, the attack source locating device 200 may further include an output device 205 and an input device 206 .
[0062] Below, combined with the attached Figure 3A method for locating an attack source provided in an embodiment of the present application is described in detail. Figure 3 As shown, the attack source location method includes S301-S303.
[0063] S301. The attack source locating device determines a data source set for locating a reference threat object according to a suspicious data source for locating a suspicious threat object.
[0064] The data source set for locating reference threat objects includes the suspicious data source for locating the suspicious threat objects.
[0065] Optionally, the suspicious threat object includes at least one of the following: an Internet Protocol (IP) address, a domain name.
[0066] Optionally, the data source includes at least one of the following: a mobile network data source, a threat intelligence data source, and an asset mapping data source.
[0067] It should be explained that mobile Internet is the abbreviation of mobile Internet, which refers to the extension of the Internet to the field of mobile communications, using mobile devices as connection terminals and providing various Internet services through wireless communication networks. These services include but are not limited to web browsing, email, instant messaging, streaming video, and mobile payment.
[0068] It needs to be explained that threat intelligence is evidence-based knowledge that is related to existing or potential threats or hazards faced by assets and can be used to provide information support for asset-related entities' response or handling decisions to threats or hazards.
[0069] It should be explained that asset mapping refers to the process of comprehensive detection, identification and classification of an organization's or individual's network assets. The purpose of asset mapping is to accurately understand the status of an organization's or individual's network assets, including the type, quantity, location, security and other information of the assets, so as to provide basic data support for subsequent security management and protection.
[0070] In a possible implementation, the attack source location device obtains the suspicious threat object from the data platform, and then locates the suspicious data source according to the suspicious threat object. The attack source location device parses the suspicious data source, and determines the data source set for locating the reference threat object from the database according to the data source type in the suspicious data source.
[0071] Optionally, the data source type includes at least one of the following: mobile network, threat intelligence, and asset mapping. The database includes: at least one suspicious threat object and at least one data source corresponding to the suspicious threat object.
[0072] In another possible implementation, the attack source locating device obtains suspicious threat objects from the data platform, and in the process of obtaining suspicious data sources based on the suspicious threat objects, pre-processes the suspicious data.
[0073] Optionally, preprocessing includes at least one of the following: encryption protection, data source verification, data cleaning, format conversion, and missing value processing.
[0074] It should be explained that when processing user queries, the attack source positioning device needs to ensure the privacy of the user, not store or abuse the user's subject information, and can be protected by encryption. The attack source positioning device verifies the data source data to ensure that the data meets the corresponding data format and ensures the reliability of the data.
[0075] It is understandable that the attack source locating device in the present application determines the suspicious data source for locating the suspicious threat object, and can select a data source set for locating the reference threat object that includes the suspicious data source based on the suspicious data source. Since the data source set for locating the reference threat object includes the suspicious data source, the situation of each data source in the suspicious data source can be evaluated based on the situation of each data source in the data source set for locating the reference threat object, and then the attack source of the suspicious threat object can be located based on the situation of each data source in the suspicious data source.
[0076] It should be explained that, due to the different update speeds of the main data sources, when querying the data source at the same time point, the data sources at all time points within a period of time will be queried. And because the same IP will be assigned to different users at different times, when the attack source locating device queries the data source at a preset time point through one IP, multiple data sources and information corresponding to multiple data sources will appear.
[0077] S302: The attack source locating device determines a target data source that meets the locating requirement based on the locating attribute information of each reference data source in the data source set.
[0078] Optionally, the positioning attribute information includes any of the following: subject name, subject mobile phone number, subject broadband account, company name, and region where the subject is located.
[0079] In a possible implementation, the attack source locating device determines the reliability of the reference data source according to the positioning attribute information and the reference data source type of the reference data source, and then selects a reference data source with high reliability as a target data source that meets the positioning requirements.
[0080] It is understandable that different types of data sources have different corresponding reliabilities, and the reliabilities of data sources corresponding to different positioning attribute information are also different.
[0081] Exemplarily, the reliability of the data source corresponding to the subject name in the positioning attribute information is greater than the reliability of the data source corresponding to the subject's mobile phone number, and the reliability of the data source corresponding to the subject's mobile phone number is greater than the reliability of the data source corresponding to the subject's region.
[0082] It should be explained that, in the process of attack source tracing, the higher the reliability of the reference data source, the higher the accuracy of locating the attack source. Therefore, the attack source locating device selects a reference data source with high reliability to locate the attack source, which can improve the accuracy of positioning.
[0083] S303: The attack source locating device locates the attack source of the suspicious threat object based on the positioning attribute information of the target data source.
[0084] In a possible implementation, the attack source locating device uses the location attribute information of the target data source as the attack source information of the suspicious threat object.
[0085] Exemplarily, when the location attribute information of the target data source is city A, the attack source location device determines that the attack source of the suspicious threat object is city A.
[0086] The above scheme brings at least the following beneficial effects: In the embodiment of the present application, the reliability of each data source in the suspicious data source can be evaluated by taking into account the positioning attribute information of the historical data source corresponding to the suspicious data source. The attack source positioning device determines the data source set for locating the reference threat object based on the suspicious data source for locating the suspicious threat object. Since the data source set for locating the reference threat object includes the suspicious data source for locating the suspicious threat object, the attack source positioning device can determine the reliability of each reference data source based on the positioning attribute information of each reference data source in the data source set for locating the reference threat object. Then, a target data source with high reliability is selected from each reference data source, and the attack source of the suspicious threat object is located according to the positioning attribute information of the target data source. Compared with the prior art, in the present application, there is no need for the staff to analyze the suspicious data source based on experience, which avoids the staff's judgment affecting objectivity, resulting in misjudgment or missed judgment, and improves the accuracy of attack source positioning.
[0087] In one possible implementation, combining Figure 3 ,like Figure 4 As shown, the process of the attack source locating device in S302 determining the target data source that meets the locating requirement according to the locating attribute information of each reference data source in the data source set can be specifically implemented through the following S401-S402.
[0088] S401. For each reference data source, the attack source locating device determines a first reliability score of the reference data source according to the positioning attribute information and the reference data source type of the reference data source, and determines a second reliability score of the reference data source according to the number of data sources with the same positioning attribute information in the data source set.
[0089] Among them, the first reliability score of the data source is positively correlated with the degree of association between the positioning attribute information of the data source and the data source type, and the second reliability score of the data source is positively correlated with the number of data sources with the same positioning attribute information in the data source set.
[0090] In a possible implementation, the attack source locating device determines the third reliability score corresponding to the positioning attribute information of the reference data source and the fourth reliability score corresponding to the reference data source type according to the positioning attribute information and the reference data source type of the reference data source and the information reliability score table. The attack source locating device determines the first reliability score of the reference data source according to the third reliability score and the fourth reliability score.
[0091] Optionally, the information reliability score table includes positioning attribute information of at least one reference data source, a third reliability score corresponding to the positioning attribute information of at least one reference data source, at least one reference data source type, and a fourth reliability score corresponding to at least one reference data source type.
[0092] It can be understood that, the higher the reliability of the positioning attribute information of the reference data source, the higher the third reliability score; and the higher the reliability of the reference data source type, the higher the fourth reliability score.
[0093] It needs to be explained that the attack source locating device can determine the first reliability score of the reference data source based on the average of the third reliability score and the fourth reliability score; the attack source locating device can also determine the first reliability score of the reference data source based on the sum of the third reliability score and the fourth reliability score. We do not limit this.
[0094] In another possible implementation, the attack source locating device determines the locating attribute information of each data source in the data source set, determines the number of data sources corresponding to the attribute information to be located in the data source set based on the attribute information to be located of the data source to be tested in the data source set, and uses the number of data sources corresponding to the attribute information to be located as the second reliability score of the data source to be tested.
[0095] Exemplarily, the positioning attribute information of the data source to be tested in the data source set is city A, the positioning attribute information of the first data source in the data source set is city B, the positioning attribute information of the second data source in the data source set is city A, the positioning attribute information of the third data source in the data source set is city B, and the positioning attribute information of the fourth data source in the data source set is city A. Then the number of data sources corresponding to the positioning attribute information to be tested in the data source set is 3, and the attack source locating device determines that the second reliability score of the data source to be tested is 3.
[0096] It should be explained that the data source set includes at least one IP address and at least one reference data source corresponding to the IP address.
[0097] In one possible implementation, if the data source set includes a first reference data source and a second reference data source, the attack source locating device adds the second reliability score in the first reference data source to the second reliability score in the second reference data source to obtain the second reliability score of the reference data source.
[0098] Exemplarily, the IP corresponding to the suspicious data source is IP3, and the data source set includes a first reference data source and a second reference data source. The IP corresponding to the first reference data source is IP1, and the IP corresponding to the second reference data source is IP2. The suspicious data source, the first reference data source, and the second reference data source all include: a mobile network data source, a threat intelligence data source, and an asset mapping data source. The second reliability score of the mobile network data source in the first reference data source is 3, the second reliability score of the threat intelligence data source in the first reference data source is 2, and the second reliability score of the asset mapping data source in the first reference data source is 3. The second reliability score of the mobile network data source in the second reference data source is 2, the second reliability score of the threat intelligence data source in the second reference data source is 5, and the second reliability score of the asset mapping data source in the second reference data source is 7. Then the second reliability score of the mobile network data source in the reference data source is 5, the second reliability score of the threat intelligence data source in the reference data source is 7, and the second reliability score of the asset mapping data source in the reference data source is 10.
[0099] S402: The attack source locating device determines the target data source according to the first reliability score and the second reliability score.
[0100] In a possible implementation, the attack source positioning device obtains the weight of the first reliability score and the weight of the second reliability score, and determines the target reliability score of each reference data source in the data source set according to the first reliability score, the weight of the first reliability score, the second reliability score, and the weight of the second reliability score. The attack source positioning device determines the target data source that meets the positioning requirement from the target reliability scores of each reference data source in the data source set.
[0101] It should be explained that the weight of the first reliability score is positively correlated with the reliability of the positioning attribute information, the weight of the first reliability score is positively correlated with the reliability of the reference data source type, and the weight of the second reliability score is positively correlated with the number of data sources of the positioning attribute information.
[0102] Optionally, the weight of the second reliability score is greater than the weight of the first reliability score.
[0103] The above scheme brings at least the following beneficial effects: In the embodiment of the present application, considering that the first reliability score of the data source is positively correlated with the degree of association between the positioning attribute information of the data source and the data source type, the second reliability score of the data source is positively correlated with the number of data sources with the same positioning attribute information in the data source set. The attack source positioning device determines the first reliability score of the reference data source based on the positioning attribute information of the reference data source and the reference data source type; and determines the second reliability score of the reference data source based on the number of data sources with the same positioning attribute information in the data source set. In this way, the attack source positioning device can accurately determine the target data source based on the first reliability score and the second reliability score.
[0104] In one possible implementation, combining Figure 4 ,like Figure 5 As shown, the process in S402 where the attack source locating device determines the target data source according to the first reliability score and the second reliability score can be specifically implemented through the following S501-S502.
[0105] S501: The attack source locating device determines, for each data source, the sum of the first reliability score and the second reliability score as a target reliability score of a reference data source.
[0106] In a possible implementation, the attack source locating device performs weighted summation of the first reliability score and the second reliability score for each data source according to the weight of the first reliability score and the weight of the second reliability score to obtain a target reliability score.
[0107] Exemplarily, the data source set for locating the reference threat object includes: a mobile network data source, a threat intelligence data source, and an asset mapping data source. The first reliability score of the mobile network data source is 2, the weight of the first reliability score of the mobile network data source is 0.2, the second reliability score of the mobile network data source is 3, and the weight of the first reliability score of the mobile network data source is 0.8, then the attack source locating device determines the target reliability score of the mobile network data source to be 2.8. The first reliability score of the threat intelligence data source is 3, the weight of the first reliability score of the threat intelligence data source is 0.2, the second reliability score of the threat intelligence data source is 5, and the weight of the first reliability score of the threat intelligence data source is 0.8, then the attack source locating device determines the target reliability score of the threat intelligence data source to be 4.6. The first reliability score of the asset mapping data source is 3, the weight of the first reliability score of the asset mapping data source is 0.1, the second reliability score of the asset mapping data source is 5, and the weight of the first reliability score of the asset mapping data source is 0.9, then the attack source locating device determines the target reliability score of the asset mapping data source to be 4.8.
[0108] S502: The attack source locating device determines the target data source according to the target reliability score of the reference data source.
[0109] In a possible implementation, the attack source locating device selects a data source whose target reliability score is greater than a preset threshold from the data source set, and then determines the target data source from the data sources whose target reliability score is greater than the preset threshold.
[0110] The above scheme brings at least the following beneficial effects: In the embodiment of the present application, the attack source positioning device determines the sum of the first reliability score and the second reliability score for each data source as the target reliability score of the reference data source, and then determines the target data source according to the target reliability score of the reference data source. In this way, the attack source positioning device fully considers the same positioning attribute information in the data source set, the positioning attribute information of the data source, and the data source type, and improves the accuracy of determining the target data source.
[0111] In one possible implementation, combining Figure 5 ,like Figure 6 As shown, the process of the attack source locating device in S502 determining the target data source according to the target reliability score of the reference data source can be specifically implemented by the following S601.
[0112] S601: The attack source locating device determines the data source with the highest target reliability score in the data source set as the target data source.
[0113] In a possible implementation, when there are multiple data sources with the highest target reliability scores in the data source set, the attack source locating device selects the data source with the second highest reliability score from the data sources with the highest target reliability scores as the target data source.
[0114] The above scheme brings at least the following beneficial effects: Since the higher the target reliability score of the data source, the higher the reliability of the data source. Therefore, in the embodiment of the present application, the attack source locating device determines the data source with the highest target reliability score in the data source set as the target data source. In this way, the greater the reliability of the target data source, the higher the accuracy of locating the attack source.
[0115] In one possible implementation, combining Figure 5 ,like Figure 7 As shown, the process of the attack source locating device in S502 determining the target data source according to the target reliability score of the reference data source can be specifically implemented through the following S701-S703.
[0116] S701: The attack source locating device obtains an initial parameter value of a suspicious data source.
[0117] Among them, the initial parameter value of the suspicious data source is positively correlated with the number of data sources with the same positioning attribute information in the suspicious data source.
[0118] Exemplarily, the suspicious data sources include a mobile network data source, a threat intelligence data source, and an asset mapping data source. The positioning attribute information of the mobile network data source among the suspicious data sources is city A, the positioning attribute information of the threat intelligence data source among the suspicious data sources is city B, and the positioning attribute information of the asset mapping data source among the suspicious data sources is city A.
[0119] S702: The attack source locating device determines the initial parameter value of the suspicious data source as the weight of the reference data source.
[0120] Exemplarily, the attack source locating device determines that the weight of the mobile network data source is 2, the weight of the threat intelligence data source is 1, and the weight of the asset mapping data source is 2.
[0121] S703: The attack source locating device determines the target data source according to the product of the weight of the reference data source and the target reliability score of the reference data source.
[0122] In one possible implementation, the attack source locating device determines the evaluation score of the reference data source based on the product of the weight of the reference data source and the target reliability score of the reference data source, and determines the data source with the highest evaluation score in the data source set as the target data source.
[0123] For example, Figure 8As shown, the attack source positioning device obtains the suspicious data source, performs data standardization processing on the suspicious data source, and determines the target reliability score of the reference data source and the initial parameter value of the suspicious data source through the data fusion analysis algorithm. The attack source positioning device determines the initial parameter value of the suspicious data source as the weight of the reference data source, and then determines the target data source, and realizes the positioning result of the attack source of the suspicious threat object according to the positioning attribute information of the target data source.
[0124] The above scheme brings at least the following beneficial effects: the initial parameter value of the suspicious data source of the attack source positioning device is determined as the weight of the reference data source, so that the attack source positioning device not only considers the reliability of the reference data source, but also considers the number of data sources with the same positioning attribute information in the suspicious data source. In this application, the reference data source and the suspicious data source are considered at the same time, which improves the accuracy of determining the target data source, thereby realizing the precise positioning of the attack source of the suspicious threat object.
[0125] It can be seen that the technical solution provided by the embodiment of the present application is introduced above mainly from the perspective of the method. In order to realize the above functions, it includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should be easily aware that, in combination with the modules and algorithm steps of each example described in the embodiment disclosed herein, the embodiment of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.
[0126] The embodiment of the present application can divide the attack source positioning device into functional modules according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules. Optionally, the division of modules in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.
[0127] like Fig. 9 , which is a schematic diagram of the structure of an attack source locating device 90 provided in an embodiment of the present application. The attack source locating device 90 comprises: a processing unit 901 and an acquiring unit 902 .
[0128] Processing unit 901 is used to determine a data source set for locating a reference threat object based on a suspicious data source for locating a suspicious threat object; the data source set for locating a reference threat object includes the suspicious data source for locating a suspicious threat object; processing unit 901 is used to determine a target data source that meets the positioning requirements based on the positioning attribute information of each reference data source in the data source set; processing unit 901 is used to locate the attack source of the suspicious threat object based on the positioning attribute information of the target data source.
[0129] Optionally, processing unit 901 is also used to determine, for each reference data source, a first reliability score of the reference data source based on the positioning attribute information and the reference data source type, and to determine a second reliability score of the reference data source based on the number of data sources with the same positioning attribute information in the data source set; processing unit 901 is also used to determine a target data source based on the first reliability score and the second reliability score.
[0130] Optionally, the processing unit 901 is further used to determine, for each data source, the sum of the first reliability score and the second reliability score as the target reliability score of the reference data source; the processing unit 901 is further used to determine the target data source based on the target reliability score of the reference data source.
[0131] Optionally, the processing unit 901 is further configured to determine a data source with the highest target reliability score in the data source set as the target data source.
[0132] Optionally, the attack source locating device also includes: an acquisition unit 902; the acquisition unit 902 is used to obtain the initial parameter value of the suspicious data source; the initial parameter value of the suspicious data source is positively correlated with the number of data sources with the same positioning attribute information in the suspicious data source; the processing unit 901 is also used to determine the target reliability score of the initial parameter value of the suspicious data source as the weight of the suspicious reference data source; the processing unit 901 is also used to determine the target data source based on the weight of the suspicious reference data source and the product of the initial parameter value of the suspicious data source with the target reliability score of the reference data source.
[0133] Optionally, the first reliability score of the data source is positively correlated with the attribute information of the data source and the degree of association with the data source type.
[0134] Optionally, the second reliability score of the data source is positively correlated with the number of data sources with the same attribute information in the data source set.
[0135] The processing unit 901 may be a processor or a controller. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the contents disclosed in this application. The processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc. The communication unit may be a transceiver circuit or a communication interface, etc. The storage module may be a memory. When the processing unit 901 is a processor, the communication unit is a communication interface, and the storage module is a memory, the attack source locating device involved in the embodiment of the present application may be Figure 2 The attack source locating device is shown.
[0136] Through the description of the above implementation methods, technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the network node is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, module and network node described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.
[0137] An embodiment of the present application also provides a computer-readable storage medium, in which instructions are stored. When a computer executes the instructions, the computer executes each step in the method flow shown in the above method embodiment.
[0138] An embodiment of the present application also provides a chip, which includes a processor and a communication interface, the communication interface and the processor are coupled, and the processor is used to run a computer program or instruction to implement the attack source locating method in the above method embodiment.
[0139] An embodiment of the present application provides a computer program product including instructions. When the instructions are executed on a computer, the computer is enabled to execute the attack source locating method in the above method embodiment.
[0140] Among them, the computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable computer disk, and a hard disk. Random Access Memory (RAM), Read-Only Memory (ROM), Erasable Programmable Read Only Memory (EPROM), registers, hard disks, optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any other form of computer-readable storage medium in a suitable combination of the above, or numerical values in the art. An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an Application Specific Integrated Circuit (ASIC). In embodiments of the present invention, computer-readable storage media may be any tangible media that contains or stores a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.
[0141] Since the apparatus, device, computer-readable storage medium, and computer program product in the embodiments of the present invention can be applied to the above-mentioned method, the technical effects that can be obtained can also refer to the above-mentioned method embodiments, and the embodiments of the present application will not be repeated here.
[0142] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.
Claims
1. A method for locating an attack source, characterized in that: The method comprises: Determine a data source set for locating a reference threat object according to the suspicious data source for locating the suspicious threat object; the data source set for locating the reference threat object includes the suspicious data source for locating the suspicious threat object; Determine a target data source that meets the positioning requirement according to the positioning attribute information of each reference data source in the data source set; Based on the location attribute information of the target data source, the attack source of the suspicious threat object is located.
2. The method according to claim 1, characterized in that The determining, according to the positioning attribute information of each reference data source in the data source set, a target data source that meets the positioning requirement includes: For each of the reference data sources, determining a first reliability score of the reference data source according to the positioning attribute information and the reference data source type of the reference data source, and determining a second reliability score of the reference data source according to the number of data sources with the same positioning attribute information in the data source set; The target data source is determined according to the first reliability score and the second reliability score.
3. The method according to claim 2, characterized in that The determining the target data source according to the first reliability score and the second reliability score includes: For each of the data sources, determining the sum of the first reliability score and the second reliability score as the target reliability score of the reference data source; The target data source is determined according to the target reliability score of the reference data source.
4. The method according to claim 3, characterized in that The step of determining the target data source according to the target reliability score of the reference data source comprises: The data source with the highest target reliability score in the data source set is determined as the target data source.
5. The method according to claim 3, characterized in that: The step of determining the target data source according to the target reliability score of the reference data source comprises: Acquiring an initial parameter value of the suspicious data source; the initial parameter value of the suspicious data source is positively correlated with the number of data sources with the same positioning attribute information in the suspicious data source; Determining the initial parameter value of the suspicious data source as the weight of the reference data source; The target data source is determined according to the product of the weight of the reference data source and the target reliability score of the reference data source.
6. The method according to any one of claims 2 to 5, characterized in that: The first reliability score of the data source is positively correlated with the location attribute information of the data source and the degree of association with the data source type.
7. The method according to any one of claims 2 to 5, characterized in that: The second reliability score of the data source is positively correlated with the number of data sources with the same positioning attribute information in the data source set.
8. An attack source positioning device, characterized in that: The device comprises a processing unit: The processing unit is used to determine a data source set for locating a reference threat object based on a suspicious data source for locating a suspicious threat object; The data source set for locating the reference threat object includes the suspicious data source for locating the suspicious threat object; The processing unit is used to determine a target data source that meets the positioning requirement according to the positioning attribute information of each reference data source in the data source set; The processing unit is used to locate the attack source of the suspicious threat object based on the positioning attribute information of the target data source.
9. An attack source positioning device, characterized in that: include: A processor and a memory; wherein the memory is used to store computer-executable instructions, and when the attack source locating device is running, the processor executes the computer-executable instructions stored in the memory, so that the attack source locating device executes the attack source locating method described in any one of claims 1-7.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes instructions, which, when executed by the attack source locating device, enable the computer to execute the attack source locating method according to any one of claims 1 to 7.