Intelligent early warning method for phishing attack, electronic equipment, medium and product

Abstract

The invention relates to the technical field of intelligent early warning, in particular to an intelligent early warning method for a phishing attack, electronic equipment, a medium and a product, and the method comprises the steps: obtaining a network data flow in real time, and carrying out the multi-modal data analysis of the network data flow, and obtaining a multi-modal network feature corresponding to the network data flow; the multi-modal network features are imported into a preset logic guiding tree, a logic path corresponding to the network data flow is determined, and the preset logic guiding tree comprises a plurality of logic nodes and logic judgment conditions; and determining a predicted phishing attack based on the logic path, and triggering a corresponding defense early warning mechanism based on the predicted phishing attack. According to the invention, the accuracy and timeliness in the network security defense process can be improved.

Description

Technical Field

[0001] The present application relates to the field of intelligent early warning technology, and in particular to an intelligent early warning method, electronic device, medium and product for phishing attacks. Background Art

[0002] Phishing attack is a form of Internet fraud, usually through forged websites or emails, claiming to be from social networking sites, auction sites, online banks, electronic payment sites or network administrators, inducing users to enter personal information, such as user names, passwords, bank card numbers and other sensitive information, in order to deceive users. Once the user's sensitive information is leaked, it may be used for identity theft, credit card fraud and other criminal activities, causing serious economic losses and privacy leakage risks to users.

[0003] Traditional network security defense methods mainly rely on fixed rule matching and blacklist mechanisms. They may appear to be powerless in the face of ever-changing, complex and changeable network attack methods, which may affect the accuracy and timeliness of the network security defense process. Summary of the invention

[0004] In order to improve the accuracy and timeliness of network security defense, the present application provides a phishing attack intelligent early warning method, electronic device, medium and product.

[0005] In the first aspect, the present application provides a phishing attack intelligent early warning method, which adopts the following technical solutions: A phishing attack intelligent early warning method, comprising: Acquire network data streams in real time, and perform multimodal data analysis on the network data streams to obtain multimodal network features corresponding to the network data streams; Importing the multimodal network features into a preset logic-oriented tree to determine a logic path corresponding to the network data flow, wherein the preset logic-oriented tree includes a plurality of logic nodes and logic judgment conditions; A predicted phishing attack is determined based on the logic pathway, and a corresponding defense warning mechanism is triggered based on the predicted phishing attack.

[0006] By adopting the above technical solution, by acquiring network data streams in real time, it is convenient to capture instant dynamic changes in the network to ensure the timeliness and data accuracy of network security defense. In addition, by performing multimodal data analysis on network data streams to cope with complex and changeable phishing attacks, it is convenient to improve the comprehensiveness and accuracy of the early warning analysis process. Through the setting of logical nodes and logical judgment conditions, after determining the multimodal network characteristics, the logical path is automatically determined from the preset logic guidance tree to predict potential phishing attacks, reducing the reliance on manual intervention, thereby facilitating the improvement of analysis efficiency and accuracy. Once a phishing attack is predicted, the rapid response method of immediately triggering the corresponding defense early warning mechanism helps to reduce the damage caused by phishing attacks to the network and users, thereby facilitating the improvement of the overall network security protection level.

[0007] In a possible implementation, the process of constructing the preset logic-guided tree includes: Obtain historical defense monitoring data, and based on the historical defense monitoring data Determine initial features and target variables; Performing correlation analysis on all initial features, and grouping the initial features based on the correlation analysis results to obtain multiple feature groups; Based on the historical business logic corresponding to each feature group, determine the key variables corresponding to each feature group and the logical judgment conditions corresponding to the key variables; The preset logic guidance tree is constructed based on each initial feature, key variable, logical judgment condition and target variable.

[0008] By adopting the above technical solution, a preset logic-guided tree is constructed through historical defense monitoring data, which facilitates improving the scalability and configurability of the preset logic-guided tree. That is, new logic nodes can be added, logic judgment conditions can be modified, or logic paths can be adjusted as needed to adapt to the ever-changing network environment and attack methods, thereby facilitating improving the accuracy of the network security defense process.

[0009] In a possible implementation, the step of determining a predicted phishing attack based on the logic path includes: Identifying variable nodes included in the logic path, and determining whether the logic path includes a target variable; If so, determining a predicted phishing attack based on the target variable; If not, based on the variable nodes included in the logic path and the characteristic values ​​corresponding to each variable node, a target similarity path is determined from the preset logic guidance tree, and a predicted phishing attack is determined based on similar target variables included in the target similarity path.

[0010] By adopting the above technical solution, when the logical path includes the target variable, the predicted phishing attack is determined directly based on the target variable, thereby facilitating the accurate prediction of the phishing attack. When the logical path does not include the target variable, the existing knowledge and experience can be used to assist the prediction, thereby facilitating the improvement of the flexibility in presetting the phishing attack while also facilitating the improvement of the reliability of the prediction results.

[0011] In a possible implementation, if the preset logic guidance tree contains more than one target similarity path, the method further includes: Determine a path progress ratio between the logic path and each target similar path based on the variable nodes included in the logic path and the characteristic value corresponding to each variable node; All target similar pathways are sorted based on the pathway progress ratio, and the target similar pathway with the highest pathway progress ratio is determined as the final target similar pathway.

[0012] By adopting the above technical solution, by finding target similar paths and using similar target variables for prediction, the flexibility in predicting phishing attacks can be greatly improved. In addition, by calculating the path progress ratio between the logical path and each target similar path, and selecting the target similar path with the highest path progress ratio as the final target similar path, it is easy to ensure that the selected final target similar path has the greatest similarity with the attacker's attack process in terms of feature values ​​and business logic, thereby improving the accuracy of the prediction results and reducing the possibility of false positives and false negatives.

[0013] In a possible implementation, when the defense level corresponding to the preset defense warning mechanism corresponding to the phishing attack is lower than the preset level, the method further includes: Identifying the attack progress of each preset logic path in the preset logic guidance tree at the current moment, and determining the current attack degree based on the attack progress of each preset logic path; Determine an initial upgrade permission based on the current attack level, where the initial upgrade permission is the access permission for sensitive data in the network environment to be defended at the current moment; Determine the number of attacks and the frequency of attacks on each sensitive data based on historical attack data, and determine the importance level of each sensitive data based on the number of attacks and the frequency of attacks on each sensitive data; Based on the importance level of each sensitive data and the initial upgrade permission, a target upgrade permission for each sensitive data is determined.

[0014] By adopting the above technical solution, by identifying the attack progress of each preset logical path in the preset logical guidance tree at the current moment, it is easy to grasp and understand the development trend of phishing attacks, and according to the possible current attack situation, perform security defense on sensitive data in advance, and adjust the corresponding access rights according to the importance level of each sensitive data to reduce the probability of sensitive data leakage.

[0015] In one possible implementation, the method further includes: Acquire historical interception data, and determine historical attack behaviors and historical attack paths corresponding to each historical attack behavior from the historical interception data; Determine simulated attack data based on each historical attack behavior and the historical attack path corresponding to each historical attack behavior; Acquire network environment information to be defended, and determine a corresponding simulated honeypot network model based on the network environment information to be defended; Based on the simulated attack data, the simulated honeypot network model is driven to obtain simulated defense data, wherein the simulated defense data includes a defense success rate and a defense duration; Abnormal defense behavior is determined based on the simulated defense data, and the abnormal defense behavior is fed back, wherein the defense success rate corresponding to the abnormal defense behavior is lower than the preset average success rate, or the defense duration is higher than the preset average duration.

[0016] By adopting the above technical solution and analyzing the historical interception data, it is easy to identify the historical attack behaviors and corresponding attack paths, which helps to understand the attacker's common methods and attack strategies. In addition, by simulating the honeypot network model, the specific defense situation when attacked can be simulated, and timely feedback can be given when abnormal defense behaviors occur during the simulated defense process, so that relevant staff can adjust the defense means or strategies in a targeted manner according to the feedback results, thereby improving the overall defense capability.

[0017] In a second aspect, the present application provides an electronic device, which adopts the following technical solution: An electronic device, comprising: at least one processor; Memory; At least one application, wherein the at least one application is stored in a memory and configured to be executed by at least one processor, and the at least one application is configured to: execute the above-mentioned phishing attack intelligent early warning method.

[0018] In a third aspect, the present application provides a computer-readable storage medium, which adopts the following technical solution: A computer-readable storage medium includes: a computer program that can be loaded by a processor and execute the above-mentioned phishing attack intelligent early warning method.

[0019] In a fourth aspect, the present application provides a computer program product, which adopts the following technical solution: A computer program product includes a computer program, and when the computer program is executed by a processor, the computer program implements the above-mentioned intelligent early warning method for phishing attacks.

[0020] In summary, the present application includes at least one of the following beneficial technical effects: By acquiring network data streams in real time, it is easy to capture instant dynamic changes in the network to ensure the timeliness and data accuracy of network security defense. In addition, by performing multimodal data analysis on network data streams to cope with complex and changeable phishing attacks, it is easy to improve the comprehensiveness and accuracy of the early warning analysis process. Through the setting of logical nodes and logical judgment conditions, after determining the multimodal network characteristics, the logical path is automatically determined from the preset logic guidance tree to predict potential phishing attacks, reducing reliance on manual intervention, thereby facilitating improved analysis efficiency and accuracy. Once a phishing attack is predicted, the rapid response method of immediately triggering the corresponding defense early warning mechanism helps to reduce the damage caused by phishing attacks to the network and users, thereby facilitating the improvement of the overall network security protection level.

[0021] By finding target similar paths and using similar target variables for prediction, the flexibility in predicting phishing attacks can be greatly improved. In addition, by calculating the path progress ratio between the logical path and each target similar path and selecting the target similar path with the highest path progress ratio as the final target similar path, it is easy to ensure that the selected final target similar path has the greatest similarity with the attacker's attack process in terms of feature values ​​and business logic, thereby improving the accuracy of the prediction results and reducing the possibility of false positives and negatives.

[0022] By identifying the attack progress of each preset logical path in the preset logical guidance tree at the current moment, it is easy to grasp and understand the development trend of phishing attacks. According to the current possible attack situation, sensitive data can be defended in advance. The corresponding access rights can be adjusted according to the importance level of each sensitive data to reduce the probability of sensitive data leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 It is a flowchart of a phishing attack intelligent early warning method in an embodiment of the present application; Figure 2 It is a schematic diagram of a process for determining target upgrade permissions in an embodiment of the present application; Figure 3 It is a structural schematic diagram of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0024] The following is combined with Figures 1 to 3 This application is described in further detail.

[0025] After reading this specification, those skilled in the art may make non-creative modifications to this embodiment as needed, but such modifications are protected by patent law as long as they are within the scope of the claims of this application.

[0026] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0027] It should be noted that in the optional embodiments of the present application, the object information and other related data involved, when the embodiments in the present application are applied to specific products or technologies, need to obtain the permission or consent of the object, and the collection, use and processing of the relevant data need to comply with the relevant laws, regulations and standards of the relevant countries and regions. In other words, if the embodiments of the present application involve data related to the object, it needs to be obtained with the authorization and consent of the object, the authorization and consent of the relevant departments, and in compliance with the relevant laws, regulations and standards of the country and region. If personal information is involved in the embodiments, the acquisition of all personal information needs to obtain the consent of the individual. If sensitive information is involved, the separate consent of the information subject needs to be obtained. The embodiments also need to be implemented with the authorization and consent of the object.

[0028] Specifically, the embodiment of the present application provides a phishing attack intelligent early warning method, which is executed by an electronic device, which can be a server or a terminal device, wherein the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. The terminal device can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc., but is not limited thereto. The terminal device and the server can be directly or indirectly connected via wired or wireless communication, which is not limited in the embodiment of the present application.

[0029] refer to Figure 1 , Figure 1 : is a flowchart of a phishing attack intelligent early warning method in an embodiment of the present application, the method includes steps S110 to S130, wherein: Step S110: acquiring a network data stream in real time, and performing multimodal data analysis on the network data stream to obtain multimodal network features corresponding to the network data stream.

[0030] Specifically, network data flows include but are not limited to network transmission data, user behavior data, system log data, network traffic data, etc., among which network transmission data can be TCP / IP data packets, which are transmitted between nodes in the network and contain various types of data such as text, images, videos, audio, etc.; user behavior data is data corresponding to the user's network behavior, such as browsing web pages, clicking links, downloading files, sending messages, etc.; system log data, i.e. log data generated by network devices, servers or applications, is used to record the operating status of the system and user activities, etc.; network traffic data is used to describe the statistical data of network traffic, such as bandwidth usage, data packet size, transmission delay, etc. Phishing attacks are a type of network fraud, in which attackers usually disguise themselves as trustworthy entities and induce users to provide sensitive information such as user names, passwords, bank account information, etc. through e-mails, text messages, social media or malicious websites. These phishing attacks are often hidden in seemingly normal network data flows to avoid detection by defense.

[0031] Since network data streams contain multiple types of information, such as text, images, audio, and video, different types of information may hide phishing attacks or other malicious behaviors in different ways. By performing multimodal data analysis on network data streams, it is convenient to simultaneously process and analyze these different types of information, thereby facilitating a more comprehensive detection of potential threats that users may face. Since phishing attacks are often accompanied by abnormal data transmission patterns, such as the centralized transmission of a large amount of sensitive data, abnormal traffic patterns, and abnormal spelling, malicious content may also be added during the data transmission process, or disguised identification, etc. Therefore, the multimodal network features obtained after performing multimodal data analysis on the network data stream can be sensitive data transmission volume, network traffic usage, language identification, grammar, data spelling, and domain name, etc. By analyzing the above multimodal network features, it is convenient to analyze or predict whether the user has encountered a phishing attack.

[0032] Step S120: importing the multimodal network features into a preset logic-oriented tree to determine the logic path corresponding to the network data flow, wherein the preset logic-oriented tree includes a plurality of logic nodes and logic judgment conditions.

[0033] Specifically, the preset logic-oriented tree can be regarded as a logic framework or decision tree for analyzing and judging whether there is a phishing attack in the network data flow. The preset logic-oriented tree contains multiple logic nodes and logic judgment conditions, where the logic node is the basic unit in the preset logic-oriented tree, which is used to characterize the key steps or decision points in the analysis and judgment process. Each logic node corresponds to an analysis task or judgment condition, which is equivalent to processing or evaluating multimodal network features. The construction process of the preset logic-oriented tree can specifically include: Obtain historical defense monitoring data, and determine initial features and target variables based on the historical defense monitoring data; perform correlation analysis on all initial features, and group the initial features based on the correlation analysis results to obtain multiple feature groups; based on the historical business logic corresponding to each feature group, determine the key variables corresponding to each feature group and the logical judgment conditions corresponding to the key variables; based on each initial feature, key variable, logical judgment condition and target variable, construct a preset logic-guided tree.

[0034] Specifically, the target variable is a leaf node, that is, a prediction result, which can be determined based on historical defense monitoring data. The historical defense monitoring data is the defense monitoring data corresponding to the historical time period. The historical time period is a period of time before the current moment. The duration corresponding to the historical time period can be 30 days or 50 days. By limiting the acquisition period of the historical defense monitoring data, it is convenient to realize the real-time update of the target variable, rather than using a fixed blacklist mechanism to predict attack behavior, so as to improve the accuracy of the prediction result. The initial feature is the historical multimodal network feature corresponding to the historical defense monitoring data. The initial feature can be used as the root node, and then the key variables corresponding to different feature groups are determined by analyzing and grouping each initial feature and analyzing the historical business logic corresponding to each feature group. The key variables can be determined as branch nodes. Each key variable corresponds to a logical judgment condition. The logical judgment condition is used to evaluate whether the branch node meets the rules or standards of specific requirements. These judgment conditions can be threshold judgments, pattern matching, statistical analysis, etc. based on multimodal network features. The specific judgment conditions are not specifically limited in the embodiments of this application. When the multimodal network feature corresponding to the network data flow meets the logical judgment condition of a branch node, the analysis process will continue along the branch of the branch node.

[0035] The preset logic guidance tree contains multiple preset logic paths, each of which contains at least one initial feature, key variables, logic judgment conditions and target variables. The preset logic path is the path from the root node to the leaf node in the preset logic guidance tree, and each preset logic path corresponds to a possible phishing attack. Although the preset logic guidance tree is set in advance, the historical defense monitoring data limits the acquisition period, so the preset logic guidance tree is still scalable and configurable, that is, new key variables can be added, logic judgment conditions can be modified, or preset logic paths can be adjusted as needed to adapt to the ever-changing network environment and attack methods. Based on the preset logic guidance tree, the logical path corresponding to the network data flow can be determined.

[0036] Step S130: Determine a predicted phishing attack based on the logical path, and trigger a corresponding defense warning mechanism based on the predicted phishing attack.

[0037] Specifically, the leaf nodes corresponding to the logical path, i.e., the target variables, can be determined based on the network data flow. Each target variable corresponds to a predicted phishing attack. Different predicted phishing attacks correspond to different defense warning mechanisms, wherein the predicted phishing attacks include but are not limited to attacks by forged emails, attacks using social platforms, attacks using browsers, attacks using forged official login interfaces, etc. When a predicted phishing attack is determined based on the network data flow, it indicates that the relevant attackers may have carried out preliminary attack behaviors. If timely defense is not taken at this time, the relevant attackers may further invade or steal sensitive information. Therefore, when a phishing attack is predicted to occur, it is necessary to trigger the corresponding defense warning mechanism based on the predicted phishing attack in a timely manner. For example, when the predicted phishing attack is a forged email attack, the corresponding defense warning mechanism can be to remind users to click links with caution and recommend verifying the authenticity of the information through official channels; when the predicted phishing attack is an attack using a browser, the corresponding defense warning mechanism can be to remind users to update the browser or apply patches and avoid entering sensitive information on suspicious websites. There is a corresponding relationship between the predicted phishing attack and the defense warning mechanism. Based on the corresponding relationship, any defense warning mechanism corresponding to the predicted phishing attack can be triggered in time. The specific content of the corresponding relationship is not specifically limited in the embodiment of the present application and can be determined by relevant staff based on historical experimental data and uploaded to the electronic device.

[0038] For the embodiments of the present application, by acquiring network data streams in real time, it is convenient to capture instant dynamic changes in the network to ensure the timeliness and data accuracy of network security defense. In addition, by performing multimodal data analysis on network data streams to cope with complex and changeable phishing attacks, it is convenient to improve the comprehensiveness and accuracy of the early warning analysis process. Through the setting of logical nodes and logical judgment conditions, after determining the multimodal network characteristics, the logical path is automatically determined from the preset logic guidance tree to predict potential phishing attacks, reducing reliance on manual intervention, thereby facilitating the improvement of analysis efficiency and accuracy. Once a phishing attack is predicted, the rapid response method of immediately triggering the corresponding defense early warning mechanism helps to reduce the damage caused by phishing attacks to the network and users, thereby facilitating the improvement of the overall network security protection level.

[0039] Furthermore, in order to improve the reliability of the prediction results, when determining the prediction of phishing attacks based on the logical path, the following steps may be specifically included: Identify the variable nodes included in the logic path and determine whether the logic path contains the target variable; if so, determine the predicted phishing attack based on the target variable; if not, determine the target similarity path from the preset logic guidance tree based on the variable nodes included in the logic path and the characteristic values ​​corresponding to each variable node, and determine the predicted phishing attack based on the similar target variables included in the target similarity path.

[0040] Specifically, when a predicted phishing attack is determined based on network data flow, it only represents that the relevant attacker may have carried out preliminary attack behavior. However, it may be difficult to directly determine the corresponding target variable along a certain variable node by only analyzing the preliminary attack behavior of the relevant attacker, that is, it may be difficult to directly follow a branch to a leaf node. Therefore, the logical path may contain the target variable or may not contain the target variable.

[0041] When the target variable is included in the logic path, the corresponding predicted phishing attack is directly determined based on the target variable. When the target variable is not included in the logic path, the existing knowledge and experience can be used to assist the prediction. Specifically, the direction of the current logic path can be predicted based on the variable nodes in the logic path and the characteristic values ​​of each variable node, that is, the target similar path corresponding to the current logic path is determined from the preset logic guide tree. The target similar path includes the current logic path and the similar target variable. For example, if the current logic path is abc, then the target similar path can be abcd-similar target variable, or abcde-similar target variable, where a is the root node, and b, c, d, and e are branch nodes. After determining the target similar path corresponding to the current logic path, the corresponding phishing attack can be predicted directly based on the similar target variable in the target similar path.

[0042] It can be seen from the above content that the target similar path corresponding to the current logical path must meet two conditions at the same time. Condition 1 is that the target similar path must include the current logical path, and condition 2 is that the target similar path must include similar target variables. Therefore, there may be multiple target similar paths for the current logical path. In order to improve the accuracy of the prediction results and reduce the possibility of false positives and false negatives, if the preset logic guidance tree contains more than one target similar path, the method provided in the embodiment of the present application also includes: Based on the variable nodes contained in the logical path and the characteristic values ​​corresponding to each variable node, the path progress ratio between the logical path and each target similar path is determined; based on the path progress ratio, all target similar paths are sorted, and the target similar path with the highest path progress ratio is determined as the final target similar path.

[0043] Specifically, for any target similar path, the number of similar path nodes contained in the target similar path and the number of logical path nodes contained in the logical path can be identified. The number of logical path nodes is first compared with the number of similar path nodes to determine the initial path progress ratio, where the number of logical path nodes is the sum of the variable nodes and the root node. Then, the corresponding critical variable node of the logical path is determined from the target similar path, and the critical logic judgment condition corresponding to the critical variable node is determined from the preset logic guidance tree. At the same time, the critical characteristic value corresponding to the critical variable node is determined based on the network data flow, and then the critical difference value is determined based on the critical logic judgment condition and the critical characteristic value. Finally, the progress ratio adjustment rate corresponding to the critical difference value is determined based on the preset adjustment mapping relationship, and the initial path progress ratio is adjusted based on the progress ratio adjustment rate to obtain the path progress ratio corresponding to the target similar path, wherein the preset adjustment mapping relationship is the corresponding relationship between the critical difference value and the progress ratio adjustment rate. The specific content of the preset adjustment mapping relationship is not specifically limited in the embodiment of the present application, and can be determined by relevant staff according to historical experimental data and uploaded to the electronic device. The larger the critical difference value, the larger the corresponding progress ratio adjustment rate. The critical variable node is the next execution variable node of the logic path relative to the target similarity path. For example, when the logic path is abc and the target similarity path is abcd-similar target variable, the critical variable node is d, and the critical logic judgment condition is the logic judgment condition corresponding to node d.

[0044] Based on the above method, the path progress ratio between the logical path and any target similar path can be determined. After determining the path progress ratio between the logical path and each target similar path, all target similar paths are sorted based on the path progress ratio to obtain a path sequence, and the target similar path corresponding to the highest path progress ratio in the path sequence is determined as the final target similar path, so as to achieve screening of multiple target similar paths, so as to ensure that the selected final target similar path has the greatest similarity with the attacker's attack process in terms of feature values ​​and business logic, thereby improving the accuracy of the prediction results and reducing the possibility of false positives and false negatives.

[0045] When the defense level corresponding to the defense warning mechanism corresponding to the preset phishing attack is lower than the preset level, the method provided in the embodiment of the present application further includes steps S210 to S240, such as Figure 2 As shown, where: Step S210: Identify the attack progress of each preset logic path in the preset logic guidance tree at the current moment, and determine the current attack level based on the attack progress of each preset logic path.

[0046] Specifically, different defense warning mechanisms correspond to different defense levels. The defense level corresponding to each defense warning mechanism can be determined based on a preset level mapping relationship. The preset level mapping relationship is the correspondence between the defense warning mechanism and the defense level. Based on the preset level mapping relationship, the defense level corresponding to any defense warning mechanism can be determined. The specific content of the preset level mapping relationship is not specifically limited in the embodiment of this application, and can be determined by relevant staff based on historical experimental data and uploaded to the electronic device. When the defense level is low, the corresponding defense warning mechanism may only be a pop-up window prompt. At this time, the access rights to sensitive data are still the original rights. In order to reduce the probability of sensitive data leakage, the attack progress can be analyzed at this time, and defense can be taken in advance based on the analysis results.

[0047] The multimodal network features determined at the current moment can be imported into the preset logic guidance tree to determine the attack progress corresponding to each preset logic path. The closer the cutoff variable node in each preset logic path is to the target variable, the faster the attack progress characterizing the preset logic path is, and the higher the corresponding current attack degree is. The cutoff variable node is the node corresponding to the judgment condition currently satisfied by the multimodal network feature. For example, the preset logic path is abcd-similar target variable, the multimodal network feature satisfies the logic judgment condition corresponding to the c node, and temporarily does not meet the logic judgment condition corresponding to the d node. At this time, the cutoff variable node can be determined to be the c node.

[0048] Step S220: Determine the initial upgrade permissions based on the current attack level, where the initial upgrade permissions are the access permissions for sensitive data in the network environment to be defended at the current moment.

[0049] Specifically, the sensitive data in the network environment to be defended can be determined by the user, and can also be data containing sensitive identifiers, wherein the sensitive identifiers can be determined by relevant staff based on historical experimental data and then uploaded to the electronic device. Different attack levels correspond to different initial upgrade permissions, and the initial upgrade permissions corresponding to the current attack level can be determined based on a preset upgrade permission mapping relationship. The preset upgrade permission mapping relationship is the correspondence between the current attack level and the initial upgrade permissions. The specific content of the preset upgrade permission mapping relationship is not specifically limited in the embodiments of the present application. After determining the initial upgrade permissions, the access rights of the sensitive data in the network environment to be defended are adjusted from the original permissions to the initial upgrade permissions. By adjusting the access rights of the sensitive data in advance according to the progress of the attack when possible attack behaviors are detected, the security of the sensitive data can be improved.

[0050] Step S230: Determine the number of attacks and the frequency of attacks on each sensitive data based on the historical attack data, and determine the importance level of each sensitive data based on the number of attacks and the frequency of attacks on each sensitive data.

[0051] Step S240: Determine the target upgrade permission for each sensitive data based on the importance level and initial upgrade permission for each sensitive data.

[0052] Specifically, after an overall adjustment of the access rights to all sensitive data, the importance level of each sensitive data can be understood through historical attack data, and finally the initial upgrade permissions can be further adjusted based on the importance level of the sensitive data. The historical attack data records the time when each sensitive data was attacked in the historical time period. The number of attacks and the frequency of attacks for each sensitive data can be determined based on the historical attack data. The more attacks and the more frequent the attacks, the higher the importance level of the corresponding sensitive data. Based on the preset attack combination parameter mapping relationship, the importance level of each sensitive data can be determined based on the number of attacks and the frequency of attacks for each sensitive data. The preset attack combination parameter mapping relationship is the correspondence between the combination of the number of attacks and the frequency of attacks and the importance level.

[0053] By identifying the attack progress of each preset logical path in the preset logical guidance tree at the current moment, it is easy to grasp and understand the development trend of phishing attacks. According to the current possible attack situation, sensitive data can be defended in advance. The corresponding access rights can be adjusted according to the importance level of each sensitive data to reduce the probability of sensitive data leakage.

[0054] In order to facilitate relevant staff to adjust defense means or strategies in a targeted manner according to the feedback results, thereby improving the overall defense capability, the method provided in the embodiment of the present application also includes: Obtain historical interception data, and determine historical attack behaviors and historical attack paths corresponding to each historical attack behavior from the historical interception data; determine simulated attack data based on each historical attack behavior and the historical attack path corresponding to each historical attack behavior; obtain network environment information to be defended, and determine the corresponding simulated honeypot network model based on the network environment information to be defended; drive the simulated honeypot network model based on the simulated attack data to obtain simulated defense data, and the simulated defense data includes a defense success rate and a defense duration; determine abnormal defense behaviors based on the simulated defense data, and provide feedback on the abnormal defense behaviors, wherein the defense success rate corresponding to the abnormal defense behaviors is lower than the preset average success rate, or the defense duration is higher than the preset average duration.

[0055] Specifically, historical interception data can be obtained from the network security record log, and the historical interception data includes, but is not limited to, key data such as attack time, attack method, attack source IP address, and attack target. The obtained historical interception data can be analyzed based on a preset network monitoring tool or log analysis tool to identify the historical attack behavior contained in the historical interception data, and the historical attack behavior is various types of phishing attacks. The historical attack path can be the attack source, attack method, attack target, etc., wherein the specific preset network monitoring tool or log analysis tool is not limited in the embodiment of the present application, as long as the historical attack behavior and the historical attack path corresponding to each historical attack behavior can be identified from the historical interception data. After determining the historical attack behaviors and the historical attack paths corresponding to each historical attack behavior, the preset network attack simulation tool can be used to generate simulated attack data. The preset network attack simulation tool can be Scapy, Metasploit, etc., and the specific tool is not limited. Metasploit is mainly used in penetration testing, vulnerability assessment, and security auditing. By simulating real network attack scenarios, Metasploit can help users discover potential vulnerabilities and weaknesses in the network system to be defended, and provide corresponding repair suggestions and improvement measures. The simulated attack data should restore the characteristics and paths of historical attack behaviors as much as possible to facilitate effective simulated defense testing.

[0056] The network environment information to be defended includes but is not limited to network structure, device type, operating system, etc. Based on the network environment information to be defended, a corresponding simulated honeypot network model is constructed. The simulated honeypot network model should contain network devices, services and vulnerabilities similar to the real network environment to be defended, so as to conduct a real simulated defense test. The generated simulated attack data is deployed to the simulated honeypot network model for simulated attack testing. During the simulated attack testing process, the simulated defense data of the simulated honeypot network model is collected, including key indicators such as defense success rate and defense duration. The collected simulated defense data is deeply analyzed, and the defense success rate and defense duration under different simulated attack behaviors are compared. Then, according to the preset average success rate and average duration, abnormal defense behavior and non-abnormal defense behavior are determined. Among them, abnormal defense behavior is manifested as a defense success rate lower than the preset average success rate, or a defense duration higher than the preset average duration. Finally, the determined abnormal defense behavior can be fed back to the network security team or relevant managers, so that the network security team or relevant managers can adjust the defense means or strategies in a targeted manner according to the feedback results, thereby improving the overall defense capability. The preset average success rate and the preset average duration are not specifically limited in the embodiments of the present application, and can be determined by relevant staff based on historical experimental data and uploaded to the electronic device.

[0057] An electronic device is provided in an embodiment of the present application, such as Figure 3 As shown, Figure 3 The electronic device 300 shown includes: a processor 301 and a memory 303. The processor 301 and the memory 303 are connected, such as through a bus 302. Optionally, the electronic device 300 may also include a transceiver 304. It should be noted that in actual applications, the transceiver 304 is not limited to one, and the structure of the electronic device 300 does not constitute a limitation on the embodiments of the present application.

[0058] The processor 301 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor 301 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0059] The bus 302 may include a path to transmit information between the above components. The bus 302 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 302 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 The fact that only one line is used in the diagram does not mean that there is only one bus or only one type of bus.

[0060] The memory 303 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0061] The memory 303 is used to store the application code for executing the solution of the present application, and the execution is controlled by the processor 301. The processor 301 is used to execute the application code stored in the memory 303 to implement the contents shown in the above method embodiment.

[0062] The electronic devices include, but are not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), and fixed terminals such as digital TVs, desktop computers, etc. It can also be a server, etc. Figure 3 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0063] An embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer-readable storage medium is run on a computer, the computer can execute the corresponding content in the aforementioned method embodiment.

[0064] The embodiment of the present application provides a computer program product, which includes a computer program, and the computer program implements the method in any of the above embodiments when executed by a processor. Compared with the related art, the embodiment of the present application obtains network data streams in real time, so as to capture the instant dynamic changes in the network, so as to ensure the timeliness and data accuracy of network security defense. In addition, by performing multimodal data analysis on the network data stream to cope with complex and changeable phishing attacks, it is convenient to improve the comprehensiveness and accuracy of the early warning analysis process. Through the setting of logical nodes and logical judgment conditions, after determining the multimodal network characteristics, the logical path is automatically determined from the preset logical guidance tree, so as to predict potential phishing attacks, reduce the dependence on manual intervention, so as to improve the analysis efficiency and accuracy. Once a phishing attack is predicted, the rapid response method of immediately triggering the corresponding defense early warning mechanism helps to reduce the damage caused by the phishing attack to the network and users, so as to improve the overall network security protection level.

[0065] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0066] The above description is only a partial implementation method of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A phishing attack intelligent early warning method, characterized in that: include: Acquire network data streams in real time, and perform multimodal data analysis on the network data streams to obtain multimodal network features corresponding to the network data streams; Importing the multimodal network features into a preset logic-oriented tree to determine a logic path corresponding to the network data flow, wherein the preset logic-oriented tree includes a plurality of logic nodes and logic judgment conditions; A predicted phishing attack is determined based on the logic pathway, and a corresponding defense warning mechanism is triggered based on the predicted phishing attack.

2. According to claim 1, a phishing attack intelligent early warning method is characterized in that: The process of constructing the preset logic-guided tree includes: Obtain historical defense monitoring data, and based on the historical defense monitoring data Determine initial features and target variables; Performing correlation analysis on all initial features, and grouping the initial features based on the correlation analysis results to obtain multiple feature groups; Based on the historical business logic corresponding to each feature group, determine the key variables corresponding to each feature group and the logical judgment conditions corresponding to the key variables; The preset logic guidance tree is constructed based on each initial feature, key variable, logical judgment condition and target variable.

3. The method for intelligent early warning of phishing attacks according to claim 2, characterized in that: The step of determining and predicting a phishing attack based on the logic path includes: Identifying variable nodes included in the logic path, and determining whether the logic path includes a target variable; If so, determining a predicted phishing attack based on the target variable; If not, based on the variable nodes included in the logic path and the characteristic values ​​corresponding to each variable node, a target similarity path is determined from the preset logic guidance tree, and a predicted phishing attack is determined based on similar target variables included in the target similarity path.

4. The method for intelligent early warning of phishing attacks according to claim 3, characterized in that: If the preset logic-guided tree contains more than one target similarity path, it also includes: Determining a path progress ratio between the logic path and each target similar path based on the variable nodes included in the logic path and the characteristic value corresponding to each variable node; All target similar pathways are sorted based on the pathway progress ratio, and the target similar pathway with the highest pathway progress ratio is determined as the final target similar pathway.

5. The method for intelligent early warning of phishing attacks according to claim 1, characterized in that: When the defense level corresponding to the preset phishing attack defense warning mechanism is lower than the preset level, the method further includes: Identifying the attack progress of each preset logic path in the preset logic guidance tree at the current moment, and determining the current attack degree based on the attack progress of each preset logic path; Determine an initial upgrade permission based on the current attack level, where the initial upgrade permission is the access permission for sensitive data in the network environment to be defended at the current moment; Determine the number of attacks and the frequency of attacks on each sensitive data based on historical attack data, and determine the importance level of each sensitive data based on the number of attacks and the frequency of attacks on each sensitive data; Based on the importance level of each sensitive data and the initial upgrade permission, a target upgrade permission for each sensitive data is determined.

6. The method for intelligent early warning of phishing attacks according to claim 1, characterized in that: Also includes: Acquire historical interception data, and determine historical attack behaviors and historical attack paths corresponding to each historical attack behavior from the historical interception data; Determine simulated attack data based on each historical attack behavior and the historical attack path corresponding to each historical attack behavior; Acquire network environment information to be defended, and determine a corresponding simulated honeypot network model based on the network environment information to be defended; Based on the simulated attack data, the simulated honeypot network model is driven to obtain simulated defense data, wherein the simulated defense data includes a defense success rate and a defense duration; Abnormal defense behavior is determined based on the simulated defense data, and the abnormal defense behavior is fed back, wherein the defense success rate corresponding to the abnormal defense behavior is lower than the preset average success rate, or the defense duration is higher than the preset average duration.

7. An electronic device, characterized in that: The electronic device includes: at least one processor; Memory; At least one application, wherein the at least one application is stored in a memory and configured to be executed by at least one processor, and the at least one application is configured to: execute a phishing attack intelligent early warning method according to any one of claims 1-6.

8. A computer-readable storage medium, characterized in that: include: A computer program is stored which can be loaded by a processor and executes a phishing attack intelligent early warning method as described in any one of claims 1-6.

9. A computer program product, characterized in that It includes a computer program, which, when executed by a processor, implements the steps of a phishing attack intelligent early warning method according to any one of claims 1 to 6.

Images