Attack detection method, device and equipment

Abstract

The invention provides an attack detection method, device and equipment, relates to the technical field of network security, and is used for improving the accuracy of attack detection. The attack detection method comprises: analyzing first traffic data from a target server to obtain first feature information, the first feature information being used for indicating source information of the first traffic data and a processing condition of the target server on the first traffic data; according to the first feature information and a pre-trained detection model, determining whether the first traffic data is abnormal, the detection model being obtained by training an initial detection model according to a sample data set, and the sample data set being obtained by analyzing real-time traffic data of each server; and determining whether the target server is attacked or not according to the proportion of the abnormal traffic data in the traffic data set detected by the detection model within the first duration range, the traffic data set comprising the first traffic data.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an attack detection method, device and equipment. Background Art

[0002] The CC (Challenge Collapsar) attack is a common distributed denial of service (DDoS) attack, which mainly consumes server resources by sending a large number of requests to the target server, causing the target server to be unable to process normal user requests, thereby achieving the purpose of denial of service.

[0003] In order to ensure the access needs of normal users, it is usually determined whether the target server is under CC attack by judging whether the number of access requests to the target server exceeds the preset threshold within a period of time. However, since the preset threshold is usually set by human experience or obtained based on statistical analysis of historical access behavior, there is a certain error, resulting in low accuracy of CC attack detection. Summary of the invention

[0004] The present application provides an attack detection method, apparatus and device for improving the accuracy of CC attack detection.

[0005] In a first aspect, an embodiment of the present application provides an attack detection method, comprising: parsing first traffic data from a target server to obtain first feature information, wherein the first feature information is used to indicate source information of the first traffic data and processing of the first traffic data by the target server; determining whether the first traffic data is abnormal based on the first feature information and a pre-trained detection model, wherein the detection model is obtained by training an initial detection model based on a sample data set, and the sample data set is parsed from real-time traffic data of each server; determining whether the target server is attacked based on the proportion of abnormal traffic data in the traffic data set after detection by the detection model within a first time range, wherein the traffic data set includes the first traffic data.

[0006] In the embodiment of the present application, the first characteristic information of the first traffic data is detected by combining the detection model with the first characteristic information of the first traffic data. Since the detection model has learned the characteristics of abnormal traffic data and normal traffic data in the sample data set during the training process, the first traffic data can be accurately classified for abnormal detection during detection, that is, whether the first traffic data is abnormal is determined, which improves the accuracy of abnormal detection of the first traffic data. Furthermore, whether the target server is attacked is determined based on the proportion of abnormal traffic data in the traffic data set, which effectively avoids the situation in which the threshold setting accuracy is low and cannot adapt to the dynamically changing business environment in the traditional threshold judgment method, and improves the accuracy of attack detection.

[0007] In one possible implementation, the first feature information includes an application programming interface API asset, a user identifier, and an access delay of the first traffic data; determining whether the first traffic data is abnormal based on the first feature information and a pre-trained detection model includes: inputting the API asset, the user identifier, and the access delay into the detection model, so that the detection model determines a reference access delay corresponding to an access type matching the API asset and the user identifier, and outputting a detection result of the first traffic data based on a difference between the reference access delay and the access delay, wherein the detection result indicates whether the first traffic data is abnormal.

[0008] In a possible implementation, the first characteristic information also includes a return code; after obtaining the detection result of the detection model on the first flow data, the method also includes: if the detection result indicates that the first flow data is abnormal, verifying whether the first flow data is abnormal according to the return code; if the return code matches any abnormal return code in a preset abnormal return code set, determining that the first flow data is abnormal; if the return code does not match any abnormal return code in the preset abnormal return code set, changing the abnormal detection result of the first flow data to normal.

[0009] In a possible implementation, before determining whether the first traffic data is abnormal based on the first feature information and the pre-trained detection model, the method also includes: receiving real-time traffic data from each server in real time through a message queue; parsing the real-time traffic data to obtain second feature information in the real-time traffic data; determining a set of suspected abnormal traffic data of each server in the servers within a second time range based on the second feature information and the request occurrence time of the real-time traffic data; determining abnormal traffic data from the set of suspected abnormal traffic data based on the resource usage of each server and the return code of each suspected abnormal traffic data in the set of suspected abnormal traffic data; classifying and identifying the abnormal traffic data and the normal traffic data of the real-time traffic data of each server, and using the identified abnormal traffic data and the identified normal traffic data as the sample data set.

[0010] In a possible implementation, the set of suspected abnormal traffic data satisfies at least one of the following conditions: the access frequency of the real-time traffic data within the second time range when the request occurs exceeds the preset frequency; the number of accesses to the real-time traffic data of the same user identifier within the second time range exceeds the first preset number; the number of accesses to the real-time traffic data of the same API asset within the second time range exceeds the second preset number.

[0011] In a possible implementation, whether the target server is attacked is determined based on the proportion of abnormal traffic data in the traffic data set after detection by the detection model within the first time range, including: if the proportion of the abnormal traffic data exceeds a preset proportion, it is determined that the target server is attacked; if the proportion of the abnormal traffic data does not exceed the preset proportion, it is determined that the target server is not attacked.

[0012] In a second aspect, an embodiment of the present application provides an attack detection device, comprising: a parsing module, used to parse first flow data from a target server to obtain first characteristic information, wherein the first characteristic information is used to indicate source information of the first flow data and processing of the first flow data by the target server; a detection module, used to determine whether the first flow data is abnormal based on the first characteristic information and a pre-trained detection model, wherein the detection model is obtained by training an initial detection model based on a sample data set, and the sample data set is parsed from real-time flow data of each server; a determination module, used to determine whether the target server is attacked based on the proportion of abnormal flow data in the flow data set after detection by the detection model within a first time range, wherein the flow data set includes the first flow data.

[0013] In one possible implementation, the first characteristic information includes an application programming interface API asset, a user identifier, and an access delay of the first traffic data; the detection module is specifically used to: input the API asset, the user identifier, and the access delay into the detection model, so that the detection model determines a reference access delay corresponding to an access type that matches the API asset and the user identifier, and outputs a detection result of the first traffic data based on the difference between the reference access delay and the access delay, wherein the detection result indicates whether the first traffic data is abnormal.

[0014] In a possible implementation, the first characteristic information also includes a return code; the detection module is also used to, after obtaining the detection result of the detection model on the first flow data, if the detection result indicates that the first flow data is abnormal, verify whether the first flow data is abnormal according to the return code; if the return code matches any abnormal return code in a preset abnormal return code set, determine that the first flow data is abnormal; if the return code does not match any abnormal return code in the preset abnormal return code set, change the abnormal detection result of the first flow data to normal.

[0015] In a possible implementation, the parsing module is also used to: before determining whether the first traffic data is abnormal based on the first feature information and the pre-trained detection model, receive real-time traffic data from each server in real time through a message queue; parse the real-time traffic data to obtain second feature information in the real-time traffic data; determine a set of suspected abnormal traffic data of each server in the servers within a second time range based on the second feature information and the request occurrence time of the real-time traffic data; determine abnormal traffic data from the set of suspected abnormal traffic data based on the resource usage of each server and the return code of each suspected abnormal traffic data in the set of suspected abnormal traffic data; classify and identify the abnormal traffic data and the normal traffic data of the real-time traffic data of each server, and use the identified abnormal traffic data and the identified normal traffic data as the sample data set.

[0016] In a possible implementation, the set of suspected abnormal traffic data satisfies at least one of the following conditions: the access frequency of the real-time traffic data within the second time range when the request occurs exceeds the preset frequency; the number of accesses to the real-time traffic data of the same user identifier within the second time range exceeds the first preset number; the number of accesses to the real-time traffic data of the same API asset within the second time range exceeds the second preset number.

[0017] In a possible implementation, the determination module is specifically used to: if the proportion of the abnormal traffic data exceeds a preset proportion, determine that the target server is attacked; if the proportion of the abnormal traffic data does not exceed the preset proportion, determine that the target server is not attacked.

[0018] In a third aspect, an embodiment of the present application provides an attack detection device, comprising: at least one processor, and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the at least one processor implements the method described in the first aspect and any possible implementation manner by executing the instructions stored in the memory.

[0019] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions. When the computer instructions are executed on a computer, the computer executes the method described in the first aspect and any possible implementation manner.

[0020] In a fifth aspect, an embodiment of the present application provides a computer program product, comprising computer instructions, which, when executed on a computer, enables the method described in the first aspect and any possible implementation method to be implemented.

[0021] The beneficial effects of the second to fifth aspects can be referred to the contents described in the first aspect above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 A schematic diagram of an application scenario of an attack detection method provided in an embodiment of the present application;

[0023] Figure 2 A flowchart of an attack detection method provided in an embodiment of the present application;

[0024] Figure 3 A schematic diagram of the structure of an attack detection device provided in an embodiment of the present application;

[0025] Figure 4 A schematic diagram of the structure of an attack detection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0027] The terms "first" and "second" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of their variations are intended to cover non-exclusive protection. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. "Multiple" in the present application can mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.

[0028] The following is a description of exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of the present application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description. It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, which should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0029] In the technical solution of this application, the acquisition, transmission, storage, and use of data are in compliance with the requirements of relevant national laws and regulations.

[0030] In order to better understand the attack detection method provided in the embodiment of the present application, the background technology of the present application is briefly described below.

[0031] Application programming interfaces (APIs) play a vital role in modern software development and digital transformation. However, APIs are usually public interfaces that allow users or applications to make frequent calls, making them ideal targets for CC attacks. The openness and dynamism of APIs make them more susceptible to abuse, especially when attackers use a large number of forged requests, which can quickly exhaust API server resources.

[0032] In response to API security issues, the Open Web Application Security Project (OWASP) provides a dedicated API security project, which includes the top ten security issues in API development, with particular emphasis on missing resources and rate limits. However, there is no rate limit or limit on the number of API requests, which makes it easy to cause CC attacks.

[0033] Currently, CC attacks caused by the abuse of API resources still use the traditional Web application firewall (WAF) protection method, which targets the source IP's access to the target uniform resource locator (URL). However, in the API request of CC attacks, it is the user's access to API assets, resulting in poor results of traditional protection methods.

[0034] In view of this, the embodiment of the present application provides an attack detection method, which learns the characteristics of abnormal traffic data and normal traffic data in a sample data set by machine learning, and then when the first traffic data is detected by using a pre-trained detection model combined with the first characteristic information of the first traffic data, the accuracy of the abnormal detection classification of the first traffic data can be effectively improved, and then the proportion of the abnormal traffic data in the traffic data set is used to determine whether the target server is attacked, which effectively avoids the situation in which the threshold setting accuracy in the traditional threshold judgment method is low and cannot adapt to the dynamically changing business environment, and improves the accuracy of attack detection. Because the first characteristic information indicates the source information of the first traffic data and the processing of the first traffic data by the target server, the pre-trained detection model also considers the API information and response information corresponding to the first traffic data when detecting the first traffic data. Compared with the traditional waf protection method, the attack detection method described in the embodiment of the present application is more suitable for API security scenarios, and effectively improves the accuracy of CC attack detection for API scenarios.

[0035] Please refer to Figure 1 , is a schematic diagram of an application scenario of an attack detection method provided in an embodiment of the present application. Figure 1 As shown, the schematic diagram includes a target server 110 and an attack detection device 120. The target server 110 and the attack detection device 120 can perform wired or wireless communication.

[0036] The target server 110 may be a single server in certain business scenarios, or any server in a server cluster or a distributed server of a cloud platform, which is not limited in the present embodiment of the application. Figure 1 In the example, the target server 110 is illustrated as any server in the server cluster. The attack detection device 120 refers to a device or apparatus with data processing capability, such as a terminal device or a server, and the terminal device includes but is not limited to a mobile phone, a personal computer (PC), a tablet computer, a laptop computer, a PDA, a mobile internet device (MID), etc. When the attack detection device 120 is a device with data processing capability, it can specifically be a functional module in a device, and the embodiment of the present application does not limit this.

[0037] Exemplarily, the target server 110 receives an access request from a client in real time, processes the access request, and returns response information to the client. The client is, for example, a browser, a mobile application, etc. Exemplarily, the client can send an access request to the target server 110 through a terminal device, and the terminal device can refer to the content described above. The attack detection device 120 collects the first flow data between the target server 110 and the client in real time, and parses the first flow data to obtain the first feature information of the first flow data, and performs anomaly detection on the first flow data based on the first feature information and the pre-trained detection model to determine whether the first flow data is abnormal. Furthermore, the attack detection device 120 determines whether the target server is attacked based on the proportion of abnormal flow data in the flow data set detected by the detection model within the first time range. Among them, the specific implementation method of the attack detection device 120 to determine whether the target server is attacked will be described below.

[0038] Please refer to Figure 2 , is a flow chart of an attack detection method provided in an embodiment of the present application. The following is a flow chart of an attack detection method performed by an attack detection device. Figure 2 The attack detection device is, for example, Figure 1 The attack detection device 120 shown, Figure 2 The target server involved is, for example, Figure 1 A target server 110 is shown.

[0039] S201, parse first traffic data from a target server to obtain first characteristic information, where the first characteristic information is used to indicate source information of the first traffic data and processing status of the first traffic data by the target server.

[0040] The first traffic data is the network traffic data between the target server and the client, which is generated by the access request and response information between the client and the target server, and includes all the communication information between the client and the server. In layman's terms, when the client sends an access request to the target server, the target server will respond to the access request, and this process will generate network traffic, which can be considered as the first traffic data. Exemplarily, the access request can be a Hypertext Transfer Protocol (HTTP) request or an HTTP2 request.

[0041] The source information of the first traffic data indicated by the first characteristic information may specifically refer to the API information accessed by the access request for the first traffic data and the user information initiating the access request, and the processing request of the target server for the first traffic data indicated by the first characteristic information may specifically refer to the response information of the target server to the access request in the first traffic data.

[0042] Optionally, the first characteristic information may include the API assets, user identification and access delay of the first traffic data. Among them, the API assets generally include the API interface itself and its related metadata, documents, usage permissions, etc. The user identification is a string generated by the authentication server and is used to verify the user's identity. The access delay refers to the time interval from the client sending an access request to the target server to the client receiving the response information from the target server. The access delay may include the time it takes for the server to process the access request and generate the response information.

[0043] Optionally, the first characteristic information may also include a return code, i.e., a response status code, or a status code, which is used to indicate the processing result of the access request, or in other words, through the status code, the processing status of the access request by the target server can be understood. For example, the status code is 200 (OK), 404 (Not Found), 503 (Service Unavailable), etc.

[0044] Specifically, the attack detection device can extract access request information and response information from the first traffic data, and extract information such as URL, request body (POST_BODY), request header, response status code, access delay, request occurrence time, etc. from the access request information. Furthermore, the attack detection device can parse the URL and request body to obtain API asset information; parse the request header to obtain a user identifier.

[0045] For example, taking the URL / v1 / app? name=test as an example, the API asset obtained by parsing is / v1 / app? name=? . Among them, / v1 / app is the path part, v1 indicates the API version, and app indicates the resource or endpoint of the API. ? name=test is the query parameter part, name is the query parameter key, and test is the query parameter value.

[0046] For another example, take the HTTP header Authorization: bearer ACCESS_TOKEN as an example, the user identifier is ACCESS_TOKEN. Among them, Authorization is used to transmit authentication information. Bearer indicates the token authentication method.

[0047] S202, determining whether the first traffic data is abnormal based on the first feature information and a pre-trained detection model, wherein the detection model is obtained by training an initial detection model based on a sample data set, and the sample data set is obtained by parsing real-time traffic data from each server.

[0048] The detection model can be a hybrid model that combines a support vector machine (SVM) and a support vector optimization algorithm, such as the Harris Hawks Optimization (HHO) algorithm, and the detection model is, for example, an SVM-HHO model. The SVM-HHO model optimizes the parameters of the SVM through the HHO algorithm. The optimized SVM model usually has a higher classification accuracy and better generalization ability, which improves the classification performance of the SVM. In addition, the global search capability of HHO helps the SVM model to fall into a local optimal solution, thereby improving the robustness of the SVM.

[0049] The specific method of training the detection model is described below.

[0050] Step 1: Get the sample data set.

[0051] The attack detection device can receive real-time traffic data from each server in real time through a message queue. The message queue is, for example, a kafka message queue. Each server can refer to an independent server, a server cluster, or a server in a cloud platform from at least one business scenario. In order to enrich the sample data set, real-time traffic data can be collected from as many servers as possible. During the data collection stage, real-time traffic data on the server can be collected by mirroring traffic or reverse proxy and pushed to the message queue. For the cloud platform, network traffic can also be obtained in real time by means of traffic probes and pushed to the message queue. Then the attack detection device can receive real-time traffic data from each server in real time through a message queue.

[0052] The attack detection device can parse the received real-time traffic data to obtain the second characteristic information. The content of the second characteristic information and the method of parsing the second characteristic information can correspond to the content of the first characteristic information above, which will not be repeated here.

[0053] Furthermore, the attack detection device may determine the suspected abnormal traffic data set of each server in each server within the second time range according to the second characteristic information and the request occurrence time of the real-time traffic data. The suspected abnormal traffic data set may refer to a traffic data set with a high access frequency, a high access frequency to the same API, or a high access frequency to the same user in each server within the second time range. Among them, the second time range may be predefined in the attack detection device, and the specific value may be set according to actual needs, and in actual applications, the second time range may also be implemented by a sliding time window, which is not limited in the embodiments of the present application.

[0054] Specifically, the suspected abnormal traffic data set meets at least one of the following conditions:

[0055] (1) The access frequency of the real-time traffic data whose request occurrence time is within the second time range exceeds the preset frequency;

[0056] (2) the number of accesses to the real-time traffic data of the same user ID within the second time period exceeds the first preset number;

[0057] (3) The number of visits to the real-time traffic data of the same API asset within the second time range exceeds a second preset number.

[0058] Among them, the preset frequency, the first preset number, and the second preset number are all predefined in the attack detection device, and their specific values ​​can be set according to actual needs, which is not limited in the embodiment of the present application.

[0059] That is to say, when there is high-frequency access traffic data in the server within the second time range, it is considered that the traffic data within the second time range belongs to the suspected abnormal traffic data set.

[0060] Exemplarily, the attack detection device can use the OpenGemini database to process the real-time traffic data from each server to determine the suspected abnormal traffic data set of each server. Specifically, the attack detection device inserts the parsed second feature information into the OpenGemini database, and uses SQL statements in the OpenGemini database to implement aggregation and filtering operations. Exemplarily, the SQL statement is as follows:

[0061] select count("id")from table group by"user_id","api_id",time(1min).

[0062] The OpenGemini database aggregates data at preset time intervals to obtain the distribution of high-frequency users, high-frequency API assets, and high-frequency access traffic data. Furthermore, the abnormal analysis function of the OpenGemini database is used to detect suspected abnormal traffic data of each server that suddenly increases or exceeds the threshold within the second time range, and the built-in artificial intelligence (AI)-based data analysis platform in OpenGemini is used to analyze the suspected abnormal traffic data within the second time range, and finally obtain a collection of suspected abnormal traffic data for each server.

[0063] Among them, the preset time interval is predefined in the OpenGemini database, and the specific value can be set according to actual needs. In practical applications, a time window can be used for implementation, and the embodiment of the present application does not limit this.

[0064] In order to improve the accuracy of the classification of real-time traffic data, the attack detection device also needs to determine the abnormal traffic data from the suspected abnormal traffic data set of each server according to the resource usage of each server and the return code corresponding to each suspected abnormal traffic data. Specifically, the attack detection device determines the abnormal traffic data from the suspected abnormal traffic data set of each server according to the resource usage of each server and the return code corresponding to each suspected abnormal traffic data in the corresponding suspected abnormal traffic data set.

[0065] Exemplarily, taking a suspected abnormal traffic data set A and its corresponding server as server B as an example, when the attack detection device determines that the remaining resource amount of server B is less than the preset resource amount, it is considered that the server resources of server B have been exhausted or are about to be exhausted by the CC attacker, and server B may be suffering from a CC attack at this time. Further, the attack detection device can determine whether the return code of each suspected abnormal traffic data in the suspected abnormal traffic data set A is an abnormal return code. If so, the suspected abnormal traffic data is determined as abnormal traffic data. If not, the suspected abnormal traffic data is determined as normal traffic data. Based on this method, abnormal traffic data can be determined from the suspected abnormal traffic data set A. Among them, determining whether the return code is an abnormal return code can be determined based on a pre-stored abnormal return code set. If the return code matches any abnormal return code in the abnormal return code set, the return code is determined to be an abnormal return code.

[0066] The attack detection device can classify and identify the determined abnormal traffic data and normal traffic data in the real-time traffic data of each server, and use the identified abnormal traffic data and the identified normal traffic data as sample data sets.

[0067] Step 2: Use the sample data set to train the initial detection model to obtain the detection model.

[0068] The attack detection device may divide the sample data set into a training data set and a test data set according to a second ratio, the second ratio is, for example, 8:2, i.e., 80% is selected. Then, the HHO algorithm related parameters are initialized, a set of candidate solutions are generated using the HHO algorithm as the parameter settings of the SVM model, the training data set and the test data set are used to train the SVM model under each set of parameter configurations and evaluate its performance index, the state of the HHO algorithm is updated according to the evaluation results, the optimization is iterated until the stop condition is met, the optimal parameter configuration and its corresponding SVM model are output, and the pre-trained detection model is obtained.

[0069] Among them, the performance indicators of the evaluation may include accuracy, precision, recall and F1 score. Among them, the accuracy indicator can measure the correctness of the detection model on all test data, the recall rate can measure the ability of the detection model to correctly detect all abnormal traffic data, and the F1 score is an indicator that comprehensively considers accuracy and recall rate, which can more comprehensively evaluate the performance of the detection model. When the recall rate is low, it means that the anomaly detection ability of the detection model is weak, so it is necessary to change the measurement method of real-time reliability to improve the performance of the detection model.

[0070] Optionally, feature scaling can be used to process features such as access latency before inputting the training data set. Specifically, standardization or normalization can be used. In the sklearn (Scikit-learn) package, tools such as StandardScaler or MinMaxScaler can be used to implement feature scaling.

[0071] Optionally, the attack detection device may also verify the stability and generalization ability of the detection model through a cross-validation method.

[0072] The trained detection model learns the characteristics of abnormal flow data and normal flow data, and can accurately detect and classify the flow data. Furthermore, the attack detection device can use the trained detection model to detect the first flow data to determine whether the first flow data is abnormal.

[0073] Specifically, the attack detection device may input the API asset, user identifier, and access delay in the first feature information into the detection model, so that the detection model determines the reference access delay corresponding to the access type matching the API asset and user identifier, and outputs the detection result of the first flow data according to the difference between the reference access delay and the access delay in the first feature information, and the detection result indicates whether the first flow data is abnormal. Then, according to the detection result of the first flow data, it can be determined whether the first flow data is abnormal.

[0074] In a possible implementation, after the detection model outputs the detection result of the first flow data, if the detection result indicates that the first flow data is abnormal, it is possible to further verify whether the first flow data is abnormal based on the return code in the first characteristic information, so as to improve the accuracy of the detection of the first flow data anomaly. Specifically, the attack detection device determines whether the return code in the first characteristic information matches the abnormal return code in the preset abnormal return code set. If the return code matches any abnormal return code in the abnormal return code set, it is determined that the first flow data is abnormal. If the return code does not match each abnormal return code in the abnormal return code set, it is determined that the first flow data is normal flow data, and the detection result of the first flow data can be changed to normal.

[0075] The abnormal return code set is pre-stored in the attack detection device, and the abnormal return code set includes return codes indicating abnormalities in the response status code, such as 404, 401, 400, 503, etc.

[0076] S203, determining whether the target server is attacked according to the proportion of abnormal traffic data in the traffic data set detected by the detection model within the first time range, where the traffic data set includes the first traffic data.

[0077] Among them, the traffic data in the traffic data set are all detected by the detection model. That is to say, the traffic data in the traffic data set are all associated with the detection results of the detection model, and the detection results can indicate whether the traffic data is abnormal traffic data. The first time range is predefined in the attack detection device, and its specific value can be set according to actual needs. In actual applications, it can be implemented in a sliding window manner, and the embodiments of the present application do not limit this.

[0078] Specifically, the attack detection device determines the detected traffic data whose request occurrence time falls within the first time range as a traffic data set, and determines the proportion of traffic data with abnormal detection results (i.e., abnormal traffic data) in the traffic data set, thereby determining whether the target server is attacked based on the proportion of abnormal traffic data in the traffic data set. If the proportion of abnormal traffic data in the traffic data set exceeds a preset proportion, it is determined that the target server is attacked. If the proportion of abnormal traffic data in the traffic data set does not exceed the preset proportion, it is determined that the target server is not attacked. Among them, the preset proportion can be set according to actual needs. For example, the preset proportion is 60%, which is not limited in the embodiment of the present application.

[0079] In a possible implementation, the attack detection device may determine the proportion of traffic data with abnormal return codes in the traffic data set in the traffic data set. If the proportion of traffic data with abnormal return codes in the traffic data set exceeds a first proportion, it is determined that the target server is attacked. If the proportion of traffic data with abnormal return codes in the traffic data set does not exceed the first proportion, it is determined that the target server is not attacked. The first proportion may be set according to actual needs, and the first proportion may be the same or different from the second proportion, which is not limited in the embodiments of the present application.

[0080] In one possible implementation, when the attack detection device determines that the target server has been attacked, an early warning is triggered and the extracted first characteristic information is sent to relevant technical personnel so that the technical personnel can take corresponding protective measures in a timely manner based on the first characteristic information. The protective measures may include tracing the abnormal traffic data according to the user identification, blocking the user's access request, and determining whether the user's account has been stolen.

[0081] In a possible implementation, if the attack detection device determines that the number of traffic data whose detection results of the detection model in the traffic data set are different from the return code matching results exceeds a third preset number, the third preset number may be predefined in the attack detection device, and the specific value may be set according to actual needs, which is not limited in the embodiments of the present application. For example, if the detection result indicates an abnormality, but its return code is a normal return code, it is considered that the detection result is different from the return code matching result. At this time, the accuracy of the detection model may be reduced due to business changes. In this case, the detection model can be optimized and trained based on the updated sample data set to improve the accuracy of the detection model's anomaly detection.

[0082] Based on the same inventive concept, an embodiment of the present application provides an attack detection device, which is used to implement any of the above-mentioned attack detection methods, for example, Figure 2 The attack detection method shown in the figure can also realize the function of the attack detection device mentioned above.

[0083] Please refer to Figure 3 , is a schematic diagram of the structure of an attack detection device provided in an embodiment of the present application. Figure 3 As shown, the attack detection device 300 includes a parsing module 301 , a detection module 302 and a determination module 303 .

[0084] Exemplarily, a parsing module 301 is used to parse first traffic data from a target server to obtain first characteristic information, wherein the first characteristic information is used to indicate source information of the first traffic data and processing of the first traffic data by the target server; a detection module 302 is used to determine whether the first traffic data is abnormal based on the first characteristic information and a pre-trained detection model, wherein the detection model is obtained by training an initial detection model based on a sample data set, and the sample data set is obtained by parsing real-time traffic data from each server; a determination module 303 is used to determine whether the target server is under attack based on the proportion of abnormal traffic data in the traffic data set detected by the detection model within a first time range, wherein the traffic data set includes the first traffic data.

[0085] In one possible implementation, the first characteristic information includes an application programming interface API asset, a user identifier, and an access delay of the first traffic data; the detection module 302 is specifically used to: input the API asset, the user identifier, and the access delay into a detection model, so that the detection model determines a reference access delay corresponding to an access type that matches the API asset and the user identifier, and outputs a detection result of the first traffic data based on the difference between the reference access delay and the access delay, and the detection result indicates whether the first traffic data is abnormal.

[0086] In one possible implementation, the first characteristic information also includes a return code; the detection module 302 is also used to, after obtaining the detection result of the detection model on the first flow data, if the detection result indicates that the first flow data is abnormal, verify whether the first flow data is abnormal according to the return code; if the return code matches any abnormal return code in a preset abnormal return code set, the first flow data is determined to be abnormal; if the return code does not match any abnormal return code in the preset abnormal return code set, the abnormal detection result of the first flow data is changed to normal.

[0087] In a possible implementation, the parsing module 301 is also used to: before determining whether the first traffic data is abnormal based on the first characteristic information and the pre-trained detection model, receive real-time traffic data from each server in real time through a message queue; parse the real-time traffic data to obtain the second characteristic information in the real-time traffic data; determine a set of suspected abnormal traffic data of each server in each server within a second time range based on the second characteristic information and the request occurrence time of the real-time traffic data; determine the abnormal traffic data from the set of suspected abnormal traffic data based on the resource usage of each server and the return code of each suspected abnormal traffic data in the set of suspected abnormal traffic data; classify and identify the abnormal traffic data and the normal traffic data of the real-time traffic data of each server, and use the identified abnormal traffic data and the identified normal traffic data as sample data sets.

[0088] In one possible implementation, the set of suspected abnormal traffic data satisfies at least one of the following conditions: the access frequency of real-time traffic data whose request occurrence time is within the second time range exceeds the preset frequency; the number of accesses to real-time traffic data of the same user identifier within the second time range exceeds the first preset number; the number of accesses to real-time traffic data of the same API asset within the second time range exceeds the second preset number.

[0089] In a possible implementation, the determination module 303 is specifically used to: if the proportion of abnormal traffic data exceeds a preset proportion, determine that the target server is attacked; if the proportion of abnormal traffic data does not exceed the preset proportion, determine that the target server is not attacked.

[0090] Based on the same inventive concept, an embodiment of the present application provides an attack detection device, which is used to implement any of the above-mentioned attack detection methods, for example, Figure 2 The attack detection method shown in the figure can also realize the function of the attack detection device mentioned above.

[0091] Please refer to Figure 4 , is a schematic diagram of the structure of an attack detection device provided in an embodiment of the present application. Figure 4As shown, the attack detection device 400 includes at least one processor 401 and a memory 402 communicatively connected to the at least one processor 401 .

[0092] The processor 401 may be a general-purpose processor or a dedicated processor. The processor 401 may include, for example, a baseband processor or a central processing unit. The baseband processor may be used to process the communication protocol and the communication data. The central processing unit may be used to control the attack detection device 400, execute the software program and / or process the data. Different processors may be independent devices or may be arranged in one or more processing circuits, for example, integrated in one or more dedicated integrated circuits.

[0093] In one embodiment, the memory 402 stores instructions that can be executed by at least one processor 401. The at least one processor 401 implements the functions of the attack detection device as described above by executing the instructions stored in the memory 402, and accordingly, can also implement the steps performed by the attack detection device as described above.

[0094] In this embodiment, the attack detection device 400 can also implement the functions of the preceding attack detection apparatus 300 , and at least one processor 401 in the attack detection device 400 can also implement the functions of the preceding parsing module 301 , the detection module 302 and the determination module 303 .

[0095] Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes any of the attack detection methods described above, for example, Figure 2 Attack detection method shown.

[0096] Based on the same inventive concept, an embodiment of the present application provides a computer program product, comprising computer instructions, which, when executed on a computer, enables any of the above-mentioned attack detection methods, for example, Figure 2 The attack detection method shown is implemented.

[0097] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0098] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0099] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0100] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0101] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. An attack detection method, characterized in that: include: Parsing first traffic data from a target server to obtain first characteristic information, where the first characteristic information is used to indicate source information of the first traffic data and processing of the first traffic data by the target server; determining whether the first traffic data is abnormal according to the first feature information and a pre-trained detection model, wherein the detection model is obtained by training an initial detection model according to a sample data set, and the sample data set is obtained by parsing real-time traffic data of each server; Determine whether the target server is attacked according to the proportion of abnormal traffic data in the traffic data set detected by the detection model within a first time range, and the traffic data set includes the first traffic data.

2. The method according to claim 1, characterized in that The first characteristic information includes an application programming interface API asset, a user identifier, and an access delay of the first traffic data; Determining whether the first traffic data is abnormal according to the first feature information and the pre-trained detection model includes: The API asset, the user identifier and the access delay are input into the detection model so that the detection model determines a reference access delay corresponding to an access type that matches the API asset and the user identifier, and outputs a detection result of the first traffic data based on the difference between the reference access delay and the access delay, wherein the detection result indicates whether the first traffic data is abnormal.

3. The method according to claim 2, characterized in that The first characteristic information also includes a return code; after obtaining the detection result of the detection model on the first flow data, the method also includes: If the detection result indicates that the first flow data is abnormal, verifying whether the first flow data is abnormal according to the return code; If the return code matches any abnormal return code in the preset abnormal return code set, it is determined that the first flow data is abnormal; If the return code does not match any abnormal return code in the preset abnormal return code set, the abnormal detection result of the first traffic data is changed to normal.

4. The method according to claim 1, characterized in that: Before determining whether the first traffic data is abnormal according to the first feature information and the pre-trained detection model, the method further includes: Receiving real-time traffic data from each server in real time through a message queue; Parsing the real-time traffic data to obtain second characteristic information in the real-time traffic data; Determine a set of suspected abnormal traffic data of each server in the servers within a second time range according to the second characteristic information and the time when the request for the real-time traffic data occurs; Determine the abnormal traffic data from the suspected abnormal traffic data set according to the resource usage of each server and the return code of each suspected abnormal traffic data in the suspected abnormal traffic data set; The abnormal traffic data and the normal traffic data of the real-time traffic data of each server are classified and marked, and the marked abnormal traffic data and the marked normal traffic data are used as the sample data set.

5. The method according to claim 4, characterized in that The suspected abnormal traffic data set meets at least one of the following conditions: The access frequency of the real-time traffic data whose request occurrence time is within the second time range exceeds the preset frequency; The number of accesses to the real-time traffic data of the same user ID within the second time range exceeds a first preset number; The number of accesses to the real-time traffic data of the same API asset within the second time range exceeds a second preset number.

6. The method according to any one of claims 1 to 5, characterized in that: Determining whether the target server is attacked according to the proportion of abnormal traffic data in the traffic data set detected by the detection model within the first time range includes: If the proportion of the abnormal traffic data exceeds a preset proportion, it is determined that the target server is attacked; If the proportion of the abnormal traffic data does not exceed the preset proportion, it is determined that the target server has not been attacked.

7. An attack detection device, characterized in that: include: A parsing module, used for parsing first flow data from a target server to obtain first characteristic information, where the first characteristic information is used to indicate source information of the first flow data and processing of the first flow data by the target server; a detection module, configured to determine whether the first traffic data is abnormal based on the first feature information and a pre-trained detection model, wherein the detection model is obtained by training an initial detection model based on a sample data set, and the sample data set is obtained by parsing real-time traffic data of each server; A determination module is used to determine whether the target server is attacked according to the proportion of abnormal traffic data in the traffic data set detected by the detection model within a first time range, and the traffic data set includes the first traffic data.

8. An attack detection device, characterized in that: include: at least one processor, and a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor implements the method according to any one of claims 1 to 6 by executing the instructions stored in the memory.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and when the computer instructions are executed on a computer, the computer is caused to execute the method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The method comprises computer instructions, which, when executed on a computer, enable the method according to any one of claims 1 to 6 to be implemented.

Images