Network security detection method and computing device

Abstract

The invention relates to the technical field of network security, and discloses a network security detection method and computing equipment, and the method comprises the steps: obtaining a plurality of data packets, and determining the data type of each data packet in the plurality of data packets; based on the data type of each data packet, detecting data of the data packet through a probe corresponding to the data type to obtain anomaly detection information of the data packet of each data type; and performing clustering analysis on the abnormal detection information of the data packets of the plurality of data types to obtain a network security detection result. According to the method and the device, multi-dimensional network security detection can be realized, and the association relationship among multiple pieces of abnormal detection information can be determined, so that the security event response speed and accuracy can be improved, and the potential network security risk can be reduced.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network security technology, and in particular, to a network security detection method and computing device. Background Art

[0002] As the security environment becomes increasingly complex, network security detection systems need to make full use of more security data for analysis and detection, and make judgments and responses to various advanced threats faced in infrastructure security, application security, data security and even business security, in order to support the continuous, stable and secure operation of the business.

[0003] Network security situation awareness technology can collect security data such as network packets and analyze security data to detect risks in network security. After obtaining the analysis results of network security, the analysis results can be displayed through visualization technology, so that the security status and trends of the network can be known through the analysis results, so as to make corresponding preventive preparations and avoid losses caused by viruses and malicious attacks in the network. However, existing network security situation awareness technologies usually focus on security detection at the network level and lack comprehensive and multi-dimensional analysis capabilities. Therefore, existing network security detection methods still need further improvement. Summary of the invention

[0004] The embodiments of the present application provide a network security detection method and a computing device, which can implement multi-dimensional network security detection and improve the speed and accuracy of security incident response.

[0005] In order to achieve the above purpose, the embodiment of the present application adopts the following technical solution:

[0006] In a first aspect, an embodiment of the present application provides a network security detection method, the method comprising: obtaining multiple data packets and determining the data type of each of the multiple data packets; based on the data type of each of the data packets, detecting the data of the data packets through a probe corresponding to the data type to obtain anomaly detection information of each data packet of the above data type; performing cluster analysis on the anomaly detection information of multiple data packets of the above data types to obtain a network security detection result.

[0007] Based on this solution, multi-dimensional data detection can be achieved by detecting different types of data through multiple probes; and, by clustering the anomaly detection information, the correlation between multiple anomaly detection information can be determined, and network security detection results can be generated based on the anomaly detection information with correlation, thereby reducing false positives and omissions of security incidents and helping users understand the overall security incidents more clearly.

[0008] In a possible implementation, the above-mentioned determination of the data type of each of the above-mentioned multiple data packets includes: parsing the above-mentioned multiple data packets to obtain protocol information corresponding to each of the above-mentioned data packets; based on the protocol information corresponding to each of the above-mentioned data packets, determining the data type corresponding to each of the above-mentioned data packets from multiple data types; wherein the above-mentioned multiple data types include one or more of network security data, cryptographic application data, mobile security data, and data security data.

[0009] Based on this solution, the acquired multiple data packets can be parsed to determine the data type of each data packet, so that the data packets can be subsequently processed by probes corresponding to the data type of each data packet among the multiple probes.

[0010] In another possible implementation, based on the data type of each of the above-mentioned data packets, the data of the above-mentioned data packets are detected by probes corresponding to the above-mentioned data types to obtain anomaly detection information of the data packets of each of the above-mentioned data types, including: based on the data type of each of the above-mentioned data packets, a probe corresponding to the data type of each of the above-mentioned data packets is determined from the above-mentioned multiple probes; wherein the above-mentioned multiple probes include one or more of a network security probe, a cryptographic application probe, a mobile security probe, a data security probe and a full-type probe; the above-mentioned multiple probes are used to detect whether there is an anomaly in the data of each of the above-mentioned data packets within a preset time period; the anomaly of the above-mentioned data packet includes an anomaly in the data flow of the above-mentioned data packet within the above-mentioned preset time period, and / or the presence of abnormal data in the above-mentioned data packet; the field information in each of the above-mentioned data packets is identified by a probe corresponding to the data type of each of the above-mentioned data packets to obtain anomaly detection information of each of the above-mentioned data packets.

[0011] Based on this solution, data packets of corresponding data types can be processed through various types of probes, and anomaly detection information of each data packet can be obtained. Therefore, multi-dimensional detection of network traffic can be achieved through various types of probes, and more abundant and accurate anomaly detection information can be further provided for subsequent correlation analysis processes.

[0012] In another possible implementation, the above-mentioned anomaly detection information of multiple data packets of the above-mentioned data types is clustered and analyzed to obtain the network security detection result, including: based on the anomaly detection information of multiple data packets of the above-mentioned data types, multiple target anomaly detection information with multiple identical field information is determined in the multiple anomaly detection information; wherein the above-mentioned anomaly detection information includes the above-mentioned field information, and the above-mentioned field information includes at least two kinds of information of source IP address, destination IP address, source port, destination port, protocol information and attack type; the above-mentioned multiple target anomaly detection information is analyzed and processed to obtain the above-mentioned network security detection result.

[0013] Based on this solution, multiple target anomaly detection information with correlation relationships among multiple anomaly detection information can be determined, so that the complete attack process can be determined and network security detection results can be generated; then users can make a faster and more accurate response to security incidents based on the network security detection results.

[0014] In another possible implementation, the above-mentioned anomaly detection information based on multiple data packets of the above-mentioned data types, and determining multiple target anomaly detection information having multiple identical field information in the multiple anomaly detection information, includes: based on the anomaly detection information of multiple data packets of the above-mentioned data types, determining multiple first anomaly detection information having the same first field information in the multiple anomaly detection information; wherein the above-mentioned field information includes the above-mentioned first field information, and the above-mentioned first field information includes the source IP address and / or the destination IP address; determining the first anomaly detection information having at least one identical second field information in the above-mentioned multiple first anomaly detection information as the above-mentioned target anomaly detection information; wherein the above-mentioned field information includes the above-mentioned second field information, and the above-mentioned second field information includes at least one of the source port, the destination port, the protocol information and the attack type.

[0015] Based on this solution, it is possible to first determine multiple first anomaly detection information with the same source IP address and / or destination IP address among multiple anomaly detection information, thereby preliminarily associating multiple first anomaly detection information with the same attack source and / or attack target; and then determine multiple target anomaly detection information with the same source port, destination port, protocol information and at least one of the attack types among the multiple first anomaly detection information, thereby realizing the determination of multiple target anomaly detection information with an associated relationship based on field information.

[0016] In another possible implementation, the above-mentioned determining the first anomaly detection information having at least one identical second field information among the above-mentioned multiple first anomaly detection information as the above-mentioned target anomaly detection information includes: determining multiple second anomaly detection information having at least one identical second field information among the above-mentioned multiple first anomaly detection information; matching multiple preset anomaly detection information in a preset attack pattern library with the above-mentioned multiple second anomaly detection information, and determining the preset attack sequence corresponding to each of the above-mentioned second anomaly detection information in the above-mentioned multiple second anomaly detection information based on the preset attack sequence corresponding to each of the above-mentioned preset anomaly detection information in the above-mentioned multiple preset anomaly detection information; based on the time information corresponding to each of the above-mentioned second anomaly detection information and the preset attack sequence, determining the above-mentioned multiple target anomaly detection information belonging to the same attack process among the above-mentioned multiple second anomaly detection information; wherein the above-mentioned field information includes the above-mentioned time information, and the time information corresponding to each of the above-mentioned second anomaly detection information is the occurrence time of the attack event corresponding to each of the above-mentioned second anomaly detection information.

[0017] Based on this scheme, it is possible to determine multiple second anomaly detection information having at least one identical second field information from multiple first anomaly detection information, and combine the time information corresponding to each second anomaly detection information and the preset attack sequence determined based on the preset attack pattern library to determine multiple target anomaly detection information belonging to the same attack process from the multiple second anomaly detection information. This allows a more accurate clustering analysis to be performed on the multiple anomaly detection information, and the complete attack process to be determined, so that users can make a more accurate response to security incidents based on network security detection results.

[0018] In another possible implementation, the above-mentioned multiple target anomaly detection information is analyzed and processed to obtain the above-mentioned network security detection result, including: based on the source IP address, destination IP address, source port or destination port of each of the above-mentioned target anomaly detection information in the above-mentioned multiple target anomaly detection information, determine the multiple attack nodes in the attack path diagram corresponding to the above-mentioned multiple target anomaly detection information; based on the attack sequence corresponding to each of the above-mentioned target anomaly detection information, determine the node sequence corresponding to each of the above-mentioned attack nodes in the above-mentioned multiple attack nodes; wherein, the attack sequence corresponding to the above-mentioned target anomaly detection information is determined based on a preset attack pattern library and the time information in the above-mentioned target anomaly detection information; based on the above-mentioned multiple attack nodes and the node sequence corresponding to each of the above-mentioned attack nodes, determine the above-mentioned attack path diagram; wherein, the above-mentioned network security detection result includes the above-mentioned attack path diagram.

[0019] Based on this solution, network security detection results such as attack path diagrams and event correlation diagrams can be generated based on the field information of multiple target anomaly detection information, and the correlation relationship between each target anomaly detection information can be displayed to users through the network security detection results, so that users can make more accurate responses to security incidents based on the network security detection results.

[0020] In another possible implementation, the above-mentioned multiple attack nodes in the attack path graph corresponding to the above-mentioned multiple target anomaly detection information are determined based on the source IP address, destination IP address, source port or destination port of each of the above-mentioned multiple target anomaly detection information, including: when the source IP addresses of the above-mentioned multiple target anomaly detection information are the same and the destination IP addresses are different, each of the above-mentioned attack nodes is determined based on the destination IP address of each of the above-mentioned target anomaly detection information.

[0021] Based on this solution, when the source IP addresses of multiple target anomaly detection information are the same and the destination IP addresses are different, the attack nodes of the attack path can be determined based on the destination IP addresses of each target anomaly detection information, so that the target IP addresses attacked by the attack source during the entire attack process can be displayed.

[0022] In another possible implementation, the above-mentioned multiple attack nodes in the attack path graph corresponding to the above-mentioned multiple target anomaly detection information are determined based on the source IP address, destination IP address, source port or destination port of each of the above-mentioned multiple target anomaly detection information, including: when the source IP addresses of the above-mentioned multiple target anomaly detection information are the same, the destination IP addresses are the same, and the destination ports are different, each of the above-mentioned attack nodes is determined based on the destination port of each of the above-mentioned target anomaly detection information.

[0023] Based on this solution, when the source IP addresses of multiple target anomaly detection information are the same, the destination IP addresses are the same, and the destination ports are different, the attack nodes of the attack path can be determined based on the destination ports of each target anomaly detection information, so that the destination ports attacked by the attack source during the entire attack process can be displayed.

[0024] In a second aspect, an embodiment of the present application further provides a network security detection device, which includes: an acquisition module, configured to acquire multiple data packets and determine the data type of each of the multiple data packets; a detection module, configured to detect the data of the data packets based on the data type of each of the data packets through probes corresponding to the data types, to obtain anomaly detection information of the data packets of each of the data types; a clustering analysis module, configured to perform cluster analysis on the anomaly detection information of multiple data packets of the above data types to obtain network security detection results.

[0025] In one possible implementation, the acquisition module is specifically configured to: parse the multiple data packets to obtain protocol information corresponding to each of the data packets; determine the data type corresponding to each of the data packets from multiple data types based on the protocol information corresponding to each of the data packets; wherein the multiple data types include one or more of network security data, cryptographic application data, mobile security data, and data security data.

[0026] In another possible implementation, the detection module is specifically configured as follows: based on the data type of each of the data packets, determining a probe corresponding to the data type of each of the data packets from the multiple probes; wherein the multiple probes include one or more of a network security probe, a cryptographic application probe, a mobile security probe, a data security probe, and a full-type probe; the multiple probes are used to detect whether there is an abnormality in the data of a data packet of each of the data types within a preset time period; the abnormality of the data packet includes an abnormality in the data flow of the data packet within the preset time period, and / or the presence of abnormal data in the data packet; the field information in each of the data packets is identified by a probe corresponding to the data type of each of the data packets to obtain abnormality detection information of each of the data packets.

[0027] In another possible implementation, the clustering analysis module is specifically configured as follows: based on the anomaly detection information of multiple data packets of the above data types, multiple target anomaly detection information having multiple identical field information is determined in the multiple anomaly detection information; wherein the anomaly detection information includes the above field information, and the above field information includes at least two of the source IP address, destination IP address, source port, destination port, protocol information and attack type; and the multiple target anomaly detection information is analyzed and processed to obtain the network security detection result.

[0028] In another possible implementation, the clustering analysis module is specifically configured as follows: based on anomaly detection information of multiple data packets of the above data types, multiple first anomaly detection information having the same first field information is determined in the multiple anomaly detection information; wherein the above field information includes the above first field information, and the above first field information includes the source IP address and / or the destination IP address; the first anomaly detection information having at least one identical second field information in the multiple first anomaly detection information is determined as the target anomaly detection information; wherein the above field information includes the above second field information, and the above second field information includes at least one of the source port, the destination port, the protocol information and the attack type.

[0029] In another possible implementation, the clustering analysis module is specifically configured to: determine, from among the multiple first anomaly detection information, multiple second anomaly detection information having at least one of the same second field information; match multiple preset anomaly detection information in a preset attack pattern library with the multiple second anomaly detection information, and determine, based on the preset attack sequence corresponding to each of the multiple preset anomaly detection information in the multiple preset anomaly detection information, a preset attack sequence corresponding to each of the multiple second anomaly detection information; determine, from among the multiple second anomaly detection information, the multiple target anomaly detection information belonging to the same attack process based on the time information and the preset attack sequence corresponding to each of the multiple second anomaly detection information; wherein the field information includes the time information, and the time information corresponding to each of the multiple second anomaly detection information is the occurrence time of the attack event corresponding to each of the multiple second anomaly detection information.

[0030] In another possible implementation, the clustering analysis module is specifically configured as follows: based on the source IP address, destination IP address, source port or destination port of each of the target anomaly detection information in the multiple target anomaly detection information, determine the multiple attack nodes in the attack path graph corresponding to the multiple target anomaly detection information; based on the attack sequence corresponding to each of the target anomaly detection information, determine the node sequence corresponding to each of the attack nodes in the multiple attack nodes; wherein the attack sequence corresponding to the target anomaly detection information is determined based on a preset attack pattern library and the time information in the target anomaly detection information; based on the multiple attack nodes and the node sequence corresponding to each of the attack nodes, determine the attack path graph; wherein the network security detection result includes the attack path graph.

[0031] In another possible implementation, the cluster analysis module is specifically configured to: when the source IP addresses of the multiple target anomaly detection information are the same and the destination IP addresses are different, determine each of the attack nodes based on the destination IP address of each of the target anomaly detection information.

[0032] In another possible implementation, the clustering analysis module is specifically configured as follows: when the source IP addresses of the multiple target anomaly detection information are the same, the destination IP addresses are the same, and the destination ports are different, each of the attack nodes is determined based on the destination port of each of the target anomaly detection information.

[0033] In a third aspect, an embodiment of the present application further provides a computing device, comprising: a processor and a memory; the processor and the memory are coupled; the memory is used to store program instructions; the processor is used to execute the program instructions to execute any method as described in the first aspect above.

[0034] In a fourth aspect, an embodiment of the present application provides a chip, which is used to execute any method in the first aspect above.

[0035] In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a computer, a method as described in any one of the first aspects is implemented.

[0036] In a sixth aspect, an embodiment of the present application provides a program product, including a computer program, which implements any method in the first aspect when executed by a processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 A flowchart of a network security detection method provided in an embodiment of the present application;

[0038] Figure 2A schematic diagram of a network security detection system provided in an embodiment of the present application;

[0039] Figure 3 A flowchart for determining abnormal detection information of each data packet provided in an embodiment of the present application;

[0040] Figure 4 A flowchart for determining network security detection results provided in an embodiment of the present application;

[0041] Figure 5 A flowchart for determining target anomaly detection information provided by an embodiment of the present application;

[0042] Figure 6 Another flow chart for determining target anomaly detection information provided by an embodiment of the present application;

[0043] Figure 7 Another flow chart for determining network security detection results provided in an embodiment of the present application;

[0044] Figure 8 A schematic diagram of an attack path diagram provided in an embodiment of the present application;

[0045] Fig. 9 A schematic diagram of an event association diagram provided in an embodiment of the present application;

[0046] Fig.10 A flowchart of another network security detection method provided in an embodiment of the present application;

[0047] Fig.11 A schematic diagram of a network security detection device provided in an embodiment of the present application;

[0048] Fig.12 A schematic diagram of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0049] The technical solution in the embodiment of the present application will be described below in conjunction with the drawings in the embodiment of the present application. In order to facilitate the clear description of the technical solution in the embodiment of the present application, the first, second, etc. descriptions appearing in the embodiment of the present application are only used for illustration and distinction of the description objects, and there is no order, nor does it represent a special limitation on the number of devices in the embodiment of the present application, and cannot constitute any limitation on the embodiment of the present application.

[0050] The network security detection method provided in the embodiment of the present application can be applied to a computing device, which can be a server or a terminal device. In practical applications, a network security detection system can be deployed on a computing device, so that a user can obtain multiple data packets transmitted by a network device (such as a router, a switch, etc.) through the network security detection system, and perform network security detection on multiple data packets to determine the network security detection results corresponding to the multiple data packets. In addition, the network security detection system can display the network security detection results through a user interface to facilitate users to view the network security detection results, and perform corresponding processing on security events based on the network security detection results.

[0051] Figure 1 A flowchart of a network security detection method provided in an embodiment of the present application. Figure 1 As shown, the method includes steps 110 to 130.

[0052] Step 110: Acquire multiple data packets and determine the data type of each of the multiple data packets.

[0053] refer to Figure 2 A schematic diagram of a network security detection system is shown. The network security detection system 200 may include a probe collector 201, an association aggregation module 202, an analysis and display module 203, and a scheduling module 204. The probe collector 201 may include a parsing module 2010 and multiple types of probes, such as a network security probe 2011, a data security probe 2012, a cryptographic application probe 2013, a mobile security probe 2014, and an all-type probe 2015.

[0054] Exemplarily, the network device can mirror or copy the data packets it transmits, and send the mirrored or copied data packets to the probe collector 201. After acquiring multiple data packets sent by the network device, the probe collector 201 can parse each of the multiple data packets through the parsing module 2010 to determine the data type of each data packet. Among them, the data type of the data packet is used to characterize that the data may come from network security data, cryptographic application data, mobile security data, data security data, etc. It should be noted that the types of the above-mentioned data packets are only examples and are not limited to this in this embodiment.

[0055] Step 120 , based on the data type of each data packet, the data of the data packet is detected by a probe corresponding to the data type to obtain abnormality detection information of the data packet of each data type.

[0056] In some embodiments, the parsing module 2010 may determine a probe corresponding to the data type of each data packet from a plurality of probes based on the data type of each data packet, and detect each data packet based on the corresponding probe, thereby obtaining abnormal detection information of data packets of each data type. The plurality of data types may include one or more of network security data, cryptographic application data, mobile security data, and data security data.

[0057] In some embodiments, the abnormal detection information of a data packet is used to indicate whether the data packet is a normal data packet or an abnormal data packet, and the abnormal detection information corresponding to the abnormal data packet can also be called an alarm log. A normal data packet indicates that the data packet does not pose a security threat, that is, there is no attack behavior; an abnormal data packet indicates that the data packet poses a security threat, that is, there is an attack behavior.

[0058] If the data packet is abnormal, it may mean that there is abnormal data in the data packet (such as abnormal field information, attack code in the data packet, etc.). For example, the source IP address in the TCP / IP header of the data packet is forged to hide the real identity of the attacker; in SQL injection attacks, malicious SQL statements are embedded in HTTP requests; in cross-site scripting attacks, malicious JavaScript code is embedded in HTML requests, etc.

[0059] If the data packet is abnormal, it may also mean that the data flow of the data packet within the preset time period is abnormal (such as a sudden increase in the flow of the data packet, etc.). For example, in a DDoS attack, the attacker will send a large number of data packets, which will cause a sudden and significant increase in the flow of data packets; when data is leaked, the attacked device will continue to send sensitive data outward, resulting in a significant increase in one-way traffic transmission, etc.

[0060] Step 130: cluster analysis is performed on the abnormal detection information of data packets of multiple data types to obtain network security detection results.

[0061] In some embodiments, after the probe collector 201 determines the anomaly detection information of the data packets of each data type, the anomaly detection information of the data packets of multiple data types can be clustered and analyzed by the association aggregation module 202 to determine multiple target anomaly detection information with an associated relationship in the anomaly detection information of the data packets of multiple data types, and the multiple target anomaly detection information is analyzed and processed by the analysis and display module 203 to obtain the network security detection result. Among them, the multiple target anomaly detection information having an associated relationship indicates that there is a certain logical connection between the multiple target anomaly detection information, such as having the same attack source, attack target, attack mode, or attack behaviors at different stages of a complete attack process, etc.

[0062] In some embodiments, the network security detection results may be displayed in a user interface through the analysis and display module 203 , so that a user may view the network security detection results and process security incidents based on the network security detection results.

[0063] Through the above scheme, different types of data can be detected through multiple probes to achieve multi-dimensional data detection; and, by performing cluster analysis on the anomaly detection information, the correlation between multiple anomaly detection information can be determined and network security detection results can be generated, thereby reducing false positives and omissions of security incidents and helping users understand the overall security incidents more clearly.

[0064] In some embodiments, determining the data type of each data packet among multiple data packets in the above step 110 includes: parsing the multiple data packets to obtain protocol information corresponding to each data packet; and determining the data type corresponding to each data packet among multiple data types based on the protocol information corresponding to each data packet.

[0065] In some embodiments, the parsing module 2010 can parse multiple data packets to determine the protocol information corresponding to each data packet. The protocol information corresponding to the data packet may include Hyper Text Transfer Protocol (HTTP), File Transfer Protocol (FTP), Secure Sockets Layer (SSL), Transport Layer Security (TLS), Secure Shell Protocol (SSH), MySQL protocol, wireless communication protocol (such as Wi-Fi, Bluetooth), etc. It should be noted that the protocol information corresponding to the above data packets is only an example and is not limited in this embodiment.

[0066] Based on the protocol information corresponding to each data packet, the data type corresponding to each data packet can be determined from multiple data types. For example, if the protocol information corresponding to the data packet is network protocol information such as HTTP, FTP, etc., then the data type of the data packet can be determined to be network security data; if the protocol information corresponding to the data packet is a database protocol such as MySQL protocol, then the data type of the data packet can be determined to be data security data; if the protocol information corresponding to the data packet is cryptographic protocol information such as SSL / TLS, SSH, etc., then the data type of the data packet can be determined to be cryptographic application data; if the protocol information corresponding to the data packet is a wireless communication protocol such as Wi-Fi, Bluetooth, etc., then the data type of the data packet can be determined to be mobile security data. It should be noted that the method of determining the data type corresponding to each data packet based on the protocol information corresponding to each data packet is only an example and is not limited to this in the present embodiment.

[0067] Through the above solution, the acquired multiple data packets can be parsed to determine the data type of each data packet, so that the data packet can be subsequently processed by a probe corresponding to the data type of each data packet among the multiple probes.

[0068] Figure 3 A flowchart of determining abnormal detection information of each data packet provided in an embodiment of the present application. Figure 3 As shown, the above step 120 includes steps 310 to 320.

[0069] Step 310, based on the data type of each data packet, determine the probe corresponding to the data type of each data packet from multiple probes; the probe is used to detect whether there is an abnormality in the data of each type of data packet within a preset time period, wherein the presence of an abnormality in the data packet includes an abnormality in the data flow of the data packet within the preset time period, and / or the presence of abnormal data in the data packet.

[0070] In some embodiments, the parsing module 2010 may determine a probe corresponding to the data type of the data packet from among the multiple probes based on the determined data type of the data packet. That is, after determining the data type of each data packet, the parsing module 2010 may distribute each data packet to a corresponding probe based on the data type of each data packet, so that the data packet can be detected by each probe.

[0071] Exemplarily, the network security probe 2011 is mainly used to detect data packets at the network layer; the data security probe 2012 is mainly used to detect data packets related to data access, processing and storage of databases; the cryptographic application probe 2013 is mainly used to detect data packets of encrypted communications at the cryptographic application level; the mobile security probe 2014 is mainly used to detect data packets at the mobile device and mobile application levels.

[0072] In addition, since the above-mentioned special probes usually only detect a certain type of data, if only the above-mentioned probes are used to detect the data of each data packet, some new, non-standard or mixed protocol information data may be missed. The full-type probe 2015 can detect all types of data, not only can detect specific types of attack behaviors, but also can detect complex attacks launched by multiple protocols, services and ports, such as Advanced Persistent Threat (APT).

[0073] In some examples, the parsing module 2010 can send data packets whose data type is network security data to the network security probe 2011 for detection; can send data packets whose data type is data security data to the data security probe 2012 for detection; can send data packets whose data type is cryptographic application data to the cryptographic application probe 2013 for detection; can send data packets whose data type is mobile security data to the mobile security probe 2014 for detection. In addition to sending data packets of each data type to the corresponding type of probe, the parsing module 2010 can also send all data packets to the full-type probe 2015, so that data packets of all data types are detected by the full-type probe 2015, so as to avoid missing some data packets with more complex attack behaviors due to only detecting data packets by the above-mentioned special type of probes.

[0074] Step 320 , identifying the field information in each data packet through a probe corresponding to the data type of each data packet, and obtaining anomaly detection information of each data packet.

[0075] In some embodiments, after determining the probe corresponding to the data type of each data packet, the corresponding probe can be used to detect whether each data packet has attack behavior based on preset abnormal behavior detection rules, etc., and obtain abnormal detection information of each data packet.

[0076] Exemplarily, when there is no attack behavior in the data packet, the attack type, event name, event level and other field information in the obtained anomaly detection information may be empty, or other content used to indicate that the data packet corresponding to the anomaly detection information is a normal data packet. In some examples, when there is no attack behavior in the data packet, the anomaly detection information of the data packet may not be generated.

[0077] In the case of attack behavior in the data packet, in addition to determining the source IP address, destination IP address, source port, destination port, protocol information and other information in the anomaly detection information, the attack type, event name, event level and other information can also be determined. For example, the attack type can include remote code execution vulnerability (RCE), SQL injection, distributed denial of service (DDoS) attack, cross-site scripting (XSS) attack, phishing attack, Web framework vulnerability, vulnerability exploitation attack, man-in-the-middle attack (MITM Attack), etc. The event name is a specific description of the attack behavior, such as Apache remote code execution vulnerability, MySQL injection vulnerability, Mirai botnet DDoS attack, WordPress plug-in XSS vulnerability, Office365 phishing email attack, executing suspicious commands through Java applications, etc. The event level is the threat level of the attack behavior, such as severe threat, high threat, medium threat, low threat, etc. It should be noted that the specific contents of the above-mentioned attack types, event names, and event levels are only examples and are not limited to them in this embodiment.

[0078] In some embodiments, after obtaining anomaly detection information of multiple data packets, the network security detection system 200 can further perform data cleaning, standardization and normalization on the anomaly detection information of multiple data packets, such as unifying and standardizing the naming method of each field information in the anomaly detection information and the file format of the anomaly detection information (such as unified conversion into JSON or XML format), etc., so as to obtain structured and standardized anomaly detection information to improve the accuracy of subsequent association analysis process.

[0079] Through the above scheme, data packets of corresponding data types can be processed through various types of probes, and anomaly detection information of each data packet can be obtained. Therefore, multi-dimensional detection of network traffic can be achieved through various types of probes, and more abundant and accurate anomaly detection information can be further provided for subsequent correlation analysis processes.

[0080] Figure 4 A flowchart for determining network security detection results provided by an embodiment of the present application. Figure 4 As shown, the above step 130 includes steps 410 to 420.

[0081] Step 410 , based on the anomaly detection information of the data packets of the multiple data types, determine a plurality of target anomaly detection information having a plurality of identical field information in the plurality of anomaly detection information.

[0082] In some embodiments, after determining the anomaly detection information of data packets of multiple data types, the anomaly detection information of data packets of multiple data types can be clustered and analyzed by the association aggregation module 202 to determine multiple target anomaly detection information with an associated relationship in the anomaly detection information of data packets of multiple data types.

[0083] Exemplarily, the anomaly detection information includes multiple field information, such as source IP address, destination IP address, source port, destination port, protocol information, attack type, event name, event level, etc. In the case where each anomaly detection information has at least two identical field information, it can be determined that the anomaly detection information is multiple target anomaly detection information with an associated relationship.

[0084] In some examples, the association relationship between each anomaly detection information can be determined based on the field information in the anomaly detection information. For example, if all the corresponding field information of each anomaly detection information is the same, it can be determined that these anomaly detection information are the same anomaly detection information, that is, these anomaly detection information correspond to the same attack behavior. For another example, if the source IP addresses corresponding to each anomaly detection information are the same, it can be determined that these anomaly detection information have the same attack source; if the destination IP addresses corresponding to each anomaly detection information are the same, it can be determined that these anomaly detection information have the same attack target; if the attack types corresponding to each anomaly detection information are the same, it can be determined that these anomaly detection information have the same attack mode; and so on.

[0085] Step 420: Analyze and process the multiple target anomaly detection information to obtain network security detection results.

[0086] In some embodiments, after the association aggregation module 202 determines multiple target anomaly detection information, the multiple target anomaly detection information can be further analyzed and processed by the analysis and display module 203 to obtain network security detection results. For example, corresponding visualization charts can be generated based on multiple target anomaly detection information. The analysis and display module 203 can display the network security detection results through a user interface.

[0087] In some embodiments, after the association aggregation module 202 determines multiple target anomaly detection information, the scheduling module 204 can also determine the corresponding response strategy based on the multiple target anomaly detection information, so as to schedule the network resources in the computing device and the network security management personnel based on the response strategy to ensure timely and orderly processing of the security incident. For example, if the multiple target anomaly detection information indicates that a security incident of SQL injection attack against a Web application has occurred, the response strategy determined by the scheduling module 204 based on the multiple target anomaly detection information may include: adding the source IP of the attacking device to the blacklist of the firewall to prevent further access of the attacking device; and enabling the SQL injection protection rules in the Web application firewall to filter out suspicious requests; and analyzing the relevant database access logs to confirm whether data leakage or tampering has occurred; and updating and repairing the vulnerabilities in the application, implementing parameterized queries to prevent SQL injection attacks, etc. Therefore, the scheduling module 204 can call the network resources such as the Web application firewall, database analysis module, application update and repair module and the network security management personnel in the computing device based on the response strategy to realize the processing of the SQL injection attack event.

[0088] Through the above scheme, multiple target anomaly detection information with correlation relationships among multiple anomaly detection information can be determined, so that the attacker's attack behavior can be completely restored, the network security detection results can be obtained, and the network security detection results can be displayed in the form of visual charts; then users can make faster and more accurate responses to security incidents based on the network security detection results.

[0089] Figure 5 A flowchart for determining target abnormality detection information provided by an embodiment of the present application. Figure 5 As shown, the above step 410 includes steps 510 to 520.

[0090] Step 510: Based on the anomaly detection information of data packets of multiple data types, determine a plurality of first anomaly detection information having the same first field information from the plurality of anomaly detection information.

[0091] In some embodiments, the association aggregation module 202 may first determine multiple first anomaly detection information with the same first field information in multiple anomaly detection information based on the anomaly detection information of multiple data packets, so as to determine multiple first anomaly detection information with the same attack source and / or attack target. Among them, the field information includes the first field information, and the first field information includes the source IP address and / or the destination IP address. In other words, if multiple anomaly detection information has the same source IP address and / or destination IP address, it means that the multiple anomaly detection information is an attack behavior initiated by the same attack source, and / or, is an attack behavior initiated to the same attack target.

[0092] For example, if the source IP addresses of each piece of abnormal detection information are the same but the destination IP addresses are different, it means that the same attack device may launch attacks on multiple different target devices, such as lateral movement attacks, network detection, etc. If the source IP addresses of each piece of abnormal detection information are different but the destination IP addresses are the same, it means that multiple attack devices may launch attacks on the same target device, such as DDoS attacks, VPN attacks, etc. If the source IP addresses of each piece of abnormal detection information are the same and the destination IP addresses are also the same, it means that the same attack device may launch attacks on the same target device.

[0093] Step 520: determine the first abnormality detection information having at least one identical second field information among the plurality of first abnormality detection information as the target abnormality detection information.

[0094] In some embodiments, after determining the above-mentioned multiple first anomaly detection information, the association aggregation module 202 can further determine the first anomaly detection information with at least one identical second field information among the multiple first anomaly detection information as the target anomaly detection information. The field information includes the second field information, and the second field information includes at least one of the source port, the destination port, the protocol information, and the attack type. That is to say, after determining multiple first anomaly detection information with the same attack source and / or the same attack target, the association relationship between these first anomaly detection information can be further judged more deeply based on the second field information, and the first anomaly detection information with at least one identical second field information can be determined as the target anomaly detection information.

[0095] For example, if the source IP address, destination port and attack type of multiple first anomaly detection information are the same, but the destination IP address and source port are different, it means that different ports of the same attack device are launching attacks on the same destination port of multiple different target devices, such as attacks launched against the same service of different target devices.

[0096] For another example, if the source IP address, destination IP address and attack type of multiple first anomaly detection information are the same, but the destination port and source port are different, it means that different ports of the same attack device launch multiple attacks on different destination ports in the same target device, which indicates that the attacker may be trying multiple attack methods to find the weak defense points on the target device.

[0097] For another example, if the destination IP addresses and destination ports of multiple first anomaly detection information are the same, but the source IP addresses are different, it means that the attacker is using multiple attack devices to concentrate on attacking the same service of the same target device.

[0098] For another example, if the source IP address, destination IP address, source port, destination port and attack type of multiple first anomaly detection information are the same, it means that the same attack device launched the same attack on the same service on the same target device. In other words, the multiple first anomaly detection information are the same target anomaly detection information.

[0099] It should be noted that the above method of determining the association relationship between multiple first abnormality detection information based on the second field information is only an example, and the association relationship between the abnormality detection information in actual applications is not limited to the above cases.

[0100] Through the above scheme, it is possible to first determine multiple first anomaly detection information with the same source IP address and / or destination IP address among multiple anomaly detection information, thereby preliminarily associating multiple first anomaly detection information with the same attack source and / or attack target; and then determine multiple target anomaly detection information with the same source port, destination port, protocol information and at least one of the attack types among the multiple first anomaly detection information, thereby realizing the determination of multiple target anomaly detection information with an associated relationship based on field information.

[0101] Figure 6 Another flow chart for determining target abnormality detection information provided by an embodiment of the present application. Figure 6 As shown, the above step 520 includes steps 610 to 630.

[0102] Step 610: Determine, from among the plurality of first abnormality detection information, a plurality of second abnormality detection information having at least one identical second field information.

[0103] In some embodiments, when the association aggregation module 202 determines multiple target anomaly detection information with an associated relationship between multiple first anomaly detection information based on the second field information, it can also first determine multiple first anomaly detection information with at least one identical second field information as multiple second anomaly detection information, and then determine multiple target anomaly detection information that are also associated in time in each second anomaly detection information, so as to determine an accurate and complete attack process (or attack chain).

[0104] Step 620, matching multiple preset anomaly detection information in the preset attack pattern library with multiple second anomaly detection information, and determining a preset attack sequence corresponding to each second anomaly detection information in the multiple second anomaly detection information based on the preset attack sequence corresponding to each preset anomaly detection information in the multiple preset anomaly detection information.

[0105] In some embodiments, the preset attack pattern library includes multiple preset anomaly detection information and the preset attack order of each preset anomaly detection information in the complete preset attack process. The preset attack pattern library can adopt an existing attack pattern library, such as the ATT&CK framework; or it can be obtained based on the historical network security detection results determined by the network security detection system 200 in the previous network security detection process.

[0106] For example, the preset attack process in the preset attack mode library and the preset attack sequence of the preset abnormality detection information in each preset attack process may include:

[0107] Preset attack process 1:

[0108] Table 1

[0109]

[0110] Among them, the preset attack process 1 indicates that the attacker uses SQL injection into the server's database through port 80 of the Web server to perform illegal queries, and attempts to use cross-site scripting attacks to inject malicious scripts into the server, and finally attempts to execute remote code on the MySQL database through port 22 again.

[0111] Preset attack process 2:

[0112] Table 2

[0113]

[0114] Among them, the preset attack process 2 indicates that the attacker uses port scanning technology to try to obtain the open ports and service information of the server, and launches SQL injection attacks against the Web services found on the server, trying to steal sensitive data in the database. Finally, a DDoS attack is organized, using multiple botnet devices to send a large number of HTTPS requests to the server's 443 port, trying to paralyze the server.

[0115] Preset attack process 3:

[0116] Table 3

[0117]

[0118]

[0119] Among them, the preset attack process 3 indicates that the attacker obtains access rights to internal network devices through phishing emails and attempts to move laterally and steal data within the network.

[0120] It can be understood that the contents in the above preset attack process 1 to the preset attack process 3 are only exemplary descriptions.

[0121] In some embodiments, the plurality of second anomaly detection information may be matched with the plurality of preset anomaly detection information in the preset attack pattern library to determine a preset attack sequence corresponding to each of the plurality of second anomaly detection information.

[0122] Step 630: Based on the time information corresponding to each piece of second anomaly detection information and the preset attack sequence, a plurality of target anomaly detection information belonging to the same attack process is determined from the plurality of second anomaly detection information.

[0123] In some embodiments, the field information in the anomaly detection information may also include time information. The association aggregation module 202 may combine the time information corresponding to each second anomaly detection information and the preset attack sequence to determine multiple target anomaly detection information and the attack sequence corresponding to each target anomaly detection information in the multiple second anomaly detection information, thereby determining an accurate and complete attack process. Among them, the time information corresponding to each second anomaly detection information is the time when the attack event corresponding to each second anomaly detection information occurs.

[0124] Exemplarily, it can be determined whether the time difference between each second abnormality detection information is within a preset time difference based on the time information corresponding to each second abnormality detection information. In the case where the time difference between the time information corresponding to a certain second abnormality detection information and the time information corresponding to other second abnormality detection information is too large (i.e., exceeds the preset time difference), it can be determined that the second abnormality detection information and the other second abnormality detection information do not belong to the same attack process.

[0125] In the case where the time difference between the time information corresponding to each second abnormality detection information does not exceed the preset time difference, although the multiple second abnormality detection information meet the condition of belonging to the same attack process in the time dimension, the multiple second abnormality detection information may include second abnormality detection information belonging to other attack processes. Therefore, in this case, the time sequence of each second abnormality detection information can be determined based on the time information corresponding to each second abnormality detection information, and based on the time sequence of each second abnormality detection information and the preset attack sequence corresponding to each second abnormality detection information, multiple target abnormality detection information belonging to the same attack process can be determined in the multiple second abnormality detection information.

[0126] In some examples, the following multiple second abnormality detection information (including second abnormality detection information 1, second abnormality detection information 2, second abnormality detection information 3, second abnormality detection information 4, and second abnormality detection information 5) are taken as examples to exemplify the method of determining multiple target abnormality detection information:

[0127] The field information of the second anomaly detection information 1 includes: the source IP address is 192.168.1.50, the destination IP address is 10.0.0.1, the destination port is port 80, the attack type is SQL injection, the protocol information is MySQL protocol, and the time information is 2024-10-2008:30:00;

[0128] The field information of the second anomaly detection information 2 includes: the source IP address is 192.168.1.50, the destination IP address is 10.0.0.1, the destination port is port 8080, the attack type is a cross-site scripting attack, the protocol information is HTTP protocol, and the time information is 2024-10-20 08:32:00;

[0129] The field information of the second anomaly detection information 3 includes: the source IP address is 192.168.1.50, the destination IP address is 10.0.0.1, the destination port is port 443, the attack type is remote code execution, the protocol information is HTTP protocol, and the time information is 2024-10-20 08:35:00;

[0130] The field information of the second anomaly detection information 4 includes: the source IP address is 192.168.1.50, the destination IP address is 10.0.0.1, the destination port is port 22, the attack type is brute force attack, the protocol information is SSH protocol, and the time information is 2024-10-2308:37:00;

[0131] The field information of the second anomaly detection information 5 includes: the source IP address is 192.168.1.50, the destination IP address is 10.0.0.1, the destination port is port 80, the attack type is DDoS attack, the protocol information is HTTP protocol, and the time information is 2024-10-2008:40:00.

[0132] First, if the preset time difference is 1 day, then according to the time information corresponding to the above-mentioned multiple second anomaly detection information, it can be determined that the second anomaly detection information 4 and the other four second anomaly detection information do not belong to the same attack process. Then, based on the time information corresponding to the second anomaly detection information 1, the second anomaly detection information 2, the second anomaly detection information 3 and the second anomaly detection information 5, it can be determined that the time sequence of the above-mentioned second anomaly detection information is: second anomaly detection information 1, second anomaly detection information 2, second anomaly detection information 3 and second anomaly detection information 5. Taking the preset attack pattern library including the preset attack process 1, the preset attack process 2 and the preset attack process 3 shown in Tables 1 to 3 as an example, based on the preset attack sequence corresponding to the multiple preset anomaly detection information in the preset attack pattern library, it can be determined that the second anomaly detection information 1, the second anomaly detection information 2 and the second anomaly detection information 3 are the anomaly detection information corresponding to the attack behaviors that occur sequentially in the preset attack process 1 (Web application attack process), and the second anomaly detection information 5 is the anomaly detection information corresponding to the attack behaviors in the preset attack process 2 (SQL injection attack process). Therefore, although the second anomaly detection information 1, the second anomaly detection information 2, the second anomaly detection information 3, and the second anomaly detection information 5 belong to the same attack process in the dimension of time, the second anomaly detection information 5 does not belong to the same attack process in the dimension of attack order as the second anomaly detection information 1, the second anomaly detection information 2, and the second anomaly detection information 3. Therefore, the second anomaly detection information 1, the second anomaly detection information 2, and the second anomaly detection information 3 are multiple target anomaly detection information belonging to the same attack process. Therefore, the complete attack process determined based on the attack order corresponding to the multiple target anomaly detection information should be: the SQL injection attack corresponding to the second anomaly detection information 1 occurs first, followed by the cross-site scripting attack corresponding to the second anomaly detection information 2, and finally the remote code execution attack corresponding to the second anomaly detection information 3 occurs.

[0133] Through the above scheme, it is possible to determine multiple second anomaly detection information having at least one identical second field information from multiple first anomaly detection information, and combine the time information corresponding to each second anomaly detection information and the preset attack sequence determined based on the preset attack pattern library to determine multiple target anomaly detection information belonging to the same attack process from the multiple second anomaly detection information, so that a more accurate clustering analysis can be performed on the multiple anomaly detection information, and the complete attack process can be determined, so that users can make a more accurate response to security incidents based on network security detection results.

[0134] Figure 7 Another flow chart for determining network security detection results provided by an embodiment of the present application. Figure 7 As shown, the above step 420 includes steps 710 to 730.

[0135] Step 710, based on the source IP address, destination IP address, source port or destination port of each target anomaly detection information in the multiple target anomaly detection information, determine multiple attack nodes in the attack path graph corresponding to the multiple target anomaly detection information.

[0136] In some embodiments, after the association aggregation module 202 determines that multiple target anomaly detection information belong to the same attack process, the analysis and display module 203 can generate corresponding network security detection results based on the multiple target anomaly detection information, such as attack path diagrams, security event association diagrams, etc., so as to clearly display the association relationship between each target anomaly detection information to the user through the network security detection results.

[0137] Exemplarily, multiple attack nodes in the attack path graph can be determined based on field information such as the source IP address, destination IP address, source port or destination port of each target anomaly detection information in multiple target anomaly detection information. That is, based on the same source IP address, destination IP address, source port or destination port of each target anomaly detection information, the source IP address, destination IP address, source port or destination port can be determined as each attack node. For example, when the source IP address, source port and destination port of each target anomaly detection information are the same, and the destination IP address is different, the destination IP address of each target anomaly detection information can be determined as each attack node; when the source IP address and destination IP address of each target anomaly detection information are the same, and the destination port is different, the destination port of each target anomaly detection information can be determined as each attack node; when the source port, destination IP address and destination port of each target anomaly detection information are the same, and the source IP address is different, the source IP address of each target anomaly detection information can be determined as each attack node. It should be noted that the above-mentioned situation of determining the attack node based on the source IP address, destination IP address, source port and destination port of each target anomaly detection information is only an example, and the attack node determined in actual application is not limited to the above-mentioned situations.

[0138] refer to Figure 8 A schematic diagram of an attack path diagram is shown in FIG. Figure 8 As shown, the same attack device attacks different target devices (i.e., target device A, target device B, and target device C), and the attack device attacks different destination ports of target device A in sequence. Therefore, the source IP address of the attack device can be determined as the starting node a in the attack path, and the attack nodes in the attack path can be determined based on the destination IP addresses of target device A, target device B, and target device C, and the attack nodes in the attack path can be determined based on the destination ports of target device A (such as port 80, port 8080, and port 443).

[0139] Step 720: Determine the node order corresponding to each attack node in the plurality of attack nodes based on the attack order corresponding to each target anomaly detection information.

[0140] In some embodiments, when determining each attack node based on the source IP address, destination IP address, source port or destination port of each target anomaly detection information, the node order corresponding to each attack node in the multiple attack nodes can also be determined based on the attack order corresponding to each target anomaly detection information. Among them, the attack order corresponding to the target anomaly detection information is determined based on the preset attack order in the preset attack mode library and the time information in the target anomaly detection information. The method of determining the attack order corresponding to the target anomaly detection information can refer to the description of steps 610 to 630, which will not be repeated here.

[0141] like Figure 8 As shown, the attack device has a certain attack sequence when attacking different destination ports in the target device A. For example, the attack device first performs an SQL injection attack on port 80 of the target device A, then performs a cross-site scripting attack on port 8080 of the target device A, and finally performs a remote code execution attack on port 443 of the target device A. Then, it can be determined that the node sequence corresponding to the attack node c, attack node d, and attack node e corresponding to each destination port is attack node c→attack node d→attack node e.

[0142] Step 730, determining an attack path graph based on multiple attack nodes and the node order corresponding to each attack node.

[0143] In some embodiments, after determining the multiple attack nodes and the node sequence corresponding to each attack node, the corresponding attack path diagram can be generated based on the multiple attack nodes and the node sequence corresponding to each attack node through the analysis and display module 203, and the attack path diagram can be displayed in the user interface. In addition, in addition to displaying the source IP address, destination IP address, source port and destination port and other field information at each attack node in the attack path diagram, the corresponding attack type, protocol information, event name, event level and other field information can also be displayed, which is not limited in this embodiment. It should be noted that Figure 8 The specific form and displayed content of the attack path diagram shown are only examples and are not limited in this embodiment.

[0144] In some embodiments, in addition to generating attack path diagrams corresponding to a plurality of target anomaly detection information, the analysis and display module 203 may also generate Fig. 9 The event association diagram is shown in the figure, and the event association diagram is displayed in the user interface. For example, the field information of multiple target anomaly detection information with association relationships (such as source IP address, destination IP address, source port, destination port, protocol information, attack type, event name, event level, etc.) can be displayed in the security event column. In addition, the same target anomaly detection information can also be marked in the form of a diagram (such as Fig. 9 For example, the number "3" in the circle on the upper left corner of the first security event column indicates that there are three identical target anomaly detection information A, the number "2" in the circle on the upper left corner of the second security event column indicates that there are two identical target anomaly detection information B, and the number "2" in the circle on the upper left corner of the third security event column indicates that there are two identical target anomaly detection information C. It should be noted that Fig. 9 The specific form and displayed content of the event association diagram shown are only examples and are not limited to this in this embodiment.

[0145] Through the above scheme, network security detection results such as attack path diagrams and event correlation diagrams can be generated based on the field information of multiple target anomaly detection information, and the correlation relationship between each target anomaly detection information can be displayed to the user through the network security detection results, so that the user can make a more accurate response to security incidents based on the network security detection results.

[0146] Fig.10 A flowchart of another network security detection method provided in an embodiment of the present application. Fig.10 As shown, the method includes steps 1010 to 1070.

[0147] Step 1010: Acquire multiple data packets and determine the data type of each of the multiple data packets.

[0148] It can be understood that the implementation method of step 1010 can refer to the relevant description of step 110, which will not be repeated here.

[0149] Step 1020 , detect the data of the data packet by using a probe corresponding to the data type to obtain abnormality detection information of the data packet of each data type.

[0150] It can be understood that the implementation method of step 1020 can refer to the relevant description of step 120 and steps 310 to 320, which will not be repeated here.

[0151] Step 1030: Based on the anomaly detection information of data packets of multiple data types, determine multiple first anomaly detection information having the same first field information from the multiple anomaly detection information.

[0152] It can be understood that the implementation of step 1030 can refer to the relevant description of step 510, which will not be repeated here.

[0153] Step 1040: Determine, from among the plurality of first abnormality detection information, a plurality of second abnormality detection information having at least one identical second field information.

[0154] It can be understood that the implementation of step 1040 can refer to the relevant descriptions of step 520 and step 610, which will not be repeated here.

[0155] Step 1050, matching multiple preset anomaly detection information in the preset attack pattern library with multiple second anomaly detection information, and determining the preset attack sequence corresponding to each second anomaly detection information in the multiple second anomaly detection information based on the preset attack sequence corresponding to each preset anomaly detection information in the multiple preset anomaly detection information.

[0156] It can be understood that the implementation method of step 1050 can refer to the relevant description of step 620, which will not be repeated here.

[0157] Step 1060: Based on the time information corresponding to each piece of second anomaly detection information and the preset attack sequence, determine a plurality of target anomaly detection information belonging to the same attack process from the plurality of second anomaly detection information.

[0158] It can be understood that the implementation method of step 1060 can refer to the relevant description of step 630, which will not be repeated here.

[0159] Step 1070, determine network security detection results such as attack path diagrams and time correlation diagrams based on the field information in the multiple target anomaly detection information, and display the network security detection results.

[0160] It can be understood that the implementation method of step 1070 can refer to the relevant description of steps 710 to 730, which will not be repeated here.

[0161] By applying the network security detection method provided by the present application, data packets are detected through probes corresponding to data types among multiple probes, which can realize multi-dimensional data detection such as network security data, cryptographic application data, mobile security data, data security data and all types of data, and improve the ability to identify complex attack patterns. In addition, by clustering the abnormal detection information of data packets of multiple data types and generating visual network security detection results, the correlation between multiple abnormal detection information can be determined, and the false positives and false negatives of security incidents can be reduced. It can also help users understand the overall security incident more clearly, thereby improving the speed and accuracy of security incident response and reducing potential network security risks.

[0162] refer to Fig.11 As shown, corresponding to the embodiment of the aforementioned network security detection method, the present application also provides an embodiment of a network security detection device. The network security detection device 1100 includes an acquisition module 1110 , a detection module 1120 and a cluster analysis module 1130 .

[0163] The acquisition module 1110 is configured to acquire multiple data packets and determine the data type of each data packet in the multiple data packets.

[0164] The detection module 1120 is configured to detect the data of each data packet based on the data type of each data packet through a probe corresponding to the data type to obtain abnormality detection information of the data packet of each data type.

[0165] The cluster analysis module 1130 is configured to perform cluster analysis on the abnormality detection information of data packets of multiple data types to obtain network security detection results.

[0166] In some embodiments, the acquisition module 1110 is specifically configured to: parse multiple data packets to obtain protocol information corresponding to each data packet; based on the protocol information corresponding to each data packet, determine the data type corresponding to each data packet among multiple data types; wherein the multiple data types include one or more of network security data, cryptographic application data, mobile security data, and data security data.

[0167] In some embodiments, the detection module 1120 is specifically configured as follows: based on the data type of each data packet, determining a probe corresponding to the data type of each data packet from a plurality of probes; wherein the plurality of probes include one or more of a network security probe, a cryptographic application probe, a mobile security probe, a data security probe, and a full-type probe; the plurality of probes are used to detect whether there is an anomaly in the data of a data packet of each data type within a preset time period; the presence of an anomaly in a data packet includes an anomaly in the data flow of the data packet within a preset time period, and / or the presence of abnormal data in the data packet; the field information in each data packet is identified by using a probe corresponding to the data type of each data packet to obtain anomaly detection information of each data packet.

[0168] In some embodiments, the clustering analysis module 1130 is specifically configured to: based on the anomaly detection information of data packets of multiple data types, determine multiple target anomaly detection information with multiple identical field information in the multiple anomaly detection information; wherein the anomaly detection information includes field information, and the field information includes at least two of the source IP address, destination IP address, source port, destination port, protocol information and attack type; analyze and process the multiple target anomaly detection information to obtain network security detection results.

[0169] In some embodiments, the clustering analysis module 1130 is specifically configured to: based on the anomaly detection information of data packets of multiple data types, determine multiple first anomaly detection information with the same first field information in multiple anomaly detection information; wherein the field information includes first field information, and the first field information includes a source IP address and / or a destination IP address; determine the first anomaly detection information with at least one identical second field information in the multiple first anomaly detection information as the target anomaly detection information; wherein the field information includes second field information, and the second field information includes at least one of a source port, a destination port, protocol information, and an attack type.

[0170] In some embodiments, the clustering analysis module 1130 is specifically configured to: determine multiple second anomaly detection information having at least one identical second field information in multiple first anomaly detection information; match multiple preset anomaly detection information in a preset attack pattern library with multiple second anomaly detection information, and determine a preset attack sequence corresponding to each second anomaly detection information in multiple second anomaly detection information based on a preset attack sequence corresponding to each preset anomaly detection information in the multiple preset anomaly detection information; determine multiple target anomaly detection information belonging to the same attack process in multiple second anomaly detection information based on the time information and the preset attack sequence corresponding to each second anomaly detection information; wherein the field information includes time information, and the time information corresponding to each second anomaly detection information is the occurrence time of the attack event corresponding to each second anomaly detection information.

[0171] In some embodiments, the clustering analysis module 1130 is specifically configured to: determine multiple attack nodes in the attack path graph corresponding to the multiple target anomaly detection information based on the source IP address, destination IP address, source port or destination port of each target anomaly detection information in the multiple target anomaly detection information; determine the node order corresponding to each attack node in the multiple attack nodes based on the attack order corresponding to each target anomaly detection information; wherein the attack order corresponding to the target anomaly detection information is determined based on a preset attack pattern library and the time information in the target anomaly detection information; determine the attack path graph based on multiple attack nodes and the node order corresponding to each attack node; wherein the network security detection result includes the attack path graph.

[0172] In some embodiments, the cluster analysis module 1130 is specifically configured to: determine each attack node based on the destination IP address of each target anomaly detection information when the source IP addresses of multiple target anomaly detection information are the same and the destination IP addresses are different.

[0173] In some embodiments, the cluster analysis module 1130 is specifically configured to: when the source IP addresses of multiple target anomaly detection information are the same, the destination IP addresses are the same, and the destination ports are different, determine each attack node based on the destination port of each target anomaly detection information.

[0174] Fig.12 A schematic diagram of a computing device provided for some embodiments of the present application. In some embodiments, the computing device may include a server, a terminal, and other devices; the computing device includes one or more processors and a memory. The memory is configured to store one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the network security detection method in the above embodiment.

[0175] like Fig.12As shown, the computing device 1200 includes: a processor (processor) 1201 and a memory 1202. Exemplarily, the computing device 1200 may also include: a communication interface (Communications Interface) 1203 and a communication bus 1204.

[0176] The processor 1201, the memory 1202 and the communication interface 1203 communicate with each other via the communication bus 1204. The communication interface 1203 is used to communicate with other devices such as client or other server network elements.

[0177] In some embodiments, the processor 1201 is used to execute the program 1205, and specifically can execute the relevant steps in the above network security detection method embodiment. Specifically, the program 1205 can include program code, and the program code includes computer executable instructions.

[0178] Exemplarily, the processor 1201 may be a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement some embodiments of the present application. The computing device 1200 may include one or more processors, which may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0179] In some embodiments, the memory 1202 is used to store the program 1205. The memory 1202 may include a high-speed RAM memory, and may also include a non-volatile memory (NVM), such as at least one disk memory.

[0180] Program 1205 may be specifically called by processor 1201 to enable computing device 1200 to perform network security detection method operations.

[0181] Some embodiments of the present application provide a computer-readable storage medium, which stores at least one executable instruction. When the executable instruction is executed on a computing device 1200, the computing device 1200 executes the network security detection method in the above embodiment.

[0182] The executable instructions may be specifically used to enable the computing device 1200 to perform network security detection method operations.

[0183] For example, the computer readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a compact disc (CD-ROM), a magnetic tape, a floppy disk, an optical data storage device, and the like.

[0184] The beneficial effects that can be achieved by the readable storage medium provided in some embodiments of the present application can be referred to the beneficial effects in the corresponding network security detection method provided above, and will not be repeated here.

[0185] It should be noted that, in the application, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "including a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0186] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0187] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, which can be embodied in any computer-readable medium for use by an instruction execution system, apparatus or device (such as a computer-based system, a system including a processor or other system that can fetch instructions from an instruction execution system, apparatus or device and execute instructions), or used in combination with these instruction execution systems, apparatuses or devices.

[0188] For the purposes of this specification, a "computer-readable medium" can be any apparatus that can contain, store, communicate, propagate, or transport the program for use by an instruction execution system, apparatus, or device or in conjunction with such instruction execution system, apparatus, or device.

[0189] More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection having one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM).

[0190] In addition, the computer readable medium can even be a paper or other suitable medium on which the program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other medium, and then editing, interpreting or processing in other suitable ways as necessary, and then storing it in the computer memory. It should be understood that various parts of the present application can be implemented in hardware, software, firmware or a combination thereof.

[0191] In the above embodiments, multiple steps or methods may be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it may be implemented by any one of the following technologies known in the art or a combination thereof: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0192] The implementation methods described above are only specific implementation methods of the present application and are not intended to limit the scope of protection of the present application. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present application should be included in the scope of protection of the present application.

Claims

1. A network security detection method, characterized in that: include: Acquire multiple data packets, and determine the data type of each of the multiple data packets; Based on the data type of each of the data packets, detecting the data of the data packets through a probe corresponding to the data type to obtain abnormality detection information of the data packets of each of the data types; Cluster analysis is performed on the abnormal detection information of multiple data packets of the data types to obtain network security detection results.

2. The method according to claim 1, characterized in that Determining the data type of each of the plurality of data packets comprises: Parsing the multiple data packets to obtain protocol information corresponding to each of the data packets; Based on the protocol information corresponding to each of the data packets, the data type corresponding to each of the data packets is determined from multiple data types; wherein the multiple data types include one or more of network security data, cryptographic application data, mobile security data, and data security data.

3. The method according to claim 1, characterized in that The method of detecting the data of the data packets based on the data type of each data packet by using a probe corresponding to the data type to obtain abnormality detection information of the data packets of each data type includes: Based on the data type of each of the data packets, a probe corresponding to the data type of each of the data packets is determined from the multiple probes; wherein the multiple probes include one or more of a network security probe, a cryptographic application probe, a mobile security probe, a data security probe, and an all-type probe; the multiple probes are used to detect whether there is an abnormality in the data of the data packets of each of the data types within a preset time period; the abnormality of the data packet includes an abnormality in the data flow of the data packet within the preset time period, and / or the presence of abnormal data in the data packet; The field information in each of the data packets is identified by a probe corresponding to the data type of each of the data packets to obtain abnormality detection information of each of the data packets.

4. The method according to claim 1, characterized in that: The cluster analysis of the abnormal detection information of the data packets of the plurality of data types to obtain the network security detection result includes: Based on the anomaly detection information of the data packets of the plurality of data types, a plurality of target anomaly detection information having a plurality of identical field information is determined in the plurality of anomaly detection information; wherein the anomaly detection information includes the field information, and the field information includes at least two of the source IP address, the destination IP address, the source port, the destination port, the protocol information, and the attack type; The multiple target anomaly detection information is analyzed and processed to obtain the network security detection result.

5. The method according to claim 4, characterized in that The abnormality detection information based on the data packets of the plurality of data types, determining a plurality of target abnormality detection information having a plurality of identical field information in the plurality of abnormality detection information, comprises: Based on the anomaly detection information of the data packets of the plurality of data types, a plurality of first anomaly detection information having the same first field information is determined in the plurality of anomaly detection information; wherein the field information includes the first field information, and the first field information includes a source IP address and / or a destination IP address; The first anomaly detection information having at least one identical second field information among the multiple first anomaly detection information is determined as the target anomaly detection information; wherein the field information includes the second field information, and the second field information includes at least one of a source port, a destination port, protocol information, and an attack type.

6. The method according to claim 5, characterized in that The determining, among the plurality of first abnormality detection information, first abnormality detection information having at least one identical second field information as the target abnormality detection information comprises: Determining, from among the plurality of first abnormality detection information, a plurality of second abnormality detection information having at least one identical second field information; Matching a plurality of preset abnormality detection information in a preset attack pattern library with the plurality of second abnormality detection information, and determining a preset attack sequence corresponding to each of the plurality of second abnormality detection information based on a preset attack sequence corresponding to each of the preset abnormality detection information in the plurality of preset abnormality detection information; Based on the time information corresponding to each piece of second anomaly detection information and the preset attack order, the multiple target anomaly detection information belonging to the same attack process are determined among the multiple second anomaly detection information; wherein the field information includes the time information, and the time information corresponding to each piece of second anomaly detection information is the occurrence time of the attack event corresponding to each piece of second anomaly detection information.

7. The method according to any one of claims 4 to 6, characterized in that: The analyzing and processing the plurality of target anomaly detection information to obtain the network security detection result includes: Determine, based on the source IP address, destination IP address, source port or destination port of each of the target anomaly detection information in the multiple target anomaly detection information, multiple attack nodes in the attack path graph corresponding to the multiple target anomaly detection information; Based on the attack sequence corresponding to each of the target anomaly detection information, determine the node sequence corresponding to each of the attack nodes in the multiple attack nodes; wherein the attack sequence corresponding to the target anomaly detection information is determined based on a preset attack mode library and the time information in the target anomaly detection information; The attack path diagram is determined based on the multiple attack nodes and the node sequence corresponding to each of the attack nodes; wherein the network security detection result includes the attack path diagram.

8. The method according to claim 7, characterized in that The determining, based on the source IP address, the destination IP address, the source port or the destination port of each of the target anomaly detection information in the multiple target anomaly detection information, multiple attack nodes in the attack path graph corresponding to the multiple target anomaly detection information includes: In a case where the source IP addresses of the plurality of target anomaly detection information are all the same and the destination IP addresses are all different, each of the attack nodes is determined based on the destination IP address of each of the target anomaly detection information.

9. The method according to claim 7, characterized in that: The determining, based on the source IP address, the destination IP address, the source port or the destination port of each of the target anomaly detection information in the multiple target anomaly detection information, multiple attack nodes in the attack path graph corresponding to the multiple target anomaly detection information includes: When the source IP addresses of the plurality of target anomaly detection information are all the same, the destination IP addresses are all the same, and the destination ports are different, each of the attack nodes is determined based on the destination port of each of the target anomaly detection information.

10. A computing device, characterized in that include: one or more processors; and A memory configured to: store one or more programs; Wherein, when the one or more programs are executed by the one or more processors, the one or more processors implement the network security detection method according to any one of claims 1-9.

Images