Attack detection method and device, electronic equipment and computer readable storage medium

Abstract

The invention discloses an attack detection method and device, electronic equipment, a computer readable storage medium and a computer program product. The method comprises the steps of collecting target data of target equipment; performing association analysis on the first abnormal data and the second abnormal data, and determining an attack detection result of the target equipment; wherein the first abnormal data is obtained by identifying the target data based on a business behavior model, and the second abnormal data is obtained by identifying the target data based on an attack behavior model. By applying the technical scheme provided by the invention, more accurate directional attack detection can be realized.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an attack detection method, and also to an attack detection device, an electronic device, a computer-readable storage medium, and a computer program product. Background Art

[0002] Among the related technologies, targeted attack detection mainly relies on UEBA (User and Entity Behavior Analytics) technology. However, UEBA essentially only analyzes abnormal network behavior, that is, users can only judge the existence of abnormal behavior in the network based on the results, and cannot determine whether it is a targeted attack behavior that poses a high threat to the enterprise; in addition, the business types and work natures of the objects covered by UEBA modeling are different, and the model characteristics of each object are also quite different, so it is easy to have a large number of abnormal behavior false alarms. It can be seen that the traditional attack detection method based on UEBA technology has the problem of inaccurate detection results.

[0003] Therefore, how to achieve more accurate targeted attack detection is an urgent problem to be solved by those skilled in the art. Summary of the invention

[0004] The purpose of the present application is to provide an attack detection method, which can achieve more accurate targeted attack detection; another purpose of the present application is to provide an attack detection device, an electronic device, a computer-readable storage medium and a computer program product, all of which have the above-mentioned beneficial effects.

[0005] In a first aspect, the present application provides an attack detection method, comprising:

[0006] Collect target data of target devices;

[0007] The first abnormal data and the second abnormal data are correlated and analyzed to determine the attack detection result of the target device; wherein the first abnormal data is obtained by identifying the target data based on the business behavior model, and the second abnormal data is obtained by identifying the target data based on the attack behavior model.

[0008] Preferably, before performing correlation analysis on the first abnormal data and the second abnormal data to determine the attack detection result of the target device, the method further includes:

[0009] Performing risk type identification on the second abnormal data to determine the risk type of the second abnormal data; the risk type includes a high risk type and a low risk type;

[0010] Accordingly, performing correlation analysis on the first abnormal data and the second abnormal data to determine the attack detection result of the target device includes:

[0011] When the risk type of the second abnormal data is the high-risk type, determining that a targeted attack exists on the target device;

[0012] When the risk type of the second abnormal data is the low risk type, correlation analysis is performed on the first abnormal data and the second abnormal data to determine an attack detection result of the target device.

[0013] Preferably, performing risk type identification on the second abnormal data to determine the risk type of the second abnormal data includes:

[0014] Performing attack behavior identification on the second abnormal data to determine a target attack behavior corresponding to the second abnormal data;

[0015] When the target attack behavior hits the high-risk attack behavior database, determining the danger type of the second abnormal data as the high-risk type;

[0016] When the target attack behavior hits the low-risk attack behavior database, the risk type of the second abnormal data is determined to be the low-risk type.

[0017] Preferably, performing correlation analysis on the first abnormal data and the second abnormal data to determine the attack detection result of the target device includes:

[0018] Perform entity association analysis and / or role association analysis on the first abnormal data and the second abnormal data to determine an attack detection result of the target device.

[0019] Preferably, performing entity association analysis and role association analysis on the first abnormal data and the second abnormal data to determine the attack detection result of the target device includes:

[0020] Matching the first abnormal data and the second abnormal data to determine an attack entity corresponding to the target device and an abnormal attack behavior of the attack entity against the target device;

[0021] When the abnormal attack behavior from the attack entity exists in a device of the same type as the target device, it is determined that a targeted attack exists on the target device.

[0022] Preferably, the process of identifying the target data based on the attack behavior model to obtain the second abnormal data includes:

[0023] Extracting features from the target data according to each attack stage to obtain target attack features at each attack stage;

[0024] The attack behavior model corresponding to each of the attack stages is used to identify the corresponding target attack features to obtain the second abnormal data.

[0025] In a second aspect, the present application further discloses an attack detection device, comprising:

[0026] A collection module, used for collecting target data of a target device;

[0027] An analysis module is used to perform correlation analysis on the first abnormal data and the second abnormal data to determine the attack detection result of the target device; wherein the first abnormal data is obtained by identifying the target data based on the business behavior model, and the second abnormal data is obtained by identifying the target data based on the attack behavior model.

[0028] In a third aspect, the present application further discloses an electronic device, comprising:

[0029] Memory for storing computer programs;

[0030] A processor is used to implement the steps of any one of the attack detection methods described above when executing the computer program.

[0031] In a fourth aspect, the present application further discloses a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of any of the attack detection methods described above are implemented.

[0032] In a fifth aspect, the present application further discloses a computer program product, which includes a computer program / instructions, and when the computer program / instructions are executed by a processor, the steps of any one of the attack detection methods described above are implemented.

[0033] An attack detection method provided by the present application includes: collecting target data of a target device; performing correlation analysis on first abnormal data and second abnormal data to determine an attack detection result of the target device; wherein the first abnormal data is obtained by identifying the target data based on a business behavior model, and the second abnormal data is obtained by identifying the target data based on an attack behavior model.

[0034] It can be seen that the attack detection method provided in the present application pre-builds a normal behavior model (business behavior model) and an attack behavior model for realizing target device data detection respectively, and then realizes attack detection of the target device by correlating and analyzing the detection results of the two models. It can be seen that this scheme realizes attack detection technology based on joint analysis of black and white models, which can realize more accurate targeted attack detection compared with the traditional attack detection method based on UEBA technology.

[0035] The attack detection device, electronic device, computer-readable storage medium, and computer program product provided in this application all have the above-mentioned beneficial effects, which will not be described in detail here. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the prior art and the embodiments of the present application, the drawings required for use in the description of the prior art and the embodiments of the present application are briefly introduced below. Of course, the drawings described below in relation to the embodiments of the present application are only part of the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without creative work, and the obtained other drawings also belong to the protection scope of the present application.

[0037] Figure 1 A flowchart of an attack detection method provided by this application;

[0038] Figure 2 A schematic diagram of a model building method provided in this application;

[0039] Figure 3 A flowchart of another attack detection method provided by this application;

[0040] Figure 4 A schematic diagram of the structure of an attack detection device provided by this application;

[0041] Figure 5 A schematic diagram of the structure of an electronic device provided in this application. DETAILED DESCRIPTION

[0042] The core of this application is to provide an attack detection method, which can achieve more accurate targeted attack detection; another core of this application is to provide an attack detection device, an electronic device, a computer-readable storage medium and a computer program product, which also have the above-mentioned beneficial effects.

[0043] In order to describe the technical solutions in the embodiments of the present application more clearly and completely, the technical solutions in the embodiments of the present application will be introduced below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0044] An embodiment of the present application provides an attack detection method.

[0045] Please refer to Figure 1 , Figure 1 This is a flow chart of an attack detection method provided in the present application. The attack detection method may include the following S101~S104.

[0046] S101: Collect target data of a target device.

[0047] This step aims to realize data collection of the target device and obtain the target data of the target device. Among them, the device type of the target device does not affect the implementation of this technical solution, and can be any type of device, such as a server, a switch, a terminal device, etc., and this application does not limit this. In addition, the type of data collected in the target device is not unique. In a possible implementation method, the target data may include network traffic data and / or terminal data and / or log data in the target device. The network traffic data may be traffic data transmitted between various business systems in the target device, such as protocol information and / or encryption information and / or five-tuple and / or payload, etc.; terminal data may include processes and / or threads and / or files and / or registries running in the target device; log data refers to record files automatically generated by the target device during operation, such as operation behavior logs and / or state change logs and / or file operation logs, etc.

[0048] S102: Perform correlation analysis on the first abnormal data and the second abnormal data to determine the attack detection result of the target device; wherein the first abnormal data is obtained by identifying the target data based on the business behavior model, and the second abnormal data is obtained by identifying the target data based on the attack behavior model.

[0049] This step aims to realize correlation analysis of different model recognition results (i.e., the first abnormal data and the second abnormal data) to determine the attack detection result of the target device; wherein, determining the attack detection result of the target device is to determine whether the target device is suffering from a targeted attack. In addition, when it is determined that the target device is suffering from a targeted attack, a corresponding alarm prompt can also be output.

[0050] Specifically, the business behavior model and the attack behavior model can be pre-created and stored in the corresponding storage space. When the target data of the target device is collected, the business behavior model and the attack behavior model can be retrieved, and the target data can be input into the two for processing, wherein the output of the business behavior model is the first abnormal data that does not conform to the business behavior model, and the output of the attack behavior model is the second abnormal data that conforms to the attack behavior model. It can be understood that the business behavior model is a white model, and the target data that conforms to the business behavior model is normal data, and the data that does not conform to the business behavior model is abnormal data, that is, the first abnormal data mentioned above; the attack behavior model is a black model, and the target data that conforms to the attack behavior model is abnormal data, that is, the second abnormal data mentioned above, and the data that does not conform to the attack behavior model is normal data. It can be imagined that in order to ensure the efficiency of attack detection, the target data recognition operations of the two models can be performed simultaneously.

[0051] Furthermore, for the above-mentioned business behavior model and attack behavior model, the embodiment of the present application also proposes a corresponding construction method.

[0052] First, the process of building a business behavior model may include:

[0053] Collect data samples from various business devices; data samples include network traffic samples and / or log data samples and / or terminal data;

[0054] For each type of business equipment, feature extraction is performed on the data samples of the business equipment to obtain business features;

[0055] The business characteristics of the business equipment are used to build the business behavior model corresponding to the business equipment.

[0056] The embodiment of the present application provides a method for constructing a business behavior model, that is, a method for constructing a model based on business characteristics corresponding to different device types. Specifically, for each type of business device, its data samples can be collected separately, including network traffic samples and / or log data samples and / or terminal data, and then the data samples are subjected to feature extraction to obtain corresponding business characteristics, thereby constructing a business behavior model of the corresponding business device using the business characteristics. Among them, the business characteristics may specifically include but are not limited to the business initiation time of the corresponding business device, the business initiator IP, the access object collection, the role operation type, etc.

[0057] That is to say, for each device type, a corresponding business behavior model can be created. Therefore, in the subsequent target data identification process based on the business behavior model, the corresponding business behavior model can be selected according to the device type of the target device to identify the target data. Based on this, the above process of identifying the target data based on the business behavior model to obtain the first abnormal data can include: determining the device type of the target device; extracting the target business characteristics of the target data according to the device type; using the business behavior model corresponding to the device type to identify the target business characteristics and obtain the first abnormal data.

[0058] In a possible implementation, the business equipment may be a high-authority facility, i.e., a centralized facility, which refers to a hardware facility that assumes high-authority permissions such as access control and role permission allocation in the network, including but not limited to a bastion host, an AD domain controller, a virtualization management platform, etc. It is understandable that various high-authority facilities have different business scenarios. For example, a bastion host performs access permission control, and an AD domain is mainly responsible for large-scale user terminal management, file distribution, and software updates.

[0059] Secondly, the process of building an attack behavior model can include:

[0060] Collect samples of aggressive behavior;

[0061] Extract features from each attack behavior sample according to the attack stage to obtain attack features of each attack stage;

[0062] For each attack stage, all attack features of the attack stage are used to build the attack behavior model corresponding to the attack stage.

[0063] The embodiment of the present application provides a method for constructing an attack behavior model, that is, a method for constructing a model based on attack features in different attack stages. Specifically, an attack behavior sample can be collected, and the attack behavior sample can be extracted from the above-mentioned data samples, and then feature extraction is performed on it according to different attack stages to obtain attack features of different attack stages. Thus, for each attack stage, the attack features of each attack stage can be used to realize the construction of the attack behavior model of the corresponding attack stage. Among them, the attack stage can be specifically divided into detection and scoring, boundary breakthrough, authority maintenance, intranet diffusion, target authority acquisition, task data acquisition, etc.; accordingly, the attack features can include but are not limited to attack techniques, attack objects, attack time, attack purpose, etc. It can be understood that different attack stages correspond to different attack features.

[0064] That is to say, for each attack stage, a corresponding attack behavior model can be created. Therefore, in the subsequent target data identification process based on the attack behavior model, the corresponding business behavior model can be selected according to the attack stage in the target data to identify the target data. Based on this, the process of identifying the target data based on the attack behavior model to obtain the second abnormal data can include: extracting features from the target data according to each attack stage to obtain the target attack features of each attack stage; using the attack behavior model corresponding to each attack stage to identify the corresponding target attack features to obtain the second abnormal data.

[0065] It can be seen that the attack detection method provided in the present application pre-builds a normal behavior model (business behavior model) and an attack behavior model for realizing target device data detection respectively, and then realizes attack detection of the target device by correlating and analyzing the detection results of the two models. It can be seen that this scheme realizes attack detection technology based on joint analysis of black and white models, which can realize more accurate targeted attack detection compared with the traditional attack detection method based on UEBA technology.

[0066] Based on the above embodiments:

[0067] In one embodiment of the present application, before performing correlation analysis on the first abnormal data and the second abnormal data to determine the attack detection result of the target device, the method may further include: identifying the danger type of the second abnormal data to determine the danger type of the second abnormal data; the danger type includes a high-risk type and a low-risk type;

[0068] Accordingly, the first abnormal data and the second abnormal data are correlated and analyzed to determine the attack detection result of the target device, including: when the danger type of the second abnormal data is a high-risk type, determining that there is a directed attack on the target device; when the danger type of the second abnormal data is a low-risk type, the first abnormal data and the second abnormal data are correlated and analyzed to determine the attack detection result of the target device.

[0069] In order to effectively ensure the efficiency of attack detection, the embodiment of the present application realizes the correlation analysis of abnormal data in combination with the danger level of the second abnormal data. Specifically, the second abnormal data that satisfies the attack behavior model in the target device can be determined through the attack behavior model, that is, the second abnormal data with attack behavior. On this basis, the danger type of this part of the second abnormal data can be identified to determine its danger level, and then the abnormal data analysis can be realized in combination with the danger level of the second abnormal data. It can be understood that due to the particularity of the attack object (target device) (high-authority facilities), when the second abnormal data belongs to high-risk type data, it can be directly determined that there is a targeted attack; however, if the second abnormal data belongs to low-risk type data, in order to effectively ensure the accuracy of the attack detection result, it can be associated with the first abnormal data for analysis to achieve attack detection.

[0070] Among them, identifying the danger type of the second abnormal data and determining the danger type of the second abnormal data may include: identifying the attack behavior of the second abnormal data and determining the target attack behavior corresponding to the second abnormal data; when the target attack behavior hits a high-risk attack behavior database, determining the danger type of the second abnormal data to be a high-risk type; when the target attack behavior hits a low-risk attack behavior database, determining the danger type of the second abnormal data to be a low-risk type.

[0071] Specifically, a high-risk behavior database and a low-risk behavior database can be created in advance. The high-risk behavior database is used to store relevant information about some high-risk behaviors, such as CVE (Common Vulnerabilities and Exposures) vulnerability exploitation behaviors, malicious code execution behaviors that comply with ATT&CK (a threat framework) techniques and tactics, and access behaviors that hit threat intelligence, etc. The low-risk behavior database is used to store relevant information about some low-risk behaviors, such as multiple failed user logins, remote logins, database sensitive operations, or other low-confidence suspicious behaviors that comply with ATT&CK techniques and tactics, etc. Therefore, the database matching solution can be used to realize the identification of the dangerous type of the second abnormal data.

[0072] In one embodiment of the present application, performing correlation analysis on the first abnormal data and the second abnormal data to determine the attack detection result of the target device may include: performing entity correlation analysis and / or role correlation analysis on the first abnormal data and the second abnormal data to determine the attack detection result of the target device.

[0073] The embodiment of the present application provides a method for implementing association analysis of two types of abnormal data, which can be implemented by entity association analysis and / or role association analysis. Among them, entity association analysis refers to associating entity devices to implement abnormal data analysis. Obviously, the entity devices here include attacking devices (i.e., the attacking entities described below) and attacked devices (i.e., each business device); role association analysis refers to associating entity device roles to implement abnormal data analysis. Here, the entity device role mainly refers to the device type of each business device, and abnormal data analysis is implemented by dividing the same type (role) devices.

[0074] Furthermore, performing entity association analysis and role association analysis on the first abnormal data and the second abnormal data to determine the attack detection result of the target device may include:

[0075] Matching the first abnormal data and the second abnormal data to determine an attack entity corresponding to the target device and an abnormal attack behavior of the attack entity against the target device;

[0076] When there is an abnormal attack behavior from the attacking entity in a device of the same type as the target device, it is determined that there is a directed attack on the target device.

[0077] First, by matching and analyzing the first abnormal data and the second abnormal data, the attack entity corresponding to the target device can be identified, that is, the physical device that attacks the target device, and the abnormal attack behavior launched by the attack entity against the target device can also be identified. Specifically, by matching and analyzing the first abnormal data and the second abnormal data, some entity features of the attack entity can be extracted, such as the device physical address and / or browser fingerprint and / or file and / or domain name and / or hash value and / or process command line and / or IP, etc., so that the attack entity can be determined; then, by comprehensively analyzing the attack entity and the first abnormal data and the second abnormal data, the abnormal attack behavior launched by the attack entity against the target device can be determined.

[0078] Furthermore, since the number of detected attack entities may not be unique, and the abnormal attack behaviors launched by different attack entities on the target device may also be different, on this basis, for the abnormal attack behaviors of each attack entity, its regularity can be analyzed through role association analysis. Taking the target device as an example, it can be checked whether its same type of devices are also subjected to abnormal attack behaviors from the same attack entity. Obviously, if the same type of devices of the target device are also subjected to abnormal attack behaviors from the same attack entity, that is, multiple devices of the same type are subjected to abnormal attack behaviors from the same attack entity, it can be determined that the target device is currently subjected to a targeted attack; conversely, if the same type of devices of the target device are not subjected to abnormal attack behaviors from the same attack entity, that is, there are no multiple devices of the same type being subjected to abnormal attack behaviors from the same attack entity, it can be determined that the target device is not subjected to a targeted attack (but it does not rule out the possibility that it may be subjected to other types of attack behaviors).

[0079] Based on the above embodiments, the embodiments of the present application provide another attack detection method.

[0080] First, please refer to Figure 2 , Figure 2 This is a flow chart of a model building method provided in this application, and its specific implementation process is as follows:

[0081] 1. Data collection:

[0082] In order to achieve behavioral modeling of various high-authority facilities in the customer network, the network traffic data, log information and terminal data of each high-authority facility can be collected separately, mainly referring to the traffic data transmitted between different business systems and the terminal data and logs of high-authority facilities. At the same time, in order to ensure the accuracy of the model and improve the accuracy of the attack detection results, the collected data can be pre-processed first, including but not limited to data cleaning, data deduplication, missing value filling, etc.

[0083] 2. “Black + White” model establishment:

[0084] (1) Establishment of white model (business behavior model):

[0085] Different business behavior models are built according to different device types (high-authority devices, including but not limited to bastion hosts, AD domain controllers, virtualization management platforms, etc.). The model can be built based on [business initiation time, business initiator IP, access object set, role operation type] as the benchmark elements, and after a period of learning and improvement, a mature business behavior model can be built.

[0086] (2) Black model (aggression behavior model) establishment:

[0087] In a complete targeted attack, the attack phase can usually be defined as [detection, boundary breach, authority maintenance, intranet diffusion, target authority acquisition, task data acquisition] six phases, and the attack characteristics shown in different attack phases are different. Therefore, based on the different attack behavior portraits of attackers in the field of targeted attacks, the attacker's attack behavior model can be constructed. Specifically, the model can be constructed based on the unique attack characteristics (attack methods, attack objects, attack time, attack purpose, etc.) of different attack phases in a complete attack chain.

[0088] 3. Model storage:

[0089] Save the business behavior model and attack behavior model to the model management center so that they can be directly called during the attack detection process.

[0090] For further information, please refer to Figure 3 , Figure 3 A flowchart of another attack detection method provided by this application is as follows:

[0091] 1. Data collection:

[0092] Collect and obtain various target data of target high-authority facilities (target devices), which may also include their network traffic data, log information and terminal data.

[0093] 2. Call the model to achieve targeted attack identification:

[0094] (1) For behaviors that violate the “white model” baseline (first abnormal data), it is considered to be a potential abnormal behavior. However, the certainty that the abnormal behavior is malicious is low. It may be an occasional business behavior. Therefore, it cannot be directly defined as a targeted attack and requires other detection capabilities to assist in verification.

[0095] (2) For behaviors that trigger the "black model" baseline (second abnormal data), the attack behaviors can be divided into low-risk attacks and high-risk attacks according to the degree of harm caused by the attack behaviors. Due to the particularity of the attack targets (high-authority facilities), high-risk attacks can be directly characterized as targeted attacks, but low-risk attacks still cannot be determined whether they are normal business operation and maintenance behaviors.

[0096] (3) For the abnormal behavior in (1) and the low-risk attack behavior in (2), a single analysis cannot directly define whether the abnormal behavior is a targeted attack behavior. Therefore, an association analysis algorithm can be used to perform entity association analysis, role association analysis, etc. on the above two behaviors, so as to upgrade the uncertain low-risk abnormal behavior to a certain high-risk attack behavior, and then define it as a targeted attack behavior in combination with the particularity of the attack target. The association process is as follows:

[0097] a. Perform data matching on the abnormal behavior in (1) and the low-risk attack behavior in (2) to extract relevant information of the attacking entity, including but not limited to the device physical address, browser fingerprint, file, domain name, hash value, process command line, IP, etc., to identify the attacking entity;

[0098] b. According to the type of high-authority device, determine the abnormal attack behavior generated by the attack entity based on the extracted attack entity information;

[0099] c. For target devices that are subject to abnormal attack behaviors, the damaged role is used to globally detect the occurrence pattern of abnormal attack behaviors, that is, to determine whether devices of the same type as the target device are also subject to abnormal attack behaviors from the attacking entity;

[0100] d. When multiple devices of the same type are subjected to abnormal attack behavior from the same attack entity, the abnormal attack behavior can be upgraded to a high-risk attack behavior, that is, a high-risk targeted attack behavior.

[0101] 3. Alarm information generation:

[0102] Through all the above behavior analysis, alarm information is generated for the final determined attack behavior.

[0103] It can be seen that the attack detection method provided in the embodiment of the present application, through the behavior modeling analysis of key high-authority facilities, targeted model establishment for different types of high-authority facilities, analysis of the high-authority network traffic, terminal data and log data, to establish a white behavior model for daily production; hierarchical modeling of the business according to different attacker portrait scenarios, starting from the perspective of the initiator of the targeted attack, to establish a black behavior model under different attack scenarios; based on the established normal business behavior model and attack behavior model, the "white + black" dual baseline correlation analysis is realized to analyze the targeted attack behavior. It can be seen that this solution realizes the attack detection technology based on the joint analysis of black and white models, which can achieve more accurate targeted attack detection compared to the traditional attack detection method based on UEBA technology.

[0104] An embodiment of the present application provides an attack detection device.

[0105] Please refer to Figure 4 , Figure 4 This is a schematic diagram of the structure of an attack detection device provided by the present application. The attack detection device may include:

[0106] Acquisition module 1, used to collect target data of target devices;

[0107] Analysis module 2 is used to perform correlation analysis on the first abnormal data and the second abnormal data to determine the attack detection result of the target device; wherein the first abnormal data is obtained by identifying the target data based on the business behavior model, and the second abnormal data is obtained by identifying the target data based on the attack behavior model.

[0108] It can be seen that the attack detection device provided in the embodiment of the present application pre-builds a normal behavior model (business behavior model) and an attack behavior model for respectively realizing target device data detection, and then realizes attack detection of the target device by correlating and analyzing the detection results of the two models. It can be seen that this scheme realizes attack detection technology based on joint analysis of black and white models, which can realize more accurate targeted attack detection compared with the traditional attack detection method based on UEBA technology.

[0109] In one embodiment of the present application, the attack detection device may further include an identification module, which is used to identify the danger type of the second abnormal data and determine the danger type of the second abnormal data before performing the correlation analysis on the first abnormal data and the second abnormal data to determine the attack detection result of the target device; the danger type includes a high-risk type and a low-risk type;

[0110] Accordingly, the above-mentioned analysis module 2 can be specifically used to determine that there is a directed attack on the target device when the danger type of the second abnormal data is a high-risk type; when the danger type of the second abnormal data is a low-risk type, perform correlation analysis on the first abnormal data and the second abnormal data to determine the attack detection result of the target device.

[0111] In one embodiment of the present application, the above-mentioned identification module can be specifically used to identify attack behavior of the second abnormal data and determine the target attack behavior corresponding to the second abnormal data; when the target attack behavior hits the high-risk attack behavior database, the danger type of the second abnormal data is determined to be a high-risk type; when the target attack behavior hits the low-risk attack behavior database, the danger type of the second abnormal data is determined to be a low-risk type.

[0112] In one embodiment of the present application, the above-mentioned analysis module 2 can be specifically used to perform entity association analysis and / or role association analysis on the first abnormal data and the second abnormal data to determine the attack detection result of the target device.

[0113] In one embodiment of the present application, the above analysis module 2 may include:

[0114] An entity association analysis unit, configured to match the first abnormal data with the second abnormal data, and determine an attack entity corresponding to the target device and an abnormal attack behavior of the attack entity against the target device;

[0115] The role association analysis unit is used to determine that a targeted attack exists on the target device when there is an abnormal attack behavior from an attacking entity in a device of the same type as the target device.

[0116] In one embodiment of the present application, the above-mentioned analysis module 2 can also be used to extract features of target data according to each attack stage to obtain target attack features of each attack stage; use the attack behavior model corresponding to each attack stage to identify the corresponding target attack features to obtain second abnormal data.

[0117] For an introduction to the device provided in this application, please refer to the above method embodiment, and this application will not go into details here.

[0118] An embodiment of the present application provides an electronic device.

[0119] Please refer to Figure 5 , Figure 5 This is a schematic diagram of the structure of an electronic device provided in this application, and the electronic device may include:

[0120] A memory 11, used for storing computer programs;

[0121] The processor 10 can implement the steps of any of the above-mentioned attack detection methods when executing a computer program.

[0122] like Figure 5 , which is a schematic diagram of the composition structure of an electronic device, the electronic device may include: a processor 10, a memory 11, a communication interface 12 and a communication bus 13. The processor 10, the memory 11 and the communication interface 12 all communicate with each other through the communication bus 13.

[0123] In the embodiment of the present application, the processor 10 may be a central processing unit (CPU), an application specific integrated circuit, a digital signal processor, a field programmable gate array or other programmable logic devices, etc.

[0124] The processor 10 may call a program stored in the memory 11. Specifically, the processor 10 may execute operations in the embodiment of the attack detection method.

[0125] The memory 11 is used to store one or more programs, which may include program codes, and the program codes include computer operation instructions. In the embodiment of the present application, the memory 11 at least stores programs for implementing the following functions:

[0126] Collect target data of target devices;

[0127] The first abnormal data and the second abnormal data are correlated and analyzed to determine the attack detection result of the target device; wherein the first abnormal data is obtained by identifying the target data based on the business behavior model, and the second abnormal data is obtained by identifying the target data based on the attack behavior model.

[0128] In a possible implementation, the memory 11 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function, etc.; the data storage area may store data created during use.

[0129] In addition, the memory 11 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device or other volatile solid-state storage device.

[0130] The communication interface 12 may be an interface of a communication module, and is used to connect to other devices or systems.

[0131] Of course, it should be noted that Figure 5 The structure shown does not constitute a limitation on the electronic device in the embodiment of the present application. In actual applications, the electronic device may include Figure 5 More or fewer components than shown, or combinations of certain components.

[0132] An embodiment of the present application provides a computer-readable storage medium.

[0133] The computer-readable storage medium provided in the embodiment of the present application stores a computer program, and when the computer program is executed by a processor, the steps of any of the above-mentioned attack detection methods can be implemented.

[0134] Among them, the computer-readable storage medium can be any available medium that can be stored in a computer or a data storage device such as a server or data center that includes one or more available media integrated. For example, it can be a magnetic medium (such as a floppy disk, hard disk, magnetic tape, etc.), an optical medium (such as a DVD) or a semiconductor medium (such as a solid-state hard disk) and other media that can store computer program codes.

[0135] For an introduction to the computer-readable storage medium provided in this application, please refer to the above method embodiment, and this application will not go into details here.

[0136] An embodiment of the present application provides a computer program product.

[0137] The computer program product provided in the embodiments of the present application includes a computer program / instruction, and when the computer program / instruction is executed by a processor, the steps of any of the above-mentioned attack detection methods can be implemented.

[0138] Specifically, in the above embodiments, all or part of them can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of them can be implemented in the form of a computer program product.

[0139] Among them, the computer program product may include one or more computer programs / instructions, and when the computer program / instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application may be generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, computer instructions may be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line, etc.) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0140] For an introduction to the computer program product provided in the embodiments of the present application, please refer to the above method embodiments, and the present application will not elaborate on them here.

[0141] The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0142] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0143] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0144] The technical solution provided by the present application is described in detail above. The principle and implementation method of the present application are described in detail using specific examples herein, and the description of the above embodiments is only used to help understand the method and core idea of ​​the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the principle of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the present application.

Claims

1. An attack detection method, characterized in that: include: Collect target data of target devices; The first abnormal data and the second abnormal data are correlated and analyzed to determine the attack detection result of the target device; wherein the first abnormal data is obtained by identifying the target data based on the business behavior model, and the second abnormal data is obtained by identifying the target data based on the attack behavior model.

2. The attack detection method according to claim 1, characterized in that: Before performing correlation analysis on the first abnormal data and the second abnormal data to determine the attack detection result of the target device, the method further includes: Performing risk type identification on the second abnormal data to determine the risk type of the second abnormal data; the risk type includes a high risk type and a low risk type; Accordingly, performing correlation analysis on the first abnormal data and the second abnormal data to determine the attack detection result of the target device includes: When the risk type of the second abnormal data is the high-risk type, determining that a targeted attack exists on the target device; When the risk type of the second abnormal data is the low risk type, correlation analysis is performed on the first abnormal data and the second abnormal data to determine an attack detection result of the target device.

3. The attack detection method according to claim 2, characterized in that: Performing risk type identification on the second abnormal data to determine the risk type of the second abnormal data includes: Performing attack behavior identification on the second abnormal data to determine a target attack behavior corresponding to the second abnormal data; When the target attack behavior hits the high-risk attack behavior database, determining the danger type of the second abnormal data as the high-risk type; When the target attack behavior hits the low-risk attack behavior database, the risk type of the second abnormal data is determined to be the low-risk type.

4. The attack detection method according to any one of claims 1 to 3, characterized in that: Performing correlation analysis on the first abnormal data and the second abnormal data to determine an attack detection result of the target device includes: Perform entity association analysis and / or role association analysis on the first abnormal data and the second abnormal data to determine an attack detection result of the target device.

5. The attack detection method according to claim 4, characterized in that: Performing entity association analysis and role association analysis on the first abnormal data and the second abnormal data to determine an attack detection result of the target device includes: Matching the first abnormal data and the second abnormal data to determine an attack entity corresponding to the target device and an abnormal attack behavior of the attack entity against the target device; When the abnormal attack behavior from the attack entity exists in a device of the same type as the target device, it is determined that a targeted attack exists on the target device.

6. The attack detection method according to claim 1, characterized in that: The process of identifying the target data based on the attack behavior model to obtain the second abnormal data includes: Extracting features from the target data according to each attack stage to obtain target attack features at each attack stage; The attack behavior model corresponding to each of the attack stages is used to identify the corresponding target attack features to obtain the second abnormal data.

7. An attack detection device, characterized in that: include: A collection module, used for collecting target data of a target device; An analysis module is used to perform correlation analysis on the first abnormal data and the second abnormal data to determine the attack detection result of the target device; wherein the first abnormal data is obtained by identifying the target data based on the business behavior model, and the second abnormal data is obtained by identifying the target data based on the attack behavior model.

8. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the attack detection method according to any one of claims 1 to 6 when executing the computer program.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the attack detection method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program / instruction, and when the computer program / instruction is executed by a processor, the steps of the attack detection method according to any one of claims 1 to 6 are implemented.

Images