Reconstruction method and device of network attack scene based on alarm log correlation

Abstract

The application provides a network attack scene reconstruction method and device based on alarm log correlation, comprising: extracting target attributes from current alarm logs to form six tuples, combining risk level attributes to determine super alarm logs; dividing the super alarm logs and a historical super alarm log set by a sliding window to obtain a candidate attack scene sequence, and screening by timestamp comparison; dividing the candidate attack scene sequence by the highest risk log to obtain a candidate attack scene sub-sequence, extracting attack types and destination port attributes into key alarm logs, and sorting to obtain a candidate attack scene key sequence; inputting the candidate attack scene key sequence into a preset probability model, outputting an attack scene sequence determined as a network attack path and constructing a model; and finally merging paths with the same last key alarm log to reconstruct the attack scene. The technical solution provided by the application reduces alarm log redundancy and manual maintenance costs, and reconstructs attack scenes from massive alarm logs.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a network attack scene reconstruction method and device based on alarm log correlation. BACKGROUND

[0002] In recent years, the Internet industry has developed rapidly, the complexity and risk of network space continue to increase, and network attack means emerge in an endless stream. Intrusion detection systems (IDS) have become an important defense line for protecting private data and maintaining network security, but there are many problems. In order to detect malicious activities as much as possible, IDS will mark suspicious events in a complex network environment, generate a large amount of alarms, and most of them are false positives. At the same time, IDS lacks proper alarm priority classification and ordering, so all alarms are considered equally important, which leads to alarm fatigue of security operators, ignoring real security events and key alarms. In addition, IDS lacks correlation analysis of the whole attack chain. Specifically, while advanced attackers use multi-stage attack behaviors, the IDS presented alarm logs are still based on single events, and the data is isolated and difficult to find multi-dimensional attack behaviors. Existing alarm correlation technologies mainly include two categories: alarm log correlation technology based on prior knowledge and alarm log correlation technology based on statistical features.

[0003] However, the alarm log correlation technology based on prior knowledge needs to rely on a large amount of expert experience to build a causal relationship knowledge base, and also needs manual screening of prior rules, which not only has a large workload and is difficult to maintain, but also the effect is too dependent on existing experience, making it difficult to mine new attack patterns; the alarm log correlation technology based on statistical features relies on frequent item sets to establish correlation rules, without risk level distinction of alarms of different attack behaviors, resulting in low correlation accuracy and inability to correlate alarms with low frequency, so that the reconstructed attack scene lacks key nodes. Therefore, how to quickly identify the intentions of attackers from a large amount of alarms and restore the complete attack scene has become a problem to be solved. SUMMARY

[0004] Therefore, the embodiments of the present application provide a network attack scene reconstruction method and device based on alarm log correlation, which reduces the dependence on prior knowledge, avoids the additional workload of security operators due to data annotation, and effectively reduces the artificial maintenance cost of the system; at the same time, it can accurately capture and deeply correlate analyze key alarms with low frequency but serious harm, so as to reconstruct the attack scene from a large amount of alarm logs, not only improving the accuracy of threat detection, but also enhancing the comprehensiveness of detection, providing a more reliable guarantee for system security. The present application mainly includes the following aspects:

[0005] In a first aspect, the embodiments of the present application provide a network attack scenario reconstruction method based on alarm log correlation, which comprises the following steps:

[0006] extracting target attributes in a current alarm log generated in the process of detecting network attacks to obtain an attribute sextuple of the current alarm log;

[0007] determining a super alarm log based on a risk level attribute of the current alarm log and the target attributes in the attribute sextuple;

[0008] dividing a log set formed by the super alarm log and historical super alarm logs using a sliding time window to obtain a plurality of super alarm log sets associated with network attack scenarios, and determining each super alarm log set as a corresponding initial candidate attack scenario sequence;

[0009] comparing timestamp attributes for each initial candidate attack scenario sequence to obtain a candidate attack scenario sequence;

[0010] splitting each candidate attack scenario sequence using a super alarm log with the highest risk level attribute as a splitting point to obtain a candidate attack scenario sub-sequence;

[0011] extracting attack type attributes and destination port attributes from attribute septuples of each super alarm log included in each candidate attack scenario sub-sequence to obtain a plurality of key alarm logs, and arranging the plurality of key alarm logs according to an order of each super alarm log of the corresponding candidate attack scenario sub-sequence to obtain a candidate attack scenario key sequence;

[0012] inputting all candidate attack scenario key sequences into a preset probability model, so that the preset probability model takes a key alarm log with the highest risk level in each candidate attack scenario key sequence as an initial attack state, outputs an attack scenario sequence corresponding to the key alarm log with the highest risk level, and determines the attack scenario sequence corresponding to the key alarm log with the highest risk level as a network attack path, and constructs a network attack path model based on the network attack path;

[0013] merging network attack paths with the same last key alarm log in the network attack path model to obtain a plurality of reconstructed network attack scenarios.

[0014] Further, the step of determining a super alarm log based on a risk level attribute of the current alarm log and the target attributes in the attribute sextuple comprises the following steps:

[0015] (A) obtaining a risk level attribute of the current alarm log based on an attack type attribute in the attribute sextuple of the current alarm log, so as to add the risk level attribute to the attribute sextuple of the current alarm log to obtain an attribute septuple of the current alarm log;

[0016] (B) performing similarity comparison on target attributes in the attribute septuple of the current alarm log and corresponding target attributes in the historical super-alarm log respectively, and obtaining a log similarity between the current alarm log and the historical super-alarm log by using the similarity of each target attribute;

[0017] (C) if the log similarity is greater than a log similarity threshold, aggregating the current alarm log and the historical super-alarm log which is last time for similarity comparison to obtain a super-alarm log;

[0018] (D) if the log similarity is less than or equal to the log similarity threshold and the historical super-alarm log which is last time for similarity comparison is not the last historical super-alarm log, performing similarity comparison on corresponding target attributes in the current alarm log and a previous historical super-alarm log of the historical super-alarm log respectively, and obtaining a log similarity between the current alarm log and the previous historical super-alarm log by using the similarity of each target attribute, and returning to step (C);

[0019] (E) if the log similarity is less than the log similarity threshold and the historical super-alarm log which is last time for similarity comparison is the last historical super-alarm log, determining the current alarm log as a super-alarm log.

[0020] Further, obtaining a risk level attribute of the current alarm log based on an attack type attribute in the attribute sextuple of the current alarm log, comprises:

[0021] mapping the attack type attribute in the attribute sextuple of the current alarm log to a network attack severity corresponding to the current alarm log based on the attack type attribute in the attribute sextuple of the alarm log and a mapping relationship between the alarm log and the network attack severity;

[0022] mapping the network attack severity corresponding to the current alarm log to the risk level attribute of the current alarm log based on a mapping relationship between the network attack severity corresponding to the alarm log and the risk level of the alarm log.

[0023] Further, the obtaining a log similarity between the current alarm log and the historical super-alarm log by using the similarity of each target attribute, comprises:

[0024] performing average weighting processing on the similarity of all target attributes to obtain the log similarity between the current alarm log and the historical super-alarm log.

[0025] Further, the log set formed by arranging the super-alarm logs and the historical super-alarm logs is divided by using a sliding time window to obtain a plurality of super-alarm log sets associated with network attack scenes, including:

[0026] The super-alarm logs and the historical super-alarm logs are arranged in time sequence based on the timestamp attribute in the attribute seven-tuple of the super-alarm logs and the timestamp attribute in the attribute seven-tuple of the historical super-alarm logs, to obtain a log set formed by a plurality of arranged super-alarm logs, and the plurality of super-alarm logs are divided by using a sliding time window based on the timestamp attribute in the attribute seven-tuple of the plurality of super-alarm logs, to obtain a plurality of super-alarm log sets associated with network attack scenes.

[0027] Further, the timestamp attribute comparison is performed on each initial candidate attack scene sequence to obtain a candidate attack scene sequence, including:

[0028] (a) For each initial candidate attack scene sequence, the time difference value between the timestamp attribute in the attribute seven-tuple of the last super-alarm log included in the initial candidate attack scene sequence and the timestamp attribute in the attribute seven-tuple of the first super-alarm log included in the next initial candidate attack scene sequence of the initial candidate attack scene sequence is compared;

[0029] (b) If the time difference value is less than a preset interval threshold, the first super-alarm log included in the next initial candidate attack scene sequence of the initial candidate attack scene sequence is divided into the last position in the initial candidate attack scene sequence, and step (a) is performed again;

[0030] (c) If the time difference value is greater than or equal to the preset interval threshold, the initial candidate attack scene sequence is determined as a candidate attack scene sequence.

[0031] Further, each candidate attack scene sequence is divided by using the super-alarm log with the highest risk level attribute as a division point to obtain a candidate attack scene sub-sequence, including:

[0032] Each candidate attack scene sequence is divided by using the super-alarm log with the highest risk level attribute as a division point to obtain a plurality of divided candidate attack scene sequences, and the divided candidate attack scene sequence containing all types of risk level attributes is extracted and determined as a candidate attack scene sub-sequence.

[0033] In a second aspect, the embodiments of the present application further provide a network attack scene reconstruction device based on alarm log correlation, and the reconstruction device comprises:

[0034] The extraction module extracts target attributes in a current alarm log generated in the process of detecting a network attack, to obtain an attribute six-tuple of the current alarm log.

[0035] The log determination module determines a super alarm log based on a risk level attribute of the current alarm log and the target attributes in the attribute six-tuple.

[0036] The initial division module divides a log set formed by arranging the super alarm log and historical super alarm logs by using a sliding time window, to obtain a plurality of super alarm log sets associated with network attack scenes, and determines each super alarm log set as a corresponding initial candidate attack scene sequence.

[0037] The dynamic division module compares timestamp attributes for each initial candidate attack scene sequence, to obtain a candidate attack scene sequence.

[0038] The segmentation module segments each candidate attack scene sequence by using a super alarm log with a highest risk level attribute as a segmentation point, to obtain a candidate attack scene sub-sequence.

[0039] The generation module extracts an attack type attribute and a destination port attribute from an attribute seven-tuple of each super alarm log included in each candidate attack scene sub-sequence, combines the attack type attribute and the destination port attribute, to obtain a plurality of key alarm logs, and arranges the plurality of key alarm logs in an order of each super alarm log of the corresponding candidate attack scene sub-sequence, to obtain a candidate attack scene key sequence.

[0040] The construction module inputs all candidate attack scene key sequences to a preset probability model, so that the preset probability model takes a key alarm log with a highest risk level in each candidate attack scene key sequence as an initial attack state, outputs an attack scene sequence corresponding to the key alarm log with the highest risk level, determines the attack scene sequence corresponding to the key alarm log with the highest risk level as a network attack path, and constructs a network attack path model based on the network attack path.

[0041] The reconstruction module merges network attack paths with a last key alarm log in the network attack path model, to obtain a plurality of reconstructed network attack scenes.

[0042] In a third aspect, an electronic device is provided, including a processor, a memory and a bus, the memory stores machine readable instructions executable by the processor, when the electronic device is running, the processor and the memory communicate through the bus, and the machine readable instructions are executed by the processor to perform the steps of the network attack scene reconstruction method based on alarm log correlation described in the first aspect or any possible implementation manner of the first aspect.

[0043] In a fourth aspect, the embodiments of the present application further provide a computer readable storage medium, which stores a computer program. When the computer program is run by a processor, the steps of the X described in the first aspect or any possible implementation manner of the first aspect are executed.

[0044] The method and device for reconstructing a network attack scene based on alarm log correlation provided by the embodiments of the present application first extract target attributes from current alarm logs generated by detecting a network attack to form attribute six-tuples, and determine super alarm logs in combination with risk level attributes; then, a sliding time window is used to divide a set composed of the super alarm logs and historical super alarm logs to obtain an initial candidate attack scene sequence, and a candidate attack scene sequence is screened out through timestamp comparison; subsequently, a super alarm log with the highest risk level is taken as a split point to obtain a candidate attack scene sub-sequence, attack type and destination port attributes are extracted from attribute seven-tuples of the super alarm logs of the sub-sequence to combine into key alarm logs and sort, and a candidate attack scene key sequence is formed; then, the key sequences are input into a preset probability model, a key alarm log with the highest risk level is taken as an initial state to output an attack scene sequence, and a network attack path is determined and a network attack path model is constructed; finally, network attack paths with the same last key alarm log in the model are merged, and multiple network attack scenes are reconstructed.

[0045] In this way, the dependence on prior knowledge is reduced, the additional workload of security operators caused by data labeling work is avoided, and the artificial maintenance cost of the system is effectively reduced; meanwhile, key alarms with low occurrence frequency but serious harm can be accurately captured and deeply associated and analyzed, so that attack scenes are reconstructed from massive alarm logs, the accuracy of threat detection is improved, the comprehensiveness of detection is enhanced, and more reliable security is provided for the system.

[0046] In order to make the above objectives, characteristics and advantages of the present application more apparent, clear and easy to understand, the following preferred embodiments are specifically described below, and the accompanying drawings are referred to, and the detailed description is as follows. BRIEF DESCRIPTION OF DRAWINGS

[0047] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments. It should be understood that the following drawings only show some of the embodiments of the present application, and therefore should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0048] Figure 1Fig. 1 shows a flowchart of a method for reconstructing a network attack scenario based on the correlation of alarm logs according to an embodiment of the present application;

[0049] Figure 2 Fig. 2 shows a flowchart of a method for reconstructing a network attack scenario based on the correlation of alarm logs according to an embodiment of the present application;

[0050] Figure 3 Fig. 3 shows a flowchart of a method for reconstructing a network attack scenario based on the correlation of alarm logs according to an embodiment of the present application;

[0051] Figure 4 Fig. 4 shows a flowchart of a method for reconstructing a network attack scenario based on the correlation of alarm logs according to an embodiment of the present application;

[0052] Figure 5 Fig. 5 shows a flowchart of a method for reconstructing a network attack scenario based on the correlation of alarm logs according to an embodiment of the present application;

[0053] Figure 6 Fig. 6 shows a flowchart of a method for reconstructing a network attack scenario based on the correlation of alarm logs according to an embodiment of the present application Figure Six ;

[0054] Figure 7 Fig. 7 shows a structural schematic diagram of a device for reconstructing a network attack scenario based on the correlation of alarm logs according to an embodiment of the present application;

[0055] Figure 8 Fig. 8 shows a structural schematic diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0056] To make the objectives, technical schemes and advantages of the embodiments of the present application clearer, the technical schemes in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of illustration and description, and are not used to limit the protection scope of the present application. In addition, it should be understood that the schematic drawings are not drawn according to the actual proportions. The flowcharts used in the present application show the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowcharts can not be implemented in sequence, and the steps without logical contextual relationship can be reversed in sequence or implemented simultaneously. In addition, one or more other operations can be added to the flowcharts or one or more operations can be removed from the flowcharts under the guidance of the content of the present application.

[0057] In addition, the described embodiments are only some, but not all, of the embodiments of the present application. The components of the embodiments of the present application described and shown in the accompanying drawings can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the claimed present application, but only represents selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0058] The method, device, electronic equipment or computer readable storage medium of the embodiments of the present application can be applied to any scene requiring alarm log association, and the embodiments of the present application do not limit the specific application scene, and any scheme using the reconstruction method and device of alarm log provided by the embodiments of the present application is within the protection scope of the present application.

[0059] It is worth noting that in recent years, the Internet industry has developed rapidly, the complexity and risk of network space continue to increase, and network attack means emerge in an endless stream. Intrusion detection system (IDS) has become an important defense line to protect private data and maintain network security, but there are many problems. In order to detect malicious activities as much as possible, IDS will mark suspicious events in a complex network environment, generate a large amount of alarms, and most of them are false positives. At the same time, IDS lacks proper alarm priority classification and ordering, so that all alarms are considered equally important, leading to alarm fatigue of security operators, ignoring real security events and key alarms. In addition, IDS lacks correlation analysis of the whole attack chain. Specifically, while multi-stage attack behavior of advanced attackers is prevalent, IDS still presents alarm logs based on single events, and data is isolated, making it difficult to discover multi-dimensional attack behavior. Existing alarm correlation technologies mainly fall into two categories: alarm log correlation technology based on prior knowledge and alarm log correlation technology based on statistical features. However, the alarm log correlation technology based on prior knowledge needs to rely on a large amount of expert experience to build a causal relationship knowledge base, and also needs manual screening of prior rules, which not only has a large workload and is difficult to maintain, but also the effect is too dependent on existing experience, making it difficult to mine new attack patterns; the alarm log correlation technology based on statistical features relies on frequent item sets to establish correlation rules, without risk level distinction for alarms of different attack behaviors, resulting in low correlation accuracy and inability to correlate alarms with low frequency, so that the reconstructed attack scene lacks key nodes. Therefore, how to quickly identify the intentions of attackers from a large number of alarms and restore the complete attack scene has become a problem to be solved.

[0060] To solve the above problems, the embodiment of the present application provides a network attack scene reconstruction method and device based on alarm log correlation, which reduces the dependence on prior knowledge, avoids the additional workload of security operators due to data labeling work, and effectively reduces the artificial maintenance cost of the system; meanwhile, it can accurately capture and deeply correlate the key alarms with low occurrence frequency but serious harm, so as to reconstruct the attack scene from the massive alarm logs, which not only improves the accuracy of threat detection, but also enhances the comprehensiveness of detection, and provides more reliable protection for system security.

[0061] In order to make the present application be understood, the technical solutions provided by the present application are described in detail below in combination with specific embodiments.

[0062] Please refer to Figure 1 , Figure 1 The flowchart of the network attack scene reconstruction method based on alarm log correlation provided by the embodiment of the present application is shown in FIG. 1.

[0063] As shown in FIG. 2, the reconstruction method of the alarm log provided by the embodiment of the present application includes the following steps: Figure 1

[0064] Step S101, extracting the target attributes in the current alarm log generated in the process of detecting network attacks, to obtain the attribute six-tuple of the current alarm log.

[0065] In the embodiment of the present application, the alarm log is the information recorded when malicious activities are found in the process of network detection. The target attributes include at least one of the following: timestamp, source IP address, destination IP address, source port, destination port and attack type. In the present application, the network is detected by an intrusion detection system.

[0066] Here, the current alarm log can be standardized by the Intrusion Detection Message Exchange Format (IDMEF) standard to comprehensively analyze the massive alarm logs generated by multiple security devices.

[0067] After step S101, the attribute six-tuple of the current alarm log is subjected to redundancy elimination. Specifically, if the attributes in the attribute six-tuple of the current alarm log are incomplete, the current alarm log is filtered out; if the attributes in the attribute six-tuple of the current alarm log are complete, the current alarm log and the alarm log with the same source IP address, destination IP address, source port, destination port and attack signature attribute within 1 second interval of the current alarm log are preliminarily aggregated into one alarm log as the current alarm log.

[0068] Step S102, determining a super alarm log based on the risk level attribute of the current alarm log and the target attributes in the attribute six-tuple. ​

[0069] Here, the risk level attribute is added to the existing attribute sextuple as an extended attribute. By marking the risk level of different attack behaviors, the priority processing of the high-risk alarm log is realized, and a large number of irrelevant alarm logs are avoided to flood the real security events worth paying attention to.

[0070] The following will be combined Figure 2 to illustrate how to determine the super alarm log based on the risk level attribute of the current alarm log and the target attribute in the attribute sextuple.

[0071] Please refer to Figure 2 , Figure 2 the second flowchart of the network attack scene reconstruction method based on the correlation of the alarm log provided by the embodiment of the present application.

[0072] As Figure 2 indicated in the description, regarding step S102, in specific implementation, as an example, the following steps can be included:

[0073] Step S1021, based on the attack type attribute in the attribute sextuple of the current alarm log, the risk level attribute of the current alarm log is obtained, so as to add the risk level attribute to the attribute sextuple of the current alarm log to obtain the attribute septuple of the current alarm log.

[0074] The following will be combined Figure 3 to illustrate how to determine the super alarm log based on the risk level attribute of the current alarm log and the target attribute in the attribute sextuple.

[0075] Please refer to Figure 3 , Figure 3 the third flowchart of the network attack scene reconstruction method based on the correlation of the alarm log provided by the embodiment of the present application.

[0076] As Figure 3 indicated in the description, regarding step S1021, based on the attack type attribute in the attribute sextuple of the current alarm log, the risk level attribute of the current alarm log is obtained, in specific implementation, as an example, the following steps can be included:

[0077] Regarding step S10211, based on the attack type attribute in the attribute sextuple of the alarm log and the mapping relationship between the alarm log and the network attack severity, the attack type attribute in the attribute sextuple of the current alarm log and the mapping relationship between the current alarm log and the network attack severity.

[0078] In this step, the attack type attribute in the attribute sextuple of the alarm log is mapped to the network attack severity corresponding to the alarm log in the Common Attack Pattern Enumeration and Classification (CAPEC) framework. Here, the CAPEC framework divides the network attack severity into three risk levels: low risk, medium risk, and high risk.

[0079] As an example, the attack type attribute "Host Discovery" in the attribute sextuple of the alarm log is mapped to the network attack severity "CAPEC-292" corresponding to the alarm log in the CAPEC framework.

[0080] In step S10212, based on the mapping relationship between the network attack severity corresponding to the alarm log and the risk level of the alarm log, the network attack severity corresponding to the current alarm log is mapped to the risk level attribute of the current alarm log.

[0081] Following the above example, the network attack severity "CAPEC-292" corresponding to the current alarm log is mapped to the risk level attribute "Low" of the current alarm log.

[0082] Referring back to Figure 2 , in step S1022, the target attributes in the attribute septuple of the current alarm log and the corresponding target attributes in the historical super-alarm log are respectively compared in similarity, and the log similarity between the current alarm log and the historical super-alarm log is obtained using the similarity of each target attribute.

[0083] Here, the target attributes in the attribute septuple of the current alarm log and the corresponding target attributes in the historical super-alarm log are respectively compared in similarity to obtain the IP address similarity, the source port similarity, the destination port similarity, the attack type similarity, and the time similarity.

[0084] In the embodiments of the present application, the specific calculation method of the attack type similarity is defined as follows: if the source IP address and the destination IP address in the attribute septuple of the current alarm log and the historical super-alarm log are the same, the IP address similarity between the current alarm log and the historical super-alarm log is 1, and the current alarm log and the historical super-alarm log can be aggregated into a super-alarm; if the source IP address and the destination IP address in the attribute septuple of the current alarm log and the historical super-alarm log are the same, the IP address similarity between the current alarm log and the historical super-alarm log is 0, and the current alarm log and the historical super-alarm log cannot be aggregated into a super-alarm.

[0085] In the embodiments of the present application, the source port similarity is specifically calculated by the following method: the ports are divided into three categories: general service ports, common ports and other ports, a port similarity tree is constructed, and the source port similarity and the destination port similarity can be calculated by formula (1) as an example.

[0086]

[0087] wherein S port is the similarity between the port of the current alarm log and the port of the historical super alarm log, ra i.port represents the port of the current alarm log, ra j.port represents the port of the historical super alarm log, l(ra i.port , ra j.port ) represents the step length of the common parent node on the port similarity tree between the port of the current alarm log and the port of the historical super alarm log. As an example, the step length of the common parent node is 1 for the port with a port number between 1 and 80, and the step length of the common parent node is 2 for the port with a port number between 1 and 1024. Wherein the source port similarity is inversely proportional to the distance of the source port to the parent node, and the destination port similarity is inversely proportional to the distance of the destination port to the parent node.

[0088] In the embodiments of the present application, the attack type similarity is specifically calculated by the following method: if the attack type in the attribute seven tuple in the current alarm log and the attack type in the attribute seven tuple in the historical super alarm log are the same, the attack type similarity between the current alarm log and the historical super alarm log is 1, and the current alarm log and the historical super alarm log can be aggregated into a super alarm log; if the attack type in the attribute seven tuple in the current alarm log and the attack type in the attribute seven tuple in the historical super alarm log are not the same, the attack type similarity between the current alarm log and the historical super alarm log is 0, and the current alarm log and the initial super alarm log cannot be aggregated into a super alarm log.

[0089] In the embodiments of the present application, the time similarity is specifically calculated by the following method: if the difference between the timestamp in the attribute seven tuple in the current alarm log and the timestamp in the attribute seven tuple in the historical super alarm log is within a preset time range, the time similarity between the current alarm log and the historical super alarm log is 1, and the current alarm log and the historical super alarm log can be aggregated into a super alarm log; if the difference between the timestamp in the attribute seven tuple in the current alarm log and the timestamp in the attribute seven tuple in the historical super alarm log is not within the preset time range, the time similarity between the current alarm log and the historical super alarm log is 0, and the current alarm log and the historical super alarm log cannot be aggregated into a super alarm log.

[0090] In the embodiments of the present application, the similarities of all target attributes are subjected to average weighting processing to obtain the log similarity between the current alarm log and the historical super alarm log. As an example, the log similarity between the current alarm log and the historical super alarm log can be calculated by formula (2).

[0091]

[0092] wherein, ra i represents the current alarm log, ra j represents the historical super alarm log, S(ra i , ra j represents the log similarity between the current alarm log and the historical super alarm log, s(ra ik , ra jk represents the similarity of the kth attribute between the current alarm log and the historical super alarm log, w k represents the weight of the kth attribute in the overall similarity. Here, since the source IP address, the destination IP address, the attack type and the timestamp cannot be aggregated if they are not the same, only the destination port and the source port need to be weighted. According to actual experience, the weights of the source port similarity and the destination port similarity are allocated. As an example, the weight of the source port similarity is 0.4 and the weight of the destination port similarity is 0.6. The weights can also be allocated according to other actual experience, and the allocated weights are not limited herein.

[0093] Step S1023, if the log similarity is greater than the log similarity threshold, the current alarm log and the historical super alarm log which is subjected to the last similarity comparison are aggregated to obtain a super alarm log.

[0094] Step S1024, if the log similarity is less than or equal to the log similarity threshold and the historical super alarm log which is subjected to the last similarity comparison is not the last historical super alarm log, the corresponding target attributes in the current alarm log and the previous historical super alarm log of the historical super alarm log are subjected to similarity comparison respectively, and the log similarity between the current alarm log and the previous historical super alarm log is obtained by using the similarity of each target attribute, and the execution of step S1023 is returned.

[0095] Step S1025, if the log similarity is less than the log similarity threshold and the historical super alarm log which is subjected to the last similarity comparison is the last historical super alarm log, the current alarm log is determined as a super alarm log.

[0096] Again referring to Figure 1S103, the log set formed by the super-alarm log and the historical super-alarm log is divided by using a sliding time window to obtain a plurality of super-alarm log sets associated with the network attack scene, and each super-alarm log set is determined as a corresponding initial candidate attack scene sequence.

[0097] The method for reconstructing a network attack scene based on alarm log correlation provided in the embodiments of the present application will be described below in combination with Figure 4 the method for reconstructing a network attack scene based on alarm log correlation provided in the embodiments of the present application.

[0098] Please refer to Figure 4 , Figure 4 FIG. 4 for a flowchart of the method for reconstructing a network attack scene based on alarm log correlation provided in the embodiments of the present application.

[0099] As shown in Figure 4 , regarding step S103, in specific implementation, as an example, the following steps can be included:

[0100] S1031, based on the timestamp attribute in the attribute seven-tuple of the super-alarm log and the timestamp attribute in the attribute seven-tuple of the historical super-alarm log, the super-alarm log and the historical super-alarm log are arranged in time sequence to obtain a log set formed by a plurality of arranged super-alarm logs.

[0101] S1032, based on the timestamp attribute in the attribute seven-tuple of the plurality of super-alarm logs, the plurality of super-alarm logs are divided by using a sliding time window to obtain a plurality of super-alarm log sets associated with the network attack scene.

[0102] Here, as an example, the sliding time window is 1 hour.

[0103] Please refer to Figure 1 , step S104, the timestamp attribute comparison is performed on each initial candidate attack scene sequence to obtain a candidate attack scene sequence.

[0104] The method for reconstructing a network attack scene based on alarm log correlation provided in the embodiments of the present application will be described below in combination with Figure 5 the method for reconstructing a network attack scene based on alarm log correlation provided in the embodiments of the present application.

[0105] Please refer to Figure 5 , Figure 5 FIG. 5 for a flowchart of the method for reconstructing a network attack scene based on alarm log correlation provided in the embodiments of the present application.

[0106] As shown in Figure 5 , regarding step S104, in specific implementation, as an example, the following steps can be included:

[0107] Step S1041, for each initial candidate attack scenario sequence, comparing the time difference value between the time stamp attribute in the attribute seven tuple of the last super alarm log included in the initial candidate attack scenario sequence and the time stamp attribute in the attribute seven tuple of the first super alarm log included in the next initial candidate attack scenario sequence of the initial candidate attack scenario sequence.

[0108] Step S1042, if the time difference value is less than the preset interval threshold, dividing the first super alarm log included in the next initial candidate attack scenario sequence of the initial candidate attack scenario sequence to the last position in the initial candidate attack scenario sequence, and returning to execute step S1041.

[0109] Here, as an example, the preset interval threshold is 1 minute.

[0110] If the time difference value is less than the preset interval threshold, it is considered that the last super alarm log included in the initial candidate attack scenario sequence may belong to the same attack scenario sequence, the initial candidate attack scenario sequence is expanded, the first super alarm log included in the next initial candidate attack scenario sequence of the initial candidate attack scenario sequence is divided into the initial candidate attack scenario sequence, the effect of sliding time window dynamic self-adaptive alarm log stream speed is realized, and the attack chain breaking problem caused by the fact that the sliding time window cannot adapt to the burstiness of the super alarm log is avoided.

[0111] Step S1043, if the time difference value is greater than or equal to the preset interval threshold, determining the initial candidate attack scenario sequence as a candidate attack scenario sequence.

[0112] Again referring to Figure 1 , step S105, taking the super alarm log with the highest risk level attribute as a cutting point, cutting each candidate attack scenario sequence to obtain a candidate attack scenario sub-sequence.

[0113] The following will be described in conjunction with Figure 6 to illustrate taking the super alarm log with the highest risk level attribute as a cutting point, cutting each candidate attack scenario sequence to obtain a candidate attack scenario sub-sequence.

[0114] Please refer to Figure 6 , Figure 6 is a flowchart of a network attack scenario reconstruction method based on alarm log correlation provided by the embodiment of the application.

[0115] As shown in Figure 6 , regarding step S105, in specific implementation, as an example, the following steps can be included:

[0116] Step S1051, split each candidate attack scene sequence with the super alarm log with the highest risk level attribute as the split point to obtain multiple split candidate attack scene sequences.

[0117] Here, the super alarm log with the highest risk level attribute is marked, and each candidate attack scene sequence is split.

[0118] Step S1052, determine the split candidate attack scene sequence containing all types of risk level attributes extracted as a candidate attack scene sub-sequence.

[0119] Here, if a split candidate attack scene sequence meets the following conditions: first, the pre-sequence super alarm log of the split candidate attack scene sequence is a low or medium risk level log; second, the super alarm log at the end of the split candidate attack scene sequence is a high risk level log, then the split candidate attack scene sequence is divided into a candidate attack scene sub-sequence.

[0120] In the already divided candidate attack scene sequence, continue to divide the attack scene sub-sequence, highlight the super alarm log with low occurrence frequency but high hazard, and divide the sub-sequence based on this as the benchmark. If a high risk level super alarm log appears, split the candidate attack scene sequence at this point. This processing method can effectively avoid the problem of alarm fatigue caused by a large number of irrelevant alarm logs, and at the same time, focus on high risk level super alarm logs without discarding low risk level super alarm logs to help reconstruct the complete attack scene.

[0121] Again refer to Figure 1 , step S106, for each candidate attack scene sub-sequence, combine the attack type attribute and the destination port attribute from the attribute seven-tuple of each super alarm log included in the candidate attack scene sub-sequence to obtain multiple key alarm logs, and arrange the multiple key alarm logs in the order of each super alarm log corresponding to the candidate attack scene sub-sequence to obtain a candidate attack scene key sequence.

[0122] Step S107, input all candidate attack scene key sequences into a preset probability model, so that the preset probability model takes the highest risk level key alarm log in each candidate attack scene key sequence as the initial attack state, outputs the attack scene sequence corresponding to each highest risk level key alarm log, and determines the attack scene sequence corresponding to the highest risk level key alarm log as the network attack path. Based on the network attack path, a network attack path model is constructed.

[0123] Herein, in the present application, the preset probability model is a probabilistic deterministic finite automaton model as an example. The probabilistic deterministic finite automaton is used to associate the scattered and isolated key alarm logs, restore the network attack path of the attacker, reconstruct the complete network attack scene, and help the security operator analyze the real intention of the attacker.

[0124] Wherein, before inputting all candidate attack scene key sequences into the preset probability model, the number of symbols and the number of states of the probabilistic deterministic finite automaton are both set to 5, all candidate attack scene key sequences are input into the initial preset probability model for unsupervised training, and a trained preset probability model and a corresponding state transition matrix are obtained. All candidate attack scene key sequences are input into the trained preset probability model, the preset probability model predicts the state transition sequence with the maximum possibility from the initial attack state to the target attack state, the state transition sequence with the maximum possibility from the initial attack state to the target attack state is determined as the attack scene sequence corresponding to the key alarm log of the highest risk level, and the key alarm log related to the key alarm log of the highest risk level is obtained.

[0125] Step S107, merging the network attack paths of the last key alarm log in the network attack path model to obtain a reconstructed multiple network attack scenes.

[0126] Here, the common entities in the fusion network attack path are implemented to realize attack scene reconstruction and restoration.

[0127] The network attack scene reconstruction method based on alarm log correlation provided by the embodiments of the present application avoids the additional workload of the security operator caused by data annotation work, thereby effectively reducing the artificial maintenance cost of the system; at the same time, it can accurately capture and deeply associate the key alarms with low occurrence frequency but serious harm, thereby reconstructing the attack scene from the massive alarm logs, not only improving the accuracy of threat detection, but also enhancing the comprehensiveness of detection, providing more reliable protection for system security.

[0128] Based on the same application concept, the network attack scene reconstruction device based on alarm log correlation corresponding to the network attack scene reconstruction method based on alarm log correlation provided by the above-mentioned embodiments is also provided in the embodiments of the present application. Since the principle of solving problems in the device in the embodiments of the present application is similar to the network attack scene reconstruction method based on alarm log correlation of the above-mentioned embodiments of the present application, the implementation of the device can be referred to the implementation of the method, and the repeated parts will not be described here.

[0129] Please refer to Figure 7 , Figure 7A structural schematic diagram of a network attack scene reconstruction device based on alarm log correlation provided by an embodiment of the present application.

[0130] As shown in Figure 7 The network attack scene reconstruction device 210 based on alarm log correlation provided by an embodiment of the present application comprises:

[0131] The extraction module 211 extracts target attributes in the current alarm log generated in the process of detecting network attacks to obtain an attribute six-tuple of the current alarm log.

[0132] The log determination module 212 determines a super alarm log based on the risk level attribute of the current alarm log and the target attributes in the attribute six-tuple.

[0133] The initial division module 213 divides a log set formed by arranging the super alarm log and historical super alarm logs using a sliding time window to obtain a plurality of super alarm log sets associated with network attack scenes, and determines each super alarm log set as a corresponding initial candidate attack scene sequence.

[0134] The dynamic division module 214 compares the timestamp attributes of each initial candidate attack scene sequence to obtain a candidate attack scene sequence.

[0135] The segmentation module 215 segments each candidate attack scene sequence using the super alarm log with the highest risk level attribute as a segmentation point to obtain a candidate attack scene sub-sequence.

[0136] The generation module 216 extracts and combines the attack type attribute and the destination port attribute from the attribute seven-tuple of each super alarm log included in each candidate attack scene sub-sequence to obtain a plurality of key alarm logs, and arranges the plurality of key alarm logs in the order of each super alarm log corresponding to the candidate attack scene sub-sequence to obtain a candidate attack scene key sequence.

[0137] The construction module 217 inputs all candidate attack scene key sequences into a preset probability model, so that the preset probability model takes the key alarm log with the highest risk level in each candidate attack scene key sequence as an initial attack state, outputs an attack scene sequence corresponding to each key alarm log with the highest risk level, and determines the attack scene sequence corresponding to the key alarm log with the highest risk level as a network attack path, and constructs a network attack path model based on the network attack path.

[0138] The reconstruction module 218 merges network attack paths in the network attack path model that have the same last key alarm log to obtain a plurality of reconstructed network attack scenes.

[0139] Preferably, the log determination module 212 is specifically configured to:

[0140] (A) obtain a risk level attribute of the current alarm log based on the attack type attribute in the attribute sextuple of the current alarm log, so as to add the risk level attribute to the attribute sextuple of the current alarm log to obtain an attribute septuple of the current alarm log;

[0141] (B) respectively compare the target attributes in the attribute septuple of the current alarm log with corresponding target attributes in the historical super-alarm log, and obtain a log similarity between the current alarm log and the historical super-alarm log by using the similarity of each target attribute;

[0142] (C) if the log similarity is greater than a log similarity threshold, aggregate the current alarm log and the historical super-alarm log which is compared with the current alarm log last time to obtain a super-alarm log;

[0143] (D) if the log similarity is less than or equal to the log similarity threshold and the historical super-alarm log which is compared with the current alarm log last time is not the last historical super-alarm log, respectively compare the target attributes in the current alarm log with corresponding target attributes in a previous historical super-alarm log of the historical super-alarm log, and obtain a log similarity between the current alarm log and the previous historical super-alarm log by using the similarity of each target attribute, and return to step (C);

[0144] (E) if the log similarity is less than the log similarity threshold and the historical super-alarm log which is compared with the current alarm log last time is the last historical super-alarm log, determine the current alarm log as a super-alarm log.

[0145] Preferably, the log determination module 212 is specifically configured to, when obtaining a risk level attribute of the current alarm log based on the attack type attribute in the attribute sextuple of the current alarm log:

[0146] map the attack type attribute in the attribute sextuple of the current alarm log to a network attack severity corresponding to the current alarm log based on a mapping relationship between the attack type attribute in the attribute sextuple of the alarm log and the network attack severity corresponding to the alarm log;

[0147] map the network attack severity corresponding to the current alarm log to the risk level attribute of the current alarm log based on a mapping relationship between the network attack severity corresponding to the alarm log and the risk level of the alarm log.

[0148] Preferably, the log determination module 212 is further configured to:

[0149] average the similarity of all target attributes to obtain the log similarity between the current alarm log and the historical super-alarm log.

[0150] Preferably, the initial division module 213 is further configured to:

[0151] arrange the super-alarm logs and the historical super-alarm logs in chronological order based on the timestamp attribute in the attribute seven-tuple of the super-alarm logs and the timestamp attribute in the attribute seven-tuple of the historical super-alarm logs to obtain a log set formed by the arranged super-alarm logs, and divide the super-alarm logs using a sliding time window based on the timestamp attribute in the attribute seven-tuple of the super-alarm logs to obtain a plurality of super-alarm log sets associated with network attack scenarios.

[0152] Preferably, the dynamic division module 214 is configured to:

[0153] (a) for each initial candidate attack scenario sequence, compare the time difference between the timestamp attribute in the attribute seven-tuple of the last super-alarm log included in the initial candidate attack scenario sequence and the timestamp attribute in the attribute seven-tuple of the first super-alarm log included in the next initial candidate attack scenario sequence of the initial candidate attack scenario sequence;

[0154] (b) if the time difference is less than a preset interval threshold, divide the first super-alarm log included in the next initial candidate attack scenario sequence of the initial candidate attack scenario sequence to the last position in the initial candidate attack scenario sequence, and return to step (a);

[0155] (c) if the time difference is greater than or equal to the preset interval threshold, determine the initial candidate attack scenario sequence as a candidate attack scenario sequence.

[0156] Preferably, the cutting module 215 is configured to:

[0157] cut each candidate attack scenario sequence with the super-alarm log with the highest risk level attribute as the cutting point to obtain a candidate attack scenario sub-sequence, including:

[0158] The super-alarm log with the highest risk level attribute is taken as a split point, each candidate attack scene sequence is split, a plurality of split candidate attack scene sequences are obtained, and the split candidate attack scene sequence containing all types of risk level attributes is extracted and determined as a candidate attack scene sub-sequence.

[0159] The device for reconstructing a network attack scene based on alarm log correlation provided by the embodiment of the application avoids the additional workload of security operators caused by data annotation, thereby effectively reducing the artificial maintenance cost of the system; meanwhile, the device can accurately capture and deeply correlate the key alarms with low occurrence frequency but serious harm, thereby reconstructing the attack scene from the massive alarm logs, improving the accuracy of threat detection, enhancing the comprehensiveness of detection, and providing more reliable protection for system security.

[0160] Please refer to Figure 8 , Figure 8 The structural schematic diagram of an electronic device provided by the embodiment of the application is shown in FIG. 1.

[0161] As shown in Figure 8 , the electronic device 300 includes a processor 310, a memory 320 and a bus 330.

[0162] The memory 320 stores machine readable instructions executable by the processor 310, when the electronic device 300 is running, the processor 310 and the memory 320 communicate through the bus 330, and the machine readable instructions executed by the processor 310 can execute the steps of the method for reconstructing a network attack scene based on alarm log correlation in the method embodiment shown in the above Figures 1-6 The specific implementation can be referred to the method embodiment, and will not be repeated here.

[0163] The embodiment of the application further provides a computer readable storage medium, the computer readable storage medium stores a computer program, and the computer program can execute the steps of the method for reconstructing a network attack scene based on alarm log correlation in the method embodiment shown in the above Figures 1-6 The specific implementation can be referred to the method embodiment, and will not be repeated here.

[0164] Those skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working process of the system and the device described above can refer to the corresponding process in the foregoing method embodiment, and will not be repeated here. In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are only schematic, for example, the division of the units is only a logical function division, and there can be another division manner in actual implementation, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some communication interfaces, devices or units, and can be electrical, mechanical or other forms.

[0165] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, i.e., they can be located in one place or distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0166] In addition, the functional units in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit.

[0167] If the functions are realized in the form of software function units and sold or used as independent products, they can be stored in a non-volatile computer readable storage medium executable by a processor. Based on this understanding, the technical solutions of the present application essentially or the parts that contribute to the prior art or the parts of the technical solutions can be embodied in the form of software products, and the computer software products are stored in a storage medium, including a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the embodiments of the present application. The foregoing storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk, and various program code storage media.

[0168] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for reconstructing a network attack scenario based on correlation of alarm logs, characterized in that, The reconstruction method comprises: extracting target attributes in a current alarm log generated in the process of detecting network attacks to obtain an attribute sextuple of the current alarm log; determining a super alarm log based on a risk level attribute of the current alarm log and the target attributes in the attribute sextuple; dividing a log set formed by arranging the super alarm log and historical super alarm logs using a sliding time window to obtain a plurality of super alarm log sets associated with network attack scenes, and determining each super alarm log set as a corresponding initial candidate attack scene sequence; performing timestamp attribute comparison on each initial candidate attack scene sequence to obtain a candidate attack scene sequence; splitting each candidate attack scene sequence with the super alarm log with the highest risk level attribute as a splitting point to obtain a candidate attack scene sub-sequence; for each candidate attack scene sub-sequence, extracting attack type attributes and destination port attributes from attribute septuples of each super alarm log included in the candidate attack scene sub-sequence to obtain a plurality of key alarm logs, and arranging the plurality of key alarm logs according to an order of each super alarm log of the corresponding candidate attack scene sub-sequence to obtain a candidate attack scene key sequence; inputting all candidate attack scene key sequences into a preset probability model, so that the preset probability model takes the key alarm log with the highest risk level in each candidate attack scene key sequence as an initial attack state, outputs an attack scene sequence corresponding to each key alarm log with the highest risk level, and determines the attack scene sequence corresponding to the key alarm log with the highest risk level as a network attack path, and constructs a network attack path model based on the network attack path; merging network attack paths in the network attack path model that have the same last key alarm log to obtain a plurality of reconstructed network attack scenes.

2. The reconstitution method of claim 1, wherein, The determination of the super alarm log based on the risk level attribute of the current alarm log and the target attributes in the attribute sextuple comprises: (A) obtaining the risk level attribute of the current alarm log based on the attack type attribute in the attribute sextuple of the current alarm log, and adding the risk level attribute to the attribute sextuple of the current alarm log to obtain an attribute septuple of the current alarm log; (B) comparing the target attributes in the attribute septuple of the current alarm log with corresponding target attributes in historical super alarm logs respectively, and obtaining a log similarity between the current alarm log and the historical super alarm log using the similarity of each target attribute; (C) if the log similarity is greater than a log similarity threshold, aggregating the current alarm log and the historical super alarm log that is last compared for similarity to obtain a super alarm log. (D) if the log similarity is less than or equal to the log similarity threshold and the last time similarity comparison is performed historical super-alarm log is not the last historical super-alarm log, then similarity comparison is performed between the corresponding target attributes in the current alarm log and the previous historical super-alarm log of the historical super-alarm log, respectively, the log similarity of the current alarm log and the previous historical super-alarm log is obtained by using the similarity of each target attribute, and step (C) is returned to be executed; (E) if the log similarity is less than the log similarity threshold and the last time similarity comparison is performed historical super-alarm log is the last historical super-alarm log, then the current alarm log is determined as a super-alarm log.

3. The reconstitution method of claim 2, wherein, Based on the attack type attribute in the attribute six tuple of the current alarm log, the risk level attribute of the current alarm log is obtained, including: Based on the attack type attribute in the attribute six tuple of the alarm log and the mapping relationship between the network attack severity corresponding to the alarm log, the attack type attribute in the attribute six tuple of the current alarm log is mapped to the network attack severity corresponding to the current alarm log; Based on the mapping relationship between the network attack severity corresponding to the alarm log and the risk level of the alarm log, the network attack severity corresponding to the current alarm log is mapped to the risk level attribute of the current alarm log.

4. The reconstitution method of claim 2, wherein, The log similarity of the current alarm log and the historical super-alarm log is obtained by using the similarity of each target attribute, including: The similarity of all target attributes is averaged and weighted to obtain the log similarity of the current alarm log and the historical super-alarm log.

5. The reconstitution method of claim 1, wherein, The log set formed by arranging the super-alarm log and the historical super-alarm log is divided by using the sliding time window to obtain a plurality of super-alarm log sets associated with the network attack scene, including: Based on the timestamp attribute in the attribute seven tuple of the super-alarm log and the timestamp attribute in the attribute seven tuple of the historical super-alarm log, the super-alarm log and the historical super-alarm log are arranged in time sequence to obtain a log set formed by arranging a plurality of super-alarm logs, and based on the timestamp attribute in the attribute seven tuple of the plurality of super-alarm logs, the plurality of super-alarm logs are divided by using the sliding time window to obtain a plurality of super-alarm log sets associated with the network attack scene.

6. The reconstitution method of claim 1, wherein, The timestamp attribute comparison is performed for each initial candidate attack scene sequence to obtain a candidate attack scene sequence, including: (a) for each initial candidate attack scene sequence, the time difference value between the timestamp attribute in the attribute seven tuple of the last super-alarm log included in the initial candidate attack scene sequence and the timestamp attribute in the attribute seven tuple of the first super-alarm log included in the next initial candidate attack scene sequence of the initial candidate attack scene sequence is compared; (b) if the time difference value is less than a preset interval threshold, the first super-alarm log included in the next initial candidate attack scene sequence of the initial candidate attack scene sequence is divided into the last position in the initial candidate attack scene sequence, and step (a) is returned to be executed; (c) if the time difference value is greater than or equal to a preset interval threshold, determining the initial candidate attack scene sequence as a candidate attack scene sequence.

7. The reconstitution method of claim 1, wherein, The super alarm log with the highest risk level attribute is taken as a segmentation point, and each candidate attack scene sequence is segmented to obtain a candidate attack scene sub-sequence. The super alarm log with the highest risk level attribute is taken as a segmentation point, and each candidate attack scene sequence is segmented to obtain a plurality of segmented candidate attack scene sequences, and the segmented candidate attack scene sequence extracted by containing all types of risk level attributes is determined as a candidate attack scene sub-sequence.

8. An apparatus for reconstructing a network attack scenario based on correlation of alert logs, the apparatus comprising: a correlation engine configured to correlate the alert logs; and a reconstruction engine configured to reconstruct the network attack scenario based on the correlated alert logs. The reconstruction device comprises: An extraction module extracts target attributes in a current alarm log generated in the process of detecting network attacks to obtain an attribute six-tuple of the current alarm log; A log determination module determines a super alarm log based on the risk level attribute of the current alarm log and the target attributes in the attribute six-tuple; An initial division module divides a log set formed by arranging the super alarm log and historical super alarm logs by using a sliding time window to obtain a plurality of super alarm log sets associated with network attack scenes, and determines each super alarm log set as a corresponding initial candidate attack scene sequence; A dynamic division module compares timestamp attributes for each initial candidate attack scene sequence to obtain a candidate attack scene sequence; A segmentation module takes the super alarm log with the highest risk level attribute as a segmentation point and segments each candidate attack scene sequence to obtain a candidate attack scene sub-sequence; A generation module extracts attack type attributes and destination port attributes from attribute seven-tuples of each super alarm log included in each candidate attack scene sub-sequence to obtain a plurality of key alarm logs, and arranges the plurality of key alarm logs in an order of each super alarm log corresponding to the candidate attack scene sub-sequence to obtain a candidate attack scene key sequence; A construction module inputs all candidate attack scene key sequences into a preset probability model, so that the preset probability model takes the key alarm log with the highest risk level in each candidate attack scene key sequence as an initial attack state, outputs an attack scene sequence corresponding to each key alarm log with the highest risk level, determines the attack scene sequence corresponding to the key alarm log with the highest risk level as a network attack path, and constructs a network attack path model based on the network attack path. A reconstruction module merges network attack paths with the same last key alarm log in the network attack path model to obtain a plurality of reconstructed network attack scenes.

9. An electronic device, comprising: The processor, the memory and the bus, the memory stores machine readable instructions executable by the processor, when the electronic device is running, the processor and the memory communicate through the bus, the machine readable instructions are executed by the processor to execute the steps of the network attack scene reconstruction method based on the alarm log correlation as claimed in any one of claims 1 to 7. The processor, the memory and the bus, the memory stores machine readable instructions executable by the processor, when the electronic device is running, the processor and the memory communicate through the bus, the machine readable instructions are executed by the processor to execute the steps of the network attack scene reconstruction method based on the alarm log correlation as claimed in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is run by the processor to execute the steps of the network attack scenario reconstruction method based on the correlation of the alarm logs according to any one of claims 1 to 7.

Images