A network attack research and judgment method, system, program product, device and medium

Abstract

The embodiment of the application provides a network attack research and judgment method, system, program product, device and medium, the system deploys multiple intelligent agents, and the method comprises the following steps: inputting an attack sample into an attack feature extraction intelligent agent, constructing an attack feature library based on the extracted attack features; inputting a network security log into a field extraction intelligent agent, and obtaining the extracted attack related fields; inputting the attack feature library and the attack related fields into an attack analysis module, obtaining attack analysis data of the attack analysis module based on the attack feature library on the attack related fields; inputting threat intelligence data, asset data and attack analysis data into a comprehensive analysis report intelligent agent, obtaining an analysis report, including attack results, attack severity, influence range and attack technology; inputting the analysis report into an attack disposal module, and obtaining an attack disposal plan. The attack research and judgment process is realized by using the intelligent agent, the analysis and judgment capability for the known attack is improved, the unknown attack behavior is identified, and the closed-loop protection measure is formed.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a network attack research and judgment method, system, program product, device and medium. BACKGROUND

[0002] With the rapid development of Internet technology, network applications have penetrated into people's daily life and enterprise operation, and have become a key component. However, with its popularity, network security problems have become increasingly serious. Attackers may cause sensitive information leakage, illegal access to server permissions, and even service interruption through SQL injection, remote code execution, file inclusion vulnerabilities and other means. In the face of these challenges, how to provide a more solid security line for enterprises and users, and timely respond to increasingly complex network threats, is a technical problem to be solved in the field. SUMMARY

[0003] The purpose of the embodiments of the present application is to provide a network attack research and judgment method, system, program product, device and medium, to realize the technical effect of forming a network security closed loop protection measure.

[0004] The first aspect of the embodiments of the present application provides a network attack research and judgment method, the method is applied to a network attack research and judgment system; the network attack research and judgment system is deployed with a plurality of intelligent agents; the method comprises:

[0005] inputting the obtained attack sample into an attack feature extraction intelligent agent, and constructing an attack feature library based on the extracted attack features;

[0006] inputting the obtained network security log into a field extraction intelligent agent, and obtaining the extracted attack related fields;

[0007] inputting the attack feature library and the attack related fields into an attack analysis module, obtaining attack analysis data of the attack analysis module based on the attack related fields and the attack feature library;

[0008] inputting threat intelligence data, asset data and the attack analysis data into a comprehensive analysis report intelligent agent, obtaining an output analysis report, the analysis report comprising one or more of attack results, attack severity, impact range and attack technology;

[0009] inputting the analysis report into an attack disposal module, and obtaining an output attack disposal plan.

[0010] In the implementation process, the agent is used to realize the whole-process automation of alarm analysis, attack behavior analysis, attack result evaluation, comprehensive report generation, treatment suggestion formulation and treatment rule creation, which can not only improve the analysis and judgment ability of known attacks, but also help to identify unknown attack behaviors, form a closed-loop protection measure, and thus provide a more solid security line for enterprises and users to timely respond to increasingly complex network threats.

[0011] Further, the attack feature extraction agent includes a pre-trained large language model; the attack feature extraction agent is input with the obtained attack sample, and an attack feature library is constructed based on the extracted attack features, including:

[0012] The attack sample is input into the attack feature extraction agent, so that the attack feature extraction agent extracts attack metadata from the attack sample, extracts field values of attack feature fields based on the attack feature fields preset according to the protocol to which the attack sample belongs, and extracts an attack vector from the attack metadata and the field values by using the large language model, to obtain an attack feature corresponding to each attack sample; wherein the attack feature includes a general field for recording the attack metadata, a protocol field for recording the field values, and the attack vector; the attack vector carries semantic information of the attack metadata and the field values;

[0013] An attack feature library including each attack feature is constructed.

[0014] In the implementation process, a general field, a protocol field and an attack vector are designed to form an attack feature for an attack sample. Through such classification design, the attack feature library can not only efficiently store attack features, but also provide detailed attack analysis and query capabilities, thereby better supporting security analysis and judgment and incident response. At the same time, through data structuring processing, the problem of low analysis efficiency caused by format difference can be reduced.

[0015] Further, the network security log includes an alarm log and a flow log; the attack-related field includes a suspected attack source IP field extracted from the alarm log; the attack feature library and the attack-related field are input into an attack analysis module, including:

[0016] If the suspected attack source IP field of the alarm log matches a preset whitelist rule, a first flow message corresponding to the alarm log is determined as non-attack flow from the flow log.

[0017] If the suspected attack source IP field of the alarm log does not match the whitelist rule, a second traffic message corresponding to the alarm log is determined from the traffic log, and the attack feature library and attack-related fields of the second traffic message are input into the attack analysis module.

[0018] In the implementation process, the suspected attack source IP field in the alarm log is matched with the whitelist rule to filter out the first traffic message and the second traffic message from the traffic log. The first traffic message does not need to continue attack analysis, thereby reducing the burden of network attack research and improving the research efficiency.

[0019] Further, the network security log includes a traffic log, the traffic log includes a request message and a response message; the attack analysis module includes an attack behavior analysis agent and an attack result analysis agent; the attack analysis data of the attack-related fields based on the attack feature library includes:

[0020] The attack feature library and the first attack-related field of the request message are input into the attack behavior analysis agent to obtain attack behavior analysis data of the attack behavior analysis agent based on the attack feature library and the first attack-related field;

[0021] The feature library and the second attack-related field of the response message are input into the attack result analysis agent to obtain attack result analysis data of the attack result analysis agent based on the attack feature library and the second attack-related field, and to obtain attack analysis data including the attack behavior analysis data and the attack result analysis data.

[0022] In the implementation process, the attack behavior analysis agent can receive and integrate multiple data sources, including structured alarm data and request messages. Through comprehensive analysis of multi-dimensional data, the attack behavior analysis agent can improve the comprehensiveness of attack behavior identification. The attack result analysis agent can effectively determine whether the attack is successfully executed by analyzing the protocol fields, general fields of the response message, and the correlation with attack features.

[0023] Further, the threat intelligence data, asset data, and attack analysis data are input into a comprehensive analysis report agent to obtain an output analysis report, including:

[0024] inputting the threat intelligence data, the asset data and the attack analysis data into a comprehensive analysis report agent, so that the comprehensive analysis report agent determines attack techniques and corresponding attack results based on the attack analysis data, matches attack IPs recorded in the attack-related fields with the threat intelligence data to obtain correlation evaluation results between the attack IPs and known attack sources, and determines attacked assets from the asset data, determines attack severity based on vulnerability data of the attacked assets and the correlation evaluation results, and obtains the analysis report.

[0025] Further, the attack handling module includes a handling suggestion generation agent and a handling rule generation agent; inputting the analysis report into the attack handling module to obtain an output attack handling plan, including:

[0026] inputting the analysis report into the handling suggestion generation agent to obtain an output attack response suggestion; wherein the attack response suggestion includes one or more of short-term handling suggestions, long-term handling suggestions, business recovery suggestions and security reinforcement suggestions;

[0027] inputting the analysis report into the handling rule generation agent to obtain an output attack handling rule; wherein the attack handling rule includes one or more of blacklist rules, whitelist rules, feature matching rules and behavior analysis rules respectively set for a plurality of different security devices.

[0028] In the above implementation process, the handling suggestion generation agent is used to generate customized handling suggestions instead of relying on fixed templates or manual analysis. The problem of mismatch between general handling suggestions and specific attack scenarios in traditional methods is solved, making the suggestions more accurate and more suitable for actual scenarios. The handling rule generation agent is used to generate security device rules adapted to specific attack scenarios, solving the problem of invalid rules or high false alarm rate caused by scenario mismatch in traditional rule generation methods, and significantly shortening the rule deployment cycle through dynamic rule generation.

[0029] The second aspect of the embodiments of the present application provides a network attack research and judgment system, the system includes:

[0030] An attack feature extraction agent is configured to extract attack features from the obtained attack samples and construct an attack feature library including the attack features.

[0031] A field extraction agent is configured to extract attack-related fields from the obtained network security logs.

[0032] An attack analysis module is configured to generate attack analysis data of the attack-related fields based on the attack feature library.

[0033] a comprehensive analysis report agent configured to generate an analysis report based on threat intelligence data, asset data, and the attack analysis data, the analysis report including one or more of attack results, attack severity, impact scope, attack techniques;

[0034] an attack handling module configured to generate an attack handling plan based on the analysis report.

[0035] A third aspect of the embodiments of the present application provides a computer program product, the computer program product comprising a computer program, the computer program being executed by a processor to implement the method of any of the first aspect.

[0036] A fourth aspect of the embodiments of the present application provides an electronic device, the electronic device comprising:

[0037] a processor;

[0038] a memory for storing processor-executable instructions;

[0039] When the processor invokes the executable instructions, the operations of the method of any of the first aspect are implemented.

[0040] A fifth aspect of the embodiments of the present application provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being executed by a processor to implement the steps of the method of any of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0041] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0042] Figure 1 a structural schematic diagram of a network attack research and judgment system provided by the embodiments of the present application;

[0043] Figure 2 a flowchart of a network attack research and judgment method provided by the embodiments of the present application;

[0044] Figure 3 a structural schematic diagram of an attack analysis module provided by the embodiments of the present application;

[0045] Figure 4 a structural schematic diagram of an attack handling module provided by the embodiments of the present application;

[0046] Figure 5 a structural schematic diagram of another network attack research and judgment system provided by the embodiments of the present application;

[0047] Figure 6 A hardware structure diagram of an electronic device is provided for an embodiment of the present application. DETAILED DESCRIPTION

[0048] The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application.

[0049] It should be noted that similar reference numerals and letters refer to similar items in the following drawings, and therefore, once an item is defined in one drawing, it need not be further defined and explained in subsequent drawings. Meanwhile, in the description of the present application, the terms “first”, “second”, and the like are only used for differentiation in description, and cannot be understood as indicating or implying relative importance.

[0050] Traditional security detection devices usually rely on known attack features for static detection and generate a large number of security alarms. In this case, the massive alarms will greatly increase the work burden of operation and maintenance personnel. Especially for complex attack events, operation and maintenance personnel may be difficult to effectively and quickly identify the real security threat from them due to insufficient or limited experience, especially when facing unknown threat attacks.

[0051] In addition, the traditional alarm analysis method usually relies on correlation analysis or application of machine learning algorithm on the alarms generated by the deployed security devices, but the analysis dimension is relatively limited, which may affect the comprehensiveness and accuracy of the analysis.

[0052] Furthermore, traditional threat detection mainly relies on security devices provided by manufacturers and their preset rule library, and identifies attacks through known threat feature library and signature matching. However, due to the differences between rule libraries of various manufacturers and the low efficiency of field standardization process, the overall detection accuracy and response efficiency are limited. In addition, the technical level of security operation personnel is high, and security operation personnel need to be familiar with different security devices to perform effective correlation query and analysis. Moreover, this method has limitations in dealing with new or unknown threats, and it is difficult to effectively analyze and judge the attack patterns that have not been recorded or newly appeared.

[0053] In order to effectively cope with these challenges, the embodiments of the present application design an automatic network attack analysis method and system based on large models, which utilizes the collaborative work of large models and agents to realize the full-process automation of alarm analysis, attack behavior analysis, attack result evaluation, comprehensive report generation, disposal suggestion formulation, and disposal rule creation. Not only can it improve the analysis and judgment ability of known attacks, but also help to identify unknown attack behaviors, form a closed-loop protection measure, and thus provide a more solid security line for enterprises and users to timely cope with the increasingly complex network threats.

[0054] The first aspect of the embodiment of the present application provides a network attack judgment method, which is applied to a network attack judgment system 100 as shown in Figure 1 The network attack judgment system 100 is deployed with multiple agents (Agent), for example, including but not limited to an attack feature extraction agent (Agent1) 110, a field extraction agent (Agent2) 120, an attack analysis module 130, a comprehensive analysis report agent (Agent5) 140 and an attack disposal module 150. Among them, the attack analysis module 130 includes multiple agents, and the attack disposal module 150 includes multiple agents, which will be described below.

[0055] The agent is deployed with one or more large models. The so-called large model refers to a machine learning model with large-scale parameters and complex computing structure, which is usually constructed by a deep neural network and has tens of billions or even hundreds of billions of parameters. These models learn complex patterns and features through training massive data, have stronger generalization ability, and can make accurate predictions on unseen data. Large models can provide core capabilities for agents, including but not limited to cognitive and generation capabilities, semantic understanding capabilities, multi-task generalization capabilities, etc. And the agent can extend the capability boundary of the large model. For example, the agent can give the large model action and interaction capabilities through integrated tool calls, sensor inputs, etc. The agent can also save historical interaction information through a knowledge base, a database or a vector storage to make up for the short context limitation of the large model. And the agent can coordinate multi-step tasks through a planning algorithm, call the large model to generate a plan and execute it.

[0056] Specifically, the network attack judgment method provided by the embodiment of the present application includes steps 210-250 as shown in Figure 2

[0057] Step 210: input the obtained attack sample into the attack feature extraction agent, and construct an attack feature library based on the extracted attack features.

[0058] ​Exemplarily, the attack feature extraction agent (Agent 1) 110 can collect various attack samples in multi-channel threat intelligence sources. For example, various attack samples can be collected by relying on public vulnerability libraries (such as CVE, Exploit-DB, etc.), security community sharing (including security projects on GitHub, forums, etc.), vulnerability analysis replication articles, and commercial vulnerability intelligence services, and the like, in combination with Python crawlers and manual sorting. The attack samples include, but are not limited to, proof of concept (PoC) attack samples, exploit (Exp) attack samples, and payload attack samples, and the like. The collected attack samples can be stored in text in a naming manner of “threat name + attack type”. The attack feature extraction agent (Agent 1) 110 can extract attack features from the obtained attack samples. Then, an attack feature library including all extracted attack features is constructed.

[0059] Step 220: input the obtained network security log into a field extraction agent, and obtain extracted attack-related fields.

[0060] Exemplarily, the network attack research and judgment system 100 can establish an API (Application Programming Interface) interface with a security operations center (SOC) and / or a situation awareness platform, and receive network security logs in real time through the API interface. The field extraction agent (Agent 2) 120 is an agent specially designed for network security log information extraction. The attack-related fields can be extracted from the network security log by using the field extraction agent (Agent 2) 120.

[0061] As an example, the field extraction agent (Agent2) 120 is deployed with a pre-trained language model. The pre-trained language model is, for example, a BGE (Beijing Academy of Artificial Intelligence General Embedding) model developed by the BAAI (Beijing Academy of Artificial Intelligence). The field extraction agent (Agent2) 120 can use the pre-trained language model to extract a plurality of attack-related fields from the network security log. The attack-related fields can include, but are not limited to, a timestamp, a source IP (Internet Protocol), a source port, a destination IP, a destination port, a risk level, a request method, an application protocol, an HTTP (HyperText Transfer Protocol) response code, an event type, an alarm type, an alarm category, a request line, a request header, a request body, a response line, a response header, a response body, a URL (Uniform Resource Locator), a host, a User-Agent, a content_type, an uplink packet number, a downlink packet number, an uplink byte number, a downlink byte number, an x_Forwarded_For, and the like.

[0062] After extracting the attack-related fields, the field extraction agent (Agent2) 120 can also clean and format the attack-related fields, such as removing irrelevant spaces, converting time formats, and the like, and finally output structured data (such as JSON) for subsequent processing and analysis.

[0063] Step 230: inputting the attack feature library and the attack-related fields into an attack analysis module to obtain attack analysis data of the attack analysis module based on the attack feature library and the attack-related fields.

[0064] By way of example, the attack analysis module 130 is a module specially designed for analyzing network attack behaviors and network attack results. It can receive the attack feature library generated by the attack feature extraction agent (Agent1) 110 and the attack-related fields extracted by the field extraction agent (Agent2) 120, and perform attack analysis on the attack-related fields based on the attack feature library to obtain analysis data. As an example, the attack analysis module 130 can compare the attack-related fields extracted from each network security log with the attack features recorded in the attack feature library for similarity, thereby analyzing the attack behavior and attack result of the network security log to obtain analysis data.

[0065] Step 240: inputting the threat intelligence data, asset data and the attack analysis data into a comprehensive analysis report agent to obtain an output analysis report, the analysis report including one or more of attack results, attack severity, impact range and attack technology.

[0066] Exemplarily, the comprehensive analysis report agent (Agent5) 140 is an agent designed for comprehensive analysis and generation of analysis reports, which can receive analysis data generated from the attack analysis module 130, and comprehensively analyze attack events in combination with asset data in the asset management database and threat intelligence data from the threat intelligence platform, so as to evaluate attack results, attack technology, impact range and severity, and generate a corresponding analysis report. The asset management database records asset data of various assets. The asset refers to a network security device, for example, including but not limited to a firewall, a switch, a router and the like. The asset data can include but is not limited to asset address, software name, version information, asset component vulnerability information and the like.

[0067] Step 250: inputting the analysis report into an attack disposal module to obtain an output attack disposal plan.

[0068] Exemplarily, the attack disposal module 150 is a module specially used for creating an attack disposal plan, which receives the analysis report generated from the comprehensive analysis report agent (Agent5) 140, and automatically generates an attack disposal plan according to the analysis report, so as to quickly respond to and prevent network attacks. The output attack disposal plan can be sent to an operation and maintenance personnel for reference when the operation and maintenance personnel responds to network attacks.

[0069] Compared with the related art in which attack features are mainly identified by relying on a rule base of a security detection type device, and attack features are not sufficiently extracted and compared by using threat intelligence sources, it is difficult to form a global perspective and achieve comprehensive threat detection. The embodiments of the present application adopt a multi-channel threat intelligence source to uniformly collect attack samples. Multi-channel intelligence integration improves threat coverage and reduces the problem of low analysis efficiency caused by intelligence redundancy, and realizes rapid identification of potential threats. Thus, it can be ensured that the network attack research and judgment system 100 can quickly adapt to new threat scenarios, thereby enhancing the response capability to zero-day vulnerabilities or unknown threats. The accuracy and speed of feature extraction are improved, and data consistency is ensured, which provides a basis for subsequent retrieval and comparison analysis.

[0070] In addition, in identifying attack fields, related technologies mostly extract limited attack fields through a pre-defined rule library, lack flexibility, and updating the rule library requires a lot of manual intervention. In the embodiment of the present application, the field extraction agent (Agent2) uses an intelligent system based on a pre-trained model, which can identify approximately attack-related fields, improving the comprehensiveness of field extraction to better cope with complex information or unknown threat scenarios. At the same time, related technologies mostly rely on manual or simple keyword matching to process alert data, making it difficult to effectively process unstructured or semi-structured logs. The present application can automatically parse and standardize diverse data formats, including unstructured text or log files in network security logs, and use intelligent parsing algorithms for normalization conversion, thereby solving the problem of data processing difficulty caused by format diversification and providing the possibility for unified analysis and integration of network security logs.

[0071] The attack analysis module uses the attack feature library to perform attack analysis on the attack-related fields and passes the attack analysis data to the comprehensive analysis report agent (Agent5) to provide data support for comprehensive analysis. Then the comprehensive analysis report agent (Agent5) performs multi-dimensional cross-analysis by integrating attack analysis data, asset data and threat intelligence data, which surpasses the traditional isolated analysis method of only alert information. This way can realize the deep correlation of cross-source data, not only improves the accuracy of analysis results, but also comprehensively evaluates the whole-chain impact range and severity of attack events, thereby effectively reducing analysis omissions.

[0072] Finally, the attack disposal module specifies the attack disposal plan according to the analysis report, rather than relying on fixed templates or manual analysis. This solves the mismatch between general disposal suggestions and specific attack scenarios in traditional methods, making the attack disposal plan more accurate and practical.

[0073] It can be seen that the embodiment of the present application can bring the following beneficial effects:

[0074] (1) The embodiment of the present application realizes the full automation of the analysis and response process of network security logs through large model and agent technology, significantly shortens the manual analysis and judgment time, improves the alert processing efficiency, and effectively reduces the dependence on professional experience of security personnel;

[0075] (2) The embodiment of the present application comprehensively analyzes and judges network security logs, asset data and threat intelligence and other multi-dimensional data from multiple angles to improve the comprehensiveness and accuracy of analysis and judgment;

[0076] (3) The embodiment of the present application uses large model and agent comprehensive analysis technology to deeply match attack features and network security logs to identify potential unknown threats, showing the ability to hunt unknown threats.

[0077] (4) The application utilizes the analysis report and attack disposal plan generated by the large model and the agent to intuitively display the threat detection and response results, assist security personnel in comprehensively understanding and accurately evaluating relevant information, thereby significantly improving security operation efficiency and response capability, and forming a closed-loop response process.

[0078] The following describes steps 210-250 in detail.

[0079] According to some embodiments of the present application, the attack feature extraction agent (Agent1) 110 includes a pre-trained large language model. The pre-trained large language model is, for example, a Sentence-BERT (SBERT) model. The SBERT model is an improved model based on BERT (Bidirectional Encoder Representations from Transformers), which is specially used to generate sentence-level embedding vectors. Unlike traditional BERT models, the SBERT model can efficiently compare the similarity between sentences without performing a large amount of calculation.

[0080] Based on this, the attack feature extraction process in step 210 and the construction process of the attack feature library can specifically include steps 211-212.

[0081] Step 211: input the obtained attack sample into the attack feature extraction agent, so that the attack feature extraction agent extracts attack metadata from the attack sample, extracts field values of attack feature fields based on pre-set attack feature fields of the protocol to which the attack sample belongs, and extracts attack vectors from the attack metadata and the field values using the large language model, to obtain attack features corresponding to each of the attack samples; wherein the attack features include a general field for recording the attack metadata, a protocol field for recording the field values, and the attack vectors; the attack vectors carry semantic information of the attack metadata and the field values;

[0082] Step 212. Construct an attack feature library including each of the attack features.

[0083] Exemplarily, after inputting the attack sample into the attack feature extraction agent (Agent1) 110, the attack feature extraction agent (Agent1) 110 can extract attack metadata from the attack sample, and can create a general field to record the extracted attack metadata. The attack metadata can help to comprehensively understand the characteristics and background of the attack. Among them, the attack metadata includes but is not limited to attack name (attack_name), attack type (attacktype), attack severity (severity), common vulnerability and exposure (CVE), creation time (create_time), update time (update_time), and attack description (description) and the like.

[0084] In addition, the corresponding attack feature fields can be pre-designed for different protocols. It can be understood that the attack sample is actually the known attack traffic captured, and the attack traffic is transmitted in the network based on various transmission protocols. The protocols include but are not limited to HTTP protocol, TCP (Transmission Control Protocol) protocol, DNS (Domain Name System) protocol and the like. In different protocols, attack behavior and attack results will be reflected in different protocol fields. Therefore, the attack feature fields that can carry attack behavior information or attack result information in different protocols can be determined in advance, to obtain the correspondence between the protocol and the attack feature field. When inputting the attack sample into the attack feature extraction agent (Agent1) 110, the attack feature extraction agent (Agent1) 110 can determine the corresponding attack feature field based on the protocol to which the attack sample belongs, extract the field value of the attack feature field, and create a protocol field to record the extracted attack feature field and its field value.

[0085] Taking the HTTP protocol as an example, Table 1 shows the attack feature fields corresponding to the HTTP protocol.

[0086] Table 1

[0087]

[0088]

[0089] Subsequently, the attack feature extraction agent (Agent1) 110 can use a large language model, for example, an SBERT model, to extract an attack vector from the attack metadata and the field values of the attack feature fields. The attack vector carries semantic information of the attack metadata and the field values.

[0090] Exemplarily, the attack feature extraction agent (Agent1) 110 can convert the text data such as threat name, CVE number, attack type, network protocol, disclosure date, vulnerability description, and PoC / Payload / Exp attack code fragments in the attack sample into a high-dimensional vector representation through an SBERT model to obtain an attack vector. The attack vector of each attack sample not only retains the semantic information of the text data, but also can efficiently capture the similarities and differences between different text data.

[0091] Finally, the attack features including the general field for recording attack metadata, the protocol field for recording attack feature fields and field values thereof, and the attack vector can be obtained. Taking the attack sample based on the HTTP protocol as an example, Table 2 shows the attack features extracted from the attack sample recorded in the attack feature library.

[0092] Table 2

[0093]

[0094]

[0095] In addition, as described above, the attack sample is actually known attack traffic. The attack traffic can be divided into request packets and response packets. Therefore, the attack sample actually includes an attack request packet sample and an attack response packet sample. The attack request packet sample carries attack behavior information, and the attack response packet sample carries attack result information. The attack feature library records the attack features extracted from the attack request packet sample and the attack features extracted from the attack response packet sample. Among them, in the attack features of the attack request packet sample, the protocol field carries attack behavior information; in the attack features of the attack response packet sample, the protocol field carries attack result information.

[0096] In addition, the attack feature extraction agent (Agent1) 110 can further perform data cleaning on the extracted attack features, including but not limited to removing duplicate samples, unifying sample formats (such as JSON format), and removing invalid or damaged attack samples, so as to convert the attack features into a structured storage format, facilitating subsequent fast retrieval and efficient analysis.

[0097] It can be known that the embodiment designs the general field, the protocol field, and the attack vector to form the attack features for the attack sample. Through such a classification design, the attack feature library can not only efficiently store the attack features, but also provide detailed attack analysis and query capabilities, thereby better supporting security analysis and judgment and event response. At the same time, through data structuring processing, the problem of low analysis efficiency caused by format difference can be reduced.

[0098] On the basis of any of the above embodiments, the network security log comprises an alarm log and a traffic log. The traffic log records full data flow information in the network, including various messages sent and received. It can be seen that there is attack traffic and non-attack traffic in the traffic log. When the detection system detects traffic that may have attack behavior from the traffic log, a corresponding alarm log is generated. Therefore, the alarm log can be matched with a certain traffic message or certain traffic messages in the traffic log.

[0099] It can be seen that the attack-related fields extracted from the network security log in step 220 include attack-related fields extracted from the alarm log and attack-related fields extracted from the traffic log. The attack-related fields extracted from the alarm log include a suspected attack source IP field. The suspected attack source IP field can be a source IP or a target IP. Whether the traffic message matched with the alarm log is input into the attack analysis module for analysis can specifically include the following two cases:

[0100] Case 1) If the suspected attack source IP field of the alarm log matches the preset whitelist rule, the first traffic message corresponding to the alarm log is determined from the traffic log as non-attack traffic.

[0101] For example, if the suspected attack source IP field extracted from the alarm log belongs to the white list IP recorded in the white list rule, it means that the suspected attack source IP is trusted. At this time, the first traffic message corresponding to the alarm log can be determined from the traffic log, and the first traffic message is determined as non-attack traffic, without the need to input the attack analysis module for analysis. The first traffic message can include one or more, and the first traffic message can be a request message and / or a response message.

[0102] Case 2) If the suspected attack source IP field of the alarm log does not match the whitelist rule, the second traffic message corresponding to the alarm log is determined from the traffic log, and the attack feature library and the attack-related fields of the second traffic message are input into the attack analysis module.

[0103] For example, if the suspected attack source IP field extracted from the alarm log does not belong to the white list IP recorded in the white list rule, it means that the suspected attack source IP is not trusted. At this time, the second traffic message corresponding to the alarm log can be determined from the traffic log, and the second traffic message and the attack feature library are input into the attack analysis module for analysis. The second traffic message can include one or more, and the second traffic message can be a request message and / or a response message. The first traffic message and the second traffic message in this embodiment do not specifically refer to a certain message or certain messages, and they are only used to distinguish whether the traffic message comes from a white list IP.

[0104] It can be known that, in the embodiment, the suspected attack source IP field in the alarm log is matched with the whitelist rule, and the trusted first traffic packet and the untrusted second traffic packet are screened from the traffic log. The first traffic packet does not need to continue attack analysis, thereby reducing the network attack research and judgment burden and improving the research and judgment efficiency.

[0105] On the basis of any of the above embodiments, the network security log includes a traffic log, and the traffic log can be specifically divided into a request packet and a response packet. In addition, as shown in Figure 3 Based on this, the attack analysis data of the attack analysis module 130 based on the attack feature library on the attack related field in the above step 230 can specifically include steps 231-232.

[0106] Step 231: inputting the attack feature library and the first attack related field of the request packet into the attack behavior analysis agent, and obtaining attack behavior analysis data of the attack behavior analysis agent based on the attack feature library on the first attack related field.

[0107] Exemplarily, the attack related field extracted from the request packet is called the first attack related field. The attack behavior analysis agent (Agent3) 131 is an agent specially designed for analyzing network attack behavior, which can receive the attack feature library generated by the attack feature extraction agent (Agent1) 110 and the first attack related field extracted by the field extraction agent (Agent2) 120. The attack behavior analysis agent (Agent3) 131 performs similarity calculation and pattern matching on the first attack related field corresponding to each request packet and the attack features in the attack feature library, to identify whether the first attack related field contains known attack features. Through such comparison and analysis, the attack behavior analysis agent (Agent3) 131 can judge whether each request packet has attack behavior.

[0108] Specifically, the attack behavior analysis agent (Agent3) 131 is deployed with a specific large language model that has been fine-tuned. The specific large language model is, for example, a deepseek-coder model. The specific large language model can be fine-tuned on a specific attack type dataset (such as a SQL injection attack dataset), so as to more accurately identify features related to specific attack types and judge whether the request packet has explicit attack attempts. If the request packet successfully matches the attack features in the attack feature library, the request packet can be marked as "attack attempt". If the request packet does not match the attack features, it is further analyzed whether the response packet corresponding to the request packet is attacked successfully through step 232.

[0109] Step 232: inputting the feature library and the second attack-related field of the response message into the attack result analysis agent, obtaining attack result analysis data of the second attack-related field based on the attack feature library by the attack result analysis agent, and obtaining attack analysis data including the attack behavior analysis data and the attack result analysis data.

[0110] Exemplarily, the attack-related field extracted from the response message is referred to as the second attack-related field. The attack result analysis agent (Agent4) 132 is an agent specially designed for analyzing network attack behaviors, which can receive the attack feature library generated by the attack feature extraction agent (Agent1) 110 and the second attack-related field extracted by the field extraction agent (Agent2) 120. The attack result analysis agent (Agent4) 132 performs similarity calculation and pattern matching between the second attack-related field corresponding to each response message and the attack features in the attack feature library, to identify whether the second attack-related field contains known attack features. Through such comparison and analysis, the attack result analysis agent (Agent4) 132 can determine whether each response message is an attack success.

[0111] Specifically, the attack result analysis agent (Agent4) 132 can calculate the cosine similarity between the embedding vector of the second attack-related field extracted from the response message and the attack vector in the attack feature, and determine whether the response message is an attack success according to the cosine similarity. Specifically, if the response message presents the result features of operating system command execution (such as “uid=0(”, “gid=0(”, “groups=0(”, “PID / Program name”, “%CPU”, “%MEM”, “inetaddr:”, etc.), the reading features of specific files (such as “root:x:0:0:root: / root: / ”, “bin:*:”, etc.), and the WebShell tool connection features (such as the regular features of ice spider WebShell tool connection, the regular features of ant sword WebShell tool connection, etc.), etc., the response message can be marked as “attack success”. On the contrary, if the response message presents error return codes such as “400”, “401”, “403” and “404”, the response message can be marked as “attack failure”.

[0112] It can be known that the traditional attack detection system usually only relies on a single data source (such as log data or traffic data) for attack detection, while the attack behavior analysis agent in the embodiment can receive and integrate multiple data sources, including structured alarm data and request messages. Through comprehensive analysis of multi-dimensional data, the attack behavior analysis agent can improve the comprehensiveness of attack behavior identification. In addition, the traditional attack analysis tool mainly focuses on pre-attack and attack behavior analysis, and less on in-depth research on response message data. The attack result analysis agent in the embodiment can effectively judge whether the attack is successfully executed by analyzing the protocol fields, general fields of the response message and their correlation with attack characteristics.

[0113] On the basis of any of the above embodiments, in step 240, the threat intelligence data, asset data and attack analysis data are input into the comprehensive analysis report agent to obtain an output analysis report, specifically including step 241.

[0114] Step 241: input the threat intelligence data, asset data and attack analysis data into the comprehensive analysis report agent, so that the comprehensive analysis report agent determines the attack technology and the corresponding attack result based on the attack analysis data, matches the attack IP recorded in the attack-related field with the threat intelligence data to obtain the correlation evaluation result between the attack IP and the known attack source, and determines the attacked asset from the asset data, determines the attack severity based on the vulnerability data of the attacked asset and the correlation evaluation result, and obtains the analysis report.

[0115] Exemplarily, the attack analysis data includes attack behavior analysis data on request messages and attack result analysis data on response messages. The comprehensive analysis report agent (Agent5) 140 combines the analysis results of the request messages and the response messages, further integrates the threat intelligence data, the component information involved in the asset and the possible vulnerabilities thereof, and performs comprehensive analysis.

[0116] Specifically, the comprehensive analysis report agent (Agent5) 140 can determine the attack technology used in a certain attack and the corresponding attack result based on the attack behavior analysis data and the attack result analysis data.

[0117] In addition, the comprehensive analysis report agent (Agent5) 140 can match the attack IP recorded in the attack-related field with threat intelligence data to obtain an association assessment between the attack IP and a known attack source. For example, threat intelligence of the attack IP can be obtained from the threat intelligence data and analyzed in detail to determine whether the attack IP has known malicious activities. By comparing the historical records of the attack IP and the associated domain name, it is determined whether the attack IP is related to a known attack source. If it is preliminarily determined that it is a real attack, a threat warning is issued in time, and the attack is labeled accordingly. The label can include, but is not limited to, "remote control", "malware", "phishing", "spam", "bot", and "APT" (Advanced Persistent Threat).

[0118] In addition, the comprehensive analysis report agent (Agent5) 140 can also determine the attacked assets from the asset data. The attacked assets are the scope of the attack. At the same time, the severity of the attack can be determined based on the vulnerability data of the attacked assets and the association assessment results. Specifically, the comprehensive analysis report agent (Agent5) 140 extracts the address, software name and version information of the attacked assets from the attack features. And find the corresponding attacked assets in the asset management database, determine the scope of the attack, and evaluate whether the attacked assets have been exploited. Finally, based on these analysis results, the attack event is comprehensively evaluated, and the conclusion is drawn and the analysis process of the event is displayed.

[0119] After obtaining the attack results, attack techniques, scope of influence and severity, the comprehensive analysis report agent (Agent5) 140 can generate a corresponding analysis report. Specifically, the comprehensive analysis report agent (Agent5) 140 can use the prompt word engineering technology to construct prompt word templates for various attack types. These prompt word templates can guide the large language model to generate more targeted and readable analysis reports. For example, the report template for SQL injection attacks will include attack vectors, injection points, database types and other key information. Table 3 below lists the judgment logic under different scenarios and explains each scenario.

[0120] Table 3

[0121]

[0122]

[0123] As an example, the analysis report generated by the comprehensive analysis report agent (Agent5) 140 for a certain attack can be output in the form of a table, as shown in Table 4 below.

[0124] Table 4

[0125]

[0126] In addition, the analysis report can also be output in natural language, clearly presenting the analysis process and conclusions. For example, it can be expressed as: "The attacker successfully executed remote code by exploiting the CVE-XXXX-XXXX vulnerability, fully controlling the server."

[0127] In addition, the analysis report can also provide detailed judgment basis, such as "The error information in the response message indicates that the attacker performed a SQL injection attack" or "According to threat intelligence, the relevant IP address has known association with a certain APT organization." This report form combines technical analysis and actual judgment, facilitating accurate communication of the cause and background of security incidents. Taking the SQL injection attack as an example, the analysis report can be expressed as: "I. Analysis Conclusion: There is a high-risk SQL injection attack attempt, although no signs of successful attack are currently found, the target system has high-risk vulnerabilities, and the attack characteristics are high-risk SQL injection, there is still a high risk. II. Judgment Basis: The request message matches the characteristics of high-risk SQL injection attacks, the target system has corresponding vulnerabilities, although the response message does not show signs of successful attack, possible reasons are: 1. The defense system intercepted the attack; 2. The attacker used evasion techniques; 3. The attack is ongoing and has not yet produced results."

[0128] It can be seen that in this embodiment, the comprehensive analysis report agent has the ability of correlation analysis: when the response message does not show signs of successful attack, the request message matches the characteristics of high-risk attacks, and the attacked assets have related vulnerabilities, the comprehensive analysis report agent can infer that the attack may have been successfully intercepted by the defense system, or the attacker used more covert and difficult-to-detect attack methods.

[0129] In addition, the comprehensive analysis report agent has the ability of causal analysis, which can deeply analyze the internal causal relationship between various related factors, accurately judge the real cause of the attack success or failure, such as determining whether the attack success is due to the existence of vulnerabilities in a specific asset component, or determining whether the attack failure is due to the successful action of the defense system, thereby providing valuable basis for the overall control of security situation and the formulation of subsequent response strategies.

[0130] In addition, the comprehensive analysis report agent has the ability of counterfactual reasoning, which can accurately infer whether the attack will be successful if the attacked assets do not have vulnerabilities. Similarly, when assuming that the defense system does not work, it can also accurately determine whether the attack can be effectively intercepted. This counterfactual reasoning ability plays an important auxiliary role in helping analysts deeply understand the core nature of attack events and fully assess their impact, and can assist in formulating more accurate and efficient security protection strategies and response plans.

[0131] On the basis of any of the above embodiments, as shown in Figure 4 The attack handling module 150 includes a handling suggestion generation agent (Agent6) 151 and a handling rule generation agent (Agent7) 152. Based on this, the analysis report in step 250 is input into the attack handling module 150 to obtain an attack handling plan, which specifically includes steps 251-252.

[0132] Step 251: inputting the analysis report into the handling suggestion generation agent to obtain an output attack response suggestion; wherein the attack response suggestion includes one or more of a short-term handling suggestion, a long-term handling suggestion, a business recovery suggestion, and a security reinforcement suggestion.

[0133] Exemplarily, the handling suggestion generation agent (Agent6) 151 is an intelligent agent specially designed for generating network security event handling suggestions, which receives the analysis report generated by the comprehensive analysis report intelligent agent (Agent5) 140 and automatically generates an attack response suggestion for a specific attack to help network security personnel quickly develop a response strategy and reduce the harm caused by the attack.

[0134] Specifically, the above analysis report, asset information and its vulnerability data, security policy and other related data can be input into the handling suggestion generation agent (Agent6) 151. The handling suggestion generation agent (Agent6) 151 uses a large language model to generate multi-dimensional attack response suggestions. The attack response suggestion includes one or more of a short-term handling suggestion, a long-term handling suggestion, a business recovery suggestion, and a security reinforcement suggestion.

[0135] The short-term handling suggestion can include but is not limited to: immediately isolating the infected host, blocking malicious IP, rolling back malicious files, etc. The long-term handling suggestion can include but is not limited to: fixing vulnerabilities, upgrading systems, strengthening security configurations, optimizing security policies, etc. The business recovery suggestion can include but is not limited to: recovering damaged data, rebuilding business systems, etc. The security reinforcement suggestion can include but is not limited to: strengthening access control, deploying security devices, conducting security audits, etc.

[0136] In addition, to ensure the security and effectiveness of the attack response suggestion, all generated attack response suggestions can be refined in combination with pre-defined handling templates, etc., and then reviewed by security experts, and monitoring and analysis of the handling effect are added. For example, monitoring the status of affected assets, security device logs, etc., to determine whether the handling is effective, etc., for continuous optimization and improvement of the model.

[0137] The following is an example of attack response recommendations generated by the treatment recommendation generation agent (Agent6) 151 for SQL injection attacks: "I. SQL injection treatment recommendations: 1. Input validation: Ensure that all inputs, especially user-provided inputs, are strictly validated and cleaned before being directly inserted into SQL queries. Use parameterized queries or prepared statements. 2. Principle of least privilege: When creating database users, assign them only the minimum necessary permissions, avoiding UPDATE, INSERT, or DELETE permissions. 3. Error information hiding: Avoid exposing detailed error information to users, reducing the risk of revealing system information. 4. Use Web Application Firewall: Deploy WAF to detect and block SQL injection attacks. II. System construction recommendations: 1. Secure Development Life Cycle (SDL): Introduce security checks in the software development life cycle to ensure that potential SQL injection risks are considered at each stage. 2. Log monitoring and auditing: Strengthen log recording of database operations and conduct regular audits to detect potential attack behavior early. 3. Vulnerability repair and update: Regularly update system and database security patches to avoid exploitation of known vulnerabilities."

[0138] Step 252: input the analysis report into the treatment rule generation agent, and obtain the output attack treatment rule; wherein the attack treatment rule includes one or more of black list rule, white list rule, feature matching rule and behavior analysis rule set for multiple different security devices respectively.

[0139] Illustratively, the treatment rule generation agent (Agent7) 152 is an intelligent agent specifically designed to create security device treatment rules, which receives analysis reports from the comprehensive analysis report intelligent agent (Agent5) 140 and automatically generates attack treatment rules suitable for different security devices to quickly respond and prevent attacks, ensuring that various security devices can effectively respond to and prevent security threats.

[0140] Specifically, the above analysis report, attack response recommendations, security device types, existing rules, and other related data can be input into the treatment rule generation agent (Agent7) 152, and a fine-tuned large language model can be used to automatically generate attack treatment rules for security devices. Subsequently, the generated attack treatment rules can be subjected to syntax checking, and the generated attack treatment rules can be output in a format supported by the security device. To ensure the safety and effectiveness of the recommendations, all generated attack treatment rules must be reviewed by security experts or tested in a simulated environment.

[0141] The attack handling rules include one or more of blacklist rules, whitelist rules, feature matching rules, and behavior analysis rules respectively set for a plurality of different security devices. The blacklist rules can include, but are not limited to, blocking malicious IP addresses, domain names, URLs, etc. The whitelist rules can include, but are not limited to, allowing access of specific IP addresses, domain names, URLs, etc. The feature matching rules can include, but are not limited to, matching specific attack features, such as malicious code, malicious files, malicious requests, etc. The behavior analysis rules can include, but are not limited to, matching abnormal behaviors, such as multiple login failures, large number of port scans, frequent access to sensitive files, etc.

[0142] It can be seen that the embodiment utilizes the handling suggestion generation agent to generate customized handling suggestions, rather than relying on fixed templates or manual analysis. The problem of mismatch between general handling suggestions and specific attack scenarios in traditional methods is solved, making the suggestions more accurate and suitable for actual scenarios. In addition, the handling rule generation agent is used to generate security device rules adapted to specific attack scenarios, solving the problem of invalid rules or high false positive rate caused by scenario mismatch in traditional rule generation methods. Moreover, by dynamically generating rules, the rule deployment cycle is significantly shortened.

[0143] Based on any of the above embodiments, the application further provides a network attack research and judgment system. As shown in Figure 1 As shown in Figure 5 The network attack research and judgment system 100 includes:

[0144] An attack feature extraction agent 110 is configured to extract attack features from obtained attack samples and construct an attack feature library including the attack features.

[0145] A field extraction agent 120 is configured to extract attack-related fields from obtained network security logs.

[0146] An attack analysis module 130 is configured to generate attack analysis data of the attack-related fields based on the attack feature library.

[0147] A comprehensive analysis report agent 140 is configured to generate an analysis report based on threat intelligence data, asset data, and the attack analysis data. The analysis report includes one or more of attack results, attack severity, impact range, and attack technology.

[0148] An attack handling module 150 is configured to generate an attack handling plan based on the analysis report.

[0149] In some embodiments, the attack feature extraction agent 110 includes a pre-trained large language model. The attack feature extraction agent 110 is specifically configured to:

[0150] input the obtained attack samples into an attack feature extraction agent, so that the attack feature extraction agent extracts attack metadata from the attack samples, extracts field values of attack feature fields based on preset attack feature fields of a protocol to which the attack samples belong, and extracts an attack vector from the attack metadata and the field values by using the large language model, to obtain attack features corresponding to each of the attack samples; wherein the attack features include a general field for recording the attack metadata, protocol fields for recording the field values, and the attack vector; the attack vector carries semantic information of the attack metadata and the field values;

[0151] construct an attack feature library including each of the attack features.

[0152] In some embodiments, the network security logs include alert logs and traffic logs; the attack-related fields include a suspected attack source IP field extracted from the alert logs; and the attack analysis module 130 is specifically configured to:

[0153] if the suspected attack source IP field of the alert log matches a preset whitelist rule, determining, from the traffic logs, that a first traffic packet corresponding to the alert log is non-attack traffic;

[0154] if the suspected attack source IP field of the alert log does not match the whitelist rule, determining, from the traffic logs, a second traffic packet corresponding to the alert log, and inputting the attack feature library and attack-related fields of the second traffic packet into the attack analysis module.

[0155] In some embodiments, the network security logs include traffic logs, and the traffic logs include request packets and response packets; the attack analysis module 130 includes an attack behavior analysis agent 131 and an attack result analysis agent 132; and the attack analysis module 130 is specifically configured to:

[0156] input the attack feature library and first attack-related fields of the request packets into the attack behavior analysis agent, and obtain attack behavior analysis data of the attack behavior analysis agent based on the attack feature library and the first attack-related fields;

[0157] input the attack feature library and second attack-related fields of the response packets into the attack result analysis agent, obtain attack result analysis data of the attack result analysis agent based on the attack feature library and the second attack-related fields, and obtain attack analysis data including the attack behavior analysis data and the attack result analysis data.

[0158] In some embodiments, the comprehensive analysis report agent 140 is specifically configured to:

[0159] inputting the threat intelligence data, the asset data and the attack analysis data into a comprehensive analysis report agent, so as to make the comprehensive analysis report agent determine attack techniques and corresponding attack results based on the attack analysis data, match attack IPs recorded in the attack-related fields with the threat intelligence data to obtain correlation evaluation results between the attack IPs and known attack sources, and determine attacked assets from the asset data, determine attack severity based on vulnerability data of the attacked assets and the correlation evaluation results, and obtain the analysis report.

[0160] In some embodiments, the attack handling module 150 includes a handling suggestion generation agent 151 and a handling rule generation agent 152; the attack handling module 150 is specifically configured to:

[0161] inputting the analysis report into the handling suggestion generation agent to obtain output attack response suggestions; wherein the attack response suggestions include one or more of short-term handling suggestions, long-term handling suggestions, business recovery suggestions and security reinforcement suggestions;

[0162] inputting the analysis report into the handling rule generation agent to obtain output attack handling rules; wherein the attack handling rules include one or more of blacklist rules, whitelist rules, feature matching rules and behavior analysis rules respectively set for a plurality of different security devices.

[0163] The implementation processes of the functions and roles of the modules in the above system are specifically described in the implementation processes of the corresponding steps in the above method, and will not be repeated here.

[0164] Based on the network attack research and judgment method described in any of the above embodiments, the present application further provides a computer program product, which includes one or more computer programs or instructions. The computer programs or instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another. The computer programs are executed by a processor to implement the network attack research and judgment method described in any of the above embodiments.

[0165] Based on the network attack research and judgment method described in any of the above embodiments, the present application further provides an electronic device as shown in Figure 6 Figure 6 ​At the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and of course can also include other hardware required by the business. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs to implement the network attack judgment method described in any of the embodiments. Among them, the electronic device can be deployed with the network attack judgment system described in any of the embodiments.

[0166] The application also provides a computer storage medium, the storage medium stores a computer program, and the computer program can be executed by a processor to execute the network attack judgment method described in any of the embodiments.

[0167] In several embodiments provided in the present application, it should be understood that the disclosed apparatus and method can also be implemented by other means. The apparatus embodiments described above are only schematic, for example, the flowcharts and block diagrams in the drawings show the possible implementation architectures, functions and operations of the apparatus, method and computer program product according to the embodiments of the present application. In this regard, each block in the flowchart or block diagram can represent a module, a program segment or a part of code, which contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur in different orders than that shown in the figure. For example, two consecutive blocks can actually be executed substantially in parallel, and sometimes they can be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and the combination of blocks in the block diagram and / or flowchart, can be implemented by a dedicated hardware-based system for executing the specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0168] In addition, each functional module in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0169] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the parts of the prior art that make contributions or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0170] The above merely provides an example of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application. It should be noted that similar reference numbers and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0171] The above merely provides an example of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application. It should be noted that similar reference numbers and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0172] It should be noted that, in the present document, the relationship terms such as first and second are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the processes, methods, articles or devices including a series of elements not only include those elements, but also include other elements not explicitly listed or inherent to such processes, methods, articles or devices. Without more limitations, the element defined by the statement "including a" does not exclude the presence of another identical element in the process, method, article or device including the element.

Claims

1. A network attack judgment method, characterized in that, The method is applied to a network attack judgment system; the network attack judgment system is deployed with multiple intelligent agents; the method comprises: inputting the obtained attack samples into an attack feature extraction intelligent agent, so that the attack feature extraction intelligent agent extracts attack metadata from the attack samples, extracts field values of attack feature fields based on preset attack feature fields of protocols to which the attack samples belong, and extracts attack vectors from the attack metadata and the field values by using a large language model included in the attack feature extraction intelligent agent, to obtain attack features corresponding to each of the attack samples; wherein the attack features comprise a general field for recording the attack metadata, protocol fields for recording the field values, and the attack vectors; the attack metadata comprises a threat name, an attack type, an attack severity, a public vulnerability and exposure, a creation time, an update time, and an attack description; the attack feature fields carry attack behavior information or attack result information; the attack vectors carry semantic information of the attack metadata and the field values; constructing an attack feature library comprising each of the attack features; inputting the obtained network security logs into a field extraction intelligent agent to obtain extracted attack-related fields; inputting the attack feature library and the attack-related fields into an attack analysis module to obtain attack analysis data of the attack analysis module based on the attack feature library and the attack-related fields; the network security logs comprise traffic logs, and the traffic logs comprise request messages and response messages; the attack analysis module comprises an attack behavior analysis intelligent agent and an attack result analysis intelligent agent; the attack analysis data of the attack analysis module based on the attack feature library and the attack-related fields comprises: inputting the attack feature library and first attack-related fields of the request messages into the attack behavior analysis intelligent agent to obtain attack behavior analysis data of the attack behavior analysis intelligent agent based on the attack feature library and the first attack-related fields; inputting the attack feature library and second attack-related fields of the response messages into the attack result analysis intelligent agent to obtain attack result analysis data of the attack result analysis intelligent agent based on the attack feature library and the second attack-related fields, to obtain attack analysis data comprising the attack behavior analysis data and the attack result analysis data; inputting threat intelligence data, asset data, and the attack analysis data into a comprehensive analysis report intelligent agent to obtain an output analysis report; the analysis report comprises one or more of attack results, attack severities, impact ranges, and attack technologies; inputting the analysis report into an attack disposal module to obtain an output attack disposal plan.

2. The method of claim 1, wherein, The network security logs comprise alarm logs and traffic logs; the attack-related fields comprise a suspected attack source IP field extracted from the alarm logs; the attack feature library and the attack-related fields are inputted into the attack analysis module, comprising: If the suspected attack source IP field of the alarm log matches a preset whitelist rule, determine a first traffic message corresponding to the alarm log from the traffic log as non-attack traffic; If the suspected attack source IP field of the alarm log does not match the whitelist rule, determine a second traffic message corresponding to the alarm log from the traffic log, and input the attack feature library and attack-related fields of the second traffic message into the attack analysis module.

3. The method of claim 1, wherein, The inputting of the threat intelligence data, asset data and attack analysis data into the comprehensive analysis report agent includes: The inputting of the threat intelligence data, asset data and attack analysis data into the comprehensive analysis report agent includes:

4. The method of claim 1, wherein, The attack handling module includes a handling suggestion generation agent and a handling rule generation agent; the inputting of the analysis report into the attack handling module includes: The inputting of the analysis report into the handling suggestion generation agent includes an output attack response suggestion; wherein the attack response suggestion includes one or more of a short-term handling suggestion, a long-term handling suggestion, a business recovery suggestion and a security reinforcement suggestion; The inputting of the analysis report into the handling rule generation agent includes an output attack handling rule; wherein the attack handling rule includes one or more of a blacklist rule, a whitelist rule, a feature matching rule and a behavior analysis rule set for a plurality of different security devices. 5.A network attack judgment system, characterized by comprising: The system includes: An attack feature extraction agent is configured to extract attack metadata from obtained attack samples, extract field values of attack feature fields based on preset attack feature fields of protocols to which the attack samples belong, extract attack vectors from the attack metadata and the field values by using a large language model, and obtain attack features corresponding to each of the attack samples; and construct an attack feature library including each of the attack features; wherein the attack features include general fields for recording the attack metadata, protocol fields for recording the field values and the attack vectors; the attack metadata includes threat names, attack types, attack severities, common vulnerabilities and exposures, creation times, update times and attack descriptions; the attack feature fields carry attack behavior information or attack result information; and the attack vectors carry semantic information of the attack metadata and the field values; A field extraction agent is configured to extract attack-related fields from obtained network security logs. An attack analysis module is configured to generate attack analysis data of the attack-related fields based on the attack feature library; the network security log comprises a traffic log, and the traffic log comprises a request message and a response message; the attack analysis module comprises an attack behavior analysis agent and an attack result analysis agent; the attack analysis data comprises attack behavior analysis data and attack result analysis data; The attack behavior analysis agent is configured to generate attack behavior analysis data of a first attack-related field based on the attack feature library and the first attack-related field of the request message; The attack result analysis agent is configured to generate attack result analysis data of a second attack-related field based on the feature library and the second attack-related field of the response message; An integrated analysis report agent is configured to generate an analysis report based on threat intelligence data, asset data and the attack analysis data, and the analysis report comprises one or more of attack results, attack severity, impact range and attack technology; An attack disposal module is configured to generate an attack disposal plan based on the analysis report.

6. A computer program product, characterised in that, The computer program product comprises a computer program, and the computer program is executed by a processor to implement the method in any one of claims 1-4.

7. An electronic device, comprising: The electronic device comprises: a processor; a memory for storing processor-executable instructions; wherein the processor invokes the executable instructions to implement the operations of the method in any one of claims 1-4.

8. A computer-readable storage medium, characterized in that, A computer program product has computer instructions stored thereon, and the computer instructions are executed by a processor to implement the steps of the method in any one of claims 1-4.

Images