Network attack detection method and device, and protection system

Abstract

The invention provides a network attack detection method and device, and a protection system, and belongs to the field of network security. After the protection equipment receives network traffic, whether the network traffic is suspicious traffic or not is judged through a traffic detection model on the basis of traffic characteristics of the network traffic, and after the network traffic is determined to be suspicious traffic, the traffic characteristics of the network traffic are further matched with attack characteristics in a characteristic library; and determining whether the network traffic is normal traffic or attack traffic based on a matching result. According to the method and the device, the network traffic is preliminarily screened through the traffic detection model, so that the number of the network traffic needing to be subjected to attack detection based on the feature library is reduced, and the detection efficiency of the protection equipment is improved. Besides, the protection device can allocate more processing resources for the detection of the single network traffic, so that the single network traffic can be detected more comprehensively based on the feature library, and the detection accuracy is improved.

Description

Technical Field

[0001] This application relates to the field of network security, and particularly to a network attack detection method, device, and protection system. Background Art

[0002] A protection device (such as a security gateway or a firewall) detects the traffic flowing through the protection device to confirm whether there is an attack on the network, and timely blocks the attack traffic in the case of an attack to ensure network security.

[0003] Currently, protection devices mainly detect and protect network attacks through intrusion prevention system (IPS) technology or anti-virus (AV) technology. Among them, IPS technology is mainly used to detect malicious traffic (or attack traffic), and AV technology is mainly used to detect malicious files (or virus files). The methods of using IPS technology and AV technology for network attack detection are similar. By pre-storing a feature library in the protection device, the feature library includes a large number of attack features of known malicious traffic or malicious files provided by network security vendors. The protection device extracts the traffic features of the network traffic reaching the protection device, compares the extracted traffic features with the attack features in the feature library. If the extracted traffic features contain the attack features in the feature library, it is determined that the network traffic is attack traffic.

[0004] However, since current protection devices need to perform attack detection based on the feature library for all received traffic, and the scale of the feature library is getting larger and larger (that is, the number of attack features in the feature library is growing rapidly), the process of the protection device comparing traffic features with attack features will become a processing bottleneck of the protection device, restricting the detection efficiency of the protection device. At the same time, in order to meet the requirements of performance indicators such as resource occupancy and latency, the protection device will omit some links in the above feature comparison process under certain conditions, which will also affect the detection accuracy. Summary of the Invention

[0005] This application provides a network attack detection method, device, and protection system.

[0006] In a first aspect, a network attack detection method is provided. The method is applied to a protection system, which includes protection devices. The protection devices receive target network traffic. The protection devices obtain target traffic characteristics, which are the traffic characteristics of the target network traffic. The protection devices input the target traffic characteristics into a target traffic detection model and obtain a target determination result output by the target traffic detection model. The target traffic detection model is trained based on a target training sample set. The target training sample set includes multiple groups of sample traffic characteristics, and each group of sample traffic characteristics is respectively labeled with a normal label or an abnormal label. The sample traffic characteristics labeled with the normal label come from known normal traffic, and the sample traffic characteristics labeled with the abnormal label come from known attack traffic. The protection devices determine whether the target network traffic is suspicious traffic according to the target determination result. If the target network traffic is suspicious traffic, the protection devices match the target traffic characteristics with the attack characteristics in the feature library and determine whether the target network traffic is attack traffic or normal traffic based on the matching result.

[0007] In this application, a joint detection scheme based on a model and a feature library is implemented. First, the traffic detection model makes a preliminary judgment on the network traffic received by the protection device. After the protection device determines that the network traffic is suspicious traffic based on the determination result of the traffic detection model, it further performs attack detection on the network traffic based on the feature library stored in the protection device. Since most network traffic is normal traffic, preliminary screening of network traffic through the traffic detection model can significantly reduce the number of network traffic that needs to be detected for attacks based on the feature library by the protection device. Since the network traffic that needs to be detected for attacks based on the feature library by the protection device is significantly reduced, on the one hand, the detection efficiency of the protection device is improved, and on the other hand, the protection device can allocate more processing resources for the detection of a single network traffic, so that it can perform more comprehensive detection on a single network traffic based on the feature library, improving the accuracy of detection.

[0008] In a first possible implementation manner, the determination result output by the target traffic detection model indicates normal or abnormal. The implementation manner for the protection device to determine whether the target network traffic is suspicious traffic according to the target determination result includes: if the target determination result indicates abnormal, the protection device determines that the target network traffic is suspicious traffic; if the target determination result indicates normal, the protection device determines that the target network traffic is normal traffic.

[0009] In this implementation mode, the target traffic detection model is mainly used to filter normal traffic. For the network traffic determined to be normal by the target traffic detection model, the protection device directly passes it through; for the network traffic determined to be abnormal by the target traffic detection model, the protection device further performs attack detection based on the feature library on it. Since the protection device does not need to perform attack detection based on the feature library on the network traffic determined to be normal by the target traffic detection model, the number of network traffic that subsequently requires the protection device to perform attack detection based on the feature library is greatly reduced, thereby improving the detection efficiency of the protection device.

[0010] In the second possible implementation mode, the determination result output by the target traffic detection model indicates normal, abnormal or suspicious. The implementation mode for the protection device to determine whether the target network traffic is suspicious traffic according to the target determination result includes: if the target determination result indicates suspicious, the protection device determines that the target network traffic is suspicious traffic. If the target determination result indicates abnormal, the protection device determines that the target network traffic is attack traffic. If the target determination result indicates normal, the protection device determines that the target network traffic is normal traffic.

[0011] In this implementation mode, the target traffic detection model is used not only to filter normal traffic in the network, but also to identify attack traffic in the network. For the network traffic determined to be normal by the target traffic detection model, the protection device directly passes it through; for the network traffic determined to be abnormal by the target traffic detection model (i.e., attack traffic), the protection device directly intercepts it; for the network traffic determined to be suspicious by the target traffic detection model, the protection device further performs attack detection based on the feature library on it. Since the protection device does not need to perform attack detection based on the feature library on the network traffic determined to be normal and abnormal by the target traffic detection model, the number of network traffic that subsequently requires the protection device to perform attack detection based on the feature library is greatly reduced, thereby improving the detection efficiency of the protection device. In addition, since the target traffic detection model has the ability to identify attack traffic, it is possible to identify malicious traffic or unknown malicious traffic that attempts to evade detection through deformation, thereby improving the detection effect of the protection device.

[0012] Combined with the above second possible implementation mode, if the confidence level of the prediction result of the target traffic detection model for the input traffic characteristics reaches the confidence level threshold, the determination result output by the target traffic detection model is the prediction result. If the confidence level of the prediction result of the target traffic detection model for the input traffic characteristics is lower than the confidence level threshold, the determination result output by the target traffic detection model indicates suspicious. Among them, the prediction result indicates normal or abnormal.

[0013] The third possible implementation method is that the determination result output by the target traffic detection model indicates normal or abnormal, and the determination result also includes a confidence level. The implementation method for the protection device to determine whether the target network traffic is suspicious traffic according to the target determination result includes: if the confidence level in the target determination result is lower than the confidence level threshold, the protection device determines that the target network traffic is suspicious traffic. If the target determination result indicates abnormal and the confidence level in the target determination result reaches the confidence level threshold, the protection device determines that the target network traffic is attack traffic. If the target determination result indicates normal and the confidence level in the target determination result reaches the confidence level threshold, the protection device determines that the target network traffic is normal traffic.

[0014] In this implementation method, the target traffic detection model can be used not only to filter normal traffic in the network but also to identify attack traffic in the network. For the network traffic determined by the protection device to be normal traffic according to the determination result of the target traffic detection model, the protection device directly allows it to pass; for the network traffic determined by the protection device to be attack traffic according to the determination result of the target traffic detection model, the protection device directly intercepts it; for the network traffic determined by the protection device to be suspicious traffic according to the determination result of the target traffic detection model, the protection device further performs attack detection based on the feature library on it. Since the protection device does not need to perform attack detection based on the feature library on the attack traffic and normal traffic determined based on the target traffic detection model, the number of network traffic that subsequently requires the protection device to perform attack detection based on the feature library is greatly reduced, thereby improving the detection efficiency of the protection device. In addition, since the target traffic detection model has the ability to identify attack traffic, it is possible to identify malicious traffic or unknown malicious traffic that attempts to avoid detection through deformation, thereby improving the detection effect of the protection device.

[0015] Optionally, the protection system further includes an analysis device, and multiple traffic detection models corresponding one by one to multiple network scenarios are stored in the analysis device. The analysis device obtains the target traffic detection model corresponding to the target network scenario from the multiple traffic detection models according to the target network scenario currently deployed by the protection device, and the target network scenario is any one of the multiple network scenarios. The analysis device sends the target traffic detection model to the protection device.

[0016] Optionally, the analysis device trains a general traffic detection model based on a general training sample set. The general training sample set includes multiple groups of sample traffic features, and the general training sample set is obtained based on the network traffic under multiple network scenarios. The analysis device obtains the target training sample set corresponding to the target network scenario, and the target training sample set is obtained based on the network traffic under the target network scenario. The analysis device trains the general traffic detection model using the target training sample set to obtain the target traffic detection model.

[0017] In this application, the analysis device collects normal traffic and attack traffic known in multiple network scenarios, extracts traffic features of a large number of known network traffic as a general training sample set, and uses the general training sample set for generalization training to obtain a general traffic detection model. Then, according to the network scenario where the protection device is actually deployed, the analysis device fine-tunes the general traffic detection model using the sample traffic features of the network traffic from the corresponding network scenario, so that the adjusted traffic detection model is more applicable to the current network scenario, thereby improving the detection accuracy of the traffic detection model.

[0018] Optionally, after the protection device matches the target traffic features with the attack features in the feature library and determines whether the target network traffic is attack traffic or normal traffic based on the matching result, the protection device performs label annotation on the target traffic features, and uses the target traffic features with labels as a new set of sample traffic features, and the new sample traffic features are used to update the target traffic detection model.

[0019] In this application, the protection device generates new sample traffic features according to the traffic determination result obtained by matching with the feature library, so as to be used to regularly update the target traffic detection model and further improve the accuracy of the traffic detection model.

[0020] Optionally, the analysis device uses network telemetry technology to collect new sample traffic features from the protection device in real time and adds the new sample traffic features to the target training sample set. The analysis device periodically trains the target traffic detection model using the latest target training sample set to obtain an updated target traffic detection model. The analysis device sends the updated target traffic detection model to the protection device. The protection device replaces the local target traffic detection model with the updated target traffic detection model. In this implementation method, the analysis device updates the target traffic detection model on the protection device, which can save the processing resources of the protection device.

[0021] Alternatively, the protection device periodically uses the new sample traffic features generated by the protection device to train the local target traffic detection model to obtain an updated target traffic detection model, and replaces the local target traffic detection model with the updated target traffic detection model. In this implementation method, the protection device updates the target traffic detection model by itself.

[0022] Optionally, if the target network traffic is normal traffic, the protection device releases the target network traffic. If the target network traffic is attack traffic, the protection device intercepts the target network traffic.

[0023] In this application, the protection device can be compatible with the defense against attack traffic and the forwarding of normal traffic.

[0024] In a second aspect, a protection device is provided. The protection device includes a plurality of functional modules, and the plurality of functional modules interact with each other to implement the actions performed by the protection device in the first aspect and its various embodiments above. The plurality of functional modules can be implemented based on software, hardware, or a combination of software and hardware, and the plurality of functional modules can be arbitrarily combined or divided based on the specific implementation.

[0025] In a third aspect, an analysis device is provided. The analysis device includes a plurality of functional modules, and the plurality of functional modules interact with each other to implement the actions performed by the analysis device in the first aspect and its various embodiments above. The plurality of functional modules can be implemented based on software, hardware, or a combination of software and hardware, and the plurality of functional modules can be arbitrarily combined or divided based on the specific implementation.

[0026] In a fourth aspect, a protection device is provided, including: a memory, a network interface, and at least one processor. The memory is used to store program instructions, and after the at least one processor reads the program instructions stored in the memory, the protection device is caused to perform the actions performed by the protection device in the first aspect and its various embodiments above.

[0027] In a fifth aspect, an analysis device is provided, including: a memory, a network interface, and at least one processor. The memory is used to store program instructions, and after the at least one processor reads the program instructions stored in the memory, the analysis device is caused to perform the actions performed by the analysis device in the first aspect and its various embodiments above.

[0028] In a sixth aspect, a protection system is provided, including a protection device, and the protection device is used to perform the actions performed by the protection device in the first aspect and its various embodiments above.

[0029] Optionally, the protection system further includes an analysis device, and the analysis device is used to perform the actions performed by the analysis device in the first aspect and its various embodiments above.

[0030] In a seventh aspect, a computer-readable storage medium is provided, and instructions are stored on the computer-readable storage medium. When the instructions are executed by a processor, the actions performed by the protection device in the first aspect and its various embodiments above are implemented, or the actions performed by the analysis device in the first aspect and its various embodiments above are implemented.

[0031] In an eighth aspect, a computer program product is provided, including a computer program. When the computer program is executed by a processor, the actions performed by the protection device in the first aspect and its various embodiments above are implemented, or the actions performed by the analysis device in the first aspect and its various embodiments above are implemented.

[0032] In a ninth aspect, a chip is provided. The chip includes programmable logic circuits and / or program instructions. When the chip operates, it implements the actions performed by the protection device in the first aspect and its various embodiments, or implements the actions performed by the analysis device in the first aspect and its various embodiments. Description of the Drawings

[0033] Figure 1 is a schematic diagram of an application scenario provided by an embodiment of the present application;

[0034] Figure 2 is a schematic diagram of the interaction between the data plane and the control plane provided by an embodiment of the present application;

[0035] Figure 3 is a schematic diagram of the hardware structure of a protection device provided by an embodiment of the present application;

[0036] Figure 4 is a schematic diagram of the hardware structure of an analysis device provided by an embodiment of the present application;

[0037] Figure 5 is a schematic diagram of the process of a network attack detection method provided by an embodiment of the present application;

[0038] Figure 6 is a schematic diagram of the process of a protection device performing attack detection processing on network traffic provided by an embodiment of the present application;

[0039] Figure 7 is a schematic diagram of the process of another protection device performing attack detection processing on network traffic provided by an embodiment of the present application;

[0040] Figure 8 is a schematic diagram of the interaction between an analysis device and a protection device provided by an embodiment of the present application;

[0041] Figure 9 is a schematic diagram of the structure of a protection device provided by an embodiment of the present application;

[0042] Figure 10 is a schematic diagram of the structure of an analysis device provided by an embodiment of the present application. Detailed Embodiments

[0043] To make the objectives, technical solutions, and advantages of the present application clearer, the following will further describe the embodiments of the present application in detail with reference to the accompanying drawings.

[0044] The protection device is used for network security protection. The protection device can detect and resist network attacks, viruses, etc., to ensure the secure transmission of data. The protection device is usually deployed between the Internet and the protected network. For example, the protection device is deployed at the boundary of the protected network to protect the protected devices in the protected network from attacks. The protection device performs security detection on the network traffic entering the protected network to confirm whether the network traffic is normal traffic or attack traffic. In addition, the protection device blocks the attack traffic to ensure the security of the protected devices, and at the same time forwards the normal traffic to ensure that the protected devices can provide services to normal clients.

[0045] Optionally, the protection device includes, but is not limited to, one or more integrations of a firewall, a security gateway (such as a router or a switch), an intrusion detection system (IDS) device, an IPS device, a unified threat management (UTM) device, an AV device, an anti-DDoS device, and a next generation firewall (NGFW).

[0046] Currently, most protection devices adopt a detection scheme based on a feature library. By pre-storing a feature library in the protection device, the feature library includes a large number of attack features of known malicious traffic or malicious files provided by network security vendors. The protection device extracts the traffic features of the network traffic reaching the protection device, compares the extracted traffic features with the attack features in the feature library. If the extracted traffic features contain the attack features in the feature library, it is determined that the network traffic is attack traffic. However, when the current protection device adopts a feature-based detection scheme, it is necessary to perform attack detection based on the feature library on all received traffic. Since the number of attack features in the feature library is usually in the tens of thousands and increases rapidly as the scale of the feature library grows (i.e., the number of attack features in the feature library grows rapidly), the process of comparing the traffic features with the attack features by the protection device will become a processing bottleneck of the protection device, restricting the detection efficiency of the protection device. At the same time, in order to meet the requirements of performance indicators such as resource occupancy and latency, the protection device will omit some links in the above feature comparison process under certain conditions, which will also affect the detection accuracy.

[0047] Based on the problems existing in the related technologies, the present application provides a technical solution. In the technical solution provided by the present application, by deploying a traffic detection model in the protection device, first, the traffic detection model makes a preliminary judgment on the network traffic received by the protection device. After the protection device determines that the network traffic is suspicious traffic based on the judgment result of the traffic detection model, it further performs attack detection on the network traffic based on the feature library stored in the protection device. Since most network traffic is normal traffic, by preliminarily screening the network traffic through the traffic detection model, the number of network traffic that needs to be detected by the protection device based on the feature library can be significantly reduced. Since the number of network traffic that needs to be detected by the protection device based on the feature library is significantly reduced, on the one hand, the detection efficiency of the protection device is improved, and on the other hand, the protection device can allocate more processing resources for the detection of a single network traffic, so that it can perform more comprehensive detection on a single network traffic based on the feature library, and the detection accuracy is improved.

[0048] The technical solution provided by the present application is as follows. The protection device receives the target network traffic. The protection device obtains the target traffic feature, and the target traffic feature is the traffic feature of the target network traffic. The protection device inputs the target traffic feature into the target traffic detection model and obtains the target judgment result output by the target traffic detection model. The target traffic detection model is trained based on the target training sample set. The target training sample set includes multiple groups of sample traffic features, and each group of sample traffic features is respectively labeled with a normal label or an abnormal label. Among them, the sample traffic features labeled with the normal label come from known normal traffic, and the sample traffic features labeled with the abnormal label come from known attack traffic. The protection device determines whether the target network traffic is suspicious traffic according to the target judgment result. If the protection device determines that the target network traffic is suspicious traffic according to the target judgment result, the protection device matches the target traffic feature with the attack features in the feature library and determines whether the target network traffic is attack traffic or normal traffic based on the matching result. Conversely, if the protection device determines that the target network traffic is normal traffic or attack traffic according to the target judgment result, the protection device ends the detection process of the target network traffic and no longer matches the target traffic feature with the attack features in the feature library, thereby reducing the number of network traffic that needs to be detected by the protection device based on the feature library. The present application improves the detection efficiency and detection accuracy of the protection device by implementing a joint detection solution based on the model and the feature library.

[0049] The specific uses of the network attack detection method provided in this application include, but are not limited to: operating system vulnerability exploitation detection (such as server message block (SMB) service vulnerability detection, Apache vulnerability detection, Struts2 component vulnerability detection, etc.), application software vulnerability detection, world wide web (web) application intrusion detection (such as structured query language (SQL) injection detection, cross-site scripting (XSS) cross-site attack detection, etc.), command and control server communication (i.e., C&C communication) detection (such as malicious traffic detection of zombies, worms, etc.).

[0050] The technical solution of this application will be introduced in detail from multiple perspectives such as application scenarios, hardware devices, method processes, software devices, etc.

[0051] The application scenarios of the embodiments of this application will be illustrated by examples below.

[0052] For example, Figure 1 is a schematic diagram of an application scenario provided by an embodiment of this application. As Figure 1 shown, this application scenario includes a protection system, an Intranet, and the Internet. The protection system includes protection devices, which are deployed between the Intranet and the Internet.

[0053] Among them, the Intranet is the internal network protected by the protection device (referred to as the protected network). The protection device is used to detect attacks on the network traffic (unidirectional traffic or bidirectional traffic) between the protected network and the Internet. For example, see Figure 1 , the protection device is used to allow normal traffic sent from the Internet to the protected network and block attack traffic sent from the Internet to the protected network. The devices located within the protected network are protected devices. Optionally, the protected device is a server, which is used to provide services to clients. For example, the protected device is an application server or a web server. Among them, the application server includes, but is not limited to, game servers, video application servers, file servers, search engine servers, instant messaging servers, etc. The web server is also called a web server or a website server. Optionally, the protected device provides services based on the hyper text transfer protocol (HTTP) or the hypertext transfer protocol secure (HTTPs).

[0054] Optionally, there are various types of protected networks, including but not limited to bank intranets, enterprise campus networks, or campus intranets, that is, the protection device can be deployed in different network scenarios.

[0055] Optionally, please continue to refer to Figure 1 , the protection system further includes an analysis device. The analysis device is, for example, a server, or a server cluster composed of several servers, or any local / cloud module, device, or system with computing power such as a cloud platform. The analysis device is used to train a traffic detection model and provide the traffic detection model to the protection device. In Figure 1 the illustrated application scenario, the analysis device and the protection device are taken as two independent devices as an example. Alternatively, the analysis device and the protection device can also be integrated into one device.

[0056] The implementation of the network attack detection method provided by the embodiments of the present application involves a control plane and a data plane. The data plane is, for example, a programmable data plane. Among them, the control plane is responsible for training a traffic detection model and deploying the trained traffic detection model to the data plane; the data plane is responsible for applying the traffic detection model to detect network traffic and providing model training data to the control plane. For example, Figure 2 is an interaction schematic diagram of a data plane and a control plane provided by the embodiments of the present application. As Figure 2 shown, the control plane includes a data collection unit and a model management unit. Among them, the data collection unit is used to collect model training data from the data plane; the model management unit is used to perform model training based on the model training data collected by the data collection unit from the data plane and send the trained traffic detection model to the data plane. The data plane includes a traffic detection model and a feature library. Among them, the traffic detection model is used to make a preliminary determination of the network traffic according to the traffic characteristics of the network traffic, and the feature library is used to match the traffic characteristics of the network traffic after determining that the network traffic is suspicious traffic according to the determination result of the traffic detection model, so as to make a secondary determination of the network traffic, so as to determine whether the network traffic is normal traffic or attack traffic. The determination result output after the matching of the feature library on the data plane can be reported to the control plane as model training data.

[0057] In the embodiments of the present application, the data plane function is deployed on the protection device. Optionally, the control plane function is also deployed on the protection device. Alternatively, only the data plane function is deployed on the protection device, and the control plane function is deployed on the analysis device.

[0058] Optionally, the traffic detection models in the embodiments of the present application include but are not limited to decision tree models, random forest models, Bayesian models, convolutional neural network (CNN) models, or deep neural network (DNN) models.

[0059] The hardware devices of the embodiments of the present application will be exemplified below.

[0060] For example, Figure 3 is a schematic diagram of the hardware structure of a protection device provided by the embodiments of the present application. As Figure 3 shown, the protection device 300 includes a processor 301, a forwarding chip 302, and at least one network interface 303. Optionally, in combination Figure 1 viewed, Figure 3 the protection device 300 in Figure 1 is the protection device shown.

[0061] Optionally, the processor 301 includes a central processing unit (CPU) and / or a dedicated hardware chip. The CPU refers to a general-purpose CPU with high scalability and flexibility. The CPU is, for example, a single-core processor (single-CPU), or a multi-core processor (multi-CPU). The dedicated hardware chip is a high-performance processing hardware module. The dedicated hardware chip includes at least one of an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a network processor (NP).

[0062] The forwarding chip 302 is used for traffic forwarding. For example, the forwarding chip 302 is used to forward network traffic from the protection device 300 to the protected device.

[0063] The at least one network interface 303 includes, for example, Figure 3 the network interface 1, network interface 2, network interface 3... network interface n in Figure 3 The network interface 303 uses any transceiver-like device for communicating with other devices or communication networks. For example, Figure 3 The network interface 1 in communicates with the protected device, and the network interface 2 in Figure 3 communicates with the analysis device. Optionally, the network interface 303 includes at least one of a wired network interface or a wireless network interface. Among them, the wired network interface is, for example, an Ethernet interface. The Ethernet interface is, for example, an optical interface, an electrical interface, or a combination thereof. The wireless network interface is, for example, a wireless local area networks (WLAN) interface, a cellular network interface, or a combination thereof, etc.

[0064] Between at least one network interface 303 and the forwarding chip 302, and between the forwarding chip 302 and the processor 301, they are connected through an internal connection 304. The internal connection 304 includes a path for transmitting data between the network interface 303, the forwarding chip 302, and the processor 301. Optionally, the internal connection 304 is a single board or a bus. For example, the internal connection 304 is Ethernet, Fibre Channel, PCI-E (Peripheral Component Interconnect Express, a high-speed serial computer bus), RapidIO (a high-performance, low-pin count, packet-switched interconnect architecture), InfiniBand, or XAUI bus (an interface extender that connects the Ethernet Media Access Control (MAC) layer to the physical layer).

[0065] Optionally, the protection device 300 further includes a content addressable memory (CAM) 305. The CAM 305 is, for example, a ternary content addressable memory (TCAM), etc. Optionally, the CAM 305 exists independently and is connected to the forwarding chip 302 through the above internal connection 304. Alternatively, the CAM 305 and the forwarding chip 302 are integrated, that is, the CAM 305 serves as the internal memory of the forwarding chip 302.

[0066] Optionally, the protection device 300 further includes a memory 306. The memory 306 is, for example, a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, or a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM), or other optical disc storage, optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media, or other magnetic storage devices, or any other medium that can be used to carry or store the desired program code 308 in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 306 exists independently, for example, and is connected to the processor 301 through an internal connection 304. Alternatively, the memory 306 and the processor 301 are integrated together.

[0067] The memory 306 stores an operating system 307 and program code 308. Optionally, the processor 301 reads the operating system 307 from the memory 306 and runs the operating system 307. The processor 301 also reads the program code 308 from the memory 306 and implements the actions performed by the protection device in the method provided by the embodiments of the present application by running the program code 308 on the operating system 307. For example, the protection device 300 is Figure 1 the protection device shown in the figure. During the process of running the program code 308 by the CPU 301, the following process is executed: obtaining the target traffic characteristics of the target network traffic received by the protection device 300; inputting the target traffic characteristics into the target traffic detection model to obtain the target determination result output by the target traffic detection model; determining whether the target network traffic is suspicious traffic according to the target determination result; if the target network traffic is suspicious traffic, matching the target traffic characteristics with the attack characteristics in the feature library, and determining whether the target network traffic is attack traffic or normal traffic based on the matching result.

[0068] Optionally, the above-mentioned devices are respectively arranged on independent chips, or at least part of or all of them are arranged on the same chip. Whether to independently arrange each device on different chips or to integrate and arrange them on one or more chips often depends on the needs of product design. The embodiments of the present application do not limit the specific implementation forms of the above-mentioned devices.

[0069] For example, Figure 4This is a schematic diagram of the hardware structure of an analysis device provided by an embodiment of the present application. As Figure 4 shown, the analysis device 400 includes a processor 401 and a memory 402, and the memory 401 is connected to the memory 402 through a bus 403. Figure 4 It is described with the processor 401 and the memory 402 being independent of each other. Optionally, the processor 401 and the memory 402 are integrated together. Optionally, in combination Figure 1 viewed, Figure 4 the analysis device 400 in Figure 1 is the analysis device shown.

[0070] Among them, the memory 402 is used to store computer programs, and the computer programs include an operating system and program codes. The memory 402 is various types of storage media, such as ROM, RAM, EEPROM, CD-ROM, flash memory, optical memory, registers, optical disc storage, optical disc storage, magnetic disk or other magnetic storage devices.

[0071] Among them, the processor 401 is a general-purpose processor or a special-purpose processor. The processor 401 may be a single-core processor or a multi-core processor. The processor 401 includes at least one circuit to perform the actions executed by the analysis device in the method provided by the embodiment of the present application.

[0072] Optionally, the analysis device 400 further includes a network interface 404, and the network interface 404 is connected to the processor 401 and the memory 402 through the bus 403. The network interface 404 can enable the analysis device 400 to communicate with the protection device. The processor 401 can interact with the protection device through the network interface 404 to collect data on the protection device and provide a traffic detection model, etc. for the protection device.

[0073] Optionally, the analysis device 400 further includes an input / output (I / O) interface 405, and the I / O interface 405 is connected to the processor 401 and the memory 402 through the bus 403. The processor 401 can receive input commands or data, etc. through the I / O interface 405. The I / O interface 405 is used for the analysis device 400 to connect to input devices, and these input devices are, for example, keyboards, mice, etc. Optionally, in some possible scenarios, the above network interface 404 and I / O interface 405 are collectively referred to as communication interfaces.

[0074] Optionally, the analysis device 400 further includes a display 406, and the display 406 is connected to the processor 401 and the memory 402 through the bus 403. The display 406 can be used to display intermediate results and / or final results, etc. generated by the processor 401 when executing the above method. In a possible implementation manner, the display 406 is a touch display screen to provide a human-computer interaction interface.

[0075] Among them, the bus 403 is of any type and is a communication bus used to implement the interconnection of internal components of the analysis device 400. For example, a system bus. In the embodiments of the present application, it is taken as an example that the above-mentioned components inside the analysis device 400 are interconnected through the bus 403. Optionally, the above-mentioned components inside the analysis device 400 communicate with each other by other connection methods except the bus 403. For example, the above-mentioned components inside the analysis device 400 are interconnected through the logic interface inside the analysis device 400.

[0076] The above-mentioned components can be respectively arranged on independent chips, or at least partially or entirely arranged on the same chip. Whether to independently arrange each component on different chips or integrate and arrange them on one or more chips often depends on the needs of product design. The embodiments of the present application do not limit the specific implementation forms of the above-mentioned components. Figure 4 The shown analysis device 400 is only exemplary. During the implementation process, the analysis device 400 includes other components, which will not be listed one by one herein.

[0077] The method flow of the embodiments of the present application will be illustrated by examples below.

[0078] For example, Figure 5 is a schematic flowchart of a network attack detection method 500 provided by the embodiments of the present application. The method 500 is applied to a protection system, and the protection system includes a protection device. Optionally, the protection system further includes an analysis device. As Figure 5 shown, the method 500 includes but is not limited to the following steps 501 to 505. Optionally, the protection device in the method 500 is the protection device in the application scenario shown in Figure 1 which includes but is not limited to a physical device or a distributed system including multiple physical devices.

[0079] Step 501, the protection device receives the target network traffic.

[0080] Optionally, in the application scenario shown in Figure 1 the target network traffic is the network traffic flowing between the protected network and the Internet passing through the protection device, and this network traffic is sent from the Internet to the protected network or from the protected network to the Internet. In the embodiments of the present application, a network traffic includes one or more packets with the same five-tuple.

[0081] Step 502, the protection device obtains the target traffic feature, and the target traffic feature is the traffic feature of the target network traffic.

[0082] Optionally, after receiving the target network traffic, the protection device caches the packets included in the target network traffic, then parses one or more packets included in the target network traffic, and obtains the target traffic feature from a specified field of the parsing result.

[0083] Optionally, if the protection device is used for intrusion prevention, the above-mentioned specified field is the HTTP payload of one or more packets included in the target network traffic, then the above-mentioned target traffic feature is the data obtained from the HTTP payload field of the parsing result after the protection device performs application layer protocol parsing on one or more packets included in the target network traffic. Or, if the protection device is used for anti-virus, the above-mentioned target traffic feature is the file data carried by the target network traffic obtained after the protection device performs application layer protocol parsing on one or more packets included in the target network traffic and reorganizes the HTTP payload field of the parsing result.

[0084] For example, taking the attack traffic of SQL injection as the target network traffic, the above-mentioned target traffic feature is the data obtained from the HTTP payload field of the parsing result after the protection device performs application layer protocol parsing on the packets included in the attack traffic, and this data is a uniform resource locator (URL). For example, this URL (i.e., the target traffic feature) is: GET / index.php? id=123or 1=1and(select top 1password from[admin]).

[0085] In one implementation manner, when the target network traffic includes multiple packets, the above-mentioned target traffic feature is the data obtained from a specified field of the parsing result after the protection device performs protocol parsing on one packet among the multiple packets included in the target network traffic. Or, the above-mentioned target traffic feature is the data obtained from a specified field of the parsing result after the protection device performs protocol parsing on at least two packets among the multiple packets included in the target network traffic. That is to say, the target traffic feature is composed of the data of the specified fields of the parsing results of at least two packets among the multiple packets included in the target network traffic, and the embodiments of the present application do not make limitations.

[0086] Step 503: The protection device inputs the target traffic feature into the target traffic detection model and obtains the target determination result output by the target traffic detection model.

[0087] The target traffic detection model is trained based on a target training sample set. The target training sample set includes multiple groups of sample traffic features. Each group of sample traffic features is labeled with a normal label or an abnormal label. The sample traffic features labeled with a normal label come from known normal traffic. The sample traffic features labeled with an abnormal label come from known attack traffic. It should be understood that the target traffic detection model is pre-stored (loaded) in the protection device.

[0088] Optionally, the protection device uses Word2Vec (word to vector, a tool for converting words into vectors) to convert the target traffic features in text form into word vectors and then inputs them into the target traffic detection model.

[0089] The target traffic detection model in the embodiments of this application is a classification model trained using a machine learning algorithm. Optionally, the determination result output by the target traffic detection model has multiple forms. For example, the determination result only includes the predicted category, or the determination result includes the predicted category and the confidence level. The confidence level refers to the accuracy or reliability of the model's prediction for the given data. The confidence level is usually expressed in the form of probability or score. The higher the confidence level, the more reliable the prediction result. The value range of the confidence level is usually 0 to 1.

[0090] In the first possible implementation manner, the determination result output by the target traffic detection model only includes the predicted category. The determination result output by the target traffic detection model indicates normal or abnormal. That is, in this implementation manner, the determination result output by the target traffic detection model only has two possible situations: normal and abnormal.

[0091] In the second possible implementation manner, the determination result output by the target traffic detection model only includes the predicted category. The determination result output by the target traffic detection model indicates normal, abnormal, or suspicious. That is, in this implementation manner, the determination result output by the target traffic detection model includes three possible situations: normal, abnormal, and suspicious. The determination result output by the target traffic detection model indicates suspicious, indicating that the target traffic detection model cannot accurately predict and classify the input traffic features.

[0092] Optionally, if the confidence level of the prediction result of the target traffic detection model for the input traffic features reaches the confidence level threshold, the determination result output by the target traffic detection model is this prediction result. If the confidence level of the prediction result of the target traffic detection model for the input traffic features is lower than the confidence level threshold, the determination result output by the target traffic detection model indicates suspicious. Among them, the prediction result indicates normal or abnormal.

[0093] In the third possible implementation manner, the determination result output by the target traffic detection model includes a predicted category and a confidence level. The determination result output by the target traffic detection model indicates normal or abnormal, and this determination result also includes a confidence level. Optionally, the determination result output by the target traffic detection model is expressed as {normal, confidence level} or {abnormal, confidence level}.

[0094] Step 504: The protection device determines whether the target network traffic is suspicious traffic according to the target determination result.

[0095] Combined with the first possible implementation manner in the above step 503, the implementation manner of the above step 504 is that if the target determination result indicates abnormal, the protection device determines that the target network traffic is suspicious traffic. If the target determination result indicates normal, the protection device determines that the target network traffic is normal traffic.

[0096] In this implementation manner, the target traffic detection model is mainly used to filter normal traffic. For the network traffic determined to be normal by the target traffic detection model, the protection device directly releases it; for the network traffic determined to be abnormal by the target traffic detection model, the protection device further performs attack detection based on the feature library. Since the protection device does not need to perform attack detection based on the feature library on the network traffic determined to be normal by the target traffic detection model, the number of network traffic that needs to be protected by the protection device based on the feature library for attack detection is greatly reduced, thereby improving the detection efficiency of the protection device.

[0097] Combined with the second possible implementation manner in the above step 503, the implementation manner of the above step 504 is that if the target determination result indicates suspicious, the protection device determines that the target network traffic is suspicious traffic. If the target determination result indicates abnormal, the protection device determines that the target network traffic is attack traffic. If the target determination result indicates normal, the protection device determines that the target network traffic is normal traffic.

[0098] In this implementation method, the target traffic detection model is used to filter normal traffic in the network and identify attack traffic in the network. For the network traffic determined by the target traffic detection model to be normal, the protection device directly allows it to pass; for the network traffic determined by the target traffic detection model to be abnormal (i.e., attack traffic), the protection device directly intercepts it; for the network traffic determined by the target traffic detection model to be suspicious, the protection device further performs attack detection based on the feature library on it. Since the protection device does not need to perform attack detection based on the feature library on the network traffic determined by the target traffic detection model to be normal and the network traffic determined to be abnormal, the number of network traffic that subsequently requires the protection device to perform attack detection based on the feature library is significantly reduced, thereby improving the detection efficiency of the protection device. In addition, since the target traffic detection model has the ability to identify attack traffic, it is possible to identify malicious traffic or unknown malicious traffic that attempts to avoid detection through deformation, thereby improving the detection effect of the protection device.

[0099] Combined with the third possible implementation method in step 503 above, the implementation method of step 504 is that if the confidence level in the target determination result is lower than the confidence level threshold, the protection device determines that the target network traffic is suspicious traffic. If the target determination result indicates abnormality and the confidence level in the target determination result reaches the confidence level threshold, the protection device determines that the target network traffic is attack traffic. If the target determination result indicates normality and the confidence level in the target determination result reaches the confidence level threshold, the protection device determines that the target network traffic is normal traffic.

[0100] Among them, when the target determination result indicates abnormality and the confidence level in the target determination result reaches the confidence level threshold, it means that the reliability of the target network traffic being attack traffic is relatively high. Similarly, when the target determination result indicates normality and the confidence level in the target determination result reaches the confidence level threshold, it means that the reliability of the target network traffic being normal traffic is relatively high. If the confidence level in the target determination result is lower than the confidence level threshold, it means that the target traffic detection model cannot accurately classify the target network traffic. At this time, the protection device regards the target network traffic as suspicious traffic, and this traffic discrimination method has relatively high reliability.

[0101] In this implementation mode, the target traffic detection model can be used not only to filter normal traffic in the network, but also to identify attack traffic in the network. For the network traffic determined by the protection device to be normal traffic according to the determination result of the target traffic detection model, the protection device directly allows it to pass; for the network traffic determined by the protection device to be attack traffic according to the determination result of the target traffic detection model, the protection device directly intercepts it; for the network traffic determined by the protection device to be suspicious traffic according to the determination result of the target traffic detection model, the protection device further performs attack detection based on the feature library on it. Since the protection device does not need to perform attack detection based on the feature library for the attack traffic and normal traffic determined based on the target traffic detection model, the number of network traffic that subsequently needs to be detected by the protection device based on the feature library is greatly reduced, thereby improving the detection efficiency of the protection device. In addition, since the target traffic detection model has the ability to identify attack traffic, it is possible to identify malicious traffic or unknown malicious traffic that attempts to avoid detection through deformation, thereby improving the detection effect of the protection device.

[0102] Step 505: If the target network traffic is suspicious traffic, the protection device matches the target traffic features with the attack features in the feature library and determines whether the target network traffic is attack traffic or normal traffic based on the matching result.

[0103] It should be understood that the feature library is pre-stored (loaded) in the protection device. Optionally, the feature library contains multiple attack features, and the multiple attack features are extracted based on a large number of known malicious traffic or malicious files provided by network security vendors.

[0104] In one embodiment, the implementation of the protection device for matching the target traffic characteristics with the attack characteristics in the characteristic library is that the protection device determines whether the target traffic characteristics contain the attack characteristics in the characteristic library. Specifically, the protection device compares the target traffic characteristics with each attack characteristic in the characteristic library respectively. If a certain attack characteristic in the characteristic library is included in the target traffic characteristics, the attack characteristic is recorded to obtain the matching result. The matching result includes the attack characteristics in the matching, that is, the attack characteristics included in both the target traffic characteristics and the characteristic library. The protection device determines whether the target network traffic is attack traffic based on the attack discrimination strategy according to the attack characteristics in the matching. There are many kinds of attack discrimination strategies, which are difficult to list one by one here. Only two examples are given for illustration. For example, when the number of attack characteristics in the matching exceeds the set threshold, the protection device determines that the target network traffic is aggressive; or when the sequence composed of the attack characteristics in the matching conforms to the predetermined matching rule, the protection device determines that the target network traffic is aggressive. The attack discrimination strategy also includes strategies defined from dimensions such as similarity, probability, and regular expressions. The attack discrimination strategy is specifically selected according to actual needs, and the embodiments of the present application do not make limitations. If the above matching result is empty, that is, the target traffic characteristics do not contain the attack characteristics in the characteristic library, the protection device determines that the target network traffic is normal traffic.

[0105] In the above embodiments, the method in which the protection device matches the target traffic characteristics with the attack characteristics in the characteristic library and determines whether the target network traffic is attack traffic according to the matching result is called the detection method based on characteristic matching.

[0106] For the sake of simple description, the simplest attack discrimination strategy is adopted in the embodiments of the present application, that is, when the number of attack characteristics in the matching is greater than or equal to 1, the protection device determines that the target network traffic is aggressive. Combining with the example in step 502 above, the target traffic characteristic is the URL parsed above: GET / index.php?id=123or 1=1and(select top 1 password from [admin]). The protection device matches this URL with the attack characteristics in the characteristic library. Assuming that the attack characteristic in the characteristic library includes "1=1" (of course, there may be other attack characteristics in the characteristic library), it means that the target traffic characteristics contain the attack characteristic "1=1" in the characteristic library, and the protection device further determines that the target network traffic is attack traffic.

[0107] Further, if in step 504 or step 505 above, the protection device determines that the target network traffic is normal traffic, the protection device releases the target network traffic. Alternatively, if in step 504 or step 505 above, the protection device determines that the target network traffic is attack traffic, the protection device intercepts the target network traffic and discards the packets included in the target network traffic cached locally. The protection device intercepting the target network traffic means stopping forwarding the packets in the target network traffic.

[0108] Optionally, after determining that the target network traffic is attack traffic, the protection device outputs an alarm message through an output device. The alarm message includes the traffic identifier of the target network traffic (such as five-tuple information) for the operation and maintenance personnel to view. In one implementation, after determining that the target network traffic is attack traffic, the protection device first outputs an alarm message through the output device, and after receiving an interception instruction for the target network traffic, the protection device then intercepts the target network traffic.

[0109] In an alternative embodiment of the present application, the protection device determines that the network traffic is normal traffic or suspicious traffic based on the determination result output by the traffic detection model (corresponding to the first possible implementation manner in step 503 and step 504). For example, Figure 6 is a schematic flowchart of a process for a protection device to perform attack detection processing on network traffic provided by an embodiment of the present application. As Figure 6 shown, the protection device first extracts the traffic characteristics of the received network traffic, and then inputs the traffic characteristics of the network traffic into the traffic detection model. If the protection device determines that the network traffic is normal traffic according to the determination result of the traffic detection model, the protection device releases the network traffic. If the protection device determines that the network traffic is suspicious traffic according to the determination result of the traffic detection model, the protection device further matches the traffic characteristics of the network traffic with the attack characteristics in the feature library. If the protection device determines that the network traffic is normal traffic based on the matching result, the protection device releases the network traffic. If the protection device determines that the network traffic is attack traffic based on the matching result, the protection device intercepts the network traffic.

[0110] In another alternative embodiment of the present application, the protection device determines that the network traffic is normal traffic, attack traffic or suspicious traffic based on the determination result output by the traffic detection model (corresponding to the second possible implementation manner or the third possible implementation manner in step 503 and step 504). For example, Figure 7 is another schematic flowchart of a process for a protection device to perform attack detection processing on network traffic provided by an embodiment of the present application. As Figure 7As shown, the protection device first extracts the traffic characteristics of the received network traffic, and then inputs the traffic characteristics of the network traffic into the traffic detection model. If the protection device determines that the network traffic is normal traffic according to the determination result of the traffic detection model, the network traffic is released. If the protection device determines that the network traffic is attack traffic according to the determination result of the traffic detection model, the network traffic is intercepted. If the protection device determines that the network traffic is suspicious traffic according to the determination result of the traffic detection model, the traffic characteristics of the network traffic are further matched with the attack characteristics in the feature library. If the protection device determines that the network traffic is normal traffic based on the matching result, the network traffic is released. If the protection device determines that the network traffic is attack traffic based on the matching result, the network traffic is intercepted.

[0111] In the network attack detection method provided by the embodiments of the present application, by deploying a traffic detection model in the protection device, the traffic detection model first makes a preliminary judgment on the network traffic received by the protection device. After the protection device determines that the network traffic is suspicious traffic based on the determination result of the traffic detection model, the protection device further performs attack detection on the network traffic based on the feature library stored in the protection device. Since most network traffic is normal traffic, through the preliminary screening of network traffic by the traffic detection model, the number of network traffic that needs to be detected by the protection device based on the feature library can be greatly reduced. Since the number of network traffic that needs to be detected by the protection device based on the feature library is greatly reduced, on the one hand, the detection efficiency of the protection device is improved, and on the other hand, the protection device can allocate more processing resources for the detection of a single network traffic, so that the protection device can perform more comprehensive detection on a single network traffic based on the feature library, improving the detection accuracy. In addition, since the attack characteristics included in the feature library are extracted based on known (or common) malicious traffic or malicious files, the detection scheme based on the feature library has poor detection effects on unknown malicious traffic or malicious files. In the embodiments of the present application, through the combined model detection scheme and the feature library detection method, when the traffic detection model has the ability to identify attack traffic, the traffic detection model may also identify malicious traffic or unknown malicious traffic that attempts to avoid detection through deformation, thereby improving the detection effect of the protection device.

[0112] Optionally, the above target traffic detection model is sent by the analysis device to the protection device. For example, after the protection device is launched, the analysis device sends the target traffic detection model to the protection device.

[0113] In one implementation, multiple traffic detection models corresponding one by one to multiple network scenarios are stored in the analysis device. The analysis device obtains the target traffic detection model corresponding to the target network scenario from the multiple traffic detection models according to the target network scenario currently deployed by the protection device, where the target network scenario is any one of the multiple network scenarios. The analysis device sends the target traffic detection model to the protection device. Optionally, the network scenarios are divided according to the type of the internal network protected by the protection device. For example, the bank internal network, the enterprise campus network, and the campus internal network, etc. are different network scenarios. Or, the network scenarios are divided according to the service types provided by the internal network protected by the protection device. For example, the game service, the video service, the file service, etc. are different network scenarios. The embodiments of the present application do not limit the network scenario division method.

[0114] Optionally, the analysis device trains a general traffic detection model based on a general training sample set. The general training sample set includes multiple groups of sample traffic features. The general training sample set is obtained based on the network traffic under multiple network scenarios, that is, the sample traffic features in the communication training sample set come from the network traffic under multiple network scenarios. The analysis device obtains the target training sample set corresponding to the target network scenario, and the target training sample set is obtained based on the network traffic under the target network scenario. The analysis device trains the general traffic detection model with the target training sample set to obtain the target traffic detection model.

[0115] In the embodiments of the present application, the analysis device collects the known normal traffic and attack traffic under multiple network scenarios, extracts the traffic features of a large number of known network traffic as sample traffic features, and generalizes and trains to obtain a general traffic detection model. Then, according to the network scenario actually deployed by the protection device, the analysis device fine-tunes the general traffic detection model with the sample traffic features from the network traffic under the corresponding network scenario, so that the adjusted traffic detection model is more applicable to the current network scenario, thereby improving the detection accuracy of the traffic detection model.

[0116] Optionally, the protection device generates new sample traffic features according to the traffic determination result obtained by matching with the feature library, so as to be used for regularly updating the target traffic detection model and further improving the accuracy of the traffic detection model. Specifically, after the protection device matches the target traffic feature with the attack feature in the feature library to determine that the target network traffic is attack traffic or normal traffic (that is, perform the above step 505), the protection device performs label annotation on the target traffic feature, and uses the target traffic feature with the label as a group of new sample traffic features, and the new sample traffic features are used to update the target traffic detection model.

[0117] An implementation method is that the analysis device updates the target traffic detection model on the protection device. The analysis device uses network telemetry technology to collect new sample traffic characteristics from the protection device in real time, and adds the new sample traffic characteristics to the target training sample set. The analysis device periodically trains the target traffic detection model with the latest target training sample set to obtain an updated target traffic detection model. The analysis device sends the updated target traffic detection model to the protection device. The protection device replaces the local target traffic detection model with the updated target traffic detection model.

[0118] Optionally, the implementation method for the analysis device to collect new sample traffic characteristics from the protection device using network telemetry technology is as follows. The analysis device sends a subscription request to the protection device, and this subscription request is used to subscribe to the sample traffic characteristics generated on the protection device. The protection device periodically pushes the sample traffic characteristics generated during the current period to the analysis device according to the subscription request. Optionally, the subscription request further includes a collection frequency, and the protection device determines the push period according to the collection frequency. For example, deploy the control plane function shown Figure 2 on the analysis device and deploy the data plane function on the protection device. Figure 8 It is an interaction schematic diagram between an analysis device and a protection device provided by an embodiment of the present application. As Figure 8 shown, the analysis device includes a data collection unit and a model management unit. The data collection unit has network telemetry function and data storage function. The data collection unit collects sample traffic characteristics from the protection device through network telemetry. The specific implementation process includes: sending a subscription request to the protection device to request to subscribe to the sample traffic characteristics generated on the protection device; receiving the subscription result reported by the protection device; unpacking the subscription result to obtain the sample traffic characteristics. After that, the data collection unit stores the sample traffic characteristics locally, such as storing them in a local time series database. The model management unit retrains the model according to the sample traffic characteristics collected by the data collection unit from the protection device to obtain an updated traffic detection model (realize model upgrade), and then sends the updated traffic detection model to the protection device. The protection device includes a traffic detection model and a feature library. After receiving network traffic, the protection device first preprocesses the network traffic, including parsing the network traffic and extracting the traffic characteristics of the network traffic. Then, based on the traffic detection model, a first determination is made on the network traffic according to the traffic characteristics of the network traffic. If it is determined that the network traffic is suspicious based on the determination result of the traffic detection model, then the traffic characteristics of the network traffic are matched based on the feature library to make a second determination on the network traffic, so as to determine whether the network traffic is normal traffic or attack traffic. The protection device generates sample traffic characteristics according to the determination result determined by the matching based on the feature library and pushes them to the analysis device.

[0119] In the embodiments of the present application, the analysis device uses network telemetry technology to collect sample traffic characteristics from the protection device. Only one subscription request needs to be sent to the protection device, and the protection device can periodically push the sample traffic characteristics to the analysis device, consuming less processing performance of the analysis device. Alternatively, the analysis device uses the Simple Network Management Protocol (SNMP) to collect sample traffic characteristics from the protection device. The embodiments of the present application do not limit the implementation manner of the analysis device to collect data from the protection device.

[0120] Optionally, the model update period is one day, one week, or two weeks. The embodiments of the present application do not limit the model update period. In the above solution, the analysis device adds the sample traffic characteristics generated by the protection device to the original training sample set, and uses the sample traffic characteristics generated by the protection device and the original training sample set together to update the traffic detection model on the protection device. Alternatively, the analysis device only uses the sample traffic characteristics generated by the protection device in the current period to update the traffic detection model on the protection device, or the analysis device uses all the sample traffic characteristics generated by the protection device in the historical period to update the traffic detection model on the protection device.

[0121] In another implementation manner, the protection device itself updates the target traffic detection model. The protection device periodically uses the new sample traffic characteristics generated by the protection device to train the local target traffic detection model, obtains the updated target traffic detection model, and replaces the local target traffic detection model with the updated target traffic detection model.

[0122] Optionally, the protection device only uses the sample traffic characteristics generated by the protection device in the current period to update the traffic detection model on the protection device, or the protection device uses all the sample traffic characteristics generated by the protection device in the historical period to update the traffic detection model on the protection device.

[0123] The sequence of steps of the above network attack detection method provided by the embodiments of the present application can be appropriately adjusted, and the steps can also be increased or decreased accordingly according to the situation. Any person skilled in the art in the technical field disclosed in the present application can easily think of a changed method, which should be covered by the protection scope of the present application. For example, the analysis device further updates the general traffic detection model according to the sample traffic characteristics generated by the protection device and / or the updated traffic detection model on the protection device, and then updates the traffic detection models corresponding to multiple network scenarios based on the updated general traffic detection model, and improves the model accuracy by continuously enriching the training samples of the model. In one implementation, the traffic detection model on the protection device is iteratively updated in a small cycle, and the general traffic detection model on the analysis device and the traffic detection models corresponding to various network scenarios are iteratively updated in a large cycle.

[0124] The following is an example of the virtual device of the embodiments of the present application.

[0125] For example, Figure 9 is a schematic structural diagram of a protection device 900 provided by the embodiments of the present application. It has Figure 9 The protection device 900 with the shown structure is used to implement the method 500 described in the above embodiments. Optionally, Figure 9 The shown protection device 900 is Figure 1 the protection device in Figure 9 As shown in Figure 9 , the protection device 900 includes but is not limited to a transceiver module 901, a feature extraction module 902, a first determination module 903, and a second determination module 904. Optionally, please continue to refer to

[0126] The transceiver module 901 is used to receive target network traffic. The feature extraction module 902 is used to obtain target traffic characteristics, and the target traffic characteristics are the traffic characteristics of the target network traffic. The first determination module 903 is used to input the target traffic characteristics into the target traffic detection model to obtain the target determination result output by the target traffic detection model, and determine whether the target network traffic is suspicious traffic according to the target determination result. The target traffic detection model is trained based on a target training sample set, and the target training sample set includes multiple groups of sample traffic characteristics, and each group of sample traffic characteristics is respectively labeled with a normal label or an abnormal label. The sample traffic characteristics labeled with a normal label come from known normal traffic, and the sample traffic characteristics labeled with an abnormal label come from known attack traffic. The second determination module 904 is used to, if the target network traffic is suspicious traffic, match the target traffic characteristics with the attack characteristics in the feature library, and determine whether the target network traffic is attack traffic or normal traffic based on the matching result.

[0127] Here, for the implementation processes of the transceiver module 901, the feature extraction module 902, the first determination module 903, and the second determination module 904, please refer to the descriptions in the foregoing method embodiments. For example, the transceiver module 901 receives the target network traffic by using step 501 in method 500. The feature extraction module 902 obtains the target traffic features by using step 502 in method 500. The first determination module 903 determines whether the target network traffic is suspicious traffic by using steps 503 and 504 in method 500. The second determination module 904 matches the target traffic features with the attack features in the feature library by using step 505 in method 500, and determines that the target network traffic is attack traffic or normal traffic based on the matching result. The embodiments of this application will not be described repeatedly herein.

[0128] Optionally, the determination result output by the target traffic detection model indicates normal or abnormal. The first determination module 903 is specifically configured to: if the target determination result indicates abnormal, determine that the target network traffic is suspicious traffic; if the target determination result indicates normal, determine that the target network traffic is normal traffic.

[0129] Or, the determination result output by the target traffic detection model indicates normal, abnormal, or suspicious. The first determination module 903 is specifically configured to: if the target determination result indicates suspicious, determine that the target network traffic is suspicious traffic; if the target determination result indicates abnormal, determine that the target network traffic is attack traffic; if the target determination result indicates normal, determine that the target network traffic is normal traffic.

[0130] Optionally, if the confidence level of the prediction result of the target traffic detection model for the input traffic features reaches the confidence level threshold, the determination result output by the target traffic detection model is the prediction result. If the confidence level of the prediction result of the target traffic detection model for the input traffic features is lower than the confidence level threshold, the determination result output by the target traffic detection model indicates suspicious; wherein, the prediction result indicates normal or abnormal.

[0131] Or, the determination result output by the target traffic detection model indicates normal or abnormal, and the determination result further includes a confidence level. The first determination module 903 is specifically configured to: if the confidence level in the target determination result is lower than the confidence level threshold, determine that the target network traffic is suspicious traffic; if the target determination result indicates abnormal and the confidence level in the target determination result reaches the confidence level threshold, determine that the target network traffic is attack traffic; if the target determination result indicates normal and the confidence level in the target determination result reaches the confidence level threshold, determine that the target network traffic is normal traffic.

[0132] Optionally, the sample generation module 905 is configured to, after matching the target traffic feature with the attack features in the feature library and determining whether the target network traffic is attack traffic or normal traffic based on the matching result, label the target traffic feature, and use the target traffic feature labeled with the label as a new set of sample traffic features for updating the target traffic detection model.

[0133] Optionally, the model update module 906 is configured to periodically train the local target traffic detection model with the new sample traffic features generated by the protection device, obtain the updated target traffic detection model, and replace the local target traffic detection model with the updated target traffic detection model.

[0134] Optionally, the transceiver module 901 is further configured to allow the target network traffic to pass if the target network traffic is normal traffic, and intercept the target network traffic if the target network traffic is attack traffic.

[0135] Appendix Figure 9 The described device embodiments are merely illustrative. For example, the division of the modules is only a logical function division. In actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. In each embodiment of the present application, the functional modules may be integrated in a processing module, or each module may exist physically alone, or two or more modules may be integrated in one module. Appendix Figure 9 Among them, the above-mentioned various modules may be implemented in the form of hardware or in the form of software functional units. For example, when implemented in software, the above-mentioned feature extraction module 902, the first determination module 903, the second determination module 904, the sample generation module 905, and the model update module 906 may be Figure 3 software functional modules generated after the processor 301 in Appendix Figure 9 reads the program code stored in the memory 306. Figure 3 Among them, the above-mentioned various modules may also be separately implemented by different hardware of the protection device. For example, the feature extraction module 902, the first determination module 903, the second determination module 904, the sample generation module 905, and the model update module 906 are implemented by Figure 3The remaining processing resources in the network interface 303 and the processor 301 (such as other cores in a multi-core processor) complete the task. Obviously, the above functional modules can also be implemented in a combination of software and hardware. For example, the transceiver module 901 is implemented by a hardware programmable device, while the feature extraction module 902, the first determination module 903, the second determination module 904, the sample generation module 905, and the model update module 906 are software functional modules generated after the processor reads the program instructions stored in the memory.

[0136] For example, Figure 10 is a schematic structural diagram of an analysis device 1000 provided by an embodiment of the present application. It has Figure 10 The analysis device 1000 with the structure shown is used to implement the actions performed by the analysis device in the above embodiments. Optionally, Figure 10 The analysis device 1000 shown is Figure 1 the analysis device in Figure 10 As shown, the analysis device 1000 includes, but is not limited to, a model acquisition module 1001 and a transceiver module 1002. Optionally, please continue to refer to Figure 10 and the analysis device 1000 may further include one or more of a model generation module 1003, a data acquisition module 1004, or a model update module 1005.

[0137] The model acquisition module 1001 is used to obtain a target traffic detection model corresponding to the target network scenario from multiple traffic detection models according to the target network scenario currently deployed by the protection device. Multiple traffic detection models corresponding one-to-one to multiple network scenarios are stored in the analysis device. The target network scenario is any one of the multiple network scenarios. Among them, the target traffic detection model is trained based on a target training sample set, and the target training sample set includes multiple groups of sample traffic features. Each group of sample traffic features is respectively labeled with a normal label or an abnormal label. The sample traffic features labeled with a normal label come from known normal traffic, and the sample traffic features labeled with an abnormal label come from known attack traffic. The transceiver module 1002 is used to send the target traffic detection model to the protection device.

[0138] Optionally, the model generation module 1003 is used to: train a general traffic detection model based on a general training sample set, where the general training sample set includes multiple groups of sample traffic features and is based on network traffic under multiple network scenarios; obtain a target training sample set corresponding to the target network scenario, where the target training sample set is based on network traffic under the target network scenario; and train the general traffic detection model with the target training sample set to obtain the target traffic detection model.

[0139] Optionally, the data acquisition module 1004 is configured to collect new sample traffic characteristics in real time from the protection device by using network telemetry technology, and add the new sample traffic characteristics to the target training sample set. The model update module 1005 is configured to periodically train the target traffic detection model by using the latest target training sample set to obtain an updated target traffic detection model. The transceiver module 1002 is further configured to send the updated target traffic detection model to the protection device.

[0140] Appendix Figure 10 The described device embodiments are merely illustrative. For example, the division of the modules is only a logical function division. In actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. In each embodiment of the present application, the functional modules may be integrated in a processing module, or each module may exist physically alone, or two or more modules may be integrated in one module. Appendix Figure 10 Among them, the above-mentioned various modules may be implemented in the form of hardware, or in the form of software functional units, or in a combination of software and hardware.

[0141] The embodiment of the present application further provides a protection device, including: a memory, a network interface, and at least one processor. The memory is used to store program instructions. After the at least one processor reads the program instructions stored in the memory, the protection device is caused to perform the actions performed by the protection device in the above method embodiment. Optionally, the hardware structure of the protection device is as Figure 3 shown.

[0142] The embodiment of the present application further provides an analysis device, including: a memory, a network interface, and at least one processor. The memory is used to store program instructions. After the at least one processor reads the program instructions stored in the memory, the analysis device is caused to perform the actions performed by the analysis device in the above method embodiment. Optionally, the hardware structure of the analysis device is as Figure 4 shown.

[0143] The embodiment of the present application further provides a protection system, including a protection device. The protection device is used to perform the actions performed by the protection device in the above method embodiment. Optionally, the protection system further includes an analysis device, and the analysis device is used to perform the actions performed by the analysis device in the above method embodiment. Optionally, the structure of the protection system is, for example, referred to Figure 1 .

[0144] The embodiments of this application also provide a computer-readable storage medium, on which instructions are stored. When the instructions are executed by a processor, the actions performed by the protection device or the analysis device in the above method embodiments are implemented.

[0145] The embodiments of this application also provide a computer program product, including a computer program. When the computer program is executed by a processor, the actions performed by the protection device or the analysis device in the above method embodiments are implemented.

[0146] In the embodiments of this application, the term "traffic" also refers to "network traffic" or "data traffic". Traffic refers to the data transmitted through a network at a given point in time. For example, the traffic received by a device at time point T refers to all the packets received by the device at time point T.

[0147] Each embodiment in this specification is described in a progressive manner. The same or similar parts among the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments.

[0148] In the description of the embodiments of this application, unless otherwise specified, the meaning of "at least one" is one or more. The meaning of "a plurality" is two or more.

[0149] A referring to B means that A is the same as B or A is a simple deformation of B.

[0150] The term "and / or" in this application merely describes the association relationship of associated objects, indicating three relationships. For example, A and / or B means: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0151] Optionally, in the above embodiments, it is implemented in whole or in part by software, hardware, firmware, or any combination thereof. Optionally, when implemented using software, it is implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions described in the embodiments of the present application are generated in whole or in part. Optionally, the computer is a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. Optionally, the computer instructions are stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center by wire (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.). Optionally, the computer-readable storage medium is any available medium that the computer can access, or a data storage device such as a server or data center that includes one or more integrated available media. Optionally, the available medium is a magnetic medium (such as a floppy disk, hard disk, magnetic tape), an optical medium (such as a digital video disk (DVD)), or a semiconductor medium (such as a solid state disk (SSD)), etc.

[0152] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements on some of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A network attack detection method, characterized in that, The method is applied to a protection system, which includes protection devices, and the method comprises: The protection device receives target network traffic; The protection device obtains target traffic characteristics, which are the traffic characteristics of the target network traffic; The protection device inputs the target traffic characteristics into a target traffic detection model to obtain a target determination result output by the target traffic detection model. The target traffic detection model is trained based on a target training sample set, which includes multiple groups of sample traffic characteristics. Each group of sample traffic characteristics is respectively labeled with a normal label or an abnormal label. The sample traffic characteristics labeled with the normal label come from known normal traffic, and the sample traffic characteristics labeled with the abnormal label come from known attack traffic; The protection device determines whether the target network traffic is suspicious traffic according to the target determination result; If the target network traffic is suspicious traffic, the protection device matches the target traffic characteristics with the attack characteristics in the feature library and determines whether the target network traffic is attack traffic or normal traffic based on the matching result.

2. The method according to claim 1, wherein The determination result output by the target traffic detection model indicates normal or abnormal. The protection device determines whether the target network traffic is suspicious traffic according to the target determination result, including: If the target determination result indicates abnormal, the protection device determines that the target network traffic is suspicious traffic; If the target determination result indicates normal, the protection device determines that the target network traffic is normal traffic.

3. The method according to claim 1, wherein The determination result output by the target traffic detection model indicates normal, abnormal or suspicious. The protection device determines whether the target network traffic is suspicious traffic according to the target determination result, including: If the target determination result indicates suspicious, the protection device determines that the target network traffic is suspicious traffic; If the target determination result indicates abnormal, the protection device determines that the target network traffic is attack traffic; If the target determination result indicates normal, the protection device determines that the target network traffic is normal traffic.

4. The method according to claim 3, wherein If the confidence level of the prediction result of the target traffic detection model for the input traffic characteristics reaches the confidence level threshold, the determination result output by the target traffic detection model is the prediction result; If the confidence level of the prediction result of the target traffic detection model for the input traffic characteristics is lower than the confidence level threshold, the determination result output by the target traffic detection model indicates suspicious; wherein, the prediction result indicates normal or abnormal.

5. The method according to claim 1, characterized in that, The determination result output by the target traffic detection model indicates normal or abnormal, and the determination result further includes a confidence level. The protection device determines whether the target network traffic is suspicious traffic according to the target determination result, including: If the confidence level in the target determination result is lower than the confidence level threshold, the protection device determines that the target network traffic is suspicious traffic; If the target determination result indicates abnormal and the confidence level in the target determination result reaches the confidence level threshold, the protection device determines that the target network traffic is attack traffic; If the target determination result indicates normal and the confidence level in the target determination result reaches the confidence level threshold, the protection device determines that the target network traffic is normal traffic.

6. The method according to any one of claims 1 to 5, characterized in that The protection system further includes an analysis device, in which multiple traffic detection models corresponding one by one to multiple network scenarios are stored. The method further includes: According to the target network scenario currently deployed by the protection device, the analysis device obtains the target traffic detection model corresponding to the target network scenario from the multiple traffic detection models, and the target network scenario is any one of the multiple network scenarios; The analysis device sends the target traffic detection model to the protection device.

7. The method according to claim 6, wherein The method further includes: The analysis device trains a general traffic detection model based on a general training sample set, the general training sample set includes multiple groups of sample traffic features, and the general training sample set is obtained based on the network traffic under the multiple network scenarios; The analysis device obtains the target training sample set corresponding to the target network scenario, and the target training sample set is obtained based on the network traffic under the target network scenario; The analysis device uses the target training sample set to train the general traffic detection model to obtain the target traffic detection model.

8. The method according to claim 6 or 7, characterized in that After the protection device matches the target traffic features with the attack features in the feature library and determines that the target network traffic is attack traffic or normal traffic based on the matching result, the method further includes: The protection device performs label annotation on the target traffic features, and uses the target traffic features with labels as a new group of sample traffic features, and the new sample traffic features are used to update the target traffic detection model.

9. The method according to claim 8, wherein The method further includes: The analysis device uses network telemetry technology to collect the new sample traffic features from the protection device in real time, and adds the new sample traffic features to the target training sample set; The analysis device periodically uses the latest target training sample set to train the target traffic detection model to obtain an updated target traffic detection model; The analysis device sends the updated target traffic detection model to the protection device; The protection device replaces the local target traffic detection model with the updated target traffic detection model.

10. The method according to claim 8, wherein The method further includes: The protection device periodically uses the new sample traffic features generated by the protection device to train the local target traffic detection model to obtain an updated target traffic detection model, and replaces the local target traffic detection model with the updated target traffic detection model.

11. The method according to any one of claims 1 to 10, characterized in that, The method further includes: If the target network traffic is normal traffic, the protection device releases the target network traffic; If the target network traffic is attack traffic, the protection device intercepts the target network traffic.

12. A protective device, characterized in that, Including: A memory, a network interface, and at least one processor, The memory is used to store program instructions, After the at least one processor reads the program instructions stored in the memory, the protection device is caused to perform the following operations: Receive target network traffic; Obtain the target traffic characteristics, where the target traffic characteristics are the traffic characteristics of the target network traffic; Input the target traffic characteristics into the target traffic detection model to obtain the target determination result output by the target traffic detection model. The target traffic detection model is trained based on a target training sample set, and the target training sample set includes multiple groups of sample traffic characteristics. Each group of sample traffic characteristics is respectively labeled with a normal label or an abnormal label. The sample traffic characteristics labeled with the normal label come from known normal traffic, and the sample traffic characteristics labeled with the abnormal label come from known attack traffic; Determine whether the target network traffic is suspicious traffic according to the target determination result; If the target network traffic is suspicious traffic, match the target traffic characteristics with the attack characteristics in the feature library, and determine whether the target network traffic is attack traffic or normal traffic based on the matching result.

13. The protective device according to claim 12, characterized in that, The determination result output by the target traffic detection model indicates normal or abnormal. After the program instruction is read by the at least one processor, the protection device is caused to perform the following operations: If the target determination result indicates abnormal, determine that the target network traffic is suspicious traffic; If the target determination result indicates normal, determine that the target network traffic is normal traffic.

14. The protective device according to claim 12, wherein The determination result output by the target traffic detection model indicates normal, abnormal or suspicious. After the program instruction is read by the at least one processor, the protection device is caused to perform the following operations: If the target determination result indicates suspicious, determine that the target network traffic is suspicious traffic; If the target determination result indicates abnormal, determine that the target network traffic is attack traffic; If the target determination result indicates normal, determine that the target network traffic is normal traffic.

15. The protective device according to claim 14, characterized in that, If the confidence level of the prediction result of the target traffic detection model for the input traffic characteristics reaches the confidence level threshold, the determination result output by the target traffic detection model is the prediction result; If the confidence level of the prediction result of the target traffic detection model for the input traffic characteristics is lower than the confidence level threshold, the determination result output by the target traffic detection model indicates suspicious; wherein, the prediction result indicates normal or abnormal.

16. The protective device according to claim 12, wherein, The determination result output by the target traffic detection model indicates normal or abnormal, and the determination result further includes a confidence level. After the program instruction is read by the at least one processor, the protection device is caused to perform the following operations: If the confidence level in the target determination result is lower than the confidence level threshold, determine that the target network traffic is suspicious traffic; If the target determination result indicates abnormal and the confidence level in the target determination result reaches the confidence level threshold, determine that the target network traffic is attack traffic; If the target determination result indicates normal and the confidence level in the target determination result reaches the confidence level threshold, determine that the target network traffic is normal traffic.

17. The protective device according to any one of claims 12 to 16, characterized in that, After the program instruction is read by the at least one processor, the protection device is further caused to perform the following operations: After matching the target traffic feature with the attack features in the feature library and determining whether the target network traffic is attack traffic or normal traffic based on the matching result, label the target traffic feature, and use the target traffic feature with the label as a new set of sample traffic features, where the new sample traffic features are used to update the target traffic detection model.

18. An analysis device, characterized in that, Including: A memory, a network interface, and at least one processor, The memory is used to store program instructions, After the at least one processor reads the program instructions saved in the memory, the analysis device is caused to perform the following operations: According to the target network scenario currently deployed by the protection device, obtain the target traffic detection model corresponding to the target network scenario from multiple traffic detection models. The analysis device stores the multiple traffic detection models corresponding one by one to multiple network scenarios. The target network scenario is any one of the multiple network scenarios. Among them, the target traffic detection model is trained based on a target training sample set, and the target training sample set includes multiple sets of sample traffic features. Each set of sample traffic features is labeled with a normal label or an abnormal label. The sample traffic features labeled with the normal label come from known normal traffic, and the sample traffic features labeled with the abnormal label come from known attack traffic; Send the target traffic detection model to the protection device.

19. The analysis device according to claim 18, characterized in that, After the program instructions are read by the at least one processor, the analysis device is further caused to perform the following operations: Train a general traffic detection model based on a general training sample set, where the general training sample set includes multiple sets of sample traffic features, and the general training sample set is obtained based on the network traffic under the multiple network scenarios; Obtain the target training sample set corresponding to the target network scenario, where the target training sample set is obtained based on the network traffic under the target network scenario; Train the general traffic detection model with the target training sample set to obtain the target traffic detection model.

20. The analysis device according to claim 19, characterized in that, After the program instructions are read by the at least one processor, the analysis device is further caused to perform the following operations: Use network telemetry technology to collect new sample traffic features in real time from the protection device, and add the new sample traffic features to the target training sample set; Periodically train the target traffic detection model with the latest target training sample set to obtain an updated target traffic detection model; Send the updated target traffic detection model to the protection device.

21. A protection system, characterized in that, The protection system includes a protection device, and the protection device is used to perform the actions performed by the protection device in any one of the methods according to claims 1 to 11.

22. The protection system according to claim 21, wherein, The protection system further includes an analysis device, and the analysis device is used to perform the actions performed by the analysis device in any one of the methods according to claims 6 to 9.

23. A computer-readable storage medium, characterized in that, Instructions are stored on the computer-readable storage medium, and when the instructions are executed by the processor, the actions performed by the protection device in any one of the methods according to claims 1 to 11 are implemented, or the actions performed by the analysis device in any one of the methods according to claims 6 to 9 are implemented.

Images