Network attack tracing and defending method, device and system

Abstract

The invention relates to the technical field of network security, in particular to a network attack tracing and defending method, device and system, and the method comprises the steps: capturing network flow data through a network monitoring tool in real time; traffic features are extracted through the multi-dimensional features based on the network traffic data; analyzing the historical traffic data based on a statistical rule, setting a threshold value of each traffic feature, and forming a plurality of typical access modes; screening abnormal traffic based on the plurality of typical access modes; discovering a second abnormal behavior feature in the abnormal traffic through a statistical method; identifying an abnormal traffic mode based on the second abnormal behavior feature in combination with the typical access mode; analyzing the abnormal traffic mode to determine position information of a potential attack source; and dynamically adjusting a bandwidth allocation strategy based on the position information. According to the method, the influence caused by attacks can be effectively relieved, for example, the bandwidth of suspected malicious traffic is limited, so that network resources are prevented from being influenced by the attacks. The method is suitable for high-concurrency scenes needing low-delay response.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network attack tracing and defense method, device, and system. Background Art

[0002] Cyberattack tracing and defense refers to the process of analyzing cyberattack incidents, tracking their source, and implementing measures to prevent similar attacks in the cybersecurity field. This involves using advanced technologies and tools to monitor the network environment, identify potential threats, and conduct in-depth analysis of attack behavior to determine its source, methods, and intent. This approach not only enables effective response to current attacks but also provides a foundation for building a more robust defense system, thereby improving overall cybersecurity and protecting critical information infrastructure from harm.

[0003] Existing network attack tracing methods are not convenient for quickly finding the attack location based on the attack pattern, which delays processing time and increases losses. Summary of the Invention

[0004] The purpose of the present invention is to provide a network attack tracing and defense method, device, and system, which aims to effectively mitigate the impact of attacks, such as by limiting the bandwidth of suspected malicious traffic, thereby protecting network resources from the impact of attacks.

[0005] To achieve the above-mentioned purpose, in a first aspect, the present invention provides a network attack tracing and defense method, comprising: using a network monitoring tool to capture network traffic data in real time;

[0006] Extracting traffic features based on network traffic data through multi-dimensional features, wherein the traffic features include packet size, protocol type, source and destination IP addresses, port numbers, timestamps, and traffic rates;

[0007] Analyze historical traffic data based on statistical rules to set thresholds for various traffic characteristics and form multiple typical access patterns;

[0008] Filter abnormal traffic based on multiple typical access patterns;

[0009] Discover the second abnormal behavior feature in abnormal traffic through statistical methods;

[0010] Identify abnormal traffic patterns based on the second abnormal behavior feature combined with typical access patterns;

[0011] Analyzing the abnormal traffic pattern to determine the location information of the potential attack source;

[0012] The bandwidth allocation strategy is dynamically adjusted based on the location information.

[0013] After dynamically adjusting the bandwidth allocation strategy based on the location information, the method further includes: uploading the abnormal traffic pattern to a host computer for sharing.

[0014] The specific steps of discovering abnormal behavior characteristics in abnormal traffic by statistical methods include:

[0015] Remove incomplete and erroneous data from abnormal traffic data;

[0016] Normalize the abnormal traffic data after removing the erroneous data to obtain the data to be processed;

[0017] The data to be processed is processed by calculating the mean, variance and distribution to obtain abnormal behavior characteristics.

[0018] The step of analyzing the abnormal traffic pattern to determine the location information of a potential attack source includes:

[0019] Extracting location-related information from abnormal traffic data packets, the location-related information including source IP address, destination IP address, protocol type, and port number;

[0020] The DBSCAN clustering algorithm is used to find the correlation of IP addresses in abnormal traffic packets;

[0021] Utilize IP geolocation databases to convert source IP addresses into physical locations;

[0022] Use the Traceroute tool to send probe packets to the suspected attack source from multiple locations, record information about each router, and compare the routing paths at different locations to narrow down the actual physical location of the attack source.

[0023] The specific steps of using the DBSCAN clustering algorithm to find the correlation of IP addresses in abnormal traffic data packets include:

[0024] Represent each IP address as a feature vector based on location-related information;

[0025] Set the neighborhood radius and minimum number of samples, and run the DBSCAN algorithm to obtain the clustering results;

[0026] The relevance ranking is obtained based on the clustering results.

[0027] The specific steps of dynamically adjusting the bandwidth allocation strategy based on the location information include:

[0028] Prioritize different applications based on business needs and service types;

[0029] Control bandwidth access priority in corresponding areas of IP segments based on different priorities;

[0030] Dynamically adjust the bandwidth allocation ratio of each area according to real-time traffic conditions.

[0031] The specific steps of dynamically adjusting the bandwidth allocation ratio of each area according to the real-time traffic status include:

[0032] Collect real-time traffic data from various regions;

[0033] Assigning initial priorities to each region;

[0034] Dynamically adjust the bandwidth ratio of each region based on real-time traffic data.

[0035] In a second aspect, the present invention further provides a network attack tracing and defense device, including a network traffic acquisition module, a traffic feature extraction module, a typical model recognition module, an abnormal traffic screening module, a second abnormal feature extraction module, an abnormality confirmation module, a location information acquisition module, and a bandwidth adjustment module:

[0036] The network traffic acquisition module is used to capture network traffic data using a network monitoring tool;

[0037] The traffic feature extraction module is used to extract traffic features based on network traffic data, wherein the traffic features include packet size, protocol type, source and destination IP addresses, port numbers, timestamps, and traffic rates;

[0038] The typical model identification module is used to analyze historical traffic data to set thresholds for various traffic characteristics and form multiple typical access patterns;

[0039] The abnormal traffic screening module is used to screen abnormal traffic based on multiple typical access patterns;

[0040] The second abnormal feature extraction module is used to discover the second abnormal behavior feature in the abnormal traffic through a statistical method;

[0041] The anomaly confirmation module is used to identify an abnormal traffic pattern based on the second abnormal behavior feature in combination with a typical access pattern;

[0042] The location information acquisition module is used to analyze the abnormal traffic pattern to determine the location information of the potential attack source;

[0043] The bandwidth adjustment module is configured to dynamically adjust the bandwidth allocation strategy based on the location information.

[0044] In a third aspect, the present invention also provides a network attack tracing and defense system, including the aforementioned network attack tracing and defense device.

[0045] The present invention provides a network attack tracing and defense method, device, and system that uses efficient network monitoring tools to capture network traffic data in real time. These tools meticulously monitor all data flows in and out of the network, providing essential data support for subsequent analysis. Based on the captured network traffic data, a variety of key traffic characteristics are extracted, including but not limited to packet size, protocol type, source and destination IP addresses, port numbers, timestamps, and traffic rates. These characteristics are crucial for understanding network behavior patterns and provide a basis for identifying anomalous activity. Subsequently, through in-depth analysis of historical traffic data, thresholds are set for each traffic characteristic, and multiple typical access patterns are generated based on these thresholds. Based on these typical access patterns, anomalous traffic is further screened. The differences between current network traffic and the typical patterns are compared to identify anomalous traffic that may indicate malicious activity. To more accurately locate potential threats, the present method also uses statistical methods to identify a second level of abnormal behavior characteristics within the identified anomalous traffic. This multi-level analysis effectively reduces false positives and improves detection accuracy. Next, the second level of abnormal behavior characteristics is combined with the previously established typical access patterns to identify specific anomalous traffic patterns. This method can not only identify the existence of an attack, but also help understand the method and intention of the attack. Once the abnormal traffic patterns are determined, these patterns are analyzed to determine the location information of potential attack sources. This process may involve complex network tracking technology to locate the source of the attack as accurately as possible. Based on the location information obtained, the bandwidth allocation strategy is dynamically adjusted. This measure can effectively alleviate the impact of the attack, for example, by limiting the bandwidth of suspected malicious traffic, thereby protecting network resources from the impact of the attack. In addition, this flexible response mechanism also improves the security and stability of the entire network. The present invention also has the ability to integrate the efficiency of rule-driven and the generalization ability of data-driven models for unknown threats, and achieves a balance between security protection and network performance through dynamic resource allocation. The algorithm is suitable for scenarios with high concurrency and low-latency response requirements, such as cloud platforms defending against DDoS attacks, intercepting abnormal behavior of IoT device groups, or blocking data theft in real time on corporate intranets, and other complex network environments that are sensitive to both detection efficiency and accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0047] Figure 1 It is a flow chart of a network attack tracing and defense method of the present invention.

[0048] Figure 2 This is a flow chart of the present invention for discovering abnormal behavior characteristics in abnormal traffic through statistical methods.

[0049] Figure 3 It is a flow chart of analyzing the abnormal traffic pattern to determine potential attack sources according to the present invention.

[0050] Figure 4 The present invention is a flow chart of using the DBSCAN clustering algorithm to find the relevance of IP addresses in abnormal traffic data packets.

[0051] Figure 5 This is a flow chart of the present invention for dynamically adjusting the bandwidth allocation strategy based on the location information.

[0052] Figure 6 This is a flow chart of the present invention for dynamically adjusting the bandwidth allocation ratio of each area according to real-time traffic conditions. DETAILED DESCRIPTION

[0053] The following describes embodiments of the present invention in detail, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and are not to be construed as limiting the present invention.

[0054] First embodiment

[0055] See also Figures 1 to 6 The present invention provides a network attack tracing and defense method, comprising:

[0056] S101 uses network monitoring tools to capture network traffic data in real time;

[0057] Network monitoring tools are essential for capturing and recording network traffic data. These tools can capture packets in the network in real time or extract historical traffic information from log files.

[0058] You can use tcpdump to capture network traffic data. First, run the tcpdump command on a server or network device, specifying the network interface (such as eth0), and save the captured data to a file. For example, you could use the command to capture all traffic passing through the eth0 interface and save it as a file named network_traffic.pcap. This will create a complete network traffic data set for subsequent analysis.

[0059] S102 extracts traffic features based on the network traffic data through multi-dimensional features, wherein the traffic features include packet size, protocol type, source and destination IP addresses, port numbers, timestamps, and traffic rates;

[0060] After capturing network traffic data, the next step is to extract key features from this data. These features can describe traffic behavior patterns and help understand normal and abnormal behavior in the network. Common traffic features include:

[0061] Packet size: The number of bytes in each packet, reflecting the scale of traffic.

[0062] Protocol type: such as TCP, UDP, ICMP, etc., used to determine the purpose of traffic.

[0063] Source and destination IP addresses: The sender and receiver of traffic, used to identify the communicating parties.

[0064] Port number: such as HTTP (80), HTTPS (443), etc., used to determine the service type.

[0065] Timestamp: The time information of the data packet, used to analyze the time distribution of traffic.

[0066] Traffic rate: The number of bytes or packets transmitted per unit time, used to assess traffic intensity.

[0067] The process of extracting these features usually involves parsing the contents of the data packet. For example, using specialized tools (such as Scapy or Zeek) to read the captured traffic file and analyze the header information of each packet one by one to extract the required features.

[0068] For each data packet, you can extract its source IP address, destination IP address, protocol type, packet size, timestamp and other information. For example, a data packet contains the following features:

[0069] Source IP address: 192.168.1.1

[0070] Destination IP address: 8.8.8.8

[0071] Protocol type: TCP

[0072] Packet size: 1500 bytes

[0073] Timestamp: 2025-03-27 16:54:00

[0074] In this way, traffic data is converted into a structured feature list, laying the foundation for subsequent analysis.

[0075] S103 analyzes historical traffic data based on statistical rules to set thresholds for various traffic characteristics and form multiple typical access patterns;

[0076] After extracting traffic characteristics, it is necessary to perform statistical analysis on historical traffic data to set reasonable thresholds and form multiple typical access patterns. The goal of this step is to define what is "normal" traffic behavior and what is "abnormal" traffic behavior.

[0077] Specifically, statistics such as mean, standard deviation, maximum, minimum, and percentile can be calculated for each traffic feature. Thresholds can then be set based on these statistics. For example, for packet size, a range can be set (such as the mean plus or minus two standard deviations), and traffic outside this range is considered abnormal.

[0078] In addition, traffic can be divided into multiple typical access patterns through cluster analysis or other methods. For example:

[0079] Normal user behavior: Traffic is small, protocols are mainly HTTP and HTTPS, and communication targets are concentrated on a few IP addresses.

[0080] Inter-server communication: The traffic is large, the protocol type is a custom protocol, and the communication objects are relatively fixed.

[0081] Abnormal scanning behavior: high traffic rate, diverse protocol types, and a large number of communication objects.

[0082] Assume that the features of historical traffic data have been extracted and the statistics of packet size have been calculated:

[0083] Average: 1000 bytes

[0084] Standard deviation: 200 bytes

[0085] Maximum value: 1500 bytes

[0086] Minimum: 500 bytes

[0087] Based on these statistics, we can set the packet size threshold to be between 600 and 1400 bytes (i.e., the mean plus or minus two standard deviations). Traffic outside this range is considered abnormal.

[0088] Furthermore, historical data analysis can be used to identify multiple typical access patterns. For example, if a large portion of traffic is concentrated within certain time periods and with a small number of communicating partners, this traffic can be classified as "normal user behavior." If a particular traffic rate is significantly higher than other traffic, this can be classified as "abnormal scanning behavior."

[0089] S104 filters abnormal traffic based on multiple typical access patterns;

[0090] After forming multiple typical access patterns, real-time traffic data can be compared with these patterns to filter out traffic that does not conform to normal patterns. The core idea of this method is that if the characteristics of a certain traffic deviate from the normal threshold range or do not belong to any typical pattern, it is considered an anomaly.

[0091] For example, if the packet size of a certain flow is found to exceed the set threshold range, or the number of its communication partners is significantly higher than the normal pattern, then this flow is an anomaly.

[0092] Assume that a normal pattern has been defined, where the packet size ranges from 600 to 1400 bytes and the number of communicating parties ranges from 1 to 10. Now, a live traffic data is captured with the following characteristics:

[0093] Packet size: 1800 bytes

[0094] Number of communication partners: 50

[0095] Clearly, the packet size of this traffic is outside the normal range, and the number of communication partners is much higher than normal. Therefore, we can mark this traffic as abnormal and further investigate its source and destination.

[0096] S105 discovers a second abnormal behavior feature in the abnormal traffic by using a statistical method;

[0097] The specific steps include:

[0098] S201 removes incomplete error data from abnormal traffic data;

[0099] Before processing any data, you first need to ensure the quality of the dataset. This step primarily involves cleaning the data, removing records that contain missing values, are formatted incorrectly, or are clearly inappropriate (e.g., with negative data packet sizes). This prevents subsequent analysis from being biased by data quality issues.

[0100] You have an anomalous traffic dataset containing incomplete or erroneous data items. This data needs to be inspected and cleaned. Check whether any fields are empty (for example, missing source or destination IP addresses). Verify that all numeric fields (such as packet size and timestamp) are valid and contain no negative or other illogical values. For records with missing values, you can decide whether to delete them or fill in the missing values using a reasonable method (such as the average value) based on business needs.

[0101] S202 normalizes the abnormal traffic data after removing the erroneous data to obtain data to be processed;

[0102] Normalization involves converting data of different scales to the same scale for easier comparison and analysis. In network traffic data, different features (such as packet size and communication frequency) often have very different numerical ranges. Without normalization, certain features can have a disproportionate impact on the analysis results. Common normalization methods include min-max normalization and Z-score normalization.

[0103] For cleaned abnormal traffic data, one of two common methods can be used for normalization: linearly map the value of each feature to the interval [0, 1]. The formula is (x-min) / (max-min), where x is the original value, min and max are the minimum and maximum values of the feature, respectively.

[0104] S203 processes the data to be processed by calculating the mean value, variance and distribution to obtain abnormal behavior characteristics.

[0105] In this step, statistical methods are used to explore patterns and structure within the data. Calculating the mean, variance, and distribution of the data can help identify potential anomalous behavior. These statistics not only reveal overall trends in the data but also help identify deviations from normal behavior.

[0106] Now that the abnormal traffic data has been normalized, you can analyze it by following these steps: 1. Understand the typical values for each feature. For example, calculating the average of all packet sizes can provide an idea of "normal" packet sizes. 2. Measure the dispersion of the data around the average. High variance indicates high volatility, which is an indicator of abnormal behavior. 3. Use visualization tools such as histograms or box plots to show the distribution of the data. This helps to visually identify the most common values and the extremes.

[0107] Based on these statistics, we can define rules to identify the second type of abnormal behavior. For example, if the packet size of a particular IP address is significantly higher than the mean plus two standard deviations, the behavior of that IP address is considered anomalous. Similarly, if the communication frequency within a certain period is significantly lower than normal, this is also a signal worthy of attention.

[0108] S106 identifies an abnormal traffic pattern based on the second abnormal behavior feature and the typical access pattern;

[0109] Typical access patterns are benchmarks of normal behavior, determined through statistical analysis of historical traffic data. For example, normal user behavior is characterized by small-scale, low-frequency communications, while inter-server communication is characterized by large-scale, high-frequency data exchanges. These patterns provide a "normal" reference framework; any deviation from this framework is considered abnormal.

[0110] However, relying solely on typical access patterns cannot capture some subtle or complex abnormal behaviors. For example, some attackers may mimic the communication patterns of normal users but conceal their true intentions through subtle differences in characteristics (such as unusually low-frequency activities or abnormal behavior within a specific time window). Therefore, it is necessary to introduce a second abnormal behavior feature as a supplement.

[0111] The second abnormal behavior feature is a deeper feature extracted from abnormal traffic data, which can reveal some abnormal signals that cannot be directly reflected by typical access patterns. For example:

[0112] Abnormally low-frequency behavior: Certain IP addresses exhibit extremely low communication frequencies that are inconsistent with normal user behavior or inter-server communication patterns.

[0113] Atypical time distribution: Some traffic is concentrated during non-working hours, while normal user behavior usually occurs during working hours.

[0114] Unusual protocol usage: Traffic that uses uncommon protocols or ports is an attempt by attackers to circumvent detection.

[0115] These features provide additional clues for identifying complex abnormal behaviors and can make up for the limitations of typical access patterns.

[0116] To more comprehensively identify abnormal traffic patterns, it's necessary to combine typical access patterns with secondary abnormal behavior characteristics. This approach not only enhances the accuracy of anomaly detection but also helps understand the underlying characteristics of abnormal behavior. The following is a detailed implementation strategy:

[0117] Weights are assigned to typical access patterns and secondary abnormal behavior characteristics, and a comprehensive anomaly score is calculated based on these weights for each traffic record. For example, if a traffic record does not conform to any typical access patterns, it will be assigned a higher anomaly score. If a traffic record also exhibits secondary abnormal behavior characteristics (such as abnormally low frequency or atypical time distribution), its anomaly score will be further increased.

[0118] Develop a comprehensive set of anomaly rules based on business needs. If a traffic flow does not conform to any typical access pattern but also exhibits a secondary abnormal behavior characteristic, it is marked as highly suspicious. If a traffic flow only exhibits the secondary abnormal behavior characteristic but conforms to a typical access pattern, further background information is investigated.

[0119] Based on comprehensive anomaly scores and rules, abnormal traffic is classified into different patterns. For example

[0120] Simple anomaly patterns deviate only from typical access patterns (e.g., excessively high traffic). Complex anomaly patterns deviate from typical access patterns and exhibit secondary anomalous behavior characteristics (e.g., unusually low frequency and use of non-standard ports). Potentially disguised patterns superficially conform to typical access patterns but exhibit secondary anomalous behavior characteristics.

[0121] Assume that the following typical access pattern and second abnormal behavior characteristics have been formed:

[0122] Typical access patterns:

[0123] Mode A: Normal user behavior, low communication frequency, and mainly HTTP / HTTPS protocol types.

[0124] Mode B: Communication between servers, with high communication frequency and diverse protocol types.

[0125] Second abnormal behavior characteristics:

[0126] Feature X: Abnormally low-frequency behavior (communication frequency is lower than the mean minus two standard deviations).

[0127] Feature Y: Atypical time distribution (traffic concentrated in the early morning hours).

[0128] Signature Z: Unusual protocol usage (using non-standard ports or protocols).

[0129] Next, you can follow these steps to identify unusual traffic patterns:

[0130] For each traffic record, check whether it matches any typical access pattern. If not, it is initially marked as an anomaly.

[0131] The traffic is further checked to see if it exhibits a second abnormal behavior characteristic (such as characteristic X, Y, or Z). If multiple characteristics are exhibited simultaneously, the abnormality level is increased.

[0132] Classify traffic into simple anomaly patterns, complex anomaly patterns, or potential masquerading patterns based on comprehensive anomaly scores and rules.

[0133] Output the final abnormal traffic pattern list and provide detailed description information (such as abnormal reasons, time distribution, etc.).

[0134] S107: Analyze the abnormal traffic pattern to determine the location information of the potential attack source;

[0135] include:

[0136] S301 extracts location-related information from the abnormal traffic data packet, where the location-related information includes the source IP address, destination IP address, protocol type, and port number;

[0137] Extract geographic location-related information from abnormal traffic data. This information includes but is not limited to:

[0138] Source IP address: The initiator of the traffic.

[0139] Destination IP address: The destination of the traffic.

[0140] Protocol type: such as TCP, UDP, etc., helps to understand the purpose of traffic.

[0141] Port number: An identifier for a specific service or application, such as HTTP (80) or HTTPS (443).

[0142] This information will help build a basic data set for subsequent analysis and clustering operations.

[0143] Suppose there is a dataset containing abnormal traffic records, each of which contains the aforementioned location-related information. For example, an abnormal traffic record is as follows:

[0144] Source IP address: 192.168.1.1

[0145] Destination IP address: 8.8.8.8

[0146] Protocol type: TCP

[0147] Port number: 80

[0148] S302 uses the DBSCAN clustering algorithm to find the correlation of IP addresses in abnormal traffic data packets;

[0149] The specific steps include:

[0150] S401 represents each IP address as a feature vector based on location related information;

[0151] In order to use clustering algorithms such as DBSCAN, each IP address needs to be converted into a feature vector. A feature vector usually contains multiple dimensions, which can be different aspects of location-related information.

[0152] For example, you can construct a feature vector containing the following elements:

[0153] Numerical form of the source IP address (can be encoded directly or through a hash function)

[0154] Numerical form of the target IP address

[0155] Protocol type (integers can be used to represent different protocols)

[0156] Port number

[0157] In this way, each IP address can be represented as a point in a multidimensional space, making it suitable for clustering algorithms.

[0158] S402 sets the neighborhood radius and the minimum number of samples, and runs the DBSCAN algorithm to obtain the clustering results;

[0159] DBSCAN is a density-based clustering algorithm that does not require the number of clusters to be specified in advance. Its core parameters include:

[0160] Neighborhood radius (eps): defines the maximum distance between two points, beyond which they are considered not to belong to the same cluster.

[0161] Minimum number of samples (min_samples): determines the minimum number of neighbors required for a point to become a core point.

[0162] After selecting appropriate parameter values based on the data characteristics, the DBSCAN algorithm is run to obtain clustering results. Each cluster represents a group of IP addresses with similar characteristics, while noise points are potential attack sources.

[0163] Suppose we select eps = 0.5 and min_samples = 5 as parameters and run the DBSCAN algorithm. The algorithm will output a series of clusters and noise points. For example, some IP addresses are concentrated in a few major clusters, while other IP addresses are marked as noise points.

[0164] S403 obtains a correlation ranking based on the clustering results.

[0165] After obtaining the clustering results, you can sort the relevance of the IP addresses. Specifically, you can sort according to the following criteria:

[0166] Larger clusters represent normal communication groups, while smaller clusters or isolated points are more likely to be sources of abnormal behavior. Noise points are often outliers and are associated with potential attack sources. By analyzing clusters and noise points, you can prioritize IP addresses that are most likely to be attack sources.

[0167] S303 converts the source IP address into a physical location using an IP geolocation database;

[0168] Once the potential attack source IP address is determined, it needs to be converted to a physical location. This can be done by querying an IP geolocation database. Common IP geolocation databases include MaxMind GeoIP, IP2Location, etc.

[0169] These databases provide API interfaces that allow users to obtain corresponding geographic location information, such as country, city, longitude and latitude, by entering an IP address.

[0170] Assume that an IP address (such as 192.168.1.1) that is suspected to be the source of an attack has been identified. You can use the MaxMind GeoIP database to query the geographic location of this IP address and obtain results similar to the following:

[0171] Country: China

[0172] City: Beijing

[0173] Latitude and longitude: 39.9042,116.407

[0174] S304 uses the Traceroute tool to send probe packets from multiple locations to the suspected attack source, records information about each router passed through, and compares the routing paths at different locations to narrow down the actual physical location of the attack source.

[0175] While IP geolocation databases can provide approximate geographic location information, further analysis is required to more precisely determine the attack source's actual physical location. One effective method is to use the Traceroute tool, sending probe packets to the suspected attack source from multiple locations and recording information about each router hop. By comparing routing paths at different locations, it's possible to identify shared routers and narrow down the attack source's actual physical location.

[0176] Assume that three different detection points (A, B, and C) are selected worldwide, and a Traceroute request is sent from each detection point to the suspected attack source (192.168.1.1). The routing path returned by each detection point is as follows:

[0177] Detection point A->192.168.1.1:

[0178] Hop 1: 10.0.0.1

[0179] Hop 2: 10.0.0.2 ...

[0181] Detection point B->192.168.1.1:

[0182] Hop 1: 10.0.0.1

[0183] Hop 2: 10.0.0.3 ...

[0185] Detection point C->192.168.1.1:

[0186] Hop 1: 10.0.0.1

[0187] Hop 2: 10.0.0.2 ...

[0189] By comparing these routing paths, it can be found that certain routers (such as 10.0.0.1) are shared, which means they are close to the attack source. Combined with the information provided by the IP geolocation database, the actual physical location of the attack source can be further narrowed down.

[0190] S108 dynamically adjusts the bandwidth allocation strategy based on the location information.

[0191] The specific steps include:

[0192] S501 sets priorities for different applications based on business needs and service types;

[0193] Prioritize different applications based on business needs and service types. This step is to ensure that critical businesses and services have sufficient bandwidth resources to ensure their performance is not affected.

[0194] Critical business applications, such as financial trading systems and real-time video conferencing, typically require high bandwidth and low latency. While common business applications, such as office automation systems and file transfer services, also require stable connections, they have relatively lower bandwidth requirements. Non-critical applications, such as background data backup and log collection, can be prioritized appropriately without impacting other services.

[0195] S502 controls the bandwidth access priority of the corresponding area of the IP segment based on different priorities;

[0196] Based on the application priority set in the previous step, further refine it to specific IP segments and regions. Each region contains multiple IP segments, and each IP segment carries different types of services. Therefore, it is necessary to control the bandwidth access priority of each IP segment in each region based on the priority.

[0197] High-priority area: If a certain area carries a large number of critical business applications, it should be assigned a higher bandwidth access priority.

[0198] Medium-priority areas: Areas with a large number of general business applications can be assigned medium-priority bandwidth access rights.

[0199] Low-priority areas: Areas that mainly run non-critical applications can have their bandwidth access priority appropriately lowered.

[0200] In this way, bandwidth resources in key areas can be fully guaranteed while non-key areas can be prevented from occupying too many resources.

[0201] Assume there are two main regions:

[0202] Beijing: Mainly operates real-time video conferencing and financial transaction systems (high priority)

[0203] Shanghai: Mainly used for office automation systems and file download services (medium priority)

[0204] A higher bandwidth access priority can be set for the IP segment in the Beijing area to ensure the smooth operation of its key businesses.

[0205] S503 dynamically adjusts the bandwidth allocation ratio of each area according to the real-time traffic situation.

[0206] The specific steps include:

[0207] S601 collects real-time traffic data from various regions;

[0208] Real-time traffic data needs to be collected from various regions. This data can be obtained through network monitoring tools (such as NetFlow, sFlow, SNMP, etc.), mainly including:

[0209] Traffic size

[0210] Number of connections

[0211] Use bandwidth

[0212] Packet loss rate

[0213] By analyzing these data, we can understand the current traffic load situation in each region and provide basic data support for subsequent bandwidth adjustments.

[0214] Assume that NetFlow is used to collect real-time traffic data from Beijing and Shanghai. The results show:

[0215] Beijing: Current traffic load is high and close to the maximum bandwidth limit

[0216] Shanghai: The current traffic load is low, and there is still a large margin.

[0217] This data will help determine how to adjust bandwidth allocation ratios across regions.

[0218] S602 assigns an initial priority to each region;

[0219] After collecting real-time traffic data, each region is assigned an initial priority. This priority can be set based on previous business needs and service types, and can also be fine-tuned based on current traffic conditions.

[0220] For example, if the traffic load in a certain area is close to the upper limit, even if the area originally has medium priority, its priority needs to be temporarily increased to avoid a decrease in service quality.

[0221] Based on the previous data analysis results, a higher initial priority can be assigned to the Beijing region, while a medium priority can be assigned to the Shanghai region.

[0222] S603 dynamically adjusts the bandwidth ratio of each region based on real-time traffic data.

[0223] Dynamically adjust bandwidth allocation across regions based on real-time traffic data. This process can be implemented through automated scripts or network management systems, ensuring bandwidth resources can flexibly respond to changing traffic conditions.

[0224] If a region's traffic load exceeds its currently allocated bandwidth limit, the bandwidth allocation for that region can be temporarily increased to alleviate the pressure. Conversely, if a region's traffic load is low, its bandwidth allocation can be appropriately reduced, freeing up resources for areas in greater need. By dynamically adjusting bandwidth allocations across regions, we ensure optimal utilization of bandwidth resources across the entire network, avoiding localized congestion or waste.

[0225] Suppose that traffic load in Beijing continues to rise, approaching its allocated bandwidth limit. An automated script can be written to automatically transfer some of Shanghai's idle bandwidth to Beijing upon detection of this situation, thereby alleviating traffic pressure in Beijing.

[0226] S109 uploads the abnormal traffic pattern to the host computer for sharing.

[0227] Extract identified abnormal traffic patterns from local devices and encapsulate them in a predefined format. For example, the abnormal traffic patterns are packaged into JSON, XML, or other formats that are easy to transmit. The encapsulated content typically includes:

[0228] Source IP address and destination IP address

[0229] Protocol type and port number

[0230] Traffic characteristics (such as packet size, communication frequency)

[0231] Timestamp and geolocation information

[0232] Description of unusual behavior (e.g., "unusually low-frequency behavior" or "atypical time distribution")

[0233] Use a transport protocol (such as HTTP / HTTPS, FTP / SFTP, or MQTT) to upload the packaged data to the host computer. The specific choice depends on the network environment and security requirements:

[0234] After the host computer receives the uploaded data, it needs to parse it and store it in a database or log system. After the upload is completed, the abnormal traffic pattern can be shared and used by other modules or users on the host computer. Specific applications include:

[0235] The host computer can analyze the uploaded abnormal traffic patterns through the real-time monitoring module and trigger the alarm mechanism. For example:

[0236] If multiple nodes are detected reporting similar abnormal traffic patterns simultaneously, it indicates a distributed attack (such as a DDoS attack). If an abnormal traffic pattern involves a critical business system, the relevant team will be notified immediately to take action.

[0237] By aggregating abnormal traffic patterns from multiple nodes, threat intelligence can be generated. For example, common attack patterns (such as scanning behaviors and malware propagation paths) can be extracted. This allows for the creation of behavioral profiles of attackers and helps predict future attack trends.

[0238] Use visualization tools (such as Grafana and Kibana) to visualize abnormal traffic patterns in charts for easier understanding. For example, you can display the geographic distribution of abnormal traffic, show the temporal trend of abnormal traffic, and compare abnormal behavior patterns over different time periods.

[0239] The host computer can automatically trigger response strategies based on uploaded abnormal traffic patterns. For example, it can dynamically adjust firewall rules to restrict access from suspicious IP addresses or activate the intrusion detection system's deep analysis module to further investigate the source of abnormal traffic.

[0240] Suppose that branch A of a company detects an abnormal traffic pattern and uploads it to the host computer at headquarters. The abnormal traffic pattern contains the following information:

[0241] Source IP address: 192.168.1.100

[0242] Destination IP address: 8.8.8.8

[0243] Protocol type: TCP

[0244] Port number: 80

[0245] Abnormal behavior description: "Abnormal high-frequency scanning behavior"

[0246] After the host computer receives the data:

[0247] Parse and store in the database.

[0248] The threat intelligence module discovered that the source IP address had been marked as malicious.

[0249] Trigger the alarm mechanism and notify the security team.

[0250] Automatically update firewall rules to block further access from that IP address.

[0251] The geographical distribution and time trend of the abnormal traffic are displayed on the monitoring panel.

[0252] This approach combines the efficiency of rule-driven detection with the generalization capabilities of data-driven models for unknown threats, and balances security protection with network performance through dynamic resource allocation. This algorithm is suitable for high-concurrency scenarios requiring low-latency responses, such as cloud platforms defending against DDoS attacks, intercepting abnormal behavior in IoT clusters, and blocking data theft in real time on enterprise intranets. These complex network environments are sensitive to both detection efficiency and accuracy.

[0253] Second embodiment

[0254] The present invention also provides a network attack tracing and defense device, comprising a network traffic acquisition module, a traffic feature extraction module, a typical model identification module, an abnormal traffic screening module, a second abnormal feature extraction module, an abnormal confirmation module, a location information acquisition module, and a bandwidth adjustment module: the network traffic acquisition module is used to capture network traffic data using a network monitoring tool; the traffic feature extraction module is used to extract traffic features based on the network traffic data, the traffic features including packet size, protocol type, source and target IP addresses, port numbers, timestamps, and traffic rates; the typical model identification module is used to analyze historical traffic data to set thresholds for each traffic feature and form multiple typical access patterns;

[0255] The abnormal traffic screening module is used to screen abnormal traffic based on multiple typical access patterns; the second abnormal feature extraction module is used to discover the second abnormal behavior feature in the abnormal traffic through a statistical method; the abnormal confirmation module is used to identify abnormal traffic patterns based on the second abnormal behavior feature combined with typical access patterns; the location information acquisition module is used to analyze the abnormal traffic pattern to determine the location information of potential attack sources; the bandwidth adjustment module is used to dynamically adjust the bandwidth allocation strategy based on the location information.

[0256] In this embodiment, the network traffic acquisition module utilizes efficient network monitoring tools to capture all network traffic data in real time. This raw traffic data is then fed into the traffic feature extraction module, which parses each packet to extract key features, including but not limited to packet size, protocol type, source and destination IP addresses, port numbers, timestamps, and traffic rate. The typical model identification module conducts in-depth analysis of historical traffic data, setting appropriate thresholds for each traffic feature and constructing a series of typical access patterns. These patterns provide a benchmark for subsequent anomaly detection. Once all preparations are complete, the abnormal traffic screening module uses the established typical access patterns to identify abnormal traffic that does not conform to normal behavior. For traffic marked as abnormal, the second abnormal feature extraction module applies statistical methods to further identify the hidden second-layer abnormal behavior features. The anomaly confirmation module then combines the previously defined typical access patterns with the newly discovered second-layer abnormal behavior features to accurately identify the specific abnormal traffic pattern. Once the abnormal traffic pattern is determined, the location information acquisition module is activated, which uses in-depth analysis of these abnormal patterns to track and locate potential attack sources. Finally, the bandwidth adjustment module intelligently and dynamically adjusts the network bandwidth allocation strategy based on the obtained location information, thereby effectively limiting or isolating data flows from suspected attack sources and ensuring the safe and stable operation of the network.

[0257] In summary, the present invention can not only effectively monitor and identify abnormal activities in the network, but also quickly respond and mitigate the impact of potential threats through technical means. It is an important tool for maintaining network security.

[0258] Third embodiment

[0259] On the basis of the second embodiment, the present invention further provides a network attack tracing and defense system, including a network attack tracing and defense device of the second embodiment.

[0260] At its core, this system includes, but is not limited to, the previously described network attack tracing and defense device. This device is equipped with multiple specially designed functional modules: a network traffic acquisition module, a traffic feature extraction module, a typical pattern recognition module, an abnormal traffic screening module, a second abnormal feature extraction module, an anomaly confirmation module, a location information acquisition module, and a bandwidth adjustment module. Each module is meticulously designed to perform specific functions, ensuring comprehensive monitoring of network traffic and timely detection of potential threats.

[0261] Furthermore, by integrating these modules, this network attack tracing and defense system forms a more complex and efficient workflow. It not only captures and analyzes network traffic in real time, but also establishes normal behavior patterns based on historical data and uses these patterns to identify abnormal traffic. Once abnormal behavior is detected, the system further explores the underlying second-layer abnormality characteristics to more accurately identify the abnormal traffic pattern and pinpoint the source of the attack.

[0262] The above disclosure is only a preferred embodiment of the present invention, and certainly cannot be used to limit the scope of the rights of the present invention. Ordinary technicians in this field can understand that all or part of the processes of the above embodiment and equivalent changes made in accordance with the claims of the present invention are still within the scope of the invention.

Claims

1. A network attack tracing and defense method, It is characterized by: Includes: using network monitoring tools to capture network traffic data in real time; Extracting traffic features based on network traffic data through multi-dimensional features, wherein the traffic features include packet size, protocol type, source and destination IP addresses, port numbers, timestamps, and traffic rates; Analyze historical traffic data based on statistical rules to set thresholds for various traffic characteristics and form multiple typical access patterns; Filter abnormal traffic based on multiple typical access patterns; Discover the second abnormal behavior feature in abnormal traffic through statistical methods; Identify abnormal traffic patterns based on the second abnormal behavior feature combined with typical access patterns; Analyzing the abnormal traffic pattern to determine the location information of the potential attack source; The bandwidth allocation strategy is dynamically adjusted based on the location information.

2. A network attack tracing and defense method according to claim 1, characterized in that: After dynamically adjusting the bandwidth allocation strategy based on the location information, the method further includes: uploading the abnormal traffic pattern to a host computer for sharing.

3. A network attack tracing and defense method according to claim 2, characterized in that: The specific steps of discovering abnormal behavior characteristics in abnormal traffic by statistical methods include: Remove incomplete and erroneous data from abnormal traffic data; Normalize the abnormal traffic data after removing the erroneous data to obtain the data to be processed; The data to be processed is processed by calculating the mean, variance and distribution to obtain abnormal behavior characteristics.

4. A network attack tracing and defense method according to claim 3, characterized in that: Analyzing the abnormal traffic pattern to determine the location information of the potential attack source includes: Extracting location-related information from abnormal traffic data packets, the location-related information including source IP address, destination IP address, protocol type, and port number; The DBSCAN clustering algorithm is used to find the correlation of IP addresses in abnormal traffic packets; Utilize IP geolocation databases to convert source IP addresses into physical locations; Use the Traceroute tool to send probe packets to the suspected attack source from multiple locations, record information about each router, and compare the routing paths at different locations to narrow down the actual physical location of the attack source.

5. A network attack tracing and defense method according to claim 4, characterized in that: The specific steps of using the DBSCAN clustering algorithm to find the correlation of IP addresses in abnormal traffic data packets include: Represent each IP address as a feature vector based on location-related information; Set the neighborhood radius and minimum number of samples, and run the DBSCAN algorithm to obtain the clustering results; The relevance ranking is obtained based on the clustering results.

6. A network attack tracing and defense method according to claim 5, characterized in that: The specific steps of dynamically adjusting the bandwidth allocation strategy based on the location information include: Prioritize different applications based on business needs and service types; Control bandwidth access priority in corresponding areas of IP segments based on different priorities; Dynamically adjust the bandwidth allocation ratio of each area according to real-time traffic conditions.

7. A network attack tracing and defense method according to claim 6, characterized in that: The specific steps of dynamically adjusting the bandwidth allocation ratio of each area according to the real-time traffic status include: Collect real-time traffic data from various regions; Assigning initial priorities to each region; Dynamically adjust the bandwidth ratio of each region based on real-time traffic data.

8. A network attack tracing and defense device, using a network attack tracing and defense method according to any one of claims 1 to 7, characterized in that: It includes network traffic acquisition module, traffic feature extraction module, typical model recognition module, abnormal traffic screening module, second abnormal feature extraction module, abnormal confirmation module, location information acquisition module and bandwidth adjustment module: The network traffic acquisition module is used to capture network traffic data using a network monitoring tool; The traffic feature extraction module is used to extract traffic features based on network traffic data, wherein the traffic features include packet size, protocol type, source and destination IP addresses, port numbers, timestamps, and traffic rates; The typical model identification module is used to analyze historical traffic data to set thresholds for various traffic characteristics and form multiple typical access patterns; The abnormal traffic screening module is used to screen abnormal traffic based on multiple typical access patterns; The second abnormal feature extraction module is used to discover the second abnormal behavior feature in the abnormal traffic through a statistical method; The anomaly confirmation module is used to identify an abnormal traffic pattern based on the second abnormal behavior feature in combination with a typical access pattern; The location information acquisition module is used to analyze the abnormal traffic pattern to determine the location information of the potential attack source; The bandwidth adjustment module is configured to dynamically adjust the bandwidth allocation strategy based on the location information.

9. A network attack tracing and defense system, characterized in that: Including the network attack tracing and defense device as described in claim 8.

Images