Attack detection method and device, storage medium and processor
By creating nodes in the XFF field of the data flow and recording flowbits status information, the false positive and false negative problems of attack detection in connection multiplexing scenarios are solved, achieving higher attack detection accuracy and identification of multi-stage attacks.
Patent Information
- Application Number
- CN202511049213.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-29
- Publication Date
- 2025-09-05
AI Technical Summary
In connection multiplexing scenarios, existing technologies have difficulty accurately distinguishing when multiple data streams are merged into the same data stream, resulting in false positives and false negatives, affecting the accuracy of attack detection.
By obtaining the first data stream for attack feature matching and recording the flowbits status information, creating a node using the XFF field, obtaining the second data stream for attack feature matching, and determining whether the flowbits status information of its node matches the first data stream, an attack detection result is generated.
It improves the accuracy of attack detection, reduces the false alarm rate, can identify multi-stage attacks and prevent misjudgments or missed reports caused by complex network structures.
Smart Images
Figure CN120602218A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of network security technology, and in particular to an attack detection method, device, storage medium, and processor. Background Art
[0002] Deep Packet Inspection (DPI) performs deep packet inspection on application layer traffic of intrusion prevention system (IPS) devices to detect attacks in a timely manner. In a typical data center network, multiple network devices, such as load balancing devices, are deployed on demand in front of content detection devices such as IPS. Load balancing devices use the load connection multiplexing function to convert multiple data streams initiated by clients into a single data stream, saving a lot of new construction processes and improving the performance of the entire network. Load balancing devices can also be used in conjunction with SSL gateways. Enterprises can first offload HTTPS traffic in the existing network into HTTP traffic, and then forward it through the load balancing device to facilitate subsequent device detection. At this time, after the load balancing proxy, the source, destination, and other five-tuple information of the data stream will be the same, that is, multiple client traffic will be merged into a single data stream and sent to the IPS device for security detection.
[0003] When multiple data streams are merged into a single stream, all request and response payload information is included in the single stream. This makes it difficult to comprehensively identify attacks based on the correlation of multiple features within the same stream. All client requests and responses are combined, making it impossible to accurately distinguish them, resulting in false positives or even missed negatives.
[0004] Faced with the difficulty that enterprise users face in identifying attacks in connection reuse scenarios, how to reduce false positives and missed positives and improve the accuracy of attack detection is a technical problem that needs to be solved urgently. Summary of the Invention
[0005] Based on the above problems, the present application provides an attack detection method, device, storage medium and processor, the purpose of which is to reduce false positives and missed positives in connection multiplexing scenarios and improve the accuracy of attack detection.
[0006] The embodiments of this application disclose the following technical solutions:
[0007] A first aspect of the present application provides an attack detection method, the method comprising:
[0008] Obtaining a first data stream, performing attack signature matching on the first data stream, and recording corresponding flowbits status information in a node corresponding to the first data stream if the first data stream matches a first attack signature; the node corresponding to the first data stream is created based on the XFF field of the first data stream;
[0009] A second data stream is obtained, and attack signature matching is performed on the second data stream. If the second data stream matches the second attack signature and a node corresponding to the second data stream meets a preset condition, an attack detection result is generated.
[0010] Optionally, obtaining the second data stream, performing attack signature matching on the second data stream, and generating an attack detection result if the second data stream matches the second attack signature and a node corresponding to the second data stream meets a preset condition includes:
[0011] Obtain a second data stream; the second data stream is a response data stream corresponding to the first data stream in the same transaction; the first data stream is a request data stream;
[0012] Perform attack feature matching on the second data stream. If the second data stream hits the second attack feature, determine whether the flowbits status information in the node corresponding to the second data stream matches the flowbits status information in the first data stream. If so, the attack is hit and a security event is generated; if not, it is not hit.
[0013] Optionally, obtaining the second data stream, performing attack signature matching on the second data stream, and generating an attack detection result if the second data stream matches the second attack signature and a node corresponding to the second data stream meets a preset condition includes:
[0014] Acquire a second data stream; the second data stream is a request data stream for the same transaction that is different from the first data stream; the first data stream is a request data stream;
[0015] Performing attack signature matching on the second data flow, and if the second data flow matches the second attack signature, recording corresponding flowbits status information in a node corresponding to the second data flow; the node corresponding to the second data flow is created based on the XFF field of the second data flow;
[0016] Determine whether the flowbits status information in the node corresponding to the second data stream matches the flowbits status information in the first data stream and whether the XFF address corresponding to the node corresponding to the second data stream matches the XFF address corresponding to the node corresponding to the first data stream. If so, the attack is hit and a security event is generated; if not, the attack is not hit.
[0017] Optionally, creating a node corresponding to the first data stream based on the XFF field of the first data stream includes:
[0018] Extracting XFF field information from the first data stream using an Aho-Corasick algorithm;
[0019] A node corresponding to the first data stream is created using the designated address information in the XFF field information in the first data stream as a key value.
[0020] A second aspect of the present application provides an attack detection device, the device comprising:
[0021] The first data stream detection module is used to obtain the first data stream and match the attack signature of the first data stream. If the first data stream hits the first attack signature, the corresponding flowbits status information is recorded in the node corresponding to the first data stream; the node corresponding to the first data stream is created based on the XFF field of the first data stream.
[0022] The second data stream detection module is used to obtain the second data stream, perform attack feature matching on the second data stream, and generate an attack detection result if the second data stream hits the second attack feature and the node corresponding to the second data stream meets the preset conditions.
[0023] Optionally, the second data flow detection module is specifically configured to:
[0024] Obtain a second data stream; the second data stream is a response data stream corresponding to the first data stream in the same transaction; the first data stream is a request data stream;
[0025] Perform attack feature matching on the second data stream. If the second data stream hits the second attack feature, determine whether the flowbits status information in the node corresponding to the second data stream matches the flowbits status information in the first data stream. If so, the attack is hit and a security event is generated; if not, it is not hit.
[0026] Optionally, the second data flow detection module is specifically configured to:
[0027] Acquire a second data stream; the second data stream is a request data stream for the same transaction that is different from the first data stream; the first data stream is the request data stream;
[0028] Performing attack signature matching on the second data flow, and if the second data flow matches the second attack signature, recording corresponding flowbits status information in a node corresponding to the second data flow; the node corresponding to the second data flow is created based on the XFF field of the second data flow;
[0029] Determine whether the flowbits status information in the node corresponding to the second data stream matches the flowbits status information in the first data stream and whether the XFF address corresponding to the node corresponding to the second data stream matches the XFF address corresponding to the node corresponding to the first data stream. If so, the attack is hit and a security event is generated; if not, the attack is not hit.
[0030] Optionally, creating a node corresponding to the first data stream based on the XFF field value of the first data stream includes:
[0031] Extracting XFF field information from the first data stream using an Aho-Corasick algorithm;
[0032] A node corresponding to the first data stream is created using the designated address information in the XFF field information in the first data stream as a key value.
[0033] A third aspect of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program. When the program is executed by a processor, the attack detection method provided in any implementation manner of the first aspect is implemented.
[0034] A fourth aspect of the present application provides a processor configured to run a computer program, wherein the program, when running, executes the attack detection method provided in any implementation of the first aspect.
[0035] Compared with the existing technology, this application has the following beneficial effects:
[0036] The attack detection method provided by the present application is that after the first data stream hits the attack feature, the flowbits status information is recorded in the node created based on the XFF field. The second data stream searches for the corresponding node and determines whether the preset conditions are met. For example, if the flowbits status information of the node corresponding to the second data stream matches the flowbits status information in the first data stream, the preset conditions are met and an attack detection result is generated. This method of obtaining the attack detection result after both data streams hit the attack feature and meet the preset conditions in the same HTTP transaction can not only detect multi-stage attacks, but also reduce the false alarm rate of attacks and improve the accuracy of system attack detection. In addition, when attack detection is performed on a single HTTP transaction, even if the XFF fields of multiple data streams are consistent, they can still be identified as different behaviors of the same client, preventing misjudgment or omissions due to complex network structures, and improving the accuracy of attack detection in complex environments. BRIEF DESCRIPTION OF THE DRAWINGS
[0037] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.
[0038] Figure 1 A flowchart of an attack detection method provided in an embodiment of the present application;
[0039] Figure 2 A flowchart of another attack detection method provided in an embodiment of the present application;
[0040] Figure 3 A flowchart of another attack detection method provided in an embodiment of the present application;
[0041] Figure 4 A schematic diagram of the structure of an attack detection device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0042] As previously described, when multiple data streams are merged into a single stream, all request and response payload information is contained within the single stream. This creates difficulties in attack detection, where multiple features within the same stream must be correlated. All client requests and responses are combined, making it difficult to accurately distinguish them, leading to false positives or even missed negatives. This makes it difficult for enterprise users to detect attacks in connection reuse scenarios.
[0043] In view of the above problems, the inventors have proposed an attack detection method, device, storage medium and processor after research, which obtain a first data stream, match the attack characteristics of the first data stream, and record the corresponding flowbits status information in the node corresponding to the first data stream if the first data stream hits the first attack characteristic; the node corresponding to the first data stream is created based on the XFF field of the first data stream; obtain a second data stream, match the attack characteristics of the second data stream, and generate an attack detection result if the second data stream hits the second attack characteristic and the node corresponding to the second data stream meets the preset conditions.
[0044] In order to help those skilled in the art better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.
[0045] See also Figure 1 , which is a flow chart of an attack detection method provided by an embodiment of the present application. Figure 1 As shown, the method includes the following steps:
[0046] S101: Obtain a first data flow, perform attack signature matching on the first data flow, and if the first data flow matches a first attack signature, record corresponding flowbits status information in a node corresponding to the first data flow.
[0047] The node corresponding to the first data stream is created based on the XFF field of the first data stream.
[0048] The first data flow refers to the first detected traffic, usually an HTTP request.
[0049] X-Forwarded-For (XFF) is an HTTP request header field that helps the server identify the client's true source IP address when the request passes through multiple proxy nodes. The first IP address among the multiple IP addresses contained in the XFF field is usually designated as the client's true address.
[0050] For example, X-Forwarded-For: 192.168.1.100, 10.0.0.1, 172.16.0.1
[0051] The client (IP address is 192.168.1.100) requests resources through proxy server A (IP address is 10.0.0.1), adds the client IP address in the XFF field, and forwards the request to proxy server B (IP address is 172.16.0.1). Proxy server B appends the IP address of proxy server A to the client IP address in the XFF field and forwards the request to the target server.
[0052] The first attack signature is a signature of a rule included in the rule engine.
[0053] Perform attack feature matching on the first data stream, and use a rule engine (such as Snort, WAF, etc.) to extract features and match rules on the content of the first data stream. If a part of the first data stream, such as the URL, IP address, and user agent string, matches a feature in a rule in the rule engine, the first data stream hits the feature.
[0054] Flowbits is a state marking mechanism in rule engines such as Snort, which is used to share state information between multiple rules to indicate that a certain behavior or state has occurred.
[0055] Create corresponding nodes based on the XFF field of the data flow and record the flowbits status on the XFF node of the data flow. By recording the flowbits status information, the attack behavior at a certain stage (such as uploading a malicious file) is marked for verification in subsequent transactions. This method can identify multi-stage attack chains and improve the accuracy and completeness of detection.
[0056] S102: Obtain a second data stream, perform attack feature matching on the second data stream, and generate an attack detection result if the second data stream matches a second attack feature and a node corresponding to the second data stream meets a preset condition.
[0057] The second data flow refers to another detected data flow in the same HTTP transaction, such as a responder data flow of the first data flow or another request data flow.
[0058] The preset condition means that the flowbits status information in the node corresponding to the second data flow matches the flowbits status information in the first data flow.
[0059] The attack detection method provided by the embodiment of the present application is that after the first data stream hits the attack feature, the flowbits status information is recorded in the node created based on the XFF field. The second data stream searches for the corresponding node and determines whether the preset conditions are met. For example, if the flowbits status information of the node corresponding to the second data stream matches the flowbits status information in the node corresponding to the first data stream, the preset conditions are met and an attack detection result is generated. This method of obtaining the attack detection result after both data streams hit the attack feature and meet the preset conditions in the same HTTP transaction can not only detect multi-stage attacks, but also reduce the false alarm rate of attacks and improve the accuracy of system attack detection. In addition, when attack detection is performed on a single HTTP transaction, even if the XFF fields of multiple data streams are consistent, they can still be identified as different behaviors of the same client, preventing misjudgments or omissions due to complex network structures, and improving the accuracy of attack detection in complex environments.
[0060] In order to further improve the attack detection method described in the above embodiment, the first data stream is refined into a request data stream and the second data stream is refined into a response data stream for description.
[0061] See also Figure 2 , which is a flow chart of another attack detection method provided by an embodiment of the present application. Figure 2 As shown, the method includes the following steps:
[0062] S201: Obtain a request data flow, perform attack feature matching on the request data flow, and if the request data flow matches a first attack feature, record corresponding flowbits status information in a node corresponding to the request data flow.
[0063] The node corresponding to the request data stream is created based on the XFF field of the request data stream.
[0064] In one possible implementation:
[0065] Extracting XFF field information from the request data stream using the Aho-Corasick algorithm;
[0066] A node corresponding to the request data stream is created using the designated address information in the XFF field information in the request data stream as a key value.
[0067] The designated address information in the XFF field information in the data stream is the first IP address among the multiple IP addresses contained in the XFF field of the data stream. In other words, the designated address information in the XFF field information in the data stream is the real address of the client.
[0068] The Aho-Corasick algorithm is an efficient multi-pattern string matching algorithm, commonly used to quickly search for multiple keywords (patterns) within a text. Its core idea is to construct a finite state automaton (Trie tree structure) to simultaneously match all predefined patterns in a single scan of the text, with near-linear time complexity (O(n+m), where n is the length of the text and m is the total length of all patterns).
[0069] The client's real address is extracted based on the XFF field and used to create a node. This method can identify the same client behavior and improve the accuracy of attack detection in complex network environments.
[0070] S202. Obtain the response data stream corresponding to the request data stream, perform attack feature matching on the response data stream, and if the response data stream matches the second attack feature, determine whether the flowbits status information in the node corresponding to the response data stream matches the flowbits status information in the request data stream. If so, the attack is hit and a security event is generated; if not, it is not hit.
[0071] The response data stream is a response data stream corresponding to the request data stream in the same transaction.
[0072] When both data streams match attack signatures and the flowbits status information matches, an attack is determined to have occurred and a security event is generated. This approach not only detects multi-stage attacks but also reduces the false alarm rate and improves the accuracy of system attack detection.
[0073] Another attack detection method provided by an embodiment of the present application is that after the request data stream hits the attack feature, the flowbits status information is recorded in the node created based on the XFF field. The response data stream searches for the corresponding node and, when the flowbits status information in the node corresponding to the response data stream matches the flowbits status information in the request data stream, determines the attack behavior and generates a security event. This method of obtaining attack detection results when both data streams hit the attack feature and the flowbits status information match in the same HTTP transaction can not only detect multi-stage attacks, but also reduce the false alarm rate of attacks and improve the accuracy of system attack detection. Moreover, when attack detection is performed on a single HTTP transaction, even if the XFF fields of multiple data streams are consistent, they can still be identified as different behaviors of the same client, preventing misjudgments or omissions due to complex network structures and improving the accuracy of attack detection in complex environments.
[0074] In order to further improve the attack detection method described in the above embodiment, the first data stream is refined into a request data stream, and the second data stream is refined into another request data stream for description.
[0075] See also Figure 3 , which is a flow chart of another attack detection method provided by an embodiment of the present application. Figure 3 As shown, the method includes the following steps:
[0076] S301: Obtain a first request data flow, perform attack feature matching on the first request data flow, and if the first request data flow matches a first attack feature, record corresponding flowbits status information in a node corresponding to the first request data flow.
[0077] The node corresponding to the first request data stream is created based on the XFF field of the request data stream.
[0078] In one possible implementation:
[0079] Extracting XFF field information from the first request data stream using the Aho-Corasick algorithm;
[0080] A node corresponding to the first request data stream is created using the designated address information in the XFF field information in the first request data stream as a key value.
[0081] The first address in the XFF field is usually specified as the client's real address.
[0082] The client's real address is extracted based on the XFF field and used to create a node. This method can identify the same client behavior and improve the accuracy of attack detection in complex network environments.
[0083] S302: Obtain a second request data stream, perform attack feature matching on the second request data stream, and if the second request data stream matches the second attack feature, record corresponding flowbits status information in a node corresponding to the second request data stream.
[0084] The second request data stream is a data stream different from the first request data stream in the same transaction; the node corresponding to the second request data stream is created based on the XFF field of the second data stream.
[0085] For example, to detect SQL injection attempts:
[0086] alert http any any->any any(
[0087] msg: "Feature 1: SQL injection attempt";
[0088] content:"UNION SELECT";
[0089] flowbits:set,sql_injected;
[0090] xff; )
[0092] Among them, content:"UNION SELECT" detects whether the HTTP request contains the string "UNION SELECT", which is a common feature of SQL injection.
[0093] flowbits:set,sql_injected: If the match is successful, mark the flowbits state sql_injected in the node corresponding to the current data flow.
[0094] xff: Enables state tracking based on the X-Forwarded-For field, ensuring that the client can be correctly identified even if the request goes through a proxy.
[0095] For example, detecting access to a WebShell:
[0096] alert http any any->any any(
[0097] msg: "Feature 2: Access to WebShell";
[0098] content:" / shell.php";
[0099] flowbits:isset,sql_injected;
[0100] xff; )
[0102] content:" / shell.php": Checks whether the request contains / shell.php, which is a common WebShell path feature.
[0103] flowbits:isset,sql_injected: Checks whether the sql_injected state has been set in a previous request.
[0104] xff: Also based on the XFF field, ensures that the status matches the same client.
[0105] S303. Determine whether the flowbits status information in the node corresponding to the second request data stream matches the flowbits status information in the first request data stream and whether the XFF address corresponding to the node corresponding to the second request data stream matches the XFF address corresponding to the node corresponding to the first request data stream. If so, the attack is hit and a security event is generated; if not, the attack is not hit.
[0106] The XFF address corresponding to the node corresponding to the data stream is the first IP address among the multiple IP addresses contained in the XFF field of the data stream. In other words, the XFF address corresponding to the node corresponding to the data stream is the real address of the client.
[0107] When both request data streams match attack signatures, the client addresses are the same, and the flowbits status information matches, an attack is determined to have occurred and a security event is generated. This approach can not only detect multi-stage attacks, but also reduce the false alarm rate and improve the accuracy of system attack detection.
[0108] Another attack detection method provided by an embodiment of the present application is that after the first request data stream hits the attack feature, the flowbits status information is recorded in the node created based on the XFF field. After the second request data stream hits the attack feature, the flowbits status information is recorded in the node created based on the XFF address. The attack detection result is obtained when it is determined that the flowbits status information in the node corresponding to the second request data stream matches the flowbits status information in the first request data stream and the XFF address corresponding to the node corresponding to the second request data stream matches the XFF address corresponding to the node corresponding to the first request data stream. This method can not only detect multi-stage attacks, but also reduce the false alarm rate of attacks and improve the accuracy of system attack detection. In addition, attack detection is performed on a single HTTP transaction. Even if the request data streams come from different proxy nodes, as long as the XFF fields are consistent, they can still be identified as different behaviors of the same client, preventing misjudgment or omissions due to complex network structures, and improving the accuracy of attack detection in complex environments.
[0109] Based on the attack detection method introduced in the above embodiments, the present application also provides an attack detection device. Figure 4 Figure 2 is a schematic diagram of the structure of the device. Figure 4 As shown, the attack detection device includes:
[0110] The first data stream detection module 401 is used to obtain a first data stream and perform attack feature matching on the first data stream. If the first data stream hits the first attack feature, the corresponding flowbits status information is recorded in the node corresponding to the first data stream; the node corresponding to the first data stream is created based on the XFF field of the first data stream.
[0111] The second data stream detection module 402 is configured to obtain a second data stream, perform attack feature matching on the second data stream, and generate an attack detection result if the second data stream matches a second attack feature and a node corresponding to the second data stream meets a preset condition.
[0112] Optionally, the second data flow detection module is specifically configured to:
[0113] Obtain a second data stream; the second data stream is a response data stream corresponding to the first data stream in the same transaction; the first data stream is a request data stream;
[0114] Perform attack feature matching on the second data stream. If the second data stream hits the second attack feature, determine whether the flowbits status information in the node corresponding to the second data stream matches the flowbits status information in the first data stream. If so, the attack is hit and a security event is generated; if not, it is not hit.
[0115] Optionally, the second data flow detection module is specifically configured to:
[0116] Acquire a second data stream; the second data stream is a request data stream for the same transaction that is different from the first data stream; the first data stream is a request data stream;
[0117] Performing attack signature matching on the second data flow, and if the second data flow matches the second attack signature, recording corresponding flowbits status information in a node corresponding to the second data flow; the node corresponding to the second data flow is created based on the XFF field of the second data flow;
[0118] Determine whether the flowbits status information in the node corresponding to the second data stream matches the flowbits status information in the first data stream and whether the XFF address corresponding to the node corresponding to the second data stream matches the XFF address corresponding to the node corresponding to the first data stream. If so, the attack is hit and a security event is generated; if not, the attack is not hit.
[0119] Optionally, creating a node corresponding to the first data stream based on the XFF field value of the first data stream includes:
[0120] Extracting XFF field information from the first data stream using an Aho-Corasick algorithm;
[0121] A node corresponding to the first data stream is created using the designated address information in the XFF field information in the first data stream as a key value.
[0122] In addition, an embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored. When the program is executed by a processor, the attack detection method described in any of the method embodiments is implemented.
[0123] In addition, an embodiment of the present application further provides a processor, which is used to run a computer program. When the program is run, the attack detection method described in any implementation manner of the aforementioned method embodiment is executed.
[0124] It should be noted that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. The device embodiment described above is merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components indicated as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. A person of ordinary skill in the art can understand and implement it without expending creative work.
[0125] The above is merely one specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.
Claims
1. An attack detection method, characterized in that: include: Obtaining a first data stream, performing attack signature matching on the first data stream, and recording corresponding flowbits status information in a node corresponding to the first data stream if the first data stream matches a first attack signature; the node corresponding to the first data stream is created based on the XFF field of the first data stream; A second data stream is obtained, and attack signature matching is performed on the second data stream. If the second data stream matches the second attack signature and a node corresponding to the second data stream meets a preset condition, an attack detection result is generated.
2. The method according to claim 1, characterized in that The acquiring of the second data stream, performing attack signature matching on the second data stream, and generating an attack detection result if the second data stream matches the second attack signature and a node corresponding to the second data stream meets a preset condition, includes: Obtain a second data stream; the second data stream is a response data stream corresponding to the first data stream in the same transaction; the first data stream is a request data stream; Perform attack feature matching on the second data stream. If the second data stream hits the second attack feature, determine whether the flowbits status information in the node corresponding to the second data stream matches the flowbits status information in the first data stream. If so, the attack is hit and a security event is generated; if not, it is not hit.
3. The method according to claim 1, characterized in that The acquiring of the second data stream, performing attack signature matching on the second data stream, and generating an attack detection result if the second data stream matches the second attack signature and a node corresponding to the second data stream meets a preset condition, includes: Acquire a second data stream; the second data stream is a request data stream for the same transaction that is different from the first data stream; the first data stream is the request data stream; Performing attack signature matching on the second data flow, and if the second data flow matches the second attack signature, recording corresponding flowbits status information in a node corresponding to the second data flow; the node corresponding to the second data flow is created based on the XFF field of the second data flow; Determine whether the flowbits status information in the node corresponding to the second data stream matches the flowbits status information in the first data stream and whether the XFF address corresponding to the node corresponding to the second data stream matches the XFF address corresponding to the node corresponding to the first data stream. If so, the attack is hit and a security event is generated; if not, the attack is not hit.
4. The method according to claim 1, wherein Creating a node corresponding to the first data stream based on the XFF field of the first data stream includes: Extracting XFF field information from the first data stream using an Aho-Corasick algorithm; A node corresponding to the first data stream is created using the designated address information in the XFF field information in the first data stream as a key value.
5. An attack detection device, characterized in that: include: a first data flow detection module, configured to obtain a first data flow, perform attack signature matching on the first data flow, and record corresponding flowbits status information in a node corresponding to the first data flow if the first data flow matches a first attack signature; the node corresponding to the first data flow is created based on the XFF field of the first data flow; The second data stream detection module is used to obtain the second data stream, perform attack feature matching on the second data stream, and generate an attack detection result if the second data stream hits the second attack feature and the node corresponding to the second data stream meets the preset conditions.
6. The device according to claim 5, characterized in that The second data flow detection module is specifically configured to: Obtain a second data stream; the second data stream is a response data stream corresponding to the first data stream in the same transaction; the first data stream is a request data stream; Perform attack feature matching on the second data stream. If the second data stream hits the second attack feature, determine whether the flowbits status information in the node corresponding to the second data stream matches the flowbits status information in the first data stream. If so, the attack is hit and a security event is generated; if not, it is not hit.
7. The device according to claim 5, characterized in that The second data flow detection module is specifically configured to: Acquire a second data stream; the second data stream is a request data stream for the same transaction that is different from the first data stream; the first data stream is a request data stream; Performing attack signature matching on the second data flow, and if the second data flow matches the second attack signature, recording corresponding flowbits status information in a node corresponding to the second data flow; the node corresponding to the second data flow is created based on the XFF field of the second data flow; Determine whether the flowbits status information in the node corresponding to the second data stream matches the flowbits status information in the first data stream and whether the XFF address corresponding to the node corresponding to the second data stream matches the XFF address corresponding to the node corresponding to the first data stream. If so, the attack is hit and a security event is generated; if not, the attack is not hit.
8. The device according to claim 5, characterized in that Creating a node corresponding to the first data stream based on the XFF field value of the first data stream includes: Extracting XFF field information from the first data stream using an Aho-Corasick algorithm; A node corresponding to the first data stream is created using the designated address information in the XFF field information in the first data stream as a key value.
9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the program is executed by a processor, the attack detection method according to any one of claims 1 to 4 is implemented.
10. A processor, characterized in that: Used to run a computer program, which executes the attack detection method according to any one of claims 1 to 4 when the program is run.