Botnet virus defense method, apparatus and device, and storage medium

Abstract

The invention discloses a botnet virus defense method and device, equipment and a storage medium, and relates to the technical field of network security, and the method comprises the steps: collecting a target network data packet in network traffic through an edge firewall, and extracting the features of the target network data packet; determining a target attack detection model by using historical network traffic and a preset artificial intelligence technology through the AI center, performing lightweight processing on the target attack detection model to obtain a corresponding lightweight model, and issuing the lightweight model to the edge firewall; wherein the historical network traffic comprises botnet viruses; and detecting the botnet virus in the network flow on the edge firewall by using the lightweight model based on the characteristics of the target network data packet, and updating the rule of the edge firewall to defend the attack of the botnet virus. The Botnet virus defense effect can be improved through the edge firewall and the AI technology.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method, apparatus, device, and storage medium for defending against botnet viruses. Background Technology

[0002] With the rapid development of internet technology, cybersecurity threats are constantly increasing, especially the harm caused by botnet viruses. Botnets infect a large number of computers or devices, turning them into "zombie" nodes for malicious attacks. These infected devices are usually remotely controlled and used to carry out malicious activities such as DDoS (Distributed Denial of Service) attacks, sending spam, and stealing user information. Traditional firewall technology mainly relies on rule bases and signature matching to detect known attacks, but faced with complex and constantly evolving botnet viruses, traditional firewalls often cannot identify and defend against unknown attack methods in a timely manner.

[0003] Firewall systems typically lack intelligent features and have limited ability to respond to unknown or mutated attacks. With the diversification and increased stealth of virus propagation methods, the limitations of traditional firewalls are becoming increasingly apparent. Therefore, improving the effectiveness of botnet defense is a pressing technical problem that needs to be solved. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide a method, apparatus, device, and storage medium for defending against botnet viruses, which can improve the defense effect against botnet viruses. The specific solution is as follows:

[0005] Firstly, this application provides a botnet virus defense method applied to a botnet virus defense system, wherein the botnet virus defense system includes an edge firewall, a blockchain, and an AI hub, the AI ​​hub being deployed in the cloud, and the edge firewall registering corresponding edge firewall nodes in the blockchain; wherein the method includes:

[0006] The target network data packets in network traffic are collected through the edge firewall, and the characteristics of the target network data packets are extracted.

[0007] The AI ​​hub uses historical network traffic and preset artificial intelligence technology to determine a target attack detection model, and then performs lightweight processing on the target attack detection model to obtain a corresponding lightweight model, which is then distributed to the edge firewall; wherein, the historical network traffic contains botnet viruses.

[0008] The edge firewall utilizes the lightweight model to detect botnet viruses in the network traffic based on the characteristics of the target network packets, and updates the rules of the edge firewall to defend against botnet virus attacks.

[0009] Optionally, the step of collecting target network packets in network traffic through an edge firewall and extracting the features of the target network packets includes:

[0010] The initial network data packets in the network traffic are obtained through a preset multi-protocol interface, and the initial network data packets are preprocessed to obtain the target network data packets.

[0011] Parse the source IP address, destination IP address, source port, destination port, packet size, and protocol type corresponding to the target network data packet;

[0012] The protocol characteristics of the target network data packet are determined by using a preset protocol parsing engine based on the protocol type, the source IP address, the destination IP address, the source port, the destination port, the data packet size, the protocol type, and the protocol characteristics.

[0013] Optionally, the step of determining the target attack detection model using historical network traffic and preset artificial intelligence technology includes:

[0014] Determine the historical data characteristics corresponding to the historical network traffic, and determine the tags corresponding to the historical data characteristics; wherein, the tags are normal traffic or abnormal traffic;

[0015] Based on preset ratio conditions, the historical data features, and the labels corresponding to the historical data features, the corresponding training set and test set are determined.

[0016] The preset artificial intelligence model is trained based on the training set using the preset artificial intelligence technology to obtain the target attack detection model, and the accuracy of the target attack detection model is evaluated based on the test set.

[0017] Optionally, the step of using the lightweight model to detect botnet viruses in the network traffic based on the characteristics of the target network data packets includes:

[0018] The features of the target network data packet are input into the lightweight model based on a preset format, and the abnormal probability corresponding to the target network data packet is output using the lightweight model.

[0019] Determine the output time corresponding to the anomaly probability, and determine the corresponding target time difference based on the current time and the output time;

[0020] The target time decay coefficient is determined based on a preset time decay mechanism, and the anomaly score corresponding to the target network data packet is determined based on the target time decay coefficient, the anomaly probability, and the target time difference, so as to detect the botnet virus in the network traffic based on the anomaly score.

[0021] Optionally, detecting the botnet virus in the network traffic based on the anomaly score includes:

[0022] If the abnormal score is greater than a preset score threshold, the botnet virus in the network traffic is detected, and the risk status corresponding to the network traffic is determined to be high risk.

[0023] The identity of the device that generated the network traffic is verified based on a preset biometric verification method.

[0024] If the verification passes, the risk status of the network traffic will be updated from high risk to normal.

[0025] If verification fails, the network traffic will be blocked.

[0026] Optionally, after detecting botnet viruses in the network traffic based on the characteristics of the target network data packets, the method further includes:

[0027] The edge firewall generates a target hash fingerprint corresponding to the network traffic using a preset hash algorithm, and uploads the target hash fingerprint to the blockchain.

[0028] The target hash fingerprint is verified using other edge firewall nodes of the blockchain based on the Byzantine fault-tolerant consensus algorithm, and stored in the blockchain after successful verification.

[0029] Accordingly, updating the rules of the edge firewall to defend against the botnet virus attack includes:

[0030] The target event corresponding to the target hash fingerprint is sent to each edge firewall node of the blockchain using the smart contract of the blockchain;

[0031] The edge firewalls receive the target events and update the rules of each edge firewall based on the target events to defend against attacks from the botnet virus.

[0032] Optionally, after detecting botnet viruses in the network traffic based on the characteristics of the target network data packets, the method further includes:

[0033] The edge firewall encrypts and uploads the characteristics of each target network data packet in the network traffic to the AI ​​hub.

[0034] The AI ​​hub updates the target attack detection model based on the characteristics of each target network data packet, generates an incremental update package corresponding to the updated target attack detection model, and sends the incremental update package to the edge firewall.

[0035] The edge firewall updates the lightweight model based on the model incremental update package, so as to detect botnet viruses in the network traffic to be detected based on the updated lightweight model.

[0036] Secondly, this application provides a botnet virus defense device applied to a botnet virus defense system, the botnet virus defense system including an edge firewall, a blockchain, and an AI hub, the AI ​​hub being deployed in the cloud, and the edge firewall registering corresponding edge firewall nodes in the blockchain; wherein, the device includes:

[0037] The feature extraction module is used to collect target network data packets in network traffic through the edge firewall and extract the features of the target network data packets;

[0038] The model determination module is used to determine a target attack detection model through the AI ​​hub using historical network traffic and preset artificial intelligence technology, and to perform lightweight processing on the target attack detection model to obtain a corresponding lightweight model, and to distribute the lightweight model to the edge firewall; wherein, the historical network traffic includes botnet viruses;

[0039] The virus defense module is used to utilize the lightweight model in the edge firewall to detect botnet viruses in the network traffic based on the characteristics of the target network packets, and update the rules of the edge firewall to defend against botnet virus attacks.

[0040] Thirdly, this application provides an electronic device, comprising:

[0041] Memory, used to store computer programs;

[0042] A processor is used to execute the computer program to implement the aforementioned botnet virus defense method.

[0043] Fourthly, this application provides a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned botnet virus defense method.

[0044] In this application, a botnet virus defense system is first implemented by collecting target network data packets from network traffic through an edge firewall and extracting the characteristics of the target network data packets. Then, through the AI ​​hub, a target attack detection model is determined using historical network traffic and preset artificial intelligence technology. This target attack detection model is then lightweighted to obtain a corresponding lightweight model, which is then distributed to the edge firewall. The historical network traffic contains botnet viruses. Finally, the edge firewall uses the lightweight model to detect botnet viruses in the network traffic based on the characteristics of the target network data packets and updates the rules of the edge firewall to defend against botnet virus attacks. As can be seen from the above, this application first uses an edge firewall to monitor network traffic in real time, accurately capturing target network data packets and extracting their features, providing basic data support for subsequent detection. Next, the AI ​​hub utilizes historical network traffic containing botnet viruses, combined with pre-defined artificial intelligence technology to construct a target attack detection model, and then performs lightweight processing on the model. The lightweight model is then distributed to the edge firewall, ensuring detection capabilities while adapting to the resource characteristics of edge devices. Finally, the edge firewall, using the lightweight model, accurately detects botnet viruses in network traffic based on the previously extracted target network data packet features, and dynamically updates its own protection rules according to the detection results, achieving efficient defense against botnet virus attacks. In this way, this application, through the deep integration of edge firewall and AI technology, achieves localized deployment and real-time response of the attack detection model. The lightweight model significantly reduces the computational load on edge devices while maintaining detection accuracy, resulting in a faster defense response. Furthermore, this application utilizes the edge firewall and the lightweight model to monitor and analyze the behavioral characteristics of network traffic in real time, dynamically identifying distributed attack patterns rather than simply relying on traditional static rules, effectively identifying and defending against botnet viruses. Attached Figure Description

[0045] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0046] Figure 1 A flowchart of a botnet virus defense method provided in this application;

[0047] Figure 2 This application provides a specific flowchart for handling abnormal traffic.

[0048] Figure 3 This application provides an interactive diagram of a specific botnet virus defense system.

[0049] Figure 4 A flowchart illustrating a specific botnet virus defense method provided in this application;

[0050] Figure 5 This application provides a schematic diagram of the structure of a botnet virus defense device;

[0051] Figure 6 This application provides a structural diagram of an electronic device. Detailed Implementation

[0052] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0053] With the rapid development of internet technology, cybersecurity threats are constantly increasing, especially the harm caused by botnet viruses. Botnets infect a large number of computers or devices, turning them into "zombie" nodes for malicious attacks. These infected devices are usually remotely controlled and used to carry out malicious activities such as DDoS attacks, sending spam, and stealing user information. Traditional firewall technology mainly relies on rule bases and signature matching to detect known attacks, but in the face of complex and constantly evolving botnet viruses, traditional firewalls often cannot identify and defend against unknown attack methods in a timely manner. Firewall systems usually lack intelligent features and have limited ability to respond to unknown or mutated attacks. As virus propagation methods become more diversified and stealthy, the limitations of traditional firewall defenses become increasingly prominent. Therefore, this application provides a botnet virus defense solution that can improve the defense effect against botnet viruses.

[0054] See Figure 1 As shown, this invention discloses a botnet virus defense method applied to a botnet virus defense system. The botnet virus defense system includes an edge firewall, a blockchain, and an AI hub. The AI ​​hub is deployed in the cloud, and the edge firewall registers corresponding edge firewall nodes in the blockchain. The method may include:

[0055] Step S11: Collect target network data packets in network traffic through the edge firewall and extract the characteristics of the target network data packets.

[0056] It's important to note that in botnet virus defense systems, edge firewalls are deployed at the network edge, such as branch offices or IoT (Internet of Things) gateways, undertaking distributed traffic preprocessing and real-time interception tasks. The edge firewall's processing unit integrates a CPU (Central Processing Unit) and a GPU (Graphics Processing Unit) working collaboratively; the GPU accelerates AI (Artificial Intelligence) model inference, such as the parallel computation of CNN (Convolutional Neural Network), while the CPU handles traffic rule matching and protocol parsing. The edge firewall's storage unit includes cache and persistent storage; the cache stores real-time traffic characteristics, while persistent storage stores historical network traffic, AI model parameters, and defense rule bases.

[0057] In this embodiment, the edge firewall first obtains initial network data packets from network traffic through a preset multi-protocol interface and preprocesses these packets to obtain the target network data packets. The preset multi-protocol interface supports multi-protocol access, including Ethernet, Wi-Fi, and dedicated IoT interfaces, and supports traffic throughput of 1Gbps-100Gbps. Next, it needs to parse information such as the source IP address, destination IP address, source port, destination port, data packet size, and protocol type corresponding to the target network data packets. In one specific implementation, the code for extracting network data packet information is shown below:

[0058] import scapy.all as scapy

[0059] def extract_traffic_features(packet):

[0060] # Extracting key features of network packets

[0061] features = {}

[0062] features['src_ip'] = packet[scapy.IP].src

[0063] features['dst_ip'] = packet[scapy.IP].dst

[0064] features['protocol'] = packet[scapy.IP].proto

[0065] features['packet_length'] = len(packet)

[0066] return features

[0067] Example: Extracting features from packet capture files

[0068] packets = scapy.rdpcap('traffic.pcap')

[0069] traffic_data = [extract_traffic_features(packet) for packet inpackets]

[0070] Because the edge firewall has a built-in protocol parsing engine that supports the parsing of IoT protocols such as MQTT (Message Queuing Telemetry Transport) and CoAP (Constrained Application Protocol), it can utilize the preset protocol parsing engine to analyze protocol characteristics based on protocol type. Specifically, for the MQTT protocol, it can parse the Topic, QoS (Quality of Service) level, and Payload content to identify abnormal publishing and subscription behaviors. For the CoAP protocol, it can analyze the URI (Uniform Resource Identifier) ​​path, request method, and message type to detect botnet heartbeat characteristics. In one specific implementation, the parsing code for the MQTT and CoAP protocols is shown below:

[0071] def protocol_semantic_analysis(packet: object) -> dict:

[0072] Perform deep protocol semantic analysis to detect botnet characteristics targeting the MQTT / CoAP protocol.

[0073] Parameters: packet: A network data packet object, which must include the protocol type and parsing fields.

[0074] Returns: dict: A dictionary containing risk assessment values ​​(0.0-1.0) and feature descriptions.

[0075] #MQTT Protocol Anomaly Detection Logic

[0076] ifpacket.protocol == "MQTT":

[0077] #Detecting anomalies in topic hierarchy depth

[0078] topic_depth = len(packet.topic.split(' / '))

[0079] If topic_depth > 3: # The threshold is derived from statistical analysis of botnet viruses in historical network traffic.

[0080] return {

[0081] 'risk': 0.8,

[0082] 'feature': 'TopicDepthExceed',

[0083] 'evidence': f'MQTT topic-level depth anomaly ({topic_depth} layers)'

[0084] }

[0085] # CoAP Protocol Anomaly Detection Logic

[0086] elif packet.protocol == "CoAP":

[0087] # Detecting false flood attack signatures

[0088] if packet.msg_type == "NON" and packet.code.startswith("4"):

[0089] return {

[0090] 'risk': 0.65,

[0091] 'feature': 'CoAP_ErrorFlood',

[0092] 'evidence': f'CoAP exception response code {packet.code}'

[0093] }

[0094] # Default returns a risk-free status

[0095] return {'risk': 0.0, 'feature': 'Normal'}

[0096] As can be seen, MQTT protocol parsing supports in-depth detection at the Topic level, such as path identification of / bot_ctrl / update, and CoAP protocol parsing supports abnormal distribution analysis of CoAP message types, such as early warning of abnormal proportions of CON (Confirmable) / NON (Non-confirmable) messages.

[0097] Then, the edge firewall can determine the characteristics of the target network data packet based on the source IP address, destination IP address, source port, destination port, data packet size, protocol type, and protocol characteristics corresponding to the target network data packet.

[0098] Step S12: Through the AI ​​hub, a target attack detection model is determined using historical network traffic and preset artificial intelligence technology, and the target attack detection model is lightweighted to obtain a corresponding lightweight model. The lightweight model is then sent to the edge firewall; wherein, the historical network traffic contains botnet viruses.

[0099] It should be noted that in the botnet virus defense system, the AI ​​hub is deployed in the cloud and can employ deep learning and reinforcement learning algorithms to train a target attack detection model to help edge firewalls identify complex botnet attack behaviors. Specifically, to train the target attack detection model, the AI ​​hub first determines the historical data features corresponding to historical network traffic and identifies the labels corresponding to these features; the labels are either normal or abnormal traffic. Then, based on preset ratio conditions, historical data features, and the labels corresponding to these features, appropriate training and test sets are determined. Finally, a preset artificial intelligence model is trained on the training set using preset artificial intelligence technology to obtain the target attack detection model, and the accuracy of the target attack detection model can be evaluated based on the test set. That is, the AI ​​hub can be trained based on federated learning and a large amount of historical network traffic to determine the target attack detection model, which can extract attack features and identify abnormal behavior. In one specific implementation, the code for training the target attack detection model based on a supervised learning model, such as random forest, is shown below:

[0100] from sklearn.ensemble import RandomForestClassifier

[0101] from sklearn.model_selection import train_test_split

[0102] from sklearn.metrics import accuracy_score

[0103] # Load historical data features corresponding to historical network traffic

[0104] X = load_feature_data() # Feature matrix

[0105] y = load_labels() # Labels: 0 indicates normal traffic, 1 indicates abnormal traffic

[0106] # Divide the training set and the test set

[0107] X_train, X_test, y_train, y_test = train_test_split(X, y, test_size=0.2, random_state=42)

[0108] # Training a random forest model

[0109] model = RandomForestClassifier(n_estimators=100, random_state=42)

[0110] model.fit(X_train, y_train)

[0111] # Model Evaluation

[0112] y_pred = model.predict(X_test)

[0113] print(f"Model accuracy: {accuracy_score(y_test, y_pred):.2f}")

[0114] After the AI ​​hub trains the target attack detection model, it can be lightweighted to obtain a lightweight model, which is then deployed to the edge firewall. Once deployed, the edge firewall can use the lightweight model to analyze network traffic and detect abnormal behavior, such as frequent access to the same target by a large number of unknown IPs or fluctuations in malicious traffic, thereby predicting and identifying potential botnet activity.

[0115] Step S13: The edge firewall uses the lightweight model to detect botnet viruses in the network traffic based on the characteristics of the target network data packets, and updates the rules of the edge firewall to defend against the botnet virus attack.

[0116] In this embodiment, after deploying a lightweight model corresponding to the target attack detection model on the edge firewall, the lightweight model can be used to detect botnet viruses. The specific process includes: first, inputting the characteristics of the target network data packet into the lightweight model of the edge firewall based on a preset format, and then using the lightweight model to output the anomaly probability corresponding to the target network data packet; next, determining the output time corresponding to the anomaly probability, and determining the corresponding target time difference based on the current time and the output time; finally, determining the target time decay coefficient based on a preset time decay mechanism, and determining the anomaly score corresponding to the target network data packet based on the target time decay coefficient, the anomaly probability, and the target time difference, so as to detect botnet viruses in network traffic based on the anomaly score. Specifically, the lightweight model can be used to determine the anomaly probability corresponding to the target network data packet based on the characteristics of the target network data packet. Then, the anomaly score corresponding to the target network data packet can be determined based on the preset time decay mechanism and the anomaly probability. In one specific implementation, the implementation code for determining the anomaly score based on the preset time decay mechanism is shown below:

[0117] import numpy as np

[0118] def calculate_priority(anomaly_score, delta_time, traffic_similarity,

[0119] alpha=0.6, beta=0.3, gamma=0.1, lambda_=0.1)

[0120] Parameter description:

[0121] anomaly_score: The probability of anomalies (0~1) output by the lightweight model;

[0122] delta_time: The difference (in seconds) between the current time and the time of the first detection;

[0123] traffic_similarity: Traffic pattern similarity (0~1);

[0124] alpha, beta, gamma: Weighting coefficients (default values ​​are configurable);

[0125] lambda_: Time decay coefficient;

[0126] time_decay = np.exp(-lambda_ * delta_time) # Calculate the time decay factor

[0127] priority = alpha * anomaly_score + beta * time_decay + gamma * traffic_similarity # Calculate response priority

[0128] return priority

[0129] Example call, DDoS attack scenario, dynamically adjusting weights:

[0130] ddos_weights = {'alpha': 0.7, 'beta': 0.2, 'gamma': 0.1}

[0131] priority = calculate_priority(

[0132] anomaly_score=0.95,

[0133] delta_time=300, # The attack has lasted for 5 minutes

[0134] traffic_similarity=0.8,

[0135] **ddos_weights )

[0137] if priority > 0.6:

[0138] block_traffic(flow)

[0139] As can be seen from the above, this embodiment can combine LSTM (Long Short-Term Memory Network) to dynamically calculate the time decay factor. This allows for an adaptive sliding window mechanism for attack strength. In this way, the priority of abnormal traffic depends not only on the current anomaly probability (anomaly_score) but also on the time decay factor and traffic pattern similarity. Time decay controls the priority to gradually decrease as the duration of abnormal traffic increases, thus avoiding prolonged resource occupation.

[0140] To handle abnormal traffic in real time, in one specific implementation, the edge firewall can be designed with a real-time traffic processing module to block or restrict abnormal traffic. That is, network traffic can be processed directly based on anomaly scores. The implementation code for the real-time traffic processing module is shown below:

[0141] import time

[0142] def time_decay(last_seen, lambda_=0.1):

[0143] # Calculate weight decay based on time

[0144] delta_time = time.time() - last_seen

[0145] return np.exp(-lambda_ * delta_time)

[0146] def calculate_priority(anomaly_score, last_seen_time, traffic_pattern_score):

[0147] # Calculate traffic priority scoring

[0148] time_score = time_decay(last_seen_time)

[0149] return anomaly_score + 0.5 * time_score + 0.3 * traffic_pattern_score

[0150] Example: Processing real-time traffic

[0151] def handle_traffic_flow(traffic):

[0152] for flow in traffic: # Iterate through each flow

[0153] priority = calculate_priority(flow['anomaly_score'], flow['last_seen'], flow['pattern_score'])

[0154] If priority > threshold: # threshold (blocking threshold)

[0155] block_traffic(flow) # Block high-priority abnormal traffic

[0156] else:

[0157] allow_traffic(flow) # Allow normal traffic

[0158] In another specific implementation, see Figure 2 As shown, the above-mentioned detection of botnet viruses in network traffic based on the anomaly score can include: if the anomaly score is greater than a preset score threshold, the botnet virus in the network traffic is detected, and the risk status corresponding to the network traffic is determined to be high risk; then, the device identity that generated the network traffic is verified based on a preset biometric verification method; if the verification is successful, the risk status of the network traffic is updated from high risk to normal; if the verification fails, the network traffic is intercepted. Specifically, when the anomaly score is greater than the preset score threshold, a two-factor biometric verification is forcibly triggered, namely, liveness detection + voiceprint recognition verification. Liveness detection can be performed through pupil focusing trajectory analysis, and voiceprint recognition can be performed through voiceprint MFCC (Mel-Frequency Cepstral Coefficients) feature matching. In addition, device fingerprint fusion technology, such as MAC address (Media Access Control Address) and hardware serial number hash, can be introduced to verify the device identity. When the verification is successful, the network traffic can be determined to be normal traffic and marked as whitelisted; if the verification fails, cross-device interception can be initiated. The implementation code is shown below:

[0159] if flow['priority_score'] > threshold:

[0160] if zero_trust_check(device_id) == False: # Call the zero-trust verification module block_traffic(flow)

[0161] It should be noted that in the botnet virus defense system, the edge firewall registers its corresponding edge firewall node in the blockchain. See also... Figure 3As shown, after an edge firewall detects a botnet virus in network traffic, it first generates a target hash fingerprint corresponding to the network traffic using a preset hash algorithm and uploads it to the blockchain. The preset hash algorithm can be HMAC-SHA256 (Hash-based Message Authentication Code with SHA-256). Then, the blockchain uses other edge firewall nodes to verify the target hash fingerprint based on the BFT consensus algorithm (Byzantine Fault Tolerance), and stores the target hash fingerprint on the blockchain after successful verification. This allows the hash fingerprints of the edge firewall nodes and the blockchain to be synchronized through the BFT consensus algorithm, combined with the blockchain's immutability for storing hash fingerprints. Next, the blockchain triggers a smart contract to generate a target event corresponding to the target hash fingerprint, i.e., a global threat rule, such as issuing a blocking policy when a Mirai fingerprint is detected. The target event can then be distributed to each edge firewall node on the blockchain. Upon receiving the target event, each edge firewall updates its rules based on the target event to defend against botnet attacks.

[0162] In this embodiment, see Figure 3 As shown, after detecting botnet viruses in network traffic based on the characteristics of target network data packets, the process can further include: first, encrypting and uploading the characteristics of each target network data packet in the network traffic to the AI ​​hub via the edge firewall; then, updating the target attack detection model based on the characteristics of each target network data packet via the AI ​​hub, generating an incremental update package corresponding to the updated target attack detection model, and distributing the incremental update package to the edge firewall; finally, updating the lightweight model via the edge firewall based on the incremental update package, so as to detect botnet viruses in the network traffic to be detected based on the updated lightweight model. Specifically, the AI ​​hub can synchronize the latest attack data from the edge firewall at a preset time interval, such as every hour. That is, when the edge firewall detects botnet viruses in the network traffic, the edge firewall can encrypt and upload the characteristics of each target network data packet in the network traffic via TLS 1.8 (Transport Layer Security) to the AI ​​hub, thereby triggering an incremental update of the target attack detection model in the AI ​​hub. The implementation code of the target attack detection model during incremental update is shown below:

[0163] def update_model(new_data, new_labels, model):

[0164] # Update target attack detection model

[0165] model.fit(new_data, new_labels)

[0166] return model

[0167] Example: Regularly load new data and update the model

[0168] new_data, new_labels = load_new_training_data()

[0169] model = update_model(new_data, new_labels, model)

[0170] Subsequently, the AI ​​hub can generate an incremental update package corresponding to the updated target attack detection model, i.e., the pruned model parameters, and distribute the incremental update package to each edge firewall. Upon receiving the incremental update package, the edge firewall can update its local lightweight model based on it. In this way, this embodiment can update the model through real-time data, thereby enhancing the adaptability of the botnet virus defense system, improving the accuracy and capability of protection, and forming a dynamic protection mechanism that is self-learning and self-adjusting. It is evident that the botnet virus defense system can intelligently judge the virus's propagation behavior, control channels, and packet characteristics, reducing the blind spots of traditional firewall technology in protecting against unknown attacks.

[0171] It should be noted that this embodiment can be integrated with the SIEM system (Security Information and Event Management) to push threat logs corresponding to abnormal traffic to Splunk or QRadar, and supports custom alarm rules, such as automatically generating work orders when the risk score is >0.7.

[0172] In one specific implementation, this embodiment can be applied to a scenario where a CT scanner in a hospital intranet frequently sends abnormal DICOM (Digital Imaging and Communications in Medicine) protocol data packets, suspected of being controlled by a botnet. An AI model can identify the abnormal traffic patterns, block malicious commands, and trigger a device firmware update.

[0173] As can be seen above, and see also Figure 4As shown, in this embodiment, for the botnet virus defense system, the system first collects target network data packets from network traffic through an edge firewall and extracts the characteristics of the target network data packets. Then, through the AI ​​hub, it uses historical network traffic and preset artificial intelligence technology to determine a target attack detection model, and performs lightweight processing on the target attack detection model to obtain a corresponding lightweight model, which is then distributed to the edge firewall. The historical network traffic contains botnet viruses. Finally, the edge firewall uses the lightweight model to detect botnet viruses in the network traffic based on the characteristics of the target network data packets, and updates the rules of the edge firewall to defend against botnet virus attacks. As shown above, this embodiment first uses an edge firewall to monitor network traffic in real time, accurately capturing target network data packets and extracting their features, providing basic data support for subsequent detection. Next, the AI ​​hub utilizes historical network traffic containing botnet viruses, combined with pre-defined artificial intelligence technology to construct a target attack detection model. This model is then lightweighted and distributed to the edge firewall, ensuring detection capabilities while adapting to the resource characteristics of edge devices. Finally, the edge firewall, using the lightweight model, accurately detects botnet viruses in network traffic based on the previously extracted target network data packet features, and dynamically updates its protection rules according to the detection results, achieving efficient defense against botnet virus attacks. In this way, this embodiment achieves localized deployment and real-time response of the attack detection model through the deep integration of edge firewall and AI technology. The lightweighted model significantly reduces the computational load on edge devices while maintaining detection accuracy, resulting in a faster defense response. Furthermore, this embodiment utilizes an edge firewall to monitor and analyze the behavioral characteristics of network traffic in real time through a lightweight model, dynamically identifying distributed attack patterns rather than simply relying on traditional static rules, effectively identifying and defending against botnet viruses. Furthermore, this embodiment is not only compatible with traditional computers, but also provides unified botnet virus defense for mobile devices and IoT devices, thereby covering a wider attack surface.

[0174] Accordingly, see Figure 5 As shown in the illustration, this application also provides a botnet virus defense device applied to a botnet virus defense system. The botnet virus defense system includes an edge firewall, a blockchain, and an AI hub. The AI ​​hub is deployed in the cloud, and the edge firewall registers corresponding edge firewall nodes in the blockchain. The device may include:

[0175] The feature extraction module 11 is used to collect target network data packets in network traffic through the edge firewall and extract the features of the target network data packets;

[0176] The model determination module 12 is used to determine a target attack detection model through the AI ​​hub using historical network traffic and preset artificial intelligence technology, and to perform lightweight processing on the target attack detection model to obtain a corresponding lightweight model, and to distribute the lightweight model to the edge firewall; wherein, the historical network traffic includes botnet viruses;

[0177] The virus defense module 13 is used to utilize the lightweight model in the edge firewall to detect botnet viruses in the network traffic based on the characteristics of the target network packets, and update the rules of the edge firewall to defend against the attacks of the botnet viruses.

[0178] In some specific embodiments, the feature extraction module 11 may include:

[0179] The network data packet acquisition unit is used to acquire initial network data packets in the network traffic through a preset multi-protocol interface, and to preprocess the initial network data packets to obtain the target network data packets;

[0180] The network packet parsing unit is used to parse the source IP address, destination IP address, source port, destination port, packet size, and protocol type corresponding to the target network packet;

[0181] The feature extraction unit is used to parse protocol features based on the protocol type using a preset protocol parsing engine, and to determine the features of the target network data packet based on the source IP address, the destination IP address, the source port, the target port, the data packet size, the protocol type, and the protocol features.

[0182] In some specific embodiments, the model determination module 12 may include:

[0183] A historical data feature determination unit is used to determine the historical data features corresponding to the historical network traffic and to determine the tags corresponding to the historical data features; wherein, the tags are normal traffic or abnormal traffic;

[0184] The training set determination unit is used to determine the corresponding training set and test set based on a preset ratio condition, the historical data features, and the labels corresponding to the historical data features;

[0185] The model evaluation unit is used to train a preset artificial intelligence model based on the training set using the preset artificial intelligence technology to obtain the target attack detection model, and to evaluate the accuracy of the target attack detection model based on the test set.

[0186] In some specific embodiments, the virus defense module 13 may include:

[0187] The anomaly probability determination submodule is used to input the features of the target network data packet into the lightweight model based on a preset format, and use the lightweight model to output the anomaly probability corresponding to the target network data packet.

[0188] The time difference determination submodule is used to determine the output time corresponding to the anomaly probability, and to determine the corresponding target time difference based on the current time and the output time;

[0189] The virus detection submodule is used to determine a target time decay coefficient based on a preset time decay mechanism, and to determine an anomaly score corresponding to the target network data packet based on the target time decay coefficient, the anomaly probability, and the target time difference, so as to detect the botnet virus in the network traffic based on the anomaly score.

[0190] In some specific embodiments, the virus detection submodule may include:

[0191] A risk status determination unit is used to detect the botnet virus in the network traffic and determine the risk status of the network traffic as high risk if the anomaly score is greater than a preset score threshold.

[0192] A device authentication unit is used to verify the identity of the device that generates the network traffic based on a preset biometric authentication method.

[0193] The risk status update unit is used to update the risk status of the network traffic from high risk to normal when the device authentication of the network traffic passes.

[0194] A network traffic interception unit is used to intercept network traffic when device authentication fails.

[0195] In some specific embodiments, the botnet virus defense device may further include:

[0196] The hash fingerprint upload module is used to generate a target hash fingerprint corresponding to the network traffic through the edge firewall using a preset hash algorithm, and upload the target hash fingerprint to the blockchain.

[0197] The hash fingerprint storage module is used to verify the target hash fingerprint using other edge firewall nodes of the blockchain based on the Byzantine fault-tolerant consensus algorithm, and store the target hash fingerprint in the blockchain after successful verification.

[0198] Accordingly, the virus defense module 13 may include:

[0199] The target event distribution unit is used to distribute the target event corresponding to the target hash fingerprint to each edge firewall node of the blockchain using the smart contract of the blockchain;

[0200] The rule update unit is used to receive the target event using each of the edge firewalls and update the rules of each of the edge firewalls based on the target event to defend against the attack of the botnet virus.

[0201] In some specific embodiments, the botnet virus defense device may further include:

[0202] The feature-encrypted upload unit is used to encrypt and upload the features of each target network data packet in the network traffic to the AI ​​hub through the edge firewall;

[0203] The model incremental update package distribution unit is used to update the target attack detection model based on the characteristics of each target network data packet through the AI ​​hub, generate the model incremental update package corresponding to the updated target attack detection model, and distribute the model incremental update package to the edge firewall.

[0204] The lightweight model update unit is used to update the lightweight model based on the model incremental update package through the edge firewall, so as to detect botnet viruses in the network traffic to be detected based on the updated lightweight model.

[0205] Furthermore, embodiments of this application also disclose an electronic device, Figure 6 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the botnet virus defense method disclosed in any of the foregoing embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0206] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0207] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0208] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including computer programs capable of performing the botnet virus defense method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.

[0209] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned botnet virus defense method. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0210] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0211] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0212] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0213] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0214] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for defending against botnet viruses, characterized in that, An application is made to a botnet virus defense system, which includes an edge firewall, a blockchain, and an AI hub. The AI ​​hub is deployed in the cloud, and the edge firewall registers corresponding edge firewall nodes in the blockchain. The method includes: The target network data packets in network traffic are collected through the edge firewall, and the characteristics of the target network data packets are extracted. The AI ​​hub uses historical network traffic and preset artificial intelligence technology to determine a target attack detection model, and then performs lightweight processing on the target attack detection model to obtain a corresponding lightweight model, which is then distributed to the edge firewall; wherein, the historical network traffic contains botnet viruses. The edge firewall utilizes the lightweight model to detect botnet viruses in the network traffic based on the characteristics of the target network packets, and updates the rules of the edge firewall to defend against botnet virus attacks.

2. The botnet virus defense method according to claim 1, characterized in that, The process of collecting target network packets from network traffic through an edge firewall and extracting the characteristics of the target network packets includes: The initial network data packets in the network traffic are obtained through a preset multi-protocol interface, and the initial network data packets are preprocessed to obtain the target network data packets. Parse the source IP address, destination IP address, source port, destination port, packet size, and protocol type corresponding to the target network data packet; The protocol characteristics of the target network data packet are determined by using a preset protocol parsing engine based on the protocol type, the source IP address, the destination IP address, the source port, the destination port, the data packet size, the protocol type, and the protocol characteristics.

3. The botnet virus defense method according to claim 1, characterized in that, The method of determining the target attack detection model using historical network traffic and preset artificial intelligence technology includes: Determine the historical data characteristics corresponding to the historical network traffic, and determine the tags corresponding to the historical data characteristics; wherein, the tags are normal traffic or abnormal traffic; Based on preset ratio conditions, the historical data features, and the labels corresponding to the historical data features, the corresponding training set and test set are determined. The preset artificial intelligence model is trained based on the training set using the preset artificial intelligence technology to obtain the target attack detection model, and the accuracy of the target attack detection model is evaluated based on the test set.

4. The botnet virus defense method according to claim 1, characterized in that, The step of using the lightweight model to detect botnet viruses in network traffic based on the characteristics of the target network data packets includes: The features of the target network data packet are input into the lightweight model based on a preset format, and the abnormal probability corresponding to the target network data packet is output using the lightweight model. Determine the output time corresponding to the anomaly probability, and determine the corresponding target time difference based on the current time and the output time; The target time decay coefficient is determined based on a preset time decay mechanism, and the anomaly score corresponding to the target network data packet is determined based on the target time decay coefficient, the anomaly probability, and the target time difference, so as to detect the botnet virus in the network traffic based on the anomaly score.

5. The botnet virus defense method according to claim 4, characterized in that, The method of detecting the botnet virus in the network traffic based on the anomaly score includes: If the abnormal score is greater than a preset score threshold, the botnet virus in the network traffic is detected, and the risk status corresponding to the network traffic is determined to be high risk. The identity of the device that generated the network traffic is verified based on a preset biometric verification method. If the verification passes, the risk status of the network traffic will be updated from high risk to normal. If verification fails, the network traffic will be blocked.

6. The botnet virus defense method according to claim 1, characterized in that, After detecting botnet viruses in the network traffic based on the characteristics of the target network data packets, the method further includes: The edge firewall generates a target hash fingerprint corresponding to the network traffic using a preset hash algorithm, and uploads the target hash fingerprint to the blockchain. The target hash fingerprint is verified using other edge firewall nodes of the blockchain based on the Byzantine fault-tolerant consensus algorithm, and stored in the blockchain after successful verification. Accordingly, updating the rules of the edge firewall to defend against the botnet virus attack includes: The target event corresponding to the target hash fingerprint is sent to each edge firewall node of the blockchain using the smart contract of the blockchain; The edge firewalls receive the target events and update the rules of each edge firewall based on the target events to defend against attacks from the botnet virus.

7. The botnet virus defense method according to any one of claims 1 to 6, characterized in that, After detecting botnet viruses in the network traffic based on the characteristics of the target network data packets, the method further includes: The edge firewall encrypts and uploads the characteristics of each target network data packet in the network traffic to the AI ​​hub. The AI ​​hub updates the target attack detection model based on the characteristics of each target network data packet, generates an incremental update package corresponding to the updated target attack detection model, and sends the incremental update package to the edge firewall. The edge firewall updates the lightweight model based on the model incremental update package, so as to detect botnet viruses in the network traffic to be detected based on the updated lightweight model.

8. A botnet virus defense device, characterized in that, An application is made to a botnet virus defense system, which includes an edge firewall, a blockchain, and an AI hub. The AI ​​hub is deployed in the cloud, and the edge firewall registers corresponding edge firewall nodes in the blockchain. The device includes: The feature extraction module is used to collect target network data packets in network traffic through the edge firewall and extract the features of the target network data packets; The model determination module is used to determine a target attack detection model through the AI ​​hub using historical network traffic and preset artificial intelligence technology, and to perform lightweight processing on the target attack detection model to obtain a corresponding lightweight model, and to distribute the lightweight model to the edge firewall; wherein, the historical network traffic includes botnet viruses; The virus defense module is used to utilize the lightweight model in the edge firewall to detect botnet viruses in the network traffic based on the characteristics of the target network packets, and update the rules of the edge firewall to defend against botnet virus attacks.

9. An electronic device, characterized in that, The electronic device includes a processor and a memory; wherein the memory is used to store a computer program, which is loaded and executed by the processor to implement the botnet virus defense method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store computer programs, which, when executed by a processor, implement the botnet virus defense method as described in any one of claims 1 to 7.

Images