Network attack detection method and device

Abstract

The embodiment of the invention provides a network attack detection method and device, and relates to the technical field of network, and the method comprises the steps: carrying out the attack detection of a to-be-detected message based on a feature library, and obtaining a first detection result, and the feature library comprises the message features of a known network attack; if the first detection result represents that the to-be-detected message is not an attack message, calling a pre-trained attack detection model to carry out attack detection on the to-be-detected message to obtain a second detection result; and if the second detection result represents that the to-be-detected message is an attack message, updating the feature library according to the message features of the to-be-detected message. By applying the network attack detection scheme provided by the embodiment of the invention, the network attack can be accurately detected.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network, in particular to a network attack detection method and device. BACKGROUND

[0002] With the continuous development of Internet technology, the means of network attack is also more and more diversified. In order to resist various network attacks and protect the information security of the Internet platform and users on the Internet platform, an network attack detection scheme is urgently needed to accurately detect various network attacks and make corresponding defense measures. SUMMARY

[0003] The purpose of the embodiment of the present application is to provide a network attack detection method and device to accurately detect network attacks. The specific technical scheme is as follows:

[0004] In a first aspect, the present application provides a network attack detection method applied to a network device, comprising:

[0005] Performing attack detection on the to-be-detected packet based on a feature library to obtain a first detection result, wherein the feature library includes packet features of known network attacks;

[0006] If the first detection result indicates that the to-be-detected packet is not an attack packet, then calling a pre-trained attack detection model to perform attack detection on the to-be-detected packet to obtain a second detection result;

[0007] If the second detection result indicates that the to-be-detected packet is an attack packet, then updating the feature library according to the packet features of the to-be-detected packet.

[0008] In an embodiment of the present application, if the first detection result indicates that the to-be-detected packet is not an attack packet, then before performing attack detection on the to-be-detected packet by calling the pre-trained attack detection model, the method further comprises:

[0009] Extracting the packet features of the to-be-detected packet as first packet features;

[0010] Performing statistical analysis on the packet features of the received packets in a first time period to obtain baseline packet features, wherein the first time period is a time period of a preset time length from the time of receiving the to-be-detected packet;

[0011] Obtaining a deviation degree of the first packet features relative to the baseline packet features;

[0012] If it is determined that the to-be-detected packet is suspected to be an attack packet based on the deviation degree, then performing the step of calling the pre-trained attack detection model to perform attack detection on the to-be-detected packet.

[0013] In one embodiment of the present application, if the first detection result indicates that the to-be-detected packet is not an attack packet, the method further comprises:

[0014] determining a server type for attack detection of the to-be-detected packet according to a packet attribute of the to-be-detected packet, wherein the server type comprises a server deployed in an intranet and a server deployed in a cloud;

[0015] performing attack detection on the to-be-detected packet by calling a pre-trained attack detection model to obtain a second detection result, comprising:

[0016] if the determined server type is the server deployed in the intranet, scheduling an intranet cluster server to perform attack detection on the to-be-detected packet, and obtaining a result of attack detection on the to-be-detected packet by a first server in the intranet cluster server using a target model deployed by the first server as the second detection result, wherein the target model is a model selected from a plurality of pre-trained attack detection models based on feature values of the to-be-detected packet in a plurality of feature dimensions;

[0017] if the determined server type is the server deployed in the cloud, scheduling a second server deployed in the cloud to perform attack detection on the to-be-detected packet by using an attack detection model deployed by the second server as the second detection result.

[0018] In one embodiment of the present application, if the first detection result indicates that the to-be-detected packet is not an attack packet, the method further comprises:

[0019] identifying a key segment in the to-be-detected packet;

[0020] encoding the key segment to obtain encoded data;

[0021] obtaining a descriptive label of the to-be-detected packet;

[0022] generating a detection request packet containing the encoded data and the descriptive label;

[0023] scheduling the intranet cluster server to perform attack detection on the to-be-detected packet, and obtaining a result of attack detection on the to-be-detected packet by a first server in the intranet cluster server using a first target model deployed by the first server, comprising:

[0024] sending the detection request packet to the intranet cluster server;

[0025] obtaining a result of attack detection on the detection request packet by the first server in the intranet cluster server using the first target model deployed by the first server;

[0026] The second server of the scheduling cloud end deployment uses the attack detection model deployed by the second server to perform attack detection on the to-be-detected packet, and the result includes:

[0027] The detection request packet is sent to the second server deployed in the cloud end.

[0028] The second server uses the attack detection model deployed by the second server to perform attack detection on the detection request packet, and the result is obtained.

[0029] In an embodiment of the present application, the pre-trained attack detection model is called to perform attack detection on the to-be-detected packet, and a second detection result is obtained, including:

[0030] The to-be-detected packet is extracted from a plurality of preset feature dimensions to obtain feature values of each feature dimension.

[0031] Based on the feature values of each feature dimension, a second target model is selected from a plurality of pre-trained attack detection models.

[0032] The second target model is called to perform attack detection on the to-be-detected packet.

[0033] In an embodiment of the present application, before the attack detection on the to-be-detected packet based on the feature library, the method further includes:

[0034] The to-be-detected packet is matched with a packet blacklist and a packet whitelist, wherein the packet blacklist records information of attack packets, and the packet whitelist records information of non-attack packets.

[0035] If the to-be-detected packet matches the packet blacklist, it is determined that the to-be-detected packet is an attack packet.

[0036] If the to-be-detected packet matches the packet whitelist, it is determined that the to-be-detected packet is a non-attack packet.

[0037] If the to-be-detected packet does not match the packet blacklist or the packet whitelist, the attack detection on the to-be-detected packet based on the feature library is performed.

[0038] In an embodiment of the present application, the method further includes:

[0039] If the second detection result represents that the to-be-detected packet is an attack packet, the packet blacklist is updated according to packet information of the to-be-detected packet.

[0040] If the second detection result represents that the to-be-detected packet is not an attack packet, the packet whitelist is updated according to packet information of the to-be-detected packet.

[0041] In a second aspect, an apparatus for detecting network attacks is provided. The apparatus is applied to a network device and includes:

[0042] A first detection module is configured to detect a to-be-detected packet based on a feature library to obtain a first detection result, wherein the feature library includes packet features of known network attacks.

[0043] A second detection module is configured to, if the first detection result indicates that the to-be-detected packet is not an attack packet, invoke a pre-trained attack detection model to detect the to-be-detected packet to obtain a second detection result.

[0044] A feature library updating module is configured to, if the second detection result indicates that the to-be-detected packet is an attack packet, update the feature library based on packet features of the to-be-detected packet.

[0045] In an embodiment of the present application, the apparatus further includes:

[0046] A feature extraction module is configured to, if the first detection result indicates that the to-be-detected packet is not an attack packet, extract packet features of the to-be-detected packet as first packet features before the second detection module detects the to-be-detected packet.

[0047] A statistical analysis module is configured to statistically analyze packet features of received packets in a first time period to obtain reference packet features, wherein the first time period is a time period of a preset time length from a time when the to-be-detected packet is received.

[0048] A deviation obtaining module is configured to obtain a deviation of the first packet features relative to the reference packet features.

[0049] A packet determination module is configured to, if it is determined that the to-be-detected packet is suspected to be an attack packet based on the deviation, trigger the second detection module.

[0050] In an embodiment of the present application, if the first detection result indicates that the to-be-detected packet is not an attack packet, the apparatus further includes:

[0051] A type determination module is configured to, if the first detection result indicates that the to-be-detected packet is not an attack packet, determine a server type for detecting the to-be-detected packet based on packet attributes of the to-be-detected packet, wherein the server type includes a server deployed in an intranet and a server deployed in a cloud.

[0052] The second detection module includes:

[0053] The first scheduling submodule is configured to, if the determined server type is a server deployed in an intranet, schedule an intranet cluster server to perform attack detection on the to-be-detected packet, and obtain a result of attack detection performed by a first server in the intranet cluster server on the to-be-detected packet by using a target model deployed by the first server as a second detection result, wherein the target model is a model selected from a plurality of attack detection models pre-trained based on characteristic values of the to-be-detected packet in a plurality of characteristic dimensions.

[0054] The second scheduling submodule is configured to, if the determined server type is a server deployed in a cloud, schedule a second server deployed in the cloud to perform attack detection on the to-be-detected packet by using an attack detection model deployed by the second server, and obtain a result of the attack detection as the second detection result.

[0055] In an embodiment of the present application, the apparatus further comprises:

[0056] The request packet generation module is configured to, if the first detection result indicates that the to-be-detected packet is not an attack packet, identify a key segment in the to-be-detected packet, encode the key segment to obtain encoded data, obtain a descriptive label of the to-be-detected packet, and generate a detection request packet containing the encoded data and the descriptive label.

[0057] The first scheduling submodule is specifically configured to:

[0058] send the detection request packet to the intranet cluster server;

[0059] obtain a result of attack detection performed by the first server in the intranet cluster server on the detection request packet by using a first target model deployed by the first server;

[0060] The second scheduling submodule is specifically configured to:

[0061] send the detection request packet to the second server deployed in the cloud;

[0062] obtain a result of attack detection performed by the second server on the detection request packet by using an attack detection model deployed by the second server.

[0063] In an embodiment of the present application, the second detection module is specifically configured to:

[0064] perform feature extraction on the to-be-detected packet from a plurality of preset characteristic dimensions to obtain characteristic values of each characteristic dimension;

[0065] select a second target model from a plurality of attack detection models pre-trained based on the characteristic values of each characteristic dimension;

[0066] invoke the second target model to perform attack detection on the to-be-detected packet.

[0067] In one embodiment of the present application, the device further comprises:

[0068] The packet matching module is configured to match the to-be-detected packet with a packet blacklist and a packet whitelist before the feature library-based attack detection is performed on the to-be-detected packet, wherein the packet blacklist records information of attack packets, and the packet whitelist records information of non-attack packets.

[0069] The first determination module is configured to determine that the to-be-detected packet is an attack packet if the to-be-detected packet matches the packet blacklist.

[0070] The second determination module is configured to determine that the to-be-detected packet is a non-attack packet if the to-be-detected packet matches the packet whitelist.

[0071] The first execution module is configured to trigger the first detection module if the to-be-detected packet does not match the packet blacklist or the packet whitelist.

[0072] In one embodiment of the present application, the device further comprises:

[0073] The first update module is configured to update the packet blacklist according to packet information of the to-be-detected packet if the second detection result indicates that the to-be-detected packet is an attack packet.

[0074] The second update module is configured to update the packet whitelist according to packet information of the to-be-detected packet if the second detection result indicates that the to-be-detected packet is not an attack packet.

[0075] In a third aspect, an electronic device is provided, which includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory complete communication with each other through the communication bus.

[0076] The memory is configured to store a computer program.

[0077] The processor is configured to execute the program stored on the memory to implement the method steps of any one of the first aspect.

[0078] In a fourth aspect, a computer readable storage medium is provided, which stores a computer program, and the computer program is executed by a processor to implement the method steps of any one of the first aspect.

[0079] The embodiments of the present application have the following beneficial effects:

[0080] From the above, when detecting network attacks by using the scheme provided by the embodiments of the present application, the feature library is used to detect the to-be-detected packet once to obtain a first detection result, and in the case that the first detection result indicates that the to-be-detected packet is not an attack packet, the attack detection model is called again to detect the to-be-detected packet again to obtain a second detection result. In this way, the to-be-detected packet is detected by using two different attack detection methods, which can accurately detect whether the to-be-detected packet is an attack packet and improve the accuracy of network attack detection. Moreover, in the case that the second detection result indicates that the to-be-detected packet is an attack packet, the feature library is updated according to the packet features of the to-be-detected packet, which realizes the synchronous updating of the feature library with the continuous updating and upgrading of network attacks. In this way, in the subsequent detection process of other packets, most of the attack packets in the packets can be quickly detected based on the feature library, so that the detection accuracy is ensured, and the detection efficiency is improved and the computational overhead of network attack detection is reduced. BRIEF DESCRIPTION OF DRAWINGS

[0081] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and other embodiments can also be obtained by those skilled in the art based on these drawings.

[0082] Figure 1 The flowchart of the first network attack detection method provided by the embodiments of the present application is shown in the figure.

[0083] Figure 2 The flowchart of the second network attack detection method provided by the embodiments of the present application is shown in the figure.

[0084] Figure 3 The structure diagram of the first network attack detection device provided by the embodiments of the present application is shown in the figure.

[0085] Figure 4 The structure diagram of an electronic device provided by the embodiments of the present application is shown in the figure. DETAILED DESCRIPTION

[0086] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art based on the present application belong to the scope of protection of the present application.

[0087] Currently, there are various means of network attacks, and a traditional defense method is to formulate a corresponding packet matching condition based on packet attribute information, to generate a defense rule according to the packet matching condition, and to detect whether a network attack is received according to the defense rule; or to detect whether a network attack is received by a DPI (Deep Packet Inspection) mode based on feature library recognition.

[0088] However, both of the above two methods have the problems of fixed protection means and untimely updating, and can only defend against known network attacks, and often have no recognition and defense capability against unknown and new network attacks. For example, the DPI deep packet detection mainly adopts a recognition mechanism based on a feature library rule. This technology depends on a feature library, which contains attack features of network attack packets. When network attack detection is performed, the packet is matched with the features in the feature library, so as to realize network attack detection. In order to cope with the emerging network attack means, the feature library needs to be updated to obtain the latest feature information of network attacks (such as viruses, intrusions, etc.). It can be seen that this way of using DPI deep packet detection can only detect the network attacks corresponding to the features in the feature library, and it is difficult to recognize the variant attacks (such as SQL (Structured Query Language) injection variants) other than the network attacks corresponding to the features in the feature library. Moreover, the existing DPI deep packet detection scheme usually needs to be manually updated by the user to download the feature library update package and manually deploy it.

[0089] In addition, the detection rule formulated by the DPI deep packet detection mode based on the feature library is usually a static rule, and it is difficult to dynamically adjust the rule according to the real-time network attack features, resulting in a high false positive rate.

[0090] To solve the above technical problems, the embodiments of the present application provide a network attack detection method and device.

[0091] First, the execution subject of the network attack detection scheme provided by the embodiments of the present application is described.

[0092] The network attack detection scheme provided by the embodiments of the present application is used to protect the information security of the Internet platform and the users on the platform, and the network equipment deployed on the Internet platform can execute the network attack detection scheme provided by the embodiments of the present application to detect whether the packet received by the Internet platform is an attack packet. The above network equipment can be a firewall device deployed on the Internet platform.

[0093] Next, the network attack detection method and device provided by the embodiments of the present application are described in detail through specific embodiments.

[0094] Referring to Figure 1, a flowchart of a first network attack detection method is provided. In the embodiment, the method includes the following steps S101-S105.

[0095] Step S101: detecting the attack of the to-be-detected packet based on the feature library to obtain a first detection result.

[0096] The feature library includes the packet features of known network attacks.

[0097] The to-be-detected packet is introduced as follows.

[0098] In order to protect the information security of the Internet platform and the platform users, it is necessary to detect whether the platform is attacked in real time. Therefore, during the operation of the Internet platform, the packet received by the platform in real time can be regarded as a to-be-detected packet, and it is detected whether the packet is an attack packet. If it is detected that the packet is not an attack packet, the packet is released, and the Internet platform normally processes the packet. If it is detected that the packet is an attack packet, the packet is discarded to prevent the Internet platform from being attacked.

[0099] In addition to the packet received by the Internet platform in real time, the to-be-detected packet can also be a packet that needs to be detected whether it is an attack packet.

[0100] The specific process of detecting the attack of the to-be-detected packet based on the feature library is described as follows.

[0101] After obtaining the to-be-detected packet, the packet features of the to-be-detected packet can be extracted, and the packet features of the to-be-detected packet are matched with the packet features contained in the feature library. The feature library includes the packet features of known network attacks. If the packet features of the to-be-detected packet match at least one of the packet features of the known network attacks, it means that the to-be-detected packet belongs to the network attack corresponding to the matched packet features contained in the feature library. At this time, it can be determined that the to-be-detected packet is an attack packet, thereby generating a first detection result representing that the to-be-detected packet is an attack packet. If the packet features of the to-be-detected packet do not match all the packet features contained in the feature library, it means that the to-be-detected packet is not an attack packet. At this time, a first detection result representing that the to-be-detected packet is not an attack packet is generated.

[0102] Step S102: judging whether the first detection result represents that the to-be-detected packet is an attack packet. If not, step S103 is performed.

[0103] Specifically, the feature library includes packet features of known network attacks, and attack detection is performed based on the feature library, that is, attack detection is performed based on the packet features of known network attacks, to obtain a first detection result. If the first detection result indicates that the to-be-detected packet is an attack packet, it means that the network attack implemented by the to-be-detected packet is a known network attack, and the packet features of the known network attack have been recorded in the feature library. Therefore, in this case, there is no need to update the feature library according to the to-be-detected packet, and the to-be-detected packet can be directly discarded.

[0104] If the first detection result indicates that the to-be-detected packet is not an attack packet, it means that the network attack implemented by the to-be-detected packet can be a brand-new unknown network attack, or the to-be-detected packet can be a normal packet. Therefore, step S103 can be performed to perform attack detection on the to-be-detected packet again in a different manner.

[0105] Step S103: calling a pre-trained attack detection model to perform attack detection on the to-be-detected packet to obtain a second detection result.

[0106] The attack detection model is used to detect whether a packet is an attack packet, and detailed introduction of the attack detection model can be referred to subsequent embodiments, which will not be described here.

[0107] Specifically, in the case where the first detection result indicates that the to-be-detected packet is not an attack packet, the to-be-detected packet can be input to the attack detection model to enable the attack detection model to perform attack detection on the to-be-detected packet and output a second detection result.

[0108] Step S104: determining whether the second detection result indicates that the to-be-detected packet is an attack packet, and if yes, performing step S105.

[0109] If the second detection result indicates that the to-be-detected packet is not an attack packet, it means that the packet detection device uses both the attack detection manner based on the feature library and the attack detection manner using the attack detection model, and detects that the to-be-detected packet is not an attack packet. At this time, it can be accurately determined that the to-be-detected packet is a normal packet, and the Internet platform is not attacked.

[0110] If the second detection result indicates that the to-be-detected packet is an attack packet, it means that the network attack implemented by the to-be-detected packet is an unknown network attack. At this time, it can be determined that the to-be-detected packet is an attack packet, and step S105 can be performed to update the feature library.

[0111] Step S105: updating the feature library according to the packet features of the to-be-detected packet.

[0112] Specifically, in a case that the to-be-detected packet is determined to be an attack packet and the network attack implemented by the to-be-detected packet is an unknown network attack, the packet features of the to-be-detected packet can be extracted, the packet features of the to-be-detected packet are added to the feature library, and the feature library rules are adjusted. In this way, if a network attack of the same type as the to-be-detected packet is encountered subsequently, the network attack can be quickly and accurately detected based on the feature library.

[0113] As can be seen from the above, when detecting a network attack by applying the scheme provided in the embodiments of the present application, the to-be-detected packet is subjected to attack detection based on the feature library to obtain a first detection result. In a case that the first detection result indicates that the to-be-detected packet is not an attack packet, the to-be-detected packet is subjected to attack detection again by calling an attack detection model to obtain a second detection result. In this way, the to-be-detected packet is detected by using two different attack detection methods, which can accurately detect whether the to-be-detected packet is an attack packet and improve the accuracy of network attack detection. Moreover, in a case that the second detection result indicates that the to-be-detected packet is an attack packet, the feature library is updated according to the packet features of the to-be-detected packet, which realizes the synchronous updating of the feature library with the continuous updating and upgrading of network attacks. In this way, in the subsequent detection of other packets, most of the attack packets can be quickly detected based on the feature library, thereby ensuring the detection accuracy, improving the detection efficiency, and reducing the computational overhead of network attack detection.

[0114] For the packets received by the Internet platform, most of the packets are actually normal packets. If each packet is detected according to the process shown in steps S101-S105, not only the network device implementing the scheme will be greatly burdened, but also the time consumption for detecting network attacks will be prolonged, and the zero-day attack detection timeliness (the zero-day attack detection timeliness refers to the time length from receiving an attack packet to taking network attack defense measures) will be increased.

[0115] To solve the above technical problem, in an embodiment of the present application, if the first detection result indicates that the to-be-detected packet is not an attack packet, the to-be-detected packet can be processed according to the following steps one to four before the attack detection model is called to perform attack detection on the to-be-detected packet.

[0116] Step one: extracting the packet features of the to-be-detected packet as first packet features.

[0117] Specifically, the to-be-detected packet can be subjected to protocol analysis to obtain the packet content of the to-be-detected packet, and the packet content of the to-be-detected packet is subjected to feature extraction to obtain the first packet features.

[0118] For example, the HTTP method used by the message content of the to-be-detected message, the length of the message header of the to-be-detected message, the SQL syntax depth of the message content of the to-be-detected message, and the like can be extracted as the first message feature.

[0119] Step two: statistically analyze the message features of the received messages in the first time period to obtain the reference message features.

[0120] The first time period is a time period of a preset time length from the time of receiving the to-be-detected message.

[0121] The preset time length is a time length set in advance, for example, five minutes, six minutes, and the like.

[0122] Specifically, if the to-be-detected message is a message received in real time by an Internet platform, the first time period can be determined as a time period of a preset time length from the current time, the messages received in the time period are obtained, the message features of the obtained messages are extracted, the distribution of the extracted message features is counted, the statistical result representing the distribution of the message features is obtained, and the reference message features are generated according to the statistical result.

[0123] For example, for the message header length feature, the reference length of the message header length can be generated according to the distribution of the message header length feature in the statistical result, for example, the average length of the message header length of the messages in the first time period is calculated, and the average length is taken as the reference length.

[0124] Step three: obtain the deviation degree of the first message feature relative to the reference message feature.

[0125] The deviation degree represents the difference between the first message feature and the reference message feature. The reference message feature can be regarded as a standard value of the message features of the messages in the first time period. The greater the difference between the first message feature and the reference message feature, that is, the greater the deviation degree of the first message feature relative to the reference message feature, the farther the first message feature is from the standard value, and the greater the difference between the to-be-detected message and the normal message, indicating that the to-be-detected message is more likely to be an attack message.

[0126] Specifically, the distance between the first message feature and the reference message feature can be calculated, for example, the Euclidean distance, the cosine distance, and the like, and the distance is taken as the deviation degree of the first message feature relative to the reference message feature.

[0127] In addition, the first message feature and the reference message feature can each include multiple features of different dimensions, such as HTTP method, message header length, protocol feature, context abnormality, historical behavior feature, and the like. In this case, a weight coefficient corresponding to each dimension can be preset, and the distance can be calculated according to the weight coefficient corresponding to each dimension.

[0128] For example, when calculating the Euclidean distance between the first message feature and the reference message feature, the Euclidean distance between the first message feature and the reference message feature can be calculated by using a weighted Euclidean distance calculation method according to the weight coefficient corresponding to each dimension.

[0129] Step four: determining whether the to-be-detected message is an attack message according to the deviation. If it is determined that the to-be-detected message is suspected to be an attack message based on the deviation, a step of calling a pre-trained attack detection model to detect the to-be-detected message is performed.

[0130] Specifically, after the deviation is obtained, it can be determined whether the deviation is greater than or equal to a preset deviation threshold. Alternatively, according to a preset calculation rule, a score representing the suspiciousness of the to-be-detected message as an attack message is calculated according to the deviation, and it is determined whether the score is greater than or equal to a preset score threshold.

[0131] If the deviation is greater than or equal to the deviation threshold, or the score is greater than or equal to the score threshold, it indicates that the to-be-detected message is significantly different from a normal message. In this case, it can be determined that the to-be-detected message is suspected to be an attack message, and a step of calling an attack detection model to detect the to-be-detected message is performed.

[0132] If the deviation is less than the deviation threshold, or the score is less than the score threshold, it indicates that the to-be-detected message is a normal message. In this case, the to-be-detected message can be released.

[0133] As can be seen from the above, when detecting a network attack by using the scheme provided in the embodiments of the present application, a first message feature of a to-be-detected message is filtered before an attack detection model is called for detection. Only when it is determined that the to-be-detected message is suspected to be an attack message, the attack detection model is called. For a to-be-detected message that can be determined to be a normal message, the attack detection model does not need to be called. In this way, the load of a network device can be reduced, the time cost of detecting a network attack can be shortened, and the timeliness of detecting a zero-day attack can be improved.

[0134] The attack detection model mentioned in step S103 and the way of calling the attack detection model to detect an attack will be described below.

[0135] In an embodiment of the present application, when calling the pre-trained attack detection model to perform attack detection on the to-be-detected packet, feature extraction is performed on the to-be-detected packet from multiple preset feature dimensions to obtain feature values of each feature dimension; based on the feature values of each feature dimension, a second target model is selected from the pre-trained multiple attack detection models; and the second target model is called to perform attack detection on the to-be-detected packet.

[0136] Different attack detection models can be deployed in the network device, and different attack detection models detect different attack types according to different detection mechanisms.

[0137] The attack types detected by different attack detection models and the corresponding detection mechanisms are described below.

[0138] 1. Attack type: XSS (Cross Site Scripting, Cross-site Scripting)

[0139] Detection mechanism: analyze the HTML (Hyper Text Markup Language, HyperText Markup Language) / JS (JavaScript) code structure of the to-be-detected packet, detect whether the script injection is abnormal, for example, detect whether there is an unescaped <script>标签、事件处理器异常嵌套等等。

[0140] 检测这种攻击类型的攻击检测模型可以是一种NLP(Natural LanguageProcessing，自然语言处理)模型。针对这种攻击类型，该NLP模型可以解析用户输入语义，识别可疑的DOM操作意图，例如检测是否存在动态生成恶意弹窗代码。

[0141] 2、攻击类型：CSRF(Cross-site request forgery，跨站请求伪造)

[0142] 检测机制：验证请求来源于用户行为的关联性，检测非预期的跨域请求，例如，检测是否存在异常Referer头、高频率重复操作等等。

[0143] 针对这种攻击类型，检测这种攻击类型的攻击检测模型可以结合用户行为画像(如用户登录IP、操作时间)与请求上下文分析，识别异常会话模式。

[0144] 3、攻击类型：文件上传漏洞

[0145] 检测机制：检测待检测报文中文件内容特征、文件头与扩展名是否匹配，例如，内容特征是否包含伪装的图片木马、php文件伪装成.jpg文件等等。

[0146] 检测这种攻击类型的攻击检测模型可以是一种CNN(Convolutional NeuralNetworks，卷积神经网络)模型。针对这种攻击类型，该CNN模型可以分析文件二进制流，识别隐藏的恶意代码段。

[0147] 4、攻击类型：路径遍历攻击

[0148] 检测机制：解析待检测报文中携带的URL参数中的路径跳转符号(如.. / 、～)，结合上下文判断报文发送者是否试图通过待检测报文越权访问系统文件。

[0149] 针对这种攻击类型，检测这种攻击类型的攻击检测模型可以分析待检测报文的路径参数与正常业务逻辑的偏离度，按照偏离度检测是否存在路径遍历攻击。例如分析从用户上传目录跳转到 / etc / passwd的路径。

[0150] 5、攻击类型：DDoS攻击

[0151] 检测机制：分析流量时空分布，识别流量模型突变，例如是否出现突发高频请求、异常地理IP集中访问等等。

[0152] 检测这种攻击类型的攻击检测模型可以是一种LSTM(Long Short-Term Memory，长短期记忆网络)模型。针对这种攻击类型，该LSTM模型可以建立流量基线，检测偏离阈值的突发流量，并且使用聚类算法区分正常用户与异常网络行为。

[0153] 6、攻击类型：缓冲区溢出攻击

[0154] 检测机制：检测输入数据长度(如超长字符串的长度)是否异常、是否存在针对特定内存的操作指令(如shellcode中的0×90NOP雪橇)。

[0155] 检测这种攻击类型的攻击检测模型可以通过动态污点追踪(Taint Analysis)结合指令序列模式识别，定位恶意代码注入点。

[0156] 7、攻击类型：DNS(Domain Name System，域名系统)欺骗 / 劫持

[0157] 检测机制：验证DNS响应与历史记录的偏离(如TTL(Time to Live，生存周期)异常、权威服务器变更)，识别伪造解析结果。

[0158] 检测这种攻击类型的攻击检测模型可以是一种图神经网络模型。针对这种攻击类型，检测这种攻击类型的攻击检测模型可以基于DNS关系图谱分析，检测异常域名解析路径，如检测非注册商IP相应权威记录。

[0159] 8、攻击类型：SSL / TLS(Secure Sockets Layer / Transport Layer Security)中间人攻击

[0160] 检测机制：检测证书链是否异常(如自签名证书、过期证书)、协议片本是否降级(如强制使用低版本TLS)。

[0161] 检测这种攻击类型的攻击检测模型可以是一种强化学习模型。针对这种攻击类型，检测这种攻击类型的攻击检测模型可以评估握手过程中的参数合规性(如密钥交换算法强度)，识别非标准加密行为。

[0162] 9、攻击类型：数据泄露(爬虫)

[0163] 检测机制：分析API调用频率、参数组合规律，识别自动化爬取行为(如高频分页请求、异常User-Agent)。

[0164] 针对这种攻击类型，检测这种攻击类型的攻击检测模型可以进行用户行为序列建模(如隐马尔可夫模型)，区分人类操作与机器脚本的交互模式。

[0165] 10、攻击类型：API滥用 / 越权访问

[0166] 检测机制：验证请求参数与身份权限的关联(如普通用户尝试访问管理者接口、参数包含未授权资源ID)。

[0167] 针对这种攻击类型，检测这种攻击类型的攻击检测模型可以基于知识图谱的权限关系推理，实时匹配请求路径与RBAC(Role-Based Access Control，角色访问控制)策略。

[0168] 11、攻击类型：敏感信息暴露

[0169] 检测机制：检测待检测报文的响应内容中的敏感字段(如身份证号、银行卡号等)、未加密传输的凭证数据。

[0170] 针对这种攻击类型，检测这种攻击类型的攻击检测模型可以是一种词向量模型，网络设备可以结合正则表达式以及词向量魔心，识别上下文语义中的隐私数据。例如，"密码：123456”与"密码字段已加密”的差异。

[0171] 12、攻击类型：其他攻击

[0172] 检测机制：分析邮件正文 / 链接的语义特征(如仿冒品牌LOGO、短链跳转异常)、附件文件风险。

[0173] 检测这种攻击类型的攻击检测模型可以是一种视觉模型(如ResNet)和 / 或NLP模型。针对这种攻击类型，视觉模型可以检测待检测报文包含的图片中的伪造UI(UserInterface，用户界面)元素；NLP模型识别文本中的诱导性语言(例如"紧急重置密码”)。

[0174] 13、攻击类型：供应链攻击

[0175] 检测机制：检测软件依赖库的哈希值变化、异常动态链接行为(如合法软件加载恶意DLL(Dynamic Link Library，动态链接库))。

[0176] 针对这种攻击类型，检测这种攻击类型的攻击检测模型可以根据图数据库追踪组件依赖链，结合动态行为沙箱检测隐蔽的代码注入。

[0177] 14、攻击类型：无文件攻击

[0178] 检测机制：检测内存中的非驻留型恶意代码(如PowerShell恶意指令、注册表注入)。

[0179] 针对这种攻击类型，检测这种攻击类型的攻击检测模型可以进行实时内存快照分析(例如BERT(Bidirectional Encoder Representations from Transformers，基于Transformer的双向编码器表征)模型解析进程命令行参数)，识别可以的内存操作模式。

[0180] 检测上述14种攻击类型的模型涉及行为分析、异常检测、语义理解以及模式学习等等技术，利用这些模型，能够做到对报文的语义级分析(如SQL语法树解析、API调用序列建模)，实现对未知威胁和高级隐蔽攻击的动态识别，突破现有特征库规则的固有边界。

[0181] 接下来，对从多个攻击检测模型中选择第二目标模型，调用第二目标模型对待检测报文进行攻击检测的方式进行说明。

[0182] 网络设备可以从多个预设的特征维度对待检测报文进行特征提取，得到各特征维度的特征值，根据提取得到的特征值，确定负责检测该特征值下的报文的攻击检测模型，作为第二目标模型，从而将待检测报文输入至第二目标模型，得到第二目标模型对待检测报文进行攻击检测输出的检测结果，作为第二检测结果。

[0183] 由以上可见，应用本申请实施例提供的方案检测网络攻击时，可以预先训练有多个攻击检测模型，这样基于待检测报文在各特征维度下的特征值，可以准确选择出用于检测待检测报文所属类型的模型，作为第二目标模型，从而调用第二目标模型，能够准确对待检测报文进行攻击检测。因此，应用本申请实施例提供的网络攻击检测方案，能够提高网络攻击的准确性。

[0184] 本申请的一个实施例中，网络设备还可以定期获得互联网平台中生成的报文误报 / 漏报日志，根据所获得日志修正或者说更新攻击检测模型的模型参数、权重。在对攻击检测模型进行修正时，可以采用增量更新的方式，对攻击检测模型进行更新升级。并且，网络设备可以保留攻击检测模型的历史版本，这样当当前版本的攻击检测模型的误报率超过一定阈值，可以快速回滚至攻击检测模型的上一历史版本。

[0185] 下面对上述步骤S103中提及的攻击检测模型以及调用攻击检测模型进行攻击检测的另一种方式进行说明。

[0186] 在第一检测结果表征待检测报文不是攻击报文的情况下，可以采用以下实施例提供的方式来调用攻击检测模型进行攻击检测。

[0187] 本申请的一个实施例中，若第一检测结果表征待检测报文不是攻击报文，则根据待检测报文的报文属性，确定对待检测报文进行攻击检测的服务器类型，其中，服务器类型包括：部署于内网的服务器和部署于云端的服务器。

[0188] 若所确定的服务器类型为部署于内网的服务器，则调度内网集群服务器对待检测报文进行攻击检测，获得内网集群服务器中的第一服务器使用其所部署的第一目标模型对待检测报文进行攻击检测的结果，作为第二检测结果，其中，第一目标模型为：基于待检测报文在多个特征维度的特征值从预先训练的多个攻击检测模型中选择的模型。

[0189] 若所确定的服务器类型为部署于云端的服务器，则调度云端部署的第二服务器使用其所部署的攻击检测模型对待检测报文进行攻击检测的结果，作为第二检测结果。

[0190] 首先，对服务器和攻击检测模型的部署进行说明。

[0191] 互联网平台的内网中部署有多个服务器，由这多个服务器组成内网集群服务器，内网集群服务器中的每一服务器可以用于处理特定的流量，不同服务器处理不同类型的流量。每一服务器中部署一种攻击检测模型，该攻击检测模型基于该服务器所处理的流量的流量特征训练得到，即能够使得每一服务器所部署的攻击检测模型为该服务器对应的垂直领域的检测模型。例如，可以将该服务器已处理流量中的报文以及已处理流量中报文的报文类型(包括正常报文、攻击报文)作为模型样本，训练该服务器上部署的攻击检测模型，这样使得训练所得模型对于该服务器所处理的流量具有较高检测精度。

[0192] 在训练时，采用联邦学习框架，聚合多防火墙设备的局部攻击特征，构建内网专属知识库，确定敏感数据不出域。

[0193] 另外，在攻击检测模型的训练过程中，可以在模型的训练集中注入一定比例的扰动样本来对模型进行对抗样本学习。

[0194] 互联网平台的云端也部署有服务器，云端中部署的服务器可以用于处理来自外网的各种流量，该服务器中也部署有攻击检测模型，该攻击检测模型基于跨域的、多种不同类型的流量作为模型样本训练得到，覆盖APT(Advanced Persistent Threat，高级长期威胁)攻击全生命周期行为。

[0195] 本申请的一个实施例中，可以在云端部署弹性伸缩的检测服务，支持按需调用云端服务器，按照需要调用云端服务器进行攻击检测的报文的数量分配为云端服务器分配计算资源，以使得云端服务器使用所分配的计算资源，调用所部署的攻击检测模型进行检测。

[0196] 内网的内网集群服务器和云端的服务器用于处理不同的流量(或者说报文)，对于待检测报文而言，若待检测报文的第一检测结果表征待检测报文不是攻击报文，则可以利用这些服务器上部署的攻击检测模型对待检测报文再次进行检测。

[0197] 具体的，在第一检测结果表征待检测报文不是攻击报文的情况下，可以获得待检测报文的报文属性，例如待检测报文的五元组，根据待检测报文的报文属性，按照预先设置的报文属性与服务器类型之间的匹配规则，确定与待检测报文的报文属性相匹配的服务器类型，作为对待检测报文进行攻击检测的服务器类型。

[0198] 另外，可以根据待检测报文的其他信息确定服务器类型。例如，对于敏感报文或者要求低延迟的报文，可以调用内网中部署的服务器，对于来自外网的报文，可以调用云端部署的模型。

[0199] 服务器类型包括部署于内网的服务器和部署于云端的服务器。下面对上述确定的服务器类型为这两种服务器的情况下进行攻击检测的具体过程进行说明。

[0200] 一、对待检测报文进行攻击检测的服务器类型为部署于内网的服务器

[0201] 网络设备可以调度内网集群服务器对待检测报文进行攻击检测。由于内网集群服务器集合了多台服务器，每台服务器上均部署有攻击检测模型，这种情况下，可以按照以下两种方式中任一种实现服务器调度，进而进行攻击检测。

[0202] 第一种方式中，由网络设备在内网集群服务器所包含的服务器中确定需要调度的服务器，所确定的服务器即为第一服务器，第一服务器中部署的攻击检测模型即为第一目标模型，网络设备调度所确定的服务器，以使得该服务器使用所部署的第一目标模型对待检测报文进行攻击检测，得到检测结果，并将该检测结果反馈给网络设备，这样网络设备即可获得所反馈的检测结果，作为第二检测结果。

[0203] 第二种方式中，网络设备可以向内网集群服务器中负责管理各服务器的管理设备或者具有服务器管理功能的服务器发送报文检测请求，由内网集群服务器中的管理设备或者具有服务器管理功能的服务器确定上述第一服务器，从而调度第一服务器使用期所部署的第一目标模型对待检测报文进行攻击检测，得到检测结果，并将该检测结果反馈给网络设备，这样网络设备即可获得所反馈的检测结果，作为第二检测结果。

[0204] 在上述两种方式中，无论是网络设备、管理设备还是具有服务器管理功能的服务器，在确定第一服务器时，可以根据待检测报文在多个特征维度的特征值，确定负责检测该特征值下的报文的攻击检测模型，作为第一目标模型，从而将部署有所确定第一目标模型的服务器作为第一服务器。

[0205] 二、对待检测报文进行攻击检测的服务器类型为部署于云端的服务器

[0206] 这种情况下，网络设备调度云端部署的第二服务器，以使得第二服务器使用其所部署的攻击检测模型对待检测报文进行攻击检测，得到检测结果，并将该检测结果反馈给网络设备，这样网络设备即可获得所反馈的检测结果，作为第二检测结果。

[0207] 由以上可见，应用本申请实施例提供的方案检测异常行为时，在内网和云端均部署有服务器，且服务器中部署有攻击检测模型，在进行网络攻击检测时，根据待检测报文的报文属性，确定需要调度的服务器类型，从而利用所调度服务器上部署的模型进行攻击检测。不同属性的报文可以利用不同模型进行攻击检测。这样一方面各个服务器上部署的模型可以有针对性的对于特定类型的报文进行检测，从而提高网络攻击检测的准确性，另一方面，不同服务器上部署的模型可以并行对多个报文进行检测，这样能够提高网络攻击检测效率。经测试，采用本申请实施例提供的网络攻击检测方案能够使零日攻击检测时效从72小时缩短至2小时，满足金融交易等场景下的毫秒级响应需求。

[0208] 网络设备在调度服务器对待检测报文进行攻击检测时，可以采用以下实施例提及的方式进行调度。

[0209] 本申请的一个实施例中，在第一检测结果表征待检测报文不是攻击报文的情况下，网络设备一方面确定对待检测报文进行攻击检测的服务器类型，另一方面识别待检测报文中的关键片段；对关键片段进行编码，得到编码数据；获得待检测报文的描述性标签；生成包含编码数据和描述性标签的检测请求包。

[0210] 上述关键片段包括待检测报文中的HTTP头、DNS查询负载等等。

[0211] 获得上述关键片段后，采用编码技术，对关键片段进行编码，得到编码数据。例如，采用熵编码算法(如LZMA(Lempel-Ziv-Markov chain-Algorithm，Lempel-Ziv马尔可夫链算法))对关键片段进行编码压缩。

[0212] 上述描述性标签可以包括待检测报文的元数据标签，如IP信誉值、协议类型等等。

[0213] 在获得上述编码数据以及描述性标签后，生成包含编码数据和描述性标签的检测请求包。

[0214] 当网络设备确定出对待检测报文进行攻击检测的服务器类型以及生成检测请求包后，可以向所确定的服务器发送检测请求包。

[0215] 当确定出对待检测报文进行攻击检测的服务器类型为部署于内网的服务器的情况下，网络设备向内网集群服务器发送检测请求包，获得内网集群服务器中第一服务器使用其所部署的第一目标模型对检测请求包进行攻击检测的结果。

[0216] 当确定出对待检测报文进行攻击检测的服务器类型为部署于云端的服务器的情况下，网络设备向云端部署的第二服务器发送检测请求包，获得第二服务器使用其所部署的攻击检测模型对检测请求包进行攻击检测的结果。

[0217] 由以上可见，应用本申请实施例提供的方案检测网络攻击时，网络设备可以生成检测请求包，从而向服务器发送该检测请求包，获得服务器反馈的检测结果，即可获得第二检测结果，检测请求包中包含待检测报文的描述性标签以及对待检测报文中关键片段进行编码后得到的编码数据，而非整个待检测报文，可见，检测请求包属于一种轻量化的请求包，这样能够减缓网络设备与各服务器之间的传输压力，节省资源。

[0218] 参见图2，提供了第二种网络攻击检测方法的流程示意图，本实施例中，上述方法包括以下步骤S201-S206。

[0219] 步骤S201：网络设备生成检测请求包。

[0220] 网络设备可以按照上述方式，生成包含编码数据和描述性标签的检测请求包。

[0221] 步骤S202：网络设备确定对待检测报文进行攻击检测的服务器类型。

[0222] 步骤S203：当确定出对待检测报文进行攻击检测的服务器类型为部署于内网的服务器的情况下，网络设备向内网集群服务器发送检测请求包，获得内网集群服务器中第一服务器使用其所部署的第一目标模型对检测请求包进行攻击检测的结果。

[0223] 步骤S204：当确定出对待检测报文进行攻击检测的服务器类型为部署于云端的服务器的情况下，网络设备向云端部署的第二服务器发送检测请求包，获得第二服务器使用其所部署的攻击检测模型对检测请求包进行攻击检测的结果。

[0224] 步骤S205：网络设备根据所获得检测结果，对待检测报文执行放行 / 丢弃操作。

[0225] 步骤S206：若所获得检测结果表征待检测报文是攻击报文，则根据待检测报文的报文特征，更新特征库。

[0226] 在基于特征库对待检测报文进行攻击检测之前，网络设备还可以按照以下实施例中提及的方式进行处理。

[0227] 本申请的一个实施例中，在基于特征库对待检测报文进行攻击检测之前，将待检测报文分别与报文黑名单、报文白名单进行匹配；若待检测报文与报文黑名单匹配，则确定待检测报文为攻击报文；若待检测报文与报文白名单匹配，则确定待检测报文为非攻击报文；若待检测报文与报文黑名单、报文白名单均不匹配，则执行基于特征库对待检测报文进行攻击检测的步骤。

[0228] 其中，报文黑名单中记录攻击报文的信息，报文白名单中记录非攻击报文的信息。

[0229] 上述报文信息可以包括报文的五元组等等信息。

[0230] 具体的，网络设备可以将待检测报文的报文信息与报文黑名单中记录的信息进行匹配，若待检测报文的报文信息与报文黑名单中记录的信息匹配成功，则确定待检测报文为攻击报文，此时，可以丢弃待检测报文；若待检测报文的报文信息与报文黑名单中记录的信息匹配失败，则说明待检测报文可能是非攻击报文，也可能是未记录的、未知的攻击报文。

[0231] 网络设备还可以将待检测报文的报文信息与报文白名单中记录的信息进行匹配，若待检测报文的报文信息与报文白名单中记录的信息匹配成功，则确定待检测报文为非攻击报文，此时，可以放行待检测报文；若待检测报文的报文信息与报文白名单中记录的信息匹配失败，则说明待检测报文可能是攻击报文，也可能是除白名单对应的非攻击报文之外的非攻击。

[0232] 在待检测报文与报文黑名单、报文白名单均不匹配的情况下，可以执行上述步骤S101基于特征库对待检测报文进行攻击检测。

[0233] 另外，网络设备可以实时或定期维护报文黑名单和报文白名单，清除报文黑名单和报文白名单中记录的、长时间未匹配到的信息，避免这些信息占用网络设备内存。

[0234] 由以上可见，应用本申请实施例提供的方案检测网络攻击时，在基于特征库对待检测报文进行攻击检测之前可以利用报文黑名单和报文白名单进行一次初步过滤，这样能够减轻网络设备的检测工作量，提高检测效率。

[0235] 本申请的一个实施例中，在上述第二检测结果表征待检测报文是攻击报文的情况下，可以根据待检测报文的报文信息，更新报文黑名单；在第二检测结果表征待检测报文不是攻击报文的情况下，可以根据待检测报文的报文信息，更新报文白名单。

[0236] 具体的，若第二检测结果表征待检测报文是攻击报文，说明通过待检测报文实施的网络攻击是一种全新的、未知的网络攻击，因此，一方面可以根据待检测报文的报文特征，更新特征库，另一方面还可以将待检测报文的报文信息添加至报文黑名单中，这样在后续遇到与待检测报文相同攻击类型的报文时，可以直接利用报文黑名单确定其为攻击报文，这样无需使用特征库和攻击检测模型进行攻击检测，提高了网络攻击检测的检测效率。

[0237] 若第二检测结果表征待检测报文不是攻击报文，可以将待检测报文的报文信息添加至报文白名单中，这样后续遇到与待检测报文类似的报文，网络设备可以利用报文白名单直接确定其为非攻击报文，同样也无需使用特征库和攻击检测模型验证其是否为非攻击报文，这样能够减轻网络设备的检测工作量，提高检测效率。

[0238] 另外，报文黑名单和报文白名单根据第二检测结果进行动态跟新，这样无需人工维护报文黑名单和报文白名单，显著降低了运维成本，并且避免了人为维护的偏差导致的误判风险。

[0239] 与上述网络攻击检测方法相对应，本申请实施例还提供了一种网络攻击检测装置。

[0240] 本申请的一个实施例中，参见图3，提供了一种网络攻击检测装置的结构示意图，本实施例中，上述装置应用于网络设备，包括：

[0241] 第一检测模块301，用于基于特征库对待检测报文进行攻击检测，得到第一检测结果，其中，所述特征库中包括：已知网络攻击的报文特征；

[0242] 第二检测模块302，用于若所述第一检测结果表征所述待检测报文不是攻击报文，则调用预先训练的攻击检测模型对所述待检测报文进行攻击检测，得到第二检测结果；

[0243] 特征库更新模块303，若所述第二检测结果表征所述待检测报文是攻击报文，则根据所述待检测报文的报文特征，更新所述特征库。

[0244] 由以上可见，应用本发明实施例提供的方案检测网络攻击时，基于特征库对待检测报文进行一次攻击检测，得到第一检测结果，在第一检测结果表征待检测报文不是攻击报文的情况下，再调用攻击检测模型对待检测报文再次进行攻击检测，得到第二检测结果，这样采用两种不同的攻击检测方式对待检测报文进行检测，能够准确检测待检测报文是否为攻击报文，提高网络攻击检测的准确性。并且，在第二检测结果表征待检测报文是攻击报文的情况下，还根据待检测报文的报文特征更新特征库，实现了随着网络攻击的不停更新换代而同步更新特征库，这样能够在后续对其他报文的检测过程中，基于特征库即可迅速检测出其中的大部分攻击报文，从而在保证检测准确性的同时，还能够提高检测效率以及降低网络攻击检测的计算开销。

[0245] 本申请的一个实施例中，所述装置还包括：

[0246] 特征提取模块，用于若所述第一检测结果表征所述待检测报文不是攻击报文，则在所述调用预先训练的攻击检测模型对所述待检测模型进行攻击检测之前，提取所述待检测报文的报文特征，作为第一报文特征；

[0247] 统计分析模块，用于对第一时间段内所接收报文的报文特征进行统计分析，得到基准报文特征，其中，所述第一时间段为：从所述待检测报文的接收时刻起向前预设时长的时间段；

[0248] 偏离度获得模块，用于获得所述第一报文特征相对于基准报文特征的偏离度；

[0249] 报文确定模块，用于若基于所述偏离度确定所述待检测报文疑似为攻击报文，则触发所述第二检测模块302。

[0250] 由以上可见，应用本申请实施例提供的方案检测网络攻击时，在调用攻击检测模型进行检测之前，先根据待检测报文的第一报文特征进行一次过滤，只有在确定待检测报文疑似为攻击报文的情况下才调用攻击检测模型，而对于可以确定为正常报文的待检测报文则无需调用，这样能够减轻网络设备的负载，缩短检出网络攻击的耗时，减小零日攻击检测时效。

[0251] 本申请的一个实施例中，若所述第一检测结果表征所述待检测报文不是攻击报文，所述装置还包括：

[0252] 类型确定模块，用于若所述第一检测结果表征所述待检测报文不是攻击报文，根据所述待检测报文的报文属性，确定对所述待检测报文进行攻击检测的服务器类型，其中，所述服务器类型包括：部署于内网的服务器和部署于云端的服务器；

[0253] 所述第二检测模块302，包括：

[0254] 第一调度子模块，用于若所确定的服务器类型为部署于内网的服务器，则调度内网集群服务器对所述待检测报文进行攻击检测，获得所述内网集群服务器中的第一服务器使用其所部署的目标模型对所述待检测报文进行攻击检测的结果，作为第二检测结果，其中，所述目标模型为：基于所述待检测报文在多个特征维度的特征值从预先训练的多个攻击检测模型中选择的模型；

[0255] 第二调度子模块，用于若所确定的服务器类型为部署于云端的服务器，则调度云端部署的第二服务器使用其所部署的攻击检测模型对所述待检测报文进行攻击检测的结果，作为第二检测结果。

[0256] 由以上可见，应用本申请实施例提供的方案检测异常行为时，在内网和云端均部署有服务器，且服务器中部署有攻击检测模型，在进行网络攻击检测时，根据待检测报文的报文属性，确定需要调度的服务器类型，从而利用所调度服务器上部署的模型进行攻击检测。不同属性的报文可以利用不同模型进行攻击检测。这样一方面各个服务器上部署的模型可以有针对性的对于特定类型的报文进行检测，从而提高网络攻击检测的准确性，另一方面，不同服务器上部署的模型可以并行对多个报文进行检测，这样能够提高网络攻击检测效率。经测试，采用本申请实施例提供的网络攻击检测方案能够使零日攻击检测时效从72小时缩短至2小时。

[0257] 本申请的一个实施例中，所述装置还包括：

[0258] 请求包生成模块，用于若所述第一检测结果表征所述待检测报文不是攻击报文，识别所述待检测报文中的关键片段；对所述关键片段进行编码，得到编码数据；获得所述待检测报文的描述性标签；生成包含所述编码数据和所述描述性标签的检测请求包；

[0259] 所述第一调度子模块，具体用于：

[0260] 向内网集群服务器发送所述检测请求包；

[0261] 获得所述内网集群服务器中第一服务器使用其所部署的第一目标模型对所述检测请求包进行攻击检测的结果；

[0262] 所述第二调度子模块，具体用于：

[0263] 向云端部署的第二服务器发送所述检测请求包；

[0264] 获得所述第二服务器使用其所部署的攻击检测模型对所述检测请求包进行攻击检测的结果。

[0265] 由以上可见，应用本申请实施例提供的方案检测网络攻击时，网络设备可以生成检测请求包，从而向服务器发送该检测请求包，获得服务器反馈的检测结果，即可获得第二检测结果，检测请求包中包含待检测报文的描述性标签以及对待检测报文中关键片段进行编码后得到的编码数据，而非整个待检测报文，可见，检测请求包属于一种轻量化的请求包，这样能够减缓网络设备与各服务器之间的传输压力，节省资源。

[0266] 本申请的一个实施例中，所述第二检测模块302，具体用于：

[0267] 从多个预设的特征维度对所述待检测报文进行特征提取，得到各特征维度的特征值；

[0268] 基于各特征维度的特征值，从预先训练的多个攻击检测模型中，选择第二目标模型；

[0269] 调用所述第二目标模型对所述待检测报文进行攻击检测。

[0270] 由以上可见，应用本申请实施例提供的方案检测网络攻击时，可以预先训练有多个攻击检测模型，这样基于待检测报文在各特征维度下的特征值，可以准确选择出用于检测待检测报文所属类型的模型，作为第二目标模型，从而调用第二目标模型，能够准确对待检测报文进行攻击检测。因此，应用本申请实施例提供的网络攻击检测方案，能够提高网络攻击的准确性。

[0271] 本申请的一个实施例中，所述装置还包括：

[0272] 报文匹配模块，用于在所述基于特征库对待检测报文进行攻击检测之前，将待检测报文分别与报文黑名单、报文白名单进行匹配，其中，所述报文黑名单中记录攻击报文的信息，所述报文白名单中记录非攻击报文的信息；

[0273] 第一确定模块，用于若所述待检测报文与所述报文黑名单匹配，则确定所述待检测报文为攻击报文；

[0274] 第二确定模块，用于若所述待检测报文与所述报文白名单匹配，则确定所述待检测报文为非攻击报文；

[0275] 第一执行模块，用于若所述待检测报文与所述报文黑名单、所述报文白名单均不匹配，则触发所述第一检测模块301。

[0276] 由以上可见，应用本申请实施例提供的方案检测网络攻击时，在基于特征库对待检测报文进行攻击检测之前可以利用报文黑名单和报文白名单进行一次初步过滤，这样能够减轻网络设备的检测工作量，提高检测效率。

[0277] 本申请的一个实施例中，所述装置还包括：

[0278] 第一更新模块，用于若所述第二检测结果表征所述待检测报文是攻击报文，则根据所述待检测报文的报文信息，更新所述报文黑名单；

[0279] 第二更新模块，用于若所述第二检测结果表征所述待检测报文不是攻击报文，则根据所述待检测报文的报文信息，更新所述报文白名单。

[0280] 本方案中，若第二检测结果表征待检测报文是攻击报文，说明通过待检测报文实施的网络攻击是一种全新的、未知的网络攻击，因此，一方面可以根据待检测报文的报文特征，更新特征库，另一方面还可以将待检测报文的报文信息添加至报文黑名单中，这样在后续遇到与待检测报文相同攻击类型的报文时，可以直接利用报文黑名单确定其为攻击报文，这样无需使用特征库和攻击检测模型进行攻击检测，提高了网络攻击检测的检测效率。

[0281] 若第二检测结果表征待检测报文不是攻击报文，可以将待检测报文的报文信息添加至报文白名单中，这样后续遇到与待检测报文类似的报文，网络设备可以利用报文白名单直接确定其为非攻击报文，同样也无需使用特征库和攻击检测模型验证其是否为非攻击报文，这样能够减轻网络设备的检测工作量，提高检测效率。

[0282] 本申请实施例还提供了一种电子设备，如图4所示，包括处理器401、通信接口402、存储器403和通信总线404，其中，处理器401，通信接口402，存储器403通过通信总线404完成相互间的通信。

[0283] 存储器403，用于存放计算机程序；

[0284] 处理器401，用于执行存储器403上所存放的程序时，实现上述任一网络攻击检测方法的步骤。

[0285] 上述电子设备提到的通信总线可以是外设部件互连标准(Peripheral ComponentInterconnect，PCI)总线或扩展工业标准结构(Extended Industry StandardArchitecture，EISA)总线等。该通信总线可以分为地址总线、数据总线、控制总线等。为便于表示，图中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。

[0286] 通信接口用于上述电子设备与其他设备之间的通信。

[0287] 存储器可以包括随机存取存储器(Random Access Memory，RAM)，也可以包括非易失性存储器(Non-Volatile Memory，NVM)，例如至少一个磁盘存储器。可选的，存储器还可以是至少一个位于远离前述处理器的存储装置。

[0288] 上述的处理器可以是通用处理器，包括中央处理器(Central Processing Unit，CPU)、网络处理器(Network Processor，NP)等；还可以是数字信号处理器(DigitalSignalProcessor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现场可编程门阵列(Field-Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。

[0289] 在本申请提供的又一实施例中，还提供了一种计算机可读存储介质，该计算机可读存储介质内存储有计算机程序，所述计算机程序被处理器执行时实现上述任一网络攻击检测方法的步骤。

[0290] 在本申请提供的又一实施例中，还提供了一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述实施例中任一网络攻击检测方法。

[0291] 在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本发明实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘Solid State Disk(SSD))等。

[0292] 需要说明的是，在本文中，诸如第一和第二等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且，术语"包括”、"包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下，由语句"包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、物品或者设备中还存在另外的相同要素。

[0293] 本说明书中的各个实施例均采用相关的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于装置、电子设备、计算机可读存储介质、计算机程序产品实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。

[0294] 以上所述仅为本发明的较佳实施例，并非用于限定本发明的保护范围。凡在本发明的精神和原则之内所作的任何修改、等同替换、改进等，均包含在本发明的保护范围内。< / script>

Claims

1. A network attack detection method characterized by, The method is applied to a network device and comprises the following steps: performing attack detection on a to-be-detected packet based on a feature library to obtain a first detection result, wherein the feature library comprises packet features of known network attacks; if the first detection result indicates that the to-be-detected packet is not an attack packet, calling a pre-trained attack detection model to perform attack detection on the to-be-detected packet to obtain a second detection result; if the second detection result indicates that the to-be-detected packet is an attack packet, updating the feature library according to packet features of the to-be-detected packet.

2. The method of claim 1, wherein, if the first detection result indicates that the to-be-detected packet is not an attack packet, before the calling of the pre-trained attack detection model to perform attack detection on the to-be-detected packet, the method further comprises the following steps: extracting packet features of the to-be-detected packet as first packet features; performing statistical analysis on packet features of received packets in a first time period to obtain baseline packet features, wherein the first time period is a time period of a preset length from a time of receiving the to-be-detected packet; obtaining a deviation degree of the first packet features relative to the baseline packet features; if it is determined that the to-be-detected packet is suspected to be an attack packet based on the deviation degree, performing the step of calling the pre-trained attack detection model to perform attack detection on the to-be-detected packet.

3. The method of claim 1, wherein, if the first detection result indicates that the to-be-detected packet is not an attack packet, the method further comprises the following steps: determining a server type for performing attack detection on the to-be-detected packet according to packet attributes of the to-be-detected packet, wherein the server type comprises a server deployed in an intranet and a server deployed in a cloud; the calling of the pre-trained attack detection model to perform attack detection on the to-be-detected packet to obtain the second detection result comprises the following steps: if the determined server type is the server deployed in the intranet, scheduling an intranet cluster server to perform attack detection on the to-be-detected packet, obtaining a result of using a target model deployed in a first server in the intranet cluster server to perform attack detection on the to-be-detected packet as the second detection result, wherein the target model is a model selected from pre-trained attack detection models based on feature values of the to-be-detected packet in multiple feature dimensions; if the determined server type is the server deployed in the cloud, scheduling a second server deployed in the cloud to use an attack detection model deployed in the second server to perform attack detection on the to-be-detected packet to obtain a result as the second detection result.

4. The method of claim 3, wherein, if the first detection result indicates that the to-be-detected packet is not an attack packet, the method further comprises the following steps: identifying a key segment in the to-be-detected packet; encoding the key segment to obtain encoded data; obtaining a descriptive label of the to-be-detected packet; generating a detection request packet comprising the encoded data and the descriptive label; the scheduling of the intranet cluster server to perform attack detection on the to-be-detected packet to obtain a result of using a first target model deployed in a first server in the intranet cluster server to perform attack detection on the to-be-detected packet comprises the following steps: sending the detection request packet to the intranet cluster server; obtaining a result of attack detection of the detection request packet by a first target model deployed on a first server in the intranet cluster server; the result of attack detection of the detection request packet by the second server deployed in the cloud comprises: sending the detection request packet to the second server deployed in the cloud; obtaining a result of attack detection of the detection request packet by the second server deployed in the cloud.

5. The method of claim 1, wherein, the second detection result comprises: extracting features of the detection packet from a plurality of preset feature dimensions to obtain feature values of each feature dimension; selecting a second target model from a plurality of pre-trained attack detection models based on the feature values of each feature dimension; calling the second target model to detect attacks on the detection packet.

6. The method according to any one of claims 1-5, characterized in that, Before the attack detection on the detection packet based on the feature library, the method further comprises: matching the detection packet with a black list of packets and a white list of packets, wherein the black list of packets records information of attack packets, and the white list of packets records information of non-attack packets; if the detection packet matches the black list of packets, the detection packet is determined as an attack packet; if the detection packet matches the white list of packets, the detection packet is determined as a non-attack packet; if the detection packet does not match the black list of packets or the white list of packets, the attack detection on the detection packet based on the feature library is performed.

7. The method of claim 6, wherein, The method further comprises: if the second detection result indicates that the detection packet is an attack packet, updating the black list of packets according to packet information of the detection packet; if the second detection result indicates that the detection packet is not an attack packet, updating the white list of packets according to packet information of the detection packet.

8. A network attack detection apparatus characterized by comprising: The device is applied to a network equipment and comprises: a first detection module configured to detect attacks on a detection packet based on a feature library to obtain a first detection result, wherein the feature library comprises packet features of known network attacks; a second detection module configured to, if the first detection result indicates that the detection packet is not an attack packet, call a pre-trained attack detection model to detect attacks on the detection packet to obtain a second detection result; a feature library updating module configured to, if the second detection result indicates that the detection packet is an attack packet, update the feature library according to packet features of the detection packet.

9. The apparatus of claim 8, wherein, The device further comprises: a feature extraction module configured to, if the first detection result indicates that the detection packet is not an attack packet, extract packet features of the detection packet as first packet features before the calling of the pre-trained attack detection model to detect attacks on the detection packet. a statistical analysis module, configured to perform statistical analysis on packet features of received packets in a first time period to obtain baseline packet features, wherein the first time period is a time period of a preset length of time from a time of receiving the to-be-detected packet; an offset degree obtaining module, configured to obtain an offset degree of the first packet features relative to the baseline packet features; a packet determining module, configured to trigger the second detection module if it is determined based on the offset degree that the to-be-detected packet is suspected to be an attack packet.

10. The apparatus of claim 8, wherein, If the first detection result indicates that the to-be-detected packet is not an attack packet, the apparatus further comprises: a type determining module, configured to determine a server type for performing attack detection on the to-be-detected packet according to packet attributes of the to-be-detected packet if the first detection result indicates that the to-be-detected packet is not an attack packet, wherein the server type includes a server deployed in an intranet and a server deployed in a cloud. The second detection module comprises: a first scheduling submodule, configured to schedule an intranet cluster server to perform attack detection on the to-be-detected packet if the determined server type is the server deployed in the intranet, and obtain a result of attack detection performed by a first server in the intranet cluster server on the to-be-detected packet using a target model deployed by the first server as a second detection result, wherein the target model is a model selected from a plurality of attack detection models pre-trained based on feature values of the to-be-detected packet in a plurality of feature dimensions; a second scheduling submodule, configured to schedule a second server deployed in a cloud to perform attack detection on the to-be-detected packet using an attack detection model deployed by the second server as a second detection result if the determined server type is the server deployed in the cloud.

11. The apparatus of claim 10, wherein, The apparatus further comprises: a request packet generating module, configured to identify a key segment in the to-be-detected packet if the first detection result indicates that the to-be-detected packet is not an attack packet, encode the key segment to obtain encoded data, obtain a descriptive label of the to-be-detected packet, and generate a detection request packet containing the encoded data and the descriptive label; The first scheduling submodule is specifically configured to: send the detection request packet to the intranet cluster server; obtain a result of attack detection performed by the first server in the intranet cluster server on the detection request packet using a first target model deployed by the first server; The second scheduling submodule is specifically configured to: send the detection request packet to the second server deployed in the cloud; obtain a result of attack detection performed by the second server on the detection request packet using an attack detection model deployed by the second server.

12. The apparatus of claim 8, wherein, The second detection module is specifically configured to: perform feature extraction on the to-be-detected packet from a plurality of preset feature dimensions to obtain feature values of each feature dimension; select a second target model from a plurality of attack detection models pre-trained based on the feature values of each feature dimension; invoke the second target model to perform attack detection on the to-be-detected packet.

13. The apparatus of any one of claims 8-12, wherein, The apparatus further comprises: The message matching module is configured to match the to-be-detected message with a message blacklist and a message whitelist before the to-be-detected message is detected by the feature library, wherein the message blacklist records information of attack messages, and the message whitelist records information of non-attack messages. The first determining module is configured to determine that the to-be-detected message is an attack message if the to-be-detected message matches the message blacklist. The second determining module is configured to determine that the to-be-detected message is a non-attack message if the to-be-detected message matches the message whitelist. The first executing module is configured to trigger the first detecting module if the to-be-detected message does not match the message blacklist or the message whitelist.

14. The apparatus of claim 13, wherein, The device further comprises: The first updating module is configured to update the message blacklist according to message information of the to-be-detected message if the second detecting result indicates that the to-be-detected message is an attack message. The second updating module is configured to update the message whitelist according to message information of the to-be-detected message if the second detecting result indicates that the to-be-detected message is not an attack message.

15. An electronic device, comprising: The device comprises a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus. The memory is configured to store a computer program. The processor is configured to execute the program stored in the memory to implement the method steps in any one of claims 1-7.

16. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the method steps in any one of claims 1-7.

Images