Network attack detection method and device and electronic equipment

Abstract

The invention discloses a network attack detection method and device and electronic equipment. The method comprises the steps that a gateway access log is acquired, and the gateway access log comprises a website domain name, a source internet protocol IP address and a timestamp; obtaining a query per second (QPS) rate of the website domain name according to the timestamp; under the condition that the QPS is greater than a QPS peak value, acquiring a PV proportion of access times of a source IP address corresponding to the website domain name in a preset time interval; further judging whether the source IP address is a preset malicious IP address or not under the condition that the PV proportion is greater than the PV proportion threshold value; and under the condition that the source IP address is the malicious IP address, adding the source IP address into the IP address banning blacklist. According to the method and the device, the accuracy of network attack interception is improved, hardware resources are saved, the performance of a Web attack detection system is improved, meanwhile, the duration of attack interception response is shortened, and missing interception and mistaken interception are not easy to occur.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of artificial intelligence, and particularly relates to a network attack detection method and device and electronic equipment. BACKGROUND

[0002] In order to ensure the safety of enterprise network services, network attack detection needs to be performed on enterprise network access.

[0003] In the related art, statistical interception is performed by using Internet Protocol (IP) address access frequency (PageView, PV) statistics, website domain name query rate per second (Queries Per Second, QPS) statistics, and user request access frequency statistics. The interception strategy is relatively extensive, which leads to a high false interception rate. In addition, a long blacklist IP address list is generated, which wastes hardware resources. In the case of limited hardware resources, the performance of a network (Web) attack detection system (for example, a Web firewall) is affected. At the same time, the length of the attack interception response is increased, which easily leads to missed interception and false interception. SUMMARY

[0004] Embodiments of the application provide a network attack detection method and device, electronic equipment and storage medium to solve the problem of a high false interception rate caused by an extensive interception strategy, a long blacklist IP address list, wasted hardware resources, affected performance of a Web attack detection system, and increased length of attack interception response, which easily leads to missed interception and false interception in the related art.

[0005] To achieve the above object, the embodiments of the application adopt the following technical solutions: In a first aspect, the embodiments of the application provide a network attack detection method, including: obtaining a gateway access log, the gateway access log including a website domain name, a source Internet Protocol (IP) address of an access user accessing the website domain name, and a timestamp of accessing the website domain name; obtaining a current query rate per second (QPS) corresponding to the website domain name according to the timestamp; in a case where the current QPS corresponding to the website domain name is greater than a QPS peak value of the website domain name preset in a network attack detection rule, obtaining a proportion of access frequency (PV) of a source IP address corresponding to the website domain name within a preset time interval; in a case where the proportion of PV corresponding to the source IP address is greater than a PV proportion threshold value preset in the network attack detection rule, further determining whether the source IP address is a preset malicious IP address; and in a case where the source IP address is the malicious IP address, adding the source IP address to an IP address ban blacklist to perform ban processing on the source IP address in the IP address ban blacklist.

[0006] In a second aspect, the embodiments of the present application provide a network attack detection apparatus, comprising: a first obtaining module configured to obtain a gateway access log, wherein the gateway access log comprises a website domain name, a source Internet Protocol (IP) address of an access user accessing the website domain name, and a timestamp of accessing the website domain name; a second obtaining module configured to obtain a current query per second (QPS) of the website domain name according to the timestamp; a third obtaining module configured to obtain a proportion of a visit number (PV) of a source IP address corresponding to the website domain name within a preset time interval, in a case where a current QPS corresponding to the website domain name is greater than a QPS peak value of the website domain name in a preset network attack detection rule; a judging module configured to further judge whether the source IP address is a preset malicious IP address, in a case where the proportion of the PV corresponding to the source IP address is greater than a preset PV proportion threshold in the network attack detection rule; and a generating module configured to add the source IP address into an IP address ban blacklist, in a case where the source IP address is the malicious IP address, so as to perform a ban processing on the source IP address in the IP address ban blacklist.

[0007] In a third aspect, the embodiments of the present application provide an electronic device, comprising: a processor, a memory, and a program or instruction stored in the memory and executable on the processor, and the program or instruction is executed by the processor to implement the steps of the method according to the first aspect of the present application.

[0008] In a fourth aspect, the embodiments of the present application provide a readable storage medium, wherein the readable storage medium stores a program or instruction, and the program or instruction is executed by a processor to implement the steps of the method according to the first aspect of the present application.

[0009] The above at least one technical scheme adopted by the embodiments of the present application can achieve the following beneficial effects: The embodiment of the application obtains a gateway access log when detecting a network attack, the gateway access log including a website domain name, a source Internet protocol IP address of an access visitor of the website domain name, and a timestamp of accessing the website domain name; a current query per second rate QPS corresponding to the website domain name is obtained according to the timestamp; if the current QPS corresponding to the website domain name is greater than a preset QPS peak value of the website domain name in a network attack detection rule, a proportion of a visit number PV of the source IP address corresponding to the website domain name within a preset time interval is obtained; if the proportion of the PV corresponding to the source IP address is greater than a preset PV proportion threshold in the network attack detection rule, it is further judged whether the source IP address is a preset malicious IP address; if the source IP address is the malicious IP address, the source IP address is added to an IP address ban blacklist, so as to perform ban processing on the source IP address in the IP address ban blacklist. The embodiment of the application adopts the query per second rate QPS of the website domain name and the visit number PV proportion statistics of the source IP address within the preset time interval, and generates an IP address ban blacklist in combination with the preset malicious IP address, so that the interception strategy is more careful, the accuracy of network attack interception is improved, the IP address list in the generated blacklist is relatively short, hardware resources are saved, the performance of the Web attack detection system is improved in the case of limited hardware resources, the length of the attack interception response is reduced, and the problems of missed interception and false interception are less likely to occur. BRIEF DESCRIPTION OF DRAWINGS

[0010] The accompanying drawings, which are included to provide a further understanding of the application and constitute a part of this application, illustrate certain illustrative embodiments of the application and together with the description serve to explain the application. In the drawings: Figure 1 A flowchart of a network attack detection method provided by an embodiment of the application; Figure 2 An application scenario diagram of a network attack detection method provided by an embodiment of the application; Figure 3 A whole flowchart of a network attack detection method provided by another embodiment of the application; Figure 4 A structure diagram of a network attack detection device provided by an embodiment of the application; Figure 5 A structure diagram of an electronic device provided by an embodiment of the application. DETAILED DESCRIPTION

[0011] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0012] The terms "first," "second," etc., used in this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein. Furthermore, "and / or" in this application indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship. It should be noted that all data involved in this application was obtained with the user's authorization.

[0013] The technical solutions provided by the various embodiments of this application are described in detail below with reference to the accompanying drawings.

[0014] Figure 1 This is a flowchart illustrating a network attack detection method according to one embodiment of this application. Figure 1 As shown, the network attack detection method of this application embodiment may specifically include the following steps: S101, Obtain the gateway access log. The gateway access log includes the website domain name, the source Internet Protocol IP address of the visitor accessing the website domain name, and the timestamp of the access to the website domain name.

[0015] In this embodiment of the application, the execution subject of the network attack detection method is a network attack detection device, which can be installed in an electronic device. This electronic device can be a terminal device or a server. The terminal device can be a mobile phone, tablet computer, desktop computer, laptop, vehicle-mounted device, etc.; the server can be a standalone server or a server cluster composed of multiple servers.

[0016] When visitors (including legitimate users and attackers) access a website's Uniform Resource Locator (URL), they pass through a web gateway system. The web gateway system stores complete gateway access logs, and multiple gateway access logs can be obtained through it. Each gateway access log includes at least the website domain, the source Internet Protocol (IP) address of the visitor accessing the website domain, and a timestamp of the website domain access.

[0017] S102, obtain the current query rate (QPS) for the website domain based on the timestamp.

[0018] In this embodiment of the application, the query rate per second (QPS) corresponding to the website domain can be determined based on the timestamp of the website domain accessed in the access logs of each gateway.

[0019] S103: If the current QPS of the website domain is greater than the preset peak QPS of the website domain in the network attack detection rules, obtain the percentage of PV accesses from the source IP address of the website domain within a preset time interval.

[0020] In this embodiment, a network attack detection rule management system can collect network attack detection rules, including the QPS peak value of website domains, from a front-end management interface provided to security operations personnel for QPS statistical detection. Since the processing power of the servers behind each website domain differs, a corresponding QPS peak value is set for each website domain.

[0021] If the current query per second (QPS) of the website domain determined in step S102 is greater than the peak QPS of the same website domain in the network attack detection rules, then the page view (PV) percentage detection continues. This involves obtaining the PV of the source IP address corresponding to the website domain within a preset time interval and the total PV of all IPs within that time interval, and then calculating the percentage of the source IP address's PV in the total PV. The preset time interval (e.g., 1 minute) can be set in the network attack detection rules.

[0022] S104. If the PV ratio corresponding to the source IP address is greater than the preset PV ratio threshold in the network attack detection rules, further determine whether the source IP address is a preset malicious IP address.

[0023] In this embodiment of the application, the network attack detection rules may also include a pre-set PV percentage threshold. If the PV percentage of accesses to the source IP address corresponding to the website domain name determined in step S103 within a preset time interval is greater than the PV percentage threshold for the same website domain name in the network attack detection rules, then threat intelligence information association analysis continues, that is, it is determined whether the source IP address is a preset malicious IP address.

[0024] The network attack information system aggregates threat intelligence information corresponding to various network attacks output by office network firewall systems, traffic intrusion detection systems, WAF systems, and anti-crawler systems. The threat intelligence information includes at least malicious IP addresses.

[0025] When determining whether a source IP address is a preset malicious IP address, you can query the threat intelligence information associated with the source IP address through the network attack information system, that is, query whether the source IP address in the gateway access log is a malicious IP address in the threat intelligence information.

[0026] S105, if the source IP address is a malicious IP address, add the source IP address to the IP address blocking blacklist in order to block the source IP address in the IP address blocking blacklist.

[0027] In this embodiment, if the source IP address in the gateway access log is determined to be a malicious IP address, the source IP address is added to the IP address blocking blacklist to block the source IP address in the IP address blocking blacklist. As a feasible implementation, the IP address blocking blacklist may also include at least one of the following information: the time interval in the network attack detection rules, the number of accesses (PV) corresponding to the source IP address, and the PV percentage.

[0028] The IP address blacklist can be stored in a database, and can also be notified to security operations personnel and displayed in a visual network attack display system. It can also be sent to a network (web) attack detection system (such as a web firewall) so that the web attack detection system can block network attacks according to the IP address blacklist, thereby improving the accuracy of attack interception, protecting enterprise network security, and providing users with continuous and stable services.

[0029] The network attack detection rules can also include the blocking duration corresponding to the source IP address, and the corresponding IP address blocking blacklist can also include the blocking duration corresponding to the source IP address.

[0030] Threat intelligence information can also include threat tags corresponding to malicious IP addresses. Similarly, IP address blacklists can include threat tags corresponding to the source IP addresses.

[0031] Furthermore, the threat intelligence information may also include the IP address reputation value corresponding to the malicious IP address. The IP address reputation value is used to characterize the threat level of the IP address, for example, 95 points. The higher the score, the greater the threat level of the IP address. Correspondingly, the above step S105 may specifically include the following steps: if the source IP address is a malicious IP address and the IP address reputation value corresponding to the malicious IP address is greater than a preset reputation value threshold, add the source IP address to the IP address blocking blacklist.

[0032] When a source IP address is determined to be malicious, its reputation value can be queried through a network attack information system. If the reputation value is greater than a preset threshold (e.g., 90 points), an IP address blacklist is generated. The IP address blacklist may also include the IP address's reputation value.

[0033] Furthermore, the network attack detection method in this application embodiment may further include the following steps: determining the threat level of the source IP address based on the IP address reputation value corresponding to the source IP address. For example, if the IP address reputation value of the source IP address is greater than 90 points, then the threat level of the source IP address is determined to be high-risk. Correspondingly, the IP address blacklist may also include the threat level of the source IP address.

[0034] Furthermore, the gateway access log also includes the target Uniform Resource Locator (URL) requested by the visitor. If the source IP address is not a malicious IP address, or the reputation value of the IP address corresponding to the malicious IP address is equal to or less than the reputation value threshold, network attack detection can be performed based on the target URL and preset whitelist identification rules (i.e., judgment rules). Correspondingly, the network attack detection method of this application embodiment may further include the following steps: if the source IP address is not a malicious IP address, or the reputation value of the IP address corresponding to the malicious IP address is equal to or less than the reputation value threshold, further determine whether the target URL matches the detection regular expression corresponding to the target URL in the judgment rules; if the target URL does not match the detection regular expression corresponding to the target URL in the judgment rules, add the source IP address to the IP address blocking blacklist.

[0035] The judgment rules can be generated through the following steps: obtaining multiple network attack alarms within a preset time period, including the action, attack type, and URL; filtering out target network attack alarms from the multiple network attack alarms, where the action is "allow" and the attack type is "non-attack"; generating corresponding detection regular expressions for the URLs in the target network attack alarms and writing them into the judgment rules.

[0036] Specifically, when visitors (including legitimate users and attackers) access the URL of a website domain, they will pass through a network attack detection system. When the network attack detection system detects a network attack event, it generates a network attack alarm log.

[0037] The local large language model analysis system can statistically analyze network attack alarm information according to a preset time period (e.g., day, week, month). From the statistically analyzed network attack alarm information, it can select network attack alarm information with the action of allowing access and the attack type of non-attack as target network attack alarm information. Based on each URL in these selected target network attack alarm information, it generates corresponding detection regular expressions and writes the detection regular expressions corresponding to each URL into the judgment rules.

[0038] As a feasible implementation method, the local large language model analysis system can count the number of each URL in the selected multiple target network attack alarm information, determine the top URLs based on the number of each URL, and generate corresponding detection regular expressions for each URL.

[0039] Specifically, the local large language model analysis system can filter out multiple target network attack alarm messages with the execution action being allowed and the attack type being non-attack, and count the number of each URL in these target network attack alarm messages according to a preset time period (e.g., daily, weekly, monthly) (i.e., deduplicating the URL field). Based on the number of each URL, the multiple URLs are sorted in descending order, and the top 100 URLs are determined as the URLs to be used to generate detection regular expressions.

[0040] As a feasible implementation method, a large language model in a local large language model analysis system can be used to generate corresponding regular expressions (i.e., detection regular expressions) for each URL. Specifically, each URL can be input as a prompt word into the large language model for regular expression conversion. The large language model outputs the corresponding detection regular expression for each URL based on the input prompt word. After security operations personnel confirm the validity of the detection regular expressions for each URL, they are aggregated into a set of website domain normal business (whitelist) detection regular expressions in the judgment rules, which are used to determine whether the user's requested URL is a normal business URL.

[0041] A large language model can be trained through the following steps: First, acquire multiple sample data sets, including sample URLs and corresponding standard detection regularities. Second, train the initial large language model using these sample data sets so that the detection regularities output by the model for the sample URLs are consistent with the standard detection regularities, thus obtaining the trained large language model. The initial large language model can be a ChatGLM model.

[0042] To clearly describe the flow of the network attack detection method according to the embodiments of this application, the following is combined with... Figure 2 , Figure 3 The overall process of the network attack detection method according to the embodiments of this application is described in detail. Figure 2This is a schematic diagram illustrating an application scenario of the network attack detection method according to an embodiment of this application. Figure 3 This is a flowchart illustrating the network attack detection method according to an embodiment of this application. Figure 2 , Figure 3 As shown, the network attack detection method of this application embodiment includes the following steps: When a web attack detection system (such as a web firewall) detects a web attack event, it generates a web attack alert log and sends it to the web attack management system (which may be equipped with Graylog log management software) via the Syslog protocol. The web attack management system receives the logs via a network listening service using the User Datagram Protocol (UDP), performs data filtering and log formatting (Extract-Transform-Load, ETL), and then stores the log data in an ElasticSearch database index table within the web attack log collection database cluster.

[0043] The logs generated by the web attack detection system can be formatted as follows: [Website Domain] [URL] [Source IP Address] [Target IP Address] [Action Performed: (Allow)] [Attack Type: (Non-Attack)] [Timestamp] The format for storing network attack alert logs in the index table can be as follows: [Index Name] [Website Domain] [URL] [Source IP Address] [Target IP Address] [Action Performed: (Allow)] [Attack Type: (Non-Attack)] [Timestamp] Here, "index name" refers to the table index name in the ElasticSearch database, which is equivalent to the table name in the MySQL database.

[0044] The network attack management system calls the API interface of the local large language model analysis system. The local large language model analysis system sorts multiple URLs in descending order based on the number of URLs in multiple network attack alerts where the "execution action" is "allowed" and the "attack type" is "non-attack." The top-ranked URLs are then used as query terms to query the large language model in the local large language model analysis system, resulting in the "detection regular expression" output by the large language model. The local large language model analysis system then sends the large language model analysis rule log, including the "detection regular expression," to the network attack management system via its RESTful API interface. The network attack management system stores the received large language model analysis rule log in a MySQL database within the network attack log collection database cluster.

[0045] The format of the large language model analysis rule log sent to the network attack management system can be as follows: [Website Domain] [URL] [Regular Expression Detection].

[0046] The format of the large language model analysis logs stored in the ElasticSearch database can be as follows: [Table Name] [Website Domain] [URL] [Regular Expression for Detection]

[0047] Here,

table name

[0048] The web gateway system can send gateway access logs to the network attack management system via the Syslog protocol. The network attack management system receives the gateway access logs sent by the web gateway system through a UDP protocol network listening service, filters and formats the data, and then stores the log data in the ElasticSearch database index table in the network attack log collection database cluster.

[0049] The logs generated by the web gateway system can be formatted as follows: [Website Domain] [URL] [Source IP Address] [Target IP Address] [Timestamp] The gateway access logs stored in the index table can be formatted as follows: [Index Name] [Website Domain] [URL] [Source IP Address] [Target IP Address] [Timestamp].

[0050] Here, "index name" refers to the table index name in the ElasticSearch database, which is equivalent to the table name in the MySQL database.

[0051] The network attack detection rule management system collects network attack detection rule logs through a front-end management interface provided to security operations personnel, and sends these logs to the network attack management system. The network attack management system then stores the received network attack detection rule logs in a MySQL database index table within the network attack log collection database cluster.

[0052] The format of the network attack detection rule logs collected by the network attack detection rule management system can be as follows: Business QPS threshold [Website Domain] [Peak QPS] IP address blacklist [Website Domain] [Time Interval] [Percentage of Accesses from Source IP Address] API Interface Rules [Website Domain] [URL] [Source IP Address] [PV Percentage Threshold] [Ban Duration]

[0053] The format of the network attack detection rule log stored in the index table can be as follows: [Table Name] [Website Domain] [Peak QPS] [Table Name] [Website Domain] [Time Interval] [Percentage of Accesses from Source IP Address] [Table Name] [Website Domain] [URL] [Source IP Address] [PV Percentage Threshold] [Ban Duration]

[0054] Here,

table name

[0055] Network attack information systems, such as the open-source Malware Information Sharing Platform (MISP), aggregate threat intelligence logs corresponding to various network attacks. The format of the threat intelligence logs is as follows: [Malicious IP Address] [IP Address Reputation Value] [Threat Tag] [Timestamp]

[0056] The network attack correlation analysis system checks the gateway access logs for peak query per second (QPS) and page view (PV) percentage thresholds based on network attack detection rule logs. If the percentages of QPS and PV in the gateway access logs are greater than the peak QPS and PV percentage thresholds in the network attack detection rule logs, the system queries the associated threat intelligence logs in the network attack information system. Specifically, it checks whether the source IP address is a malicious IP address. If so, it obtains the associated IP address reputation value and threat tag. The generated IP address blacklist log can be formatted as follows: [Source IP Address] [Time Interval] [Percentage of Access Count] [Block Duration] [Threat Level] [Reputation Score] [Threat Tag] [Time Stamp]

[0057] The network attack correlation analysis system stores the network attack correlation analysis results, i.e., the final generated IP address blocking blacklist logs, in the network attack correlation analysis result database and displays them in the visualized network attack display system.

[0058] In summary, the network attack detection method of this application uses the query per second (QPS) of website domains and the percentage of page views (PV) of source IP addresses within a preset time interval, combined with a preset list of malicious IP addresses, to generate an IP address blocking blacklist. This results in a more comprehensive interception strategy, improving the accuracy of network attack interception. Furthermore, the generated blacklist contains a relatively short number of IP addresses, saving hardware resources and improving the performance of the web attack detection system even with limited hardware resources. It also reduces the attack interception response time and minimizes the risk of missed or false interceptions. Combining IP address reputation values ​​with network attack detection makes the generated blacklist more accurate. The method intelligently generates a whitelist based on a large language model, using feature rules (i.e., detection regular expressions) corresponding to normal business URL requests, and incorporates these rules into network attack detection. This reduces the workload of creating and maintaining network attack detection rules, lowers the manpower and time costs of security operations, and further improves the accuracy of network attack detection. Using a local large language model instead of a public large language model for detection regular expression generation better ensures data security.

[0059] Figure 4 This is a schematic diagram of a network attack detection device provided in one embodiment of this application. Figure 4 As shown, the network attack detection device 400 of this application embodiment may specifically include: a first acquisition module 401, a second acquisition module 402, a third acquisition module 403, a judgment module 404, and a generation module 405. Wherein: The first acquisition module 401 is used to acquire gateway access logs, which include the website domain name, the source Internet Protocol IP address of the visitor accessing the website domain name, and the timestamp of the access to the website domain name.

[0060] The second acquisition module 402 is used to obtain the current query rate (QPS) corresponding to the website domain name based on the timestamp.

[0061] The third acquisition module 403 is used to acquire the percentage of page views (PV) of the source IP address corresponding to the website domain within a preset time interval when the current QPS of the website domain is greater than the preset peak QPS of the website domain in the network attack detection rules.

[0062] The judgment module 404 is used to further determine whether the source IP address is a preset malicious IP address if the PV ratio corresponding to the source IP address is greater than the preset PV ratio threshold in the network attack detection rules.

[0063] The generation module 405 is used to add the source IP address to the IP address blocking blacklist when the source IP address is a malicious IP address, so as to block the source IP address in the IP address blocking blacklist.

[0064] In this embodiment of the application, the specific process by which each module and unit in the network attack detection device implements its function can be found in the relevant descriptions in the above network attack detection method embodiments, and will not be repeated here.

[0065] In summary, the network attack detection device of this application uses the query per second (QPS) of website domain names and the percentage of page views (PV) of source IP addresses within a preset time interval to generate an IP address blacklist, combined with a preset list of malicious IP addresses. This results in a more comprehensive interception strategy, improving the accuracy of network attack interception. Furthermore, the generated blacklist contains a relatively short number of IP addresses, saving hardware resources and improving the performance of the web attack detection system even with limited hardware resources. It also reduces the attack interception response time and minimizes the risk of missed or false interceptions. Combining IP address reputation values ​​with network attack detection makes the generated blacklist more accurate. The device intelligently generates a whitelist based on a large language model, using feature rules (i.e., detection regular expressions) corresponding to normal business URL requests, and incorporates these rules into network attack detection. This reduces the workload of creating and maintaining network attack detection rules, lowers the manpower and time costs of security operations, and further improves the accuracy of network attack detection. Using a local large language model instead of a public large language model for detection regular expression generation better ensures data security.

[0066] This application also provides an electronic device. For example... Figure 5 As shown, the electronic device 500 includes: a processor 501, a memory 502, and a program or instructions stored in the memory 502 and executable on the processor 501. When the program or instructions are executed by the processor 501, they implement the steps of the network attack detection method as described in any of the above embodiments.

[0067] The electronic device in this application uses the website domain's query per second (QPS) and the percentage of page views (PV) of the source IP address within a preset time interval to generate an IP address blacklist, combined with a preset list of malicious IP addresses. This results in a more comprehensive interception strategy, improving the accuracy of network attack interception. Furthermore, the generated blacklist contains a relatively short number of IP addresses, saving hardware resources and improving the performance of the web attack detection system even with limited hardware resources. It also reduces attack interception response time and minimizes the risk of missed or false interceptions. Combining IP address reputation values ​​with network attack detection makes the generated blacklist more accurate. A whitelist (i.e., detection regular expressions) based on a large language model is intelligently generated, representing the feature rules (i.e., detection regular expressions) corresponding to normal business URL requests. This reduces the workload of creating and maintaining network attack detection rules, lowers the manpower and time costs of security operations, and further improves the accuracy of network attack detection. Using a local large language model instead of a public large language model for detection regular expression generation better ensures data security.

[0068] This application also proposes a readable storage medium storing one or more computer programs, the one or more computer programs including instructions, which, when executed by a processor in an electronic device including multiple applications, enable the processor in the electronic device to perform the various steps of the above-described network attack detection method embodiments.

[0069] The readable storage medium in this application uses the website domain's query per second (QPS) and the percentage of page views (PV) of the source IP address within a preset time interval as statistical data. Combined with a preset list of malicious IP addresses, it generates an IP address blacklist, resulting in a more comprehensive interception strategy and improved accuracy in network attack interception. Furthermore, the generated blacklist contains a relatively short IP address list, saving hardware resources and improving the performance of the web attack detection system even with limited hardware resources. It also reduces attack interception response time and minimizes the risk of missed or false interceptions. Combining IP address reputation values ​​with network attack detection makes the generated blacklist more accurate. A whitelist (i.e., feature rules corresponding to normal business URL requests) is intelligently generated based on a large language model and used in network attack detection. This reduces the workload of creating and maintaining network attack detection rules, lowers the manpower and time costs of security operations, and further improves the accuracy of network attack detection. Using a local large language model instead of a public large language model for generating detection regular expressions better ensures data security.

[0070] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0071] For ease of description, the above devices are described separately by function as various units. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware.

[0072] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0073] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0074] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0075] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0076] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0077] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0078] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0079] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0080] This application can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0081] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0082] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for detecting network attacks, characterized in that, include: Obtain gateway access logs, which include the website domain name, the source Internet Protocol IP address of the visitor accessing the website domain name, and the timestamp of accessing the website domain name; The current query rate (QPS) corresponding to the website domain is obtained based on the timestamp. If the current QPS of the website domain is greater than the peak QPS of the website domain preset in the network attack detection rules, obtain the percentage of page views (PV) of the source IP address corresponding to the website domain within a preset time interval. If the PV ratio corresponding to the source IP address is greater than the preset PV ratio threshold in the network attack detection rule, it is further determined whether the source IP address is a preset malicious IP address. If the source IP address is the malicious IP address, the source IP address is added to the IP address blocking blacklist to block the source IP address in the IP address blocking blacklist.

2. The method according to claim 1, characterized in that, When the source IP address is the malicious IP address, adding the source IP address to the IP address blocking blacklist includes: If the source IP address is the malicious IP address and the reputation value of the IP address corresponding to the malicious IP address is greater than a preset reputation value threshold, the source IP address will be added to the IP address blacklist; the IP address reputation value is used to characterize the threat level of the IP address.

3. The method according to claim 2, characterized in that, The gateway access log also includes the target Uniform Resource Locator URL requested by the visitor. The method further includes: If the source IP address is not the malicious IP address, or if the reputation value of the IP address corresponding to the malicious IP address is equal to or less than the reputation value threshold, further determine whether the target URL matches the detection regular expression corresponding to the target URL in the judgment rule; If the target URL does not match the detection regular expression corresponding to the target URL in the judgment rule, the source IP address will be added to the IP address blocking blacklist.

4. The method according to claim 3, characterized in that, The method further includes: Acquire multiple network attack alerts within a preset time period, wherein the network attack alerts include the action performed, the attack type, and the URL; From the multiple network attack alerts, select the target network attack alerts where the action is to allow access and the attack type is non-attack. For the URL in the target network attack alarm information, generate the corresponding detection regular expression and write it into the judgment rule.

5. The method according to claim 4, characterized in that, The step of generating corresponding detection regular expressions for the URLs in the target network attack alert information includes: The URL is input as a prompt word into a large language model for regular expression conversion, and the detection regular expression corresponding to the URL is obtained from the output of the large language model.

6. The method according to claim 5, characterized in that, The large language model is trained through the following steps: Acquire multiple sample data, the sample data including sample URLs and standard detection regular expressions corresponding to the sample URLs; The initial large language model is trained using the multiple sample data to make the detection regularity corresponding to the sample URL output by the model consistent with the standard detection regularity, thereby obtaining the trained large language model; the initial large language model is the ChatGLM model.

7. The method according to claim 4, characterized in that, The step of generating corresponding detection regular expressions for the URLs in the target network attack alert information includes: Count the number of each URL in the selected network attack alerts for multiple targets; Determine the top-ranking URLs based on the number of each URL; Generate a corresponding detection regular expression for each URL.

8. The method according to any one of claims 1-7, characterized in that, The IP address blocking blacklist also includes at least one of the following: The time interval, the PV corresponding to the source IP address and / or the PV percentage, the blocking duration corresponding to the website domain name in the network attack detection rules, the IP address reputation value corresponding to the malicious IP address, the threat level determined based on the IP address reputation value, and the threat tag corresponding to the malicious IP address.

9. A network attack detection device, characterized in that, include: The first acquisition module is used to acquire gateway access logs, which include website domain names, the source Internet Protocol (IP) address of the visitors accessing the website domain names, and the timestamp of the access to the website domain names. The second acquisition module is used to obtain the current query rate per second (QPS) corresponding to the website domain name based on the timestamp. The third acquisition module is used to acquire the percentage of page views (PV) of the source IP address corresponding to the website domain within a preset time interval when the current QPS of the website domain is greater than the preset QPS peak of the website domain in the network attack detection rules. The judgment module is used to further determine whether the source IP address is a preset malicious IP address when the PV ratio corresponding to the source IP address is greater than the preset PV ratio threshold in the network attack detection rule. The generation module is used to add the source IP address to the IP address blocking blacklist when the source IP address is the malicious IP address, so as to block the source IP address in the IP address blocking blacklist.

10. An electronic device, characterized in that, It includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein the program or instructions, when executed by the processor, implement the steps of the method as described in any one of claims 1-8.

Images