Network attack detection method, device, equipment, medium and product

Abstract

The invention discloses a network attack detection method and device, equipment, a medium and a product in the technical field of computers, and the method comprises the steps: inputting a first data set into a first AI application, so as to enable the first AI application to carry out the risk recognition processing of first data, and to obtain and output first risk object information; inputting the first risk object information into a second AI application, so that the second AI application can determine a hypothetical attack path according to the first risk object information to obtain and output second path information, and when it is detected that the second path information is matched with first path information corresponding to the first risk object information presented in the first data set, the first risk object information corresponding to the second risk object information is obtained. The first attack detection result is determined according to the first risk object information and the second path information, so that the first attack detection result can represent the risk object presented by the first data and the attack path corresponding to the risk object, the network attack can be automatically detected from some data, the analysis efficiency and accuracy are improved, and the user experience is improved. And the equipment safety can be improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, device, medium, or product for detecting network attacks. Background Technology

[0002] In some scenarios (such as network security and software engineering), if a security alert is received, relevant personnel will manually analyze a large amount of data (such as a large amount of log data collected from a certain host) to ensure security and manually trace the network attack indicated by the alert.

[0003] In addition, the solution shown above has at least the following drawbacks: ① It is inefficient because relevant personnel need to spend several hours to complete the analysis of a large amount of data; ② It is easy for false alarms or omissions to occur because relevant personnel analyze based on their personal experience. Summary of the Invention

[0004] To address the aforementioned technical problems, this application provides a method, apparatus, device, medium, or product for detecting network attacks.

[0005] To achieve the above objectives, the technical solution provided in this application is as follows:

[0006] This application provides a network attack detection method, the method comprising: inputting a first dataset into a first artificial intelligence (AI) application to obtain first risk object information output by the first AI application; wherein the first dataset includes first path information corresponding to the first risk object information; inputting the first risk object information into a second AI application to obtain second path information output by the second AI application; and determining a first attack detection result based on the second path information and the first risk object information in response to a match between the second path information and the first path information.

[0007] In one possible implementation, the method further includes: in response to a mismatch between the second path information and the first path information, updating the first risk object information based on the first path information, and continuing to perform the step of inputting the first risk object information into the second AI application.

[0008] In one possible implementation, the first dataset is determined based on data collected for a first detection object; the method further includes: in response to finding a second detection object based on the first risk object information, inputting the second dataset into the first AI application to obtain second risk object information output by the first AI application, the second dataset being determined based on data collected for the second detection object, the second dataset including third path information corresponding to the second risk object information; inputting the second risk object information into the second AI application to obtain fourth path information output by the second AI application; in response to the fourth path information matching the third path information, determining a second attack detection result based on the fourth path information and the second risk object information; and integrating the second attack detection result and the first attack detection result to obtain a third attack detection result.

[0009] In one possible implementation, before integrating the second attack detection result and the first attack detection result to obtain the third attack detection result, the method further includes: updating the first attack detection result based on the second risk object information.

[0010] In one possible implementation, the first dataset indicates the state of the first detected object within a first time period; updating the first attack detection result based on the second risk object information includes: inputting the second risk object information and the first dataset into the first AI application to obtain third risk object information output by the first AI application; obtaining a third dataset corresponding to the third risk object information, the third dataset including fifth path information corresponding to the third risk object information, the third dataset indicating the state of the first detected object within a second time period; inputting the third risk object information into the second AI application to obtain sixth path information output by the second AI application; and updating the first attack detection result based on the sixth path information and the third risk object information in response to a match between the sixth path information and the fifth path information.

[0011] In one possible implementation, the method further includes: in response to a received alarm message, obtaining the first dataset based on the alarm message, wherein the alarm message indicates at least one risk object; or, in response to detecting a request triggered for the first detected object, obtaining the first dataset based on the request, wherein the request does not indicate a risk object.

[0012] In one possible implementation, the method satisfies at least one of the following constraints: the process of determining the first path information includes: constructing a graph based on the first dataset; searching for the first path information corresponding to the first risk object information from the graph; the first dataset is determined based on at least one type of data collected for the first detection object; the at least one type of data includes at least a portion of configuration information of the first detection object, operation data collected from the first detection object, and operation data collected from the gateway corresponding to the first detection object.

[0013] This application provides a network attack detection device, comprising: a first determining unit, configured to input a first dataset into a first AI application to obtain first risk object information output by the first AI application, wherein the first dataset indicates first path information corresponding to the first risk object information; a second determining unit, configured to input the first risk object information into a second AI application to obtain second path information output by the second AI application; and a third determining unit, configured to determine a first attack detection result based on the second path information and the first risk object information in response to a match between the second path information and the first path information.

[0014] This application provides an electronic device, the device comprising: a processor and a memory; the memory for storing instructions or computer programs; the processor for executing the instructions or computer programs in the memory, so that the electronic device performs the network attack detection method provided in this application.

[0015] This application provides a computer-readable medium storing instructions or computer programs that, when executed on a device, cause the device to perform the network attack detection method provided in this application.

[0016] This application provides a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for executing the network attack detection method provided in this application.

[0017] Compared with related technologies, this application has at least the following advantages:

[0018] In the technical solution provided in this application, a first dataset is first input into a first AI application (such as an agent), which performs risk identification processing on the first data to obtain and output first risk object information (such as the operation of "finding passwords"). This first risk object information can represent objects (such as operations, events, etc.) that are suspected of being risky presented in the first data, thereby enabling the first risk object information to represent the potential attack points presented in the first data. Then, the first risk object information is input into a second AI application (such as an agent), which determines a hypothetical attack path based on the first risk object information and outputs second path information (such as the path information "a certain vulnerability 1 → obtaining command execution privileges → finding passwords"). This second path information can represent what path is presented when an attack is caused using the first risk object information, so that the second path information can be detected and matched with the first risk object information. When the first path information (such as "a certain vulnerability 1 → obtain command execution privileges → search for passwords") corresponding to the first risk object information presented in the first dataset is matched, it can be determined that the first risk object information has been used to cause an attack. Therefore, the first attack detection result is determined based on the first risk object information and the second path information, so that the first attack detection result can represent the risk object presented by the first data and its corresponding attack path. Thus, the first attack detection result can indicate the characteristics of the network attack based on the first risk object information (such as attack path characteristics), so as to realize the automatic detection of risk points and their source tracing results from some data (such as a large amount of data collected from host 1), thereby realizing the automatic detection of network attacks from some data, overcoming the defects caused by manual analysis (such as intrusion event source tracing analysis), improving analysis efficiency and accuracy, and helping to improve equipment security.

[0019] As can be seen, this application provides a hypothesis-verification automated reasoning mechanism based on machine learning models (such as intelligent agents) to first automatically give an attack path hypothesis for a suspected exploitable risk object, and then verify the attack path from massive data to determine that the attack was caused by the risk object. This achieves automatic focus on the intrusion path and other source tracing information for exploited risk objects, realizes automatic source tracing, and improves efficiency. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 A flowchart illustrating a network attack detection method provided in this application embodiment;

[0022] Figure 2 This is a schematic diagram of the structure of a risk analysis system provided in an embodiment of this application;

[0023] Figure 3 A schematic diagram of some modules in a risk analysis system provided in an embodiment of this application;

[0024] Figure 4 This is a schematic diagram of the structure of a network attack detection device provided in an embodiment of this application;

[0025] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0026] One or more embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0027] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0028] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.

[0029] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0030] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0031] The names of the messages or information exchanged between the various devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of these messages or information.

[0032] It is understood that the data involved in this technical solution (including but not limited to the data itself, the acquisition, use, storage or deletion of the data) shall comply with the requirements of relevant laws, regulations and related provisions.

[0033] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, relevant users should be informed of the type, scope of use, and usage scenarios of the information involved in this disclosure through appropriate means in accordance with relevant laws and regulations, and authorization should be obtained from the relevant users. Among them, relevant users may include any type of rights holder, such as individuals, enterprises, and groups.

[0034] For example, in response to receiving an active request from a user, a prompt message is sent to the relevant user to clearly indicate that the operation requested by the user will require obtaining and using the user's information. This allows the relevant user to choose whether to provide information to the software or hardware such as the electronic device, application, server, or storage medium that performs the operation of any embodiment of the present disclosure based on the prompt message.

[0035] As an optional but non-restrictive implementation, in response to a user's active request, a prompt message can be sent to the user, such as a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide information to the electronic device.

[0036] It is understood that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0037] Research has shown that in certain scenarios, if a device triggers a security alarm, it can be determined that the device has been subjected to a cyberattack. Therefore, relevant personnel can analyze the device's log data (such as intrusion incident tracing). Intrusion incident tracing is a crucial aspect of network security defense. Specifically, after a security incident such as a network intrusion, data breach, or malware infection, it involves analyzing various data (such as logs and event data) to reconstruct the attack process, locate the intrusion entry point, trace the attack path, determine the attack source, identify the attack methods, pinpoint the attack target, and determine the scope of impact.

[0038] Research also revealed that in some scenarios, intrusion incident tracing relies on manual analysis and pre-set fixed rule templates, leading to the following drawbacks: ① The need for manual investigation and analysis of large amounts of log data from alarm-triggered devices (such as hosts) is time-consuming, resulting in low efficiency; ② The reliance on human experience makes the solution prone to false alarms and missed alarms, leading to poor accuracy; ③ The fixed rule templates prevent the solution from effectively addressing diverse attack methods and complex attack chains, and compromise its ability to trace unknown threats. Consequently, this approach is less effective against certain attacks, such as Advanced Persistent Threats (APPTs). The solution exhibits poor attribution in response to APT (Advanced Persistent Threat) attacks, resulting in weak adaptability; ④ Because the solution relies on manual intervention, it exhibits poor analysis performance when faced with a large number of heterogeneous logs, further affecting the efficiency and accuracy of attribution, thus limiting its attribution capabilities; ⑤ Because the solution relies on personnel to trace attribution based on device alarm information, it depends on known alarms, making it unsuitable for potential risk investigation in scenarios without obvious alarms, thus limiting its applicability.

[0039] Based on the above research, in order to overcome at least some of the aforementioned problems, this application provides a network attack detection method based on a machine learning model (such as an intelligent agent) that exhibits automated reasoning functionality. The method includes: firstly, inputting a first dataset into a first AI application (such as an intelligent agent), so that the first AI application performs risk identification processing on the first dataset to obtain and output first risk object information (such as the operation "find password"), so that the first risk object information can represent objects (such as operations, events, etc.) suspected of being risky presented in the first dataset, thereby enabling the first risk object information to represent the potential attack points presented in the first dataset; then inputting the first risk object information into a second AI application (such as an intelligent agent), so that the second AI application can determine a hypothetical attack path based on the first risk object information to obtain and output second path information (such as the path information "a certain vulnerability 1 → obtain execution command privileges → find password"), so that the second path information can represent the attack points that could potentially cause an attack when the first risk object is exploited. When information leads to an attack, the system determines the path that the first risk object information has been exploited to cause an attack. This is because when the second path information matches the first path information corresponding to the first risk object information presented in the first dataset (e.g., the path information "vulnerability 1 → gain command execution privileges → search for passwords"), the system can determine that the first risk object information has been used to cause an attack. Therefore, the first attack detection result is determined based on the first risk object information and the second path information. This first attack detection result can represent the risk object presented by the first data and its corresponding attack path, thus indicating the characteristics (such as attack path characteristics) of the network attack based on the first risk object information. This enables the automatic detection of risk points and their tracing results from some data (such as a large amount of data collected from host 1), thereby achieving automatic detection of network attacks from some data. This overcomes the shortcomings caused by manual analysis (such as intrusion event tracing analysis), improves analysis efficiency and accuracy, and is beneficial to improving device security.

[0040] As can be seen, this application provides a hypothesis-verification automated reasoning mechanism based on machine learning models (such as intelligent agents) to first automatically give an attack path hypothesis for a suspected exploitable risk object, and then verify the attack path from massive data to determine that the attack was caused by the risk object. This achieves automatic focus on the intrusion path and other source tracing information for exploited risk objects, realizes automatic source tracing, and improves efficiency.

[0041] Furthermore, this application does not limit the executing entity of the network attack detection method. For example, the method can be applied to a terminal device or a server. Alternatively, the method can be implemented through data interaction between the terminal device and the server. The terminal device can be a smartphone, computer, personal digital assistant (PDA), tablet computer, etc. The server can be a standalone server, a cluster server, or a cloud server.

[0042] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present application.

[0043] To better understand the technical solution provided in this application, the network attack detection method provided in this application will be explained below with reference to some accompanying drawings. For example... Figure 1 As shown, the network attack detection method provided in this application includes S1-S3 below.

[0044] S1: Input the first dataset into the first AI application to obtain the first risk object information output by the first AI application. The first dataset includes the first path information corresponding to the first risk object information.

[0045] The first dataset refers to the dataset used in network attack detection (such as data collected from a specific host or data from...). Figure 2 The data output by the data normalization module is used to enable the first dataset to indicate the characteristics of the analyzed target (such as a risky object indicated by a security alert or a host manually specified by the user).

[0046] As can be seen, in one possible implementation, the first dataset can indicate the state of the first detection object (such as a risk point indicated by a security alarm or a host manually specified by the user) in time period 1, so that the various risk points and their corresponding attack paths of the first detection object in time period 1 can be analyzed based on the first dataset.

[0047] It's important to note that a risk object (also known as a risk point) refers to a security vulnerability in a host, system, application, or business process that an attacker can exploit to launch an intrusion, steal data, or disrupt services. Therefore, a risk object can refer to a gap that a threat might exploit. For example, a risk object could be the operation of "finding a password." Furthermore, an attack path is the operational chain from the initial intrusion point to the target resource. Attackers will connect at least one risk point, gradually escalating privileges or penetrating the core system. Therefore, an attack path can refer to the path corresponding to the risk point (such as a path that uses the risk point to launch an attack). For example, an attack path could be "Vulnerability 1 → Obtaining command execution privileges → Finding a password."

[0048] For the aforementioned first detection object, it refers to an object with network attack detection needs (such as discovering potential risk points, tracing the source of risks indicated by alarm information, etc.), such as a host with security devices deployed, a host without security devices deployed, or entities indicated by alarm information (such as host addresses, malware signatures, etc.). This application does not limit the host; for example, the host can be a physical machine, a container, a virtual machine, or a system server. This application does not limit the address; for example, it can include an Internet Protocol Address (IP) address.

[0049] Furthermore, this application does not limit the first detection object. For example, it can be implemented using any terminal device with security protection needs (such as a host) or an entity indicated by alarm information. Therefore, the first detection object can be an entity indicated by alarm information (such as a host address, malware signature, etc.). The first detection object can also be a terminal device indicated manually or automatically that has a potential risk discovery need, such as a terminal device with a surge in Central Processing Unit (CPU) usage, a terminal device with software suspected of being risky installed, a terminal device that has downloaded files suspected of being attack-risky, or a terminal device suspected of having vulnerabilities.

[0050] Furthermore, this application does not limit the method of determining the first detection object. For example, in some scenarios (such as scenarios where an alarm is triggered), the first detection object may be determined based on the received alarm information.

[0051] For example, in some scenarios (such as potential risk screening), the first detection object can be determined based on user operations, so that the first detection object can indicate which terminal device the user wants to screen for potential risks.

[0052] For example, in some scenarios, the first detection target can be obtained by automatically analyzing some information (such as resource usage information presented by the host itself, risk information posted on forums, threat intelligence obtained through certain methods, etc.) so that the first detection target can represent terminal devices suspected of having risks mined from this information.

[0053] Regarding the aforementioned first time period, this first time period refers to the time period required for network attack detection targeting the first detection object. Furthermore, this application does not limit the method of determining the first time period. For example, if the first detection object is determined based on alarm information, then the first time period can be determined based on the time of occurrence of the security issue indicated by the alarm information, so that the first time period can represent the time period adjacent to the time of occurrence of the security issue (e.g., the time period of [time of occurrence of security issue - 1 hour, time of occurrence of security issue + 1 hour]). As another example, if the first detection object is determined based on user instructions, then the first time period can refer to the risk investigation time period specified by the user instructions.

[0054] Furthermore, this application does not limit the method of obtaining the aforementioned first dataset. For example, in some scenarios, when the aforementioned first detection object is a host, the first dataset can be based on at least one type of data collected for the first detection object (such as...). Figure 3 The configuration information, traffic-side data, terminal-side data, etc. shown are used to determine the first detection object; the at least one type of data includes at least a portion of the configuration information of the first detection object, operation data (such as terminal-side data) collected from the first detection object, and operation data (such as traffic-side data) collected from the gateway corresponding to the first detection object, so that the first dataset can describe the state of the first detection object in the first time period as comprehensively and accurately as possible, thereby making the network attack detection results obtained based on the first dataset more accurate.

[0055] For the configuration information of the first detection object (such as...) Figure 3 Regarding the configuration information shown, this configuration information records some static configuration information associated with the first detection object, such as the running service version, open ports, scheduled tasks, a list of installed software, historical alarm records, etc., so that the configuration information can describe some configuration characteristics of the first detection object during a first time period. Furthermore, this application does not limit the implementation method of this configuration information; for example, the configuration information can use any information capable of describing the configuration characteristics of the terminal device, such as... Figure 3The static information database shown is used for implementation. Furthermore, this application does not limit the method of obtaining this configuration information; for example, it can be implemented using any method capable of obtaining the configuration information of the terminal device, such as reading from the terminal device's local repository or downloading from the cloud.

[0056] For operational data collected from the first detection object (such as...) Figure 3 Regarding the terminal-side data shown, the operation data refers to various dynamic behavior records collected from the first detection object, such as process creation and call chains, file read / write operations, service start / stop, user login / logout records, etc., so that the operation data can describe some behavioral characteristics of the first detection object within a first time period. Furthermore, this application does not limit the implementation method of the operation data; for example, the operation data can use any information capable of describing the behavioral characteristics of the terminal device, such as... Figure 3 The implementation uses the raw data recorded in the Endpoint Detection and Response (EDR) shown. Furthermore, this application does not limit the method of obtaining this operational data; for example, it can be implemented using any method capable of obtaining the behavior records of the terminal device, such as reading from the terminal device's local repository or downloading from the cloud.

[0057] For operation data collected from the gateway corresponding to the first detection object (such as...) Figure 3 Regarding the traffic-side data shown, the operation data refers to various dynamic behavior records performed by the first detection object that need to transmit information outward through the gateway, such as network connection records, file download records, etc., so that the operation data can describe some network usage characteristics exhibited by the first detection object in a first time period. Furthermore, this application does not limit the implementation method of the operation data. For example, the operation data can adopt any information that can describe the network usage characteristics of the terminal device, such as... Figure 3 The implementation uses the raw data recorded in the Network Detection and Response (NDR) shown. Furthermore, this application does not limit the method of obtaining this operational data; for example, it can be implemented using any method capable of obtaining the behavior records of the terminal device from the gateway, such as reading from the gateway's local repository or downloading from the cloud.

[0058] Furthermore, this application does not limit the method of acquiring at least one data of the first detection object. For example, the process of acquiring at least one data may be: after receiving alarm information, determining at least one data based on the alarm information so that the at least one data can represent the original data collected for the first detection object indicated by the alarm information within a specified time period that is highly correlated with it.

[0059] For example, in some scenarios, the process of acquiring at least one data of the first detection object can be as follows: after receiving some requests that are manually or automatically triggered (such as user instructions), the at least one data is determined according to the first detection object specified in the request, so that the at least one data can represent the original data that is strongly correlated with the first detection object collected within a specified time period.

[0060] Furthermore, this application does not limit the method of determining the first dataset. For example, it can specifically be: after obtaining at least one type of data of the first detection object, filtering the data using pre-set data filtering rules to obtain the first dataset (such as by...). Figure 2 or Figure 3 The data output by the data filtering module shown is used to enable the first dataset to describe some operations that are highly relevant to security and performed by the first detected object within the first time period.

[0061] For the aforementioned data filtering rules, these rules refer to rules pre-set by relevant personnel and used to implement the data filtering process. Moreover, this application does not limit the implementation method of the data filtering rules. For example, the data filtering rules can be configured to perform at least the following tasks: ① Remove meaningless noise events (such as frequent heartbeat events) through filtering; ② Remove a large number of redundant fields through filtering to retain some pre-set key fields; ③ Remove behavioral events with low (or even irrelevant) security relevance through filtering to retain behavioral events with high security relevance (such as executable file creation, external network connection, remote session, etc.).

[0062] Based on the above two paragraphs, it can be seen that in some scenarios, after identifying the first detection target based on alarm information or user commands, data can be retrieved from different databases (such as...). Figure 3Data collected within a specified time period (such as the first time period mentioned above) is obtained from the static information database (EDR, NDR) shown. This data includes not only a large amount of behavioral log data but also a large amount of device configuration information, thus enabling the data to comprehensively describe the state of the first detected object during that time period. Because the amount of this data is relatively large, and it contains a large amount of data irrelevant to the source tracing analysis, it can be filtered according to pre-defined data filtering rules to obtain the first dataset corresponding to the first detected object. This first dataset describes the operations performed by the first detected object during the first time period that are highly relevant to security. Therefore, the first dataset contains data strongly related to source tracing, which can then be used as the minimum complete dataset corresponding to the first detected object during that time period. This allows for subsequent analysis based on the minimum complete dataset to identify potentially risky operations performed by the first detected object during that time period.

[0063] Furthermore, in some scenarios, to overcome the defects caused by structural differences in data from different sources, the process of determining the first dataset corresponding to the first detection object may specifically include: after aggregating data from different sources to obtain at least one type of data for the first detection object, filtering the at least one type of data according to pre-set data filtering rules to remove data without analytical value; and then performing data normalization processing on the remaining data after filtering (e.g., from...). Figure 2 The data normalization module shown in the figure implements the processing to obtain the first dataset corresponding to the first detection object.

[0064] It should be noted that this application does not limit the implementation method of the above-described data normalization process. For example, it can be implemented using any data normalization method. For instance, the data normalization process can be: unifying data from different sources into the same structural format, and constructing an index for each data based on certain naming rules, thereby achieving normalization processing for these data. These naming rules are configured to establish a unified index based on some information (such as namespaces, device identifiers, etc.); and this application does not limit the specific naming rules.

[0065] Furthermore, this application does not limit the timing of obtaining the first dataset mentioned above. For ease of understanding, the following explanation combines two scenarios.

[0066] Scenario 1: In some scenarios (such as scenarios that support security alerts), the process of obtaining the first dataset mentioned above can be as follows: in response to received alert information (such as...) Figure 3The protection alarm shown is used to obtain the first dataset. The alarm information indicates at least one risky object, so that the first dataset can describe the status of the entity indicated by the alarm information within the time period corresponding to these risky objects, such as [the time of occurrence of the security problem indicated by the alarm information - preset duration, the time of occurrence of the security problem + preset duration]. This allows for subsequent automatic network attack detection and processing (such as intrusion incident tracing) based on the first dataset and the specific risk points indicated by the alarm information. The preset duration can be determined according to the tracing analysis time requirements corresponding to the security problem.

[0067] Based on the above, it can be seen that the network attack detection method provided in this application supports passive triggering (such as...). Figure 3 The passively triggered process described herein is as follows: Upon receiving a high-confidence alarm message from an external security device, the entity indicated by the alarm message (such as a host IP address) is used as the initial taint, automatically triggering the network attack detection process based on this network attack detection method. This allows for tracing back or forward from the explicit risk point indicated by the alarm message. Therefore, the network attack detection method provided in this application is suitable for automatically performing network attack detection and processing in scenarios with existing explicit risk points.

[0068] Scenario 2: In some scenarios, the process of obtaining the first dataset corresponding to the first detection object can be as follows: In response to the detection of a request triggered for the first detection object, the first dataset is obtained according to the request. The request does not indicate a risk object, so that the first dataset can indicate the state of the first detection object during the time period indicated by the request, so that potential risk mining can be automatically performed based on the first dataset later. The request is configured to request potential risk screening and attack tracing for the first detection object; and this application does not limit the implementation method of the request. For example, the risk analysis request can be manually triggered by the user, or it can be triggered by some devices based on existing intelligence information (such as...). Figure 3 The threat intelligence and other information shown are automatically triggered.

[0069] Based on the foregoing, the proactive triggering process supported by the network attack detection method provided in this application is as follows: If, based on some information, there is suspicion that the first detection target has a potential risk (such as a software having a high-risk vulnerability, abnormal device behavior, etc.), a request carrying the device identifier of the first detection target can be triggered. This allows for the automatic triggering of risk point mining processing based on the network attack detection method, enabling a comprehensive risk investigation and tracing of the first detection target. Therefore, the network attack detection method provided in this application is suitable for automatically performing risk analysis and processing in scenarios without risk points (such as no alarms).

[0070] The first AI application refers to machine learning models with risk point identification capabilities (such as large language models or...). Figure 2 The first AI application, represented as agent 1, is able to analyze relevant data from a device (such as the first dataset mentioned above) to identify potentially risky operations performed by the device.

[0071] Furthermore, this application does not limit the implementation method of the first AI application mentioned above. For example, it can be implemented using any machine learning model that has risk recognition function, such as an intelligent agent or a large language model.

[0072] Furthermore, this application does not limit the working principle of the aforementioned first AI application. For example, when the prompt words corresponding to the first AI application record a large amount of risk point identification knowledge (such as a large number of network attack examples and their corresponding expert experience), the first AI application performs risk point identification processing on some data (such as the aforementioned first dataset) under the guidance of the prompt words.

[0073] For example, if a knowledge base, such as a Retrieval-Augmented Generation (RAG) knowledge base, is pre-configured for the first AI application, then after some data is input into the first AI application, the application retrieves content from the knowledge base based on this data to recall content that is highly relevant to it. This content can then be used by the first AI application to identify and process the risks associated with the data. The RAG knowledge base refers to a pre-built database that records a large amount of security knowledge (such as examples of various risk attacks) to record the characteristics of various attack risks (such as identification rules and attack paths).

[0074] For example, in some scenarios, the aforementioned first AI application can be configured to identify risk points from some data according to at least one dimension. This at least one dimension may include some or all of the following: high-risk service analysis dimension, suspicious command analysis dimension, abnormal login analysis dimension, and abnormal file analysis dimension.

[0075] For the aforementioned high-risk service analysis dimension, this dimension is configured to identify service processes that are suspected of being exploitable. The implementation process of this dimension is as follows: first, a deduplicated process tree is determined based on the first dataset corresponding to the first detection object; then, each service process is identified from the process tree; then, for any process, information related to the process (such as software version, exposed ports, etc.) is queried, and the relevant content of this information (such as vulnerabilities, etc.) is queried through the RAG knowledge base to determine whether the process is at risk of being exploited.

[0076] Regarding the aforementioned suspicious command analysis dimension, this dimension is configured to identify some instructions that are suspected of being risky, such as lateral movement instructions, bounce instructions, system sensitive file access instructions, privilege escalation instructions, etc. Moreover, this application does not limit the implementation method of this dimension. For example, it can be implemented by means of pre-set identification rules for instructions that are suspected of being risky (such as rules recalled from the RAG knowledge base).

[0077] Regarding the aforementioned abnormal login analysis dimension, this dimension is configured to identify some login operations that are suspected of being risky, such as successful login with weak passwords, outbreak of failed password guessing records, password reuse, and abnormal login from other locations. Moreover, this application does not limit the implementation method of this dimension. For example, it can be implemented by means of pre-set identification rules for suspected risky login operations (such as rules recalled from the RAG knowledge base).

[0078] Regarding the aforementioned abnormal file analysis dimension, this dimension is configured to identify some file operations that are suspected of being risky, such as downloading files using external links, script files appearing in temporary directories, and suspicious executable file landing traces. Moreover, this application does not limit the implementation method of this dimension. For example, it can be implemented by using pre-set identification rules for suspected risky file operations (such as rules recalled from the RAG knowledge base).

[0079] Based on the aforementioned content related to the first AI application, it can be inferred that this first AI application (such as...) Figure 2 The working principle of the agent 1 shown may include: the first AI application based on a pre-built RAG knowledge base (such as...) Figure 2 The RAG knowledge base shown is used to perform risk point identification processing on the first dataset to obtain the first risk object information, so that the first risk object information can indicate the objects that are suspected of being risky presented in the first data (such as the operation of "finding passwords"), so that the "hypothesis-verification" reasoning method can be used to confirm whether the object has been used to cause an attack.

[0080] The first risk object information describes the risk points presented in the first dataset, enabling the first risk object information to represent objects suspected of being exploited for attacks (such as the "password search" operation) presented in the first dataset. Furthermore, this application does not limit the implementation of the first risk object information; for example, it can be implemented using any type of risk point.

[0081] The first path information corresponding to the first risk object information describes the path presented by the first dataset corresponding to the first risk object information, so that the first path information can indicate the state of the first risk object information presented in the first dataset (such as the state of being utilized by which path).

[0082] In addition, this application does not limit the method of determining the first path information. For example, the process of determining the first path information may be: directly constructing the first path information based on the data related to the first risk object information recorded in the first dataset, so that the first path information can describe the state of the first risk object information in the first dataset.

[0083] Furthermore, to improve efficiency, the process of determining the first path information can be as follows: constructing a graph based on the first dataset (e.g., Figure 2 The graph database shown enables the graph to present the content described by the first dataset in a structured manner (such as the status of each risk point in the first dataset); the graph can be used to find the first path information corresponding to the first risk object information, thus enabling the graph to quickly query the first path information corresponding to the first risk object information, thereby improving efficiency.

[0084] For the aforementioned graph, the graph refers to a tree diagram determined based on the first dataset corresponding to the first detected object, which can describe the state of the first detected object in a structured manner within a first time period; moreover, this application does not limit the method of determining the graph, for example, it can be implemented using any method that can construct a graph based on a large amount of data.

[0085] For example, the above graph construction process may include the following steps: First, extract elements (such as processes, files, addresses, ports, etc.) from the first dataset to serve as nodes in the graph; then, extract the causal relationships or interactive behaviors between the elements from the first dataset (such as process 1 creating process 2, process 2 connecting to address 1, user 1 logging into host 1), etc., to serve as directed edges in the graph; then, extract detailed information about each element (such as file hash value, location, etc.) and detailed information about each relationship (such as timestamp, operation type, etc.) from the first dataset, respectively, as attributes of the nodes and directed edges in the graph, so that these nodes and directed edges can be imported into a graph database (such as...) Figure 2 The graph database shown is used to form a large-scale, semantically rich graph that can describe the various behaviors of the first detected object in the first time period, so that the attack path hypothesized for some risk points (such as the information of the first risk object) can be verified based on the graph.

[0086] S2: Input the information of the first risk object into the second AI application to obtain the second path information output by the second AI application.

[0087] The second AI application refers to the machine learning model used when hypothesizing an attack path for a risky object, so that the second AI application has the function of generating an attack path for that risky object.

[0088] Furthermore, this application does not limit the implementation method of the second AI application. For example, it can be implemented using any machine learning model with attack path generation function, such as an intelligent agent or a large language model.

[0089] Furthermore, this application does not limit the working principle of the aforementioned second AI application. For example, when the prompt words corresponding to the first AI application record attack path knowledge corresponding to various risk points (such as a large number of network attack examples and their corresponding expert experience), the first AI application can infer the attack path corresponding to a risk object under the guidance of the prompt words.

[0090] For example, if a knowledge base is pre-configured for the first AI application (such as...) Figure 2 The RAG knowledge base shown above allows the first AI application to retrieve content highly relevant to the risk point (such as examples of attack risks, attack paths, etc.) after a certain risk point (such as information about the first risk object) is input into the first AI application. The first AI application then uses this content to determine the attack path corresponding to the risk point.

[0091] Furthermore, this application does not limit the relationship between the aforementioned second AI application and the aforementioned first AI application; for example, both can use the same model (e.g., Figure 2 The agent 1 shown is used for implementation. Alternatively, the two can be implemented using different models.

[0092] The second path information describes the attack path hypothesized by the second AI application based on the first risk object information, so that the second path information can indicate what path appears when an attacker uses the first risk object information to cause an attack.

[0093] S3: In response to the matching of the second path information with the first path information, determine the first attack detection result based on the second path information and the first risk object information.

[0094] The first attack detection result can indicate which risk points and corresponding attack paths the first detected object presented in the first time period, so that the first attack detection result can not only describe the actual risk points of the first detected object that were used to cause attacks in the first time period, but also describe the attack tracing results (such as attack paths) determined for the risk points.

[0095] As can be seen, in one possible implementation, after assuming second path information (such as "a vulnerability 1 → gain execution command privileges → find password") for the first risk object information, the first path information corresponding to the first risk object information in the graph can be compared with the second path information to identify whether the second path information matches the first path information. This allows verification of the correctness of the second path information using the graph. This application does not limit the implementation of this matching. For example, if the second path information is part or all of the first path information (such as "a vulnerability 1 → gain execution command privileges → find password"), then it can be determined that the second path information matches the first path information; however, if the first path information (such as "a vulnerability 2 → gain execution command privileges → find password") does not contain any part identical to the second path information, then it can be determined that the second path information does not match the first path information.

[0096] Based on the above S1 to S3, the network attack detection method based on a machine learning model (such as an intelligent agent) and exhibiting automated reasoning function provided in this application includes: firstly, inputting a first dataset into a first AI application (such as an intelligent agent), so that the first AI application performs risk identification processing on the first data to obtain and output first risk object information (such as the operation of "finding passwords"), so that the first risk object information can represent objects (such as operations, events, etc.) that are suspected of being risky presented in the first data, thereby enabling the first risk object information to represent the risk points that are suspected of causing attacks presented in the first data; then inputting the first risk object information into a second AI application (such as an intelligent agent), so that the second AI application can determine the hypothesized attack path based on the first risk object information to obtain and output second path information (such as the path information of "a certain vulnerability 1 → obtaining execution command privileges → finding passwords"), so that the second path information can represent the attack points that are suspected of causing attacks when the first risk object information is used to create vulnerabilities. When an attack occurs, the attack path is determined so that when the second path information matches the first path information corresponding to the first risk object information presented in the first dataset (such as the path information "a certain vulnerability 1 → obtain command execution privileges → search for passwords"), it can be determined that the first risk object information has been used to cause an attack. Therefore, the first attack detection result is determined based on the first risk object information and the second path information, so that the first attack detection result can represent the risk object presented by the first data and its corresponding attack path. Thus, the first attack detection result can indicate the characteristics of the network attack based on the first risk object information (such as attack path characteristics), so as to realize the automatic detection of risk points and their source tracing results from some data (such as a large amount of data collected from host 1), thereby realizing the automatic detection of network attacks from some data, overcoming the defects caused by manual analysis (such as intrusion event source tracing analysis), improving analysis efficiency and accuracy, and helping to improve equipment security.

[0097] Research has found that in some scenarios, the first AI application may discover multiple risk points from the first dataset at once. Therefore, to improve efficiency, the aforementioned network attack detection method can include at least the following steps: First, the first AI application determines N first risk object information points from the first dataset, where N is a positive integer; then, the second AI application assumes second path information corresponding to the i-th first risk object information, where i is a positive integer, initially 1, and i ≤ N, so as to determine whether the second path information matches the first path information indicated by the first dataset for the i-th first risk object information. Based on the second path information and the i-th first risk object information, the method can determine... The risk analysis result corresponding to the i-th first risk object information is determined, such that the risk analysis result includes at least the second path information and the i-th first risk object information. i is then updated, such that the updated i increases by 1 compared to the original i. The process then returns to continue executing the step of "using the second AI application to hypothesize the attack path corresponding to the i-th first risk object information" and subsequent steps, until it is detected that all first risk object information has been traversed. Based on the risk analysis results corresponding to all obtained first risk object information, the aforementioned first attack detection result is determined, so that the first attack detection result can indicate each risk point presented by the first dataset and its corresponding attack path. This application does not limit the implementation method of the first attack detection result. For example, it can specifically be: integrating the risk analysis results corresponding to these first risk object information according to certain information (such as temporal information, causal relationships, etc.) to obtain the first attack detection result, so that the first attack detection result can present these first risk object information and their corresponding attack paths in a structured manner (such as a chain). For example, the first attack detection result can be obtained by marking the risk analysis results corresponding to these first risk object information onto the already constructed graph, so that the marked graph can present these risk points and their corresponding attack paths in a specific way.

[0098] Research has found that in some scenarios, the information on the first risk object directly generated using a large language model may have certain defects (such as the inability to accurately describe the characteristics of the risk point itself), which can easily affect the effectiveness of risk analysis.

[0099] Based on the above research, in order to overcome the problems shown in the previous paragraph, the above network attack detection method may further include the following steps: In response to the mismatch between the second path information and the first path information, it can be determined that the first risk object information is not very accurate. Therefore, the first risk object information is updated based on the first path information so that the updated first risk object information has some content added compared to the first risk object information before the update (such as the upstream service corresponding to the first risk object information), thereby making the updated first risk object information more accurate than the first risk object information before the update. Then, the above S2 and subsequent steps are executed to start the next round of "hypothesis-verification" reasoning process. This iterative cycle continues until the stopping condition is met (such as detecting that the attack path matches the actual path, or the number of iterations reaches a preset threshold, etc.), at which point the iterative cycle ends.

[0100] As can be seen, this application provides a cyclical reasoning process based on "hypothesis-verification," which may specifically include the following steps: utilizing an intelligent agent (such as...) Figure 2 The agent 1 shown determines the information of the first risk object from the first dataset corresponding to the first detection object.

[0101] First, the intelligent agent generates hypothetical second path information based on the information of the first risk object;

[0102] Then, using the first path information presented by the graph for the first risk object, the second path information is verified to obtain the verification result;

[0103] If the verification result indicates that the first path information and the second path information are successfully matched, it can be determined that the first risk object information has indeed been used to cause an attack. Therefore, the graph is updated according to the first risk object information and the second path information so that the updated graph includes the first risk object information and the second path information, so that the first attack detection result (such as risk graph) of the first detection object can be determined based on the updated graph. This allows the first attack detection result to present the risk points of the first detection object and its corresponding attack paths in a graph format.

[0104] If the verification result indicates that the first path information and the second path information fail to match, it can be determined that the first risk object information may be inaccurate. Therefore, the first risk object information is updated based on the first path information to make the updated first risk object information more accurate than the original first risk object information. This allows the agent to return to the above-mentioned step of "generating hypothetical second path information based on the first risk object information" and subsequent steps based on the updated first risk object information, thus initiating the next round of "hypothesis-verification" reasoning process. This process is iterated until the number of iterations reaches a preset threshold, at which point it can be determined that the first risk object information has not been used to cause an attack. Therefore, the graph is updated based on the first risk object information and the second path information (or the first path information) to ensure that the updated graph does not contain the first risk object information and the second path information (or the first path information). This ensures that the final risk graph (such as the first attack detection result) presents the first detected object and its attack path.

[0105] Research has revealed that for certain risk points (such as black IPs), attacks exploiting these risk points may exhibit a propagation relationship between multiple hosts.

[0106] Based on the above research, in order to better improve the source tracing effect, when the first dataset is determined based on data collected from the first detection object (e.g., host 1), the network attack detection method may further include the following steps: In response to finding the second detection object (e.g., host 2) based on the first risk object information, it can be determined that the attack caused by the first risk object information has also spread to the second detection object. Therefore, the second dataset is input into the first AI application to obtain the second risk object information output by the first AI application. The second dataset is determined based on data collected from the second detection object, and the second dataset includes third path information corresponding to the second risk object information; The second risk object information is input into the second AI application, and the fourth path information output by the second AI application is obtained; in response to the matching of the fourth path information with the third path information, the second attack detection result is determined based on the fourth path information and the second risk object information; the second attack detection result and the first attack detection result are integrated to obtain the third attack detection result (such as a multi-device linkage attack chain diagram), so that the third attack detection result can indicate the cross-device attack path presented by a risk point (such as a black IP or other risk point), thereby enabling the third attack detection result to indicate the attack propagation situation of the risk point among multiple devices, which is conducive to improving the accuracy of tracing.

[0107] For the aforementioned second detection object, it refers to the object found using the first risk object information as a clue, which is affected by an attack caused by the exploitation of the first risk object information. The second detection object must at least satisfy the following constraint: the first risk object information has an impact on the second detection object (e.g., the risk operation indicated by the first risk object information induces the second detection object to perform a certain risk operation, etc.). Furthermore, this application does not limit the method of determining the second detection object. For example, it can employ any method capable of searching for other hosts affected by the attack based on clues indicated by risk points (such as IP addresses), such as using machine learning models (e.g., large language models or...). Figure 2 The intelligent agent 2) shown is implemented. Specifically, for Figure 2 In the case of agent 2, after obtaining the information about the first risky object, agent 2 can analyze, under the guidance of a threat intelligence database, whether the threat clues (such as IP addresses) indicated by the first risky object information will actually cause attacks on other hosts. If so, it will search for other devices based on the first risky object information; otherwise, it will not take any action. The threat intelligence database records a large amount of security-related knowledge, enabling agent 2 to use this knowledge to analyze the characteristics of some threat clues (such as the characteristics of multi-device propagation attacks).

[0108] For the aforementioned second dataset, it can indicate the state of the second detected object within a third time period. This third time period can be determined based on the first risk object information, such that it is defined as [the time of occurrence of the impact of the threat clues indicated by the first risk object information on the second detected object - threshold 1, and the time of occurrence of the impact of the threat clues indicated by the first risk object information on the second detected object + threshold 1]. This allows the third time period to represent the time period required for analyzing the impact. Furthermore, the implementation method of the second dataset (such as the determination process) is similar to that of the first dataset described above, and for the sake of brevity, it will not be repeated here.

[0109] Regarding the aforementioned second risk object information, this second risk object information describes the risk points identified for the second detection object. The content of this second risk object information is similar to that of the first risk object information described above, and for the sake of brevity, it will not be repeated here.

[0110] The aforementioned third path information indicates the path corresponding to the second risk object information presented by the second dataset. The content of this third path information is similar to that of the first path information, and for the sake of brevity, it will not be repeated here.

[0111] The fourth path information described above describes the attack path hypothesized by the second AI application targeting the second risky object. The content of this fourth path information is similar to that of the second path information described above, and for the sake of brevity, it will not be repeated here.

[0112] Regarding the aforementioned second attack detection result, this second attack detection result is determined based on the aforementioned second dataset. This allows the second attack detection result to indicate which risk points presented by the second detected object during the third time period were exploited to cause attacks and their attack paths. Therefore, the second attack detection result not only describes the risk points that caused attacks by the second detected object during the third time period but also describes the source tracing results determined for those risk points. Furthermore, the implementation method of this second attack detection result (such as the determination process) is similar to the implementation method of the aforementioned first attack detection result, and for the sake of brevity, it will not be described in detail here.

[0113] Furthermore, this application does not limit the implementation of the step of "integrating the second attack detection result and the first attack detection result to obtain the third attack detection result". For example, it can adopt any method that can integrate multiple analysis results into one analysis result, such as using a machine learning model (such as a large language model or...). Figure 2 The intelligent agent 2 shown is implemented.

[0114] Research has revealed that in some scenarios, attacks presented by different hosts may have some kind of correlation (such as causal relationship). Therefore, after discovering the risk points that cause attacks for the second detection object, the risk points can be used as clues to conduct another round of attack detection on the first detection object, in order to discover new risk points for the first detection object and improve the comprehensiveness of the analysis.

[0115] Based on the above research, in order to better improve the comprehensiveness of risk analysis, the above network attack detection method may further include the following steps: updating the first attack detection result according to the second risk object information, so that the risk operation indicated by the updated first attack detection result adds the newly discovered risk points and attack paths based on the second risk object information compared to the first attack detection result before the update, thereby making the attack indicated by the updated first attack detection result more comprehensive than the attack indicated by the first attack detection result before the update, so as to improve the comprehensiveness of attack detection.

[0116] Furthermore, this application does not limit the implementation method of the above-mentioned "updating the first attack detection result based on the second risk object information". For example, in some scenarios, it can specifically be: in response to the above-mentioned second attack detection result including M second risk object information, the first attack detection result is updated based on the M second risk object information, so as to realize that based on all the risk points that have been discovered for the second detection object (such as host 2) that cause the attack, another round of attack detection is performed on the first detection object (such as host 1) in order to discover more risk points that cause the attack.

[0117] Research has revealed that attacks from different devices may induce each other in certain scenarios. Therefore, after identifying the risk points that cause attacks in the second detection object, further analysis is conducted to determine whether other risk points induced by the first detection object have appeared.

[0118] Based on the above research, in one possible implementation, the step of "updating the first attack detection result based on the second risk object information" can specifically be: updating the first attack detection result based on the second risk object information that meets the first condition. The first condition is that there is a correlation (such as a causal relationship) between the second risk object information and one or more risk points (such as the first risk object information) indicated by the first attack detection result. This allows for further analysis based on the second risk object information that meets the first condition to determine whether the first detected object has exhibited other risk points associated with the second risk object information, thereby improving the comprehensiveness of the risk analysis.

[0119] Research has revealed that in some scenarios, certain attacks, once transmitted from one device to another, do not necessarily return. Therefore, when detecting attacks on a second target, if not only are risk points with some relationship (such as causal relationship) to those already detected on the first target found, but also risk points completely unrelated to those already detected on the first target, then, to improve the comprehensiveness of the risk analysis, these unrelated risk points can be used as a starting point to further analyze whether other risk points exist on the first target.

[0120] Based on the above research, in one possible implementation, the step of "updating the first attack detection result based on the second risk object information" can specifically be: updating the first attack detection result based on the second risk object information that meets the second condition. The second condition is that there is no correlation between the second risk object information and all risk points indicated by the first attack detection result, so that subsequent analysis can continue to explore whether the first detected object has had other risk points associated with the second risk object information, thereby improving the comprehensiveness of risk analysis.

[0121] In some scenarios, the above-mentioned step of "updating the first attack detection result based on the second risk object information" can be specifically as follows: firstly, analyze whether a new risk point has appeared in the relevant data of the first detection object (such as the first dataset) that is related to the second risk object information (such as a causal relationship), so that when the new risk point is determined, the attack path of the new risk point is determined from the relevant data, and the first attack detection result is updated using the attack path and the relevant information of the new risk point.

[0122] Research has found that in some scenarios, certain risk points detected in the second detection target may induce the first detection target to exhibit certain risk points in other time periods.

[0123] Based on the above research, in order to improve the accuracy of the analysis, when the first dataset indicates the state of the first detected object within the first time period, the step of "updating the first attack detection result based on the second risk object information" can be as follows: input the second risk object information and the first dataset into the first AI application to obtain the third risk object information output by the first AI application, so that the third risk object information indicates the newly discovered risk points in the current round of attack analysis; obtain the third dataset corresponding to the third risk object information, the third dataset including the fifth path information corresponding to the third risk object information, the third dataset indicating the state of the first detected object within the second time period; input the third risk object information into the second AI application to obtain the sixth path information output by the second AI application; in response to the matching of the sixth path information with the fifth path information, update the first attack detection result based on the sixth path information and the third risk object information. This can realize risk analysis across time periods, thereby connecting risk attacks from different devices and different times into a complete, related (such as causal) attack chain, so as to better improve the source tracing effect.

[0124] Regarding the aforementioned third risk object information, this third risk object information can indicate new risk points discovered for the first detection object, using the second risk object information as a clue. Moreover, this application does not limit the implementation method of the third risk object information. For example, it can specifically be: inputting the second risk object information as an additional condition to the first AI application, so that the first AI application can re-process the first data for risk identification under the guidance of the second risk object information, in order to determine whether the first detection object has other risk points besides the aforementioned first risk object information.

[0125] For the aforementioned third dataset, it can indicate the state (such as the operation performed) of the first detected object within a second time period. This second time period is determined based on the third risk object information, making it the time period of [the occurrence time of the third risk object information - threshold 2, the occurrence time of the third risk object information + threshold 2]. This allows the second time period to represent the reference time period needed when analyzing whether the third risk object information has been used to cause an attack. Furthermore, the implementation method of this third dataset (such as the determination process) is similar to the implementation method of the first dataset described above, and for the sake of brevity, it will not be repeated here.

[0126] The sixth path information described above describes the attack path hypothesized by the second AI application targeting the third risky object. The content of this sixth path information is similar to that of the second path information described above, and for the sake of brevity, it will not be repeated here.

[0127] The fifth path information described above describes the path corresponding to the third risk object information presented by the third dataset. The content of this fifth path information is similar to that of the first path information described above, and for the sake of brevity, it will not be repeated here.

[0128] In addition, this application does not limit the method of obtaining the above-mentioned fifth path information. For example, it can specifically be: updating the map based on the third dataset so that the updated map adds the state of the first detection object in the second time period compared with the map before the update; and searching for the fifth path information corresponding to the third risk object information from the updated map.

[0129] Furthermore, this application does not limit the implementation of the above-mentioned step of "updating the map based on the third dataset corresponding to the third risk object information". For example, it can specifically be: splicing the newly constructed map based on the third dataset with the map already constructed based on the first dataset above to form a map, so as to realize the map update process.

[0130] Furthermore, this application does not limit the update process of the first attack detection result. For example, it may include: first, the agent generates hypothetical sixth path information based on the third risk object information; then, using the fifth path information presented by the updated graph for the third risk object information, the sixth path information is verified to obtain a verification result; if the verification result indicates that the fifth path information and the sixth path information are successfully matched, it can be determined that the third risk object information has been used to cause an attack, so the first attack detection result is updated based on the third risk object information and the sixth path information, so that the updated first attack detection result has some additional information (such as the third risk object information and the sixth path information) compared to the first attack detection result before the update; however, if If the verification result indicates that the fifth path information and the sixth path information fail to match, it can be determined that the third risk object information may not be accurate. Therefore, the third risk object information is updated based on the fifth path information to make the updated third risk object information more accurate than the previous third risk object information. This allows the agent to return to the above-mentioned step of "generating the hypothetical attack path based on the third risk object information" and subsequent steps based on the updated third risk object information, thus initiating the next round of the "hypothesis-verification" reasoning process. This process is iterated until the number of iterations reaches a preset threshold, at which point it can be determined that the third risk object information has not been used to cause an attack. Therefore, the third risk object information and the sixth path information can be discarded directly.

[0131] Research has revealed that after uncovering new attack-causing risks in the first detection object by using some risk points detected against the second detection object as clues, these new attack-causing risks may also induce other risk points in the second detection object to be exploited for attacks. Therefore, to improve the accuracy of the analysis, the aforementioned network attack detection method may further include the following steps: updating the second attack detection result based on the aforementioned third risk object information. This ensures that the risk points indicated by the updated second attack detection result include newly uncovered risk points based on the third risk object information, making the risk points indicated by the updated second attack detection result more comprehensive than those indicated by the previous second attack detection result, thereby improving the comprehensiveness of the risk analysis. The update process for the second attack detection result is similar to the update process for the first attack detection result described above, and will not be repeated here for the sake of brevity.

[0132] To better understand the various update processes described above, three examples are provided below.

[0133] Example 1: In some scenarios (such as scenarios with sufficient computing resources), after detecting a risk point 1 that could cause an attack on device 1 within time period 1, if device 2 is located using this risk point 1 as a clue, then the corresponding time period 2 for device 2 can be determined based on risk point 1. Furthermore, based on the data analysis of device 2 within time period 2, it can be determined that device 2 exhibited risk points 2 to 5 that could cause an attack within that time period 2. Therefore, an intelligent agent (such as...) can... Figure 2 The agent 1 shown determines whether device 1 has encountered any other potential attack points besides risk point 1, based on risk points 2 through 5. If a potential attack point 6 is detected, the agent determines the corresponding time period 3 for device 1 based on risk point 6, and updates the data graph corresponding to device 1 in time period 3. This updated graph records the actual path corresponding to risk point 6, allowing subsequent inference based on the updated graph whether device 1 has engaged in an attack using risk point 6. This enables updating the risk analysis results for device 1. Furthermore, if the updated risk analysis results for device 1 indicate that device 1 encountered the attack-causing risk point 6 in time period 3, the risk analysis results for device 2 can be updated based on risk point 6. This iterative cycle continues until no new risk points are discovered, thus integrating risk points from different devices and times across devices and time periods to improve the tracing effect.

[0134] Example 2: In some scenarios (such as attacks propagating bidirectionally across different devices over time), after detecting a risk point 1 that could cause an attack on device 1 within time period 1, if device 2 is located using this risk point 1 as a clue, then the corresponding time period 2 for device 2 can be determined based on risk point 1. Furthermore, based on the data analysis of device 2 within time period 2, it can be determined that device 2 experienced a risk point 2 induced by risk point 1 within that time period 2, which could then be used by an intelligent agent (such as...) Figure 2The agent 1 shown determines whether device 1 has other potential attack points besides risk point 1 based on risk point 2. If a potential attack point 3 is detected, the agent determines the corresponding time period 3 for device 1 based on risk point 3, and updates the data graph corresponding to device 1 in time period 3. This updated graph records the actual path corresponding to risk point 3, allowing subsequent inference based on the updated graph whether device 1 has launched an attack using risk point 3 (such as risk point 3 induced by risk point 2). This enables updating the risk analysis results for device 1. Furthermore, if the updated risk analysis results for device 1 indicate that device 1 has the attack-causing risk point 3 in time period 3, the risk analysis results for device 2 can be updated based on risk point 3. This iterative cycle continues until no new risk points are discovered, thus linking risk points from different devices and different times into a complete, causally related attack chain, thereby improving the tracing effect.

[0135] Example 3: In some scenarios (such as attacks propagating unidirectionally between different devices), after detecting a risk point 1 that could cause an attack on device 1 within time period 1, if device 2 is located using this risk point 1 as a clue, then the time period 2 corresponding to device 2 can be determined based on this risk point 1. Furthermore, based on data analysis of device 2 within time period 2, it can be determined that device 2 not only experienced an attack caused by risk point 2 induced by risk point 1, but also an attack caused by risk point 3, which is completely unrelated to risk point 1. Therefore, an intelligent agent (such as...) can... Figure 2 The agent 1, as shown, determines whether device 1 has other potential attack points besides risk point 1 based on risk point 3. If a potential attack point 4 is detected, the agent determines the corresponding time period 3 of device 1 based on risk point 4, and updates the data graph of device 1 in time period 3 so that the updated graph records the actual path corresponding to risk point 4. This allows for subsequent inference based on the updated graph whether device 1 has launched an attack using risk point 4 (e.g., risk point 4 induced by risk point 3). This enables updating the risk analysis results for device 1. Furthermore, if the updated risk analysis results for device 1 indicate that device 1 also has a risk point 5 unrelated to risk point 3 in time period 3, the risk analysis results for device 2 can be updated based on risk point 5. This iterative cycle continues until no new risk points are discovered, integrating risk points from different devices and times into complete and related (e.g., causal) attack chains to improve the tracing effect.

[0136] Based on the aforementioned content regarding network attack detection methods, this application provides a network attack detection method and system based on a large language model (e.g., Figure 2 The system shown aims to automate, intelligently, and accurately trace the source of potential risks or existing network intrusions, especially APT attacks. This allows the system to address the inefficiencies, rigid rules, and limited scope inherent in manual tracing methods. Specifically, the system employs... Figure 2 The architecture shown is implemented to enable the system to effectively reconstruct attack paths, locate attack sources, and generate interpretable attribution reports by integrating data acquisition, graph construction, and intelligent analysis based on large language models. Furthermore, the triggering module in the system is configured to determine when to execute the network attack detection method provided in this application. The triggering modes implemented by this module include passive triggering and active triggering, and both types of triggering methods can be used to implement risk analysis processing for the same terminal device.

[0137] The solution provided in this application overturns the passive mode of some attribution techniques that heavily rely on explicit attack signals (such as alarm information) provided by security devices. This solution utilizes a large language model to continuously and deeply analyze and reason about the global behavioral data of terminal devices, eliminating the need for explicit alarm information. It proactively uncovers discrete, potential risk points from massive amounts of seemingly normal behavior. By understanding the intent of global data, this solution discovers subtle traces of attacks and initiates attribution, achieving a fundamental shift from passive response to proactive defense. Therefore, the solution provided in this application can extend from an "alarm-driven" mode to a "proactive discovery" mode, enabling attack attribution in alarm-free scenarios.

[0138] Furthermore, considering the characteristics of APT attacks, which typically involve multiple hosts and last for extended periods, this application provides a dynamic graph expansion and correlation analysis scheme. Specifically, when a risk point exploited to cause an attack is discovered on any terminal device, this scheme automatically expands the analysis scope to other related terminal devices. This allows for the linking of behavioral logs scattered across different devices and time periods into a complete, causally related attack chain, enabling relevant personnel to fully trace back each step of the attack from a global perspective. Therefore, the scheme provided in this application can expand from a "single-device analysis of local attacks" model to a "cross-device analysis of the entire attack picture" model, achieving complete cross-device attribution.

[0139] Furthermore, this application provides an automated hypothesis-verification reasoning mechanism based on a large language model, compressing the manual correlation, analysis, and verification work that previously required hours or even days of personnel to perform to the minute level. This mechanism can automatically propose attack path hypotheses and quickly verify and prune them in massive amounts of data, thereby automatically focusing on the most critical intrusion paths and root causes. Therefore, the solution provided in this application can extend from a "manual analysis" model to an "automatic source tracing" model, achieving a minute-level response time.

[0140] Based on the network attack detection method provided in the embodiments of this application, the embodiments of this application also provide a network attack detection device, which is described below in conjunction with... Figure 4 Explanation and clarification will be provided. Among them, Figure 4 This is a schematic diagram of a network attack detection device provided in an embodiment of this application. It should be noted that for technical details of the network attack detection device provided in this embodiment, please refer to the relevant content of the network attack detection method described above.

[0141] like Figure 4 As shown, the network attack detection device 400 provided in this application embodiment includes:

[0142] The first determining unit 401 is used to input the first dataset into the first AI application to obtain the first risk object information output by the first AI application; wherein, the first dataset includes the first path information corresponding to the first risk object information;

[0143] The second determining unit 402 is used to input the first risk object information into the second AI application to obtain the second path information output by the second AI application;

[0144] The third determining unit 403 is used to determine a first attack detection result based on the second path information and the first risk object information in response to the matching of the second path information and the first path information.

[0145] In one possible implementation, the network attack detection device 400 further includes: a first update unit, configured to update the first risk object information based on the first path information in response to a mismatch between the second path information and the first path information, and continue to execute the step of inputting the first risk object information into the second AI application.

[0146] In one possible implementation, the first dataset is determined based on data collected for the first detection object;

[0147] The network attack detection device 400 further includes: a fourth determining unit, configured to, in response to finding a second detection object based on the first risk object information, input the second dataset into the first AI application to obtain second risk object information output by the first AI application, wherein the second dataset is determined based on data collected for the second detection object, and the second dataset includes third path information corresponding to the second risk object information; input the second risk object information into the second AI application to obtain fourth path information output by the second AI application; in response to matching the fourth path information with the third path information, determine a second attack detection result based on the fourth path information and the second risk object information; and integrate the second attack detection result and the first attack detection result to obtain a third attack detection result.

[0148] In one possible implementation, the fourth determining unit is further configured to: update the first attack detection result based on the second risk object information before integrating the second attack detection result and the first attack detection result to obtain the third attack detection result.

[0149] In one possible implementation, the first dataset indicates the state of the first detected object within a first time period;

[0150] The fourth determining unit is specifically configured to: input the second risk object information and the first dataset into the first AI application to obtain the third risk object information output by the first AI application; obtain the third dataset corresponding to the third risk object information, the third dataset including the fifth path information corresponding to the third risk object information, the third dataset indicating the state of the first detected object during the second time period; input the third risk object information into the second AI application to obtain the sixth path information output by the second AI application; and update the first attack detection result based on the sixth path information and the third risk object information in response to the matching of the sixth path information and the fifth path information.

[0151] In one possible implementation, the network attack detection device 400 further includes: a data acquisition unit, configured to acquire the first dataset based on the received alarm information, wherein the alarm information indicates at least one risk object; or, in response to detecting a request triggered against the first detection object, acquire the first dataset based on the request, wherein the request does not indicate a risk object.

[0152] In one possible implementation, the network attack detection device 400 satisfies at least one of the following constraints:

[0153] The process of determining the first path information includes: constructing a graph based on the first dataset; and searching for the first path information corresponding to the first risk object information from the graph.

[0154] The first dataset is determined based on at least one type of data collected for the first detection object; the at least one type of data includes configuration information of the first detection object, operation data collected from the first detection object, and at least a portion of operation data collected from the gateway corresponding to the first detection object.

[0155] Based on the aforementioned content regarding the network attack detection device 400, its working principle includes: firstly, inputting a first dataset into a first AI application (such as an agent), enabling the first AI application to perform risk identification processing on the first data to obtain and output first risk object information (such as the operation of "finding passwords"), so that the first risk object information can represent objects (such as operations, events, etc.) suspected of having risks presented in the first data, thereby enabling the first risk object information to represent the potential attack points presented in the first data; then, inputting the first risk object information into a second AI application (such as an agent), enabling the second AI application to determine a hypothetical attack path based on the first risk object information to obtain and output second path information (such as the path information of "a certain vulnerability 1 → obtaining command execution privileges → finding passwords"), so that the second path information can represent what path is presented when an attack is caused using the first risk object information, so that... When the second path information is detected to match the first path information corresponding to the first risk object information presented in the first dataset (such as the path information "a certain vulnerability 1 → obtain command execution privileges → search for passwords"), it can be determined that the first risk object information has been used to cause an attack. Therefore, the first attack detection result is determined based on the first risk object information and the second path information, so that the first attack detection result can represent the risk object presented by the first data and its corresponding attack path. Thus, the first attack detection result can indicate the characteristics of the network attack based on the first risk object information (such as attack path characteristics), so as to realize the automatic detection of risk points and their source tracing results from some data (such as a large amount of data collected from host 1), thereby realizing the automatic detection of network attacks from some data, overcoming the defects caused by manual analysis (such as intrusion event source tracing analysis), improving analysis efficiency and accuracy, and helping to improve equipment security.

[0156] In addition, this application also provides an electronic device, which includes a processor and a memory: the memory is used to store instructions or computer programs; the processor is used to execute the instructions or computer programs in the memory so that the electronic device performs any implementation of the network attack detection method provided in this application.

[0157] See Figure 5 This diagram illustrates a structural schematic of an electronic device 500 suitable for implementing embodiments of the present disclosure. The terminal devices in these embodiments may include, but are not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 5 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0158] like Figure 5 As shown, electronic device 500 may include a processing unit (e.g., central processing unit, graphics processor, etc.) 501, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 502 or a program loaded from storage device 508 into random access memory (RAM) 503. RAM 503 also stores various programs and data required for the operation of electronic device 500. The processing unit 501, ROM 502, and RAM 503 are interconnected via bus 504. Input / output (I / O) interface 505 is also connected to bus 504.

[0159] Typically, the following devices can be connected to I / O interface 505: input devices 506 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 507 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 508 including, for example, magnetic tapes, hard disks, etc.; and communication devices 509. Communication device 509 allows electronic device 500 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 5 An electronic device 500 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0160] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 509, or installed from a storage device 508, or installed from a ROM 502. When the computer program is executed by the processing device 501, it performs the functions defined in the methods of embodiments of this disclosure.

[0161] The electronic device provided in this embodiment belongs to the same inventive concept as the method provided in the above embodiments. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.

[0162] This application also provides a computer-readable medium storing instructions or computer programs that, when executed on a device, cause the device to perform any implementation of the network attack detection method provided in this application.

[0163] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0164] In some implementations, clients and servers can communicate using any currently known or future-developed network protocol such as HTTP (Hypertext Transfer Protocol) and can interconnect with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), the Internet (e.g., the Internet of Things), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future-developed networks.

[0165] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0166] The aforementioned computer-readable medium carries one or more programs, which, when executed by the electronic device, enable the electronic device to perform the aforementioned methods.

[0167] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including but not limited to object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0168] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0169] The units described in the embodiments of this disclosure can be implemented in software or hardware. The names of the units / modules do not necessarily limit the specific unit itself.

[0170] The functions described above in this document can be performed at least in part by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), and so on.

[0171] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0172] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems or apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and relevant parts can be referred to the method section.

[0173] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0174] It should also be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0175] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0176] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for detecting network attacks, characterized in that, The method includes: The first dataset is input into the first artificial intelligence (AI) application to obtain the first risk object information output by the first AI application; wherein, the first dataset includes the first path information corresponding to the first risk object information; The first risk object information is input into the second AI application to obtain the second path information output by the second AI application. In response to the matching of the second path information with the first path information, a first attack detection result is determined based on the second path information and the first risk object information.

2. The method according to claim 1, characterized in that, The method further includes: In response to the mismatch between the second path information and the first path information, the first risk object information is updated based on the first path information, and the step of inputting the first risk object information into the second AI application continues.

3. The method according to claim 1, characterized in that, The first dataset is determined based on data collected for the first detection object; The method further includes: In response to finding a second detection object based on the first risk object information, the second dataset is input into the first AI application to obtain the second risk object information output by the first AI application. The second dataset is determined based on the data collected for the second detection object and includes third path information corresponding to the second risk object information. Input the second risk object information into the second AI application to obtain the fourth path information output by the second AI application; In response to the matching of the fourth path information with the third path information, a second attack detection result is determined based on the fourth path information and the second risk object information; The second attack detection result and the first attack detection result are integrated to obtain the third attack detection result.

4. The method according to claim 3, characterized in that, Before integrating the second attack detection result and the first attack detection result to obtain the third attack detection result, the method further includes: The first attack detection result is updated based on the second risk object information.

5. The method according to claim 4, characterized in that, The first dataset indicates the state of the first detected object within a first time period; The step of updating the first attack detection result based on the second risk object information includes: Input the second risk object information and the first dataset into the first AI application to obtain the third risk object information output by the first AI application; Obtain a third dataset corresponding to the third risk object information, the third dataset including fifth path information corresponding to the third risk object information, the third dataset indicating the state of the first detected object in the second time period; The third risk object information is input into the second AI application to obtain the sixth path information output by the second AI application; In response to the matching of the sixth path information with the fifth path information, the first attack detection result is updated based on the sixth path information and the third risk object information.

6. The method according to claim 1, characterized in that, The method further includes: In response to the received alarm information, the first dataset is obtained based on the alarm information, wherein the alarm information indicates at least one risk object; or, In response to the detection of a request triggered for the first detection object, the first dataset is obtained according to the request, wherein the request does not indicate a risk object.

7. The method according to claim 1, characterized in that, The method satisfies at least one of the following constraints: The process of determining the first path information includes: constructing a graph based on the first dataset; and searching for the first path information corresponding to the first risk object information from the graph. The first dataset is determined based on at least one type of data collected for the first detection object; the at least one type of data includes configuration information of the first detection object, operation data collected from the first detection object, and at least a portion of operation data collected from the gateway corresponding to the first detection object.

8. A network attack detection device, characterized in that, include: The first determining unit is configured to input the first dataset into the first AI application to obtain the first risk object information output by the first AI application; wherein, the first dataset includes first path information corresponding to the first risk object information; The second determining unit is used to input the first risk object information into the second AI application to obtain the second path information output by the second AI application. The third determining unit is used to determine the first attack detection result based on the second path information and the first risk object information in response to the matching of the second path information and the first path information.

9. An electronic device, characterized in that, The device includes: a processor and a memory; The memory is used to store instructions or computer programs; The processor is configured to execute the instructions or computer program in the memory to cause the electronic device to perform the method according to any one of claims 1-7.

10. A computer-readable medium, characterized in that, The computer-readable medium stores instructions or computer programs that, when executed on the device, cause the device to perform the method according to any one of claims 1-7.

11. A computer program product, characterized in that, It includes a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the method of any one of claims 1-7.

Images