Network tentative attack detection method and device, electronic equipment and storage medium

Abstract

The invention discloses a network tentative attack detection method and device, electronic equipment and a storage medium, which are used for solving the problem that network tentative attacks are difficult to effectively detect in the prior art, and the method comprises the following steps: obtaining operation parameter time sequence characteristics of a target system in a current detection time period; embedding the operation parameter time sequence features based on an embedding model to obtain corresponding operation parameter time sequence feature vectors; sliding window operation is conducted on the operation parameter time sequence feature vector according to preset sliding window parameters, a plurality of local feature vectors are obtained, and the preset sliding window parameters comprise the window length and the sliding length; and performing matching based on the plurality of local feature vectors and network tentative attack feature vectors stored in a database, and determining a network tentative attack detection result according to a matching result.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to methods, devices, electronic devices and storage media for detecting network probing attacks. Background Technology

[0002] A probing attack is the initial stage of a cyberattack lifecycle. To successfully obtain the necessary information from the target system, the attacker's goal at this stage is not to directly damage the system or steal data, but rather to covertly gather as much information as possible about the target system, probing its vulnerabilities and the strength of its defenses. Based on these vulnerabilities and defense strength, the attacker can then launch a targeted cyberattack. Probing attacks need to be short-lived, and the methods used to probe the target system's vulnerabilities and defense strength need to be highly covert to ensure the successful acquisition of the necessary information, preparing for subsequent cyberattacks.

[0003] In related technologies, behavioral feature vectors are constructed by obtaining features such as sessions and traffic over a period of time from the target system to be protected. These behavioral feature vectors are then matched with attack feature vectors of network attacks in the database. If the two match successfully, it can be determined that a network attack has occurred on the target system. This is a detection method for network attacks. However, there is no effective detection scheme for network probing attacks.

[0004] Therefore, how to effectively detect network probing attacks in order to prevent subsequent network attacks is one of the technical problems that needs to be solved by existing technologies. Summary of the Invention

[0005] To address the problem of difficulty in effectively detecting network probing attacks in existing technologies, embodiments of this application provide a method, apparatus, electronic device, and storage medium for detecting network probing attacks.

[0006] In a first aspect, embodiments of this application provide a method for detecting network probing attacks, including: Obtain the temporal characteristics of the target system's operating parameters within the current detection time period; The timing features of the running parameters are embedded based on the embedding model to obtain the corresponding timing feature vector of the running parameters. The time-series feature vector of the running parameters is subjected to a sliding window operation according to preset sliding window parameters to obtain multiple local feature vectors. The preset sliding window parameters include window length and sliding length. The network probing attack detection result is determined based on the matching results of the multiple local feature vectors with the network probing attack feature vectors stored in the database.

[0007] Secondly, embodiments of this application provide a network probing attack detection device, comprising: The acquisition module is used to acquire the time-series characteristics of the target system's operating parameters within the current detection time period; The embedding module is used to embed the time-series features of the running parameters based on the embedding model to obtain the corresponding time-series feature vector of the running parameters; A sliding window module is used to perform a sliding window operation on the time-series feature vector of the running parameters according to preset sliding window parameters to obtain multiple local feature vectors. The preset sliding window parameters include window length and sliding length. The detection module is used to match the multiple local feature vectors with network probing attack feature vectors stored in the database, and determine the network probing attack detection result based on the matching result.

[0008] Thirdly, embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the network probing attack detection method described in this application.

[0009] Fourthly, embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the network probing attack detection method described in this application.

[0010] The beneficial effects of this application are as follows: The network probing attack detection method, apparatus, electronic device, and storage medium provided in this application involve: acquiring the time-series features of the target system's operating parameters within the current detection time period; embedding the time-series features of the operating parameters based on an embedding model to obtain corresponding time-series feature vectors of operating parameters; performing a sliding window operation on the time-series feature vectors of operating parameters according to preset sliding window parameters to obtain multiple local feature vectors, the preset sliding window parameters including window length and sliding length; matching the multiple local feature vectors with network probing attack feature vectors stored in a database, and determining the network probing attack detection result based on the matching result. In this embodiment, network probing attack feature vectors are pre-stored in a database. During the current detection time period, the timing features of the target system's operating parameters within the current detection time period are embedded to obtain a timing feature vector of operating parameters. Then, by performing a sliding window operation on the timing feature vector of the target system's operating parameters within the current detection time period, multiple local feature vectors for smaller time periods are obtained. This divides the entire timing feature sequence into multiple overlapping local segments. The local feature vectors are then matched and analyzed one by one with the network probing attack feature vectors already labeled in the database. Therefore, even if the attack duration is very short, this method can capture the attack behavior characteristics within its activity time window, achieving accurate and timely automated detection of short-term, sudden network probing attacks that are difficult to detect using traditional methods. Furthermore, by analyzing the local features of multiple consecutive local windows, the system can determine whether an abnormal signal is continuous or accidental. If an abnormal pattern is detected in multiple consecutive windows, its confidence level is very high. This helps filter out one-off, accidental noise, significantly reducing false alarms and improving the accuracy of network probing attack detection.

[0011] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0012] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 A flowchart illustrating the network probing attack detection method provided in this application embodiment; Figure 2 A schematic diagram of the training process of a network probing attack detection model provided in an embodiment of this application; Figure 3A schematic diagram of the training process for another network probing attack detection model provided in this application embodiment; Figure 4 A flowchart illustrating the process of determining the detection result of a network probing attack, provided for an embodiment of this application; Figure 5 A schematic diagram illustrating another process for determining the detection result of network probing attacks, provided as an embodiment of this application; Figure 6 A flowchart illustrating another network probing attack detection method provided in this application embodiment; Figure 7 A schematic diagram of the training process for another network probing attack detection model provided in this application embodiment; Figure 8 A schematic diagram of the network probing attack detection device provided in the embodiments of this application; Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0013] In related technologies, behavioral feature vectors are constructed by obtaining features such as sessions and traffic over a period of time from the target system to be protected. These behavioral feature vectors are then matched with attack feature vectors of network attacks in the database. If the two match successfully, it can be determined that a network attack has occurred on the target system. This is a detection method for network attacks. However, there is no effective detection scheme for network probing attacks.

[0014] Detecting network attacks requires acquiring a session over a relatively long period (e.g., several hours), while network probing attacks are shorter (e.g., a segment scanning attack lasts only a few minutes) and are highly covert, making their behavior difficult to detect. Compared to existing network attack detection methods, the attack characteristics exhibited by network probing attacks lasting only a few minutes are not frequent. Even if the session time required by existing network attack detection methods is shortened, it is still difficult to detect network probing attacks, thus hindering the prevention of subsequent network attacks.

[0015] Based on this, embodiments of this application provide a method, apparatus, electronic device, and storage medium for detecting network probing attacks, thereby effectively detecting network probing attacks and preventing subsequent network attacks.

[0016] The preferred embodiments of this application are described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit this application. Furthermore, the embodiments and features in the embodiments of this application can be combined with each other without conflict.

[0017] In this application embodiment, the target system to be protected can be any network system, such as the internal network of a company or an external network. The target system can be a distributed system including multiple servers and network devices that provide specified business services, or it can be a single server that provides specified business services. This application embodiment does not limit this.

[0018] The server can be a standalone physical server or a cloud server that provides basic cloud computing services such as cloud servers, cloud databases, and cloud storage. This application does not limit this.

[0019] The following will refer to the appendix. Figures 1-7 The exemplary embodiments of this application are described in more detail below. It should be noted that the above application scenarios are shown only to facilitate understanding of the spirit and principles of this application, and the implementation methods of this application are not limited in any way. On the contrary, the implementation methods of this application can be applied to any applicable scenario.

[0020] like Figure 1 The diagram shown illustrates the implementation flow of the network probing attack detection method provided in this application embodiment. This network probing attack detection method can be applied to the aforementioned target system to be protected, and specifically includes the following steps: S11. Obtain the timing characteristics of the target system's operating parameters within the current detection time period.

[0021] In practical implementation, the detection time period can be preset, such as 1 hour or any other arbitrary duration; this application embodiment does not limit this. Since network probing attacks typically employ low-frequency, dispersed request methods to mimic normal network traffic characteristics, and they acquire key parameters of the target system, including open ports, service versions, vulnerability status, and defense mechanism configurations, the target system's operating parameters in this application can include the following data sources: network traffic data, system and log information, threat intelligence and related data, application layer interaction details, and terminal behavior data.

[0022] Specifically, when collecting the operating parameters of the target system, the following information can be collected from the above data sources: (1) Collect information such as source IP (Internet Protocol), destination IP, source port, destination port, protocol distribution, and traffic pattern from network traffic data. Among them, source IP, destination IP, source port, and destination port are used to analyze abnormal connection requests and identify high-frequency scanning behavior; protocol distribution information is used to monitor the use of unconventional protocols, such as TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) traffic on unconventional ports; traffic pattern is used to detect avoidance strategies such as low-rate and distributed requests.

[0023] (2) Collect open ports and service versions, login failure records, process and file change information from the system and log information. Among them, open ports and service versions are used to identify vulnerable services exposed by scanning records; in login failure records, frequent account and password attempts may expose brute-force attacks; in process and file change information, abnormal process startup or system file modification may be associated with backdoor implantation.

[0024] (3) Collect IP or domain name WHOIS (domain name lookup protocol) information and historical behavior baseline from threat intelligence and related data. Among them, IP or domain name WHOIS information is used to determine whether the source belongs to a known malicious network or high-risk area; historical behavior baseline is a normal traffic pattern, which is used to compare the normal traffic pattern and identify abnormal activities that deviate from the baseline.

[0025] (4) Collect HTTP (Hypertext Transfer Protocol) request headers and parameters, and error response content in the application layer interaction details. The HTTP request headers and parameters are used to capture probing behaviors disguised as legitimate requests, such as unconventional User and Agent. The error response content is used to analyze specific error information returned by the target system (server).

[0026] (5) Collect information such as registry or configuration changes and network connection timing in the terminal behavior data. Among them, registry or configuration changes are used to monitor the privilege escalation or persistence operations after the attacker's attempt; connection timing is used to identify the timing characteristics of low-frequency but regular probe requests.

[0027] In implementation, the target system to be protected can collect multiple sets of operating parameters corresponding to multiple sampling points (i.e., multiple sampling time points) within the current detection time period according to a preset sampling frequency, forming the time-series characteristics of operating parameters. In other words, within the current detection time period, the operating parameters collected at one sampling time point constitute a set of data, which can be used to construct an operating parameter feature. The operating parameter features of adjacent sampling time points are concatenated according to the order of sampling time points from front to back to obtain the time-series characteristics of the target system's operating parameters within the current detection time period. The sampling frequency can be set according to actual needs, and this application embodiment does not limit this. For example, if a set of data is collected at sampling time point A, forming operating parameter feature A; a set of data is collected at sampling time point B, forming operating parameter feature B; and a set of data is collected at sampling time point C, forming operating parameter feature C, and sampling time point A is earlier than sampling time point B, and sampling time point B is earlier than sampling time point C, then operating parameter feature A and operating parameter feature B can be concatenated, and the concatenated feature can be further concatenated with operating parameter feature C to obtain the time-series characteristics of the operating parameters.

[0028] S12. Embed the time-series features of the running parameters based on the embedding model to obtain the corresponding time-series feature vector of the running parameters.

[0029] In specific implementation, the target system inputs the time-series features of the target system's operating parameters within the current detection time period into the embedding model for embedding, and outputs the time-series feature vector of the operating parameters. The embedding model may, but is not limited to, the BGE (BAAI General Embedding) model, and this application embodiment does not limit it.

[0030] In one implementation, the operating parameter features collected at each acquisition time point can be first input into the embedding model for embedding, and the corresponding operating parameter feature vectors collected at the acquisition time point can be output. Then, the operating parameter feature vectors of adjacent acquisition time points can be concatenated in the order of acquisition time points from front to back to obtain the time sequence feature vector of the target system's operating parameters within the current detection time period. This application embodiment does not limit this. For example, a set of data is collected at time point A and constructed as operating parameter feature A; a set of data is collected at time point B and constructed as operating parameter feature B; and a set of data is collected at time point C and constructed as operating parameter feature C. Operating parameter features A, B, and C are then input into an embedding model for embedding, resulting in vector representations of operating parameter features A, B, and C. Since time point A is earlier than time point B, and time point B is earlier than time point C, the vector representations of operating parameter features A and B can be concatenated. The resulting feature vector is then concatenated with the vector representation of operating parameter feature C to obtain the time-series feature vector of the operating parameters.

[0031] S13. Perform a sliding window operation on the time-series feature vector of the running parameters according to the preset sliding window parameters to obtain multiple local feature vectors.

[0032] In one implementation, the target system can perform a sliding window operation on the runtime parameter time-series feature vector according to preset sliding window parameters to obtain multiple local feature vectors. The preset sliding window parameters include a window length and a sliding length. The target system sets the window length and sliding length to small values ​​to ensure that the time range corresponding to the obtained local feature vectors is small. For example, if the runtime of the runtime parameter time-series feature vector (i.e., the current detection time period) is 9:00-10:00, with a duration of 60 minutes, and since the duration of a network probing attack generally does not exceed 1 minute, the window length can be set to be less than 1 / 60 of the runtime parameter time-series feature vector's runtime length, i.e., less than 1 minute, and the sliding length can also be set to be less than 1 / 60 of the runtime parameter time-series feature vector's runtime length.

[0033] To improve detection accuracy, the target system uses a sliding window to perform a sliding window operation on the time-series feature vector of the operating parameters, resulting in multiple local feature vectors with overlapping portions between adjacent local feature vectors. For example, if the sliding window is set to 6 seconds and the sliding length is 3 seconds, then the position [1, 7] seconds in the time-series feature vector of the operating parameters is the first local feature vector obtained by the sliding window, and the position [4, 10] seconds in the time-series feature vector of the operating parameters is the second local feature vector obtained by the sliding window. The overlapping portion of the first and second local feature vectors is the feature vector portion at [4, 7] seconds.

[0034] In another implementation, a trained network probing attack detection model can be used to perform a sliding window operation on the time-series feature vector of the operating parameters according to preset sliding window parameters.

[0035] In practice, the time-series feature vector of the running parameters is input into the network probing attack detection model. The network probing attack detection model then performs a sliding window operation on the time-series feature vector of the running parameters according to preset sliding window parameters to obtain multiple local feature vectors.

[0036] like Figure 2 The diagram shown illustrates the training process of a network probing attack detection model provided in this application embodiment, including the following steps: S21. Obtain the training sample set, which includes the time series characteristics of the target system's sample operating parameters during the sample time period when the target system is subjected to a network probing attack, and the time series characteristics of the target system's sample operating parameters during the sample time period when the target system is not subjected to a network probing attack.

[0037] In practice, network probing attacks can be detected on the target system through manual testing. When a network probing attack is detected, the time period during which the network probing attack occurred is taken as a sample time period. The time-series characteristics of the target system's operating parameters within this sample time period are obtained to construct a positive sample. For example, if a network probing attack occurred between 9:00 and 9:01 (1 second) on a historical day, the operating parameter data of the target system during the time period from 8:50 to 9:20 (taking data from half an hour before and after) can be obtained. The operating parameter data from 8:50 to 9:20 is used to construct a sample operating parameter time-series characteristic as a positive sample. The construction method is the same as the method of constructing the operating parameter time-series characteristics of the target system within the current detection time period in step S11, and will not be elaborated here. The time-series characteristics of the target system's operating parameters during the sample time period when no network probing attack occurred in the test system are used as negative samples. A training sample set is obtained based on the positive and negative samples. Then, the training sample set can be sent to the target system through the client for model training, or the model training can be performed on the training platform. The training platform then deploys the trained network probing attack detection model on the target system. This application does not limit this, and this application only uses the example of the target system performing model training for illustration.

[0038] S22. For each sample's runtime parameter time-series features, embed the sample's runtime parameter time-series features based on the embedding model to obtain the corresponding sample runtime parameter time-series feature vector.

[0039] In practice, for each sample's runtime parameter time-series features, the sample's runtime parameter time-series features are input into the embedding model for embedding, resulting in a sample runtime parameter time-series feature vector.

[0040] S23. Label the network probing attack feature vector in the time-series feature vector of the sample running parameters corresponding to the positive sample to obtain the label of the network probing attack feature vector.

[0041] Continuing with the previous example, after obtaining the vector representation of the sample's runtime parameter time-series features from the runtime parameter data between 8:50 and 9:20, the sample local feature vector corresponding to 9:00 to 9:01 in the runtime parameter time-series feature vector is labeled as the network probing attack feature vector, thus obtaining the label of this segment of network probing attack feature vector.

[0042] S24. For the time-series feature vector of the sample running parameters corresponding to the negative sample, randomly select a local feature vector of the sample and label it to obtain the label of the non-network probing attack feature vector.

[0043] In practice, for the time-series feature vector of the sample running parameters corresponding to the negative sample, a local feature vector of the sample with a corresponding duration (such as 1 second) can be randomly selected and labeled as a non-network probing attack feature vector to obtain the label of the non-network probing attack feature vector.

[0044] S25. Input the temporal feature vector of the sample running parameters into the model to be trained, so that the model to be trained can perform a sliding window operation on the temporal feature vector of the sample running parameters according to the preset sliding window parameters to obtain multiple sample local feature vectors.

[0045] In practice, for each sample's runtime parameter temporal feature vector, the target system inputs this vector into the model to be trained. The model then performs a sliding window operation on the sample's runtime parameter temporal feature vector according to preset sliding window parameters, obtaining multiple local feature vectors. Thus, multiple local feature vectors corresponding to each sample's runtime parameter temporal feature vector can be obtained.

[0046] In this embodiment, the model to be trained may be, but is not limited to, a machine learning model or a convolutional neural network model. The model can be selected according to actual needs, and this embodiment does not limit it.

[0047] S26. Based on the labels of local feature vectors of multiple samples, network probing attack feature vectors, and non-network probing attack feature vectors, iteratively train the model to be trained until the model converges, and obtain the trained network probing attack detection model.

[0048] In practice, the training model is iteratively trained based on multiple local feature vectors corresponding to the time-series feature vectors of each sample's running parameters, the labels of network probing attack feature vectors, and the labels of non-network probing attack feature vectors. The parameters of the training model are adjusted until the model converges, resulting in the trained network probing attack detection model.

[0049] In another implementation, to improve the model's accuracy, a combination of unlabeled and labeled methods can be used to train the network probing attack detection model, such as... Figure 3 The diagram shown illustrates the training process of another network probing attack detection model provided in this application embodiment, including the following steps: S31. Obtain the training sample set, which includes the time series characteristics of the target system's sample operating parameters during the sample time period when the target system is subjected to a network probing attack, and the time series characteristics of the target system's sample operating parameters during the sample time period when the target system is not subjected to a network probing attack.

[0050] S32. For each sample's runtime parameter time-series features, embed the sample's runtime parameter time-series features based on the embedding model to obtain the corresponding sample runtime parameter time-series feature vector.

[0051] S33. Label the network probing attack feature vector in the time-series feature vector of the sample running parameters corresponding to the positive sample to obtain the label of the network probing attack feature vector.

[0052] S34. For the time-series feature vector of the sample running parameters corresponding to the negative sample, randomly select a segment of the sample local feature vector for labeling to obtain the label of the non-network probing attack feature vector.

[0053] S35. Input the temporal feature vector of the sample running parameters into the model to be trained, so that the model to be trained can perform a sliding window operation on the temporal feature vector of the sample running parameters according to the preset sliding window parameters to obtain multiple sample local feature vectors.

[0054] The implementation of steps S31 to S35 can be found in the implementation of steps S21 to S25, and will not be repeated here.

[0055] S36. Iteratively train the model to be trained based on the local feature vectors of multiple samples to obtain the pre-trained model.

[0056] In practice, the model to be trained is iteratively trained based on the local feature vectors of multiple samples corresponding to the time-series feature vectors of the running parameters of each sample. This allows the model to learn the parameters required to detect network probing attacks, so as to adjust the model parameters until the model converges and a pre-trained model is obtained.

[0057] In this step, the model to be trained is trained using unlabeled sample data to obtain a pre-trained model.

[0058] S37. Based on multiple local feature vectors, labels of network probing attack feature vectors, and labels of non-network probing attack feature vectors, the pre-trained model is iteratively trained until the model converges, resulting in the trained network probing attack detection model.

[0059] In practice, to further improve the model accuracy, the pre-trained model is further iteratively trained based on multiple local feature vectors corresponding to the time-series feature vectors of each sample's running parameters, the labels of network probing attack feature vectors, and the labels of non-network probing attack feature vectors. The parameters of the pre-trained model are adjusted until the model converges, resulting in the trained network probing attack detection model.

[0060] In the above implementation, the hybrid training method using unlabeled and labeled data is an efficient pre-training mechanism. It utilizes a large amount of readily available unlabeled data to learn common normal and abnormal behavior patterns through pre-training. The model operates on a large number of unlabeled sample parameter time-series feature vectors, and through a sliding window operation, it learns to reconstruct or understand the inherent structure and patterns of time-series data. By using local feature vectors of samples, the model is forced to focus on micro-behavioral patterns within short time windows, rather than relying solely on macro-statistical characteristics over the entire time period. In this process, the model naturally learns what time-series patterns and statistical regularities normal traffic typically exhibits, and how abnormal fluctuations (potentially caused by attacks) disrupt these regularities. Furthermore, a small amount of precisely labeled data (especially local features of attacks) teaches the model what the key anomalies are, thereby training a highly sensitive and robust specialized detection model for brief, covert network probing attacks at a relatively low cost.

[0061] S14. Match multiple local feature vectors with network probing attack feature vectors stored in the database, and determine the network probing attack detection result based on the matching result.

[0062] In one implementation, when the target system directly performs a sliding window operation on the time-series feature vectors of the target system's operating parameters within the current detection time period to obtain multiple local feature vectors, it can be done according to the following... Figure 4 The process shown determines the results of network probing attack detection, including the following steps: S41. For each local feature vector, the target system obtains the similarity between the local feature vector and each network probing attack feature vector in the database.

[0063] During implementation, the target system can be tested in advance by manual testing to detect network probing attacks. When a network probing attack is detected in the test system, the attack characteristic parameters of the network probing attack are obtained, that is, the operating parameters of the target system during the period when the network probing attack occurred. A network probing attack feature vector is constructed using each attack characteristic parameter and stored in a database. There can be multiple systems to be protected, so the attack characteristic parameters of each system that has experienced a network probing attack can be obtained, and a network probing attack feature vector can be constructed. In other words, multiple network probing attack feature vectors are stored in the database.

[0064] In this step, the target system calculates the similarity between each local feature vector and each network probing attack feature vector in the database. When calculating the similarity between the local feature vector and the network probing attack feature vector, the cosine similarity or Euclidean distance between the two can be calculated. This application embodiment does not limit this.

[0065] S42. If the maximum similarity is determined to be greater than the similarity threshold, then the local feature vector is determined to match the corresponding first network exploratory attack feature vector.

[0066] In specific implementation, for the local feature vector, if the local feature vector has the highest similarity to the first network probing attack feature vector in the database, and the maximum similarity is greater than the similarity threshold, then the target system can determine that the local feature vector matches the first network probing attack feature vector. The similarity threshold can be set according to actual needs, such as a value in the range of [60%, 1). This application embodiment does not limit this.

[0067] S43. If multiple consecutive local feature vectors after determining the local feature vector match the first network probing attack feature vector, then it is determined that the target system has been subjected to a network probing attack.

[0068] In practice, if the target system determines that multiple consecutive local feature vectors following the local feature vector match the first network probing attack feature vector, then it can be determined that the local feature vector and multiple consecutive local feature vectors following the local feature vector are the same network probing attack vector, and the target system has suffered a network probing attack.

[0069] In another implementation, when a network probing attack detection model is used to perform a sliding window operation on the time-series feature vectors of the target system's operating parameters within the current detection time period to obtain multiple local feature vectors, the obtained network probing attack detection model can be used to match the multiple local feature vectors with the network probing attack feature vectors stored in the database, and the network probing attack detection result can be determined based on the matching result.

[0070] In specific implementation, it can be done according to the following: Figure 5 The process shown determines the results of network probing attack detection, including the following steps: S51. For each local feature vector, the network probing attack detection model is used to determine the similarity between the local feature vector and each network probing attack feature vector in the database.

[0071] In practice, the target system inputs the time-series feature vector of the target system's operating parameters within the current detection time period into the network probing attack detection model. The network probing attack detection model performs a sliding window operation on the time-series feature vector of the operating parameters according to preset sliding window parameters to obtain multiple local feature vectors. For each local feature vector, the network probing attack detection model calculates the similarity between the local feature vector and each network probing attack feature vector in the database.

[0072] S52. If the maximum similarity is determined to be greater than the similarity threshold, then the local feature vector is determined to match the corresponding second network exploratory attack feature vector.

[0073] In practice, if the network probing attack detection model determines that the local feature vector has the highest similarity to the second network probing attack feature vector in the database, and the maximum similarity is greater than the similarity threshold, then the network probing attack detection model can determine that the local feature vector matches the second network probing attack feature vector.

[0074] S53. If multiple consecutive local feature vectors after determining the local feature vector match the second network probing attack feature vector, then it is determined that the target system has been subjected to a network probing attack.

[0075] In practice, if multiple consecutive local feature vectors following the local feature vector in the network probing attack detection model match the second network probing attack feature vector, then it can be determined that the local feature vector and the multiple consecutive local feature vectors following it are the same network probing attack vector, and the target system has been subjected to a network probing attack.

[0076] In one implementation, after determining the network probing attack detection result based on the network probing attack detection model, the method further includes: The target system returns the detection results of network probing attacks to the client; if it determines that it has received the detection result update request sent by the client, the detection result update request carries the local feature vector of the misjudged attack; the misjudged local feature vector is marked as a non-network probing attack feature vector and stored in the database.

[0077] In practice, the target system returns the detection results of network probing attacks to the client for display. A human judges the accuracy of the local feature vectors identified as network probing attack feature vectors. If a local feature vector is a misclassified local feature vector (i.e., not a genuine network probing attack feature vector), the client sends this misclassified local feature vector to the target system in a detection result update request. Upon receiving the update request, the target system extracts the misclassified local feature vector from the request, marks it as a non-network attack feature vector, and stores it in the database. This way, if a local feature vector subsequently matches this non-network attack feature vector in the database, it can be directly determined that the local feature vector is not a network probing attack feature vector, thereby improving the accuracy of the model in detecting network probing attacks.

[0078] In another implementation, network probing attack detection can be performed by combining the target system with a network probing attack detection model, the implementation process of which is as follows: Figure 6 As shown, the following steps may be included: S61. The target system obtains the timing characteristics of the target system's operating parameters within the current detection time period.

[0079] S62. The target system embeds the time-series features of the operating parameters based on the embedding model to obtain the corresponding time-series feature vector of the operating parameters.

[0080] S63. Based on the network probing attack detection model, identify candidate local feature vectors in the time-series feature vector of runtime parameters.

[0081] Among them, the candidate local feature vectors are the local feature vectors that are initially judged by the network probing attack detection model to be network probing attack feature vectors.

[0082] In practice, the target system inputs the time-series feature vector of the target system's operating parameters within the current detection time period into the network probing attack detection model. The network probing attack detection model then identifies the network probing attack feature vector in the time-series feature vector of the operating parameters, which can be denoted as: candidate local feature vector.

[0083] In this implementation, the training method for the network probing attack detection model is as follows: Figure 7 As shown, it includes the following steps: S71. Obtain the training sample set, which includes the time series characteristics of the target system's sample operating parameters during the sample time period when the target system is subjected to a network probing attack, and the time series characteristics of the target system's sample operating parameters during the sample time period when the target system is not subjected to a network probing attack.

[0084] S72. For each sample's runtime parameter time-series features, embed the sample's runtime parameter time-series features based on the embedding model to obtain the corresponding sample runtime parameter time-series feature vector.

[0085] S73. Label the network probing attack feature vector in the time-series feature vector of the sample running parameters corresponding to the positive sample to obtain the label of the network probing attack feature vector.

[0086] S74. For the time-series feature vector of the sample running parameters corresponding to the negative sample, randomly select a segment of the sample local feature vector for labeling to obtain the label of the non-network probing attack feature vector.

[0087] The implementation of steps S71 to S74 can be found in the implementation of steps S21 to S25, and will not be repeated here.

[0088] S75. Based on the sample running parameter time-series feature vector, the label of the network probing attack feature vector, and the label of the non-network probing attack feature vector, the model to be trained is iteratively trained until the model converges, and the trained network probing attack detection model is obtained.

[0089] Compared to Figure 2 The training method of the network probing attack detection model shown in the figure does not require sliding window operation on the temporal feature vector of sample running parameters during the training process. Instead, the temporal feature vector of sample running parameters is directly input into the model to be trained. Based on the labels of network probing attack feature vectors and non-network probing attack feature vectors, the model learns to identify network probing attack feature vectors in the temporal feature vector of sample running parameters. The parameters of the model to be trained are adjusted until the model converges, and the trained network probing attack detection model is obtained.

[0090] S64. The target system performs a sliding window operation on the candidate local feature vectors according to the preset sliding window parameters to obtain multiple local feature vectors.

[0091] In this step, after the network probing attack detection model outputs the identified candidate local feature vectors, the target system performs a sliding window operation on the candidate local feature vectors according to preset sliding window parameters to obtain multiple local feature vectors.

[0092] S65. The target system matches multiple local feature vectors with network probing attack feature vectors stored in the database, and determines the network probing attack detection result based on the matching result.

[0093] The implementation of this step can refer to the implementation of the matching process executed by the target system in steps S41 to S43, which will not be elaborated here.

[0094] The network probing attack detection method provided in this application involves: acquiring the time-series features of the target system's operating parameters within the current detection time period; embedding the time-series features of the operating parameters based on an embedding model to obtain corresponding time-series feature vectors of operating parameters; performing a sliding window operation on the time-series feature vectors of operating parameters according to preset sliding window parameters to obtain multiple local feature vectors, the preset sliding window parameters including window length and sliding length; matching the multiple local feature vectors with network probing attack feature vectors stored in the database, and determining the network probing attack detection result based on the matching result. In this embodiment, network probing attack feature vectors are pre-stored in a database. During the current detection time period, the timing features of the target system's operating parameters within the current detection time period are embedded to obtain a timing feature vector of operating parameters. Then, by performing a sliding window operation on the timing feature vector of the target system's operating parameters within the current detection time period, multiple local feature vectors for smaller time periods are obtained. This divides the entire timing feature sequence into multiple overlapping local segments. The local feature vectors are then matched and analyzed one by one with the network probing attack feature vectors already labeled in the database. Therefore, even if the attack duration is very short, this method can capture the attack behavior characteristics within its activity time window, achieving accurate and timely automated detection of short-term, sudden network probing attacks that are difficult to detect using traditional methods. Furthermore, by analyzing the local features of multiple consecutive local windows, the system can determine whether an abnormal signal is continuous or accidental. If an abnormal pattern is detected in multiple consecutive windows, its confidence level is very high. This helps filter out one-off, accidental noise, significantly reducing false alarms and improving the accuracy of network probing attack detection.

[0095] Based on the same inventive concept, this application also provides a network probing attack detection device. Since the principle of the network probing attack detection device in solving the problem is similar to that of the network probing attack detection method, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0096] like Figure 8 As shown, this is a schematic diagram of the structure of a network probing attack detection device provided in an embodiment of this application, which may include: The acquisition module 81 is used to acquire the time-series characteristics of the operating parameters of the target system within the current detection time period; Embedding module 82 is used to embed the time-series features of the running parameters based on the embedding model to obtain the corresponding time-series feature vector of the running parameters; The sliding window module 83 is used to perform a sliding window operation on the time-series feature vector of the running parameters according to preset sliding window parameters to obtain multiple local feature vectors. The preset sliding window parameters include window length and sliding length. The detection module 84 is used to match the multiple local feature vectors with the network probing attack feature vectors stored in the database, and determine the network probing attack detection result based on the matching result.

[0097] In one implementation, the detection module 84 is specifically configured to, for each local feature vector, obtain the similarity between the local feature vector and each network probing attack feature vector in the database; if the maximum similarity is determined to be greater than the similarity threshold, then the local feature vector is determined to match the corresponding first network probing attack feature vector; if multiple consecutive local feature vectors after the local feature vector are determined to match the first network probing attack feature vector, then the target system is determined to have suffered a network probing attack.

[0098] In one embodiment, the detection module 84 is specifically used to match the multiple local feature vectors with network probing attack feature vectors stored in the database using the acquired network probing attack detection model, and determine the network probing attack detection result based on the matching result.

[0099] In one embodiment, the sliding window module 83 is specifically used to input the time-series feature vector of the running parameters into the network probing attack detection model, and use the network probing attack detection model to perform a sliding window operation on the time-series feature vector of the running parameters according to preset sliding window parameters to obtain the plurality of local feature vectors.

[0100] In one implementation, the detection module 84 is specifically used to determine the similarity between each local feature vector and each network probing attack feature vector in the database using the network probing attack detection model; if the maximum similarity is greater than a similarity threshold, then the local feature vector is determined to match the corresponding second network probing attack feature vector; if multiple consecutive local feature vectors after the local feature vector are determined to match the second network probing attack feature vector, then the target system is determined to have suffered a network probing attack.

[0101] In one implementation, the detection module 84 is specifically used to train the network probing attack detection model in the following manner: acquiring a training sample set, the training sample set including the time-series features of the target system's sample operating parameters within the sample time period when the target system suffers a network probing attack; embedding the time-series features of the sample operating parameters based on the embedding model for each sample operating parameter time-series feature to obtain a corresponding sample operating parameter time-series feature vector; and labeling the network probing attack feature vector in the sample operating parameter time-series feature vector corresponding to the positive sample to obtain the label of the network probing attack feature vector; and labeling the negative sample... The corresponding sample runtime parameter temporal feature vector is used to randomly select a segment of sample local feature vectors for labeling, thereby obtaining the label of the non-network probing attack feature vector. The sample runtime parameter temporal feature vector is input into the model to be trained, and the model to be trained performs a sliding window operation on the sample runtime parameter temporal feature vector according to the preset sliding window parameters to obtain multiple sample local feature vectors. Based on the multiple sample local feature vectors, the label of the network probing attack feature vector, and the label of the non-network probing attack feature vector, the model to be trained is iteratively trained until the model converges, thereby obtaining the trained network probing attack detection model.

[0102] In one implementation, the detection module 84 is specifically used to train the network probing attack detection model in the following manner: acquiring a training sample set, the training sample set including the time-series features of the target system's sample operating parameters within the sample time period when the target system suffers a network probing attack; embedding the time-series features of the sample operating parameters based on the embedding model for each sample operating parameter time-series feature to obtain a corresponding sample operating parameter time-series feature vector; labeling the network probing attack feature vector in the sample operating parameter time-series feature vector corresponding to positive samples to obtain the label of the network probing attack feature vector; and randomly assigning labels to the sample operating parameter time-series feature vector corresponding to negative samples. A segment of local feature vectors is selected and labeled to obtain labels for non-network probing attack feature vectors. The temporal feature vectors of the sample execution parameters are input into the model to be trained, and the model to be trained performs a sliding window operation on the temporal feature vectors of the sample execution parameters according to the preset sliding window parameters to obtain multiple sample local feature vectors. The model to be trained is iteratively trained based on the multiple sample local feature vectors to obtain a pre-trained model. The pre-trained model is iteratively trained based on the multiple local feature vectors, the labels of the network probing attack feature vectors, and the labels of the non-network probing attack feature vectors until the model converges to obtain the trained network probing attack detection model.

[0103] In one embodiment, the device further includes: The return module is used to return the network probing attack detection result to the client after determining the network probing attack detection result; The marking module is used to mark the misjudged local feature vector as a non-network probing attack feature vector and store it in the database if it determines that a detection result update request sent by the client has been received and the detection result update request carries a misjudged local feature vector.

[0104] In one embodiment, the sliding window module 83 is specifically used to identify candidate local feature vectors in the time-series feature vector of the operating parameters based on the network probing attack detection model. The candidate local feature vectors are local feature vectors that are initially judged by the network probing attack detection model to be network probing attack feature vectors. The sliding window operation is performed on the candidate local feature vectors according to the preset sliding window parameters to obtain multiple local feature vectors.

[0105] Based on the same technical concept, this application also provides an electronic device 900, referring to... Figure 9 As shown, the electronic device 900 is used to implement the network probing attack detection method described in the above-described method embodiments. The electronic device 900 in this embodiment may include: a memory 901, a processor 902, and a computer program stored in the memory and executable on the processor, such as a network probing attack detection program. When the processor executes the computer program, it implements the steps in the various network probing attack detection method embodiments described above.

[0106] This application embodiment does not limit the specific connection medium between the memory 901 and the processor 902. This application embodiment... Figure 9 The memory 901 and processor 902 are connected via a bus 903, and the bus 903 is in Figure 9 The connections between other components are shown in bold lines only and are not intended to be limiting. The bus 903 can be divided into address bus, data bus, control bus, etc. For ease of illustration, Figure 9 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0107] Memory 901 may be volatile memory, such as random-access memory (RAM); memory 901 may also be non-volatile memory, such as read-only memory, flash memory, hard disk drive (HDD), or solid-state drive (SSD); or memory 901 may be any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto. Memory 901 may be a combination of the above-mentioned memories.

[0108] The processor 902 is used to implement the network probing attack detection method provided in the embodiments of this application.

[0109] This application also provides a computer-readable storage medium storing computer-executable instructions required to execute the processor, including a program required to execute the processor.

[0110] In some possible implementations, various aspects of the network probing attack detection method provided in this application can also be implemented as a program product comprising program code that, when the program product is run on an electronic device, causes the electronic device to perform the steps in the network probing attack detection method according to various exemplary embodiments of this application described above.

[0111] Those skilled in the art will understand that embodiments of this application can be provided as methods, apparatus, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0112] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (devices), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the process. Figure 1One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0113] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0114] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0115] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0116] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A network probing attack detection method, characterized by, The method comprises the following steps: obtaining the running parameter time sequence characteristics of the target system in the current detection time period; embedding the running parameter time sequence characteristics based on an embedding model to obtain corresponding running parameter time sequence characteristic vectors; performing a sliding window operation on the running parameter time sequence characteristic vectors according to preset sliding window parameters to obtain a plurality of local feature vectors, wherein the preset sliding window parameters include window length and sliding length; matching the plurality of local feature vectors with network trial attack feature vectors stored in a database, and determining a network trial attack detection result according to the matching result.

2. The method of claim 1, wherein, The method of matching the plurality of local feature vectors with network trial attack feature vectors stored in a database, and determining a network trial attack detection result according to the matching result, specifically comprises: for each local feature vector, respectively obtaining the similarity between the local feature vector and each network trial attack feature vector in the database; if it is determined that the maximum similarity is greater than a similarity threshold, it is determined that the local feature vector matches the corresponding first network trial attack feature vector; if it is determined that a plurality of continuous local feature vectors after the local feature vector match the first network trial attack feature vector, it is determined that the target system is subjected to a network trial attack.

3. The method of claim 1, wherein, The method of matching the plurality of local feature vectors with network trial attack feature vectors stored in a database, and determining a network trial attack detection result according to the matching result, specifically comprises: using the obtained network trial attack detection model to match the plurality of local feature vectors with network trial attack feature vectors stored in a database, and determining a network trial attack detection result according to the matching result.

4. The method of claim 1, wherein, The method of performing a sliding window operation on the running parameter time sequence characteristic vectors according to preset sliding window parameters to obtain a plurality of local feature vectors, specifically comprises: inputting the running parameter time sequence characteristic vectors into the network trial attack detection model, and using the network trial attack detection model to perform a sliding window operation on the running parameter time sequence characteristic vectors according to preset sliding window parameters to obtain the plurality of local feature vectors.

5. The method of claim 3 or 4, wherein, The method of determining a network trial attack detection result based on the plurality of local feature vectors, a network trial attack detection model, and network trial attack feature vectors stored in a database, specifically comprises: for each local feature vector, using the network trial attack detection model to respectively determine the similarity between the local feature vector and each network trial attack feature vector in the database; if it is determined that the maximum similarity is greater than a similarity threshold, it is determined that the local feature vector matches the corresponding second network trial attack feature vector; if it is determined that a plurality of continuous local feature vectors after the local feature vector match the second network trial attack feature vector, it is determined that the target system is subjected to a network trial attack.

6. The method of claim 3, wherein, The network trial attack detection model is obtained by the following method: obtaining a training sample set, wherein the training sample set includes sample running parameter time sequence characteristics of the target system in a sample time period when the target system is subjected to a network trial attack; embedding the sample running parameter time sequence feature based on the embedding model, to obtain a corresponding sample running parameter time sequence feature vector; and performing label annotation on the network exploratory attack feature vector in the sample running parameter time sequence feature vector corresponding to the positive sample, to obtain a label of the network exploratory attack feature vector; performing label annotation on a local feature vector in the sample running parameter time sequence feature vector corresponding to the negative sample, to obtain a label of the non-network exploratory attack feature vector; inputting the sample running parameter time sequence feature vector into a to-be-trained model, to perform a sliding window operation on the sample running parameter time sequence feature vector according to the preset sliding window parameter by the to-be-trained model, to obtain a plurality of sample local feature vectors; iteratively training the to-be-trained model based on the plurality of sample local feature vectors, the label of the network exploratory attack feature vector, and the label of the non-network exploratory attack feature vector, until the model converges, to obtain the trained network exploratory attack detection model.

7. The method of claim 3, wherein, The network exploratory attack detection model is trained in the following manner: obtaining a training sample set, the training sample set including sample running parameter time sequence features of the target system in a sample time period when the target system is subjected to a network exploratory attack; embedding the sample running parameter time sequence feature based on the embedding model, to obtain a corresponding sample running parameter time sequence feature vector; and performing label annotation on the network exploratory attack feature vector in the sample running parameter time sequence feature vector corresponding to the positive sample, to obtain a label of the network exploratory attack feature vector; performing label annotation on a local feature vector in the sample running parameter time sequence feature vector corresponding to the negative sample, to obtain a label of the non-network exploratory attack feature vector; inputting the sample running parameter time sequence feature vector into a to-be-trained model, to perform a sliding window operation on the sample running parameter time sequence feature vector according to the preset sliding window parameter by the to-be-trained model, to obtain a plurality of sample local feature vectors; iteratively training the to-be-trained model based on the plurality of sample local feature vectors, the label of the network exploratory attack feature vector, and the label of the non-network exploratory attack feature vector, until the model converges, to obtain the trained network exploratory attack detection model. After determining the network exploratory attack detection result, further comprising:

8. The method of claim 5, wherein, returning the network exploratory attack detection result to the client; if it is determined that a detection result update request sent by the client is received, the detection result update request carrying a misjudged local feature vector, marking the misjudged local feature vector as a non-network exploratory attack feature vector and storing it to the database. performing a sliding window operation on the running parameter time sequence feature vector according to a preset sliding window parameter, to obtain a plurality of local feature vectors, specifically comprising:

9. The method of claim 1 or 2, wherein, ​ Based on the network trial attack detection model, a candidate local feature vector in the running parameter time sequence feature vector is identified, the candidate local feature vector being a local feature vector preliminarily judged as a network trial attack feature vector by the network trial attack detection model; The candidate local feature vector is subjected to a sliding window operation according to the preset sliding window parameter, to obtain a plurality of local feature vectors.

10. A network probing attack detection apparatus characterized by comprising: Comprise: An acquisition module is configured to acquire a running parameter time sequence feature of a target system in a current detection time period; An embedding module is configured to embed the running parameter time sequence feature based on an embedding model to obtain a corresponding running parameter time sequence feature vector; A sliding window module is configured to perform a sliding window operation on the running parameter time sequence feature vector according to a preset sliding window parameter to obtain a plurality of local feature vectors, the preset sliding window parameter comprising a window length and a sliding length; A detection module is configured to match the plurality of local feature vectors with network trial attack feature vectors stored in a database, and determine a network trial attack detection result according to a matching result.

11. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the program to implement the network trial attack detection method of any one of claims 1-9.

12. A computer readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the steps in the network trial attack detection method of any one of claims 1-9.

Images