Network attack tracing method and device, electronic equipment and computer program product

Abstract

The invention discloses a network attack tracing method and device, electronic equipment and a computer program product. The method relates to the field of information security, and comprises the following steps: collecting related data of an attacked target network node, and extracting network attack traceability features from the related data; n candidate areas to which the attack source belongs are determined based on the IP address in the network attack traceability feature, and an attack path model is constructed based on the network attack traceability feature, where N is a positive integer; performing source tracing analysis on the attack source through the attack path model, and determining a target area from the N candidate areas based on a source tracing analysis result; and determining a network attack traceability result based on the target area and the traceability analysis result. Through the method and the device, the problem of insufficient network attack tracing accuracy in related technologies is solved.

Description

Technical Field

[0001] This application relates to the field of information security, and more specifically, to a method, apparatus, electronic device, and computer program product for tracing the source of network attacks. Background Technology

[0002] With the rapid advancement of internet technology, the frequency and complexity of cyberattacks have increased significantly. Hacker groups and individuals utilize advanced techniques, including zero-day exploits, social engineering, and illegal software distribution, to launch precise and covert attacks on network systems, seriously challenging personal privacy, corporate data security, and even the stability of critical national infrastructure.

[0003] Network attack attribution techniques face multiple challenges. First, accuracy becomes a significant issue. Many techniques, when dealing with attacks in complex network environments, rely too heavily on a single source of information, making them less effective at pinpointing attackers when they utilize evasion techniques such as IP spoofing and proxy servers. Second, the tracking range is limited. Most techniques are confined to local networks or specific geographical areas, making it difficult to trace the origins of transnational cyberattacks. Third, analysis speed becomes a bottleneck. Faced with massive datasets and dense network events, reconstructing attack paths requires considerable time, crucial for timely response and damage mitigation, but this lack of speed undoubtedly increases the difficulty of protection.

[0004] There is currently no effective solution to the problem of insufficient accuracy in tracing the origins of network attacks in related technologies. Summary of the Invention

[0005] The main objective of this application is to provide a method, apparatus, electronic device, and computer program product for tracing network attacks, in order to solve the problem of insufficient accuracy in tracing network attacks in related technologies.

[0006] To achieve the above objectives, according to one aspect of this application, a method for tracing network attacks is provided. The method includes: collecting relevant data of the target network node under attack; extracting network attack tracing features from the relevant data; determining N candidate regions to which the attack source belongs based on the IP address in the network attack tracing features; constructing an attack path model based on the network attack tracing features, where N is a positive integer; performing tracing analysis on the attack source using the attack path model; determining the target region from the N candidate regions based on the tracing analysis results; and determining the network attack tracing result based on the target region and the tracing analysis results.

[0007] Optionally, extracting network attack tracing features from relevant data includes: if the relevant data contains network data packets, determining the flow pattern of network data packets and the field characteristics of communication protocols as candidate features; if the relevant data contains system logs, determining abnormal login events and file tampering records in the system logs as candidate features; if the relevant data contains network device configuration information, determining the configuration change characteristics of the network device configuration information as candidate features; inputting at least one candidate feature into the target model to obtain network attack tracing features, wherein the target model is used to filter features associated with network attack tracing from the candidate features.

[0008] Optionally, constructing an attack path model based on network attack attribution features includes: extracting data packet flow characteristics and timestamps from the network attack attribution features; obtaining the network topology to which the target network node belongs; constructing a communication graph based on the network topology, data packet flow characteristics, and timestamps, wherein the communication graph includes multiple nodes and edges, each node is used to represent network devices in the network topology, each edge is used to represent data packet flow characteristics, and the attribute information of the edge includes the timestamp corresponding to the data packet flow characteristics; searching for multiple attack paths from the communication graph using a path search algorithm; and constructing an attack path model based on the multiple attack paths.

[0009] Optionally, constructing an attack path model based on multiple attack paths includes: for each attack path, determining whether the attack path matches the attack time of the network attack event based on the timestamp information on the attack path; if the attack path matches the attack time, determining the attack path as a path in the attack path model; if the attack path does not match the attack time, eliminating the attack path.

[0010] Optionally, the attack source is traced and analyzed using the attack path model. Based on the traced and analyzed results, the target region is determined from N candidate regions, including: tracing the propagation path of the attack source backward from the damaged node in the attack path model using the shortest path algorithm; determining whether there is abnormal behavior in the system logs of each node on the propagation path, and determining whether there are abnormal changes in the device configuration information of each node; if there is abnormal behavior in the system logs of a node or abnormal changes in the device configuration information, determining the region to which the node belongs; if the region to which the node belongs is a candidate region, determining the region to which the node belongs as the target region.

[0011] Optionally, determining the N candidate regions to which the attack source belongs based on the IP address in the network attack tracing features includes: extracting the target IP address related to the network attack from the network attack tracing features; for each target IP address, retrieving the geographical location information of the target IP address from the preset IP address database, and determining the region to which the target IP address belongs based on the geographical location information; and determining the region to which each target IP address belongs as a candidate region.

[0012] Optionally, collecting relevant data from the attacked target network node includes: deploying data collection probes on the target network node and collecting relevant data at preset intervals using the data collection probes.

[0013] To achieve the above objectives, according to another aspect of this application, a network attack tracing device is provided. The device includes: a collection unit for collecting relevant data of a target network node under attack and extracting network attack tracing features from the relevant data; a construction unit for determining N candidate regions to which the attack source belongs based on the IP address in the network attack tracing features, and constructing an attack path model based on the network attack tracing features, where N is a positive integer; a tracing unit for performing tracing analysis on the attack source through the attack path model, and determining the target region from the N candidate regions based on the tracing analysis results; and a determination unit for determining the network attack tracing result based on the target region and the tracing analysis results.

[0014] In this embodiment, relevant data of the target network node under attack is collected, and network attack tracing features are extracted from the relevant data. Based on the IP address in the network attack tracing features, N candidate regions to which the attack source belongs are determined, and an attack path model is constructed based on the network attack tracing features, where N is a positive integer. The attack source is traced and analyzed through the attack path model, and the target region is determined from the N candidate regions based on the traced analysis results. The network attack tracing result is determined based on the target region and the traced analysis results. Through multi-level data collection, feature extraction, and attack path model construction, the source of the network attack is traced with high precision, and the attack source is located quickly and accurately. This achieves the technical effect of improving the accuracy of network attack tracing and solves the technical problem of insufficient accuracy in network attack tracing. Attached Figure Description

[0015] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0016] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a network attack attribution method is shown.

[0017] Figure 2 This is a flowchart of a network attack tracing method provided according to an embodiment of this application;

[0018] Figure 3 This is a schematic diagram of a network attack tracing device provided according to an embodiment of this application;

[0019] Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0020] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0021] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0022] It should be noted that the information collected in this application (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data all comply with relevant laws, regulations, and standards, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding access points are provided for users to choose to authorize or refuse. For example, interfaces are set up between this system and relevant users or organizations, providing users with corresponding access points to choose to agree to or refuse automated decision-making results; if the user chooses to refuse, the process proceeds to the expert decision-making stage.

[0023] Example 1

[0024] According to an embodiment of this application, a method embodiment for tracing the source of a network attack is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0025] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing a network attack attribution method is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, processing devices such as MCU (Microcontroller Unit) or FPGA (Field-Programmable Gate Array), memory 104 for storing data, and transmission device 106 for communication functions. In addition, it may also include: a display, input / output interfaces (I / O interfaces), a USB (Universal Serial Bus) port (which may be included as one of the ports of a BUS (Business Bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0026] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0027] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the network attack tracing method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the network attack tracing method described above. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0028] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0029] The display may be, for example, a touchscreen LCD display that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0030] Under the above operating environment, this application provides a method for tracing the source of network attacks. Figure 2 This is a flowchart of a network attack tracing method provided according to an embodiment of this application, such as... Figure 2 As shown, the method includes:

[0031] Step S201: Collect relevant data of the target network node that has been attacked, and extract network attack tracing features from the relevant data.

[0032] In step S201, a network attack refers to an illegal intrusion, damage, or data theft of a target network, computer system, or network service through network means, exploiting system vulnerabilities, or using unauthorized software. Common examples include denial-of-service attacks, unauthorized software attacks, and phishing attacks. Source tracing involves analyzing and tracking various information involved in the network attack process, such as IP addresses, timestamps, and packet characteristics, to determine the origin of the attack, including its geographical location and the network it belongs to.

[0033] Relevant data includes, but is not limited to, the entire content of network packets, such as source IP address, destination IP address, port number, protocol type, packet size, and timestamp; system log information, recording various operations and status changes of the network system before and after the attack; and configuration information of network devices, such as the setting parameters of routers, switches, and other devices. Feature extraction is performed on the collected data. For network packets, unique features are extracted, such as packet flow patterns and field characteristics under specific protocols; for system logs, key event features related to the attack are extracted, such as abnormal login attempts and file tampering records; and for network device configuration information, configuration change features that may be related to the attack are extracted. Data analysis algorithms, such as convolutional neural network algorithms in deep learning, are used to further optimize and filter the extracted features to highlight key features related to attack attribution.

[0034] Step S202: Based on the IP address in the network attack tracing features, determine the N candidate regions to which the attack source belongs, and construct an attack path model based on the network attack tracing features, where N is a positive integer.

[0035] In step S202, multiple source tracing analysis methods are used in combination. First, preliminary location is made based on IP address by comparing it with a global IP address database to determine the region where the possible attack source is located. However, considering that IP addresses may be spoofed, further attack path models are constructed by combining data packet flow characteristics, timestamps, and other information.

[0036] Step S203: The attack source is traced and analyzed using the attack path model, and the target region is determined from N candidate regions based on the traced and analyzed results.

[0037] In step S203, graph theory algorithms, such as the shortest path algorithm, are used to trace the attack path model backwards, gradually narrowing down the scope of the attack source. Simultaneously, features extracted from system logs and network device configuration information are combined to further verify and pinpoint potential attack sources. During the source tracing analysis, the relevant information of the attack source is continuously updated and improved, including its geographical location (by combining with a geographic information database) and its network affiliation (by comparing with network registration information).

[0038] Step S204: Determine the network attack source tracing results based on the target area and the source tracing analysis results.

[0039] In step S204, the final results obtained from the source tracing analysis, including accurate attack source information such as specific IP addresses, geographical locations, networks, and possible types of attackers (e.g., individual hackers, organized cybercrime groups), are output to network security administrators or relevant law enforcement agencies in a clear and intuitive manner. The output may also include a detailed analysis report of the attack tracing process, describing the methods used, analysis steps, difficulties encountered, and solutions, to provide a reference for the prevention and handling of similar attacks in the future.

[0040] The network attack tracing method provided in this application collects relevant data of the target network node under attack and extracts network attack tracing features from the relevant data; determines N candidate regions to which the attack source belongs based on the IP address in the network attack tracing features, and constructs an attack path model based on the network attack tracing features, where N is a positive integer; performs tracing analysis on the attack source through the attack path model, and determines the target region from the N candidate regions based on the tracing analysis results; and determines the network attack tracing result based on the target region and the tracing analysis results. Through multi-level data collection, feature extraction, and attack path model construction, it achieves the goal of high-precision tracking of the source of network attacks and rapid and accurate location of the attack source, thereby improving the technical effect of network attack tracing accuracy and solving the technical problem of insufficient accuracy in network attack tracing.

[0041] To more accurately trace and analyze the source of network attacks, it is necessary to extract network attack tracing features from multi-dimensional relevant data. Optionally, in the network attack tracing method provided in this application embodiment, extracting network attack tracing features from relevant data includes: when the relevant data contains network data packets, determining the flow pattern of network data packets and the field characteristics of communication protocols as candidate features; when the relevant data contains system logs, determining abnormal login events and file tampering records in the system logs as candidate features; when the relevant data contains network device configuration information, determining the configuration change characteristics of the network device configuration information as candidate features; inputting at least one candidate feature into a target model to obtain network attack tracing features, wherein the target model is used to filter features associated with network attack tracing from the candidate features.

[0042] In some embodiments, analyzing information such as the source IP, destination IP, and transmission path of network packets can identify abnormal communication patterns or unexpected flows, which may indicate clues to the source of the attack or the target. Examining protocol fields in data packets (such as protocol request headers, file transfer protocol command sequences, etc.) can reveal unusual field values ​​or specific protocol usage patterns as signs of attack behavior. Checking system logs for abnormal login attempts at unusual times, logins using unconventional accounts, or multiple failed login attempts is also crucial. Auditing logs for information related to file modifications, such as abnormal modification times, abnormal modification permissions, or mismatches between file types and modification records, can reveal traces left by attackers. Comparing the configuration information of network devices (such as routers and firewalls) before and after the attack can identify any unauthorized changes, which may be exploits or vulnerabilities created by attackers.

[0043] Develop a target model specifically designed to filter out features highly correlated with network attack attribution from candidate features. Candidate features extracted from various data sources will be input into the target model. Based on the results of algorithmic learning (e.g., supervised learning, unsupervised learning, semi-supervised learning), the model will score or classify the candidate features, selecting those closely related to network attack attribution.

[0044] The selected network packet flow patterns, communication protocol field characteristics, abnormal login and file tampering records in system logs, and network device configuration change characteristics are integrated into a comprehensive network attack attribution feature set. Based on the evaluation results of the target model, the network attack attribution features are ranked by importance, prioritizing those features judged to have high influence in the model, as they are more likely to lead to the source of the attack. Further verification and refined analysis are conducted on the selected network attack attribution features to eliminate false positives or noise, ensuring the accuracy and reliability of the features.

[0045] This embodiment efficiently and accurately extracts network attack tracing features from multiple data sources on attacked network nodes, laying a solid foundation for subsequent attack path analysis and attack source localization. It effectively overcomes the inaccuracy of tracing based on a single information source. Even if attackers use methods such as spoofing IP addresses or utilizing proxy servers, this invention can still accurately trace the true attack source.

[0046] After obtaining the network attack attribution characteristics, it is necessary to construct an attack path model based on the network attack attribution characteristics. Optionally, in the network attack attribution method provided in this application embodiment, constructing an attack path model based on the network attack attribution characteristics includes: extracting data packet flow characteristics and timestamps from the network attack attribution characteristics; obtaining the network topology to which the target network node belongs, and constructing a communication graph based on the network topology, data packet flow characteristics, and timestamps. The communication graph includes multiple nodes and edges, each node is used to represent network devices in the network topology, each edge is used to represent data packet flow characteristics, and the attribute information of the edge includes the timestamp corresponding to the data packet flow characteristics; searching for multiple attack paths from the communication graph through a path search algorithm, and constructing an attack path model based on the multiple attack paths.

[0047] In some embodiments, the source and destination addresses, transmission paths, and timestamps of network packets are analyzed to identify anomalous flow patterns. These patterns may include sudden increases in traffic, packets arriving via unconventional paths, or unusual communication patterns within a specific timeframe. Protocol fields in the packets are examined in detail for features that deviate from standard protocol behavior. Abnormal use of protocol fields is often a sign of a network attack. System logs are reviewed to identify login attempts at abnormal times, logins using unconventional accounts, or consecutive login failures; these events are often direct evidence of an attack. Log information regarding file modifications is analyzed to look for unauthorized file changes, abnormal modification times, or mismatches between file types and modification patterns. Network device configuration information is compared to identify possible configuration changes before and after the attack, such as the addition or modification of firewall rules or abnormal updates to routing tables.

[0048] Obtain the complete network topology of the target network node's environment, including all network devices (such as routers, switches, servers, etc.) and their connections. Define each network device in the network topology as a node in the communication graph. In the communication graph, each edge represents the flow characteristics of data packets, and its attribute information includes a timestamp, which helps to reconstruct the time sequence of the attack process. Based on the constructed communication graph, apply the shortest path algorithm or other suitable path search algorithm to search for all possible attack paths, with the target network node as the endpoint. Integrate and analyze the multiple searched attack paths to construct an attack path model. The model should include key information such as the specific network devices on each path, the direction of data packet flow, and the attack time point to facilitate subsequent reverse tracing and analysis.

[0049] This embodiment constructs an attack path model that reflects the propagation path of network attacks. Based on the model, reverse tracing can be performed, and the attack path can be verified by combining multi-source information, thereby more accurately locating the attack source. This provides strong support for the source tracing analysis of network attacks and improves the speed and accuracy of source tracing analysis.

[0050] Optionally, in the network attack tracing method provided in the embodiments of this application, constructing an attack path model based on multiple attack paths includes: for each attack path, determining whether the attack path matches the attack time of the network attack event based on the timestamp information on the attack path; if the attack path matches the attack time, determining the attack path as a path in the attack path model; if the attack path does not match the attack time, eliminating the attack path.

[0051] In some embodiments, firstly, the exact time point or time period of the network attack event is determined. This can be obtained from intrusion detection systems, system logs, or network traffic analysis. For each path traced back from the target network node, the timestamp information of each data packet on the path is extracted. The timestamp includes the specific time the data packet was sent and received. Based on the timestamps of the data packets, a time series for each path is constructed to reflect the temporal relationship of the data packets propagating in the network. The time series of each path is then compared with the attack time of the network attack event.

[0052] If the timestamp information on the path matches the attack time, meaning the data packet communication on the path occurs within the time window of the attack event and the time sequence is reasonable, then this path is considered a valid attack path and included in the attack path model. Conversely, if the timestamp on the path does not match the attack time, or if the time sequence is obviously unreasonable, this path is considered an attack-irrelevant communication flow and is removed from the attack path model.

[0053] This embodiment verifies the attack path to ensure the accuracy and effectiveness of the attack path model, thereby providing reliable data support for subsequent attack source location and network defense strategy formulation.

[0054] After constructing the attack path model, source tracing analysis is performed to determine the target area. Optionally, in the network attack source tracing method provided in this application embodiment, source tracing analysis is performed on the attack source through the attack path model, and the target area is determined from N candidate areas based on the source tracing analysis results, including: tracing the propagation path of the attack source backward from the damaged node in the attack path model using the shortest path algorithm; determining whether there is abnormal behavior in the system log of each node on the propagation path, and determining whether there are abnormal changes in the device configuration information of each node; if there is abnormal behavior in the system log of the node or abnormal changes in the device configuration information, determining the area to which the node belongs; if the area to which the node belongs is a candidate area, determining the area to which the node belongs as the target area.

[0055] In some embodiments, when using attack path models to locate attack sources, it is necessary not only to focus on the propagation path of data packets, but also to deeply analyze the system logs and device configuration information on each node to detect abnormal behavior and configuration changes, thereby more accurately pinpointing the location of the attack source. Starting from the compromised nodes identified in the attack path model, the shortest path algorithm is used to trace the propagation path of data packets in reverse until the suspected attack initiation point is found. The shortest path algorithm can efficiently filter out the most likely attack path, and by reverse analyzing each node on the path, it gradually approaches the attack source.

[0056] For each node along the path, examine its system logs for any unusual behavior, such as login attempts at abnormal times, operations using unregistered accounts, multiple failed login attempts, or command execution records. Anomalies are often closely related to attack activities and are crucial information for determining whether a node is involved in an attack. Simultaneously, analyze the network device configuration information of each node to identify any unusual configuration changes, such as unauthorized modifications to firewall rules or abnormal updates to routing tables. Unusual changes to device configurations may be direct evidence that attackers are attempting to conceal their activities or exploit network vulnerabilities.

[0057] By combining abnormal behavior in system logs and abnormal changes in device configuration information, each node on the path is comprehensively evaluated. If a node exhibits abnormal behavior in its system logs or abnormal changes in its device configuration information, this node is likely associated with the attack source. The geographical or cyberspace region to which the node belongs is determined. Each network node typically belongs to a specific geographical region or network service provider. By querying IP address databases or network registration information, the specific region to which a node belongs can be determined. When a node's region is one of N candidate regions, and abnormal behavior or configuration changes are observed on the node, this region is identified as the target region, i.e., the most likely location of the attack source. The identification of the target region is based on a comprehensive judgment of path analysis and anomaly detection, reducing the possibility of false positives and improving the accuracy of location.

[0058] This embodiment traces the data packet propagation path backward, deeply analyzing system logs and device configuration information at each node along the path to detect abnormal behavior and changes, thereby more accurately pinpointing the location of the attack source. It can complete the source analysis of network attacks in a relatively short time. This enables network security administrators to take timely measures to sanction the attack source or strengthen defenses, reducing the losses caused by the attack.

[0059] Candidate regions can be obtained by searching a preset IP address database. Optionally, in the network attack tracing method provided in this application embodiment, determining N candidate regions to which the attack source belongs based on the IP address in the network attack tracing features includes: extracting target IP addresses related to the network attack from the network attack tracing features; for each target IP address, searching the geographical location information of the target IP address in the preset IP address database, and determining the region to which the target IP address belongs based on the geographical location information; and determining the region to which each target IP address belongs as a candidate region.

[0060] In some embodiments, the network packets related to the attack are first analyzed in detail from the network attack attribution characteristics to extract all target IP addresses involved in the attack. These IP addresses may originate from the source address field of the attack packets or from the addresses of other network devices that the attacker interacted with during the attack. For each target IP address, a pre-defined IP address database is used for querying. The IP address database contains a large number of mappings between IP addresses and their geographical locations, such as latitude and longitude, city, and country. Based on the retrieved geographical location information, the specific region to which each target IP address belongs is determined. All regions determined from the target IP addresses are aggregated to form a candidate region list. These regions may be located globally or concentrated within a specific geographical area, depending on the distribution of IP addresses used by the attacker.

[0061] This embodiment effectively narrows down the search scope for attack sources by using the IP addresses used in cyberattacks, providing a clear direction for subsequent in-depth investigations and legal actions. Source tracing analysis is not limited to local networks or specific regions but can be conducted globally. By combining with global IP address databases, geographic information databases, and other resources, effective source tracing analysis of cyberattacks originating from around the world is possible.

[0062] In order to conduct source tracing analysis of network attacks, it is necessary to collect relevant data first. Optionally, in the network attack source tracing method provided in this application embodiment, collecting relevant data of the attacked target network node includes: deploying data collection probes on the target network node and collecting relevant data through the data collection probes at preset intervals.

[0063] In some embodiments, data acquisition probes are deployed at critical locations on the target network node, such as network ingress points, core switches, or servers. These probes can monitor and capture all network packets passing through the node in real time, while simultaneously recording system logs and network device configuration information. The data acquisition probes periodically capture data at preset intervals (e.g., every minute, every 5 minutes, or longer, depending on the size of network traffic and analysis requirements). The captured packets include complete IP addresses, port numbers, protocol types, packet sizes, and timestamps. Large packets may be appropriately truncated or filtered to improve processing efficiency. In addition to network packets, system log information can also be recorded, including but not limited to login attempts, permission changes, and file modification operations. This log information can reveal the attacker's actions within the network system, providing crucial clues for subsequent attack path analysis. Configuration information from network devices (such as routers and switches) is also collected. Changes in configuration information may indicate a network attack or an attacker's attempt to conceal their activities.

[0064] This embodiment establishes a comprehensive, real-time data collection mechanism on the attacked target network nodes, providing a sufficient and high-quality data foundation for subsequent network attack tracing and analysis.

[0065] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0066] Example 2

[0067] This application also provides a network attack tracing device. It should be noted that the network attack tracing device of this application can be used to execute the network attack tracing method provided in this application. The network attack tracing device provided in this application is described below.

[0068] According to an embodiment of this application, an apparatus for implementing the above-described network attack tracing method is also provided. Figure 3 This is a schematic diagram of a network attack tracing device provided according to an embodiment of this application, such as... Figure 3 As shown, the device includes:

[0069] The acquisition unit 301 is used to collect relevant data of the target network node that has been attacked and extract network attack tracing features from the relevant data.

[0070] Construction unit 302 is used to determine N candidate regions to which the attack source belongs based on the IP address in the network attack tracing characteristics, and to construct an attack path model based on the network attack tracing characteristics, where N is a positive integer;

[0071] The source tracing unit 303 is used to perform source tracing analysis on the attack source through the attack path model, and determine the target area from N candidate areas based on the source tracing analysis results.

[0072] The determination unit 304 is used to determine the network attack tracing results based on the target area and the tracing analysis results.

[0073] The network attack tracing device provided in this application embodiment collects relevant data of the target network node under attack through a collection unit 301, and extracts network attack tracing features from the relevant data; a construction unit 302 determines N candidate regions to which the attack source belongs based on the IP address in the network attack tracing features, and constructs an attack path model based on the network attack tracing features, where N is a positive integer; a tracing unit 303 performs tracing analysis on the attack source through the attack path model, and determines the target region from the N candidate regions based on the tracing analysis results; and a determination unit 304 determines the network attack tracing result based on the target region and the tracing analysis results. Through multi-level data collection, feature extraction, and attack path model construction, the device achieves the goal of high-precision tracking of the source of network attacks and rapid and accurate location of the attack source, thereby improving the technical effect of network attack tracing accuracy and solving the technical problem of insufficient accuracy in network attack tracing.

[0074] Optionally, in the network attack tracing device provided in this application embodiment, the acquisition unit 301 includes: a first determining module, used to determine the flow pattern of network data packets and the field characteristics of communication protocols as candidate features when the relevant data includes network data packets; a second determining module, used to determine abnormal login events and file tampering records of system logs as candidate features when the relevant data includes system logs; a third determining module, used to determine the configuration change characteristics of network device configuration information as candidate features when the relevant data includes network device configuration information; and an input module, used to input at least one candidate feature into a target model to obtain network attack tracing features, wherein the target model is used to filter features associated with network attack tracing from the candidate features.

[0075] Optionally, in the network attack tracing device provided in this application embodiment, the construction unit 302 includes: a first extraction module, used to extract data packet flow characteristics and timestamps from network attack tracing features; an acquisition module, used to acquire the network topology to which the target network node belongs, and construct a communication graph based on the network topology, data packet flow characteristics and timestamps, wherein the communication graph includes multiple nodes and edges, each node is used to represent network devices in the network topology, each edge is used to represent data packet flow characteristics, and the attribute information of the edge includes the timestamp corresponding to the data packet flow characteristics; and a search module, used to search for multiple attack paths from the communication graph through a path search algorithm, and construct an attack path model based on the multiple attack paths.

[0076] Optionally, in the network attack tracing device provided in this application embodiment, the search module includes: a judgment submodule, used to determine whether the attack path matches the attack time of the network attack event based on the timestamp information on the attack path for each attack path; a determination submodule, used to determine the attack path as a path in the attack path model if the attack path matches the attack time; and a rejection submodule, used to reject the attack path if the attack path does not match the attack time.

[0077] Optionally, in the network attack tracing device provided in this application embodiment, the tracing unit 303 includes: a tracing module, used to trace the propagation path of the attack source backward from the damaged node in the attack path model using the shortest path algorithm; a judgment module, used to judge whether there is abnormal behavior in the system log of each node on the propagation path, and to judge whether there is abnormal change in the device configuration information of each node; a fourth determination module, used to determine the region to which the node belongs when there is abnormal behavior in the system log of the node or abnormal change in the device configuration information; and a fifth determination module, used to determine the region to which the node belongs as the target region when the region to which the node belongs is a candidate region.

[0078] Optionally, in the network attack tracing device provided in this application embodiment, the construction unit 302 includes: a second extraction module, used to extract target IP addresses related to network attacks from network attack tracing features; a retrieval module, used to retrieve the geographical location information of the target IP address in a preset IP address database for each target IP address, and determine the region to which the target IP address belongs based on the geographical location information; and a sixth determination module, used to determine the region to which each target IP address belongs as a candidate region.

[0079] Optionally, in the network attack tracing device provided in this application embodiment, the collection unit 301 includes: a collection module, used to deploy data collection probes on the target network node and collect relevant data at preset intervals through the data collection probes.

[0080] It should be noted that the above-mentioned acquisition unit 301, construction unit 302, tracing unit 303, and determination unit 304 correspond to steps S201 to S204 in Embodiment 1. The four units and the corresponding steps implement the same instances and application scenarios, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above-mentioned modules or units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above-mentioned modules or units can also be part of the device and run in the computer terminal 10 provided in Embodiment 1.

[0081] Example 3

[0082] Embodiments of this application may provide an electronic device. Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 4 As shown, the electronic device may include: one or more ( Figure 4 (Only one is shown) Processor 402, memory 404, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0083] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the methods and apparatus in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the above-described methods. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0084] The processor can access information and applications stored in memory via a transmission device to perform the following steps: collect relevant data of the target network node under attack, and extract network attack tracing features from the relevant data; determine N candidate regions to which the attack source belongs based on the IP address in the network attack tracing features, and construct an attack path model based on the network attack tracing features, where N is a positive integer; perform tracing analysis on the attack source through the attack path model, and determine the target region from the N candidate regions based on the tracing analysis results; determine the network attack tracing result based on the target region and the tracing analysis results.

[0085] The processor can also invoke information and applications stored in the memory via the transmission device to perform the following steps: if the relevant data includes network data packets, determine the flow pattern of the network data packets and the field characteristics of the communication protocol as candidate features; if the relevant data includes system logs, determine abnormal login events and file tampering records in the system logs as candidate features; if the relevant data includes network device configuration information, determine the configuration change characteristics of the network device configuration information as candidate features; input at least one candidate feature into the target model to obtain network attack tracing features, wherein the target model is used to filter features associated with network attack tracing from the candidate features.

[0086] The processor can also access information and applications stored in the memory via the transmission device to perform the following steps: extracting packet flow characteristics and timestamps from network attack tracing features; obtaining the network topology to which the target network node belongs, and constructing a communication graph based on the network topology, packet flow characteristics, and timestamps. The communication graph includes multiple nodes and edges, where each node represents a network device in the network topology, each edge represents a packet flow characteristic, and the edge's attribute information includes the timestamp corresponding to the packet flow characteristic; and searching for multiple attack paths from the communication graph using a path search algorithm, and constructing an attack path model based on these multiple attack paths.

[0087] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: for each attack path, determine whether the attack path matches the attack time of the network attack event based on the timestamp information on the attack path; if the attack path matches the attack time, determine the attack path as a path in the attack path model; if the attack path does not match the attack time, remove the attack path.

[0088] The processor can also access information and applications stored in memory via a transmission device to perform the following steps: tracing the propagation path of the attack source backward from the compromised node in the attack path model using a shortest path algorithm; determining whether there is abnormal behavior in the system logs of each node on the propagation path, and determining whether there are abnormal changes in the device configuration information of each node; if there is abnormal behavior in the system logs of a node or abnormal changes in the device configuration information, determining the region to which the node belongs; if the region to which the node belongs is a candidate region, determining the region to which the node belongs as the target region.

[0089] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: extracting the target IP addresses related to the network attack from the network attack tracing characteristics; for each target IP address, retrieving the geographical location information of the target IP address in the preset IP address database, and determining the region to which the target IP address belongs based on the geographical location information; and determining the region to which each target IP address belongs as a candidate region.

[0090] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: collecting relevant data of the attacked target network node, including: deploying data collection probes on the target network node and collecting relevant data at preset intervals through the data collection probes.

[0091] This application provides a scheme for collecting relevant data on attacked target network nodes, extracting network attack tracing features from the relevant data, determining N candidate regions to which the attack source belongs based on the IP addresses in the network attack tracing features, and constructing an attack path model based on the network attack tracing features, where N is a positive integer; performing tracing analysis on the attack source through the attack path model, determining the target region from the N candidate regions based on the tracing analysis results, and determining the network attack tracing result based on the target region and the tracing analysis results. Through multi-level data collection, feature extraction, and attack path model construction, this scheme achieves the goal of high-precision tracing of the source of network attacks and rapid and accurate location of the attack source, thereby improving the technical effect of network attack tracing accuracy and solving the technical problem of insufficient accuracy in network attack tracing.

[0092] Those skilled in the art will understand that Figure 4 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 4 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 4 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 4 The different configurations shown.

[0093] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0094] Example 4

[0095] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the network attack tracing method provided in Embodiment 1.

[0096] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0097] This application also provides a computer program product that, when executed on a data processing device, is suitable for performing steps of a network attack attribution method.

[0098] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0099] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0100] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0101] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0102] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0103] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0104] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for tracing the source of a network attack, characterized in that, include: Collect relevant data on the target network nodes that have been attacked, and extract network attack tracing features from the relevant data; Based on the IP address in the network attack tracing features, N candidate regions to which the attack source belongs are determined, and an attack path model is constructed based on the network attack tracing features, where N is a positive integer; The attack source is traced and analyzed using the attack path model, and the target region is determined from the N candidate regions based on the traced and analyzed results. The network attack attribution result is determined based on the target area and the attribution analysis results.

2. The method according to claim 1, characterized in that, The network attack attribution features extracted from the relevant data include: If the relevant data contains network data packets, the flow pattern of the network data packets and the field characteristics of the communication protocol are identified as candidate features; If the relevant data includes system logs, abnormal login events and file tampering records in the system logs are identified as candidate features; If the relevant data includes network device configuration information, the configuration change feature of the network device configuration information is identified as a candidate feature; At least one candidate feature is input into the target model to obtain the network attack attribution feature, wherein the target model is used to filter features associated with network attack attribution from the candidate features.

3. The method according to claim 1, characterized in that, Constructing an attack path model based on the aforementioned network attack attribution characteristics includes: Extract packet flow characteristics and timestamps from the network attack attribution characteristics; Obtain the network topology to which the target network node belongs, and construct a communication graph based on the network topology, the data packet flow characteristics, and the timestamp. The communication graph includes multiple nodes and edges. Each node is used to represent a network device in the network topology, and each edge is used to represent the data packet flow characteristics. The attribute information of the edge includes the timestamp corresponding to the data packet flow characteristics. Multiple attack paths are searched from the communication graph using a path search algorithm, and an attack path model is constructed based on these multiple attack paths.

4. The method according to claim 3, characterized in that, The attack path model constructed based on the multiple attack paths includes: For each attack path, determine whether the attack path matches the attack time of the network attack event based on the timestamp information on the attack path; If the attack path matches the attack time, the attack path is determined as a path in the attack path model; If the attack path does not match the attack time, the attack path will be eliminated.

5. The method according to claim 1, characterized in that, The attack source is traced and analyzed using the attack path model. Based on the tracement and analysis results, the target region is determined from the N candidate regions, including: The propagation path of the attack source is traced backward from the damaged node in the attack path model using the shortest path algorithm. Determine whether there is any abnormal behavior in the system logs of each node on the propagation path, and determine whether there are any abnormal changes in the device configuration information of each node; If the abnormal behavior is found in the system log of the node or if there are abnormal changes in the device configuration information, determine the region to which the node belongs; If the region to which the node belongs is the candidate region, the region to which the node belongs is determined as the target region.

6. The method according to claim 1, characterized in that, Based on the IP address in the network attack attribution characteristics, the N candidate regions to which the attack source belongs are determined, including: Extract the target IP addresses related to the network attack from the network attack tracing features; For each target IP address, retrieve the geographic location information of the target IP address from the preset IP address database, and determine the region to which the target IP address belongs based on the geographic location information; The region to which each target IP address belongs is determined as the candidate region.

7. The method according to claim 1, characterized in that, The data collected regarding the target network nodes that have been attacked includes: A data acquisition probe is deployed on the target network node, and the relevant data is collected by the data acquisition probe at preset time intervals.

8. A network attack tracing device, characterized in that, include: The data acquisition unit is used to collect relevant data of the target network node that has been attacked, and extract network attack tracing features from the relevant data. The construction unit is used to determine N candidate regions to which the attack source belongs based on the IP address in the network attack tracing features, and to construct an attack path model based on the network attack tracing features, where N is a positive integer; The source tracing unit is used to perform source tracing analysis on the attack source through the attack path model, and determine the target region from the N candidate regions based on the source tracing analysis results. The determining unit is used to determine the network attack tracing result based on the target area and the tracing analysis result.

9. An electronic device, characterized in that, include: Memory, which stores executable programs; A processor for running the program, wherein the program executes the network attack attribution method according to any one of claims 1 to 7 when it runs.

10. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the steps of the network attack tracing method according to any one of claims 1 to 7.

Images