Network attack tracing method and device, equipment, storage medium and program product

Abstract

The invention discloses a network attack tracing method and device, equipment, a storage medium and a program product, and relates to the technical field of computers. The method comprises the following steps: after acquiring communication data of suspicious IPs, performing anomaly detection on the communication data of the suspicious IPs to obtain an anomaly feature of each suspicious IP; generating an abnormal reason description text of the IP based on the abnormal characteristics of the suspicious IP; and finally, carrying out traceability study and judgment on the network attack.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to methods, apparatus, devices, storage media, and program products for tracing the source of network attacks. Background Technology

[0002] As networks expand in scale and complexity, cyberattack methods are becoming increasingly diversified, posing a serious threat to network security. Cyberattack attribution, as a crucial technology in the field of network security, is of great significance for the timely detection and response to cyberattacks.

[0003] Currently, there are various methods for tracing network attacks, among which those based on host logs and traffic data are more common. However, on the one hand, in large-scale network environments, this data is difficult to obtain or is incomplete; on the other hand, existing methods are unable to cope with complex and ever-changing attack methods, resulting in significant deficiencies in accuracy and the ability to identify complex attacks.

[0004] Therefore, the relevant methods still suffer from problems such as low accuracy in identifying network attacks, difficulty in dealing with complex scenarios, and low efficiency in tracing the source. Summary of the Invention

[0005] The purpose of this application is to provide a method, apparatus, device, storage medium, and program product for tracing the source of network attacks, which can improve the accuracy of network attack identification, cope with various complex attack scenarios, and improve the efficiency of network attack tracing.

[0006] To achieve the above objectives, this application adopts the following technical solution:

[0007] Firstly, this application provides a method for tracing the source of a network attack. The method includes: acquiring communication data of M first suspicious IPs; the first suspicious IPs include victim IPs and / or suspected attack IPs; M is an integer greater than zero; performing anomaly detection on the communication data of each first suspicious IP to obtain the abnormal characteristics of each first suspicious IP; the abnormal characteristics include: connection characteristics, port characteristics, and the number of IPs in the same network segment as the first suspicious IP; generating an anomaly cause description text for each first suspicious IP based on the anomaly cause description text of each first suspicious IP; and performing source tracing and analysis based on the anomaly cause description text of each first suspicious IP.

[0008] The technical solution provided in this application focuses on the first suspicious IP group, which includes victim IPs and suspected attack IPs. It extracts abnormal features such as connection characteristics, port characteristics, and the number of IPs in the same network segment from their communication data. This facilitates large-scale network tracing and effectively addresses complex scenarios such as multi-hop attacks. Extracting multiple features from the data avoids identifying network attacks using a single indicator, improving the accuracy of network attack identification. Furthermore, it enables targeted modeling of specific behavioral characteristics (such as specific communication patterns, high-risk port usage patterns, and IP associations in the same network segment), broadening the scenarios for network attack tracing. Combining these features to generate targeted descriptions of the causes of anomalies provides intuitive analytical basis for tracing and judgment, helping analysts quickly locate key nodes related to attacks, thereby enabling rapid verification and decision-making and improving tracing efficiency.

[0009] One possible implementation is that, if the suspected attacking IP is the destination IP in the communication data, the connection characteristics of the source IP in the communication data include at least one of the following: the number of times it connects to other IPs, the number of different IPs it connects to, the maximum number of times it connects to other IPs within a single time window, the number of bytes of data packets sent to other IPs, and the number of data packets sent to other IPs; if the suspected attacking IP is the source IP in the communication data, the connection characteristics of the destination IP in the communication data include at least one of the following: the number of times it is connected to other IPs, the number of IPs connected to by different IPs, the maximum number of times it is connected to other IPs within a time window, the number of bytes of data packets received from other IPs, and the number of data packets received from other IPs.

[0010] Another possible implementation is as follows: when the first suspicious IP is the source IP, the number of destination port types of the first suspicious IP, the number of high-risk ports among the destination ports, the proportion of high-risk ports among the destination ports, and the number of source port types of the first suspicious IP.

[0011] Another possible implementation is to determine whether each first suspicious IP is an attacking IP based on the description text of the abnormal cause of each first suspicious IP, and obtain the source tracing result; if the source tracing result includes the attacking IP, the source tracing ends; if the source tracing result does not include the attacking IP, the source tracing is iterated.

[0012] Another possible implementation is as follows: In each iteration of source tracing, based on the anomaly description text of each first suspicious IP in the previous iteration of source tracing, N second suspicious IPs are determined from M first suspicious IPs; N is an integer less than or equal to M; anomaly detection is performed based on the communication data of the second suspicious IPs to obtain the anomaly characteristics of each second suspicious IP; based on the anomaly characteristics of each second suspicious IP, an anomaly description text of each second suspicious IP is generated; and source tracing and analysis are performed based on the anomaly description text of each second suspicious IP.

[0013] Another possible implementation involves preprocessing the communication data of each first suspicious IP to filter out communication data within abnormal time periods; extracting the features of the communication data within abnormal time periods and standardizing them to obtain standardized data for each first suspicious IP; and performing anomaly detection on the standardized data of each first suspicious IP to obtain the anomaly features of each first suspicious IP.

[0014] Secondly, a network attack tracing device is provided, which includes: an acquisition module and a processing module;

[0015] The aforementioned acquisition module is used to acquire communication data of M first suspicious IPs; the first suspicious IPs include victim IPs and / or suspected attack IPs; M is an integer greater than zero;

[0016] The aforementioned processing module is used to perform anomaly detection on the communication data of each first suspicious IP, and obtain the anomaly characteristics of each first suspicious IP;

[0017] The aforementioned processing module is also used to generate an anomaly description text for each first suspicious IP based on the anomaly characteristics of each first suspicious IP;

[0018] The aforementioned processing module is also used to perform source tracing and analysis based on the anomaly description text of each first suspicious IP.

[0019] One possible implementation is that, if the suspected attacking IP is the destination IP in the communication data, the connection characteristics of the source IP in the communication data include at least one of the following: the number of times it connects to other IPs, the number of different IPs it connects to, the maximum number of times it connects to other IPs within a single time window, the number of bytes of data packets sent to other IPs, and the number of data packets sent to other IPs; if the suspected attacking IP is the source IP in the communication data, the connection characteristics of the destination IP in the communication data include at least one of the following: the number of times it is connected to other IPs, the number of IPs connected to by different IPs, the maximum number of times it is connected to other IPs within a time window, the number of bytes of data packets received from other IPs, and the number of data packets received from other IPs.

[0020] Another possible implementation is as follows: when the first suspicious IP is used as the source IP, the number of destination port types of the first suspicious IP, the number of high-risk ports among the destination ports, the proportion of high-risk ports among the destination ports, and the number of source port types of the first suspicious IP.

[0021] In another possible implementation, the above processing module is also used to determine whether each first suspicious IP is an attacking IP based on the description text of the abnormal cause of each first suspicious IP, and obtain the source tracing result; if the source tracing result includes the attacking IP, the source tracing ends; if the source tracing result does not include the attacking IP, the source tracing is iterated.

[0022] In another possible implementation, the aforementioned processing module is further configured to, during each iteration of source tracing, determine N second suspicious IPs from M first suspicious IPs based on the anomaly cause description text of each first suspicious IP in the previous iteration of source tracing; N is an integer less than or equal to M; perform anomaly detection based on the communication data of the second suspicious IPs to obtain the anomaly characteristics of each second suspicious IP; generate anomaly cause description text for each second suspicious IP based on the anomaly characteristics of each second suspicious IP; and perform source tracing and analysis based on the anomaly cause description text of each second suspicious IP.

[0023] In another possible implementation, the above processing module is also used to preprocess the communication data of each first suspicious IP, filter out the communication data in abnormal time periods; extract the communication data features in abnormal time periods and perform standardization processing to obtain the standardized data of each first suspicious IP; and perform anomaly detection on the standardized data of each first suspicious IP to obtain the abnormal features of each first suspicious IP.

[0024] The technical effects of any implementation method in the second aspect can be found in the technical effects of any implementation method in the first aspect mentioned above, and will not be repeated here.

[0025] Thirdly, an electronic device is provided, comprising: a processor and a memory, wherein the memory stores at least one computer program, and the at least one computer program is loaded and executed by the processor to implement the above-mentioned method for attribution of network attacks.

[0026] Fourthly, a computer-readable storage medium is provided, wherein at least one computer program is stored in the computer-readable storage medium, and the at least one computer program is loaded and executed by a processor to implement the above-mentioned method for tracing the source of network attacks.

[0027] Fifthly, a computer program product is provided, which includes a computer program or instructions, and when the computer program or instructions are executed by a processor, the above-mentioned method for tracing the source of network attacks is implemented.

[0028] The solutions provided in aspects three through five above are used to implement the method provided in aspect one above, and their specific implementations will not be described in detail here. The technical effects corresponding to any implementation method of the solutions provided in aspects three through five above can be found in the technical effects corresponding to any implementation method in aspect one above, and will not be described in detail here.

[0029] It should be noted that any of the possible implementations of any of the above aspects can be combined, provided that the solutions do not contradict each other. Attached Figure Description

[0030] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0031] Figure 1 A schematic diagram of the structure of a network attack tracing system provided in this application embodiment;

[0032] Figure 2 A flowchart illustrating a method for tracing the source of a network attack provided in an embodiment of this application;

[0033] Figure 3 A schematic diagram of a 3sigma-based data distribution provided in an embodiment of this application;

[0034] Figure 4 A schematic diagram of the distribution of full communication data provided in an embodiment of this application;

[0035] Figure 5 This application provides a schematic diagram of communication data distribution during an abnormal time period.

[0036] Figure 6 This is a schematic diagram of the three-dimensional distribution of anomaly detection results provided in an embodiment of this application;

[0037] Figure 7 A schematic diagram illustrating the steps of a network attack tracing method provided in this application embodiment;

[0038] Figure 8 A schematic diagram of the structure of a network attack tracing device provided in an embodiment of this application;

[0039] Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0040] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0041] In the description of this application, it should be understood that the terms "upper," "lower," "left," "right," "front," "rear," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or relative positional relationship shown in the accompanying drawings. They are used only for the convenience of describing this application and for simplification, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this application. Unless otherwise specified, the above-mentioned orientational descriptions can be flexibly set in practical applications, provided that the relative positional relationships shown in the accompanying drawings are satisfied.

[0042] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0043] In the description of this application, it should be noted that, unless otherwise expressly specified and limited, the terms "installation," "connection," "linking," and "communication" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection. They can refer to a direct connection or an indirect connection through an intermediate medium, or a connection within two components. Those skilled in the art can understand the specific meaning of the above terms in this application according to the specific circumstances.

[0044] In embodiments of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, article, or apparatus that includes that element.

[0045] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0046] In the embodiments of this application, at least one can also be described as one or more, and multiple can be two, three, four or more, and this application does not impose any restrictions.

[0047] In the description of this specification, specific features, structures, materials, or characteristics may be combined in any suitable manner in one or more embodiments or examples.

[0048] To facilitate understanding, the terms used in the embodiments of this application will be explained first.

[0049] Communication data refers to metadata generated during network communication, including but not limited to key fields such as source / destination IP address, port number, protocol type, communication time, and data packet size.

[0050] Network-wide source tracing: refers to the technology of reconstructing attack paths based on network-wide communication data in a carrier-grade network environment, which is different from the traditional source tracing method based on single-point logs.

[0051] The 3 sigma rule is a statistical outlier identification method. It assumes that most data follows a normal distribution, while data points exceeding the mean plus or minus three standard deviations are considered outliers. The data distribution following the 3 sigma rule is as follows: Figure 3 As shown, 99.7% of the data are distributed within 3 standard deviations of the mean, 95% of the data are distributed within 2 standard deviations of the mean, and 68% of the data are distributed within 2 standard deviations of the mean.

[0052] It should be noted that all information (including but not limited to device information, network information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.), and signals involved in this application have been authorized by the subject or fully authorized by all parties, and the collection, use, and processing of related data must comply with relevant laws, regulations, and standards. For example, network characteristic data, metadata, etc., involved in this application were all obtained with full authorization.

[0053] As networks expand in scale and complexity, cyberattack methods are becoming increasingly diversified, posing a serious threat to network security. Cyberattack attribution, as a crucial technology in the field of network security, is of great significance for the timely detection and response to cyberattacks.

[0054] Currently, there are various methods for tracing network attacks, among which the method based on host logs and traffic data is more common. This method mainly involves collecting local logs from devices such as servers and terminals, analyzing abnormal behavior, and locating traces of attacks at the host level.

[0055] However, on the one hand, in large-scale network environments, this data is difficult to obtain or is incomplete, and traditional solutions do not make sufficient use of network communication data, especially in large-scale network environments. They lack the ability to correlate and analyze network-wide traffic data and rely excessively on host-side logs or local traffic data. Limited by the scope of data collection and storage costs, they cannot cover intermediate jumper nodes and cross-network segment communication behaviors in the attack path. On the other hand, relying on single indicators (such as IP address, access frequency, etc.) to identify potential attack sources makes existing methods unable to cope with complex and ever-changing attack methods, resulting in significant deficiencies in accuracy and ability to identify complex attacks. The lack of targeted modeling of attacker-specific behavioral characteristics leads to insufficient correlation between detection results and actual attack behavior.

[0056] Traditional methods cannot provide interpretable criteria for anomaly identification, making it difficult for security operations personnel to quickly verify and make decisions. This results in low source tracing efficiency and a high false positive rate. Furthermore, the lack of an iterative source tracing mechanism makes it impossible to gradually locate the real attack source through multiple rounds of analysis, leading to insufficient depth and accuracy in tracing multi-hop attacks.

[0057] Based on this, this application proposes a method for tracing network attacks. It focuses on the first suspicious IP group, including victim IPs and suspected attack IPs, and extracts abnormal features such as connection characteristics, port characteristics, and the number of IPs in the same network segment from their communication data. This facilitates large-scale network tracing and effectively addresses complex scenarios such as multi-hop attacks. Extracting multiple features from the data avoids identifying network attacks using a single indicator, improving the accuracy of network attack identification. Furthermore, it allows for targeted modeling of specific behavioral characteristics (such as specific communication patterns, high-risk port usage patterns, and IP associations in the same network segment), broadening the scenarios for network attack tracing. Combining these features to generate targeted descriptions of the causes of anomalies provides intuitive analytical basis for tracing and judgment, helping analysts quickly locate key nodes related to attacks, thereby enabling rapid verification and decision-making and improving tracing efficiency.

[0058] The solution provided in this application can be applied to Figure 1 The network attack attribution system shown is as follows: Figure 1 This is a schematic diagram of the structure of a network attack tracing system provided in an embodiment of this application.

[0059] For example, the network attack tracing system 10 includes an electronic device 11. The electronic device 11 can acquire communication data between the victim IP and the suspected attack IP, perform anomaly detection on the communication data, generate an anomaly description text, and conduct network attack tracing and analysis.

[0060] In some embodiments, after a suspected attacking IP or a victim IP is known, the electronic device 11 can obtain communication data (such as NetFlow logs) of the suspected attacking IP or a victim IP from the operator or network equipment, and after extracting communication data during abnormal time periods, obtain the characteristics of the communication data and perform standardization processing.

[0061] In some embodiments, the electronic device 11 can perform anomaly detection on the preprocessed communication data and generate detailed anomaly cause description text based on the features in the communication data, so as to submit it to operation experts or large models for network attack tracing and analysis based on the anomaly cause description text.

[0062] Optionally, the electronic device 11 can also store the acquired communication data of suspected attacking IPs or victim IPs to facilitate the retrieval of original data and the processing and analysis of the original data.

[0063] In some embodiments, the electronic device 11 can be a server, such as a single server or a server cluster consisting of multiple servers. In some embodiments, the server cluster can also be a distributed cluster.

[0064] In some embodiments, the electronic device 11 can be a terminal device, such as a mobile phone, tablet computer, desktop computer, laptop computer, handheld computer, notebook computer, ultra-mobile personal computer (UMPC), netbook, cellular phone, personal digital assistant (PDA), augmented reality (AR) / virtual reality (VR) device, etc. This application embodiment does not impose any special limitations on the specific form of the terminal device.

[0065] In some embodiments, the network attack attribution system 10 may also include a notification device 12.

[0066] The prompting device 12 is used to display a description of the cause of the anomaly and / or the results of tracing the network attack. For example, the prompting device 12 can be a voice prompt device, in which case the prompting device 12 presents the description of the cause of the anomaly and / or the results of tracing the network attack to the user by reading aloud. Alternatively, the prompting device 12 can also be a display device, in which case the prompting device 12 presents the description of the cause of the anomaly and / or the results of tracing the network attack to the user by displaying the description of the cause of the anomaly and / or the results of tracing the network attack on a display screen in various ways (such as text, images, videos, etc.).

[0067] In some embodiments, a communication connection is established between the prompting device 12 and the electronic device 11. For example, the connection method can be a wireless connection, such as Bluetooth or Wi-Fi; or it can be a wired connection, such as fiber optic, etc., without limitation. For example, the electronic device 11 and the prompting device 12 can be connected to the Internet through a router, thereby realizing the communication connection between the electronic device 11 and the prompting device 12.

[0068] It should be noted that the system architecture described in the embodiments of this application is for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and does not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the evolution of system architecture, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0069] The following description, in conjunction with the accompanying drawings, introduces a method for tracing the source of a network attack provided in an embodiment of this application.

[0070] For example, the network attack tracing method provided in this application can be achieved through... Figure 1 The network attack attribution system shown is implemented, or, through... Figure 1 The electronic devices implemented in the network attack attribution system shown.

[0071] See Figure 2 This is a flowchart illustrating a method for tracing the source of a network attack provided in an embodiment of this application. Figure 2 As shown, the network attack tracing method provided in this application includes the following steps S201 to S204.

[0072] S201. Obtain communication data of the first suspicious IPs.

[0073] The first suspicious IP includes the victim IP and / or the suspected attack IP; M is an integer greater than zero.

[0074] In some implementations, a victim IP refers to the IP address of a device (such as a server, terminal, or network device) that is attacked, compromised, or abnormally affected during a cyberattack. For example, the IP address of a server paralyzed by a DDoS attack; or the IP address of a terminal that has been infected with malware and had its data leaked.

[0075] In some implementations, a suspected attack IP refers to an IP address that is preliminarily determined to be likely to initiate, participate in, or be strongly associated with an attack. For example, an IP that sends a large number of malicious data packets to a victim IP in a short period of time, or an IP that frequently communicates with known malicious IPs (such as botnet nodes or C2 servers), is considered a suspected attack IP and is a potential initiator or associate of the attack.

[0076] In some implementations, communication data refers to relevant data generated during network communication, which is a record of network communication behavior collected by network devices (routers, switches, etc.). Communication data does not record the complete content of each data packet, but rather aggregates information by flow, including but not limited to key fields such as source / destination IP address, port number, protocol type, communication time, and data packet size.

[0077] For example, communication data can be NetFlow logs, J-Flow logs, and NetStream logs. Examples of communication data are shown in Table 1 below:

[0078] Table 1. Sample Communication Data

[0079]

[0080] In some implementations, communication data can be obtained through specialized tools after obtaining legal permission.

[0081] For example, NetFlow data can be obtained by configuring specific collection rules on network devices. The devices capture packet information and store it in a stream buffer, and then periodically export the stream information in the buffer to the NetFlow collector in batches. Alternatively, tools such as Python's nfstream library can be used for capture.

[0082] In some implementations, it is necessary to select communication data within different time ranges based on different types of network attacks.

[0083] For example, for short-term burst attacks (such as DDoS attacks, port scanning attacks, etc.), which are highly sudden and short-lived, short-term communication data before and after the attack can be obtained, such as within 1 hour before and after the attack; for continuous penetration attacks (such as APT attacks, Trojan implantation, etc.), which have long incubation periods and covert behavior, communication data over a long period can be obtained, such as 7 to 30 days before the attack; for periodic attacks (such as timed vulnerability exploitation, periodic malicious scanning, etc.), which are repeatedly launched at fixed intervals, communication data can be obtained by combining the total periodic regularity.

[0084] S202. Perform anomaly detection on the communication data of each first suspicious IP to obtain the anomaly characteristics of each first suspicious IP.

[0085] The abnormal characteristics include: connection characteristics, port characteristics, and the number of IPs in the same network segment as the first suspicious IP.

[0086] In some implementations, three types of features can be extracted from communication data: connection features, port features, and the number of IPs sharing the same network bit as the first suspicious IP. Connection features allow for rapid screening of IPs whose communication behavior deviates from normal patterns, providing a preliminary assessment of whether they are involved in network attacks and narrowing down the scope for subsequent analysis. Port features allow for rapid association with specific network attack methods such as vulnerability exploitation and brute-force attacks, thereby deduce the attacker's technical path. The number of IPs sharing the same network bit allows for determining the number and scale of attacking nodes, expanding the scope of tracing.

[0087] In some implementations, connection feature extraction requires judgment based on the location of the suspected attacking IP. Communication data is acquired based on the first suspected IP; therefore, in each communication data segment, either the source IP or the destination IP is a suspected attacking IP. Thus, classifying and extracting connection features can reveal the abnormal characteristics of the suspected attacking IP communicating with other IPs from different perspectives.

[0088] In some implementations, when a suspected attacking IP is located at the destination IP position in the communication data, the corresponding network communication flow is as follows: other IPs act as source IPs sending data packets to the suspected attacking IP, rather than the suspected attacking IP sending data packets to other IPs. Therefore, it is necessary to extract the characteristics of the source IP in the communication data. Since the source IP is the active initiator of the communication behavior, it is necessary to extract the communication timing characteristics of the source IP sending data to other IPs.

[0089] For example, if the suspected attacking IP is the destination IP in the communication data, the connection characteristics of the source IP in the communication data include at least one of the following: the number of times it connects to other IPs, the number of different IPs it connects to, the maximum number of times it connects to other IPs within a single time window, the number of bytes of data packets sent to other IPs, and the number of data packets sent to other IPs.

[0090] In some implementations, when a suspected attacking IP is located at the source IP position in the communication data, the corresponding network communication flow is as follows: the suspected attacking IP acts as the source IP sending data packets to other IPs, rather than other IPs sending data packets to this suspected attacking IP. Therefore, it is necessary to extract the characteristics of the destination IP in the communication data. Since the destination IP is the passive recipient of network communication behavior, it is necessary to extract the communication characteristics of the destination IP receiving data when the suspected attacking IP sends data to it.

[0091] For example, if the suspected attacking IP is the source IP in the communication data, the connection characteristics of the destination IP in the communication data include at least one of the following: the number of times it is connected by other IPs, the number of IPs connected by different IPs, the maximum number of times it is connected by other IPs within a time window, the number of bytes of data packets received from other IPs, and the number of data packets received from other IPs.

[0092] In some embodiments, only the port characteristics when the first suspicious IP is the source IP are considered, including the number of destination port types of the first suspicious IP, the number of high-risk ports in the destination ports, the proportion of high-risk ports in the destination ports, and the number of source port types of the first suspicious IP.

[0093] In some implementations, ports serve as logical addresses in the TCP / IP protocol used to distinguish network application processes, and their number is directly determined by the port number range. According to the standard definition of the Internet Corporation for Assigned Numbers (ICANN), port numbers range from 0 to 65535, totaling 65536. Ports can be classified according to various dimensions such as function, security risks, and transmission protocols.

[0094] For example, ports can be categorized into three types based on their purpose and allocation rules: well-known ports, numbered 0-1023 (1024 in total), mainly allocated to standardized network services in the TCP / IP protocol; registered ports, numbered 1024-49151 (48128 in total), used to allocate to specific network applications, services, or protocols developed by enterprises or developers; and dynamic / private ports, numbered 49152-65535 (16384 in total), which are temporarily allocated ports and not permanently bound to any specific service.

[0095] In some implementations, high-risk ports refer to ports that are open by default, have high-risk vulnerabilities in their corresponding services, or are easily exploited by attackers to launch brute-force attacks, remote code execution, data theft, or other similar attacks. For example, port 445 corresponds to the Server Message Block Protocol (SLP) and is used for file sharing; port 135 corresponds to the Remote Procedure Call Protocol (RPC) and is used for remote procedure calls; and port 3389 corresponds to the Remote Desktop Protocol (RDP) and is used for Windows Remote Desktop.

[0096] In some implementations, the number of IPs with the same network bit as the first suspicious IP refers to the total number of associated IPs that are in the same network segment (i.e., have the same network bit) as the first suspicious IP. The network bit here is determined by the subnet mask of the IP address. For example, if the first suspicious IP is 192.168.1.10 ( / 24 network segment), then the range of IPs with the same network bit is 192.168.1.0-192.168.1.255.

[0097] For example, the abnormal features provided in this application are shown in Table 2 below.

[0098] Table 2 Abnormal Characteristics Table

[0099]

[0100] Examples of features extracted from communication data are shown in Table 3 below.

[0101] Table 3 Examples of IP Characteristics

[0102]

[0103] In some embodiments, step S202 can be implemented as steps a1 to a3.

[0104] Step a1: Preprocess the communication data of each first suspicious IP and filter out the communication data in abnormal time periods.

[0105] In some implementations, communication data during abnormal time periods refers to network communication records generated within time intervals that deviate from normal business communication patterns. These may include sudden increases / decreases in communication frequency, concentrated abnormal IP interactions, frequent access to high-risk ports, etc., and are usually associated with the probing, outbreak, and incubation phases of network attacks.

[0106] In some implementations, the acquired communication data typically spans a large time period, often covering communication records from several days to over ten days. However, this type of data exhibits a significant uneven temporal distribution: the amount of communication data is extremely small in most time periods, with large amounts of data generated only in a few time periods (such as peak business periods or periods of attack outbreaks). Directly using the entire volume of communication data for outlier detection can negatively impact the accuracy of the detection results: records from most periods with low data volumes lower the statistical average of the features, causing deviations in the calculated normal range threshold, ultimately reducing the accuracy of anomaly detection. Therefore, it is necessary to filter out communication data from outlier time periods.

[0107] For example, the distribution of all communication data is as follows: Figure 4 As shown, the volume of communication data was huge only in mid-October, while the volume of data at other times was extremely small.

[0108] In some implementations, abnormal time periods can be extracted by dividing the communication data into time windows: the data is divided into time windows (e.g., 1 hour), with the time window set according to the time span and distribution of the communication data. The amount of data within each time window is counted, and the mean and variance of the data are calculated. Abnormal event windows are filtered out according to the 3 sigma rule, and consecutive time windows are merged to finally obtain multiple abnormal time periods.

[0109] For example, the distribution of communication data during abnormal time periods is as follows: Figure 5 As shown, the period from October 9th to October 18th was segmented using a time window, and thus considered an abnormal time period.

[0110] Step a2: Extract the communication data features of the abnormal time period and perform standardization processing to obtain the standardized data of each first suspicious IP.

[0111] In some implementations, standardized data refers to processed data that maps the original data to a uniform numerical range or distribution interval through specific mathematical transformations. This eliminates the impact of differences in units (such as connection frequency in "times / minute" or data packet size in "KB") and numerical magnitudes of the original data, making different types of feature data comparable and fusionable.

[0112] For example, z-score standardization can be used to standardize features. For each feature x, the standardized value is x′, calculated using the following formula:

[0113]

[0114] Where mean(x) is the characteristic mean and σ is the characteristic variance.

[0115] Examples of standardized feature values ​​are shown in Table 4 below.

[0116] Table 4. Examples of standardized eigenvalues

[0117]

[0118] Step a3: Perform anomaly detection on the standardized data of each first suspicious IP to obtain the anomaly characteristics of each first suspicious IP.

[0119] In some implementations, anomaly detection of communication data can be performed using statistical analysis methods. Based on historical communication data, a statistical baseline (such as mean, variance, percentile) can be calculated, and deviations from the baseline range are judged as anomalies. Alternatively, machine learning methods can be used to automatically learn normal patterns from massive communication data through algorithms (such as unsupervised learning and supervised learning) and identify anomalies that deviate from the patterns.

[0120] For example, algorithms such as Extended Isolation Forest with Copula-Based Outlier Detection (ECOD), Isolation Forest, One-Class Support Vector Machine (OneClassSVM), Local Outlier Factor (LOF), and clustering can be used to detect anomalies in standardized communication data and identify IP anomaly features and anomaly scores.

[0121] For example, taking the ECOD algorithm as an example, ECOD is an unsupervised outlier detection algorithm based on the Empirical Cumulative Distribution Function (ECDF). It combines outliers from different dimensions of the same sample, and determines whether a data point is an outlier by calculating the outlier of each sample. The higher the outlier, the greater the likelihood that the data point is considered an outlier.

[0122] Suppose that the connected dataset contains n samples, and each sample contains d features.

[0123] For each feature dimension j, calculate its left-tailed and right-tailed ECDFs. ECDF is a non-parametric method for describing the distribution of data; it represents the proportion of observations less than or equal to a certain value. The left-tailed ECDF is calculated as follows:

[0124]

[0125] in, Indicates left tail ECDF, This represents the value of the i-th sample in the j-th feature dimension, where n is the number of samples. The purpose of the left-tailed ECDF is to use historical normal data to statistically analyze a certain feature (…). The probability that the number of times a connection is made to other IPs or the number of different IPs connected to is less than or equal to a certain value z can be directly used as a normal distribution scale for this feature.

[0126] The calculation method for the right tail ECDF is as follows:

[0127]

[0128] in, Indicates right tail ECDF, This represents the value of the i-th sample in the j-th feature dimension, where n is the number of samples. The calculation logic of the right-tailed ECDF is to use historical data to statistically determine the probability that the feature value is not less than a certain value. Its function is to establish a quantification baseline for features with excessively high values ​​in the connected data, filling the gap in the detection of high-value anomalies by the left-tailed ECDF.

[0129] Next, we calculate the skewness for each feature dimension j. Skewness is a statistic that describes the shape of the data distribution and measures the degree of skewness in the data distribution.

[0130]

[0131] Where, γ j This represents the skewness of feature dimension j. This represents the value of the i-th sample in the j-th feature dimension, where n is the number of samples. It is the sample mean of the j-th feature. Skewness is calculated by amplifying the difference between the positive and negative directions of the deviation from the mean by raising the numerator to the cube, and reducing the deviation by raising the denominator to the power of 1.5 by raising the denominator to the power of n-1. Skewness can eliminate the influence of the dispersion of data, retaining only the asymmetric information of the distribution pattern.

[0132] For a sample in a connected dataset, calculate its three outliers and sum them logarithmically. The calculation method for outliers considering only the left tail is as follows:

[0133]

[0134] Among them, O left-only (X i ) indicates an outlier with the left tail. This indicates the application of left-tailed ECDF to a single sample feature value, where d represents the number of features. Let represent the value of the i-th sample in the j-th feature dimension. Calculating the left-tailed outlier can quantify the degree of anomaly in connected data where feature values ​​are too low.

[0135] The outlier calculation method considering only the right tail is as follows:

[0136]

[0137] Among them, O right-only (X i ) indicates an outlier with the right tail. This indicates the application of right-tailed ECDF to a single sample feature value, where d represents the number of features. This represents the value of the i-th sample in the j-th feature dimension. This represents the application of the left-tailed ECDF to the eigenvalues ​​of a single sample. Calculating the right-tailed outlier can quantify the degree of anomalousness in connected data with excessively high eigenvalues.

[0138] Then, select either the left-tailed or right-tailed ECDF based on the skewness. If the skewness is negative, the left tail is longer, so the left-tailed ECDF is selected. If the skewness is positive, the right tail is longer, so the right-tailed ECDF is selected. The calculation method is as follows:

[0139]

[0140] Among them, O auto (X i ) represents the outlier of the automatically selected ECDF, γ j This represents the skewness of feature dimension j. This represents the value of the i-th sample in the j-th feature dimension. This indicates the application of right-tailed ECDF to a single sample feature value, where d represents the number of features. By selecting the correct tail distribution for each feature and then summing the scores, outlier calculations are made to fit the distribution characteristics of each feature, avoiding the limitations of fixed left / right tail strategies.

[0141] Finally, the largest outlier among the three outliers is considered as the outlier for sample i. The 3sigma rule is used to filter features, identifying anomalous features that significantly deviate from the normal range.

[0142] O i =max{O left-only (X i ),O right-only (X i ),O auto (X i )}

[0143] For example, the anomaly score of IP after ECOD anomaly detection is shown in Table 5 below.

[0144] Table 5. Example of IP anomaly scoring

[0145]

[0146]

[0147] In some implementations, dimensionality reduction can also be used to visualize ECOD results, transforming high-dimensional feature data into directly observable three-dimensional spatial images, and intuitively analyzing the spatial distribution patterns of anomaly detection results.

[0148] For example, by using PCA (Principal Component Analysis) to reduce dimensionality to three-dimensional space, high-dimensional features can be compressed into three comprehensive dimensions while retaining the main distribution information of the data. Then, anomaly detection algorithms such as ECOD are used to mark outliers, and the location of these points is displayed in three-dimensional space from different perspectives (such as whether outliers are clustered, whether they are far from normal point clusters, or whether they are distributed in a specific area).

[0149] For example, Figure 6 Each small graph in the chart is a view in three-dimensional space, used to present the distribution of data points. From these different perspectives, it can be observed that: normal data points tend to be relatively concentrated, forming relatively dense clusters; abnormal data points are mostly scattered around normal clusters, or in some areas far from normal clusters, showing different distribution characteristics from normal data.

[0150] S203. Based on the abnormal characteristics of each first suspicious IP, generate a description text of the abnormal cause for each first suspicious IP.

[0151] In some implementations, the anomaly description text can transform scattered anomaly features into readable and effective information, and connect attack clues, shortening the time from anomaly discovery to risk assessment and improving the efficiency of network attack tracing.

[0152] In some implementations, the anomaly description text for each first suspicious IP can be generated by first extracting parameter information from the IP’s abnormal characteristics, then matching this parameter information with known attack behavior patterns (such as DDoS attacks, port scanning, C2 communication), and finally using natural language to concatenate the features and matching results to clearly explain what specific abnormal characteristics of the IP indicate what kind of attack behavior or risk is suspected.

[0153] In some implementations, differentiated anomaly description text templates can be designed for different roles; for example, operations and maintenance personnel may focus on technical details, while management may focus on risk impact.

[0154] For example, an example of an exception cause description text is shown in Table 6 below.

[0155] Table 6. Examples of Text Describing the Reasons for Abnormalities

[0156]

[0157]

[0158]

[0159] S204. Conduct source tracing and analysis based on the anomaly description text of each first suspicious IP.

[0160] In some implementations, source tracing and analysis refers to a systematic analysis process that uses clues such as descriptions of the causes of anomalies to trace the origin, propagation path, motivation, and scope of related impact of cyberattacks, ultimately forming a clear understanding of the cyberattacks, rather than merely remaining at the superficial stage of discovering anomalies.

[0161] For example, source tracing and analysis can be performed by querying threat intelligence of abnormal IPs, submitting the threat intelligence and description of the cause of the anomaly to operations experts or large models for analysis.

[0162] In some embodiments, source tracing and analysis are performed based on the anomaly description text of each suspicious IP, including: determining whether each first suspicious IP is an attacking IP based on the anomaly description text of each first suspicious IP, and obtaining the source tracing result; if the source tracing result includes the attacking IP, the source tracing ends; if the source tracing result does not include the attacking IP, the source tracing is iterated.

[0163] In some implementations, operations experts or large-scale models can first break down the description of the anomaly into a structured list of risks corresponding to the features. For example, from the description of the anomaly, features such as time anomaly (non-business hours), behavior anomaly (high-frequency connections and high-risk port access), and cluster association (multiple IPs collaborating on the same network segment) can be extracted. Each feature is labeled with its corresponding attack mode and risk level. Secondly, verification criteria are matched for each feature dimension. For example, "time anomaly" is accompanied by "the average frequency of connections of this IP in the same historical period", "high-risk port access" is accompanied by "attack cases of port 445 being used in the past six months", and "cluster association" is accompanied by "the location of the IPs on the same network segment". Finally, a decision judgment matrix is ​​provided, listing the judgment conditions for attacking IPs. For example, if multiple features meet the network attack characteristics, or a single feature has a high risk level and a historical attack record, the information can be verified against the matrix to quickly determine whether it is the source of the attacking IP.

[0164] In some embodiments, during each iteration of source tracing, based on the anomaly description text of each first suspicious IP in the previous iteration of source tracing, N second suspicious IPs are determined from M first suspicious IPs; N is an integer less than or equal to M; anomaly detection is performed based on the communication data of the second suspicious IPs to obtain the anomaly characteristics of each second suspicious IP; based on the anomaly characteristics of each second suspicious IP, anomaly description text of each second suspicious IP is generated; and source tracing and analysis are performed based on the anomaly description text of each second suspicious IP.

[0165] In some implementations, in each source tracing iteration, based on the anomaly description text of the M first suspicious IPs identified in the previous round, N second suspicious IPs with more prominent risks are first selected; then, for the N second suspicious IPs, their communication data are re-analyzed to obtain more accurate anomaly characteristics; then, more detailed anomaly description text is generated based on the new anomaly characteristics; finally, source tracing analysis is carried out based on the more accurate anomaly description text to further confirm whether these second suspicious IPs contain attack behavior IPs, gradually eliminating low-risk IPs and filtering high-risk IPs, so that the source tracing results are more accurate.

[0166] For example, such as Figure 7As shown in the embodiments of this application, the network attack tracing method can first obtain the communication data of a first suspicious IP, then perform data preprocessing, and filter the communication data of abnormal time periods according to time windows; next, extract the communication data features of the abnormal time periods and perform standardization operations, and then perform anomaly detection on the standardized features through an anomaly detection algorithm; generate anomaly description text for the detected abnormal IPs, and submit the anomaly description text to a human or large model, and combine it with the threat intelligence of the first suspicious IP to determine whether it is an attacking IP. If it is an attacking IP, the tracing result is output; if it is not an attacking IP, the tracing is iterative, a second suspicious IP is filtered out, communication data is obtained, and the above steps are executed again.

[0167] The foregoing mainly describes the solution provided in this application. Accordingly, this application also provides a website identification device for implementing the above-described method embodiments.

[0168] like Figure 8 The schematic diagram shown illustrates the structure of a network attack tracing device 700. The network attack tracing device 700 may include an acquisition module 701 and a processing module 702. The acquisition module 701 is used to execute... Figure 2 The illustrated method includes step S201; the extraction module 702 is used to perform this operation. Figure 2 The operations of steps S202, S203 and S204.

[0169] In some embodiments, the website identification device includes hardware structures and / or software modules corresponding to the execution of each function in order to achieve the above-described functions. Those skilled in the art will readily recognize that, based on the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0170] This application embodiment can divide the website identification device into functional modules according to the above method embodiment. For example, each function can be divided into a separate functional module, or two or more functions can be integrated into a feature extraction module. The integrated module can be implemented in hardware or as a software functional module. It should be noted that the module division in this application embodiment is illustrative and only represents one logical functional division. In actual implementation, there may be other division methods.

[0171] like Figure 9As shown, the electronic device 800 provided in this application embodiment may include a processor 802, a bus 804, a communication interface 803, and a memory 801. The processor 802, the memory 801, and the communication interface 803 communicate with each other via the bus 804. It should be understood that this application does not limit the number of processors and memories in the network device.

[0172] The 804 bus can be a PCI bus, an Extended Industry Standard Architecture (EISA) bus, or a UB bus, etc. Buses can be divided into address buses, data buses, control buses, etc. For ease of representation, Figure 9 The bus is represented by only one line, but this does not mean that there is only one bus or one type of bus. Bus 804 may include a path for transmitting information between various components of the network device (e.g., memory 801, processor 802, communication interface 803).

[0173] Processor 802 may include any one or more processors such as CPU, graphics processing unit (GPU), microprocessor (MP), or digital signal processor (DSP).

[0174] The memory 801 may include volatile memory, such as random access memory (RAM). The processor 802 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0175] The communication interface 803 uses transceiver modules, such as, but not limited to, network interface cards and transceivers, to enable communication between network devices and other devices or communication networks.

[0176] The memory 801 stores executable program code, and the processor 802 executes the executable program code to implement the functions of the aforementioned method embodiments. That is, the memory 801 stores instructions for executing the aforementioned website identification method.

[0177] In another aspect, a computer-readable storage medium is provided, wherein at least one computer program is stored in the computer-readable storage medium, and the at least one computer program is loaded and executed by a processor to implement the website identification method provided in the above-described method embodiments.

[0178] In another aspect, a computer program product is provided, which includes a computer program or instructions that, when executed by a processor, implement the website identification method provided in the above-described method embodiments.

[0179] Through the above description of the implementation methods, those skilled in the art will clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the module can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, modules, and units described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0180] Since the bevel feature extraction module, computer-readable storage medium, and computer program product in the embodiments of the present invention can be applied to the above method, the technical effects that can be obtained can also be referred to the above method embodiments. The embodiments of the present invention will not be repeated here.

[0181] The method steps in this embodiment can be implemented in hardware or by a processor executing software instructions. The software instructions can consist of corresponding software modules, which can be stored in random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, portable hard disks, CD-ROMs, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and storage medium can reside in an ASIC. Alternatively, the ASIC can reside in a network device. Of course, the processor and storage medium can also exist as discrete components in the network device.

[0182] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer programs or instructions. When the computer program or instructions are loaded and executed on a computer, the processes or functions of the embodiments of this application are performed, in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user equipment, or other programmable module. The computer program or instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another. For example, a computer program or instructions can be transferred from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium, such as a floppy disk, hard disk, or magnetic tape; it can also be an optical medium, such as a digital video disc (DVD); or it can be a semiconductor medium, such as a solid-state drive (SSD).

[0183] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for tracing the origin of a network attack, characterized in that, The method includes: Obtain communication data from M first suspicious IPs; the first suspicious IPs include victim IPs and / or suspected attack IPs; M is an integer greater than zero; Anomaly detection is performed on the communication data of each first suspicious IP to obtain the abnormal characteristics of each first suspicious IP; the abnormal characteristics include: connection characteristics, port characteristics, and the number of IPs in the same network segment as the first suspicious IP; Based on the abnormal characteristics of each first suspicious IP, generate a description text of the abnormal cause for each first suspicious IP; The source of the anomaly is determined based on the description of the cause of the anomaly for each first suspicious IP.

2. The method according to claim 1, characterized in that, If the suspected attacking IP is the destination IP in the communication data, the connection characteristics of the source IP in the communication data include at least one of the following: the number of times it connects to other IPs, the number of different IPs it connects to, the maximum number of times it connects to other IPs within a single time window, the number of bytes of data packets sent to other IPs, and the number of data packets sent to other IPs. If the suspected attacking IP is the source IP in the communication data, the connection characteristics of the destination IP in the communication data include at least one of the following: the number of times it is connected by other IPs, the number of IPs connected by different IPs, the maximum number of times it is connected by other IPs within a time window, the number of bytes of data packets received from other IPs, and the number of data packets received from other IPs.

3. The method according to claim 1, characterized in that, The port features include at least one of the following: When the first suspicious IP is the source IP, the number of destination port types of the first suspicious IP, the number of high-risk ports among the destination ports, the proportion of high-risk ports among the destination ports, and the number of source port types of the first suspicious IP.

4. The method according to claim 1, characterized in that, The source tracing and analysis based on the anomaly description text of each suspicious IP includes: Based on the anomaly description text of each first suspicious IP, determine whether each first suspicious IP is an IP of attack behavior, and obtain the source tracing result; If the source tracing results include the IP address of the attacking party, the source tracing process ends. If the source tracing results do not include the IP address of the attacking behavior, iterative source tracing is performed.

5. The method according to claim 4, characterized in that, The iterative source tracing, in the case where the source tracing results do not include the attacking IP, includes: In each iteration of the source tracing process, based on the anomaly description text of each first suspicious IP in the previous iteration of source tracing, N second suspicious IPs are determined from the M first suspicious IPs; where N is an integer less than or equal to M. Anomaly detection is performed based on the communication data of the second suspicious IP to obtain the abnormal characteristics of each second suspicious IP; Based on the abnormal characteristics of each second suspicious IP, generate a description text of the abnormal cause for each second suspicious IP; The source of the anomaly is determined based on the description of the cause of the anomaly for each of the second suspicious IP addresses.

6. The method according to claim 1, characterized in that, The anomaly detection of the communication data of each first suspicious IP, to obtain the anomaly characteristics of each first suspicious IP, includes: The communication data of each first suspicious IP is preprocessed to filter out communication data from abnormal time periods; The communication data features of the abnormal time period are extracted and standardized to obtain the standardized data of each first suspicious IP. Anomaly detection is performed on the standardized data of each first suspicious IP to obtain the abnormal characteristics of each first suspicious IP.

7. A network attack tracing device, characterized in that, The device includes: an acquisition module and a processing module; The acquisition module is used to acquire communication data of M first suspicious IPs; the first suspicious IPs include victim IPs and / or suspected attack IPs; M is an integer greater than zero; The processing module is used to perform anomaly detection on the communication data of each first suspicious IP and obtain the abnormal characteristics of each first suspicious IP. The processing module is also used to generate an anomaly description text for each first suspicious IP based on the anomaly characteristics of each first suspicious IP; The processing module is also used to perform source tracing and analysis based on the anomaly description text of each first suspicious IP.

8. An electronic device, characterized in that, It includes a processor and a memory, the processor being coupled to the memory; the memory is used to store computer instructions, which are loaded and executed by the processor to enable the computer device to implement the network attack attribution method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one computer program, which is loaded and executed by a processor to implement the network attack attribution method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when run on an electronic device, causes the electronic device to perform the network attack attribution method as described in any one of claims 1 to 6.

Images