A method for tracing malicious IP identity information based on intelligent agents

Abstract

This invention relates to a method for tracing malicious IP identity information based on an intelligent agent. The method includes constructing a tracing intelligent agent, which comprises a task planning module, a tool invocation module, and a result verification module; receiving the IP address to be traced and initiating the tracing task; dynamically planning the tracing process and deciding to invoke at least one tracing tool; automatically invoking the selected tracing tool and extracting the identity information associated with the IP address; verifying the extracted identity information; if the verification fails, replanning and invoking other tracing tools until the verification passes or no tools can be invoked; and outputting the verified identity information as the tracing result. The beneficial effects of this invention are: by using an intelligent agent to understand and plan the task, this invention organically, efficiently, and completely automatically organizes the fragmented tracing process, completely replacing manual tracing.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence technology, and in particular relates to a method for tracing the malicious IP identity information based on intelligent agents. Background Technology

[0002] With the increasing sophistication of information technology infrastructure, cyberattacks are becoming increasingly rampant. For network security administrators, tracing and identifying attacking IPs, gathering more information about attackers, deterring them, and even reporting to regulatory agencies are all routine tasks. However, tracing malicious IPs is extremely difficult. The techniques used for tracing attackers primarily rely on honeypot technology and manual analysis of attack packets to extract characteristics. But both of these techniques have limitations to varying degrees.

[0003] Honeypot-based attribution tracing technology requires attackers to access the honeypot deployed by the administrator through a browser or hacking attack. The honeypot automatically triggers exploits of vulnerabilities in the attacker's browser and software to obtain information such as the attacker's operating system fingerprint. This information is then correlated with past intelligence databases for analysis. The biggest challenge of this technology is that attackers must have access to the honeypot system, and their computers must have vulnerabilities in the corresponding software, making it difficult for network security administrators to proactively control and trace the attacker's origin.

[0004] Manual analysis of attack packets to extract features relies on expert experience to analyze the characteristics of attack packets and extract the attacker's fingerprint information for tracing the source. However, attack packets do not necessarily carry much information, and it is difficult to trace the source of well-disguised attackers. Therefore, both of these techniques have limitations in different dimensions. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method for tracing malicious IP identity information based on intelligent agents.

[0006] Firstly, a method for tracing malicious IP identity information based on intelligent agents is provided, including: S1. Construct a source tracing intelligent agent, which includes a task planning module, a tool invocation module, and a result verification module; S2. Receive the IP address to be traced and start the tracing task; S3. Dynamically plan the tracing process through the task planning module and decide to call at least one tracing tool; S4. The selected tracing tool is automatically invoked through the tool invocation module, and the identity information associated with the IP address is extracted; S5. Verify the extracted identity information through the result verification module; S6. If the verification fails, return to the task planning module to replan and call other tracing tools, repeating S3 to S5 until the verification passes or there are no tools to call. S7. Output the verified identity information as the tracing result.

[0007] Preferably, in S3, the tracing tools include: an IP Whois tracing tool, an IP query historical domain name resolution tool, and a webpage content extraction tool.

[0008] Preferably, in S4, the tool calling module can automatically extract the input parameters required to call the source tracing tool, including the IP address and the domain name.

[0009] Preferably, in S4, when the tracing tool is an IP Whois tracing tool, the name of the organization to which the IP belongs and the whois text information are extracted.

[0010] Preferably, in step S4, if identity association information associated with the IP address is extracted, then step S5 is executed; if identity information associated with the IP address is not extracted, then it is determined whether there are other tracing tools that have not yet been called and whose calling conditions can be met. If so, then the other tracing tool is called to try to extract the identity association information again.

[0011] Secondly, a malicious IP identity information tracing device based on intelligent agents is provided for executing any of the methods described in the first aspect, including: The building unit is used to construct the traceability intelligent agent, which includes a task planning module, a tool invocation module, and a result verification module. The receiving unit is used to receive the IP address to be traced and start the tracing task. The planning unit is used to dynamically plan the tracing process through the task planning module and decide to call at least one tracing tool. The invocation unit is used to automatically invoke the selected tracing tool through the tool invocation module and extract the identity information associated with the IP address; The verification unit is used to verify the extracted identity information through the result verification module; The return unit is used to return to the task planning module to replan and call other tracing tools if the verification fails, repeating the execution from the planning unit to the verification unit until the verification passes or there are no tools to call. The output unit is used to output the verified identity information as the tracing result.

[0012] Thirdly, a computer storage medium is provided, wherein a computer program is stored therein; when the computer program is run on a computer, the computer causes the computer to perform any of the methods described in the first aspect.

[0013] Fourthly, an electronic device is provided, comprising: Memory, used to store computer programs; A processor for executing the computer program to implement the method as described in any of the first aspects.

[0014] The beneficial effects of this invention are: 1. This invention is based on Agentic Agent technology. It uses intelligent agents to understand and plan tasks, thereby organizing the fragmented tracing process organically, efficiently and completely automatically, which can completely replace manual tracing.

[0015] 2. The source tracing tools are fragmented and have large differences in input parameters. This invention is based on the semantic understanding and logical reasoning capabilities of a large model to understand and extract the input parameters of the source tracing tools, thereby automating the invocation of source tracing tools and the extraction of source tracing information.

[0016] 3. This invention uses a cumulative verification method for tracing results. Based on the continuously accumulating tracing information fed back by the tracing tools, the verification module automatically determines the end of the tracing task. Specifically, for each additional instance of tracing information obtained, the result verification module performs a tracing result verification. If the tracing evidence is sufficient, the tracing task is automatically stopped, thereby achieving a balance between input and output. Attached Figure Description

[0017] Figure 1 The overall structural block diagram of the malicious IP identity tracing method based on a large model provided by the present invention; Figure 2 This invention provides a tracing process diagram when only the ipwhois tracing tool is included. Figure 3 The diagram illustrates the tracing process when two tracing tools are included, as provided by this invention. Detailed Implementation

[0018] The present invention will be further described below with reference to embodiments. The description of the embodiments below is only for the purpose of helping to understand the present invention. It should be noted that those skilled in the art can make several modifications to the present invention without departing from the principle of the present invention, and these improvements and modifications also fall within the protection scope of the claims of the present invention.

[0019] Example 1: To address the problems in the existing technology, Embodiment 1 of this application provides a method for tracing malicious IP identity information based on intelligent agents. Through intelligent agent technology, it achieves fully automated tracing of malicious IPs. Throughout the tracing process, it dynamically plans the tracing path, automatically calls tracing tools to extract tracing information, and employs a reflective verification mechanism to verify the tracing results, thereby ensuring the accuracy of the tracing results.

[0020] Specifically, such as Figure 1 As shown, the method includes: S1. Construct a source tracing intelligent agent, which includes a task planning module, a tool invocation module, and a result verification module.

[0021] The task planning module is used for dynamic planning and decision-making of the tracing process, and completes the entire tracing process in full automation; the tool calling module is used to realize the automated calling of fragmented, heterogeneous and multi-source tracing tools and the automated extraction of tracing information; the result verification module is used to realize the reflection and verification of the identity information of the tracing results and feed it back to the task planning module to realize the dynamic iterative evolution of the tracing process.

[0022] S2. Receive the IP address to be traced and start the tracing task.

[0023] S3. Dynamically plan the tracing process through the task planning module and decide to call at least one tracing tool.

[0024] Specifically, dynamic programming selects and invokes tracing tools based on the input and information returned from the previous tracing task. By default, it judges based on the tool's parameters; if the currently obtained information matches the parameter value type of the tool's input, then the tool is considered ready to be invoked. Parameter value types include IP address, URL, domain name, etc.

[0025] In addition, in S3, the source tracing tools include: IP Whois source tracing tool, IP query historical domain name resolution tool, and web page content extraction tool.

[0026] S4. The selected tracing tool is automatically invoked through the tool invocation module, and the identity information associated with the IP address is extracted.

[0027] In S4, the tool calling module can automatically extract the input parameters required to call the source tracing tool, including IP address and domain name.

[0028] It should be noted that this application has many ways of calling the source tracing tool task. When the source tracing tool is an IP Whois source tracing tool, the name of the organization to which the IP belongs and the whois text information are extracted.

[0029] For example, such as Figure 2As shown, querying IPwhois information is registered as a tracing tool for the intelligent agent (the input parameter for the tool is an IP address). When an IP address is input to initiate a tracing task, the planning module determines that the current task is a new tracing task, and then identifies the tracing tool that has not been called before as the IPwhois tracing tool. The planning module plans the execution task as "IPwhois tracing tool execution task," and executes the tracing tool call task. The tool module extracts the organization name and WHOIS text information of the IP address, and feeds the tracing information back to the result verification module. If the result verification module passes, the tracing process ends. For example, if the IP address 8.8.8.8 is input into this tracing system, it will trace the IP address to Google LLC. This is a public DNS address, and its ownership information is definite.

[0030] Furthermore, if multiple source tracing tools exist, the order in which they are invoked can be dynamically adjusted. For example, when multiple tools meet the criteria, the tool with the highest historical hit count is selected first.

[0031] S5. Verify the extracted identity information through the result verification module.

[0032] Specifically, the logic of verification essentially requires sufficient evidence. The default convention is: the traceable identity information must have at least one identity identifier that semantically matches the identity identifier, and at least one tracing tool must return contextual evidence.

[0033] S6. If the verification fails, return to the task planning module to replan and call other tracing tools, repeating S3 to S5 until the verification passes or there are no tools to call.

[0034] S7. Output the verified identity information as the tracing result.

[0035] Example 2: Based on Embodiment 1, Embodiment 2 of this application provides a more specific method for tracing malicious IP identity information based on an intelligent agent, supporting dynamically expanded tracing tools. The entire tracing intelligent agent automatically understands and invokes the tracing tools, including: S1. Construct a source tracing intelligent agent, which includes a task planning module, a tool invocation module, and a result verification module.

[0036] S2. Receive the IP address to be traced and start the tracing task.

[0037] S3. Dynamically plan the tracing process through the task planning module and decide to call at least one tracing tool.

[0038] S4. The selected tracing tool is automatically invoked through the tool invocation module, and the identity information associated with the IP address is extracted.

[0039] In S4, if identity association information associated with the IP address is extracted, then S5 is executed; if identity association information associated with the IP address is not extracted, then it is determined whether there are other tracing tools that have not yet been called and whose calling conditions can be met. If so, then the other tracing tool is called to try to extract identity association information again.

[0040] For example, this embodiment registers two source tracing tools: an IP query tool for historical domain name resolution (input parameter is IP address) and a tool for extracting source tracing information from the homepage of the website corresponding to the domain name (input parameter is domain name). The detailed execution flow is as follows... Figure 3 As shown in the figure. The information extracted from the source tracing tool includes email addresses, mobile phone numbers, ID card numbers, online nicknames, and social media accounts.

[0041] S5. Verify the extracted identity information through the result verification module.

[0042] It should be noted that the underlying model of the intelligent agent possesses very strong advantages in semantic and linguistic logical reasoning. It is capable of making evidence and logical judgments based on various traceability information associated with IP addresses, similar to human capabilities.

[0043] S6. If the verification fails, return to the task planning module to replan and call other tracing tools, repeating S3 to S5 until the verification passes or there are no tools to call.

[0044] S7. Output the verified identity information as the tracing result.

[0045] It should be noted that the parts in this embodiment that are the same as or similar to those in Embodiment 1 can be referred to each other, and will not be repeated in this application.

[0046] Example 3: Based on Embodiment 2, Embodiment 3 of this application provides a malicious IP identity information tracing device based on intelligent agents, including: The building unit is used to construct the traceability intelligent agent, which includes a task planning module, a tool invocation module, and a result verification module. The receiving unit is used to receive the IP address to be traced and start the tracing task. The planning unit is used to dynamically plan the tracing process through the task planning module and decide to call at least one tracing tool. The invocation unit is used to automatically invoke the selected tracing tool through the tool invocation module and extract the identity information associated with the IP address; The verification unit is used to verify the extracted identity information through the result verification module; The return unit is used to return to the task planning module to replan and call other tracing tools if the verification fails, repeating the execution from the planning unit to the verification unit until the verification passes or there are no tools to call. The output unit is used to output the verified identity information as the tracing result.

[0047] It should be noted that the system provided in this embodiment is the corresponding device for the method provided in embodiment 2. Therefore, the parts that are the same as or similar to those in embodiment 2 in this embodiment can be referred to each other, and will not be described again in this application.

[0048] In summary, this invention, based on intelligent agent technology, provides a more proactive, intelligent, and automated analysis method. This method has low labor costs, good results, strong scalability, and universality, and can perform source tracing analysis on the identity information of any IP.

Claims

1. A method for tracing malicious IP identity information based on intelligent agents, characterized in that, include: S1. Construct a source tracing intelligent agent, which includes a task planning module, a tool invocation module, and a result verification module; S2. Receive the IP address to be traced and start the tracing task; S3. Dynamically plan the tracing process through the task planning module and decide to call at least one tracing tool; S4. The selected tracing tool is automatically invoked through the tool invocation module, and the identity information associated with the IP address is extracted; S5. Verify the extracted identity information through the result verification module; S6. If the verification fails, return to the task planning module to replan and call other tracing tools, repeating S3 to S5 until the verification passes or there are no tools to call. S7. Output the verified identity information as the tracing result.

2. The method for tracing malicious IP identity information based on intelligent agents according to claim 1, characterized in that, In S3, the source tracing tools include: IP Whois source tracing tool, IP query historical domain name resolution tool, and web page content extraction tool.

3. The method for tracing malicious IP identity information based on intelligent agents according to claim 2, characterized in that, In S4, the tool calling module can automatically extract the input parameters required to call the source tracing tool, including IP address and domain name.

4. The method for tracing malicious IP identity information based on intelligent agents according to claim 3, characterized in that, In S4, when the tracing tool is an IP Whois tracing tool, the name of the organization to which the IP belongs and the whois text information are extracted.

5. The method for tracing malicious IP identity information based on intelligent agents according to claim 4, characterized in that, In S4, if identity association information associated with the IP address is extracted, then S5 is executed; if identity association information associated with the IP address is not extracted, then it is determined whether there are other tracing tools that have not yet been called and whose calling conditions can be met. If so, then the other tracing tool is called to try to extract identity association information again.

6. A malicious IP identity information tracing device based on intelligent agents, characterized in that, For performing the method according to any one of claims 1 to 5, comprising: The building unit is used to construct the traceability intelligent agent, which includes a task planning module, a tool invocation module, and a result verification module. The receiving unit is used to receive the IP address to be traced and start the tracing task. The planning unit is used to dynamically plan the tracing process through the task planning module and decide to call at least one tracing tool. The invocation unit is used to automatically invoke the selected tracing tool through the tool invocation module and extract the identity information associated with the IP address; The verification unit is used to verify the extracted identity information through the result verification module; The return unit is used to return to the task planning module to replan and call other tracing tools if the verification fails, repeating the execution from the planning unit to the verification unit until the verification passes or there are no tools to call. The output unit is used to output the verified identity information as the tracing result.

7. A computer storage medium, characterized in that, The computer storage medium stores a computer program; when the computer program is run on the computer, it causes the computer to perform the method described in any one of claims 1 to 5.

8. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the method as described in any one of claims 1 to 5.

Images