A network attack detection method, device, apparatus and storage medium

Abstract

The application discloses a network attack detection method and device, equipment and storage medium, apply to network security detection technical field, including obtaining the access log data of the system to be detected;Obtain the access demand data of a plurality of accounts from the access log data;The access demand data of a plurality of accounts is handled, and feature data is obtained;The account behavior feature and resource request feature are analyzed, and a graph structure model is obtained;The clustering analysis technique is used to identify and divide the graph structure model, the obtained collaborative account data set is handled, and collaborative detection data is obtained;The sliding time window analysis technique is used to analyze the resource request feature and time dimension feature, and resource access frequency data is obtained;Based on the collaborative detection data and the resource access frequency data, the attack detection result of the system to be detected is obtained.The method provided by the application can solve the technical problem that the account collaboration cannot be effectively detected in the prior art.

Description

Technical Field

[0001] This invention relates to the field of network security detection technology, and in particular to a network attack detection method, apparatus, device, and storage medium. Background Technology

[0002] With the rapid development of network applications, there are a large number of account and resource interaction behaviors in the system, and attackers' penetration methods for multi-account and multi-host environments are becoming increasingly complex.

[0003] In existing technologies, the identification of multi-account collaborative access behavior mainly relies on static threshold rules. This mainly involves setting a fixed upper limit on the access frequency of a single account. Once the access frequency of an account exceeds this threshold, an alarm is triggered. However, this method only focuses on whether the behavior of a single account breaks through the preset frequency in an instant. Attackers can break down a large data enumeration task into many small tasks and assign them to multiple low-privilege accounts under their control for execution. The execution volume of each account is far below the static threshold and is consistent with its own normal behavior baseline.

[0004] Therefore, existing technologies cannot detect any anomalies in the detection results of each account. However, when the access results of these accounts are aggregated in the background, the attacker has successfully stolen the complete dataset. This highly covert and harmful attack method can remain hidden in the system for a long time without being detected, leading to the illegal acquisition of sensitive data and posing a serious threat to system security. Summary of the Invention

[0005] This invention provides a network attack detection method, apparatus, device, and storage medium, which solves the technical problem in the prior art that it is impossible to effectively detect distributed enumeration attacks carried out by accounts in concert, so as to achieve accurate identification of covert cross-account collaborative attack behavior and improve system security.

[0006] To address the aforementioned technical problems, this invention provides a network attack detection method, the method comprising: Obtain access log data from the system under test; Based on the access requests of several accounts in the system to be detected, access request data of several accounts is obtained from the access log data; feature extraction processing is performed on the access request data of several accounts to obtain the account behavior features, resource request features and time dimension features of each account. Modeling and analyzing the account behavior characteristics and resource request characteristics yields a graph structure model between accounts and resources in the system to be detected. Clustering analysis is used to identify and divide the graph structure model, and the obtained collaborative account dataset is subjected to community detection processing based on modularity optimization to obtain collaborative detection data. The resource request characteristics and the time dimension characteristics are analyzed using sliding time window analysis technology to obtain resource access frequency data; Based on the collaborative detection data and the resource access frequency data, the attack detection results of the system to be detected are obtained.

[0007] As one preferred embodiment, the step of performing feature extraction processing on the access request data of the several accounts to obtain the account behavior characteristics, resource request characteristics, and time dimension characteristics of each account includes: The access frequency data and access intensity data of each account are extracted from the access demand data of several accounts. The access frequency data and access intensity data are accumulated and processed to obtain the account behavior characteristics of the account. The resource sequence data of the system to be detected is obtained, the account behavior characteristics of several accounts are analyzed collaboratively to obtain collaborative resource data, and the collaborative resource data is normalized to obtain the resource request characteristics. The account access frequency data is processed according to a fixed time interval to obtain the time dimension feature.

[0008] As a preferred embodiment, the step of modeling and analyzing the account behavior characteristics and the resource request characteristics to obtain a graph structure model between accounts and resources in the system to be detected includes: The account behavior features and resource request features are structured to obtain a graph structure model, wherein the graph structure model includes at least a set of nodes, a set of edges, and an edge weight function; The node set includes at least an account node set and a resource node set, and the edge weight function is used to characterize the access strength between accounts and resources.

[0009] As one preferred embodiment, the graph structure model is identified and partitioned using clustering analysis technology, and the resulting collaborative account dataset is subjected to community detection processing based on modularity optimization to obtain collaborative detection data, including: Cluster analysis was used to identify and divide the graph structure model, resulting in several collaborative account datasets. With the goal of maximizing modularity, a community detection method based on modularity optimization is used to process several collaborative account datasets to obtain the collaborative detection data.

[0010] As one preferred embodiment, the analysis of the resource request characteristics and the time dimension characteristics using the sliding time window analysis technique to obtain resource access frequency data includes: The resource request characteristics and time dimension characteristics are analyzed using sliding time window analysis technology to obtain the aggregated access frequency of resources within several time windows. The aggregated access frequency of resources within each time window is serialized to obtain the resource access frequency data.

[0011] As one preferred embodiment, obtaining the attack detection result of the system to be detected based on the collaborative detection data and the resource access frequency data includes: The collaborative detection data and the resource access frequency data are normalized to obtain a comprehensive risk factor; The attack detection results of the system under test are obtained by processing the comprehensive risk factors based on the entropy weight method.

[0012] As a preferred embodiment, after obtaining the attack detection result of the system to be detected, the network attack detection method further includes: Build a network attack detection database; The attack detection results are input into the network attack detection database for correlation analysis to obtain a dynamic attack detection strategy. The attack detection results include at least a list of marked accounts, abnormal access to resources, and attack time windows. Based on the aforementioned attack dynamic detection strategy, adaptive optimization protection is performed on the system to be detected.

[0013] The present invention also provides a network attack detection device, the device comprising: The acquisition module is used to acquire access log data of the system under test; The extraction module is used to obtain access request data of several accounts from the access log data based on the access requests of several accounts in the system to be detected; and to perform feature extraction processing on the access request data of several accounts to obtain the account behavior features, resource request features and time dimension features of each account. The modeling module is used to model and analyze the account behavior characteristics and resource request characteristics to obtain a graph structure model between accounts and resources in the system to be detected. The identification module is used to identify and divide the graph structure model using clustering analysis technology, and to perform community detection processing based on modularity optimization on the obtained collaborative account dataset to obtain collaborative detection data. The analysis module is used to analyze the resource request characteristics and the time dimension characteristics using sliding time window analysis technology to obtain resource access frequency data; The detection module is used to obtain the attack detection results of the system to be detected based on the collaborative detection data and the resource access frequency data.

[0014] The present invention also provides a network attack detection device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the network attack detection method described above.

[0015] The present invention further provides a computer-readable storage medium storing a computer program, wherein when the device containing the computer-readable storage medium executes the computer program, it implements the network attack detection method described above.

[0016] Compared with the prior art, the beneficial effects of the present invention are at least one of the following: This invention acquires access log data of a system under test; based on access requests from several accounts in the system under test, it obtains access demand data for several accounts from the access log data; it performs feature extraction processing on the access demand data of several accounts to obtain account behavior features, resource request features, and time dimension features for each account; it models and analyzes the account behavior features and resource request features to obtain a graph structure model between accounts and resources in the system under test; it uses clustering analysis technology to identify and divide the graph structure model, and performs community detection processing based on modularity optimization on the obtained collaborative account dataset to obtain collaborative detection data; it uses sliding time window analysis technology to analyze the resource request features and the time dimension features to obtain resource access frequency data; and based on the collaborative detection data and the resource access frequency data, it obtains the attack detection results of the system under test.

[0017] Compared to existing technologies, this invention lays a data foundation from three aspects: account, resource, and time. It then extracts multi-dimensional features and uses graph modeling to abstract the access relationships between accounts and resources into a network structure. Community clustering identifies collaborative access groups, and sliding time window analysis aggregates cross-account access frequencies to capture temporal anomalies. Finally, a weighted risk assessment is performed by integrating the strength of collaborative relationships and the degree of resource access mutation, achieving accurate attack detection. This invention overcomes the limitations of traditional single-account threshold detection, effectively identifying covert distributed enumeration and collaborative penetration attacks initiated by multiple accounts even when the behavior of a single account appears normal. This significantly improves the detection accuracy of complex cross-account attacks and the robustness of system protection. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating a network attack detection method in one embodiment of the present invention; Figure 2This is a schematic diagram of the network attack detection device in one embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of a network attack detection device in one embodiment of the present invention; Figure label: Among them, 11. Acquisition module; 12. Extraction module; 13. Modeling module; 14. Recognition module; 15. Analysis module; 16. Detection module; 21. Processor; 22. Memory. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The purpose of providing these embodiments is to make the disclosure of the present invention more thorough and comprehensive. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0020] In the description of this invention, it should be noted that, unless otherwise defined, all technical and scientific terms used in this invention have the same meaning as commonly understood by one of ordinary skill in the art. The terminology used in this specification is for the purpose of describing specific embodiments only and is not intended to limit the invention. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0021] One embodiment of the present invention provides a network attack detection method; for details, please refer to [link to specific documentation]. Figure 1 , Figure 1 The diagram shown is a flowchart of a network attack detection method according to one embodiment of the present invention. The method includes: S1: Obtain access log data of the system to be tested; S2: Based on the access requests of several accounts in the system to be detected, obtain the access request data of several accounts from the access log data; perform feature extraction processing on the access request data of several accounts to obtain the account behavior features, resource request features and time dimension features of each account. S3: Model and analyze the account behavior characteristics and resource request characteristics to obtain a graph structure model between accounts and resources in the system to be detected; S4: Use clustering analysis to identify and divide the graph structure model, and perform community detection processing based on modularity optimization on the obtained collaborative account dataset to obtain collaborative detection data; S5: Analyze the resource request characteristics and the time dimension characteristics using sliding time window analysis technology to obtain resource access frequency data; S6: Based on the collaborative detection data and the resource access frequency data, the attack detection result of the system to be detected is obtained.

[0022] Specifically, the first step is to collect access logs from the system being tested. These access logs include account identification information, host identification information, access resource identification, access timestamps, and specific parameters of the access requests. The log collection module can obtain access data through the system's built-in interface or a unified log collection framework, and store the collected raw logs in a centralized data storage unit, providing a reliable data source for subsequent processing.

[0023] During the data collection process, it is essential to ensure the accurate chronological order and source account correspondence of each access behavior. By recording the timestamps and account identifiers in the access logs, it is possible to ensure that access behaviors from multiple accounts and multiple hosts within the same time window can be fully tracked. To reduce the impact of noisy data on the analysis, access requests can be initially screened during the collection phase to eliminate automatically accessed data, cached access, or invalid requests.

[0024] The collected data should cover all access records of all target accounts and hosts within the selected time range. Data collection methods can include real-time collection and periodic batch collection strategies to meet the security analysis needs of different system environments.

[0025] Meanwhile, to ensure the security and integrity of the data, necessary encryption and verification processes should be performed during transmission and storage to ensure that the log content is not tampered with or lost.

[0026] The collected access log data is cleaned and standardized. The cleaning process includes removing duplicate records, correcting missing fields, unifying the time format, and standardizing access parameters, so that the log data can be compared between different accounts and hosts.

[0027] Standardization processes may include uniform time zone conversion of access times, discretization or normalization of access parameters, and uniform encoding of resource identifiers to ensure the accuracy and consistency of data across all dimensions.

[0028] The cleaned structured data is linked and integrated according to the account dimension to form access requirement data for each account. Specifically, for each target account, all its access request records are aggregated to sort out information such as the access resource list, operation frequency of various resources, and distribution pattern of request parameters, and transform scattered single access requests into access requirement data that can reflect the account's access preferences and demand characteristics.

[0029] Furthermore, feature extraction processing is performed on the access request data of the several accounts to obtain the account behavior features, resource request features, and time dimension features of each account. This includes: extracting the account access frequency data and access intensity data of each account from the access request data of the several accounts; accumulating the account access frequency data and the access intensity data to obtain the account behavior features; acquiring the resource sequence data of the system to be detected; performing collaborative analysis on the account behavior features of the several accounts to obtain collaborative resource data; normalizing the collaborative resource data to obtain the resource request features; and processing the account access frequency data according to a fixed time interval to obtain the time dimension features.

[0030] Specifically, from the integrated access demand data of each account, the total number of access requests for each account within a specified period is counted to obtain account access frequency data, which reflects the access activity level of the account.

[0031] At the same time, the data volume of each account's single access request, the complexity of the request operation, or the degree of system resource consumption are counted to obtain access intensity data, which reflects the degree of impact of the account's access behavior.

[0032] The two types of data are then accumulated and processed. The accumulation and processing methods can be time-weighted summation or cumulative statistics within a sliding period. In this way, the scattered single access behavior data is transformed into a feature set that can reflect the long-term access pattern of the account, and finally the account behavior characteristics are obtained.

[0033] Secondly, collect all resource information within the system to be tested, and construct system resource sequence data according to dimensions such as resource type, functional module, or access permission. Then, based on the account behavior characteristics of each account, analyze the resource access directions of different accounts, filter out the resource set that is accessed by multiple accounts, and thus obtain collaborative resource data. This data reflects the degree of correlation between accounts at the resource request level and can capture the access tendency of multiple accounts for the same batch of resources.

[0034] Next, the collaborative resource data is normalized. The normalization method can be maximum-minimum standardization or Z-score standardization to eliminate the difference in the units of access frequency of different resources and make the data in a uniform numerical range.

[0035] Set a fixed time interval, which can be adjusted according to the system's business characteristics and the timing patterns of attack behavior.

[0036] Then, the account access frequency data is sliced ​​according to the time interval, dividing the continuous access frequency data into multiple time windows. The access frequency distribution, peak occurrence time, and frequency change trend of each account in each time window are statistically analyzed. In this way, the originally disordered access frequency data is transformed into a feature set with time sequence regularity, and finally a time dimension feature is formed.

[0037] In another embodiment, for account a In the time window t Internal resources r Access behavior can be defined using access strength data. for: in Indicates account In the time window Resources r Number of visits, These are optional weighting coefficients used to highlight the importance of specific behaviors.

[0038] By accumulating the frequency of access to the same resource by different accounts, we can obtain the characteristics of the amount of shared resources between accounts. for: Used for quantitative accounts a1 With account a2 In resources r The degree of collaboration, i.e., collaborative resource data, among which, For account a1 In resources r Access frequency.

[0039] Secondly, features are extracted from the time dimension, specifically the access sequence for each account. Calculate access time interval And define the time dimension feature as: in For indicator functions, This is the access frequency threshold. Describe resources within a short time window r The degree of concentration of simultaneous access by multiple accounts reflects potential distributed collaborative behavior.

[0040] Furthermore, the account behavior features and resource request features are modeled and analyzed to obtain a graph structure model between accounts and resources in the system to be detected. This includes: performing structured processing on the account behavior features and resource request features to obtain a graph structure model, wherein the graph structure model includes at least a set of nodes, a set of edges, and an edge weight function; the set of nodes includes at least a set of account nodes and a set of resource nodes, and the edge weight function is used to characterize the access strength between accounts and resources.

[0041] Specifically, the key elements for constructing a graph structure model are identified, with the core components being the set of nodes, the set of edges, and the edge weight function.

[0042] For the construction of the node set, each account in the system to be tested is mapped as an independent account node, and all account nodes are integrated to form an account node set. At the same time, each accessible resource in the system is mapped as an independent resource node, and all resource nodes are integrated to form a resource node set. The two types of nodes together constitute the node set of the graph structure model.

[0043] For the construction of the edge set, based on the access records in the account behavior characteristics, if an account has access to a certain resource, a connection edge is established between the corresponding account node and the resource node. All nodes with access associations are integrated with their corresponding edges to form the edge set of the graph structure model.

[0044] The construction of the edge weight function is based on the access intensity data in account behavior characteristics and the degree of collaborative access association in resource request characteristics. The calculation logic of the edge weight is designed so that the output value of the edge weight function can accurately represent the access intensity between the account and the resource. The higher the access intensity, the larger the edge weight value. The edge weight can be quantitatively calculated by weighting and summing indicators such as the access frequency, access duration and operation complexity of the account to the resource.

[0045] Through the above structuring process, the originally scattered account behavior characteristics and resource request characteristics are transformed into a graph structure model with clear topological relationships and quantified weights, thereby intuitively presenting the relationship between different accounts at the resource request level. At the same time, the access intensity represented by the edge weight function can further distinguish the access depth of accounts to resources.

[0046] In another embodiment, the relationship between accounts and resources is represented in a structured manner using graph modeling. The graph structure model can be defined as an undirected weighted graph. ,in Represents a set of nodes, including a set of account nodes. With resource node set , Denotes the set of edges. It is a weighted edge function used to quantify the access intensity or degree of collaboration between accounts and resources.

[0047] For each edge Its weight Can be based on account a Resources r Access behavior is defined as in For account Resources Access frequency, and This is an adjustment factor used to balance the intensity of single-account access with the synergy of cross-account access. Including account a All external accounts have access to resources The access frequency data, through this weighting mechanism, can reflect potential collaborative behavior among accounts in the graph. A This refers to the number of accounts.

[0048] In graph modeling, collaborative edge weights between accounts can also be defined to directly represent the degree of overlap in access to the same resource between accounts.

[0049] For account nodes and Collaborative edges between The edge weight can be defined as: This weight quantifies the overlap in access to various resources by two accounts; the larger the value, the more significant the collaborative access behavior.

[0050] By constructing this graph structure, the edge weights between account nodes and resource nodes, as well as the collaborative edge weights between account nodes, can intuitively reflect the behavioral relationships and collaborative strength between accounts, providing a foundation for subsequent community detection and abnormal group identification.

[0051] In practical applications, adjacency matrices can be used. Represent the graph, where matrix elements Corresponding node With nodes The edge weights between account nodes and resource nodes, as well as the edge weights between account nodes, are all explicitly represented in the matrix. This adjacency matrix can be used in graph clustering algorithms to analyze and identify groups of accounts that collaboratively access sensitive resources within a short period of time.

[0052] Furthermore, cluster analysis is used to identify and divide the graph structure model, and the resulting collaborative account dataset is processed using a community detection method based on modularity optimization to obtain collaborative detection data. This includes: using cluster analysis to identify and divide the graph structure model to obtain several collaborative account datasets; and using a community detection method based on modularity optimization to process the several collaborative account datasets with the goal of maximizing modularity, to obtain the collaborative detection data.

[0053] Based on the topological relationship between nodes and edges in the graph structure model, an appropriate clustering algorithm is selected to group account nodes. The clustering process is based on the degree of resource access association between account nodes. If multiple account nodes frequently access the same batch of resource nodes, their corresponding edge weights are higher, and these account nodes will be classified into the same cluster.

[0054] By calculating the similarity index of account nodes, account nodes with high similarity are aggregated and account nodes with low similarity are separated. Finally, the entire account resource association graph is divided into several relatively independent account subsets, and each subset is a collaborative account dataset.

[0055] Modularity is a core indicator for measuring the quality of community partitioning in a graph structure. The higher the value, the tighter the connection between nodes within a community and the sparser the connection between communities.

[0056] For the collaborative account dataset obtained from the initial segmentation, a community detection algorithm with modularity optimization is used for iterative optimization. The algorithm will continuously adjust the affiliation relationship of account nodes in different datasets and calculate the modularity value after each adjustment until the modularity reaches the maximum value.

[0057] The resulting subset of accounts is a tightly structured collaborative account community. Accounts within the community not only share common resource access preferences, but also have significantly stronger connections with each other than accounts outside the community.

[0058] By precisely refining the preliminary clustering results and eliminating weakly related account groups formed by accidental factors, the system identifies a set of accounts with highly collaborative characteristics, which is a cluster of low-privilege accounts controlled by attackers. The final output collaborative detection data can accurately reflect the collaborative attack relationships between accounts.

[0059] In another embodiment, a clustering analysis algorithm is used to detect the collaborative graph structure between accounts and resources in order to identify groups of accounts that collaboratively access the same sensitive resources within the same time window.

[0060] First, the diagram Using account nodes and their connections as input, a graph clustering algorithm is used to group accounts with similar behavioral patterns into the same subgroup.

[0061] A community detection method based on modularity optimization can be used, defining modularity. for in Represents the nodes in the adjacency matrix With nodes The right to the border, For nodes i The degree, Let the total edge weight in the graph be . For nodes Community number to which it belongs For indicator functions, when The value is 1 if it is true, and 0 otherwise.

[0062] By maximizing modularity It can identify groups of accounts with high internal collaboration intensity, that is, potential collaborative groups that have concentrated access to the same resources in a short period of time.

[0063] After identifying the account group, it is necessary to assess the strength of collaboration and consistency of behavior within the account group.

[0064] For groups Account collection within The synergy strength index can be defined as: This indicator quantifies the degree of overlap in resource access among accounts within a group; a higher value indicates more significant collaborative behavior between accounts.

[0065] To further assess the consistency of account behavior, the standard deviation or entropy value of account access frequency within the group can be calculated using the formula. in This indicates the uniformity of resource access among a group; a smaller value indicates a high degree of concentration in access to a specific resource. For the probability of access, R This refers to the total amount of resources; For account access frequency, Indicates the first k A group.

[0066] By using the aforementioned indicators of coordination strength and behavioral consistency, we can identify groups of accounts exhibiting distributed collaborative access behavior within a short time window, providing a basis for further analysis of cross-account distributed enumeration attacks.

[0067] Furthermore, the resource request characteristics and the time dimension characteristics are analyzed using sliding time window analysis technology to obtain resource access frequency data, including: analyzing the resource request characteristics and the time dimension characteristics using sliding time window analysis technology to obtain the aggregated access frequency of resources within several time windows; and serializing the aggregated access frequency of resources within each time window to obtain the resource access frequency data.

[0068] Based on the business characteristics of the system under test and the temporal patterns of the attack behavior, a reasonable time window length and sliding step size are set. The time window length needs to cover the possible duration of the attack behavior, while the sliding step size determines the time granularity of the frequency analysis.

[0069] Then, the access timestamp in the time dimension features is used as an index to map the resource request features to the corresponding time axis, and a sliding time window is started to perform time-series slicing.

[0070] Within each time window, the access behavior of individual accounts is no longer distinguished. Instead, the number of requests for the same resource by all accounts within the window is accumulated to obtain the aggregated access frequency of the target resource within that time window.

[0071] The resource access frequency values ​​calculated within each time window are arranged sequentially according to the sliding order of the time windows to form resource access frequency data in time order.

[0072] During serialization, the order of time windows must be maintained to ensure the temporal continuity of frequency data. At the same time, the sequence can be smoothed to remove abnormal peaks caused by system fluctuations and improve data stability.

[0073] In another embodiment, time-series anomaly detection is performed on the access behavior of each resource to reveal potential risks that may exist when accessed by a single account is low but aggregated across accounts.

[0074] First, each resource r The access frequency sequence is defined as in Indicates account a In the time window t Resources r Number of visits, A The total number of accounts. The time series is divided into segments of length [length missing] using a sliding time window method. continuous time window Calculate the average resource access frequency within each window. with standard deviation : When resource access frequency abruptly changes within each time window, a standardized anomaly index can be calculated. To determine if there is any abnormal behavior: like ,in To preset an anomaly threshold, resources will be allocated. (r) In the time window Access behavior is flagged as abnormal. This method allows for the identification of potential abnormal patterns even if the access volume of a single account is within the normal range, through aggregated analysis of multi-account access.

[0075] In addition, to improve the robustness of detection, the length of the time window can be adjusted. and threshold It can be dynamically adjusted to adapt to different system loads and access fluctuations.

[0076] First, we construct a dynamic sliding window, setting up resources. The sequence of access events is as follows: in Indicates the access time. This indicates access to the account.

[0077] Define sliding time window The length is Initially set to a fixed value .

[0078] To adapt to changes in access frequency, adjust in real time : in: This represents the access frequency within the current window. For the past Average access frequency of each window; This is the window adaptive adjustment coefficient.

[0079] When system load increases, the window automatically widens to reduce sensitivity; when access stabilizes, the window shortens to improve detection accuracy.

[0080] Calculate the rate of change of resource access frequency within each time window: To address the varying degrees of fluctuation in access to different resources, a dynamic threshold is introduced: in: 、 Each in the past Within each window The mean and standard deviation; This is a sensitivity parameter. When... At that time, determine the resources In the window The memory exhibits abnormal behavior during the time period.

[0081] This dynamic threshold mechanism can adapt to changes in the overall access frequency of the system without requiring manual setting of a fixed threshold.

[0082] Furthermore, based on the collaborative detection data and the resource access frequency data, the attack detection result of the system to be detected is obtained, including: normalizing the collaborative detection data and the resource access frequency data to obtain a comprehensive risk factor; and processing the comprehensive risk factor based on the entropy weight method to obtain the attack detection result of the system to be detected.

[0083] Specifically, collaborative detection data reflects the degree of collaboration among account groups. Its numerical magnitude and dimensions differ significantly from those of resource access frequency data, and direct fusion can lead to weight imbalance.

[0084] First, a suitable normalization method is selected to process the two types of data separately. The module degree value of the account community in the collaborative detection data and the aggregated access frequency value of each time window in the resource access frequency data are uniformly mapped to the standard range of 0 to 1.

[0085] The normalized collaborative detection data and resource access frequency data are then linearly fused to construct a comprehensive risk factor, which simultaneously covers the collaborative association characteristics of account groups and the temporal anomaly characteristics of resource access.

[0086] Entropy weighting is an objective weighting method that determines weights based on the degree of data dispersion, avoiding the interference of subjective factors on detection results. First, the information entropy of each feature indicator in the comprehensive risk factor is calculated. The smaller the information entropy of an indicator, the higher its dispersion, the greater its contribution to attack detection, and the higher its corresponding weight.

[0087] Then, the weight coefficients of each feature index are calculated based on the information entropy, and the weight coefficients are then weighted and summed with the normalized feature values ​​to obtain the final risk score.

[0088] A risk scoring threshold is set. If the risk score of a certain account group exceeds the threshold, it is determined that there is cross-account collaborative attack behavior; otherwise, it is determined that it is normal access behavior.

[0089] In another embodiment, a joint anomaly score is defined. : in: Access resources within the current time window The number of accounts; This represents the system's historical maximum number of accounts accessing the system simultaneously. Let be the weighting coefficient, satisfying , It calculates the rate of change in resource access frequency. This is a dynamic threshold.

[0090] A comprehensive risk assessment is conducted based on the detection results to determine whether cross-account distributed enumeration attacks exist in the system.

[0091] First, the internal synergy strength of the collaborative group Indicators of Behavioral Consistency Standardized anomaly index for time anomaly detection A unified quantitative approach is adopted to generate a comprehensive risk score.

[0092] For the group and its related resource collection The risk score is defined as follows: in This is a weighting coefficient, which can be adjusted according to the system security policy. and These are the maximum cooperative strength and maximum behavioral consistency entropy values ​​observed in historical data, used for normalization. This score comprehensively considers the degree of cooperation within the group, behavioral concentration, and the degree of resource access anomalies.

[0093] Risk scoring With preset threshold Compare them.

[0094] when At that time, the group was determined. If cross-account collaborative and distributed enumeration attacks occur within the current time window, an alert will be generated or detection results will be output. By repeating the above process for all collaborative groups, anomaly risk assessment can be achieved across the entire system.

[0095] To improve the reliability of the judgment, a dynamic threshold strategy can be introduced to adjust the threshold. The system is dynamically adjusted based on overall system traffic, resource sensitivity levels, and historical anomaly distribution.

[0096] In a further embodiment of the present invention, the time anomaly detection module dynamically adjusts the threshold based on the access frequency change of the sliding time window to adapt to the real-time changes in access load and behavior patterns.

[0097] Let the first The target resource access frequency within each time window is The average access frequency of the history window is The detection threshold is .

[0098] System initialization base threshold And dynamically correct based on access characteristics during the detection process.

[0099] To achieve adaptive threshold updates, this design uses the following dynamically adjusted formula: in This is the learning rate parameter, used to control the speed at which the threshold is adjusted.

[0100] When the current access frequency is higher than the historical average, that is The system automatically raises the threshold to reduce false alarms caused by normal peak access times; conversely, when... When the threshold is lowered, the system improves the sensitivity of anomaly detection. This process is similar to a one-dimensional adaptive filtering mechanism, which can dynamically balance the detection sensitivity under different access stages.

[0101] To account for the differences in the importance of resources within the system, this invention further introduces a resource access concentration index. Its definition is: in Indicates the current time window Accessing the same resource within Number of accounts This indicates the total number of accesses within the time window. When a resource is accessed by an unusually large number of accounts within a short period of time... If the value increases significantly, the system automatically lowers the threshold to enhance the detection sensitivity for behaviors related to that resource. The final threshold update formula is expressed as: in For adjustment coefficients, This represents the historical average concentration of visits.

[0102] This formula achieves dynamic adjustment based on two factors: changes in access frequency and concentration of resource access. When the overall access frequency increases, the threshold is automatically raised; when the concentration of access to a certain resource increases, the threshold is automatically lowered, thereby maintaining detection stability and accuracy in complex cross-account access behaviors.

[0103] Furthermore, to prevent excessive threshold fluctuations from causing detection instability, this invention introduces an exponential smoothing mechanism in the time dimension: in As a smoothing factor, The threshold calculated at the current moment. This is the smoothed threshold from the previous time step. Through this recursive update method, the system can maintain the continuity and robustness of the threshold when access patterns change drastically, ensuring a stable and controllable detection process.

[0104] After obtaining the attack detection results of the system to be detected, the network attack detection method further includes constructing a network attack detection database; inputting the attack detection results into the network attack detection database for correlation analysis processing to obtain a dynamic attack detection strategy, wherein the attack detection results include at least a list of marked accounts, abnormal access resources, and attack time windows; and adaptively optimizing the protection of the system to be detected based on the dynamic attack detection strategy.

[0105] Specifically, a database structure adapted to the storage requirements of attack detection results should be designed, and core storage fields should be determined. These fields should cover account identifiers and permission information in the marked account list, resource types and resource address information of abnormally accessed resources, time intervals and access frequency characteristics of attack time windows, and intermediate data such as collaborative account community structure and resource access frequency sequences generated during the detection process.

[0106] Then, the basic operating environment of the database is set up, data read and write permissions and storage backup mechanisms are configured to ensure data security and traceability.

[0107] The output of this attack detection results, including the list of marked accounts that accessed resources abnormally and the attack time window, will be imported in batches into the pre-built attack detection database.

[0108] Then, the correlation analysis process is initiated to explore the correlation patterns between the current attack data and historical attack data from multiple dimensions, including analyzing the correlation between marked accounts and historical malicious accounts, the overlap between abnormal access resources and historical attack target resources, and the similarity between the attack time window and the time distribution characteristics of historical attack behaviors.

[0109] Based on these correlations, suggestions for adjusting detection rules to address current attack patterns are derived. These include optimizing the edge weight calculation weights of graph structure models, adjusting the length and step size of the sliding time window, updating the threshold parameters of risk scores, and generating corresponding protection rules. For example, permission restrictions can be imposed on marked accounts, and access frequency monitoring can be set for abnormal access to resources. Ultimately, these are integrated to form a dynamic attack detection strategy.

[0110] Following the rule adjustment recommendations in the attack dynamic detection strategy, the system's detection model parameters were updated to ensure that subsequent detections can accurately identify similar attack patterns.

[0111] The protection rules in the enforcement strategy are used to downgrade or temporarily freeze the privileges of marked accounts to prevent them from launching further coordinated attacks. A real-time monitoring mechanism is deployed for abnormal access to resources, and an alarm is triggered immediately once access behavior that matches the attack characteristics is detected.

[0112] Simultaneously, system operation data and new attack detection results are continuously collected after the strategy is implemented and fed back to the network attack detection database, forming a closed-loop management system for detection analysis, strategy optimization, and protection.

[0113] Through the above comprehensive risk assessment steps, this invention can effectively identify potential cross-account distributed enumeration attacks based on collaborative analysis and time anomaly detection results, even when the access volume of a single account is normal and the behavior of a single IP is not abnormal, thereby improving the system's security protection capabilities.

[0114] Another embodiment of the present invention provides a network attack detection device; for details, please refer to [link to relevant documentation]. Figure 2 , Figure 2 The diagram shown illustrates the structure of a network attack detection device according to one embodiment of the present invention. The device includes: Module 11 is used to acquire access log data of the system to be tested; The extraction module 12 is used to obtain access request data of several accounts from the access log data based on the access requests of several accounts in the system to be detected; and to perform feature extraction processing on the access request data of several accounts to obtain the account behavior features, resource request features and time dimension features of each account. Modeling module 13 is used to model and analyze the account behavior characteristics and resource request characteristics to obtain a graph structure model between accounts and resources in the system to be detected. The identification module 14 is used to identify and divide the graph structure model using clustering analysis technology, and to perform community detection processing based on modularity optimization on the obtained collaborative account dataset to obtain collaborative detection data. Analysis module 15 is used to analyze the resource request characteristics and the time dimension characteristics using sliding time window analysis technology to obtain resource access frequency data; The detection module 16 is used to obtain the attack detection result of the system to be detected based on the collaborative detection data and the resource access frequency data.

[0115] See Figure 3This is a schematic diagram of the network attack detection device provided in an embodiment of the present invention. The network attack detection device provided in this embodiment includes a processor 21, a memory 22, and a computer program stored in the memory 22 and configured to be executed by the processor 21. When the processor 21 executes the computer program, it implements the steps as described in the network attack detection method embodiment above, for example... Figure 1 The steps S1 to S6 described above; or, when the processor 21 executes the computer program, it implements the functions of each module in the above-described device embodiments, such as the acquisition module 11.

[0116] For example, the computer program can be divided into one or more modules, which are stored in the memory 22 and executed by the processor 21 to complete the present invention. The one or more modules can be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in the network attack detection device. For example, the computer program can be divided into an acquisition module 11, an extraction module 12, a modeling module 13, etc., with the specific functions of each module as follows: Module 11 is used to acquire access log data of the system to be tested; The extraction module 12 is used to obtain access request data of several accounts from the access log data based on the access requests of several accounts in the system to be detected; and to perform feature extraction processing on the access request data of several accounts to obtain the account behavior features, resource request features and time dimension features of each account. Modeling module 13 is used to model and analyze the account behavior characteristics and resource request characteristics to obtain a graph structure model between accounts and resources in the system to be detected. The identification module 14 is used to identify and divide the graph structure model using clustering analysis technology, and to perform community detection processing based on modularity optimization on the obtained collaborative account dataset to obtain collaborative detection data. Analysis module 15 is used to analyze the resource request characteristics and the time dimension characteristics using sliding time window analysis technology to obtain resource access frequency data; The detection module 16 is used to obtain the attack detection result of the system to be detected based on the collaborative detection data and the resource access frequency data.

[0117] The network attack detection device may include, but is not limited to, processor 21 and memory 22. Those skilled in the art will understand that the schematic diagram is merely an example of a network attack detection device and does not constitute a limitation on the device. It may include more or fewer components than illustrated, or combine certain components, or use different components. For example, the network attack detection device may also include input / output devices, network access devices, buses, etc.

[0118] The processor 21 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor 21 is the control center of the network attack detection device, connecting various parts of the entire network attack detection device via various interfaces and lines.

[0119] The memory 22 can be used to store the computer programs and / or modules. The processor 21 implements various functions of the network attack detection device by running or executing the computer programs and / or modules stored in the memory 22 and calling the data stored in the memory 22. The memory 22 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory 22 may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0120] If the modules integrated into the network attack detection device are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0121] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0122] Accordingly, embodiments of the present invention provide a computer-readable storage medium, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform steps in the network attack detection method of the above embodiments, for example... Figure 1 Steps S1 to S6 as described above.

[0123] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

Claims

1. A method for detecting network attacks, characterized in that, include: Obtain access log data from the system under test; Based on the access requests of several accounts in the system to be detected, access request data of several accounts is obtained from the access log data; feature extraction processing is performed on the access request data of several accounts to obtain the account behavior features, resource request features and time dimension features of each account. Modeling and analyzing the account behavior characteristics and resource request characteristics yields a graph structure model between accounts and resources in the system to be detected. Clustering analysis is used to identify and divide the graph structure model, and the obtained collaborative account dataset is subjected to community detection processing based on modularity optimization to obtain collaborative detection data. The resource request characteristics and the time dimension characteristics are analyzed using sliding time window analysis technology to obtain resource access frequency data; Based on the collaborative detection data and the resource access frequency data, the attack detection results of the system to be detected are obtained.

2. The network attack detection method as described in claim 1, characterized in that, The step of performing feature extraction processing on the access request data of several accounts to obtain the account behavior characteristics, resource request characteristics, and time dimension characteristics of each account includes: The access frequency data and access intensity data of each account are extracted from the access demand data of several accounts. The access frequency data and access intensity data are accumulated and processed to obtain the account behavior characteristics of the account. The resource sequence data of the system to be detected is obtained, the account behavior characteristics of several accounts are analyzed collaboratively to obtain collaborative resource data, and the collaborative resource data is normalized to obtain the resource request characteristics. The account access frequency data is processed according to a fixed time interval to obtain the time dimension feature.

3. The network attack detection method as described in claim 1, characterized in that, The process of modeling and analyzing the account behavior characteristics and resource request characteristics to obtain a graph structure model between accounts and resources in the system to be detected includes: The account behavior features and resource request features are structured to obtain a graph structure model, wherein the graph structure model includes at least a set of nodes, a set of edges, and an edge weight function; The node set includes at least an account node set and a resource node set, and the edge weight function is used to characterize the access strength between accounts and resources.

4. The network attack detection method as described in claim 1, characterized in that, The graph structure model is identified and partitioned using clustering analysis techniques. The resulting collaborative account dataset is then subjected to community detection processing based on modularity optimization to obtain collaborative detection data, including: Cluster analysis was used to identify and divide the graph structure model, resulting in several collaborative account datasets. With the goal of maximizing modularity, a community detection method based on modularity optimization is used to process several collaborative account datasets to obtain the collaborative detection data.

5. The network attack detection method as described in claim 1, characterized in that, The method of using sliding time window analysis to analyze the resource request characteristics and the time dimension characteristics to obtain resource access frequency data includes: The resource request characteristics and time dimension characteristics are analyzed using sliding time window analysis technology to obtain the aggregated access frequency of resources within several time windows. The aggregated access frequency of resources within each time window is serialized to obtain the resource access frequency data.

6. The network attack detection method as described in claim 1, characterized in that, The process of obtaining the attack detection result of the system under test based on the collaborative detection data and the resource access frequency data includes: The collaborative detection data and the resource access frequency data are normalized to obtain a comprehensive risk factor; The attack detection results of the system under test are obtained by processing the comprehensive risk factors based on the entropy weight method.

7. The network attack detection method as described in claim 1, characterized in that, After obtaining the attack detection results of the system to be detected, the network attack detection method further includes: Build a network attack detection database; The attack detection results are input into the network attack detection database for correlation analysis to obtain a dynamic attack detection strategy. The attack detection results include at least a list of marked accounts, abnormal access to resources, and attack time windows. Based on the aforementioned attack dynamic detection strategy, adaptive optimization protection is performed on the system to be detected.

8. A network attack detection device, characterized in that, include: The acquisition module is used to acquire access log data of the system under test; The extraction module is used to obtain access request data of several accounts from the access log data based on the access requests of several accounts in the system to be detected; and to perform feature extraction processing on the access request data of several accounts to obtain the account behavior features, resource request features and time dimension features of each account. The modeling module is used to model and analyze the account behavior characteristics and resource request characteristics to obtain a graph structure model between accounts and resources in the system to be detected. The identification module is used to identify and divide the graph structure model using clustering analysis technology, and to perform community detection processing based on modularity optimization on the obtained collaborative account dataset to obtain collaborative detection data. The analysis module is used to analyze the resource request characteristics and the time dimension characteristics using sliding time window analysis technology to obtain resource access frequency data; The detection module is used to obtain the attack detection results of the system to be detected based on the collaborative detection data and the resource access frequency data.

9. A network attack detection device, characterized in that, The method includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements the network attack detection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein when the device containing the computer-readable storage medium executes the computer program, it implements the network attack detection method as described in any one of claims 1 to 7.

Images