Network attack detection method, device, equipment and storage medium

Abstract

The application discloses a network attack detection method and device, equipment and storage medium, and relates to the technical field of network security. The method comprises the following steps: performing protocol analysis and feature extraction on network traffic data to obtain structured traffic features of the network traffic data; performing semantic analysis on all original attack detection rules in an original attack detection rule set to generate target attack detection rule variants corresponding to the original attack detection rules; constructing an enhanced attack detection rule set based on the original attack detection rules and the target attack detection rule variants; and performing matching detection on the structured traffic features based on the enhanced attack detection rule set to obtain a network attack detection result of the network traffic data. The application can perform matching detection on the structured traffic features based on the enhanced attack detection rule set containing original rules and variant rules, so that various attack variants can be identified, and the accuracy of network attack detection is improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to network attack detection methods, devices, equipment and storage media. Background Technology

[0002] With the rapid evolution of next-generation information technologies, cyberattack methods are becoming increasingly complex and covert. In particular, the rise of Advanced Persistent Threats (APTs) and Zero-day Attacks targeting Web services, enterprise intranets, and cloud computing environments poses a severe challenge to cybersecurity protection systems. Against this backdrop, how to efficiently and accurately detect cyberattacks, especially known variants of attacks, has become a research hotspot in the field of cybersecurity.

[0003] Currently, existing network attack detection methods typically employ feature-based rule-based detection approaches. These methods use predefined attack detection rules by security experts to perform pattern matching on network packets to identify known attack behaviors. However, the attack detection rules in the rule base of these methods often rely on manual writing or simple string replacement of known attacks, resulting in limited coverage, a high risk of false negatives, and low accuracy. Summary of the Invention

[0004] The main purpose of this application is to provide a network attack detection method, apparatus, device and storage medium, which aims to solve the technical problem that the accuracy of existing network attack detection methods is not high due to the small coverage of attack detection rules.

[0005] To achieve the above objectives, this application proposes a network attack detection method, the method comprising: Upon detecting network traffic data, protocol parsing and feature extraction are performed on the network traffic data to obtain structured traffic features of the network traffic data; Semantic analysis is performed on all original attack detection rules in the original attack detection rule set using a pre-defined large language model to generate target attack detection rule variants corresponding to each original attack detection rule. An enhanced attack detection rule set is constructed based on the original attack detection rule and the corresponding variants of the target attack detection rule; Based on the enhanced attack detection rule set, the structured traffic features are matched and detected to obtain the network attack detection results of the network traffic data.

[0006] In one embodiment, the step of performing protocol parsing and feature extraction on the network traffic data to obtain structured traffic features of the network traffic data includes: The network packets in the network traffic data are identified by protocol to determine the protocol type of the network packets; The network data packet is parsed according to the protocol type to extract the transport layer header information and application layer payload data of the network data packet; The application layer payload data is encoded and restored to obtain the standardized payload data of the network data packets; The structured traffic characteristics of the network traffic data are constructed based on the transport layer header information and the standardized payload data.

[0007] In one embodiment, the step of performing semantic analysis on all original attack detection rules in the original attack detection rule set using a preset large language model to generate target attack detection rule variants corresponding to each original attack detection rule includes: The structure of all original attack detection rules in the original attack detection rule set is parsed to extract the key attack detection fields from the original attack detection rules. The key attack detection fields are categorized according to attack type to obtain the structured attack detection rules corresponding to each of the original attack detection rules. The structured attack detection rules are semantically analyzed using a pre-defined large language model to obtain the rule semantic features of each original attack detection rule; The original attack detection rules are equivalently transformed using the preset large language model based on the semantic features of the rules, thereby generating target attack detection rule variants corresponding to the original attack detection rules.

[0008] In one embodiment, the step of performing equivalent transformation processing on each of the original attack detection rules based on the rule semantic features using the preset large language model to generate target attack detection rule variants corresponding to each of the original attack detection rules includes: The allowed transformation fields in the original attack detection rules are determined by the preset large language model based on the semantic features of the rules; The field type corresponding to the allowed transformation field is determined based on the semantic role of the allowed transformation field in the original attack detection rule; The target rule transformation strategy that matches the field type is queried from the preset variant strategy library. The target rule transformation strategy includes at least one of encoding transformation, syntax transformation and regular expression equivalence transformation. Based on the target rule transformation strategy, the allowed transformation field is transformed to generate candidate attack detection rule variants of the original attack detection rule; The candidate attack detection rule variants are validated, and those that pass the validation are identified as target attack detection rule variants.

[0009] In one embodiment, the step of constructing an enhanced attack detection rule set based on the original attack detection rule and the corresponding variant of the target attack detection rule includes: Determine the similarity of matching fields between the original attack detection rule and the corresponding variant of the target attack detection rule; Redundant attack detection rule variants with matching field similarity exceeding a preset similarity threshold are identified and removed from the target attack detection rule variants to obtain effective attack detection rule variants; The original attack detection rules and the effective attack detection rule variants are merged to construct an enhanced attack detection rule set.

[0010] In one embodiment, the step of matching and detecting the structured traffic features based on the enhanced attack detection rule set to obtain the network attack detection result of the network traffic data includes: A subset of candidate attack detection rules that match the structured traffic features is selected from the enhanced attack detection rule set; Determine the matching priority of each attack detection rule in the subset of candidate attack detection rules. The matching priority includes high priority and low priority. The original attack detection rule corresponds to the high priority, and the target attack detection rule variant corresponds to the low priority. The high-priority original attack detection rule is invoked to accurately match the application layer payload information in the structured traffic features, and it is determined whether the application layer payload information meets all the matching conditions of a single original attack detection rule. If an exact match fails, the lower-priority variant of the target attack detection rule is invoked to perform fuzzy matching detection on the structured traffic features to obtain the network attack detection result of the network traffic data.

[0011] In one embodiment, the step of invoking the low-priority variant of the target attack detection rule to perform fuzzy matching detection on the structured traffic features to obtain the network attack detection result of the network traffic data includes: The application layer load information is normalized to obtain the processed application layer load information; The processed application layer payload information, the structured semantic features of the target attack detection rule variant, and the local matching evidence are input into a preset large language model to obtain the matching category output by the preset large language model; Network attack detection results are generated based on the matching categories of the network traffic data, and the network attack detection results are interpreted by the preset large language model according to the thought process.

[0012] Furthermore, to achieve the above objectives, this application also proposes a network attack detection device, the device comprising: The feature extraction module is used to perform protocol parsing and feature extraction on the network traffic data when network traffic data is detected, so as to obtain the structured traffic features of the network traffic data. The rule analysis module is used to perform semantic analysis on all the original attack detection rules in the original attack detection rule set through a preset large language model, and generate target attack detection rule variants corresponding to each of the original attack detection rules. The rule enhancement module is used to construct an enhanced attack detection rule set based on the original attack detection rule and the corresponding variant of the target attack detection rule; The rule matching module is used to perform matching and detection on the structured traffic features based on the enhanced attack detection rule set, and obtain the network attack detection results of the network traffic data.

[0013] In addition, to achieve the above objectives, this application also proposes a network attack detection device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the network attack detection method described above.

[0014] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the network attack detection method described above.

[0015] This application provides a network attack detection method. Upon detecting network traffic data, the method performs protocol parsing and feature extraction to obtain structured traffic features. It then performs semantic analysis on all original attack detection rules in a pre-defined large language model to generate target attack detection rule variants for each original attack detection rule. An enhanced attack detection rule set is constructed based on the original attack detection rules and their corresponding target attack detection rule variants. Finally, the method performs matching detection on the structured traffic features based on the enhanced attack detection rule set to obtain the network attack detection results for the network traffic data. Compared to existing network attack detection methods, this method offers a more comprehensive approach. Traditional network attack detection methods typically rely on manually written attack detection rules or simple string replacement of known attacks, resulting in limited coverage, a high risk of false negatives, and low accuracy. This application addresses this issue by performing structural parsing and semantic analysis on the original attack detection rules to understand their attack intent and generate various rule variants. This constructs an enhanced attack detection rule set containing both the original and variant rules. Based on this enhanced set, structured traffic features are matched and detected, enabling the identification of attack variants with the same attack logic but diverse surface forms. This solves the technical problem of low accuracy in existing network attack detection methods due to the limited coverage of attack detection rules. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating an embodiment of the network attack detection method of this application. Figure 2 This is a flowchart illustrating Embodiment 2 of the network attack detection method of this application; Figure 3 This is a flowchart illustrating the construction of the enhanced attack detection rule set in the network attack detection method of this application. Figure 4 This is a flowchart illustrating Embodiment 3 of the network attack detection method of this application; Figure 5 This is a flowchart illustrating the overall process of the network attack detection method described in this application. Figure 6 This is a schematic diagram of the module structure of the network attack detection device according to an embodiment of this application; Figure 7 This is a schematic diagram of the device structure of the hardware operating environment involved in the network attack detection method in this application embodiment.

[0019] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0020] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0021] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0022] The main solution of this application embodiment is as follows: when network traffic data is detected, protocol parsing and feature extraction are performed on the network traffic data to obtain structured traffic features of the network traffic data; semantic analysis is performed on all original attack detection rules in the original attack detection rule set to generate target attack detection rule variants corresponding to each original attack detection rule; an enhanced attack detection rule set is constructed based on the original attack detection rules and the corresponding target attack detection rule variants; and the structured traffic features are matched and detected based on the enhanced attack detection rule set to obtain the network attack detection results of the network traffic data.

[0023] Because existing network attack detection methods typically rely on manually written attack detection rules or simple string replacement of known attacks, their coverage is limited, they are prone to false negatives, and their accuracy is low.

[0024] This application provides a solution that, by performing structural parsing and semantic analysis on the original attack detection rules, understands the attack intent of the rules and generates multiple rule variants to construct an enhanced attack detection rule set containing the original rules and variant rules. Based on this enhanced set, structured traffic features are matched and detected, enabling the identification of attack variants with the same attack logic but different surface forms. This solves the technical problem of low accuracy in existing network attack detection methods due to the small coverage of attack detection rules.

[0025] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device or network attack detection device capable of performing the above functions. The following description uses a network attack detection device (hereinafter referred to as the device) as an example to illustrate this embodiment and the subsequent embodiments.

[0026] Based on this, embodiments of this application provide a network attack detection method, referring to... Figure 1 , Figure 1 This is a flowchart illustrating an embodiment of the network attack detection method of this application.

[0027] In this embodiment, the network attack detection method includes steps S10 to S40: Step S10: Upon detecting network traffic data, perform protocol parsing and feature extraction on the network traffic data to obtain structured traffic features of the network traffic data.

[0028] Understandably, network traffic data can be a sequence of data packets transmitted through a communication network. This can include real-time traffic captured by network boundary gateways, mirrored ports of core switches, and server network interface cards, as well as offline stored traffic log files. This embodiment does not impose any limitations on this. In a network communication environment, network traffic data can be transmitted in the network in the form of multiple network data packets. Each network data packet can contain transport layer header information for routing and transmission control (such as source address, destination address, source port, destination port, and protocol type) and the actual application layer data content transmitted, i.e., application layer payload data (such as HTTP request content, DNS query content, and TLS handshake information).

[0029] It is also understood that structured traffic features can be a set of feature information extracted from raw network data packets and organized according to a preset data format and fields. This can include, but is not limited to, the communication 5-tuple information field (source IP address, destination IP address, source port number, destination port number, transport layer protocol type), protocol status fields (such as TCP connection status, HTTP request method, HTTP response status code), application layer standardized payload fields (such as the HTTP request URI and request body after URL decoding and HTML entity decoding), and connection status fields (such as session identifier, timestamp). In practical applications, raw network data packets typically exist in the form of binary byte streams, containing nested headers and payload data from different protocol layers. Devices can parse these layers according to protocol specifications, extract key fields, and reassemble them according to a unified data structure to form structured traffic features that can be directly used by subsequent rule matching and semantic analysis modules. This eliminates the differences caused by different protocol formats and encoding methods, improving the efficiency and accuracy of subsequent matching and detection. These structured traffic features can be stored in structured data form (such as JSON format, key-value pair sets, or table format) so that subsequent matching and detection can directly call various fields for comparison.

[0030] In practical implementation, the device can acquire raw network packets passing through the monitored link in real time through traffic acquisition probes deployed in the network or packet capture interfaces at the operating system kernel level. After acquiring the network traffic data, the device can parse each packet layer by layer according to protocol specifications. From the network layer, it extracts the source Internet Protocol address, destination Internet Protocol address, and protocol type; from the transport layer, it extracts the source port number, destination port number, and Transmission Control Protocol (TCP) flags; and from the application layer, it extracts the request method, Uniform Resource Locator (URL), request header, and payload content. Then, the device can perform encoding and restoration processing on the extracted payload content, restoring the payload content processed by URL encoding, Base64 encoding, or HTML entity encoding to the original string form. Finally, the extracted key fields from each layer are organized according to a preset format to construct a structured set of feature information as structured traffic features.

[0031] Furthermore, the step of performing protocol parsing and feature extraction on the network traffic data to obtain structured traffic features of the network traffic data includes: Step S11: Perform protocol identification on the network data packets in the network traffic data to determine the protocol type of the network data packets.

[0032] Understandably, a network data packet is the most basic unit of transmission in network traffic data; that is, a data segment transmitted over a physical network in network communication. In practical applications, data can be divided into smaller data blocks before transmission, and each data block is appended with header information for routing and transmission control to form a network data packet. Network data packets typically follow a layered protocol structure, containing, from the outside in, a link layer header, a network layer header, a transport layer header, and application layer payload data.

[0033] It is also understood that the network data packets in this embodiment may be Transmission Control Protocol (TCP) data packets, User Datagram Protocol (UDP) data packets, or Internet Control Message Protocol (ICP) data packets, etc., and their type is determined by the type of transport layer protocol used in network communication.

[0034] It should be understood that the protocol type can be an identifier of the type of communication protocol used by the network data packet. It can include network layer protocol type and transport layer protocol type. The network layer protocol type is used to indicate the protocol used by the network layer of the network data packet, such as IPv4 and IPv6. The transport layer protocol type is used to indicate the protocol used by the transport layer of the network data packet, such as TCP, UDP, and ICMP.

[0035] In its implementation, after acquiring a network data packet, the device can read the data content following the link layer header, parse the network layer header according to the Internet Protocol version 4 (IP4) or Internet Protocol version 6 (IP6) header format, read the values ​​of protocol fields from the network layer header, and determine the transport layer protocol type of the network data packet based on the values ​​of the protocol fields. Furthermore, the device can read the next header type field after the Ethernet header in the network data packet to determine the network layer protocol type, and further determine the transport layer protocol type. Specifically, if the network data packet uses Transmission Control Protocol (TCP), the protocol type is determined to be TCP; if the network data packet uses User Datagram Protocol (UDP), the protocol type is determined to be UDP; if the network data packet uses Internet Control Message Protocol (ICP-MS), the protocol type is determined to be ICP-MS.

[0036] Step S12: Perform protocol parsing on the network data packet according to the protocol type, and extract the transport layer header information and application layer payload data of the network data packet.

[0037] It should be understood that transport layer header information can be the field information contained in the transport layer protocol header of a network data packet. This can include source port number, destination port number, sequence number, acknowledgment number, data offset, flags (such as SYN flag, ACK flag, and FIN flag), window size, checksum, and urgent pointer. In practical applications, devices can parse and extract these fields from the transport layer header of network data packets to identify the uniqueness of the communication session and the connection status.

[0038] It should also be understood that application layer payload data can be the actual application layer data content carried after the transport layer header in a network data packet. In a Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) segment, the valid data portion following the transport layer header is the application layer payload data. This data can contain the content actually transmitted by the application, such as the request line and request body in an HTTP request, the status line and response body in an HTTP response, the domain name information in a DNS query, and the certificate information in a TLS handshake. In this embodiment, after completing network layer and transport layer parsing, the device can extract all data bytes following the transport layer header from the network data packet as the application layer payload data.

[0039] In practical implementation, after determining the protocol type of the network data packet, the device can obtain the transport layer header format definition corresponding to that protocol type, and parse the transport layer header from the network data packet according to this format definition to extract the various fields contained in the transport layer header. Specifically, if the protocol type is Transmission Control Protocol (TCP), the source port number, destination port number, sequence number, acknowledgment number, and flag bits can be parsed according to the TCP header format; if the protocol type is User Datagram Protocol (UDP), the source port number, destination port number, message length, and checksum can be parsed according to the UDP header format. After completing the transport layer header parsing, the device can extract all data content following the transport layer header from the network data packet as application layer payload data.

[0040] Step S13: Encode and restore the application layer payload data to obtain the standardized payload data of the network data packet.

[0041] It should be noted that standardized payload data can be data content with a unified character encoding and format specification obtained by performing encoding restoration processing on the original application layer payload data. Since the original application layer payload data may contain various encoding formats, such as URL percent sign encoding, Base64 encoding, HTML entity encoding, and Unicode escape encoding, these encoding formats will change the surface character representation of the payload data but not its semantic content. Therefore, the device can decode and restore these encodings, uniformly converting payload data with different encoding formats into standard character set encoding (such as UTF-8 encoding) and standard format (such as plain text format), thereby obtaining standardized payload data. This allows for keyword matching and regular expression matching in a unified format during subsequent matching and detection.

[0042] Step S14: Construct structured traffic features of the network traffic data based on the transport layer header information and the standardized payload data.

[0043] In this embodiment, network traffic data packets are identified by protocol, and headers are parsed layer by layer according to protocol type to extract transport layer header information and application layer payload data. The application layer payload data is then encoded and restored to obtain standardized payload data. Based on the transport layer header information and standardized payload data, a structured traffic feature with a unified format is constructed. This transforms the diverse and encoded binary data packets in the original network traffic into standardized data input with clear fields and a unified format. This allows subsequent rule-based matching detection to directly perform accurate comparisons and logical judgments based on field indices, eliminating the need to repeatedly perform protocol parsing and encoding restoration operations during each detection, thus improving the efficiency of network attack detection. Simultaneously, the standardized payload data eliminates the possibility of attackers bypassing detection through encoding transformations, enabling the detection engine to perform matching based on the restored true attack payload, thereby improving the accuracy and comprehensiveness of attack variant detection.

[0044] Step S20: Perform semantic analysis on all original attack detection rules in the original attack detection rule set using a preset large language model to generate target attack detection rule variants corresponding to each original attack detection rule.

[0045] It should be noted that the preset large language model can be a pre-configured artificial intelligence model used for semantic understanding and analysis of structured attack detection rules. Specifically, it can be a large language model (LLM), or a model specifically designed for network security rule analysis obtained by fine-tuning a general large language model. In this embodiment, the preset large language model has natural language understanding and reasoning capabilities, enabling it to understand the semantic meaning of each field in the input structured attack detection rules, identify the attack targets, attack steps, logical relationships between key matching conditions, and attack intent, and return the analysis results according to the specified output format.

[0046] It should be noted that the original attack detection rule set can be a predefined set of detection rules used to identify network attack behavior. This set can be stored in the form of a rule base on the device's local storage medium or in a remote rule server. Each rule can be pre-written by network security experts based on known attack characteristics.

[0047] It should also be noted that the original attack detection rule set can be implemented in various formats, such as the Snort rule format, the Suricata rule format, or a custom structured rule format. Taking Snort rules as an example, each detection rule can contain two parts: a rule header and rule options. The rule header defines the protocol type (such as TCP, UDP, ICMP), communication direction (such as from an external network to an internal server, or from an internal network to an external network), source address range (such as any address or a specific network segment), destination address range (such as a specific server IP address), and port range (such as port 80 for HTTP services, or port 443 for HTTPS services). The rule options define keyword matching conditions (i.e., the content field, used to match specific strings in the payload), regular expression matching conditions (i.e., the pcre field, used to match strings that conform to a specific regular expression pattern), logical connection relationships (such as multiple conditions being related by "AND" or "OR"), and corresponding alarm information (i.e., the msg field, used to describe the attack type and provide an alarm description).

[0048] Understandably, a raw attack detection rule can be a single detection rule from a set of raw attack detection rules, which can be used to define the detection logic for a class of known network attack behaviors. In this embodiment, each raw attack detection rule can independently specify all the matching conditions required to identify a specific attack method, including network layer conditions, transport layer conditions, and application layer conditions, as well as the operations to be performed after the rule is hit.

[0049] It should be noted that the target attack detection rule variant can be a derived rule that has the same attack detection semantics as the original attack detection rule but differs in its specific matching expression. In this embodiment, the target attack detection rule variant and the original attack detection rule are consistent at the attack intent level, that is, the attack logic defined by the variant rule is substantially equivalent to the attack logic defined by the original rule. However, the variant rule differs from the original rule in the specific string literal form, regular expression expression method, or encoding representation, thereby enabling the variant rule to match known attack variants generated by literal transformation.

[0050] It should also be noted that variants of the target attack detection rule can include, but are not limited to, encoding variants, syntax variants, and regular expression equivalent variants. Encoding variants can be variants generated by encoding transformations of key characters or strings in the original rule, such as performing URL encoding transformations, HTML entity encoding transformations, or Unicode encoding transformations on key strings. Syntax variants can be variants generated by performing syntax-level transformations on key characters or strings while maintaining the original rule's attack logic, such as case conversion, character splitting, delimiter insertion, comment character insertion, or equivalent substitution of logical operators. Regular expression equivalent variants can be variants generated by performing equivalent rewriting of regular expression fragments in the original rule, such as character class replacement, grouping method adjustment, quantifier equivalent rewriting, or escape form conversion.

[0051] In its implementation, the device can read all original attack detection rules from the local rule base and perform structured parsing on each rule to extract the effective fields used for attack detection. Then, it categorizes and organizes the extracted fields according to attack type, grouping rule fields belonging to the same attack type together to generate a structured representation for each rule. Subsequently, the device can perform semantic analysis on the structured rules using a large language model to understand the attack essence, core matching conditions, and attack intent described by each rule, extracting the semantic features corresponding to the rules. Based on the extracted semantic features, it performs equivalent transformation processing on each original attack detection rule, generating one or more target attack detection rule variants for each original rule that have the same attack semantics but different expressions.

[0052] Step S30: Construct an enhanced attack detection rule set based on the original attack detection rule and the corresponding variant of the target attack detection rule.

[0053] It should be understood that the enhanced attack detection rule set is an expanded rule set composed of the original attack detection rules and the target attack detection rule variants corresponding to each original attack detection rule. In this embodiment, the enhanced attack detection rule set includes two parts: original rules and variant rules. The original rules retain the original detection logic to ensure accurate identification of known attacks, while the variant rules cover various equivalent transformations of the original rules to improve the generalization detection capability of known attack variants.

[0054] In practical applications, the device can merge validated target attack detection rule variants with their corresponding original attack detection rules to form an enhanced rule set. During the merging process, the device can assign matching priorities to each rule in the set, such as assigning high priority to the original attack detection rules and low priority to the target attack detection rule variants. This allows the device to prioritize using the original rules for precise matching during subsequent matching detection, and only invoke the variant rules for fuzzy matching when the original rule fails to match. This ensures the accuracy of detecting known attacks while expanding the detection coverage of attack variants.

[0055] Step S40: Based on the enhanced attack detection rule set, perform matching detection on the structured traffic features to obtain the network attack detection result of the network traffic data.

[0056] Understandably, network attack detection results can be used to indicate whether network traffic data contains network attack behavior and the type of attack it belongs to. In this embodiment, network attack detection results may include matching identifier information and matching rule information. The matching identifier information indicates whether network traffic data is determined to be an attack behavior. When all matching conditions of the structured traffic features and any rule in the enhanced attack detection rule set are met, the matching identifier information is assigned a hit value; otherwise, it is assigned a miss value. The matching rule information provides relevant information about the specific hit rule in the case of a hit. This information may include the rule number, rule type, rule message content, matching priority, and specific matching conditions of the hit rule. In practical applications, network attack detection results can be output in a structured data format, such as JSON or XML, to facilitate subsequent log recording, alarm generation, or automated response processing.

[0057] In its implementation, the device compares and matches structured traffic features with each rule in the enhanced attack detection rule set according to their matching priority. Specifically, the device first calls a high-priority original attack detection rule to perform a precise match on the structured traffic features, determining whether the features meet all matching conditions of the original rule. If a precise match is successful, the hit result is directly output. If a precise match fails, a low-priority target attack detection rule variant is called to perform a fuzzy match on the structured traffic features, determining whether the features are semantically consistent with any variant rule. During the matching detection process, the device can determine whether network traffic data contains attack behavior based on the matching results and output a network attack detection result containing matching identifiers and matching rule information.

[0058] This embodiment provides a network attack detection method. The method discloses that, upon detecting network traffic data, it performs protocol parsing and feature extraction on the network traffic data to obtain structured traffic features; it performs semantic analysis on all original attack detection rules in the original attack detection rule set using a pre-set large language model to generate target attack detection rule variants corresponding to each original attack detection rule; it constructs an enhanced attack detection rule set based on the original attack detection rules and their corresponding target attack detection rule variants; and it performs matching detection on the structured traffic features based on the enhanced attack detection rule set to obtain the network attack detection results for the network traffic data. Compared to existing network attack detection methods... Traditional network attack detection methods typically rely on manually written attack detection rules or simple string replacement of known attacks, resulting in limited coverage, a high risk of false negatives, and low accuracy. This embodiment addresses this by performing structural parsing and semantic analysis on the original attack detection rules to understand their attack intent and generate various rule variants. This constructs an enhanced attack detection rule set containing both the original and variant rules. Based on this enhanced set, structured traffic features are matched and detected, enabling the identification of attack variants with the same attack logic but diverse surface forms. This solves the technical problem of low accuracy in existing network attack detection methods due to the limited coverage of attack detection rules.

[0059] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in the first embodiment described above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 2 , Figure 2 This is a flowchart illustrating Embodiment 2 of the network attack detection method of this application.

[0060] In this embodiment, step S20 further includes steps S21 to S24: Step S21: Perform structural parsing on all original attack detection rules in the original attack detection rule set, and extract the key attack detection fields from the original attack detection rules.

[0061] It should be noted that the key attack detection field can be a collection of matching conditions and constraint information extracted from the original attack detection rules that have a substantial effect on attack detection. In this embodiment, the key attack detection field can specifically be the fields in the original attack detection rules used to define the detection conditions (such as protocol type, matching keywords, regular expressions, etc.) for attack behavior. These can include protocol type fields (such as "http", "tcp", "udp"), communication direction fields (such as "any→any"), address and port constraint fields (such as source address range, destination address range, source port range, destination port range), keyword matching fields (i.e., the matching string and its modifiers defined by the content field), regular expression matching fields (i.e., the regular expression defined by the pcre field), logical connection relationship fields (representing the combination of multiple matching conditions), alarm information fields (i.e., the msg field, used to describe the attack type), etc.

[0062] In its implementation, after obtaining the original attack detection rule set, the device performs lexical and syntactic analysis on each original attack detection rule to identify the rule header and rule options. Then, the device extracts network and transport layer matching conditions such as protocol type, source address, source port, destination address, and destination port from the rule header. It also extracts detection fields defining attack behavior from the rule options according to a preset list of key fields, reads the values ​​of each field, and finally integrates these fields and their values ​​into key attack detection fields.

[0063] Step S22: Classify the key attack detection fields according to the attack category to obtain the structured attack detection rules corresponding to each of the original attack detection rules.

[0064] Understandably, attack categories can be classification labels used to categorize attack detection rules. These can include SQL injection attacks (SQL statement injection targeting databases), cross-site scripting attacks (script injection targeting web browsers), command injection attacks (command execution injection targeting operating systems), file inclusion attacks (file inclusion targeting server file systems), path traversal attacks (path traversal and access to file directories), and code execution attacks (remote code execution). In practical applications, different attack categories have different targets, methods, and characteristics. Devices can use this to group rules with similar attack characteristics into one category.

[0065] It is also understood that structured attack detection rules can be rule data obtained by reorganizing and representing the key attack detection fields in the original attack detection rules according to a preset format. This can be presented in the form of field-value pairs, thereby splitting and labeling the components of the original rules according to functional dimensions. In practical applications, the original attack detection rules are usually stored in a specific syntax format (such as the Snort rule format), with different fields distinguished by specific delimiters and keywords. However, the arrangement of fields may not be regular enough, making subsequent semantic analysis difficult. Therefore, in this embodiment, the device can parse the original attack detection rules and organize the extracted key attack detection fields according to a unified field name-field value correspondence to form a structured data representation, such as a key-value pair set presented in JSON, XML, or tabular format, which facilitates subsequent input into a preset large language model for semantic analysis.

[0066] In practical applications, after extracting the key attack detection fields from the original attack detection rules, the device can first determine the attack category to which the original attack detection rule belongs based on the attack category field (such as the classtype field). For example, if the value of the classtype field is "web-application-attack", the original attack detection rule can be classified as a Web application attack; if the value of the classtype field is "attempted-dos", the original attack detection rule can be classified as a denial-of-service attack. After determining the attack category, the device can merge the key attack detection fields of multiple original attack detection rules belonging to the same attack category into the same group to facilitate subsequent batch semantic analysis and variant generation according to the attack category. In addition, the device can also use attack type keywords contained in the msg field or matching content features in the content field to help determine the attack category.

[0067] Step S23: Perform semantic analysis on the structured attack detection rules using a preset large language model to obtain the rule semantic features of each of the original attack detection rules.

[0068] It should be noted that rule semantic features can be structured data used to describe the attack semantic information of the original attack detection rules. This can include the attack object (i.e., the target type of the rule, such as a database, web server, operating system, etc.) and key matching content (i.e., the core strings or patterns in the rule used to match attack features, such as the SQL keyword "SELECT" or the script tag "..."). <script>”等）、逻辑关系（即多个匹配条件之间的组合关系，例如"与”关系、"或”关系、"非”关系等）、字符约束（即匹配内容中关于字符类型的限制条件，例如"SELECT后不能紧跟字母”）以及攻击意图（即规则所描述的攻击行为的目的，例如获取未授权数据、执行远程命令、篡改网页内容等）。

[0069] 在具体实现中，设备在获得结构化攻击检测规则之后，可以从本地存储或缓存中读取预先配置的任务描述信息和输出格式约束信息，其中，任务描述信息用于向预设大语言模型说明当前需要执行的分析任务，例如其可以是包含"请分析以下网络攻击检测规则的攻击语义特征”的指令文本；输出格式约束信息用于指示预设大语言模型按照指定的格式输出语义分析结果，例如要求以JSON格式输出包含攻击对象、关键匹配内容、逻辑关系、字符约束和攻击意图五个字段的分析结果。然后，设备可以将结构化攻击检测规则、任务描述信息和输出格式约束信息组合为提示词（即Prompt），并将提示词输入预设大语言模型，以使预设大语言模型对提示词中的结构化攻击检测规则进行语义理解，识别出规则中各个字段的语义含义以及各字段之间的逻辑组合关系，推断规则所描述的攻击行为的本质，并按照输出格式约束信息生成结构化的语义分析结果，从而获得各原始攻击检测规则的规则语义特征。

[0070] 例如，对于前述SQL注入检测规则的结构化攻击检测规则，预设大语言模型输出的规则语义特征可以包括：攻击对象为"数据库”、关键匹配内容为"SELECT”和"USER”、逻辑关系为"SELECT与USER两个条件必须同时满足”、字符约束为"SELECT之后不能紧跟字母字符”、攻击意图为"通过向数据库查询语句中注入恶意SQL关键字以获取未授权数据”。

[0071] 步骤S24：通过所述预设大语言模型基于所述规则语义特征对各所述原始攻击检测规则进行等价变形处理，生成各所述原始攻击检测规则对应的目标攻击检测规则变体。

[0072] 可理解的是，等价变形处理可以是在保持原始攻击检测规则的攻击语义不变的前提下，对规则的表达形式进行变换以生成具有相同攻击意图但不同字面形式的规则变体的操作，其可以包括编码变换（例如将关键字符转换为URL编码形式、HTML实体编码形式或Unicode编码形式）、语法变换（例如对关键字符执行大小写变换、插入注释符、插入分隔符或拆分字符）以及正则等价变换（例如对正则表达式执行字符类替换、分组方式调整或量词等价改写）等。

[0073] 还可理解的是，等价变形处理的核心在于保证变形后的规则与原始规则在攻击逻辑层面一致，即变形后的规则所能够匹配的攻击行为与原始规则所能够匹配的攻击行为在攻击本质上相同，但变形后的规则在具体的匹配字符串、正则表达式或编码形式上存在差异。

[0074] 实际应用中，设备在获得各原始攻击检测规则的规则语义特征之后，可以从规则语义特征中提取攻击对象、关键匹配内容、逻辑关系、字符约束和攻击意图等信息，并根据这些信息确定原始攻击检测规则中允许变换的字段以及允许变换的方式。然后，设备可以针对关键匹配内容中的字符串或正则表达式片段，生成多种等价表达形式，具体地，对于编码变换，设备可以将关键匹配内容中的字符转换为URL编码形式、HTML实体编码形式或Unicode编码形式，生成对应的编码变体规则；对于语法变换，设备可以对关键匹配内容中的字符执行大小写变换、插入注释符号、插入分隔符或拆分字符操作，生成对应的语法变体规则；对于正则等价变换，设备可以对原始规则中的正则表达式片段执行字符类替换、分组方式调整或量词等价改写，生成对应的正则等价变体规则。最后，设备可以对生成的各候选变体规则执行有效性校验，并将通过校验的候选变体规则确定为目标攻击检测规则变体。

[0075] 进一步地，所述步骤S24包括：步骤S241：通过所述预设大语言模型根据所述规则语义特征确定所述原始攻击检测规则中的允许变换字段。

[0076] 应理解的是，允许变换字段可以是原始攻击检测规则中允许被修改或替换以生成变体的字段。在本实施例中，允许变换字段具体可以是原始攻击检测规则中属于字面表达形式而非攻击逻辑必需部分的关键字段片段，其可以包括但不限于关键字（如SQL关键字"SELECT”、"UNION”、"DROP”，脚本标签"<script>”、"<iframe>”，命令关键字"cat”、"wget”）、操作符（如逻辑运算符、比较运算符 、算术运算符）、特殊字符（如引号、分号、括号）、字符串常量（如固定路径字符串、固定参数名）以及正则表达式片段（如字符类、量词、分组括号）等。

[0077] 实际应用中，设备在获得各原始攻击检测规则的规则语义特征之后，可以从各原始攻击检测规则的规则语义特征中提取出关键匹配内容所对应的原始字段来源，例如从content字段或pcre字段中提取出的匹配字符串或正则表达式片段，并将提取出的关键匹配内容所对应的原始字段确定为允许变换字段，同时将规则中与攻击语义不直接相关的字段（例如位置限定字段、逻辑组合字段）排除在允许变换字段之外。

[0078] 步骤S242：根据所述允许变换字段在所述原始攻击检测规则中的语义角色确定所述允许变换字段对应的字段类型。

[0079] 可理解的是，语义角色可以是允许变换字段在原始攻击检测规则的匹配条件中所承担的功能和作用，其可以用于指示该字段在规则中扮演的角色以及该字段与规则其他部分之间的语义关系。例如，当允许变换字段为"SELECT”时，其在SQL注入检测规则中的语义角色为"SQL查询语句中的操作关键字”，用于指示该字段为SQL语言的关键字；当允许变换字段为"<script>”时，其在跨站脚本检测规则中的语义角色为"HTML文档中的脚本标签起始标记”，用于指示该字段为HTML标签；当允许变换字段为"'”时，其在SQL注入检测规则中的语义角色为"字符串值的定界符”，用于指示该字段用于界定字符串的起始和结束。其中，不同语义角色对应的字段类型不同，进而对应不同的变换策略。

[0080] 还可理解的是，字段类型可以是允许变换字段在数据格式和语法层面所属的类型类别，其是语义角色的抽象分类，不同的语义角色可以归属于相同的字段类型。在本实施例中，字段类型可以包括字符串常量类型、正则表达式类型、字节序列类型、特殊字符类型等，其中，字符串常量类型即匹配固定字符串内容的字段，例如content字段中指定的"SELECT”字符串；正则表达式类型即匹配正则表达式模式的字段，例如pcre字段中指定的正则表达式片段；字节序列类型即匹配特定字节序列的字段；特殊字符类型即匹配特定特殊字符的字段，例如匹配单引号、双引号、分号等字符的字段。

[0081] 实际应用中，设备在确定允许变换字段之后，可以从规则语义特征中获取该允许变换字段的语义角色信息。若该允许变换字段用于直接匹配固定的攻击特征字符串，则可以确定该允许变换字段的语义角色为关键字匹配角色，并进一步确定该允许变换字段的字段类型为字符串常量类型；若该允许变换字段用于通过正则表达式匹配攻击模式，则可以确定该允许变换字段的语义角色为正则表达式匹配角色，并进一步确定该允许变换字段的字段类型为正则表达式类型；若该允许变换字段用于匹配特定范围的字节序列，则可以确定该允许变换字段的语义角色为字节序列匹配角色，并进一步确定该允许变换字段的字段类型为字节序列类型；若该允许变换字段用于匹配特定特殊字符，则可以确定该允许变换字段的语义角色为字符约束角色，并进一步确定该允许变换字段的字段类型为特殊字符类型。

[0082] 步骤S243：从预设变体策略库中查询所述字段类型匹配的目标规则变换策略，所述目标规则变换策略包括编码变换、语法变换和正则等价变换中的至少一种。

[0083] 应说明的是，预设变体策略库可以是预先存储有多种字段类型与变换策略之间的映射关系的知识库，其中的每条记录定义了针对特定字段类型可用的变换方式集合。例如，对于"字符串常量类型”的字段，预设变体策略库中可以记录其对应的变换方式包括编码变换、大小写变换、分隔符插入和字符拆分；对于"正则表达式类型”的字段，预设变体策略库中可以记录其对应的变换方式包括字符类替换、分组调整和量词改写。

[0084] 还应说明的是，目标规则变换策略可以是从预设变体策略库中查询到的、针对允许变换字段的字段类型所匹配的具体变换方式，其可以用于指导对允许变换字段执行具体的等价变形操作。在本实施例中，目标规则变换策略可以包括编码变换、语法变换和正则等价变换中的至少一种。

[0085] 可理解的是，编码变换可以是将原始攻击检测规则中的关键字符或字符串按照特定编码规则转换为另一种编码表示形式的变换方式，其可以用于应对攻击者通过对攻击载荷进行编码处理以绕过检测的场景。在本实施例中，编码变换可以包括URL编码变换、HTML实体编码变换、Unicode编码变换等，其中，URL编码变换可以指将关键字符串中的每个字符转换为其对应的URL编码形式，例如将"SELECT”转换为"%53%45%4C%45%43%54”；HTML实体编码变换可以指将关键字符串中的每个字符转换为其对应的HTML实体编码形式，例如将"SELECT”变换为"SELECT”；Unicode编码变换可以指将关键字符串中的每个字符转换为其对应的Unicode编码转义形式，例如将"SELECT”转换为"\u0053\u0045\u004C\u0045\u0043\u0054”。

[0086] 还可理解的是，语法变换可以是在不改变原始攻击检测规则攻击逻辑的前提下，对规则中关键字符或字符串的语法表现形式进行变换的操作，其可以用于应对攻击者通过对攻击载荷执行语法层面的变形以绕过检测的场景。在本实施例中，语法变换可以包括大小写变换、关键字拆分、分隔符插入、逻辑操作符等价替换、空白符插入等，其中，大小写变换可以指将关键字变换为全小写、全大写或混合大小写形式，如将"SELECT”变换为"select”、"SeLeCt”；关键字拆分可以指在关键字中插入空格、制表符或换行符，如将"SELECT”变换为"SEL ECT”；分隔符插入可以指在关键字中插入注释符或特殊字符，如将"SELECT”变换为"S / / ELECT”、"SEL%4CECT”；逻辑操作符等价替换可以指对逻辑操作符执行等价替换，如将"AND”替换为"&&”、"OR”替换为"||”；空白符插入可以指在关键字前后或中间插入空白字符。

[0087] 应理解的是，正则等价变换可以是对原始攻击检测规则中的正则表达式片段执行等价改写以生成具有相同匹配能力但不同表达形式的正则表达式的变换方式，其可以用于应对攻击者通过对攻击载荷中的正则表达式匹配模式进行等价变形以绕过检测的场景。在本实施例中，正则等价变换可以包括字符类替换（如将"[0-9]”替换为"\d”、"[A-Za-z]”替换为"\w”）、分组方式调整（如将"(abc)”调整为"(?:abc)”、"(abc)”调整为"(a)(b)(c)”）、量词等价改写（如将"+”替换为"{1,}”、"?”替换为"{0,1}”）、可选项展开或合并（如将"[abc]”展开为"(a|b|c)”或将"(a|b|c)”合并为"[abc]”）以及转义形式转换（如将".”替换为"[.]”、"\”替换为"\x5c”）等。

[0088] 步骤S244：基于所述目标规则变换策略对所述允许变换字段进行变换操作，生成所述原始攻击检测规则的候选攻击检测规则变体。

[0089] 可理解的是，候选攻击检测规则变体可以是对原始攻击检测规则中的允许变换字段执行变换操作后生成的、尚未经过有效性校验的中间状态规则。实际应用中，候选攻击检测规则变体可能存在语法错误、正则表达式编译错误或语义偏移等问题，因此需要经过有效性校验才能被确定为目标攻击检测规则变体并纳入增强攻击检测规则集合。

[0090] 实际应用中，设备可以基于目标规则变换策略对允许变换字段执行变换操作，生成原始攻击检测规则的候选攻击检测规则变体。具体地，若目标规则变换策略为编码变换策略，则可以对允许变换字段中的每个字符执行编码操作，例如将字符转换为其URL编码形式、HTML实体编码形式或Unicode编码形式，生成对应的编码变体规则；若目标规则变换策略为语法变换策略，则可以对允许变换字段中的字符串执行语法层面的变换操作，例如对字符执行大小写变换、在合法位置插入分隔符、插入注释符号或替换逻辑操作符，生成对应的语法变体规则；若目标规则变换策略为正则等价变换策略，则可以对允许变换字段中的正则表达式片段执行等价改写操作，例如执行字符类替换、分组方式调整、量词等价改写或转义形式转换，生成对应的正则等价变体规则。其中，设备会将原始攻击检测规则中除允许变换字段以外的其他字段保持不变，将变换后的允许变换字段替换原始字段，从而形成完整的候选攻击检测规则变体。

[0091] 步骤S245：对所述候选攻击检测规则变体进行有效性校验，并将通过校验的所述候选攻击检测规则变体确定为目标攻击检测规则变体。

[0092] 在具体实现中，设备在生成候选攻击检测规则变体之后，首先可以对候选攻击检测规则变体执行语法解析校验，检查候选攻击检测规则变体的整体语法结构是否正确，例如检查规则头部是否完整、规则选项的格式是否符合规范、各个字段的取值是否在其允许的取值范围内。若某条候选攻击检测规则变体存在语法错误，则可以该候选攻击检测规则变体标记为无效并予以过滤。随后，设备可以对候选攻击检测规则变体执行正则表达式编译校验，检查候选攻击检测规则变体中涉及的正则表达式片段是否能够被正确编译，若无法编译则可以将该候选攻击检测规则变体过滤。然后，设备还可以将候选攻击检测规则变体与预设的已知攻击样本进行匹配测试，检查候选攻击检测规则变体是否能够触发原始攻击样本的命中，若某条候选攻击检测规则变体无法触发任何已知攻击样本的命中，则可以判定该候选攻击检测规则变体已丧失攻击检测能力，并将其过滤。此外，设备还可以将候选攻击检测规则变体与原始攻击检测规则进行语义一致性比较，判断候选攻击检测规则变体与原始攻击检测规则在攻击对象、关键匹配内容和攻击意图等方面是否保持一致，若语义不一致则将该候选攻击检测规则变体过滤。另外，设备还可以将候选攻击检测规则变体与已经通过校验的其他候选攻击检测规则变体进行比较，判断是否存在重复内容，若重复则将重复的候选攻击检测规则变体过滤。最后，设备可以将通过上述全部有效性校验的候选攻击检测规则变体确定为目标攻击检测规则变体。

[0093] 在本实施例中，通过根据规则语义特征确定原始攻击检测规则中的允许变换字段，根据允许变换字段在原始攻击检测规则中的语义角色确定对应的字段类型，从预设变体策略库中查询字段类型匹配的目标规则变换策略，基于目标规则变换策略对允许变换字段进行变换操作以生成候选攻击检测规则变体，并对候选攻击检测规则变体进行有效性校验以将通过校验的候选攻击检测规则变体确定为目标攻击检测规则变体，使得生成的目标攻击检测规则变体能够覆盖编码变换、语法变换和正则等价变换等多种攻击者常用的绕过手段，避免攻击变体的漏报，从而有利于提升后续网络攻击检测的准确性。

[0094] 进一步地，所述步骤S30包括：步骤S31：确定所述原始攻击检测规则和对应所述目标攻击检测规则变体的匹配字段相似度。

[0095] 需要说明的是，匹配字段相似度可以是用于表征目标攻击检测规则变体与对应的原始攻击检测规则在匹配字段层面上的相似程度的指标，其可以用于衡量目标攻击检测规则变体相对于原始攻击检测规则在检测逻辑上的相似性。在本实施例中，匹配字段可以是指检测规则中的关键字匹配条件（即content字段）、正则表达式匹配条件（即pcre字段）以及逻辑连接关系字段等对攻击检测具有实质作用的字段。匹配字段相似度可以通过对原始攻击检测规则和目标攻击检测规则变体的各匹配字段进行比较计算得到，例如，设备可以计算原始攻击检测规则与目标攻击检测规则变体之间相同的匹配字段数量占原始攻击检测规则匹配字段总数量的比例，并将该比值作为匹配字段相似度。此外，设备也可以计算原始攻击检测规则与目标攻击检测规则变体的匹配字段之间的文本相似度，例如通过编辑距离算法或余弦相似度算法计算两个规则对应字段的相似程度，并将计算结果作为匹配字段相似度。

[0096] 在具体实现中，设备在生成各原始攻击检测规则对应的目标攻击检测规则变体之后，可以从原始攻击检测规则中提取每一条目标攻击检测规则变体的关键匹配字段，并从目标攻击检测规则变体中提取对应的关键匹配字段。随后，设备可以将原始攻击检测规则的各匹配条件按照出现顺序排列为第一字段序列，将目标攻击检测规则变体的各匹配条件按照出现顺序排列为第二字段序列，然后计算第一字段序列与第二字段序列之间的相似度，以确定原始攻击检测规则与目标攻击检测规则变体之间的匹配字段相似度。此外，设备也可以统计原始攻击检测规则与目标攻击检测规则变体中完全相同的匹配字段的数量，并计算该数量与原始攻击检测规则中匹配字段总数的比值，并将比值作为匹配字段相似度。

[0097] 步骤S32：从所述目标攻击检测规则变体中确定并剔除所述匹配字段相似度超过预设相似度阈值的冗余攻击检测规则变体，以获得有效攻击检测规则变体。

[0098] 可理解的是，预设相似度阈值可以是预先设定的用于判断目标攻击检测规则变体是否为冗余攻击检测规则变体的匹配字段相似度临界值。其中，当目标攻击检测规则变体与对应的原始攻击检测规则的匹配字段相似度超过该预设相似度阈值时，该目标攻击检测规则变体可以被判定为冗余攻击检测规则变体。在本实施例中，预设相似度阈值可以根据增强攻击检测规则集合的目标规模、检测系统的性能要求和攻击变体覆盖需求动态调整，例如，预设相似度阈值可以设置为90%。

[0099] 应理解的是，冗余攻击检测规则变体可以是与对应的原始攻击检测规则在匹配字段上高度相似、新增检测覆盖能力有限的目标攻击检测规则变体。实际应用中，冗余攻击检测规则变体虽然在攻击语义层面与原始规则一致且语法正确，但其匹配字段与原始规则的匹配字段几乎相同，将该变体规则加入增强攻击检测规则集合后，并不能有效扩展对已知攻击变体的覆盖能力，反而会增加规则匹配时的计算开销，因此需要被剔除。例如，若一条目标攻击检测规则变体与原始攻击检测规则相比，仅对原始规则中的关键字进行了大小写变换，而该原始规则本身已包含不区分大小写的修饰符时，该变体在匹配字段层面与原始规则高度相似，该变体即为冗余攻击检测规则变体。

[0100] 还应理解的是，有效攻击检测规则变体可以是与对应的原始攻击检测规则的匹配字段相似度不超过预设相似度阈值的目标攻击检测规则变体，即能够为增强攻击检测规则集合带来实质性检测范围扩展的非冗余规则变体。

[0101] 实际应用中，设备在计算得到匹配字段相似度之后，可以将匹配字段相似度与预设相似度阈值进行比较，若某条目标攻击检测规则变体与对应的原始攻击检测规则之间的匹配字段相似度大于或等于预设相似度阈值，则可以将该目标攻击检测规则变体确定为冗余攻击检测规则变体，并将该变体规则标记为待剔除；若匹配字段相似度小于预设相似度阈值，则可以将该目标攻击检测规则变体确定为有效攻击检测规则变体。设备在完成对所有目标攻击检测规则变体的匹配字段相似度计算和比较之后，可以从目标攻击检测规则变体中剔除所有被标记为待剔除的冗余攻击检测规则变体，保留所有被确定为有效攻击检测规则变体的变体规则。

[0102] 步骤S33：将所述原始攻击检测规则和所述有效攻击检测规则变体进行合并，以构建增强攻击检测规则集合。

[0103] 实际应用中，设备在获得有效攻击检测规则变体之后，可以将原始攻击检测规则和有效攻击检测规则变体进行合并，构建增强攻击检测规则集合，并为增强攻击检测规则集合中的各条规则分配匹配优先级，将原始攻击检测规则分配为高优先级，将有效攻击检测规则变体分配为低优先级，然后将优先级信息与各条规则关联存储于增强攻击检测规则集合中。此外，设备还可以对增强攻击检测规则集合中的所有规则进行排序，将匹配优先级高的规则排列在前面，将匹配优先级低的规则排列在后面，以便于后续的匹配检测操作可以按照优先级顺序依次调用各条规则。

[0104] 在本实施例中，通过确定原始攻击检测规则和对应目标攻击检测规则变体的匹配字段相似度，并从目标攻击检测规则变体中剔除匹配字段相似度超过预设相似度阈值的冗余攻击检测规则变体以获得有效攻击检测规则变体，再将原始攻击检测规则和有效攻击检测规则变体进行合并以构建增强攻击检测规则集合，使得在构建增强攻击检测规则集合的过程中能够精准识别并剔除检测增益有限的冗余变体，避免了大量与原始规则高度相似的变体规则占用存储资源和匹配计算资源，从而可以在保持检测覆盖能力扩展的同时对增强攻击检测规则集合的规模进行有效控制。

[0105] 在具体实现中，参照图3，图3为本申请网络攻击检测方法中增强攻击检测规则集合的构建流程图。如图3所示，设备首先可以从本地规则库中读取原始攻击检测规则，并将原始攻击检测规则拆分为规则头部和规则选项两个组成部分，然后分别对这两个部分进行解析处理。随后，设备可以从规则选项中提取有效匹配字段，同时从规则选项中滤除规则维护字段，再按照攻击类别对有效匹配字段进行归类，获得各原始攻击检测规则对应的结构化规则语义特征。随后，设备可以将结构化规则语义特征输入大语言模型，以使大语言模型对结构化规则语义特征进行语义分析，识别该规则所描述的攻击行为的攻击意图，最终输出结构化的语义特征，该结构化的语义特征可以包括攻击对象标签、关键匹配内容标签、逻辑关系标签、字符约束标签和攻击意图标签。设备在获得大语言模型输出的结构化语义特征之后，可以从结构化语义特征中提取关键匹配内容标签所对应的原始字段来源，将承载核心攻击语义的content字段或pcre字段确定为允许变换的关键字段，并根据该关键字段在原始攻击检测规则中的语义角色和数据格式判断其字段类型。具体地，若该关键字段为content字段且匹配固定的字符串常量，则判断该字段为关键字 / 字符串类型；若该关键字段为匹配特殊字符的字段，则判断该字段为特殊字符类型；若该关键字段为pcre字段且包含正则表达式片段，则判断该字段为正则表达式或片段类型。

[0106] 此后，设备可以根据判断出的字段类型，从预设变体策略库中匹配对应的变换策略，其中，若字段类型为关键字 / 字符串类型或特殊字符类型，则可以匹配语法变换策略或编码变换策略，包括大小写变换、分隔符插入、注释符插入和逻辑操作符等价替换等具体变换操作；编码变换策略包括URL编码、HTML实体编码和Unicode编码等具体变换操作。若字段类型为正则表达式或片段类型，则可以匹配正则等价变换策略，包括字符类替换、量词等价改写、分组方式调整和转义形式转换等具体变换操作。随后，设备可以基于匹配到的变换策略对允许变换的关键字段执行变换操作，生成候选规则变体。具体地，设备可以将原始攻击检测规则中除允许变换字段以外的其他字段保持不变，并对生成的候选规则变体执行有效性校验，包括语法解析校验、正则表达式编译校验以及样本测试与语义一致性检查。若候选规则变体通过所有有效性校验，则可以将该候选规则变体确定为有效变体并予以保留；若候选规则变体未通过有效性校验，则可以该候选规则变体确定为无效变体并予以滤除。最后，设备可以将保留的有效变体与原始攻击检测规则合并，形成增强攻击检测规则集合。

[0107] 本实施例中，通过对原始攻击检测规则集合中的各原始攻击检测规则进行结构解析以提取关键攻击检测字段，并按照攻击类别对关键攻击检测字段进行归类以获得结构化攻击检测规则，再由预设大语言模型对结构化攻击检测规则进行语义分析以获得规则语义特征，最后基于规则语义特征对各原始攻击检测规则进行等价变形处理以生成对应的目标攻击检测规则变体，使得规则变体的生成不再依赖于人工分析和手动编写，从而有利于提升规则变体的生成效率；同时，由于规则变体是基于攻击语义而非字符串字面形式生成的，使得生成的变体能够识别攻击载荷中因编码转换、大小写变换、分隔符插入等方式产生的表达形式差异，从而可以在不改变检测精度的前提下提升对已知攻击变体的检测覆盖能力，降低了因攻击载荷变形导致的漏报风险。

[0108] 基于本申请第一实施例和 / 或第二实施例，在本申请第三种实施例中，与上述实施例相同或相似的内容，可以参考上文介绍，后续不再赘述。在此基础上，请参照图4，图4为本申请网络攻击检测方法实施例三提供的流程示意图。

[0109] 在本实施例中，步骤S40还包括步骤S41~S44：步骤S41：从所述增强攻击检测规则集合中筛选与所述结构化流量特征匹配的候选攻击检测规则子集。

[0110] 应说明的是，候选攻击检测规则子集可以是从增强攻击检测规则集合中初步筛选出的、与当前待检测的结构化流量特征的基础网络条件相匹配的规则子集。实际应用中，增强攻击检测规则集合中包含大量规则，若将结构化流量特征与集合中的所有规则逐一进行匹配比较，会严重影响检测效率。因此，设备可以在进行精细匹配之前，首先根据结构化流量特征中的网络层信息和传输层信息对增强攻击检测规则集合进行初步筛选，剔除与当前流量的协议类型、通信方向、地址范围和端口范围明显不匹配的规则，将剩余规则组成候选攻击检测规则子集，从而减少后续精确匹配和模糊匹配的计算开销。

[0111] 步骤S42：确定所述候选攻击检测规则子集中各攻击检测规则对应的匹配优先级，所述匹配优先级包括高优先级和低优先级，所述原始攻击检测规则对应所述高优先级，所述目标攻击检测规则变体对应所述低优先级。

[0112] 需要说明的是，匹配优先级可以是为增强攻击检测规则集合中各条规则分配的、用于指示匹配检测时的调用先后顺序的等级标识。实际应用中，匹配优先级可以用于控制匹配检测的执行顺序，确保高优先级的规则优先执行匹配，低优先级的规则在高级别规则匹配失败后才被执行。

[0113] 在本实施例中，匹配优先级可以包括高优先级和低优先级两个等级，其中，高优先级可以是分配给原始攻击检测规则的匹配优先级等级；低优先级可以是分配给目标攻击检测规则变体的匹配优先级等级。实际应用中，由于原始攻击检测规则是由安全专家依据已知攻击特征预先编写的规则，其匹配条件精确、检测结果准确且具有明确的规则依据，因此，设备可以将原始攻击检测规则设定为高优先级，确保在匹配检测过程中首先使用原始规则进行精确匹配，以优先保证对已知攻击的检测准确性。目标攻击检测规则变体是对原始攻击检测规则进行等价变形后生成的衍生规则，其检测覆盖范围更广，但匹配精度相对原始规则略有降低，因此，设备将目标攻击检测规则变体设定为低优先级，确保仅在原始规则匹配失败后才使用变体规则进行匹配，从而在扩大攻击变体覆盖范围的同时，保持原始规则的高精度检测结果优先输出。

[0114] 步骤S43：调用所述高优先级的所述原始攻击检测规则对所述结构化流量特征中的应用层载荷信息进行精确匹配，判断所述应用层载荷信息是否满足单条所述原始攻击检测规则的全部匹配条件。

[0115] 应说明的是，匹配条件可以是原始攻击检测规则中定义的所有需要同时满足的检测约束条件的完整集合，其可以包括规则头部条件（由规则头部定义的网络层和传输层匹配条件）和规则选项条件（由规则选项定义的载荷内容匹配条件）。其中，规则头部条件可以包括协议类型匹配条件、源地址匹配条件、源端口匹配条件、目的地址匹配条件和目的端口匹配条件；规则选项条件可以包括content字段指定的字符串匹配条件、pcre字段指定的正则表达式匹配条件、flow字段指定的流方向匹配条件和流状态匹配条件。在本实施例中，全部匹配条件之间可以为逻辑"与”关系，即结构化流量特征需要同时满足全部匹配条件才被视为命中该原始攻击检测规则。

[0116] 步骤S44：若精确匹配失败，则调用所述低优先级的所述目标攻击检测规则变体对所述结构化流量特征进行模糊匹配检测，获得所述网络流量数据的网络攻击检测结果。

[0117] 在具体实现中，设备在获得增强攻击检测规则集合和结构化流量特征之后，可以从增强攻击检测规则集合中筛选与结构化流量特征匹配的候选攻击检测规则子集，并读取候选攻击检测规则子集中的各条规则，检查各条规则的类型标识。若某条规则的类型标识指示该规则为原始攻击检测规则，则可以确定该规则对应的匹配优先级为高优先级；若某条规则的类型标识指示该规则为目标攻击检测规则变体，则可以确定该规则对应的匹配优先级为低优先级。在确定各规则的匹配优先级之后，设备可以读取每一条高优先级的原始攻击检测规则的全部匹配条件，包括规则头部匹配条件和规则选项匹配条件，并将结构化流量特征中的应用层载荷信息与这些规则选项匹配条件逐一进行比对，判断应用层载荷信息是否满足每一条规则选项匹配条件。若应用层载荷信息满足该原始攻击检测规则的全部规则头部匹配条件和全部规则选项匹配条件，则判定该结构化流量特征命中该原始攻击检测规则，并输出精确匹配命中的检测结果；若应用层载荷信息不满足该原始攻击检测规则的任意一条匹配条件，则继续尝试候选攻击检测规则子集中的下一条高优先级原始攻击检测规则，若全部高优先级的原始攻击检测规则均未能命中结构化流量特征，则确定精确匹配失败。此时，设备调用低优先级的目标攻击检测规则变体对结构化流量特征进行模糊匹配检测，并在全部低优先级目标攻击检测规则变体均未能命中或某一变体命中之后，获得网络流量数据的网络攻击检测结果。

[0118] 进一步地，所述调用所述低优先级的所述目标攻击检测规则变体对所述结构化流量特征进行模糊匹配检测，获得所述网络流量数据的网络攻击检测结果的步骤，包括：步骤S441：对所述应用层载荷信息进行规范化处理，获得处理后的应用层载荷信息。

[0119] 可理解的是，处理后的应用层载荷信息可以是对原始的应用层载荷信息执行规范化处理后得到的、具有统一编码格式和字符表示的数据内容，其中的规范化处理可以消除因编码方式不同、大小写形式不同或分隔符不同造成的表面差异，使得不同表达形式的攻击载荷在规范化后呈现一致的匹配特征。在本实施例中，处理后的应用层载荷信息具体是对原始载荷进行URL解码还原、HTML实体解码还原、Unicode解码还原、大小写统一转换（如将所有大写字母转换为小写字母）以及无效分隔符清理（如移除多余的空白符、换行符和制表符）等规范化操作后获得的结果。

[0120] 步骤S442：将所述处理后的应用层载荷信息、所述目标攻击检测规则变体的结构化语义特征以及局部匹配证据输入至预设大语言模型，获取所述预设大语言模型输出的匹配类别。

[0121] 应说明的是，匹配类别可以是用于预设大语言模型对处理后的应用层载荷信息与目标攻击检测规则变体之间的攻击语义一致性进行综合判断后输出的分类结果，其可以用于指示处理后的应用层载荷信息是否与目标攻击检测规则变体所描述的攻击行为相匹配。

[0122] 步骤S444：基于所述匹配类别生成所述网络流量数据的网络攻击检测结果，并通过所述预设大语言模型根据思考过程对所述网络攻击检测结果进行解释。

[0123] 应理解的是，思考过程可以是预设大语言模型在生成匹配类别结果的过程中，对输入信息进行逐步推理和逻辑分析的内部处理链条，其可以包括预设大语言模型对处理后的应用层载荷信息的语义理解结果、对目标攻击检测规则变体的结构化语义特征的解读、对局部匹配证据的分析结论、对三者之间关联关系的综合判断以及对最终匹配类别输出的决策依据等。在实际应用中，大语言模型在接收到输入提示词后，可以按照其模型结构和训练机制对输入内容进行多层次、多角度的语义分析和逻辑推理，最终生成输出结果。在本实施例中，思考过程被用于生成对网络攻击检测结果的解释信息，例如，思考过程可以包括：预设大语言模型识别出处理后的应用层载荷信息中包含的SQL关键字和查询结构，判断该载荷具有SQL注入攻击的特征；预设大语言模型将识别出的攻击特征与目标攻击检测规则变体的结构化语义特征中的攻击意图进行比对，确认两者在攻击对象和攻击手法上一致；预设大语言模型结合局部匹配证据（如命中特定关键字的证据和命中特定逻辑结构的证据）进一步验证判断；预设大语言模型最终综合上述分析输出匹配类别。

[0124] 实际应用中，设备在调用低优先级的目标攻击检测规则变体对结构化流量特征进行模糊匹配检测时，首先可以从结构化流量特征中提取应用层载荷信息，并对应用层载荷信息执行规范化处理操作，包括URL解码操作、HTML实体解码操作、Unicode解码操作、大小写统一化处理操作等，获得处理后的应用层载荷信息。随后，设备可以从每一条目标攻击检测规则变体中提取所有关键攻击检测字段及其取值，并将处理后的应用层载荷信息与每一个关键攻击检测字段的取值进行比对，检查处理后的应用层载荷信息中是否包含取值所指定的字符串或是否满足取值所指定的正则表达式，若处理后的应用层载荷信息满足该字段的匹配要求，则可以对该字段赋予满分值；若处理后的应用层载荷信息不满足该字段的匹配要求，则可以对该字段赋予零分值或较低分值。然后，设备可以对全部关键攻击检测字段的分值进行汇总计算，获得字段匹配分值，其具体可以表示为所有关键攻击检测字段的匹配得分之和与满分的比值。同时，设备还可以从目标攻击检测规则变体中提取匹配条件之间的逻辑组合关系，检查处理后的应用层载荷信息是否满足逻辑组合关系，例如，若目标攻击检测规则变体要求条件A和条件B同时满足，而处理后的应用层载荷信息仅满足条件A不满足条件B，则可以确定结构匹配分值为部分匹配值。然后，设备可以将处理后的应用层载荷信息、目标攻击检测规则变体的结构化语义特征以及局部匹配证据组合为提示词，并将提示词输入预设大语言模型，以使预设大语言模型根据提示词中的任务描述信息，对处理后的应用层载荷信息进行语义理解，识别出该载荷中包含的攻击特征，并将识别出的攻击特征与目标攻击检测规则变体的结构化语义特征中的攻击对象、关键匹配内容、逻辑关系和攻击意图进行逐项比对，判断两者在攻击语义层面是否一致，同时结合局部匹配证据对判断结果进行进一步验证。在完成上述分析后，预设大语言模型输出匹配类别结果，同时将整个推理过程（包括每一步的判断依据和分析结论）作为思考过程一并输出。其中，当匹配类别为匹配时，则可以判定网络流量数据命中对应的目标攻击检测规则变体，并生成的网络攻击检测结果包含攻击类型标识、命中的规则变体编号以及匹配类型为模糊匹配；当匹配类别为不匹配时，则可以判定网络流量数据未命中对应的目标攻击检测规则变体，并生成的网络攻击检测结果包含未匹配标识。此后，设备可以进一步通过预设大语言模型根据思考过程对网络攻击检测结果进行解释。具体地，设备可以将预设大语言模型输出的思考过程中的各推理步骤转化为自然语言描述，生成包含攻击类型描述、命中规则依据、变体特征说明以及风险评估的检测解释信息，以便安全运维人员理解检测结果的判定依据。

[0125] 在本实施例中，通过对应用层载荷信息进行规范化处理以获得处理后的应用层载荷信息，将处理后的应用层载荷信息、目标攻击检测规则变体的结构化语义特征以及局部匹配证据输入至预设大语言模型以获取匹配类别，再基于匹配类别生成网络攻击检测结果并通过预设大语言模型根据思考过程对网络攻击检测结果进行解释，从而实现了对网络攻击变体的智能化识别与可解释性检测，使得安全运维人员能够清晰理解预设大语言模型作出匹配判定的逐步推理逻辑和判断依据，增强了检测结果的可信度和可追溯性。

[0126] 在具体实现中，参照图5，图5为本申请网络攻击检测方法的整体流程图。如图5所示，本申请中的网络攻击检测系统可以包括网络流量采集与解析模块、网络攻击检测规则增强模块和网络攻击检测与解释模块三个核心组成部分，这三个模块协同工作以实现对已知网络攻击及其变体的检测。在网络流量采集与解析模块中，设备可以通过部署于网络中的流量采集探针或实时捕获经过监测链路的原始网络数据包，并对捕获的网络数据包执行协议识别操作，确定网络数据包的传输层协议类型，然后根据确定的协议类型对网络数据包执行协议解析操作。具体地，设备可以按照对应传输层协议的头部格式从网络数据包中解析传输层头部，提取传输层头部所包含的各个字段信息，并从传输层头部中提取源互联网协议地址、目的互联网协议地址、源端口号、目的端口号和协议类型等头部信息。随后，设备可以从网络数据包中提取位于传输层头部之后的所有数据内容作为应用层载荷数据，并对应用层载荷数据执行多种解码操作，包括URL解码、Base64解码和HTML实体解码等，以将经过编码处理的应用层载荷数据还原为标准化字符形式。最后，设备可以将传输层头部信息和解码还原后的标准化载荷数据按照预设的特征格式模板进行组织，将传输层头部信息中的各个字段值填入模板对应的位置，将标准化载荷数据填入模板中的载荷内容位置，生成结构化流量特征，并结构化流量特征输出至网络攻击检测与解释模块，作为后续匹配检测的输入。

[0127] 在网络攻击检测规则增强模块中，设备首先可以从原始规则库中读取原始攻击检测规则，并对从原始规则库中读取的原始攻击检测规则执行规则结构解析与字段提取操作，以从规则选项中提取对攻击检测具有实质作用的有效字段，然后将提取的有效字段按照攻击类别进行归类，将属于同一攻击类别的规则字段归为一组，并将各规则的有效字段按照字段名-字段值配对的方式组织为结构化数据，获得各原始攻击检测规则对应的结构化规则数据。随后，设备可以将结构化规则数据输入大语言模型，以使大语言模型对结构化规则数据进行语义分析，识别各规则所描述的攻击行为的攻击对象、关键匹配内容、逻辑关系、字符约束和攻击意图，并输出这些结构化语义特征。设备在获得大语言模型输出的结构化语义特征之后，可以根据结构化语义特征定位允许变换的关键字段的字段类型从预设变体策略库中匹配对应的变换策略，并基于该变换策略对允许变换的关键字段执行变换操作，生成候选规则变体，其中规则变体可以包括编码变体、语法变体和正则等价变体。然后，设备可以对候选规则变体执行有效性校验，并将通过有效性校验的候选规则变体确定为有效变体，再为原始攻击检测规则和有效变体分配匹配优先级，将原始攻击检测规则分配为高优先级，将有效变体分配为低优先级。最后，设备可以将原始攻击检测规则和有效变体合并，形成增强攻击检测规则集合，并将增强攻击检测规则集合输出至网络攻击检测与解释模块。

[0128] 在网络攻击检测与解释模块中，设备可以接收来自网络流量采集与解析模块的结构化流量特征和来自网络攻击检测规则增强模块的增强攻击检测规则集合，并从增强攻击检测规则集合中识别各条规则的匹配优先级，将规则按照匹配优先级分为高优先级规则集合（即原始攻击检测规则）和低优先级规则集合（即目标攻击检测规则变体）。然后，设备可以先调用高优先级规则对结构化流量特征执行精准匹配操作，将结构化流量特征中的应用层载荷信息与原始攻击检测规则的全部匹配条件逐一进行比对，若应用层载荷信息满足原始攻击检测规则的全部匹配条件，则判定结构化流量特征命中该原始攻击检测规则，输出匹配命中的检测结果。若高优先级规则的精准匹配失败，则可以调用低优先级规则对结构化流量特征执行模糊匹配与语义分析操作，以判断网络流量数据是否命中某一目标攻击检测规则变体。在获得匹配检测结果之后，设备可以将匹配检测结果输入大语言模型，以使大语言模型对匹配检测结果进行语义化分析，将技术性的匹配信息转化为自然语言描述，输出攻击类型、命中规则依据、变体特征及风险评估等语义解释信息。最后，设备可以根据检测结果中的风险等级确定是否触发告警，若风险等级超过预设告警阈值，则输出告警信息。此外，设备还可以根据检测结果触发自动防御动作，例如流量阻断指令或会话隔离指令，从而实现检测与响应的闭环。

[0129] 本实施例中，通过从增强攻击检测规则集合中筛选与结构化流量特征匹配的候选攻击检测规则子集，确定候选攻击检测规则子集中各规则对应的匹配优先级，优先调用高优先级的原始攻击检测规则对结构化流量特征中的应用层载荷信息进行精确匹配，并在精确匹配失败后调用低优先级的目标攻击检测规则变体进行模糊匹配检测以获得网络攻击检测结果，从而可以避免将结构化流量特征与增强攻击检测规则集合中的所有规则逐一比较，显著降低了匹配检测的计算开销；同时，由于本实施例采用优先级分层匹配策略，优先调用高精度的原始攻击检测规进行精确匹配，在精确匹配失败后再调用低优先级变体规则进行基于语义相似度的模糊匹配，从而可以在保证检测精度和响应速度的同时实现对已知攻击表达形式多样化的变体的有效检测。

[0130] 需要说明的是，上述示例仅用于理解本申请，并不构成对本申请网络攻击检测方法的限定，基于此技术构思进行更多形式的简单变换，均在本申请的保护范围内。

[0131] 本申请还提供一种网络攻击检测装置，请参照图6，所述网络攻击检测装置包括：特征提取模块10，用于在检测到网络流量数据的情况下，对所述网络流量数据进行协议解析与特征提取，获得所述网络流量数据的结构化流量特征；规则分析模块20，用于通过预设大语言模型对原始攻击检测规则集合中的所有原始攻击检测规则进行语义分析，生成各所述原始攻击检测规则对应的目标攻击检测规则变体；规则增强模块30，用于基于所述原始攻击检测规则和对应所述目标攻击检测规则变体构建增强攻击检测规则集合；规则匹配模块40，用于基于所述增强攻击检测规则集合对所述结构化流量特征进行匹配检测，获得所述网络流量数据的网络攻击检测结果。

[0132] 本申请提供的网络攻击检测装置，采用上述实施例中的网络攻击检测方法，能够解决现有的网络攻击检测方法因攻击检测规则的覆盖范围小，导致攻击检测的精准性不高的技术问题。与现有技术相比，本申请提供的网络攻击检测装置的有益效果与上述实施例提供的网络攻击检测方法的有益效果相同，且所述网络攻击检测装置中的其他技术特征与上述实施例方法公开的特征相同，在此不做赘述。

[0133] 本申请提供一种网络攻击检测设备，网络攻击检测设备包括：至少一个处理器；以及，与至少一个处理器通信连接的存储器；其中，存储器存储有可被至少一个处理器执行的指令，指令被至少一个处理器执行，以使至少一个处理器能够执行上述实施例一中的网络攻击检测方法。

[0134] 下面参考图7，其示出了适于用来实现本申请实施例的网络攻击检测设备的结构示意图。本申请实施例中的网络攻击检测设备可以包括但不限于诸如移动电话、笔记本电脑、数字广播接收器、个人数字助理（Personal Digital Assistant，PDA）、平板电脑（Portable Application Description，PAD）、便携式多媒体播放器（Portable MediaPlayer，PMP）、车载终端（例如车载导航终端）等等的移动终端以及诸如数字TV、台式计算机等等的固定终端。图7示出的网络攻击检测设备仅仅是一个示例，不应对本申请实施例的功能和使用范围带来任何限制。

[0135] 如图7所示，网络攻击检测设备可以包括处理装置1001（例如中央处理器、图形处理器等），其可以根据存储在只读存储器1002中的程序或者从存储装置1003加载到随机访问存储器1004中的程序而执行各种适当的动作和处理。在随机访问存储器1004中，还存储有网络攻击检测设备操作所需的各种程序和数据。处理装置1001、只读存储器1002以及随机访问存储器1004通过总线1005彼此相连。输入 / 输出接口1006也连接至总线。通常，以下系统可以连接至输入 / 输出接口1006：包括例如触摸屏、触摸板、键盘、鼠标、图像传感器、麦克风、加速度计、陀螺仪等的输入装置1007；包括例如液晶显示器（Liquid CrystalDisplay，LCD）、扬声器、振动器等的输出装置1008；包括例如磁带、硬盘等的存储装置1003；以及通信装置1009。通信装置1009可以允许网络攻击检测设备与其他设备进行无线或有线通信以交换数据。虽然图中示出了具有各种系统的网络攻击检测设备，但是应理解的是，并不要求实施或具备所有示出的系统。可以替代地实施或具备更多或更少的系统。

[0136] 特别地，根据本申请公开的实施例，上文参考流程图描述的过程可以被实现为计算机软件程序。例如，本申请公开的实施例包括一种计算机程序产品，其包括承载在计算机可读介质上的计算机程序，该计算机程序包含用于执行流程图所示的方法的程序代码。在这样的实施例中，该计算机程序可以通过通信装置从网络上被下载和安装，或者从存储装置1003被安装，或者从只读存储器1002被安装。在该计算机程序被处理装置1001执行时，执行本申请公开实施例的方法中限定的上述功能。

[0137] 本申请提供的网络攻击检测设备，采用上述实施例中的网络攻击检测方法，能解决网络攻击检测的技术问题。与现有技术相比，本申请提供的网络攻击检测设备的有益效果与上述实施例提供的网络攻击检测方法的有益效果相同，且该网络攻击检测设备中的其他技术特征与上一实施例方法公开的特征相同，在此不做赘述。

[0138] 应当理解，本申请公开的各部分可以用硬件、软件、固件或它们的组合来实现。在上述实施方式的描述中，具体特征、结构、材料或者特点可以在任何的一个或多个实施例或示例中以合适的方式结合。

[0139] 以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

[0140] 本申请提供一种计算机可读存储介质，具有存储在其上的计算机可读程序指令（即计算机程序），计算机可读程序指令用于执行上述实施例中的网络攻击检测方法。

[0141] 本申请提供的计算机可读存储介质例如可以是U盘，但不限于电、磁、光、电磁、红外线、或半导体的系统或器件，或者任意以上的组合。计算机可读存储介质的更具体地例子可以包括但不限于：具有一个或多个导线的电连接、便携式计算机磁盘、硬盘、随机访问存储器（Random Access Memory，RAM）、只读存储器（Read Only Memory，ROM）、可擦式可编程只读存储器（Erasable Programmable Read Only Memory，EPROM或闪存）、光纤、便携式紧凑磁盘只读存储器（CD-Read Only Memory，CD-ROM）、光存储器件、磁存储器件、或者上述的任意合适的组合。在本实施例中，计算机可读存储介质可以是任何包含或存储程序的有形介质，该程序可以被指令执行系统或者器件使用或者与其结合使用。计算机可读存储介质上包含的程序代码可以用任何适当的介质传输，包括但不限于：电线、光缆、射频（RadioFrequency，RF）等等，或者上述的任意合适的组合。

[0142] 上述计算机可读存储介质可以是网络攻击检测设备中所包含的；也可以是单独存在，而未装配入网络攻击检测设备中。

[0143] 上述计算机可读存储介质承载有一个或者多个程序，当上述一个或者多个程序被网络攻击检测设备执行时，使得网络攻击检测设备：在检测到网络流量数据的情况下，对网络流量数据进行协议解析与特征提取，获得网络流量数据的结构化流量特征；通过预设大语言模型对原始攻击检测规则集合中的所有原始攻击检测规则进行语义分析，生成各原始攻击检测规则对应的目标攻击检测规则变体；基于原始攻击检测规则和对应目标攻击检测规则变体构建增强攻击检测规则集合；基于增强攻击检测规则集合对结构化流量特征进行匹配检测，获得网络流量数据的网络攻击检测结果。

[0144] 可以以一种或多种程序设计语言或其组合来编写用于执行本申请的操作的计算机程序代码，上述程序设计语言包括面向对象的程序设计语言—诸如Java、Smalltalk、C++，还包括常规的过程式程序设计语言—诸如"C”语言或类似的程序设计语言。程序代码可以完全地在用户计算机上执行、部分地在用户计算机上执行、作为一个独立的软件包执行、部分在用户计算机上部分在远程计算机上执行、或者完全在远程计算机或服务器上执行。在涉及远程计算机的情形中，远程计算机可以通过任意种类的网络——包括局域网（LocalArea Network，LAN）或广域网（Wide Area Network，WAN）—连接到用户计算机，或者，可以连接到外部计算机（例如利用因特网服务提供商来通过因特网连接）。

[0145] 附图中的流程图和框图，图示了按照本申请各种实施例的系统、方法和计算机程序产品的可能实现的体系架构、功能和操作。在这点上，流程图或框图中的每个方框可以代表一个模块、程序段、或代码的一部分，该模块、程序段、或代码的一部分包含一个或多个用于实现规定的逻辑功能的可执行指令。也应当注意，在有些作为替换的实现中，方框中所标注的功能也可以以不同于附图中所标注的顺序发生。例如，两个接连地表示的方框实际上可以基本并行地执行，它们有时也可以按相反的顺序执行，这依所涉及的功能而定。也要注意的是，框图和 / 或流程图中的每个方框、以及框图和 / 或流程图中的方框的组合，可以用执行规定的功能或操作的专用的基于硬件的系统来实现，或者可以用专用硬件与计算机指令的组合来实现。

[0146] 描述于本申请实施例中所涉及到的模块可以通过软件的方式实现，也可以通过硬件的方式来实现。其中，模块的名称在某种情况下并不构成对该单元本身的限定。

[0147] 本申请提供的可读存储介质为计算机可读存储介质，所述计算机可读存储介质存储有用于执行上述网络攻击检测方法的计算机可读程序指令（即计算机程序），能够解决现有的网络攻击检测方法因攻击检测规则的覆盖范围小，导致攻击检测的精准性不高的技术问题。与现有技术相比，本申请提供的计算机可读存储介质的有益效果与上述实施例提供的网络攻击检测方法的有益效果相同，在此不做赘述。

[0148] 以上所述仅为本申请的部分实施例，并非因此限制本申请的专利范围，凡是在本申请的技术构思下，利用本申请说明书及附图内容所作的等效结构变换，或直接 / 间接运用在其他相关的技术领域均包括在本申请的专利保护范围内。< / script>

Claims

1. A method for detecting network attacks, characterized in that, The method includes: Upon detecting network traffic data, protocol parsing and feature extraction are performed on the network traffic data to obtain structured traffic features of the network traffic data; Semantic analysis is performed on all original attack detection rules in the original attack detection rule set using a pre-defined large language model to generate target attack detection rule variants corresponding to each original attack detection rule. An enhanced attack detection rule set is constructed based on the original attack detection rule and the corresponding variants of the target attack detection rule; Based on the enhanced attack detection rule set, the structured traffic features are matched and detected to obtain the network attack detection results of the network traffic data.

2. The method as described in claim 1, characterized in that, The step of performing protocol parsing and feature extraction on the network traffic data to obtain structured traffic features of the network traffic data includes: The network packets in the network traffic data are identified by protocol to determine the protocol type of the network packets; The network data packet is parsed according to the protocol type to extract the transport layer header information and application layer payload data of the network data packet; The application layer payload data is encoded and restored to obtain the standardized payload data of the network data packets; The structured traffic characteristics of the network traffic data are constructed based on the transport layer header information and the standardized payload data.

3. The method as described in claim 1, characterized in that, The step of performing semantic analysis on all original attack detection rules in the original attack detection rule set using a preset large language model to generate target attack detection rule variants corresponding to each original attack detection rule includes: The structure of all original attack detection rules in the original attack detection rule set is parsed to extract the key attack detection fields from the original attack detection rules. The key attack detection fields are categorized according to attack type to obtain the structured attack detection rules corresponding to each of the original attack detection rules. The structured attack detection rules are semantically analyzed using a pre-defined large language model to obtain the rule semantic features of each original attack detection rule; The original attack detection rules are equivalently transformed using the preset large language model based on the semantic features of the rules, thereby generating target attack detection rule variants corresponding to the original attack detection rules.

4. The method as described in claim 3, characterized in that, The step of performing equivalent transformation processing on each of the original attack detection rules based on the rule semantic features using the preset large language model to generate target attack detection rule variants corresponding to each of the original attack detection rules includes: The allowed transformation fields in the original attack detection rules are determined by the preset large language model based on the semantic features of the rules; The field type corresponding to the allowed transformation field is determined based on the semantic role of the allowed transformation field in the original attack detection rule; The target rule transformation strategy that matches the field type is queried from the preset variant strategy library. The target rule transformation strategy includes at least one of encoding transformation, syntax transformation and regular expression equivalence transformation. Based on the target rule transformation strategy, the allowed transformation field is transformed to generate candidate attack detection rule variants of the original attack detection rule; The candidate attack detection rule variants are validated, and those that pass the validation are identified as target attack detection rule variants.

5. The method as described in claim 1, characterized in that, The step of constructing an enhanced attack detection rule set based on the original attack detection rule and the corresponding variant of the target attack detection rule includes: Determine the similarity of matching fields between the original attack detection rule and the corresponding variant of the target attack detection rule; Redundant attack detection rule variants with matching field similarity exceeding a preset similarity threshold are identified and removed from the target attack detection rule variants to obtain effective attack detection rule variants; The original attack detection rules and the effective attack detection rule variants are merged to construct an enhanced attack detection rule set.

6. The method according to any one of claims 1 to 5, characterized in that, The step of matching and detecting the structured traffic features based on the enhanced attack detection rule set to obtain the network attack detection result of the network traffic data includes: A subset of candidate attack detection rules that match the structured traffic features is selected from the enhanced attack detection rule set; Determine the matching priority of each attack detection rule in the subset of candidate attack detection rules. The matching priority includes high priority and low priority. The original attack detection rule corresponds to the high priority and the target attack detection rule variant corresponds to the low priority. The high-priority original attack detection rule is invoked to accurately match the application layer payload information in the structured traffic features, and it is determined whether the application layer payload information meets all the matching conditions of a single original attack detection rule. If an exact match fails, the lower-priority variant of the target attack detection rule is invoked to perform fuzzy matching detection on the structured traffic features to obtain the network attack detection result of the network traffic data.

7. The method as described in claim 6, characterized in that, The step of invoking the low-priority variant of the target attack detection rule to perform fuzzy matching detection on the structured traffic features and obtaining the network attack detection result of the network traffic data includes: The application layer load information is normalized to obtain the processed application layer load information; The processed application layer payload information, the structured semantic features of the target attack detection rule variant, and the local matching evidence are input into a preset large language model to obtain the matching category output by the preset large language model; Network attack detection results are generated based on the matching categories of the network traffic data, and the network attack detection results are interpreted by the preset large language model according to the thought process.

8. A network attack detection device, characterized in that, The device includes: The feature extraction module is used to perform protocol parsing and feature extraction on the network traffic data when network traffic data is detected, so as to obtain the structured traffic features of the network traffic data. The rule analysis module is used to perform semantic analysis on all the original attack detection rules in the original attack detection rule set through a preset large language model, and generate target attack detection rule variants corresponding to each original attack detection rule. The rule enhancement module is used to construct an enhanced attack detection rule set based on the original attack detection rule and the corresponding variant of the target attack detection rule; The rule matching module is used to perform matching and detection on the structured traffic features based on the enhanced attack detection rule set, and obtain the network attack detection results of the network traffic data.

9. A network attack detection device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the network attack detection method as described in any one of claims 1 to 7.

10. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the network attack detection method as described in any one of claims 1 to 7.

Images