A network attack chain analysis method and system based on multi-protocol operation

Abstract

This specification provides a method and system for analyzing network attack chains based on multi-protocol computation, relating to the field of network security technology. The method includes: performing protocol decomposition processing on raw network protocol data to obtain protocol traffic of various different protocol types; when the verification result is non-compliant, retrieving the corresponding protocol's abnormal feature sub-library to perform abnormal feature matching on the non-compliant protocol traffic, matching to obtain single-protocol abnormal features and reporting the abnormal features; summarizing the single-protocol abnormal features output by all protocols to a multi-protocol computation bus, performing cross-protocol joint computation on multiple single-protocol abnormal features through the multi-protocol computation bus to generate multi-protocol computation results; writing the multi-protocol computation results into a multi-protocol computation database, and splicing together and storing complete attack chain data based on the multi-protocol computation results, thereby solving the problem that existing technologies cannot analyze network attack chains based on multi-protocol computation.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for analyzing network attack chains based on multi-protocol computation. Background Technology

[0002] Current malicious network intrusions are characterized by organization, segmentation, and cross-protocol features. Attackers typically execute attacks along a complete chain of sniffing, scanning, intrusion, and data theft, switching between different network protocols and control hosts at different stages to evade security device detection. Existing network security analysis methods are mostly based on independent detection of single protocols, only able to identify scattered abnormal behaviors for single types of traffic, and rely on dispersed dimensions such as five-tuples, host processes, and application certificates to locate risks, lacking cross-protocol correlation analysis capabilities.

[0003] Traditional detection solutions process various types of network traffic separately, failing to connect fragmented attack behaviors distributed across different protocols such as DNS, ICMP, and HTTP, making it difficult to reconstruct the attacker's complete penetration chain. When attackers use a multi-protocol coordinated approach to launch a step-by-step attack on an internal network target, existing technologies can only alert to isolated anomalies under each protocol individually, unable to determine if the target host is suffering from a continuous, combined penetration. Security personnel struggle to grasp the complete attack context, resulting in missed attack detections and incomplete risk assessments, leading to low efficiency in internal network protection and source tracing analysis.

[0004] Therefore, there is an urgent need for a network attack chain analysis method based on multi-protocol computation. Summary of the Invention

[0005] In view of this, the present invention proposes a network attack chain analysis method and system based on multi-protocol computation, so as to realize the analysis of network attack chains based on multi-protocol computation.

[0006] To achieve the above objectives, the present invention provides the following technical solution: This specification provides one or more embodiments of a network attack chain analysis method based on multi-protocol computation, including: Collect raw network protocol data of the entire network traffic, and perform protocol decomposition processing on the raw network protocol data to obtain protocol traffic of various different protocol types; For each type of protocol traffic, a compliance check is performed. When the check result is non-compliant, the corresponding protocol's abnormal feature sub-library is retrieved to perform abnormal feature matching on the non-compliant protocol traffic. The single protocol abnormal feature is obtained and the abnormal feature is reported. The single-protocol anomaly features output by all protocols are aggregated into the multi-protocol operation bus. Cross-protocol joint operations are performed on multiple single-protocol anomaly features through the multi-protocol operation bus to generate multi-protocol operation results. The results of the multi-protocol operation are written into the multi-protocol operation database, and the complete attack chain data is generated and stored based on the results of the multi-protocol operation.

[0007] Based on the above technical solution, the present invention can be further improved as follows: Optionally, the raw network protocol data of the collected network traffic is subjected to protocol decomposition processing to obtain protocol traffic of various different protocol types, including: Based on the five-tuple features and packet payload features of Transmission Control Protocol and Internet Protocol, protocol identification and decomposition are performed on all raw network protocol data to separate protocol traffic of various different protocol types. The five-tuple features include source IP address, destination IP address, source port number, and transport layer protocol number. and the destination port number.

[0008] Optionally, after performing compliance verification steps for each type of protocol traffic, the following steps are also included: When the verification result is compliant, the compliant protocol traffic is stored in the normal traffic sub-database of the corresponding protocol.

[0009] Optionally, the step of aggregating the single-protocol anomaly features output by all protocols to a multi-protocol processing bus, and performing cross-protocol joint operations on multiple single-protocol anomaly features through the multi-protocol processing bus to generate multi-protocol processing results includes: Extract the quintuple information corresponding to each single protocol anomaly feature, use the quintuple information as the search keyword, traverse all protocol-related anomaly feature sub-databases to perform full matching calculation, and generate multi-protocol operation results.

[0010] Optionally, the step of writing the multi-protocol calculation result into a multi-protocol calculation database, and generating and storing complete attack chain data based on the multi-protocol calculation result, includes: When the same intranet target device has abnormal records in the abnormal feature matching results of at least two types of protocols, the intranet target device is determined to be a key attack target; Integrate all associated anomaly records of the key attack targets under various protocols and splice them together to generate complete cross-protocol attack chain data.

[0011] Optionally, the abnormal feature sub-library is classified and stored according to the abnormal scenario type. Each type of abnormal scenario corresponds to an independent abnormal feature sub-library, and the single-protocol abnormal features of different abnormal scenarios are archived to the corresponding abnormal feature sub-library.

[0012] Optionally, after writing the multi-protocol operation results into the multi-protocol operation database, and generating and storing complete attack chain data based on the multi-protocol operation results, the process includes: The attack source address, attack target, and attack path information are extracted from the complete attack chain data and simultaneously sent to network security defense devices to trigger access interception and protection policies of the corresponding network nodes.

[0013] This specification provides one or more embodiments of a network attack chain analysis system based on multi-protocol computation, including: The decomposition module is used to collect raw network protocol data of the entire network traffic, and perform protocol decomposition processing on the raw network protocol data to obtain protocol traffic of various different protocol types; The verification module is used to perform compliance verification on each type of protocol traffic. When the verification result is non-compliant, the corresponding protocol's abnormal feature sub-library is retrieved to perform abnormal feature matching on the non-compliant protocol traffic. The matching results in single protocol abnormal features, and the abnormal features are reported. The computation module is used to aggregate the single-protocol anomaly features output by all protocols to the multi-protocol computation bus, and perform cross-protocol joint operations on multiple single-protocol anomaly features through the multi-protocol computation bus to generate multi-protocol computation results. The storage module is used to write the multi-protocol operation results into the multi-protocol operation database, and to generate and store complete attack chain data based on the multi-protocol operation results.

[0014] An electronic device includes a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor executes the computer program to implement the steps of the method described herein.

[0015] A non-transitory computer-readable storage medium having a computer program stored thereon, the computer program implementing the steps of the method when executed by a processor.

[0016] The present invention has the following advantages: This invention presents a network attack chain analysis method based on multi-protocol computation. First, it breaks down traffic from various protocols and independently verifies anomalies. Then, it summarizes the anomaly characteristics of each protocol and performs cross-protocol joint computation via a bus. This method can connect fragmented attack behaviors scattered across different protocols, completely reconstructing an organized attack chain. Compared to traditional single-protocol isolation and detection methods, it can accurately locate internal network targets in multi-protocol joint attacks, reduce missed attack reports, retain complete attack evidence, and significantly improve network security tracing and defense capabilities. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in one or more embodiments of this specification or in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating a network attack chain analysis method based on multi-protocol computation in one or more embodiments of the present invention. Figure 2 This is a schematic diagram of the main components of a network attack chain analysis system based on multi-protocol computation according to one or more embodiments of the present invention; Figure 3 This is a schematic diagram of the physical structure of the electronic device provided by the present invention. Detailed Implementation

[0019] To enable those skilled in the art to better understand the technical solutions in one or more embodiments of this specification, the technical solutions in one or more embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of the embodiments. Based on one or more embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of this document.

[0020] Figure 1 This is a flowchart illustrating the network attack chain analysis method based on multi-protocol computation in an embodiment of the present invention, as shown below. Figure 1 As shown, the network attack chain analysis method based on multi-protocol operation provided in this embodiment of the invention includes the following steps S101 to S104.

[0021] S101 collects raw network protocol data of the entire network traffic, performs protocol decomposition processing on the raw network protocol data, and obtains protocol traffic of various different protocol types.

[0022] Based on the five-tuple features and packet payload features of Transmission Control Protocol and Internet Protocol, protocol identification and decomposition are performed on all raw network protocol data to separate protocol traffic of various different protocol types. The five-tuple features include the source IP address, destination IP address, source port number, transport layer protocol number, and destination port number.

[0023] S102, perform compliance verification for each type of protocol traffic. When the verification result is non-compliant, retrieve the corresponding protocol's abnormal feature sub-library to perform abnormal feature matching on the non-compliant protocol traffic, obtain single protocol abnormal features, and report the abnormal features.

[0024] The compliance verification targets traffic for specific protocols such as HTTP / DNS / SMB / ICMP. Compliance verification criteria / judgment rules: What is compliant (protocol standard fields, access whitelist, request frequency threshold), and what is non-compliant (malformed data packets, abnormal access frequency, illegal request paths).

[0025] The compliance verification performs judgments on the protocol header fields, payload content, and access behavior thresholds for each type of protocol traffic. The verification objects include DNS protocol request domain names, HTTP protocol request paths and parameters, transport layer port connection frequency, and data packet length. The compliance judgment labeling rules are as follows: if the protocol standard format is met, the access object is in the trusted whitelist, and the access frequency is lower than the preset threshold, it is judged as compliant; if there are malformed data packets, access to malicious addresses, or high-frequency abnormal connections, it is judged as non-compliant.

[0026] Anomaly feature matching adopts a two-layer matching method combining multi-mode string matching and field threshold matching: The first layer: Perform multi-mode fuzzy matching between the packet payload of non-compliant traffic and the attack signature code stored in the corresponding protocol anomaly feature sub-database; The second layer: Extract the values ​​of key protocol fields and compare them with the preset anomaly thresholds in the sub-database. If either layer matches, a single protocol anomaly feature is output.

[0027] The anomaly feature sub-library is a segmented feature storage unit designed with a layered, protocol-specific, and scenario-specific architecture, unlike the global feature library of traditional security devices that uniformly and hybridly stores attack features across all protocols. The system uses network protocol type as the primary dimension and attack anomaly scenario as the secondary dimension, creating an independent dedicated storage sub-library for each type of network protocol and each type of attack scenario. Each sub-library is physically / logically isolated. During single-protocol traffic verification, only the corresponding sub-library is loaded based on the protocol to which the current traffic belongs; feature data from other irrelevant protocols is not loaded, enabling targeted retrieval and accurate matching.

[0028] The mainstream protocols involved in this invention are all equipped with independent anomaly feature sub-libraries, including: HTTP anomaly feature sub-library, DNS anomaly feature sub-library, SMB anomaly feature sub-library, ICMP anomaly feature sub-library, and can be expanded as needed to include TCP port scanning sub-library, SMTP email attack sub-library, RDP remote brute-force sub-library, etc.

[0029] The anomaly feature matching of this invention is an identification process that, after compliance verification determines that traffic is non-compliant, retrieves the corresponding protocol anomaly feature sub-library for multi-level comparison. Before matching, only the sub-library dedicated to the protocol to which the current traffic belongs is loaded, filtering irrelevant protocol features to reduce computing power consumption. The matching adopts a three-layer progressive verification logic: the first layer is static payload feature code matching, which compares the attack strings in the data packet payload, domain name, and request path using the AC multi-mode algorithm to identify fixed attack templates such as injection, backdoors, and tunnels; the second layer is dynamic behavior threshold matching, which extracts indicators such as access frequency, data packet length, and number of consecutive connections associated with the five-tuple, compares them with preset thresholds in the sub-library, and identifies scanning and flood-type abnormal behaviors; the third layer is blacklist / whitelist matching, which verifies whether the access object hits the malicious IP or malicious domain blacklist. If any of the three-layer rules is hit, a risk is determined, and a standardized single-protocol anomaly feature carrying the protocol type and attack scenario label is generated and reported to the multi-protocol computing bus, which not only improves matching efficiency but also accurately distinguishes various attack behaviors and reduces false alarms.

[0030] When the verification result is compliant, the compliant protocol traffic is stored in the normal traffic sub-database of the corresponding protocol.

[0031] S103, summarizes the single-protocol anomaly features of all protocol outputs to the multi-protocol operation bus, performs cross-protocol joint operation on multiple single-protocol anomaly features through the multi-protocol operation bus, and generates multi-protocol operation results.

[0032] The multi-protocol operation bus is a standardized data forwarding channel in the architecture of this invention. It is used to uniformly receive, buffer, and format single-protocol anomaly characteristics of various protocol outputs. The bus unifies the data field format and outputs standardized anomaly data required for cross-protocol association to downstream operation units in batches.

[0033] Cross-protocol joint operation refers to using the network traffic quintuple as the association key to perform aggregated association calculations on multiple single-protocol abnormal features of different protocol types; by matching the abnormal behaviors of multiple protocols generated by the same terminal device, it can uncover complete penetration attack links that cannot be identified by independent detection of a single protocol.

[0034] Extract the quintuple information corresponding to each single protocol anomaly feature, use the quintuple information as the search keyword, traverse all protocol-related anomaly feature sub-databases to perform full matching calculation, and generate multi-protocol operation results.

[0035] The abnormal feature sub-library is classified and stored according to the abnormal scenario type. Each type of abnormal scenario corresponds to an independent abnormal feature sub-library, and the single-protocol abnormal features of different abnormal scenarios are archived to the corresponding abnormal feature sub-library.

[0036] S104: Write the multi-protocol operation results into the multi-protocol operation database, and generate and store complete attack chain data based on the multi-protocol operation results.

[0037] When the same intranet target device has abnormal records in the abnormal feature matching results of at least two types of protocols, the intranet target device is determined to be a key attack target; Internal network target devices refer to monitored terminals, servers, and business hosts within an enterprise's internal network, uniquely identified by a five-tuple. When a device generates matching anomaly records in traffic across two or more protocols such as DNS, HTTP, and ICMP, the system identifies it as a key internal network target device. The system aggregates all abnormal behavior records of this device across protocols, assembles a complete penetration chain according to the attack sequence, and simultaneously extracts the attack source and attack path, distributing them to defense devices for targeted interception of multi-protocol combined persistent attacks.

[0038] Integrate all associated anomaly records of the key attack targets under each protocol, and splice them together to generate complete cross-protocol attack chain data.

[0039] After writing the multi-protocol calculation results into the multi-protocol calculation database, and generating and storing complete attack chain data based on the multi-protocol calculation results, the process includes: The attack source address, attack target, and attack path information are extracted from the complete attack chain data and simultaneously sent to network security defense devices to trigger access interception and protection policies of the corresponding network nodes.

[0040] The technical solution of this invention is generally divided into two parts: network protocol data preprocessing and multi-protocol / cross-protocol computation. Network protocol data preprocessing includes using DPI (Deep Packet Inspection) and other related technologies to identify all data packets in network traffic according to the characteristics of the TCP / IP 5-tuple and the payload, marking seemingly chaotic network data into various application / protocol data. Then, compliance analysis is performed on the marking results of the network protocols according to protocol rules, including but not limited to the pairing of requests and responses, the rationality of request types, the rationality of response types, and the rationality of the regional attribution of requests and responses. Finally, the analysis results of each protocol (classified according to abnormal cases) are temporarily stored in different database sub-databases and reported to the multi-protocol computation bus. Multi-protocol / cross-protocol operations mainly refer to full quantum library matching calculations based on various abnormal characteristics. This type of operation includes, but is not limited to, if an abnormal case record exists in a certain protocol, that is, matching the five-tuple values ​​(source / destination IP and source / destination port numbers, etc.) of that record with the full case library of all protocols. For example, if server A in the internal network exists in abnormal case records of multiple protocols, it can be determined that the server is already the main attack target, and the other party is using a multi-pronged chain approach / logic to carry out penetration, ultimately forming an organized attack chain data across protocols and storing it on disk in the multi-protocol operation database.

[0041] This invention identifies and decomposes network data based on five-tuple and payload characteristics, including standard network protocols such as DNS, ICMP, HTTP, SMTP, and VPN, as well as private network protocols such as IM.

[0042] This invention expands the analysis and judgment based on the attribute dimensions of each protocol. Examples include abnormal ICMP-related behavioral attributes, sniffing behavior from remote / abnormal countries / regions, etc.

[0043] This invention performs a full-scale protocol matching operation based on the abnormal characteristics reported by a certain protocol, which can completely outline the malicious behavior chain of an external network against a target host in the internal network, and achieve joint defense and linkage between various protocols to improve security defense capabilities.

[0044] Figure 2 This is a schematic diagram illustrating the main components of the network attack chain analysis system based on multi-protocol computation according to an embodiment of the present invention. Figure 2 As shown, the network attack chain analysis system 1 based on multi-protocol operation provided in this embodiment of the invention includes a disassembly module 10, a verification module 20, an operation module 30, and a storage module 40.

[0045] The disassembly module 10 is used to collect the raw network protocol data of the entire network traffic, and perform protocol disassembly processing on the raw network protocol data to obtain protocol traffic of various different protocol types. The verification module 20 is used to perform compliance verification on each type of protocol traffic. When the verification result is non-compliant, the corresponding protocol's abnormal feature sub-library is retrieved to perform abnormal feature matching on the non-compliant protocol traffic. The single protocol abnormal feature is obtained and the abnormal feature is reported. The calculation module 30 is used to aggregate the single-protocol anomaly features output by all protocols to the multi-protocol calculation bus, and perform cross-protocol joint calculation on multiple single-protocol anomaly features through the multi-protocol calculation bus to generate multi-protocol calculation results. The storage module 40 is used to write the multi-protocol operation results into the multi-protocol operation database, and to generate and store complete attack chain data based on the multi-protocol operation results.

[0046] Figure 3 This is a schematic diagram of the physical structure of an electronic device provided in an embodiment of the present invention, such as... Figure 3 As shown, the electronic device 50 includes: a processor 501, a memory 502, and a bus 503; The processor 501 and the memory 502 communicate with each other via the bus 503. The processor 501 is used to call program instructions in the memory 502 to execute the methods provided in the above-described method embodiments, and to execute the methods provided in the embodiments of the present invention.

[0047] This embodiment provides a non-transitory computer-readable storage medium that stores computer instructions, which cause a computer to execute the method provided in this embodiment of the invention.

[0048] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for analyzing network attack chains based on multi-protocol computation, characterized in that, include: Collect raw network protocol data of the entire network traffic, and perform protocol decomposition processing on the raw network protocol data to obtain protocol traffic of various different protocol types; For each type of protocol traffic, a compliance check is performed. When the check result is non-compliant, the corresponding protocol's abnormal feature sub-library is retrieved to perform abnormal feature matching on the non-compliant protocol traffic. The single protocol abnormal feature is obtained and the abnormal feature is reported. The single-protocol anomaly features output by all protocols are aggregated into the multi-protocol operation bus. Cross-protocol joint operations are performed on multiple single-protocol anomaly features through the multi-protocol operation bus to generate multi-protocol operation results. The results of the multi-protocol operation are written into the multi-protocol operation database, and the complete attack chain data is generated and stored based on the results of the multi-protocol operation.

2. The network attack chain analysis method based on multi-protocol computation according to claim 1, characterized in that, The raw network protocol data of the collected network traffic is then subjected to protocol decomposition processing to obtain protocol traffic of various different protocol types, including: Based on the five-tuple features and packet payload features of Transmission Control Protocol and Internet Protocol, protocol identification and decomposition are performed on all raw network protocol data to separate protocol traffic of various different protocol types. The five-tuple features include source IP address, destination IP address, source port number, and transport layer protocol number. and the destination port number.

3. The network attack chain analysis method based on multi-protocol computation according to claim 1, characterized in that, After performing compliance verification steps for each type of protocol traffic, the following steps are also included: When the verification result is compliant, the compliant protocol traffic is stored in the normal traffic sub-database of the corresponding protocol.

4. The network attack chain analysis method based on multi-protocol computation according to claim 1, characterized in that, The process of aggregating the single-protocol anomaly features output by all protocols to a multi-protocol processing bus, and performing cross-protocol joint operations on multiple single-protocol anomaly features through the multi-protocol processing bus to generate multi-protocol processing results includes: Extract the quintuple information corresponding to each single protocol anomaly feature, use the quintuple information as the search keyword, traverse all protocol-related anomaly feature sub-databases to perform full matching calculation, and generate multi-protocol operation results.

5. The network attack chain analysis method based on multi-protocol computation according to claim 1, characterized in that, The step of writing the multi-protocol calculation results into a multi-protocol calculation database, and generating and storing complete attack chain data based on the multi-protocol calculation results, includes: When the same intranet target device has abnormal records in the abnormal feature matching results of at least two types of protocols, the intranet target device is determined to be a key attack target; Integrate all associated anomaly records of the key attack targets under various protocols and splice them together to generate complete cross-protocol attack chain data.

6. The network attack chain analysis method based on multi-protocol computation according to claim 1, characterized in that, The abnormal feature sub-library is classified and stored according to the abnormal scenario type. Each type of abnormal scenario corresponds to an independent abnormal feature sub-library, and the single-protocol abnormal features of different abnormal scenarios are archived to the corresponding abnormal feature sub-library.

7. The network attack chain analysis method based on multi-protocol computation according to claim 1, characterized in that, After writing the multi-protocol calculation results into the multi-protocol calculation database, and generating and storing complete attack chain data based on the multi-protocol calculation results, the process includes: The attack source address, attack target, and attack path information are extracted from the complete attack chain data and simultaneously sent to network security defense devices to trigger access interception and protection policies of the corresponding network nodes.

8. A network attack chain analysis system based on multi-protocol computation, characterized in that, include: The decomposition module is used to collect raw network protocol data of the entire network traffic, perform protocol decomposition processing on the raw network protocol data, and obtain protocol traffic of various different protocol types; The verification module is used to perform compliance verification on each type of protocol traffic. When the verification result is non-compliant, the corresponding protocol's abnormal feature sub-library is retrieved to perform abnormal feature matching on the non-compliant protocol traffic. The matching results in single protocol abnormal features, and the abnormal features are reported. The computation module is used to aggregate the single-protocol anomaly features output by all protocols to the multi-protocol computation bus, and perform cross-protocol joint operations on multiple single-protocol anomaly features through the multi-protocol computation bus to generate multi-protocol computation results. The storage module is used to write the multi-protocol operation results into the multi-protocol operation database, and to generate and store complete attack chain data based on the multi-protocol operation results.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 7.

Images