Network attack identification method, device, equipment, medium and program product

Abstract

This application provides a method, apparatus, device, medium, and program product for identifying network attacks. The method includes: determining abnormal behavior factors of target hosts based on the out-degree of target hosts in the host communication graph of the target network and the success rate of target hosts initiating network connections; determining the importance score of each target host in the target network based on the abnormal behavior factors of each target host and the host communication graph of the target network; using graph nodes in the host communication graph to represent target hosts; and performing network attack identification based on the importance scores of each target host to obtain an identification result representing whether a target host has committed a network attack. This method aims to improve the accuracy of network attack identification.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus, device, medium, and program product for identifying network attacks. Background Technology

[0002] With the widespread application of digital networks in financial services, cyberattacks in these areas are becoming increasingly diversified and covert. Relevant technologies for identifying cyberattacks mainly include signature-based detection methods and threshold-based alerting methods. However, these methods typically only identify known types of cyberattacks. Therefore, improving the accuracy of cyberattack identification is a pressing issue. Summary of the Invention

[0003] The network attack identification methods, apparatus, devices, media, and program products provided in this application are intended to improve the accuracy of network attack identification.

[0004] In a first aspect, embodiments of this application provide a method for identifying network attacks, wherein graph nodes of the host communication graph of the target network are used to characterize target hosts in the target network, and the method includes:

[0005] Based on the out-degree of the target host in the host communication graph and the success rate of the target host initiating network connections, the abnormal behavior factors of the target host are determined.

[0006] Based on the abnormal behavior factors of each target host and the host communication graph, the importance score of each target host in the target network is determined.

[0007] Based on the importance scores of each target host, network attack identification is performed to obtain identification results that characterize whether the target host has carried out a network attack.

[0008] Optionally, the weight of the edge pointing from the first graph node to the second graph node in the host communication graph is used to represent the number of times the first target host represented by the first graph node has initiated a network connection to the second target host represented by the second graph node.

[0009] The determination of the importance score of each target host in the target network based on the abnormal behavior factors of each target host and the host communication graph includes:

[0010] The importance score is determined based on the weights of the edges in the host communication graph and the abnormal behavior factor.

[0011] Optionally, determining the importance score based on the weights of the edges in the host communication graph and the anomalous behavior factor includes:

[0012] For any target host represented by the second graph node, the importance score of the target host represented by the second graph node is determined based on the weight of the edge from the first graph node to the second graph node, the importance score of the first graph node, the total weight of the edge emanating from the first graph node, and the abnormal behavior factor of the first graph node.

[0013] Optionally, determining the importance score of the target host represented by the second graph node based on the weights of the edges pointing from the first graph node to the second graph node, the importance score of the first graph node, the total weights of the edges emanating from the first graph node, and the anomalous behavior factor of the first graph node includes:

[0014] The initial influence of the importance of the first graph node on the importance of the second graph node is determined by multiplying the weight of the edge pointing from the first graph node to the second graph node with the importance score of the first graph node.

[0015] By normalizing the initial influence value using the total weight of the edges emanating from the first graph node, the target influence value of the importance of the first graph node on the importance of the second graph node is obtained.

[0016] Based on the target influence value and the abnormal behavior factor of the first graph node, the importance score of the target host represented by the second graph node is determined.

[0017] Optionally, before performing network attack identification based on the importance scores of each target host to obtain an identification result characterizing whether the target host has committed a network attack, the method further includes:

[0018] For any of the target hosts, based on the communication records of the target host during the target historical period, determine the local characteristics of the target host's network behavior;

[0019] The network attack identification based on the importance scores of each target host, to obtain an identification result characterizing whether the target host has committed a network attack, includes:

[0020] The importance score is fused with the local network behavior features to obtain the network anomaly features of the target host;

[0021] Based on the aforementioned network anomaly characteristics, network attack identification is performed on the target host, and the identification result is obtained.

[0022] Optionally, the local network behavior features include at least one of the following:

[0023] The number of times the target host's IP appeared as the source IP within the target historical period;

[0024] The number of times the target host's IP appeared as the destination IP within the target historical period;

[0025] The degree of dispersion of the target host's access targets;

[0026] The average message rate of the target host during the target historical period;

[0027] The TCP connection failure rate of the target host during the target historical period;

[0028] The average number of streaming bytes of the target host during the target historical period;

[0029] The proportion of the target host accessing the target type port during the target historical period; the target type port is a port whose access frequency is lower than a preset frequency.

[0030] Optionally, fusing the importance score with the local network behavior features to obtain the network anomaly features of the target host includes:

[0031] The importance score is concatenated and fused with the local network behavior features to obtain the feature vector of the target host;

[0032] Based on the importance score, the mean value of the local features of the network behavior, and the standard deviation of the features, the feature vector is normalized to obtain the network anomaly features of the target host.

[0033] Optionally, the step of identifying network attacks on the target host based on the network anomaly characteristics to obtain the identification result includes:

[0034] The network anomaly features are input into the anomaly detection model to identify network attacks, and the identification results are obtained.

[0035] The anomaly detection model is pre-built on training samples using the isolated forest algorithm; the training samples include sample features of sample hosts without network attack behavior, and the sample features include the importance score and local network behavior features of the sample hosts.

[0036] Optionally, before fusing the importance score with the local network behavior features to obtain the network anomaly features of the target host, the method further includes:

[0037] Obtain a first weight for the importance score and a second weight for the local features of the network behavior. The first weight is used to characterize the influence of the importance score on the recognition result; the second weight is used to characterize the influence of the local features of the network behavior on the recognition result.

[0038] The process of fusing the importance score with the local network behavior features to obtain the network anomaly features of the target host includes:

[0039] Based on the product of the importance score and the first weight, and the product of the local network behavior feature and the second weight, the importance score and the local network behavior feature are fused to obtain the network anomaly feature of the target host.

[0040] Optionally, the abnormal behavior factor is negatively correlated with the out-degree and positively correlated with the success rate.

[0041] Optionally, determining the abnormal behavior factor of the target host based on the out-degree of the target host in the host communication graph and the success rate of the target host initiating network connections includes:

[0042] Based on the success rate, determine the failure rate of the target host initiating a network connection;

[0043] The product of the failure rate, the out-degree, and the preset coefficient is input into a preset decay function to obtain the abnormal behavior factor of the target host.

[0044] Secondly, this application provides a network attack identification device, wherein graph nodes of the host communication graph of the target network are used to characterize target hosts in the target network, and the device includes:

[0045] The processing module is used to determine the abnormal behavior factor of the target host based on the out-degree of the target host in the host communication graph and the success rate of the target host initiating network connections; and to determine the importance score of each target host in the target network based on the abnormal behavior factor of each target host and the host communication graph.

[0046] The identification module is used to identify network attacks based on the importance scores of each target host, and to obtain an identification result that characterizes whether the target host has carried out a network attack.

[0047] Thirdly, this application provides an electronic device, including: a memory and a processor;

[0048] The memory stores computer-executed instructions;

[0049] The processor executes computer execution instructions stored in the memory, causing the processor to perform the method as described in any of the first aspects.

[0050] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any of the first aspects.

[0051] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the method described in any one of the first aspects.

[0052] The network attack identification method, apparatus, device, medium, and program products provided in this application can determine the abnormal behavior factors of corresponding target hosts based on the out-degree and success rate of initiating network connections of each target host in the target network, thereby quantifying the network behavior reputation of each target host. Based on the abnormal behavior factors of each target host and the host communication graph, the importance score of each target host in the target network can be determined. This abnormal behavior factor reduces interference from malicious hosts manipulating importance rankings through invalid network connections, making the importance score more closely reflect the true behavioral attributes of each target host, rather than merely reflecting its topological position. Therefore, it can improve the accuracy of network attack identification based on this importance score. This method overcomes the problem in related technologies where anomaly detection relying solely on graph topology is susceptible to interference from malicious nodes, reducing missed network attack detections and improving the accuracy of network attack identification. Attached Figure Description

[0053] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0054] Figure 1 A flowchart illustrating a method for identifying network attacks provided in this application;

[0055] Figure 2 A schematic diagram of the structure of a network attack identification device provided in this application;

[0056] Figure 3 A schematic diagram of the structure of the electronic device provided in this application.

[0057] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0058] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application.

[0059] With the widespread use of digital networks in financial services, cyberattacks can have serious consequences for financial institutions, making timely identification of cyberattacks crucial.

[0060] In related technologies, methods for identifying cyberattacks mainly include signature-based cyberattack detection or threshold-based cyberattack alerts. However, these methods typically only identify known types of cyberattacks and cannot identify flexible and ever-changing cyberattacks such as zero-day attacks and advanced persistent threats.

[0061] Therefore, improving the accuracy of network attack identification is an urgent problem to be solved.

[0062] The inventors discovered a method for network traffic analysis based on the PageRank algorithm (a method for measuring the importance of web pages). In the PageRank algorithm, the importance of an entity is determined by the quantity and quality of the entities it connects to. When applying the PageRank algorithm to network traffic analysis, a service host frequently connected to by multiple hosts may be considered more important.

[0063] The original PageRank algorithm, designed for web link scenarios, suffers from the following problems when directly applied to network traffic analysis: 1. Web links represent a binary relationship (i.e., existence or non-existence), while network communication has a frequency attribute. For example, the semantic meaning of host A initiating 100 connections to host B is drastically different from initiating only one connection. 2. Web links are essentially a voting behavior, but malicious nodes may manipulate importance rankings through a large number of invalid connections (e.g., botnets voting with each other). Therefore, the aforementioned network attack identification based on the PageRank algorithm still suffers from low accuracy.

[0064] In view of this, this application proposes a method to determine the abnormal behavior factors of a host based on factors such as network connection success rate, actively suppress malicious voting against malicious nodes such as scanners and botnets, improve the accuracy of host importance score, and thus improve the accuracy of network attack identification based on the importance score.

[0065] Optionally, the execution entity of the network attack identification method provided in this application can be any electronic device with processing capabilities, such as a server or a terminal device. Alternatively, the execution entity of the network attack identification method can also be a network attack identification system (or a network attack identification platform). The network attack identification system can be partially (or entirely) deployed on a server, server cluster, or cloud environment, and this application does not limit its deployment. In some embodiments, the cloud service platform can also provide users with the network attack identification method described in any embodiment of this application by providing network attack identification services.

[0066] The following section takes electronic devices as an example to illustrate the implementation of the network attack identification method, and provides a detailed explanation of the technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems in conjunction with specific embodiments.

[0067] The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will be described below with reference to the accompanying drawings.

[0068] Figure 1 This is a flowchart illustrating a method for identifying network attacks provided in this application. The graph nodes of the host communication graph of the target network are used to represent the target hosts in the target network. For example... Figure 1 As shown, the method includes:

[0069] S101. Based on the out-degree of the target host in the host communication graph and the success rate of the target host initiating network connections, determine the abnormal behavior factors of the target host.

[0070] Optionally, the target network can be any computer network requiring network security protection. For example, the target network could be an internal business network of a financial institution, an office LAN, a data center network, etc. This application does not limit the size, deployment scenario, network architecture, or number of target hosts of the target network.

[0071] For example, the target host can be any host device in the target network. For instance, the target host can be a service server, terminal device, network switching device, security gateway device, etc., in the target network. This application does not limit the device type, hardware configuration, deployment location, etc., of the target host. Optionally, all hosts in the target network can be the target host. Alternatively, the target host can be some hosts in the target network.

[0072] Optionally, the host communication graph described above can be a directed weighted graph structure. Each graph node uniquely corresponds to a target host in the target network. The directed edges between two graph nodes can correspond to the network connection direction between the two target hosts, such as a connection from the source target host to the destination target host.

[0073] Optionally, this application does not limit the granularity of the host communication graph construction. For example, the graph nodes of the host communication graph can be graph nodes pre-constructed based on the granularity of the target host's Internet Protocol Address (IP) address, or graph nodes constructed based on the granularity of the target host's Media Access Control Address (MAC) address, device unique identifier, etc.

[0074] For example, in a host communication graph, taking the case where a first target host initiates a network connection to a second target host, there can be directed edges in the host communication graph pointing from a first graph node to a second graph node. The first graph node in the host communication graph represents the first target host, and the second graph node represents the second target host. In some embodiments, the directed edges may also carry weight information. This weight information may include, for example, the total number of connections between the first and second target hosts, the total communication traffic, and the average connection duration.

[0075] The out-degree mentioned above can refer to the number of edges in a directed graph that originate from a certain vertex and point to other vertices. That is, in the host communication graph, for any given graph node, the number of edges originating from that node and pointing to other graph nodes is the number of other target hosts in the target network to which the target host represented by that graph node has initiated connections.

[0076] For example, for any target host, the out-degree of that target host can refer to the total number of different target hosts accessed by the target host actively initiating network connections within a preset time window. For instance, if a target host actively initiated connections to 10 different other target hosts in the past 5 minutes, then the out-degree of that target host can be 10. It should be understood that this application does not limit the duration of the aforementioned preset time window, and it can be flexibly adjusted by technicians according to actual testing needs, such as being set to 1 minute, 5 minutes, or 10 minutes.

[0077] For example, the success rate mentioned above can refer to the proportion of successful connection establishments among network connections initiated by the target host within a preset time window, out of the total number of connection attempts. For instance, assuming the target host initiates 100 connection attempts, and 97 of them successfully complete the Transmission Control Protocol (TCP) handshake to establish a connection, then the success rate of the target host in initiating network connections can be 97%.

[0078] Optionally, the aforementioned abnormal behavior factor can be used to characterize the behavioral credibility of the target host, quantifying the trustworthiness of the connection behavior initiated by the target host. In some embodiments, the abnormal behavior factor may be negatively correlated with the aforementioned out-degree and positively correlated with the aforementioned success rate.

[0079] For example, an electronic device can first collect data such as traffic logs and session connection records of the target network within a preset time window, and based on this data, obtain the total number of connection attempts and the number of successful connections for each target host, thus obtaining the success rate for each target host. The electronic device can also use the out-degree of the target host in the host communication graph as the out-degree of that target host.

[0080] By calculating abnormal behavior factors based on out-degree and success rate, the degree of abnormal behavior of a host can be quantified from the scale and quality dimensions of the target host's connection behavior. This provides a basis for behavior reputation adjustment for subsequent global importance calculations, thereby reducing the possibility of malicious target hosts interfering with global importance rankings through a large number of invalid connections.

[0081] S102. Based on the abnormal behavior factors of each target host and the host communication graph mentioned above, determine the importance score of each target host in the target network.

[0082] Optionally, the aforementioned importance score can be used to characterize the role and importance of a target host in the global communication structure of the target network. For example, a core business server frequently accessed by multiple high-reputation target hosts can have a high importance score. A scanning target host that actively initiates a large number of invalid connections has a low importance score.

[0083] For example, an electronic device can combine the anomalous behavior factors of each target host to perform iterative calculations on the host communication graph to obtain the importance score of each target host. For instance, for any target host, its importance score can be obtained by summing the importance contributions of all neighboring target hosts pointing to it, and the importance contribution of each neighboring target host can be weighted and adjusted by the anomalous behavior factors of that neighboring target host itself.

[0084] For a target host with abnormal behavior, its contribution to the importance of other hosts will be weakened because its abnormal behavior factor is small; for a target host with normal behavior, its abnormal behavior factor is large and its contribution to the importance of other hosts can be transmitted normally.

[0085] By integrating anomalous behavior factors with host communication graphs to calculate importance scores, this transforms the importance metric based solely on topology in related technologies into a behavioral importance metric that integrates behavioral semantics. This suppresses the problem of malicious nodes manipulating importance rankings through a large number of invalid connections, thus improving the accuracy of quantifying the importance of the target host's real network role based on the importance score.

[0086] S103. Based on the importance score of each target host, network attack identification is performed to obtain identification results that characterize whether the target host has carried out a network attack.

[0087] Optionally, the aforementioned network attacks (also known as abnormal network traffic attacks) can be any type of network attack, such as port scanning attacks, denial-of-service attacks, botnet communication, or low-frequency penetration attacks. This application does not limit the specific type or method of the network attack.

[0088] For example, the identification result may include two determinations: the target host is a normal host without abnormal attack behavior, or the target host is an abnormal host with network attack behavior. In some embodiments, the identification result may also include a corresponding anomaly score, used to quantify the degree of anomaly in the target host's network attack behavior.

[0089] Network attack identification based on importance scores can discover target hosts with abnormal behavior from the perspective of global network structure, and has high computational efficiency, making it suitable for real-time security detection scenarios in large-scale networks.

[0090] In this embodiment, based on the out-degree and success rate of network connections initiated by each target host in the target network, anomaly behavior factors of the corresponding target hosts can be determined to quantify the network behavior reputation of each target host. Based on the anomaly behavior factors of each target host and the host communication graph, the importance score of each target host in the target network can be determined. This anomaly behavior factor reduces interference from malicious hosts manipulating importance rankings through invalid network connections, making the importance score more closely reflect the true behavioral attributes of each target host, rather than merely reflecting its topological position. Therefore, it improves the accuracy of network attack identification based on this importance score. This method overcomes the problem in related technologies where anomaly detection relying solely on graph topology is susceptible to interference from malicious nodes, reducing missed network attack detections and improving the accuracy of network attack identification.

[0091] The following section provides a detailed explanation of how electronic devices can determine the abnormal behavior factors of a target host based on the out-degree of the target host in the host communication graph and the success rate of the target host initiating network connections.

[0092] As one possible approach, the abnormal behavior factor is negatively correlated with the out-degree and positively correlated with the success rate.

[0093] When the abnormal behavior factor is negatively correlated with the out-degree, taking the success rate and other conditions remaining constant as an example, the larger the out-degree of the network connection initiated by the target host, the smaller the value of the abnormal behavior factor corresponding to that target host. Conversely, the smaller the out-degree, the larger the value of the abnormal behavior factor. In other words, the more destination hosts a target host actively accesses, the greater the discount on its behavioral reputation and the lower the weight of the vote transmission. The fewer destination hosts a target host actively accesses, the smaller the discount on its behavioral reputation and the higher the weight of the vote transmission.

[0094] When the abnormal behavior factor is positively correlated with the success rate, taking other conditions such as out-degree remaining constant as an example, the higher the connection success rate of the target host, the larger the value of the abnormal behavior factor corresponding to that target host. The lower the success rate, the smaller the value of the abnormal behavior factor. In other words, the higher the effectiveness of the connection initiated by the target host, the better its behavioral reputation, and the higher the weight of the vote transmission. The lower the effectiveness of the connection initiated by the target host, the worse its behavioral reputation, and the lower the weight of the vote transmission.

[0095] Taking a normal business client target host as an example, the number of destination hosts it accesses daily is limited, and the connection success rate is relatively high. Therefore, the value of the abnormal behavior factor can be larger, and its voting power can be higher. Taking an attack target host that performs port scanning as an example, it will traverse and access a massive number of destination hosts, and the vast majority of connections will fail because the target ports are not open. The corresponding out-degree is large and the success rate is low, so the value of the abnormal behavior factor will be smaller.

[0096] In some embodiments, the relationship between the negative and positive correlations can be linear or nonlinear, such as exponential or logarithmic correlations. This application does not limit the specific functional form of the correlation relationship.

[0097] Through the aforementioned correlation design, the anomalous behavior factor can accurately match the real behavioral characteristics of network attacks. Specifically, the wider the target host's active connection range and the lower the percentage of effective connections, the higher its degree of anomalous behavior, and the more significantly its voting weight can be suppressed. This method adapts the anomalous behavior factor to the detection needs of network security scenarios, improving the accuracy of calculating importance scores based on this factor.

[0098] In some embodiments, the electronic device may first determine the failure rate of the target host initiating a network connection based on the success rate mentioned above, and then input the product of the failure rate, out-degree and preset coefficient into a preset attenuation function to obtain the abnormal behavior factor of the target host mentioned above.

[0099] Optionally, the failure rate mentioned above can refer to the proportion of network connections initiated by the target host that failed to be established out of the total number of connection attempts. For example, the failure rate can be the value obtained by subtracting the success rate from 1. For instance, if the connection success rate of the target host is 97%, then its corresponding failure rate is 3%.

[0100] For example, the scenarios in which the connection could not be established could include various situations where effective communication could not be established, such as TCP three-way handshake timeout, target port unreachable, or connection being actively rejected by the target host.

[0101] Optionally, the aforementioned preset coefficient can be a hyperparameter used to adjust the severity of punishment, also known as a punishment coefficient. In some embodiments, the value of this preset coefficient can determine the decay rate of the abnormal behavior factor. For example, the larger the preset coefficient value, the greater the decay of the abnormal behavior factor can be under the same out-degree and failure rate, i.e., the more severe the punishment for malicious behavior. The smaller the preset coefficient value, the more gradual the punishment can be. In some embodiments, the preset coefficient can be a preset coefficient that is predetermined by technicians through experimental parameter tuning, enabling higher accuracy in identifying network attacks. For example, the value of the preset coefficient can be 0.01, 0.05, etc., which will not be elaborated further here.

[0102] Optionally, the preset decay function can be any existing monotonically decreasing function, meaning that the larger the input value, the smaller the output value. The output value of this preset decay function can range from 0 to 1, so that the abnormal behavior factor takes the value of a positive weighting coefficient between 0 and 1.

[0103] For example, the decay function can be an exponential decay function. Correspondingly, the formula for calculating the abnormal behavior factor can be, for example, as shown in formula (1):

[0104] (1)

[0105] in, Indicates the target host Abnormal behavioral factors Indicates the preset coefficient. Indicates the target host The degree of exit, This indicates the success rate mentioned above. This means the target host The aforementioned failure rate.

[0106] For example, with a preset coefficient Taking a value of 0.01 as an example, the calculation results of the abnormal behavior factors corresponding to the target host (the host described anywhere in this application is the same concept as the target host, and will not be repeated here) with different behavior patterns can be shown in Table 1 below:

[0107] Table 1

[0108]

[0109] Taking Table 1 as an example, for a normal host, assuming the out-degree of the target host is 100 and the failure rate is 1%, the input value of formula (1) can include 0.01×100×0.01=0.01, and the abnormal behavior factor is about 0.99, close to 1. That is, the voting power of the target host in calculating the importance score of other target hosts can be basically fully retained. Taking a slightly suspicious host as an example, assuming the out-degree is 100 and the failure rate is 50%, the input value of formula (1) can include 0.01×100×0.5=0.5, and the abnormal behavior factor is about 0.61. That is, the voting power of the target host in calculating the importance score of other target hosts is partially weakened. Taking the target host of the port scanner (with network attack behavior) as an example, assuming the out-degree is 1000 and the failure rate is 99%, the input value of formula (1) can include 0.01×1000×0.99=9.9, and the abnormal behavior factor is about 0.00005, that is, the voting right of the target host in calculating the importance score of other target hosts is almost completely invalid.

[0110] In some embodiments, the above-mentioned decay function may also be other forms of monotonically decreasing function, such as piecewise linear decay function, S-shaped decay function, etc. This application does not limit the specific form of the decay function.

[0111] The above method first determines the failure rate of network connections initiated by the target host based on its connection success rate, providing basic data for quantifying the target host's behavior. By multiplying the failure rate, out-degree, and a preset coefficient, and inputting this product into a preset decay function, the abnormal behavior factor of the target host is obtained. This abnormal behavior factor can penalize hosts with high failure rates and high out-degrees; therefore, malicious scanning hosts will have lower abnormal behavior factors, while normal hosts will have higher ones. This method strengthens the suppression of malicious node voting weights, further improving the accuracy of importance scoring based on this abnormal behavior factor.

[0112] The following section details how electronic devices determine the importance score of each target host within the target network based on the abnormal behavior factors of each target host and the host communication graph of the target network:

[0113] Taking the weight of the edge pointing from the first graph node to the second graph node in the host communication graph as an example, which represents the number of times the first target host represented by the first graph node (the first target host described anywhere in this application is the same concept as the source host) has initiated a network connection to the second target host represented by the second graph node (the second target host described anywhere in this application is the same concept as the destination host), as a possible implementation, the electronic device can determine the importance score based on the weight of the edge in the host communication graph and the above-mentioned abnormal behavior factor.

[0114] In this graph, the first target host corresponds to the initiating host of the network connection, and the second target host corresponds to the receiving host of the network connection. Since network communication connections have a clear directionality, the host communication graph can be a directed graph structure. The directed edges from the nodes of the first graph to the nodes of the second graph can represent the relationship in which the first target host actively initiates a connection to the second target host.

[0115] Optionally, the weight of the aforementioned edge can be the total number of connections within a preset time window, or it can be the average connection frequency per unit time; this application does not limit this. For example, if, within a 5-minute time window, the first target host initiates 86 TCP connection requests to the second target host in the target network, then the weight of the edge representing the first target host and pointing to the second target host in the host communication graph can be 86. In some embodiments, the edge weight can also be calculated by combining parameters such as the duration of a single connection and the number of bytes of data transmitted; this will not be elaborated upon here.

[0116] In some embodiments, for any target host represented by a second graph node, the electronic device may determine the importance score of the target host represented by the second graph node based, for example, on the weight of the edge from the first graph node to the second graph node, the importance score of the first graph node, the total weight of the edge emanating from the first graph node, and the anomalous behavior factor of the first graph node.

[0117] Optionally, the total weight of the edges emanating from the first graph node can refer, for example, to the sum of the number of network connections initiated by the first target host corresponding to the first graph node to all other target hosts within a preset time window, i.e., the sum of the weights of all outgoing edges from the first graph node. This total weight can be used to normalize the importance output of the first target host to prevent hosts with high out-degree and high connection frequency from transmitting influence beyond their own magnitude.

[0118] For example, if the first target host initiates connections to four different destination hosts, and the weights of the four outgoing edges are 15, 25, 30, and 30 respectively, then the total weight of the edges sent out by the first graph node is 15+25+30+30=100.

[0119] Optionally, for any destination host acting as the connection receiver (i.e., the host corresponding to a node in the second graph), its importance score can be obtained by summing the importance contributions of all source hosts (i.e., all hosts corresponding to nodes in the first graph) that point to that second graph node. For each source host, its importance contribution to the destination host can be positively correlated with the edge weight between the two, positively correlated with the source host's own importance score, negatively correlated with the total weight of the source host's outgoing edges, and positively correlated with the source host's abnormal behavior factor.

[0120] In some embodiments, the electronic device can solve for the importance score of each target host through an iterative convergence method. For example, the electronic device can first initialize the importance scores of all target hosts to the same initial value, and then update the importance scores of each target host round by round according to the method described above for calculating importance scores, until the change in the importance scores of all target hosts is less than a preset convergence threshold, and then output the importance score of each target host.

[0121] Using the above method, for any target host represented by a node in the second graph, the importance score of the target host represented by the node in the second graph is determined based on the weights of the edges from the nodes in the first graph to the nodes in the second graph, the importance score of the nodes in the first graph, the total weights of the edges emanating from the nodes in the first graph, and the abnormal behavior factor of the nodes in the first graph. Because combining the total weights of outgoing edges normalizes influence and prevents nodes with large outgoing degrees from amplifying their influence, and because adding the abnormal behavior factor can suppress voting interference from malicious nodes, this further improves the fit between the importance score and the actual behavioral attributes of the target host, ensuring the accuracy of the importance score calculation.

[0122] For example, an electronic device may first determine the initial influence value of the importance of the first graph node on the importance of the second graph node based on the product of the weights of the edges pointing from the first graph node to the second graph node and the importance score of the first graph node. Then, the electronic device can normalize the initial influence value by using the total weights of the edges emanating from the first graph node to obtain the target influence value of the importance of the first graph node on the importance of the second graph node.

[0123] The aforementioned initial influence value can be used to quantify the importance of the source host (i.e., the first target host represented by the first graph node) and the magnitude of its initial influence on the target host, under the combined effect of the connection strength between the two hosts (i.e., the first target host and the second target host). The higher the importance of the source host, or the higher the frequency of connections between the two, the larger the initial influence value can be, indicating a stronger initial influence of the source host on the target host. Conversely, the lower the importance of the source host, or the lower the frequency of connections between the two, the smaller the initial influence value can be, indicating a weaker initial influence of the source host on the target host.

[0124] The normalization process can be used to ensure that the total importance transmitted by the first target host matches its own importance score, thereby reducing the possibility that the first target host can amplify its total importance influence output by increasing the number of outgoing edges or connections, and thus ensuring the accuracy of the subsequent calculation of the importance score of the second target host.

[0125] For example, an electronic device may divide the initial influence value by the total weight of the edges emanating from the first graph node as the normalized result, i.e., the target influence value of the importance of the first graph node on the importance of the second graph node.

[0126] For example, assuming the importance score of the first target host is 3.2, and the weight of the edge pointing to the second target host represented by the second graph node is 50, then the product of the two can be 3.2 × 50, representing the initial influence of the importance of the first graph node on the importance of the second graph node as 160. Assuming the total weight of the edges emanating from the first graph node is 200, then after normalizing the initial influence value of 160, the target influence value can be obtained as 160 ÷ 200 = 0.8. That is, the importance transmitted from the source host to the destination host is 0.8.

[0127] Then, the electronic device can determine the importance score of the target host represented by the second graph node based on the target influence value and the abnormal behavior factor of the first graph node.

[0128] Optionally, the electronic device can multiply the target influence value by the anomalous behavior factor of the first graph node to obtain the final importance contribution value of the first graph node to the second graph node. Then, the electronic device can accumulate the final importance contribution values ​​of all first graph nodes pointing to the second graph node to obtain the importance score of the target host represented by the second graph node.

[0129] For example, an electronic device can determine the importance score of the target host represented by the second graph node by the following formula (2).

[0130] (2)

[0131] in, The importance score represents the target host as indicated by the node in the second graph. For the preset damping factor (e.g.) The value can be 0.85, which is used to prevent the importance score from expanding indefinitely. This indicates all active connections to the host. (or graph nodes) The set of source hosts. This can represent the nodes in the first diagram mentioned above. Point to the node in the second graph The weight of the edge. This can represent the nodes in the first diagram mentioned above. Importance score. This can represent the aforementioned node from the first graph. The total weight of the emitted edges. It can represent the nodes of the first graph. Abnormal behavioral factors.

[0132] In this embodiment, an initial influence value is first determined by multiplying the weight of the edge pointing from the first graph node to the second graph node with the importance score of the first graph node. Then, the initial influence value is normalized by the total weight of the outgoing edges of the first graph node to obtain the target influence value. This ensures that the total importance transmitted by the first target host matches its own importance score, thereby reducing the possibility that the first target host can amplify its total importance influence output by increasing the number of outgoing edges or connections. This ensures the accuracy of the subsequent calculation of the importance score of the second target host.

[0133] The following section details how electronic devices identify network attacks based on the importance scores of each target host, obtaining identification results that characterize whether a target host has launched a network attack:

[0134] As one possible implementation, before identifying network attacks based on the importance scores of each target host to obtain an identification result characterizing whether a target host has committed a network attack, the electronic device can also determine the local network behavior characteristics of any target host based on its communication records within the target's historical time period. Then, the electronic device can fuse the importance score with the local network behavior characteristics to obtain the target host's network anomaly characteristics, and based on these characteristics, perform network attack identification on the target host to obtain the identification result.

[0135] Optionally, the target historical period can be a pre-set traffic statistics time window. For example, the target historical period can be 1 minute, 5 minutes, 15 minutes, etc., and this application does not limit the duration of the target historical period. In some embodiments, the target historical period can be flexibly adjusted by technicians according to the real-time and accuracy requirements of actual detection. In some embodiments, the duration of the target historical period can be consistent with the time window duration used to calculate the abnormal behavior factor and importance score, or it can be set to different durations according to the feature statistics requirements.

[0136] For example, the communication records mentioned above can be the full network session logs generated by the target host within the target historical period. For instance, the communication records may include information such as the source IP, destination IP, source port, destination port, connection status, number of packets, number of bytes transmitted, and connection duration for each connection.

[0137] The electronic device can obtain the above communication records by referring to any existing communication record acquisition method. For example, the above communication records can be obtained through network traffic collection devices, firewall log systems, intrusion detection systems, etc., which will not be elaborated here.

[0138] The aforementioned local network behavior features can be used to quantify the instantaneous behavioral patterns of a target host at a fine-grained level. Compared to importance scores, which focus on global topological position, local network behavior features emphasize describing the behavioral attributes of the target host itself. By combining global structural features (i.e., the aforementioned importance scores) with these local network behavior features, it is possible to cover more dimensions of anomalous network attack identification, such as identifying low-frequency covert network attacks where global structural features do not change significantly but local behavior is abnormal.

[0139] Optionally, the electronic device can directly read the aforementioned local network behavior features from the communication records. Alternatively, the electronic device can read the data used to calculate the local network behavior features from the communication records and input the data into the calculation formula for the local network behavior features to obtain the local network behavior features.

[0140] Optionally, the aforementioned local features of network behavior may include, for example, at least one of the following:

[0141] 1. The number of times the target host's IP address appears as a source IP address within the target's historical time period. For example, this local network behavior characteristic can also be referred to as the number of connections initiated. This local network behavior characteristic can be used to count the total number of times the target host actively initiates network connections. This local network behavior characteristic can reflect the scale of the target host's active communication, and thus the likelihood that the target host is an attacker actively initiating a large number of abnormal connections, such as a port scanner or a botnet controlled host. For example, the number of active connections of a normal source host usually remains within a stable range, while a scanning attack host may initiate far more connections than normal in a short period, causing the value of this local network behavior characteristic to increase.

[0142] For example, an electronic device can traverse the communication records corresponding to the target host and count the total number of records where the source IP address matches the target host's IP address, which is taken as the total number of connections initiated by the target host. For instance, if the target host has 156 communication records with matching source IP addresses within 5 minutes, then the value of this local feature of network behavior can be 156.

[0143] 2. The number of times the target host's IP address appeared as the destination IP address within the target historical time period. For example, this local network behavior feature can also be called the number of received connections, which characterizes the total number of times the target host passively receives network connections as a connection receiver. This local network behavior feature can reflect the access frequency of the target host. For instance, a host suffering from a DDoS attack will receive a large number of connection requests from different source hosts in a short period, resulting in a high value for this local network behavior feature.

[0144] For example, an electronic device can traverse communication records and count the total number of records where the destination IP address matches the target host IP address, which represents the total number of connections passively received by the target host. For instance, if the target host has 42 communication records with matching IP addresses within 5 minutes, then the local feature value of this network behavior is 42.

[0145] 3. The dispersion of the target host's access targets. For example, this dispersion value can be quantified using information entropy (destination IP entropy). The formula for calculating destination IP entropy is a logarithmic weighted sum of the access percentages for each destination IP. This local network behavior feature can be used to quantify the dispersion of the target host's access targets. The more dispersed the accessed destination IPs, the higher the entropy value. The more concentrated the accessed destination IPs, the lower the entropy value. This local network behavior feature can be used to identify attack behaviors such as port scanning and lateral movement within the intranet. For example, a scanning attack host will traverse a large number of different destination IPs, resulting in a higher entropy value.

[0146] For example, the electronic device can filter communication records where the target host is the source IP and obtain the destination IP corresponding to each communication to calculate the proportion of each destination IP's occurrences to the total number of outbound connections. Then, based on the information entropy formula, the electronic device can perform a logarithmic weighted summation of the proportions of each destination IP to obtain the destination IP entropy value, which serves as the aforementioned dispersion value.

[0147] 4. Average packet rate of the target host within the target historical period. For example, an electronic device can calculate the average packet rate by dividing the total number of packets within the target historical period by the duration of the target historical period. This local network behavior characteristic can be used to reflect the target host's traffic sending or receiving rate and can be used to reflect the characteristics of flooding attacks. For example, a flooding attack generates a large number of packets, causing the attacked host's packet rate to exceed a normal threshold.

[0148] 5. TCP connection failure rate of the target host within the target historical period. For example, an electronic device can calculate this TCP connection failure rate by dividing the total number of connection failures by the total number of connection attempts. Connection failures can include scenarios such as TCP three-way handshake failure, target port unreachable, and connection timeout. This local network behavior feature can reflect the effectiveness of the target host's connection behavior, and can be used to identify network attacks that generate a large number of failed connections, such as port scanning and password brute-force attacks.

[0149] 6. Average number of bytes per stream for the target host within the target historical time period. For example, an electronic device can calculate this average number of bytes per stream by dividing the total number of bytes transmitted within the target historical time period by the total number of session streams. This local network behavior characteristic can be used to reflect the average data transmission volume of a single network connection, and can help identify network attacks such as data theft and remote control attacks. For example, data theft attacks generate high-volume single connections, resulting in a higher average number of bytes per stream. Remote control command interaction attacks have smaller single connection data volumes, resulting in a lower average number of bytes per stream.

[0150] 7. The percentage of times the target host accesses a target type port during the target historical period. This target type port is defined as a port accessed less frequently than a preset frequency. For example, this local network behavior characteristic can also be referred to as the proportion of unused ports. Electronic devices can calculate this proportion, for example, by dividing the number of connections to the target type port by the total number of connections. This local network behavior characteristic can be used, for example, to identify network attacks such as vulnerability probing and non-standard service attacks (network attacks typically attempt to access unused ports to probe for potentially vulnerable services).

[0151] Optionally, the aforementioned network anomaly features can be comprehensive features that integrate global topology information and local behavioral information. Network anomaly features can simultaneously reflect the role and status of a target host in the target network (importance score) and specific behavioral details (local network behavioral features). Therefore, network attack identification based on these comprehensive features (network anomaly features) can capture attacks with obvious global structural features, as well as network attacks with strong camouflage and inconspicuous structural features, further improving the recall rate, comprehensiveness, and accuracy of network attack identification.

[0152] In some embodiments, the electronic device may, for example, concatenate and fuse the importance score with local network behavior features to obtain a feature vector of the target host, and then normalize the feature vector based on the feature mean and feature standard deviation of the importance score and local network behavior features to obtain the network anomaly features of the target host.

[0153] For example, the above-mentioned splicing and fusion can refer to using the importance score as an independent feature dimension, and splicing it sequentially with the local features of network behavior in a preset order to form a one-dimensional comprehensive feature vector (i.e., the feature vector of the target host). For example, assuming that the local features of network behavior contain 7 statistical dimensions (such as the 7 local features of network behavior mentioned above), then after splicing, a feature vector with 8 dimensions can be obtained, where the first dimension can be, for example, the importance score, and the second to eighth dimensions can be the aforementioned local features of network behavior in sequence.

[0154] By using the above splicing and fusion method, information on two types of features (importance scores as global features and local network behavior features as local features) can be retained, thus achieving the combination of global structural information and local behavioral information.

[0155] Optionally, the electronic device can obtain the mean and standard deviation of the importance score and local network behavior features by referring to any existing method for obtaining the mean and standard deviation of features, which will not be elaborated here. For example, the mean and standard deviation of features can be obtained in advance based on sample data from normal hosts.

[0156] For example, electronic devices can employ Z-score (a type of normalization method) standardization to normalize the importance score and local features of network behavior using the aforementioned feature mean and feature standard deviation. For instance, for each feature dimension, the normalized feature value is obtained by subtracting the feature mean from the original value of that feature and then dividing by the feature standard deviation.

[0157] The above normalization process reduces the difference in dimensions and prevents features with larger values ​​from dominating distance calculation and spatial partitioning, which would otherwise overwhelm features with smaller but equally important values ​​(such as importance scores). This improves the accuracy of network attack identification based on these network anomaly features.

[0158] Alternatively, in some embodiments, the electronic device may first obtain a first weight of the importance score and a second weight of the local network behavior features before fusing the importance score with the local network behavior features to obtain the network anomaly features of the target host. Then, based on the product of the importance score and the first weight, and the product of the local network behavior features and the second weight, the importance score and the local network behavior features are fused to obtain the network anomaly features of the target host.

[0159] The first weight mentioned above can be used to characterize the influence of the importance score on the recognition result. The second weight can be used to characterize the influence of local features of network behavior on the recognition result.

[0160] Optionally, the values ​​of the first and second weights can be flexibly configured by technicians according to the emphasis of the actual detection scenario. For example, in the detection scenario of backbone network core nodes, where more attention is paid to abnormal changes in the global topology, the value of the first weight can be increased to enhance the influence of global structural features (importance score) on the identification results. In the detection scenario of terminal access area, where more attention is paid to abnormal behavioral details of individual hosts, the value of the second weight can be increased to enhance the influence of local behavioral features (network anomaly features) on the identification results.

[0161] In some embodiments, the first weight and the second weight can also be determined by the electronic device through automated tuning. For example, the electronic device can use methods such as grid search and cross-validation to traverse different weight combinations on the validation dataset and select the weight combination that maximizes the accuracy of the recognition result as the final configuration of the first weight and the second weight.

[0162] For example, the electronic device can first calculate the product of the importance score and the first weight to obtain the weighted global feature value, and then calculate the product of the local feature of each dimension of network behavior and the second weight to obtain the weighted local feature value of each dimension. Then, the electronic device can concatenate the weighted global feature value and the local feature value of each dimension to obtain the weighted fused feature vector, thereby realizing the fusion of the importance score and the local feature of network behavior to obtain the network anomaly feature.

[0163] By using the above method, based on the importance score and the weight coefficients (first weight and second weight) of local network behavior features, the contribution ratio of global structural features and local behavioral features in anomaly detection can be flexibly adjusted, which improves the flexibility of the network attack identification method and makes it adaptable to different network architectures, different business scenarios and different detection requirements.

[0164] In some embodiments, electronic devices may input network anomaly features into an anomaly detection model to identify network attacks and obtain the aforementioned identification results.

[0165] The anomaly detection model can be pre-built on training samples using the Isolation Forest algorithm. These training samples can include sample features of host computers exhibiting no network attack behavior. These sample features can include the importance score of the host computer and the aforementioned local network behavior features.

[0166] The aforementioned isolated forest algorithm can be considered an unsupervised anomaly detection algorithm. This algorithm describes anomalous samples that are in the minority in the feature space and deviate from the normal distribution, thus making them easier to isolate quickly by randomly defined boundaries. This isolated forest algorithm can refer to any existing isolated forest algorithm; for example, by constructing multiple isolated trees and randomly selecting features and setting thresholds for the sample hosts. The shorter the path length of the sample host in the isolated tree, the easier it is to isolate, and the higher its anomaly level.

[0167] For example, the training process of the anomaly detection model can refer to any existing unsupervised model training method using the isolated forest algorithm. For instance, electronic devices can collect traffic data from sample hosts that do not exhibit network attack behavior, extract the importance score and local network behavior features of each sample host to form a training sample set, and then use the isolated forest algorithm to train on this training sample set to construct multiple isolated trees, thereby obtaining the aforementioned anomaly detection model.

[0168] Optionally, the output of the anomaly detection model may include an anomaly label (e.g., a value of 1 can indicate that the host is in a normal state, i.e., the target host is not conducting a network attack, and a value of -1 can indicate that the target host is exhibiting abnormal traffic attack behavior). In some embodiments, the output of the anomaly detection model may also include an anomaly score, used to quantify the degree of anomaly of the target host. For example, a higher anomaly score indicates a greater deviation of the target host's behavior from the normal pattern, i.e., a higher risk of network attack.

[0169] The anomaly detection model built using the isolated forest algorithm can identify network attacks without labeled attack data, and the data processing volume is low. Therefore, it ensures both the accuracy and efficiency of network attack identification.

[0170] The method for identifying network attacks provided in this application will be illustrated below with specific examples. For example, the method for identifying network attacks proposed in this application may include the following three core stages:

[0171] 1. Network graph construction and weighted PageRank calculation.

[0172] This step abstracts the original network communication logs into a directed weighted graph and iteratively calculates the behavioral importance score of each host using an improved PageRank algorithm, such as the aforementioned formula (2). This score quantifies the host's role in the global network communication structure: whether it is a core server that receives a large number of visits, a client that mainly initiates communication, or a scanner with abnormal behavior. Through this step, the behavioral characteristics of the hosts are characterized from the perspective of the global topology, laying the foundation for subsequent multidimensional analysis. 2. Multidimensional statistical feature extraction.

[0173] Based on the obtained global structural features of the host (PR value, i.e., importance score), seven statistical features are extracted from the local behavioral dimension (following the aforementioned local network behavior features, which will not be repeated here), including connection frequency, destination IP entropy, connection failure rate, etc. These features can be obtained by directly statistically analyzing the raw traffic data within the time window, and can characterize the host's instantaneous behavioral patterns. Through these local features, it is possible to capture attack patterns that may appear normal in terms of global structure but exhibit abnormalities in behavioral details, such as low-frequency slow attacks and Remote to Local (R2L) attacks. Taking the communication records of host A within a 5-minute time window as an example, the electronic device can calculate the statistical items (local network behavior features) using Table 2 below:

[0174] Table 2

[0175]

[0176] 3. Feature fusion and anomaly detection

[0177] The global features (PR values) obtained in the first two steps are fused with the 7-dimensional statistical features (F1-F7) into an 8-dimensional comprehensive feature vector, and the Isolation Forest algorithm is used for unsupervised anomaly detection. The fused feature vector contains both the host's structural information within the network topology and its fine-grained behavioral characteristics, providing a rich information foundation for anomaly detection. The Isolation Forest algorithm identifies anomalous samples by randomly partitioning the feature space, effectively discovering attacking hosts that exhibit anomalous features at the feature combination level even without labels. The output can be an anomaly score and anomaly determination result for each host.

[0178] First, for each host i in the network, its global features and local features are concatenated to form an 8-dimensional comprehensive feature vector: X_i = [PR(i), F1, F2, F3, F4, F5, F6, F7]. Examples of feature vectors for different host types are shown in Table 3 below.

[0179] Table 3

[0180]

[0181] Then, considering that the numerical ranges of the above features differ significantly, for example, PR values ​​are between 10... -4 Up to 10 0 The output degree of F1 can reach the order of 10³, while the number of bytes of F6 is on the order of 10². Features with larger numerical values ​​will dominate the distance calculation, causing features with smaller numerical values ​​but equally important values ​​(such as PR values) to be ignored. The Z-score normalization method can be used to normalize the features of each dimension, referring to the following formula (3):

[0182] (3)

[0183] in The characteristic mean, The characteristic standard deviation is denoted as . To be The results after normalization. After normalization, the mean of each feature can be 0, and the standard deviation can be 1, to ensure that each feature dimension has equal status in subsequent analysis. For example, examples of normalized feature vectors for different host types are shown in Table 4 below:

[0184] Table 4

[0185]

[0186] By constructing an 8-dimensional feature matrix of all hosts, with dimensions (n_hosts, 8), the normal traffic data can be divided into a training set X_train (containing only normal host samples). n_hosts can represent a host. Then, the Isolation Forest algorithm is used to build an anomaly detection model on the training set.

[0187] iso_forest=IsolationForest(contamination=0.1,random_state=42)

[0188] iso_forest.fit(X_train)

[0189] In the `IsolationForest` constructor, the parameter `contamination` represents the proportion of expected anomalous samples in the dataset, used to determine the threshold for anomaly detection. `random_state` is the random number seed. `Fit` is the training method for Isolation Forest, used to construct multiple isolated trees based on the input training data to complete the training of the unsupervised model.

[0190] In the anomaly detection process, for each host in the test set, an anomaly score can be calculated and an anomaly determination label can be obtained, including the anomaly score and the anomaly value. The anomaly score is converted into a positive value (the larger the value, the more abnormal), and the detection result (identification result) is output in combination with the determination label. For example, the retrieval results can be shown in Table 5 below:

[0191] Table 5

[0192]

[0193] In this embodiment, a behavior adjustment factor f(v) is introduced to calculate a behavior reputation coefficient for each node during the weighted PageRank iteration process. This exponentially weakens the influence of hosts that frequently make invalid connections (such as port scans) in the global vote. This method suppresses the ability of malicious nodes to manipulate PR rankings through a large number of invalid connections. Experiments show that in probe attack detection, the PR value of this application can suppress the scanner's score to below 0.1, while PageRank in related technologies cannot distinguish between scanners and normal clients. Experimental data demonstrates the effectiveness of the f(v) factor in suppressing noisy voting and highlighting genuine behavioral anomalies.

[0194] By concatenating an improved PageRank score (1-dimensional) with 7-dimensional time window statistical features (number of outgoing or received connections, destination IP entropy, packet rate, TCP failure rate, average stream bytes, and proportion of infrequently used ports) into an 8-dimensional comprehensive feature vector, and inputting it into an isolated forest for unsupervised learning, this fusion strategy achieves complementarity between macroscopic status and microscopic behavioral details. Experimental data from the inventors show that the PR-Stat-IF model (the name of the network attack identification method approved in this application) has a higher recall rate than related algorithms using only PageRank, achieving the ability to capture complex anomaly patterns that cannot be detected by a single dimension through the fusion of global and local information.

[0195] By capturing attacker role misalignment (such as a client attempting to impersonate a server) through a behavior regulation factor f(v), and combining this with the Isolation Forest algorithm to identify low-rate attack feature combinations disguised as normal traffic in an 8-dimensional space, this optimization addresses the low detection rate of related technologies for R2L and User to Root (U2R) attacks. Therefore, through the synergistic effect of the above methods, this application improves overall recall and the detection rate of difficult-to-detect attacks while maintaining high precision.

[0196] Figure 2 This is a schematic diagram of the structure of a network attack identification device provided in this application. Figure 2 As shown, the network attack identification device 20 may include: a processing module 21 and an identification module 22. Wherein,

[0197] Processing module 21 is used to determine the abnormal behavior factors of the target host based on the out-degree of the target host in the host communication graph and the success rate of the target host initiating network connections; based on the abnormal behavior factors of each target host and the host communication graph of the target network, it determines the importance score of each target host in the target network; the graph nodes of the host communication graph are used to represent the target hosts.

[0198] The identification module 22 is used to identify network attacks based on the importance score of each target host, and to obtain identification results that characterize whether the target host has carried out a network attack.

[0199] Optionally, the weight of the edge pointing from the first graph node to the second graph node in the host communication graph is used to represent the number of times the first target host represented by the first graph node has initiated a network connection to the second target host represented by the second graph node. Optionally, the processing module 21 is specifically used to determine the importance score based on the edge weights in the host communication graph and the abnormal behavior factor.

[0200] Optionally, the processing module 21 is specifically used to determine the importance score of the target host represented by the second graph node for any target host represented by the second graph node, based on the weight of the edge from the first graph node to the second graph node, the importance score of the first graph node, the total weight of the edge emanating from the first graph node, and the abnormal behavior factor of the first graph node.

[0201] Optionally, the processing module 21 is specifically used to determine the initial influence value of the importance of the first graph node on the importance of the second graph node based on the product of the weight of the edge pointing from the first graph node to the second graph node and the importance score of the first graph node; to normalize the initial influence value by using the total weight of the edges emanating from the first graph node to obtain the target influence value of the importance of the first graph node on the importance of the second graph node; and to determine the importance score of the target host represented by the second graph node based on the target influence value and the abnormal behavior factor of the first graph node.

[0202] Optionally, processing module 21 is further configured to, before performing network attack identification based on the importance scores of each target host to obtain an identification result characterizing whether a target host has committed a network attack, determine the local network behavior features of any target host based on the communication records of that target host within the target's historical time period. Optionally, identification module 22 is specifically configured to fuse the importance score with the local network behavior features to obtain the network anomaly features of the target host; and based on the network anomaly features, perform network attack identification on the target host to obtain an identification result.

[0203] Optionally, local network behavior features include at least one of the following:

[0204] The number of times the target host's IP appeared as the source IP within the target historical time period;

[0205] The number of times the target host's IP address appears as the destination IP address within the target historical time period;

[0206] The degree of dispersion of the target host's access targets;

[0207] The average packet rate of the target host during the target historical period;

[0208] TCP connection failure rate of the target host within the target historical time period;

[0209] The average number of streaming bytes for the target host during the target historical time period;

[0210] The percentage of times the target host accesses the target type port during the target historical period; the target type port is a port whose access frequency is lower than the preset frequency.

[0211] Optionally, the identification module 22 is specifically used to concatenate and fuse the importance score with the local features of network behavior to obtain the feature vector of the target host; based on the feature mean and feature standard deviation of the importance score and the local features of network behavior, the feature vector is normalized to obtain the network anomaly features of the target host.

[0212] Optionally, the identification module 22 is specifically used to input network anomaly features into the anomaly detection model to identify network attacks and obtain identification results; the anomaly detection model is pre-constructed on training samples using the isolated forest algorithm; the training samples include sample features of sample hosts without network attack behavior, and the sample features include the importance score of the sample host and local network behavior features.

[0213] Optionally, the identification module 22 is further configured to, before fusing the importance score with the local network behavior features to obtain the network anomaly features of the target host, obtain a first weight of the importance score and a second weight of the local network behavior features. The first weight is used to characterize the influence of the importance score on the identification result; the second weight is used to characterize the influence of the local network behavior features on the identification result. Optionally, the identification module 22 is specifically configured to, based on the product of the importance score and the first weight, and the product of the local network behavior features and the second weight, fuse the importance score with the local network behavior features to obtain the network anomaly features of the target host.

[0214] Optionally, the abnormal behavior factor is negatively correlated with out-degree and positively correlated with success rate.

[0215] Optionally, the processing module 21 is specifically used to determine the failure rate of the target host initiating network connections based on the success rate; and input the product of the failure rate, out-degree and preset coefficient into a preset decay function to obtain the abnormal behavior factor of the target host.

[0216] The network attack identification device 20 provided in this application is used to execute the aforementioned network attack identification method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0217] Figure 3A schematic diagram of the structure of the electronic device provided in this application. Figure 3 As shown, the electronic device 30 provided in this embodiment includes at least one processor 301 and a memory 302. Optionally, the electronic device 30 further includes a communication component 303. The processor 301, memory 302, and communication component 303 are connected via a bus 304.

[0218] In the specific implementation process, at least one processor 301 executes computer execution instructions stored in memory 302, causing at least one processor 301 to execute the above-mentioned network attack identification method.

[0219] The specific implementation process of processor 301 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0220] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0221] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0222] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0223] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the aforementioned method for identifying network attacks.

[0224] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the aforementioned method for identifying network attacks.

[0225] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0226] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an application-specific integrated circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0227] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0228] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0229] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0230] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0231] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0232] Finally, it should be noted that other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope.

Claims

1. A method for identifying network attacks, characterized in that, The graph nodes of the host communication graph of the target network are used to represent the target hosts in the target network, and the method includes: Based on the out-degree of the target host in the host communication graph and the success rate of the target host initiating network connections, the abnormal behavior factors of the target host are determined. Based on the abnormal behavior factors of each target host and the host communication graph, the importance score of each target host in the target network is determined. Based on the importance scores of each target host, network attack identification is performed to obtain identification results that characterize whether the target host has carried out a network attack.

2. The method according to claim 1, characterized in that, The weight of the edge pointing from the first graph node to the second graph node in the host communication graph is used to represent the number of times the first target host represented by the first graph node has initiated a network connection to the second target host represented by the second graph node. The determination of the importance score of each target host in the target network based on the abnormal behavior factors of each target host and the host communication graph includes: The importance score is determined based on the weights of the edges in the host communication graph and the abnormal behavior factor.

3. The method according to claim 2, characterized in that, Determining the importance score based on the weights of the edges in the host communication graph and the anomalous behavior factor includes: For any target host represented by the second graph node, the importance score of the target host represented by the second graph node is determined based on the weight of the edge from the first graph node to the second graph node, the importance score of the first graph node, the total weight of the edge emanating from the first graph node, and the abnormal behavior factor of the first graph node.

4. The method according to claim 3, characterized in that, The determination of the importance score of the target host represented by the second graph node based on the weights of the edges pointing from the first graph node to the second graph node, the importance score of the first graph node, the total weights of the edges emanating from the first graph node, and the anomalous behavior factor of the first graph node includes: The initial influence of the importance of the first graph node on the importance of the second graph node is determined by multiplying the weight of the edge pointing from the first graph node to the second graph node with the importance score of the first graph node. By normalizing the initial influence value using the total weight of the edges emanating from the first graph node, the target influence value of the importance of the first graph node on the importance of the second graph node is obtained. Based on the target influence value and the abnormal behavior factor of the first graph node, the importance score of the target host represented by the second graph node is determined.

5. The method according to any one of claims 1-4, characterized in that, Before performing network attack identification based on the importance scores of each target host to obtain an identification result characterizing whether the target host has committed a network attack, the method further includes: For any of the target hosts, based on the communication records of the target host during the target historical period, determine the local characteristics of the target host's network behavior; The network attack identification based on the importance scores of each target host, to obtain an identification result characterizing whether the target host has committed a network attack, includes: The importance score is fused with the local network behavior features to obtain the network anomaly features of the target host; Based on the aforementioned network anomaly characteristics, network attack identification is performed on the target host, and the identification result is obtained.

6. The method according to claim 5, characterized in that, The local characteristics of network behavior include at least one of the following: The number of times the target host's IP appeared as the source IP within the target historical period; The number of times the target host's IP appeared as the destination IP within the target historical period; The degree of dispersion of the target host's access targets; The average message rate of the target host during the target historical period; The TCP connection failure rate of the target host during the target historical period; The average number of streaming bytes of the target host during the target historical period; The proportion of the target host accessing the target type port during the target historical period; the target type port is a port whose access frequency is lower than a preset frequency.

7. The method according to claim 5, characterized in that, The process of fusing the importance score with the local network behavior features to obtain the network anomaly features of the target host includes: The importance score is concatenated and fused with the local network behavior features to obtain the feature vector of the target host; Based on the importance score, the mean value of the local features of the network behavior, and the standard deviation of the features, the feature vector is normalized to obtain the network anomaly features of the target host.

8. The method according to claim 5, characterized in that, The process of identifying network attacks on the target host based on the network anomaly characteristics, and obtaining the identification result, includes: The network anomaly features are input into the anomaly detection model to identify network attacks, and the identification results are obtained. The anomaly detection model is pre-built on training samples using the isolated forest algorithm; the training samples include sample features of sample hosts without network attack behavior, and the sample features include the importance score and local network behavior features of the sample hosts.

9. The method according to claim 5, characterized in that, Before fusing the importance score with the local network behavior features to obtain the network anomaly features of the target host, the method further includes: Obtain a first weight for the importance score and a second weight for the local features of the network behavior. The first weight is used to characterize the influence of the importance score on the recognition result; the second weight is used to characterize the influence of the local features of the network behavior on the recognition result. The process of fusing the importance score with the local network behavior features to obtain the network anomaly features of the target host includes: Based on the product of the importance score and the first weight, and the product of the local network behavior feature and the second weight, the importance score and the local network behavior feature are fused to obtain the network anomaly feature of the target host.

10. The method according to any one of claims 1-4, characterized in that, The abnormal behavior factor is negatively correlated with the out-degree and positively correlated with the success rate.

11. The method according to claim 10, characterized in that, The step of determining the abnormal behavior factors of the target host based on the out-degree of the target host in the host communication graph and the success rate of the target host initiating network connections includes: Based on the success rate, determine the failure rate of the target host initiating a network connection; The product of the failure rate, the out-degree, and the preset coefficient is input into a preset decay function to obtain the abnormal behavior factor of the target host.

12. A device for identifying network attacks, characterized in that, The graph nodes of the host communication graph of the target network are used to represent target hosts in the target network, and the apparatus includes: The processing module is used to determine the abnormal behavior factor of the target host based on the out-degree of the target host in the host communication graph and the success rate of the target host initiating network connections; and to determine the importance score of each target host in the target network based on the abnormal behavior factor of each target host and the host communication graph. The identification module is used to identify network attacks based on the importance scores of each target host, and to obtain an identification result that characterizes whether the target host has carried out a network attack.

13. An electronic device, characterized in that, include: Memory, processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the method as described in any one of claims 1-11.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-11.

15. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method described in any one of claims 1-11.

Images