Network attack detection method and device, and protection system

Abstract

The present application belongs to the field of network security. Provided are a network attack detection method and device, and a protection system. After receiving network traffic, a protection device firstly determines, by means of a traffic detection model and on the basis of a traffic feature of the network traffic, whether the network traffic is suspicious traffic; and after determining that the network traffic is suspicious traffic, the protection device further matches the traffic feature of the network traffic with attack features in a feature library, and determines on the basis of the matching result that the network traffic is normal traffic or attack traffic. In the present application, preliminary screening is performed on the network traffic by means of the traffic detection model, such that the number of pieces of network traffic on which attack detection based on the feature library needs to be performed is reduced, thereby improving the detection efficiency of the protection device. Moreover, the protection device can allocate more processing resources for the detection of a single piece of network traffic, such that the single piece of network traffic can be detected more comprehensively on the basis of the feature library, thereby improving the accuracy of detection.

Description

Network attack detection methods and equipment, and protection systems

[0001] This application claims priority to Chinese patent application number 202410138269.X, filed on January 30, 2024, entitled “Network Attack Detection Method, Equipment, and Protection System,” the entire contents of which are incorporated herein by reference. Technical Field

[0002] The present application relates to the field of network security, and in particular to a network attack detection method and equipment, and a protection system. Background Art

[0003] Protection devices (such as security gateways or firewalls) detect the traffic flowing through the protection device to confirm whether there is an attack on the network, and if there is an attack, they will promptly block the attack traffic to ensure network security.

[0004] At present, protection devices mainly detect and protect against network attacks by applying intrusion prevention system (IPS) technology or anti-virus (AV) technology. Among them, IPS technology is mainly used to detect malicious traffic (or attack traffic), and AV technology is mainly used to detect malicious files (or virus files). The method of using IPS technology and AV technology to detect network attacks is similar, by pre-storing a feature library in the protection device, which includes a large number of known malicious traffic or attack features of malicious files provided by network security vendors. The protection device extracts the traffic features of the network traffic arriving at the protection device, compares the extracted traffic features with the attack features in the feature library, and if the extracted traffic features contain the attack features in the feature library, it is determined that the network traffic is attack traffic.

[0005] However, because current protection devices must perform attack detection based on signature libraries for all received traffic, and the size of signature libraries is growing rapidly (i.e., the number of attack signatures in the signature library is rapidly increasing), the process of comparing traffic signatures with attack signatures becomes a processing bottleneck for protection devices, limiting their detection efficiency. Furthermore, to meet performance requirements such as resource utilization and latency, protection devices may, under certain conditions, omit some steps in the signature comparison process, which can also affect detection accuracy.

[0006] Summary of the Invention

[0007] The present application provides a network attack detection method and device, and a protection system.

[0008] In a first aspect, a network attack detection method is provided. The method is applied to a protection system, which includes a protection device. The protection device receives target network traffic. The protection device obtains target traffic features, which are traffic features of the target network traffic. The protection device inputs the target traffic features into a target traffic detection model and obtains a target determination result output by the target traffic detection model. The target traffic detection model is trained based on a target training sample set. The target training sample set includes multiple groups of sample traffic features, each group of sample traffic features is labeled with a normal label or an abnormal label. The sample traffic features labeled with a normal label are derived from known normal traffic, and the sample traffic features labeled with an abnormal label are derived from known attack traffic. The protection device determines whether the target network traffic is suspicious traffic based on the target determination result. If the target network traffic is suspicious traffic, the protection device matches the target traffic features with attack features in a feature library and, based on the matching results, determines whether the target network traffic is attack traffic or normal traffic.

[0009] This application implements a joint detection scheme based on a model and a feature library. First, the traffic detection model makes a preliminary judgment on the network traffic received by the protection device. After the protection device determines that the network traffic is suspicious traffic based on the judgment result of the traffic detection model, it further performs attack detection on the network traffic based on the feature library stored in the protection device. Since most network traffic is normal traffic, the preliminary screening of network traffic by the traffic detection model can greatly reduce the number of network traffic that requires the protection device to perform attack detection based on the feature library. Since the network traffic that requires the protection device to perform attack detection based on the feature library is greatly reduced, on the one hand, the detection efficiency of the protection device is improved, and on the other hand, the protection device can allocate more processing resources for the detection of a single network traffic, so that a single network traffic can be more comprehensively detected based on the feature library, thereby improving the accuracy of the detection.

[0010] In a first possible implementation, the target traffic detection model outputs a determination result indicating normal or abnormal. The protection device determines whether the target network traffic is suspicious traffic based on the target determination result, including: if the target determination result indicates abnormality, the protection device determines the target network traffic is suspicious traffic; if the target determination result indicates normal, the protection device determines the target network traffic is normal traffic.

[0011] In this implementation, the target traffic detection model primarily filters normal traffic. The protection device directly passes network traffic that the target traffic detection model identifies as normal. However, the protection device further performs signature-based attack detection on network traffic identified as abnormal by the target traffic detection model. Because the protection device does not need to perform signature-based attack detection on network traffic identified as normal by the target traffic detection model, the amount of network traffic that requires subsequent signature-based attack detection is significantly reduced, thereby improving the protection device's detection efficiency.

[0012] In a second possible implementation, the target traffic detection model outputs a determination result indicating normal, abnormal, or suspicious. The protection device determines whether the target network traffic is suspicious traffic based on the target determination result, including: if the target determination result indicates suspicious, the protection device determines the target network traffic is suspicious traffic; if the target determination result indicates abnormal, the protection device determines the target network traffic is attack traffic; and if the target determination result indicates normal, the protection device determines the target network traffic is normal traffic.

[0013] In this implementation mode, the target traffic detection model is used to filter normal traffic in the network and also to identify attack traffic in the network. For network traffic that the target traffic detection model determines to be normal, the protection device directly releases it; for network traffic that the target traffic detection model determines to be abnormal (i.e., attack traffic), the protection device directly intercepts it; for network traffic that the target traffic detection model determines to be suspicious, the protection device further performs attack detection based on the feature library. Since the protection device does not need to perform attack detection based on the feature library for network traffic that the target traffic detection model determines to be normal and network traffic that is determined to be abnormal, the number of network traffic that the protection device needs to perform attack detection based on the feature library is greatly reduced, thereby improving the detection efficiency of the protection device. In addition, since the target traffic detection model has the ability to identify attack traffic, it is possible to identify malicious traffic or unknown malicious traffic that attempts to evade detection through deformation, thereby improving the detection effect of the protection device.

[0014] In conjunction with the second possible implementation, if the confidence level of the target flow detection model's prediction of the input flow characteristics reaches a confidence threshold, the target flow detection model outputs a judgment result as the prediction result. If the confidence level of the target flow detection model's prediction of the input flow characteristics falls below the confidence threshold, the target flow detection model outputs a judgment result indicating suspiciousness. The prediction result indicates either normal or abnormality.

[0015] In a third possible implementation, the target traffic detection model outputs a determination result indicating normal or abnormal, and the determination result also includes a confidence level. The implementation method in which the protection device determines whether the target network traffic is suspicious traffic based on the target determination result includes: if the confidence level in the target determination result is lower than a confidence threshold, the protection device determines the target network traffic is suspicious traffic. If the target determination result indicates abnormality and the confidence level in the target determination result reaches the confidence threshold, the protection device determines the target network traffic is attack traffic. If the target determination result indicates normality and the confidence level in the target determination result reaches the confidence threshold, the protection device determines the target network traffic is normal traffic.

[0016] In this implementation mode, the target traffic detection model can be used to filter normal traffic in the network, and can also be used to identify attack traffic in the network. For network traffic that the protection device determines to be normal traffic based on the judgment results of the target traffic detection model, the protection device directly releases it; for network traffic that the protection device determines to be attack traffic based on the judgment results of the target traffic detection model, the protection device directly intercepts it; for network traffic that the protection device determines to be suspicious traffic based on the judgment results of the target traffic detection model, the protection device further performs attack detection based on the feature library. Since the protection device does not need to perform attack detection based on the feature library for the attack traffic and normal traffic determined based on the target traffic detection model, the number of network traffic that the protection device needs to perform attack detection based on the feature library is greatly reduced, thereby improving the detection efficiency of the protection device. In addition, since the target traffic detection model has the ability to identify attack traffic, it is possible to identify malicious traffic or unknown malicious traffic that attempts to evade detection through deformation, thereby improving the detection effect of the protection device.

[0017] Optionally, the protection system further includes an analysis device storing multiple traffic detection models corresponding to various network scenarios. Based on the target network scenario currently deployed by the protection device, the analysis device obtains a target traffic detection model corresponding to the target network scenario from the multiple traffic detection models, where the target network scenario is any one of the multiple network scenarios. The analysis device then sends the target traffic detection model to the protection device.

[0018] Optionally, the analysis device trains a universal traffic detection model based on a universal training sample set, the universal training sample set including multiple sets of sample traffic features, and the universal training sample set is obtained based on network traffic in various network scenarios. The analysis device obtains a target training sample set corresponding to a target network scenario, the target training sample set being obtained based on network traffic in the target network scenario. The analysis device trains the universal traffic detection model using the target training sample set to obtain a target traffic detection model.

[0019] In this application, the analysis device collects known normal and attack traffic from various network scenarios, extracts traffic features from a large number of known network traffic as a universal training sample set, and uses this universal training sample set for generalized training to develop a universal traffic detection model. The analysis device then fine-tunes this universal traffic detection model based on the network scenario in which the protection device is actually deployed, using sample traffic features from network traffic in the corresponding network scenario. This fine-tunes the resulting traffic detection model, making it more suitable for the current network scenario and thereby improving its detection accuracy.

[0020] Optionally, after the protection device matches the target traffic features with the attack features in the feature library and determines whether the target network traffic is attack traffic or normal traffic based on the matching results, the protection device labels the target traffic features and uses the labeled target traffic features as a set of new sample traffic features, which are used to update the target traffic detection model.

[0021] In this application, the protection device generates new sample traffic features based on the traffic judgment results obtained based on feature library matching, which is used to regularly update the target traffic detection model to further improve the accuracy of the traffic detection model.

[0022] Optionally, the analysis device uses network telemetry technology to collect new sample traffic features from the protection device in real time and adds the new sample traffic features to the target training sample set. The analysis device periodically uses the latest target training sample set to train the target traffic detection model to obtain an updated target traffic detection model. The analysis device sends the updated target traffic detection model to the protection device. The protection device replaces the local target traffic detection model with the updated target traffic detection model. In this implementation method, the analysis device updates the target traffic detection model on the protection device, which can save processing resources of the protection device.

[0023] Alternatively, the protection device periodically uses new sample traffic features generated by the protection device to train a local target traffic detection model, obtaining an updated target traffic detection model, and then replaces the local target traffic detection model with the updated target traffic detection model. In this implementation, the protection device automatically updates the target traffic detection model.

[0024] Optionally, if the target network traffic is normal traffic, the protection device allows the target network traffic to pass. If the target network traffic is attack traffic, the protection device intercepts the target network traffic.

[0025] In this application, the protection device can be compatible with the defense against attack traffic and the forwarding of normal traffic.

[0026] In a second aspect, a protective device is provided. The protective device includes multiple functional modules that interact with each other to implement the actions performed by the protective device in the first aspect and its respective embodiments. The multiple functional modules can be implemented using software, hardware, or a combination of software and hardware, and the multiple functional modules can be arbitrarily combined or divided based on the specific implementation.

[0027] In a third aspect, an analysis device is provided. The analysis device includes multiple functional modules that interact with each other to implement the actions performed by the analysis device in the first aspect and its respective embodiments. The multiple functional modules can be implemented using software, hardware, or a combination of software and hardware, and the multiple functional modules can be arbitrarily combined or divided based on the specific implementation.

[0028] In a fourth aspect, a protection device is provided, comprising: a memory, a network interface, and at least one processor. The memory is configured to store program instructions, and the at least one processor reads the program instructions stored in the memory to cause the protection device to perform the actions performed by the protection device in the first aspect and its respective embodiments.

[0029] In a fifth aspect, an analysis device is provided, comprising: a memory, a network interface, and at least one processor. The memory is configured to store program instructions, and the at least one processor reads the program instructions stored in the memory to cause the analysis device to perform the actions performed by the analysis device in the first aspect and its respective embodiments.

[0030] In a sixth aspect, a protection system is provided, comprising a protection device, wherein the protection device is used to perform the actions performed by the protection device in the above-mentioned first aspect and its various embodiments.

[0031] Optionally, the protection system further includes an analysis device, which is used to perform the actions performed by the analysis device in the above-mentioned first aspect and each embodiment thereof.

[0032] In the seventh aspect, a computer-readable storage medium is provided, on which instructions are stored. When the instructions are executed by a processor, the actions performed by the protective device in the above-mentioned first aspect and its various embodiments are implemented, or the actions performed by the analysis device in the above-mentioned first aspect and its various embodiments are implemented.

[0033] In an eighth aspect, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the actions performed by the protective device in the above-mentioned first aspect and its various embodiments, or implements the actions performed by the analysis device in the above-mentioned first aspect and its various embodiments.

[0034] In the ninth aspect, a chip is provided, which includes a programmable logic circuit and / or program instructions. When the chip is running, it implements the actions performed by the protective device in the above-mentioned first aspect and its various embodiments, or implements the actions performed by the analysis device in the above-mentioned first aspect and its various embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] FIG1 is a schematic diagram of an application scenario provided by an embodiment of the present application;

[0036] FIG2 is a schematic diagram of interaction between a data plane and a control plane provided in an embodiment of the present application;

[0037] FIG3 is a schematic diagram of the hardware structure of a protective device provided in an embodiment of the present application;

[0038] FIG4 is a schematic diagram of the hardware structure of an analysis device provided in an embodiment of the present application;

[0039] FIG5 is a flow chart of a network attack detection method provided in an embodiment of the present application;

[0040] FIG6 is a schematic diagram of a flow chart of attack detection and processing performed by a protection device on network traffic according to an embodiment of the present application;

[0041] FIG7 is a schematic diagram of a flow chart of attack detection processing performed on network traffic by another protection device provided in an embodiment of the present application;

[0042] FIG8 is a schematic diagram of the interaction between an analysis device and a protective device provided in an embodiment of the present application;

[0043] FIG9 is a schematic structural diagram of a protective device provided in an embodiment of the present application;

[0044] FIG10 is a schematic structural diagram of an analysis device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0045] In order to make the objectives, technical solutions and advantages of this application clearer, the implementation methods of this application will be further described in detail below with reference to the accompanying drawings.

[0046] Protection devices are used for network security. They detect and defend against network attacks and viruses, ensuring secure data transmission. They are typically deployed between the Internet and the protected network. For example, they can be deployed at the perimeter of the protected network to protect the protected devices within it from attacks. They perform security checks on network traffic entering the protected network to determine whether it is legitimate traffic or attack traffic. Furthermore, they block attack traffic to ensure the security of the protected devices, while forwarding legitimate traffic to ensure the protected devices can provide services to legitimate clients.

[0047] Optionally, the protective equipment includes but is not limited to firewalls, security gateways (such as routers or switches), intrusion detection system (IDS) type devices, IPS type devices, unified threat management (UTM) devices, AV devices, anti-distributed denial of service attack (anti-DDoS) devices, and next-generation firewalls (NGFW) and an integration of one or more of them.

[0048] Currently, most protection devices use a detection solution based on a signature library. This solution pre-stores a signature library in the protection device, which contains a large number of known attack signatures for malicious traffic or malicious files provided by network security vendors. The protection device extracts the traffic characteristics of the network traffic reaching the protection device and compares the extracted traffic characteristics with the attack characteristics in the signature library. If the extracted traffic characteristics contain the attack characteristics in the signature library, the network traffic is determined to be attack traffic. However, when current protection devices use a signature-based detection solution, they need to perform signature-based attack detection on all received traffic. Since the number of attack characteristics in the signature library is typically in the tens of thousands, and as the size of the signature library increases (i.e., the number of attack characteristics in the signature library increases rapidly), the process of comparing traffic characteristics with attack characteristics will become a processing bottleneck for the protection device, restricting the detection efficiency of the protection device. At the same time, in order to meet the requirements of performance indicators such as resource utilization and latency, the protection device may omit some links in the above-mentioned feature comparison process under certain conditions, which will also affect the accuracy of detection.

[0049] Based on the problems existing in the related technologies, the present application provides a technical solution. In the technical solution provided by the present application, by deploying a traffic detection model in a protection device, the traffic detection model first makes a preliminary judgment on the network traffic received by the protection device. After the protection device determines that the network traffic is suspicious traffic based on the judgment result of the traffic detection model, it further performs attack detection on the network traffic based on the feature library stored in the protection device. Since most network traffic is normal traffic, the preliminary screening of network traffic by the traffic detection model can greatly reduce the number of network traffic that requires the protection device to perform attack detection based on the feature library. Since the network traffic that requires the protection device to perform attack detection based on the feature library is greatly reduced, on the one hand, the detection efficiency of the protection device is improved, and on the other hand, the protection device can allocate more processing resources for the detection of a single network traffic, so that a single network traffic can be more comprehensively detected based on the feature library, thereby improving the accuracy of the detection.

[0050] The technical solution provided by the present application is specifically as follows: the protection device receives the target network traffic. The protection device obtains the target traffic feature, which is the traffic feature of the target network traffic. The protection device inputs the target traffic feature into the target traffic detection model to obtain the target judgment result output by the target traffic detection model. The target traffic detection model is trained based on the target training sample set. The target training sample set includes multiple groups of sample traffic features, and each group of sample traffic features is marked with a normal label or an abnormal label. Among them, the sample traffic features marked with a normal label come from known normal traffic, and the sample traffic features marked with an abnormal label come from known attack traffic. The protection device determines whether the target network traffic is suspicious traffic based on the target judgment result. If the protection device determines that the target network traffic is suspicious traffic based on the target judgment result, the protection device matches the target traffic feature with the attack feature in the feature library, and determines whether the target network traffic is attack traffic or normal traffic based on the matching result. Conversely, if the protection device determines that the target network traffic is normal traffic or attack traffic based on the target determination result, the protection device terminates the detection process for the target network traffic and no longer matches the target traffic characteristics with the attack characteristics in the signature library, thereby reducing the amount of network traffic that the protection device needs to perform signature library-based attack detection. This application improves the detection efficiency and accuracy of the protection device by implementing a combined model-based and signature library-based detection solution.

[0051] Specific uses of the network attack detection method provided in this application include, but are not limited to: operating system vulnerability exploitation detection (e.g., server message block (SMB) service vulnerability detection, Apache vulnerability detection, Struts2 component vulnerability detection, etc.), application software vulnerability detection, World Wide Web (web) application intrusion detection (e.g., structured query language (SQL) injection detection, cross-site scripting (XSS) cross-site attack detection, etc.), command and control server (C&C) communication (i.e., C&C communication) detection (e.g., detection of malicious traffic such as zombies, Trojans, and worms).

[0052] The following is a detailed introduction to the technical solution of this application from multiple perspectives, including application scenarios, hardware equipment, method flow, and software devices.

[0053] The following is an example of an application scenario of the embodiment of the present application.

[0054] For example, Figure 1 is a schematic diagram of an application scenario provided by an embodiment of the present application. As shown in Figure 1, the application scenario includes a protection system, an intranet, and the Internet. The protection system includes protection equipment, which is deployed between the intranet and the Internet.

[0055] Among them, the intranet is the internal network protected by the protection device (referred to as the protected network). The protection device is used to detect attacks on the network traffic (one-way traffic or two-way traffic) between the protected network and the Internet. For example, referring to Figure 1, the protection device is used to release normal traffic from the Internet to the protected network, and to block attack traffic from the Internet to the protected network. The device located in the protected network is the protected device. Optionally, the protected device is a server for providing services to the client. For example, the protected device is an application server or a web server. Among them, application servers include but are not limited to game servers, video application servers, file servers, search engine servers, instant messaging servers, etc. A web server is also called a web server or a website server. Optionally, the protected device provides services based on the hypertext transfer protocol (HTTP) or the hypertext transfer protocol secure (HTTPs).

[0056] Optionally, there are multiple types of protected networks, including but not limited to a bank intranet, an enterprise campus network, or a campus intranet, that is, the protection device can be deployed in different network scenarios.

[0057] Optionally, please continue to refer to Figure 1. The protection system also includes an analysis device. The analysis device is, for example, a server, or a server cluster consisting of several servers, or any local / cloud module, device or system with computing power, such as a cloud platform. The analysis device is used to train the traffic detection model and provide the traffic detection model to the protection device. In the application scenario shown in Figure 1, the analysis device and the protection device are two independent devices. Alternatively, the analysis device and the protection device can also be integrated into one device.

[0058] The implementation of the network attack detection method provided in the embodiments of the present application involves the control plane and the data plane, with the data plane being, for example, a programmable data plane. The control plane is responsible for training the traffic detection model and deploying the trained traffic detection model to the data plane; the data plane is responsible for applying the traffic detection model to detect network traffic and providing model training data to the control plane. For example, Figure 2 is a schematic diagram of the interaction between the data plane and the control plane provided in the embodiments of the present application. As shown in Figure 2, the control plane includes a data collection unit and a model management unit. The data collection unit is used to collect model training data from the data plane; the model management unit is used to train the model based on the model training data collected by the data collection unit from the data plane and send the trained traffic detection model to the data plane. The data plane includes a traffic detection model and a feature library. The traffic detection model is used to perform a preliminary assessment of network traffic based on its traffic characteristics. The feature library is used to match the traffic characteristics of the network traffic, after the traffic detection model determines that the network traffic is suspicious, to perform a secondary assessment of the network traffic, thereby determining whether the network traffic is normal traffic or attack traffic. The judgment results output by feature library matching on the data plane can be reported to the control plane as model training data.

[0059] In the embodiment of the present application, the protection device is deployed with data plane functions. Optionally, the protection device is also deployed with control plane functions. Alternatively, the protection device is deployed with only data plane functions, and the analysis device is deployed with control plane functions.

[0060] Optionally, the traffic detection model in the embodiments of the present application includes but is not limited to a decision tree model, a random forest model, a Bayesian model, a convolutional neural network (CNN) model or a deep neural network (DNN) model.

[0061] The following is an illustration of the hardware devices in the embodiments of the present application.

[0062] For example, Figure 3 is a schematic diagram of the hardware structure of a protection device provided in an embodiment of the present application. As shown in Figure 3, protection device 300 includes a processor 301, a forwarding chip 302, and at least one network interface 303. Optionally, in conjunction with Figure 1, protection device 300 in Figure 3 is the protection device shown in Figure 1.

[0063] Optionally, the processor 301 includes a central processing unit (CPU) and / or a dedicated hardware chip. The CPU refers to a general-purpose CPU with high scalability and flexibility. The CPU is, for example, a single-core processor (single-CPU) or a multi-core processor (multi-CPU). The dedicated hardware chip is a high-performance processing hardware module. The dedicated hardware chip includes at least one of an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a network processor (NP).

[0064] The forwarding chip 302 is used for traffic forwarding. For example, the forwarding chip 302 is used to forward network traffic from the protection device 300 to the protected device.

[0065] At least one network interface 303 includes, for example, network interface 1, network interface 2, network interface 3, ..., network interface n in FIG3 . The network interface 303 uses any transceiver-like device for communicating with other devices or communication networks. For example, the network interface 1 in FIG3 communicates with the protected device, and the network interface 2 in FIG3 communicates with the analysis device. Optionally, the network interface 303 includes at least one of a wired network interface or a wireless network interface. The wired network interface is, for example, an Ethernet interface. The Ethernet interface is, for example, an optical interface, an electrical interface, or a combination thereof. The wireless network interface is, for example, a wireless protected network (wireless local area networks, WLAN) interface, a cellular network interface, or a combination thereof, etc.

[0066] At least one network interface 303 is connected to the forwarding chip 302, and the forwarding chip 302 is connected to the processor 301 via an internal connection 304. The internal connection 304 includes a path for transmitting data between the network interface 303, the forwarding chip 302, and the processor 301. Optionally, the internal connection 304 is a single board or a bus. For example, the internal connection 304 is Ethernet, fiber channel, PCI-E (peripheral component interconnect express, PCI Express, a high-speed serial computer bus), RapidIO (a high-performance, low-pin-count, packet-switching-based interconnect architecture), InfiniBand, or XAUI bus (an interface extender characterized by connecting the Ethernet Media Access Control (MAC) layer to the physical layer).

[0067] Optionally, protection device 300 further includes a content addressable memory (CAM) 305. CAM 305 is, for example, a ternary content addressable memory (TCAM). Optionally, CAM 305 exists independently and is connected to forwarding chip 302 via the aforementioned internal connection 304. Alternatively, CAM 305 and forwarding chip 302 are integrated, i.e., CAM 305 functions as memory within forwarding chip 302.

[0068] Optionally, the protection device 300 further includes a memory 306. The memory 306 may be, for example, a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, a random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disk storage, an optical disk storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium capable of carrying or storing the desired program code 308 in the form of instructions or data structures and accessible by a computer, but is not limited thereto. The memory 306 may be, for example, independent and connected to the processor 301 via the internal connection 304. Alternatively, the memory 306 and the processor 301 may be integrated.

[0069] An operating system 307 and program code 308 are stored in the memory 306. Optionally, the processor 301 reads the operating system 307 from the memory 306 and runs the operating system 307. The processor 301 also reads the program code 308 from the memory 306, and implements the actions performed by the protection device in the method provided in the embodiment of the present application by running the program code 308 on the operating system 307. For example, the protection device 300 is the protection device shown in Figure 1. When the CPU 301 runs the program code 308, it performs the following process: obtaining the target traffic characteristics of the target network traffic received by the protection device 300; inputting the target traffic characteristics into the target traffic detection model to obtain the target determination result output by the target traffic detection model; determining whether the target network traffic is suspicious traffic based on the target determination result; if the target network traffic is suspicious traffic, matching the target traffic characteristics with the attack characteristics in the feature library, and determining whether the target network traffic is attack traffic or normal traffic based on the matching result.

[0070] Optionally, the above-mentioned devices are respectively provided on independent chips, or at least partially or entirely provided on the same chip. Whether each device is provided independently on different chips or integrated on one or more chips often depends on the needs of product design. The embodiments of the present application do not limit the specific implementation of the above-mentioned devices.

[0071] For example, Figure 4 is a schematic diagram of the hardware structure of an analysis device provided in an embodiment of the present application. As shown in Figure 4, analysis device 400 includes a processor 401 and a memory 402, and processor 401 and memory 402 are connected via a bus 403. Figure 4 illustrates processor 401 and memory 402 as independent of each other. Optionally, processor 401 and memory 402 are integrated together. Optionally, in conjunction with Figure 1, analysis device 400 in Figure 4 is the analysis device shown in Figure 1.

[0072] Memory 402 is used to store computer programs, including operating systems and program code. Memory 402 can be any type of storage medium, such as ROM, RAM, EEPROM, CD-ROM, flash memory, optical storage, registers, optical disk storage, optical disc storage, magnetic disk, or other magnetic storage device.

[0073] The processor 401 is a general-purpose processor or a dedicated processor. The processor 401 may be a single-core processor or a multi-core processor. The processor 401 includes at least one circuit to execute the actions performed by the analysis device in the method provided in the embodiment of the present application.

[0074] Optionally, analysis device 400 also includes a network interface 404, which is connected to processor 401 and memory 402 via bus 403. Network interface 404 enables communication between analysis device 400 and the protection device. Processor 401 can interact with the protection device through network interface 404 to collect data from the protection device and provide a traffic detection model for the protection device.

[0075] Optionally, analysis device 400 further includes an input / output (I / O) interface 405, which is connected to processor 401 and memory 402 via bus 403. Processor 401 can receive input commands or data through I / O interface 405. I / O interface 405 is used to connect analysis device 400 to input devices, such as a keyboard and a mouse. Optionally, in some possible scenarios, the network interface 404 and I / O interface 405 are collectively referred to as a communication interface.

[0076] Optionally, analysis device 400 further includes a display 406, which is connected to processor 401 and memory 402 via bus 403. Display 406 can be used to display intermediate results and / or final results generated by processor 401 executing the above method. In one possible implementation, display 406 is a touch screen display to provide a human-computer interaction interface.

[0077] The bus 403 is any type of communication bus for interconnecting the internal components of the analysis device 400, such as a system bus. The embodiments of this application illustrate the example of interconnecting the aforementioned components within the analysis device 400 via the bus 403. Alternatively, the aforementioned components within the analysis device 400 may be communicatively connected to each other using other connection methods besides the bus 403, such as interconnecting the aforementioned components within the analysis device 400 via a logical interface within the analysis device 400.

[0078] The above-mentioned devices can be respectively arranged on independent chips, or at least partially or completely on the same chip. Whether each device is independently arranged on different chips or integrated on one or more chips often depends on the needs of product design. The embodiments of the present application do not limit the specific implementation form of the above-mentioned devices. The analysis device 400 shown in Figure 4 is merely exemplary. During the implementation process, the analysis device 400 includes other components, which are not listed here.

[0079] The following is an example of the method flow of the embodiment of the present application.

[0080] For example, FIG5 is a flow chart of a network attack detection method 500 provided in an embodiment of the present application. Method 500 is applied to a protection system, which includes a protection device. Optionally, the protection system also includes an analysis device. As shown in FIG5 , method 500 includes but is not limited to the following steps 501 to 505. Optionally, the protection device in method 500 is the protection device in the application scenario shown in FIG1 , which includes but is not limited to a single physical device or a distributed system comprising multiple physical devices.

[0081] Step 501: The protection device receives target network traffic.

[0082] Optionally, in the application scenario shown in Figure 1, the target network traffic is the network traffic between the protected network and the Internet flowing through the protection device, and the network traffic is sent from the Internet to the protected network or from the protected network to the Internet. In this embodiment of the present application, a network traffic includes one or more messages with the same quintuple.

[0083] Step 502: The protection device obtains target traffic characteristics, where the target traffic characteristics are traffic characteristics of the target network traffic.

[0084] Optionally, after receiving the target network traffic, the protection device caches the packets included in the target network traffic, then parses one or more packets included in the target network traffic, and obtains the target traffic characteristics from a specified field of the parsing result.

[0085] Optionally, if the protection device is used for intrusion prevention, and the designated field is the HTTP payload of one or more packets contained in the target network traffic, then the target traffic feature is data obtained from the HTTP payload field of the parsed result after the protection device performs application layer protocol parsing on the one or more packets contained in the target network traffic. Alternatively, if the protection device is used for anti-virus protection, then the target traffic feature is file data carried in the target network traffic, obtained by the protection device performing application layer protocol parsing on the one or more packets contained in the target network traffic and reassembling the HTTP payload field of the parsed result.

[0086] For example, if the target network traffic is SQL injection attack traffic, the target traffic signature is the data obtained from the HTTP payload field of the parsed result after the protection device performs application layer protocol parsing on the packets contained in the attack traffic. This data is the uniform resource locator (URL). For example, the URL (i.e., the target traffic signature) is: GET / index.php?id=123or1=1and(select top 1password from[admin]).

[0087] In one embodiment, when the target network traffic includes multiple messages, the target traffic feature is data obtained from a specified field of the parsing result after the protection device performs protocol parsing on one of the multiple messages included in the target network traffic. Alternatively, the target traffic feature is data obtained from a specified field of the parsing result after the protection device performs protocol parsing on at least two of the multiple messages included in the target network traffic. In other words, the target traffic feature is composed of a combination of data from the specified fields of the parsing results of at least two of the multiple messages included in the target network traffic, which is not limited in this embodiment of the present application.

[0088] Step 503: The protection device inputs the target flow characteristics into the target flow detection model to obtain the target determination result output by the target flow detection model.

[0089] The target traffic detection model is trained based on a target training sample set. The target training sample set includes multiple sets of sample traffic features. Each set of sample traffic features is labeled with either a normal label or an abnormal label. Sample traffic features labeled with a normal label are derived from known normal traffic. Sample traffic features labeled with an abnormal label are derived from known attack traffic. It should be understood that the target traffic detection model is pre-stored (loaded) in the protection device.

[0090] Optionally, the protection device uses Word2Vec (word to vector, a tool for converting words into vectors) to convert the target traffic features in text form into word vectors and then input them into the target traffic detection model.

[0091] The target flow detection model in the embodiment of the present application is a classification model trained using a machine learning algorithm. Optionally, the determination results output by the target flow detection model have multiple forms, such as a determination result that only includes the predicted category, or a determination result that includes the predicted category and the confidence level. Confidence refers to the accuracy or reliability of the model's prediction of given data. Confidence is usually expressed in the form of probability or score. The higher the confidence, the more reliable the prediction result. The confidence level usually ranges from 0 to 1.

[0092] In the first possible implementation, the target traffic detection model outputs a determination result that only includes the predicted category. The determination result output by the target traffic detection model indicates normal or abnormal. In other words, in this implementation, the determination result output by the target traffic detection model only has two possible cases: normal or abnormal.

[0093] In the second possible implementation, the target traffic detection model outputs a judgment result that only includes the predicted category. The judgment result output by the target traffic detection model indicates normal, abnormal, or suspicious. In this implementation, the judgment result output by the target traffic detection model includes the three possible categories: normal, abnormal, and suspicious. If the judgment result output by the target traffic detection model indicates suspicious, it indicates that the target traffic detection model cannot accurately predict and classify the input traffic characteristics.

[0094] Optionally, if the confidence level of the target flow detection model's prediction result for the input flow characteristics reaches a confidence threshold, the target flow detection model outputs a determination result that is the prediction result. If the confidence level of the target flow detection model's prediction result for the input flow characteristics is lower than the confidence threshold, the target flow detection model outputs a determination result indicating suspiciousness. The prediction result indicates normal or abnormality.

[0095] In a third possible implementation, the target flow detection model outputs a determination result including a predicted category and a confidence level. The determination result output by the target flow detection model indicates normal or abnormal, and the determination result also includes a confidence level. Optionally, the determination result output by the target flow detection model is expressed as {normal, confidence level} or {abnormal, confidence level}.

[0096] Step 504: The protection device determines whether the target network traffic is suspicious traffic based on the target determination result.

[0097] In combination with the first possible implementation of step 503, the implementation of step 504 is as follows: if the target determination result indicates abnormality, the protection device determines that the target network traffic is suspicious traffic. If the target determination result indicates normality, the protection device determines that the target network traffic is normal traffic.

[0098] In this implementation, the target traffic detection model primarily filters normal traffic. The protection device directly passes network traffic that the target traffic detection model identifies as normal. However, the protection device further performs signature-based attack detection on network traffic identified as abnormal by the target traffic detection model. Because the protection device does not need to perform signature-based attack detection on network traffic identified as normal by the target traffic detection model, the amount of network traffic that requires subsequent signature-based attack detection is significantly reduced, thereby improving the protection device's detection efficiency.

[0099] In conjunction with the second possible implementation of step 503, step 504 can be implemented as follows: if the target determination result indicates suspicious, the protection device determines the target network traffic as suspicious traffic. If the target determination result indicates abnormal, the protection device determines the target network traffic as attack traffic. If the target determination result indicates normal, the protection device determines the target network traffic as normal traffic.

[0100] In this implementation mode, the target traffic detection model is used to filter normal traffic in the network and also to identify attack traffic in the network. For network traffic that the target traffic detection model determines to be normal, the protection device directly releases it; for network traffic that the target traffic detection model determines to be abnormal (i.e., attack traffic), the protection device directly intercepts it; for network traffic that the target traffic detection model determines to be suspicious, the protection device further performs attack detection based on the feature library. Since the protection device does not need to perform attack detection based on the feature library for network traffic that the target traffic detection model determines to be normal and network traffic that is determined to be abnormal, the number of network traffic that the protection device needs to perform attack detection based on the feature library is greatly reduced, thereby improving the detection efficiency of the protection device. In addition, since the target traffic detection model has the ability to identify attack traffic, it is possible to identify malicious traffic or unknown malicious traffic that attempts to evade detection through deformation, thereby improving the detection effect of the protection device.

[0101] In conjunction with the third possible implementation of step 503, step 504 is implemented as follows: if the confidence level in the target determination result is lower than the confidence threshold, the protection device determines that the target network traffic is suspicious traffic. If the target determination result indicates abnormality and the confidence level in the target determination result reaches the confidence threshold, the protection device determines that the target network traffic is attack traffic. If the target determination result indicates normality and the confidence level in the target determination result reaches the confidence threshold, the protection device determines that the target network traffic is normal traffic.

[0102] If the target determination result indicates anomaly and the confidence level in the target determination result reaches the confidence threshold, it indicates a high degree of confidence that the target network traffic is attack traffic. Similarly, if the target determination result indicates normal and the confidence level in the target determination result reaches the confidence threshold, it indicates a high degree of confidence that the target network traffic is normal traffic. If the confidence level in the target determination result is lower than the confidence threshold, it indicates that the target traffic detection model cannot accurately classify the target network traffic. In this case, the protection device will classify the target network traffic as suspicious traffic. This traffic identification method is highly reliable.

[0103] In this implementation mode, the target traffic detection model can be used to filter normal traffic in the network, and can also be used to identify attack traffic in the network. For network traffic that the protection device determines to be normal traffic based on the judgment results of the target traffic detection model, the protection device directly releases it; for network traffic that the protection device determines to be attack traffic based on the judgment results of the target traffic detection model, the protection device directly intercepts it; for network traffic that the protection device determines to be suspicious traffic based on the judgment results of the target traffic detection model, the protection device further performs attack detection based on the feature library. Since the protection device does not need to perform attack detection based on the feature library for the attack traffic and normal traffic determined based on the target traffic detection model, the number of network traffic that the protection device needs to perform attack detection based on the feature library is greatly reduced, thereby improving the detection efficiency of the protection device. In addition, since the target traffic detection model has the ability to identify attack traffic, it is possible to identify malicious traffic or unknown malicious traffic that attempts to evade detection through deformation, thereby improving the detection effect of the protection device.

[0104] Step 505: If the target network traffic is suspicious traffic, the protection device matches the target traffic characteristics with the attack characteristics in the feature library, and determines whether the target network traffic is attack traffic or normal traffic based on the matching result.

[0105] It should be understood that the feature library is pre-stored (loaded) in the protection device. Optionally, the feature library contains multiple attack features, which are extracted based on a large amount of known malicious traffic or malicious files provided by network security vendors.

[0106] In one embodiment, the protection device matches target traffic characteristics with attack characteristics in a signature library by determining whether the target traffic characteristics contain attack characteristics in the signature library. Specifically, the protection device compares the target traffic characteristics with each attack characteristic in the signature library. If the target traffic characteristics contain an attack characteristic in the signature library, the attack characteristic is recorded, thereby obtaining a matching result. The matching result includes the matching attack characteristics, i.e., the attack characteristics contained in both the target traffic characteristics and the signature library. Based on the matching attack characteristics and an attack identification strategy, the protection device determines whether the target network traffic is attack traffic. There are many attack identification strategies, which are difficult to list here. Here are two examples to illustrate: For example, the protection device determines that the target network traffic is offensive when the number of matching attack characteristics exceeds a set threshold; or the protection device determines that the target network traffic is offensive when the sequence of matching attack characteristics meets a predetermined matching rule. Attack identification strategies also include strategies defined based on similarity, probability, regularization, and other dimensions. The specific attack identification strategy is selected based on actual needs and is not limited in this embodiment of the present application. If the above matching result is empty, that is, the target traffic feature does not contain the attack feature in the feature library, the protection device determines that the target network traffic is normal traffic.

[0107] In the above embodiments, the protection device matches the target traffic features with the attack features in the feature library and determines whether the target network traffic is attack traffic based on the matching results. This is called a detection method based on feature matching.

[0108] For the sake of simplicity, the simplest attack discrimination strategy is adopted in the embodiment of the present application, that is, when the number of attack features in the match is greater than or equal to 1, the protection device determines that the target network traffic is offensive. Combined with the example in step 502 above, the target traffic feature is the URL obtained by the above analysis: GET / index.php? id=123or 1=1and(select top 1password from[admin]). The protection device matches the URL with the attack features in the feature library. Assuming that the attack features in the feature library include "1=1" (of course, the feature library may also include other attack features), it means that the target traffic feature includes the attack feature "1=1" in the feature library, and the protection device further determines that the target network traffic is attack traffic.

[0109] Furthermore, if, in step 504 or step 505, the protection device determines that the target network traffic is normal traffic, the protection device allows the target network traffic to pass. Alternatively, if, in step 504 or step 505, the protection device determines that the target network traffic is attack traffic, the protection device intercepts the target network traffic and discards the locally cached packets contained in the target network traffic. When the protection device intercepts the target network traffic, it stops forwarding packets in the target network traffic.

[0110] Optionally, after determining that the target network traffic is attack traffic, the protection device outputs an alarm message through an output device. The alarm message includes a traffic identifier (e.g., a five-tuple) of the target network traffic for easy viewing by operation and maintenance personnel. In one embodiment, after determining that the target network traffic is attack traffic, the protection device first outputs an alarm message through an output device. After receiving an instruction to intercept the target network traffic, the protection device then intercepts the target network traffic.

[0111] In an optional embodiment of the present application, the protection device determines whether the network traffic is normal traffic or suspicious traffic based on the judgment result output by the traffic detection model (corresponding to the first possible implementation method in the above steps 503 and 504). For example, Figure 6 is a flow chart of a protection device provided in an embodiment of the present application performing attack detection processing on network traffic. As shown in Figure 6, the protection device first extracts traffic features from the received network traffic, and then inputs the traffic features of the network traffic into the traffic detection model. If the protection device determines that the network traffic is normal traffic based on the judgment result of the traffic detection model, the network traffic is released. If the protection device determines that the network traffic is suspicious traffic based on the judgment result of the traffic detection model, the traffic features of the network traffic are further matched with the attack features in the feature library. If the protection device determines that the network traffic is normal traffic based on the matching result, the network traffic is released. If the protection device determines that the network traffic is attack traffic based on the matching result, the network traffic is intercepted.

[0112] In another optional embodiment of the present application, the protection device determines whether network traffic is normal traffic, attack traffic, or suspicious traffic based on the determination result output by the traffic detection model (corresponding to the second possible implementation or the third possible implementation in steps 503 and 504 above). For example, FIG7 is a schematic diagram of a process flow for another protection device performing attack detection processing on network traffic provided by an embodiment of the present application. As shown in FIG7, the protection device first extracts traffic features from the received network traffic and then inputs the traffic features of the network traffic into the traffic detection model. If the protection device determines that the network traffic is normal traffic based on the determination result of the traffic detection model, the protection device allows the network traffic to pass. If the protection device determines that the network traffic is attack traffic based on the determination result of the traffic detection model, the protection device intercepts the network traffic. If the protection device determines that the network traffic is suspicious traffic based on the determination result of the traffic detection model, the protection device further matches the traffic features of the network traffic with the attack features in the feature library. If the protection device determines that the network traffic is normal traffic based on the matching result, the protection device allows the network traffic to pass. If the protection device determines that the network traffic is attack traffic based on the matching result, the protection device intercepts the network traffic.

[0113] In the network attack detection method provided in the embodiment of the present application, by deploying a flow detection model in the protection device, the flow detection model first performs a preliminary judgment on the network traffic received by the protection device. After the protection device determines that the network traffic is suspicious traffic based on the judgment result of the flow detection model, it further performs attack detection on the network traffic based on the feature library stored in the protection device. Since most network traffic is normal traffic, the preliminary screening of network traffic by the flow detection model can greatly reduce the number of network traffic that requires the protection device to perform attack detection based on the feature library. Since the network traffic that requires the protection device to perform attack detection based on the feature library is greatly reduced, on the one hand, the detection efficiency of the protection device is improved, and on the other hand, the protection device can allocate more processing resources for the detection of a single network traffic, so that a single network traffic can be more comprehensively detected based on the feature library, thereby improving the accuracy of the detection. In addition, since the attack features contained in the feature library are extracted based on known (or common) malicious traffic or malicious files, the detection solution based on the feature library is not effective for detecting unknown malicious traffic or malicious files. The embodiment of the present application uses a combined model detection solution and a feature library detection method. When the traffic detection model has the ability to identify attack traffic, the traffic detection model may also identify malicious traffic or unknown malicious traffic that attempts to evade detection through deformation, thereby improving the detection effect of the protection equipment.

[0114] Optionally, the target traffic detection model is sent from the analysis device to the protection device. For example, after the protection device is online, the analysis device sends the target traffic detection model to the protection device.

[0115] In one embodiment, a plurality of traffic detection models corresponding to a variety of network scenarios are stored in the analysis device. The analysis device obtains a target traffic detection model corresponding to the target network scenario from the multiple traffic detection models based on the target network scenario currently deployed by the protection device, and the target network scenario is any network scenario among the multiple network scenarios. The analysis device sends the target traffic detection model to the protection device. Optionally, the network scenarios are divided according to the type of internal network protected by the protection device, such as bank intranet, enterprise park network and campus intranet, etc., which are different network scenarios. Alternatively, the network scenarios are divided according to the type of services provided by the internal network protected by the protection device, such as game services, video services, file services, etc., which are different network scenarios. The embodiment of the present application does not limit the way of dividing network scenarios.

[0116] Optionally, the analysis device trains a universal traffic detection model based on a universal training sample set. The universal training sample set includes multiple sets of sample traffic features. The universal training sample set is derived from network traffic in various network scenarios. That is, the sample traffic features in the communication training sample set are derived from network traffic in various network scenarios. The analysis device obtains a target training sample set corresponding to a target network scenario. The target training sample set is derived from network traffic in the target network scenario. The analysis device uses the target training sample set to train the universal traffic detection model to obtain the target traffic detection model.

[0117] In this embodiment, the analysis device collects known normal and attack traffic from various network scenarios, extracts traffic features from a large number of known network traffic flows as sample traffic features, and then generalizes and trains a generalized traffic detection model. The analysis device then fine-tunes this generalized traffic detection model based on the network scenarios in which the protection device is actually deployed, using sample traffic features from network traffic in those scenarios. This fine-tunes the resulting traffic detection model, making it more suitable for the current network scenario and thereby improving the detection accuracy of the traffic detection model.

[0118] Optionally, the protection device generates new sample traffic features based on the traffic determination results obtained by matching the feature library, which are used to regularly update the target traffic detection model to further improve the accuracy of the traffic detection model. Specifically, the protection device matches the target traffic features with the attack features in the feature library, and after determining whether the target network traffic is attack traffic or normal traffic (i.e., executing the above step 505), the protection device labels the target traffic features and uses the labeled target traffic features as a new set of sample traffic features, which are used to update the target traffic detection model.

[0119] In one implementation, an analysis device updates a target traffic detection model on a protection device. The analysis device uses network telemetry technology to collect new sample traffic features from the protection device in real time and adds the new sample traffic features to a target training sample set. The analysis device periodically trains the target traffic detection model using the latest target training sample set to obtain an updated target traffic detection model. The analysis device sends the updated target traffic detection model to the protection device. The protection device replaces the local target traffic detection model with the updated target traffic detection model.

[0120] Optionally, the analysis device uses network telemetry technology to collect new sample traffic features from the protection device in real time. The analysis device sends a subscription request to the protection device, subscribing to the sample traffic features generated on the protection device. In response to the subscription request, the protection device periodically pushes the sample traffic features generated within the current period to the analysis device. Optionally, the subscription request also includes a collection frequency, and the protection device determines the push period based on this collection frequency. For example, the control plane functions shown in Figure 2 are deployed on the analysis device, and the data plane functions are deployed on the protection device. Figure 8 is a schematic diagram of the interaction between the analysis device and the protection device according to an embodiment of the present application. As shown in Figure 8, the analysis device includes a data collection unit and a model management unit. The data collection unit has network telemetry and data storage functions. The data collection unit collects sample traffic features from the protection device via network telemetry. The specific implementation process includes: sending a subscription request to the protection device to subscribe to the sample traffic features generated on the protection device; receiving the subscription result reported by the protection device; and unpacking the subscription result to obtain the sample traffic features. The data collection unit then stores the sample traffic features locally, such as in a local time series database. The model management unit retrains the model based on the sample traffic features collected by the data collection unit from the protection device to obtain an updated traffic detection model (to achieve model upgrade), and then sends the updated traffic detection model to the protection device. The protection device includes a traffic detection model and a feature library. After receiving the network traffic, the protection device first pre-processes the network traffic, including parsing the network traffic and extracting the traffic features of the network traffic. Then, based on the traffic detection model, a judgment is made on the network traffic according to the traffic features of the network traffic. If the judgment result based on the traffic detection model determines that the network traffic is suspicious traffic, the traffic features of the network traffic are matched based on the feature library to make a secondary judgment on the network traffic, thereby determining whether the network traffic is normal traffic or attack traffic. The protection device generates sample traffic features based on the judgment result determined based on the feature library match, and pushes them to the analysis device.

[0121] In an embodiment of the present application, the analysis device uses network telemetry technology to collect sample traffic characteristics from the protection device. By simply sending a subscription request to the protection device once, the protection device can periodically push the sample traffic characteristics to the analysis device, which consumes less processing power of the analysis device. Alternatively, the analysis device uses the simple network management protocol (SNMP) to collect sample traffic characteristics from the protection device. The embodiment of the present application does not limit the implementation method of the analysis device collecting data from the protection device.

[0122] Optionally, the model update cycle is one day, one week, or two weeks, and the embodiment of the present application does not limit the model update cycle. In the above scheme, the analysis device adds the sample traffic features generated by the protection device to the original training sample set, and uses the sample traffic features generated by the protection device and the original training sample set together to update the traffic detection model on the protection device. Alternatively, the analysis device only uses the sample traffic features generated by the protection device in the current cycle to update the traffic detection model on the protection device, or the analysis device uses all sample traffic features generated by the protection device in the historical cycle to update the traffic detection model on the protection device.

[0123] Another implementation method is for the protection device to automatically update the target traffic detection model. The protection device periodically uses new sample traffic features generated by the protection device to train the local target traffic detection model, obtain an updated target traffic detection model, and then replace the local target traffic detection model with the updated target traffic detection model.

[0124] Optionally, the protection device only uses the sample traffic features generated by the protection device in the current cycle to update the traffic detection model on the protection device, or the protection device uses all sample traffic features generated by the protection device in the historical cycle to update the traffic detection model on the protection device.

[0125] The order of the steps of the above-mentioned network attack detection method provided in the embodiment of the present application can be adjusted appropriately, and the steps can also be increased or decreased accordingly according to the circumstances. Any technical personnel familiar with the technical field can easily think of a method of change within the technical scope disclosed in this application, and all of them should be covered by the protection scope of this application. For example, the analysis device further updates the general flow detection model based on the sample flow characteristics generated by the protection device and / or the updated flow detection model on the protection device, and then updates the flow detection models corresponding to multiple network scenarios based on the updated general flow detection model, thereby improving the accuracy of the model by continuously enriching the training samples of the model. In one embodiment, the flow detection model on the protection device is iteratively updated in a small period, and the general flow detection model on the analysis device and the flow detection models corresponding to various network scenarios are iteratively updated in a large period.

[0126] The following describes the virtual device in the embodiment of the present application by way of example.

[0127] For example, FIG9 is a schematic diagram of the structure of a protection device 900 provided in an embodiment of the present application. The protection device 900 having the structure shown in FIG9 is used to implement the method 500 described in the above embodiment. Optionally, the protection device 900 shown in FIG9 is the protection device in FIG1 . As shown in FIG9 , the protection device 900 includes but is not limited to a transceiver module 901, a feature extraction module 902, a first determination module 903, and a second determination module 904. Optionally, please continue to refer to FIG9 , the protection device 900 also includes a sample generation module 905 and / or a model update module 906.

[0128] The transceiver module 901 is used to receive target network traffic. The feature extraction module 902 is used to obtain target traffic features, which are traffic features of the target network traffic. The first judgment module 903 is used to input the target traffic features into the target traffic detection model, obtain the target judgment result output by the target traffic detection model, and determine whether the target network traffic is suspicious traffic based on the target judgment result. The target traffic detection model is trained based on the target training sample set. The target training sample set includes multiple groups of sample traffic features, each group of sample traffic features is marked with a normal label or an abnormal label, and the sample traffic features marked with a normal label are from known normal traffic, and the sample traffic features marked with an abnormal label are from known attack traffic. The second judgment module 904 is used to match the target traffic features with the attack features in the feature library if the target network traffic is suspicious traffic, and determine whether the target network traffic is attack traffic or normal traffic based on the matching result.

[0129] Here, please refer to the description in the previous method embodiment for the implementation process of the transceiver module 901, the feature extraction module 902, the first determination module 903, and the second determination module 904. For example, the transceiver module 901 receives the target network traffic using step 501 in method 500. The feature extraction module 902 obtains the target traffic characteristics using step 502 in method 500. The first determination module 903 determines whether the target network traffic is suspicious traffic using steps 503 and 504 in method 500. The second determination module 904 matches the target traffic characteristics with the attack characteristics in the feature library using step 505 in method 500, and determines whether the target network traffic is attack traffic or normal traffic based on the matching results. The embodiments of this application will not be repeated here.

[0130] Optionally, the determination result output by the target traffic detection model indicates normal or abnormal. The first determination module 903 is specifically used to: if the target determination result indicates abnormal, determine that the target network traffic is suspicious traffic; if the target determination result indicates normal, determine that the target network traffic is normal traffic.

[0131] Alternatively, the determination result output by the target traffic detection model indicates normal, abnormal or suspicious. The first determination module 903 is specifically used to: if the target determination result indicates suspicious, determine that the target network traffic is suspicious traffic; if the target determination result indicates abnormal, determine that the target network traffic is attack traffic; if the target determination result indicates normal, determine that the target network traffic is normal traffic.

[0132] Optionally, if the confidence level of the target flow detection model's prediction result for the input flow characteristics reaches a confidence threshold, the target flow detection model outputs a judgment result as a prediction result. If the confidence level of the target flow detection model's prediction result for the input flow characteristics is lower than the confidence threshold, the target flow detection model outputs a judgment result indicating suspiciousness; wherein the prediction result indicates normal or abnormality.

[0133] Alternatively, the determination result output by the target traffic detection model indicates normal or abnormal, and the determination result also includes confidence. The first determination module 903 is specifically used to: if the confidence in the target determination result is lower than the confidence threshold, determine that the target network traffic is suspicious traffic; if the target determination result indicates abnormality, and the confidence in the target determination result reaches the confidence threshold, determine that the target network traffic is attack traffic; if the target determination result indicates normal, and the confidence in the target determination result reaches the confidence threshold, determine that the target network traffic is normal traffic.

[0134] Optionally, the sample generation module 905 is used to match the target traffic features with the attack features in the feature library, determine whether the target network traffic is attack traffic or normal traffic based on the matching results, label the target traffic features, and use the labeled target traffic features as a set of new sample traffic features, which are used to update the target traffic detection model.

[0135] Optionally, the model update module 906 is used to periodically use new sample traffic features generated by the protection device to train the local target traffic detection model, obtain an updated target traffic detection model, and replace the local target traffic detection model with the updated target traffic detection model.

[0136] Optionally, the transceiver module 901 is further configured to allow the target network traffic to pass if the target network traffic is normal traffic; and to intercept the target network traffic if the target network traffic is attack traffic.

[0137] The device embodiment described in FIG9 is merely schematic. For example, the division of the modules is merely a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. The functional modules in the various embodiments of the present application may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module. The above-mentioned modules in FIG9 may be implemented in the form of hardware or in the form of software functional units. For example, when implemented in software, the above-mentioned feature extraction module 902, the first determination module 903, the second determination module 904, the sample generation module 905 and the model update module 906 may be implemented by software functional modules generated by the processor 301 in FIG3 after reading the program code stored in the memory 306. The above modules in FIG9 can also be implemented by different hardware of the protection device. For example, the feature extraction module 902, the first determination module 903, the second determination module 904, the sample generation module 905, and the model update module 906 are implemented by a portion of the processing resources in the processor 301 in FIG3 (for example, one core in a multi-core processor), while the transceiver module 901 is implemented by the network interface 303 in FIG3 and the remaining processing resources in the processor 301 (for example, other cores in a multi-core processor). Obviously, the above functional modules can also be implemented in a combination of software and hardware. For example, the transceiver module 901 is implemented by a hardware programmable device, while the feature extraction module 902, the first determination module 903, the second determination module 904, the sample generation module 905, and the model update module 906 are software functional modules generated by the processor after reading the program instructions stored in the memory.

[0138] For example, Figure 10 is a schematic diagram of the structure of an analysis device 1000 provided in an embodiment of the present application. The analysis device 1000 having the structure shown in Figure 10 is used to implement the actions performed by the analysis device in the above-mentioned embodiment. Optionally, the analysis device 1000 shown in Figure 10 is the analysis device in Figure 1. As shown in Figure 10, the analysis device 1000 includes but is not limited to a model acquisition module 1001 and a transceiver module 1002. Optionally, please continue to refer to Figure 10, the analysis device 1000 also includes one or more of a model generation module 1003, a data acquisition module 1004, or a model update module 1005.

[0139] Model acquisition module 1001 is used to obtain a target traffic detection model corresponding to the target network scenario currently deployed by the protection device from multiple traffic detection models. The analysis device stores multiple traffic detection models corresponding to the multiple network scenarios. The target network scenario is any one of the multiple network scenarios. The target traffic detection model is trained based on a target training sample set. The target training sample set includes multiple groups of sample traffic features, each group of sample traffic features is labeled with a normal label or an abnormal label. The sample traffic features labeled with a normal label are derived from known normal traffic, and the sample traffic features labeled with an abnormal label are derived from known attack traffic. Transceiver module 1002 is used to send the target traffic detection model to the protection device.

[0140] Optionally, the model generation module 1003 is used to: obtain a general traffic detection model based on a general training sample set, the general training sample set includes multiple groups of sample traffic features, and the general training sample set is obtained based on network traffic in multiple network scenarios; obtain a target training sample set corresponding to the target network scenario, and the target training sample set is obtained based on network traffic in the target network scenario; use the target training sample set to train the general traffic detection model to obtain a target traffic detection model.

[0141] Optionally, the data acquisition module 1004 is configured to use network telemetry technology to collect new sample traffic features from the protection device in real time and add the new sample traffic features to the target training sample set. The model update module 1005 is configured to periodically train the target traffic detection model using the latest target training sample set to obtain an updated target traffic detection model. The transceiver module 1002 is further configured to transmit the updated target traffic detection model to the protection device.

[0142] The device embodiment described in FIG10 is merely illustrative. For example, the division of the modules is merely a logical functional division. In actual implementation, there may be other division methods, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. The functional modules in the various embodiments of the present application can be integrated into a processing module, or each module can exist physically separately, or two or more modules can be integrated into a single module. The above-mentioned modules in FIG10 can be implemented in the form of hardware, or in the form of software functional units, or in a combination of software and hardware.

[0143] The present application also provides a protection device comprising a memory, a network interface, and at least one processor. The memory is configured to store program instructions, and the at least one processor reads the program instructions stored in the memory, thereby causing the protection device to execute the actions performed by the protection device in the above-described method embodiment. Optionally, the hardware structure of the protection device is shown in Figure 3.

[0144] The present application also provides an analysis device comprising a memory, a network interface, and at least one processor. The memory is configured to store program instructions, and the at least one processor reads the program instructions stored in the memory, thereby causing the analysis device to perform the actions performed by the analysis device in the above-described method embodiment. Optionally, the hardware structure of the analysis device is shown in Figure 4.

[0145] The present application also provides a protection system including a protection device. The protection device is configured to perform the actions performed by the protection device in the above method embodiment. Optionally, the protection system further includes an analysis device configured to perform the actions performed by the analysis device in the above method embodiment. Optionally, the structure of the protection system is illustrated in, for example, FIG1 .

[0146] An embodiment of the present application further provides a computer-readable storage medium having instructions stored thereon. When the instructions are executed by a processor, the actions performed by the protective device or the analysis device in the above method embodiment are implemented.

[0147] An embodiment of the present application further provides a computer program product, including a computer program. When the computer program is executed by a processor, the computer program implements the actions performed by the protective device or the analysis device in the above method embodiment.

[0148] In the embodiments of this application, the term traffic is also referred to as network traffic or data traffic. Traffic refers to the data transmitted over a network at a given point in time. For example, the traffic received by a device at time point T refers to all messages received by the device at time point T.

[0149] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0150] In the description of the embodiments of the present application, unless otherwise specified, "at least one" means one or more, and "a plurality of" means two or more.

[0151] A refers to B, which means that A is the same as B or A is a simple variant of B.

[0152] In this application, the term "and / or" simply describes a relationship between related objects, indicating the existence of three relationships. For example, A and / or B means: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the character " / " in this document generally indicates that the related objects are in an "or" relationship.

[0153] Optionally, in the above embodiments, all or part of the embodiments are implemented by software, hardware, firmware, or any combination thereof. Optionally, when implemented using software, all or part of the embodiments are implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. Optionally, the computer is a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Optionally, the computer instructions are stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. Optionally, the computer-readable storage medium is any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media integrated therein. Alternatively, the available medium is a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a digital video disk (DVD)), or a semiconductor medium (eg, a solid state disk (SSD)).

[0154] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the above embodiments, ordinary technicians in this field should understand that they can still modify the technical solutions recorded in the above embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A network attack detection method, characterized in that: The method is applied to a protection system, the protection system including a protection device, and the method includes: The protection device receives target network traffic; The protection device obtains a target traffic feature, where the target traffic feature is a traffic feature of the target network traffic; The protection device inputs the target traffic feature into the target traffic detection model to obtain a target determination result output by the target traffic detection model, wherein the target traffic detection model is trained based on a target training sample set, wherein the target training sample set includes multiple groups of sample traffic features, each group of sample traffic features is respectively marked with a normal label or an abnormal label, the sample traffic features marked with the normal label are from known normal traffic, and the sample traffic features marked with the abnormal label are from known attack traffic; The protection device determines whether the target network traffic is suspicious traffic according to the target determination result; If the target network traffic is suspicious traffic, the protection device matches the target traffic feature with the attack feature in the feature library, and determines whether the target network traffic is attack traffic or normal traffic based on the matching result.

2. The method according to claim 1, characterized in that The determination result output by the target traffic detection model indicates normal or abnormal, and the protection device determines whether the target network traffic is suspicious traffic according to the target determination result, including: If the target determination result indicates an abnormality, the protection device determines that the target network traffic is suspicious traffic; If the target determination result indicates normal, the protection device determines that the target network traffic is normal traffic.

3. The method according to claim 1, characterized in that The target traffic detection model outputs a determination result indicating normal, abnormal, or suspicious, and the protection device determines whether the target network traffic is suspicious traffic based on the target determination result, including: If the target determination result indicates suspiciousness, the protection device determines that the target network traffic is suspicious traffic; If the target determination result indicates an abnormality, the protection device determines that the target network traffic is attack traffic; If the target determination result indicates normal, the protection device determines that the target network traffic is normal traffic.

4. The method according to claim 3, characterized in that If the confidence level of the prediction result of the target flow detection model for the input flow characteristics reaches a confidence threshold, the determination result output by the target flow detection model is the prediction result; If the confidence level of the prediction result of the target flow detection model for the input flow characteristics is lower than the confidence threshold, the determination result output by the target flow detection model indicates suspiciousness; wherein the prediction result indicates normal or abnormality.

5. The method according to claim 1, wherein The target traffic detection model outputs a determination result indicating normality or abnormality, wherein the determination result further includes a confidence level. The protection device determines whether the target network traffic is suspicious traffic based on the target determination result, including: If the confidence level in the target determination result is lower than the confidence level threshold, the protection device determines that the target network traffic is suspicious traffic; If the target determination result indicates an abnormality and the confidence level in the target determination result reaches the confidence threshold, the protection device determines that the target network traffic is attack traffic; If the target determination result indicates normal, and the confidence level in the target determination result reaches the confidence level threshold, the protection device determines that the target network traffic is normal traffic.

6. The method according to any one of claims 1 to 5, characterized in that: The protection system further includes an analysis device, wherein the analysis device stores a plurality of traffic detection models corresponding to a plurality of network scenarios. The method further includes: The analysis device acquires, according to the target network scenario currently deployed by the protection device, the target traffic detection model corresponding to the target network scenario from the multiple traffic detection models, where the target network scenario is any one of the multiple network scenarios; The analysis device sends the target traffic detection model to the protection device.

7. The method according to claim 6, characterized in that The method further comprises: The analysis device obtains a general flow detection model based on a general training sample set, and the general training sample set includes multiple groups of samples. Traffic characteristics, the general training sample set is obtained based on the network traffic in the multiple network scenarios; The analysis device obtains the target training sample set corresponding to the target network scenario, where the target training sample set is obtained based on network traffic in the target network scenario; The analysis device uses the target training sample set to train the general flow detection model to obtain the target flow detection model.

8. The method according to claim 6 or 7, characterized in that After the protection device matches the target traffic feature with the attack feature in the feature library and determines, based on the matching result, that the target network traffic is attack traffic or normal traffic, the method further includes: The protection device labels the target traffic features and uses the labeled target traffic features as a set of new sample traffic features. The new sample traffic features are used to update the target traffic detection model.

9. The method according to claim 8, characterized in that The method further comprises: The analysis device uses network telemetry technology to collect the new sample traffic features from the protection device in real time, and adds the new sample traffic features to the target training sample set; The analysis device periodically uses the latest target training sample set to train the target flow detection model to obtain an updated target flow detection model; The analysis device sends the updated target traffic detection model to the protection device; The protection device replaces the local target flow detection model with the updated target flow detection model.

10. The method according to claim 8, characterized in that The method further comprises: The protection device periodically uses the new sample traffic features generated by the protection device to train a local target traffic detection model to obtain an updated target traffic detection model, and replaces the local target traffic detection model with the updated target traffic detection model.

11. The method according to any one of claims 1 to 10, characterized in that: The method further comprises: If the target network traffic is normal traffic, the protection device allows the target network traffic to pass; If the target network traffic is attack traffic, the protection device intercepts the target network traffic.

12. A protective device, characterized in that: include: memory, a network interface, and at least one processor, The memory is used to store program instructions, After the at least one processor reads the program instructions stored in the memory, the protection device is caused to perform the following operations: Receive target network traffic; Acquire target traffic characteristics, where the target traffic characteristics are traffic characteristics of the target network traffic; Inputting the target traffic feature into a target traffic detection model to obtain a target determination result output by the target traffic detection model, wherein the target traffic detection model is trained based on a target training sample set, wherein the target training sample set includes multiple groups of sample traffic features, each group of sample traffic features is respectively marked with a normal label or an abnormal label, the sample traffic features marked with the normal label are from known normal traffic, and the sample traffic features marked with the abnormal label are from known attack traffic; Determine whether the target network traffic is suspicious traffic according to the target determination result; If the target network traffic is suspicious traffic, the target traffic feature is matched with the attack feature in the feature library, and based on the matching result, it is determined whether the target network traffic is attack traffic or normal traffic.

13. The protective device according to claim 12, characterized in that The determination result output by the target flow detection model indicates normal or abnormal, and after the program instructions are read by the at least one processor, the protection device performs the following operations: If the target determination result indicates an abnormality, determining the target network traffic as suspicious traffic; If the target determination result indicates normal, the target network traffic is determined to be normal traffic.

14. The protective device according to claim 12, characterized in that The determination result output by the target traffic detection model indicates normal, abnormal, or suspicious, and after the program instructions are read by the at least one processor, the protection device performs the following operations: If the target determination result indicates suspiciousness, determining the target network traffic as suspicious traffic; If the target determination result indicates an abnormality, determining that the target network traffic is attack traffic; If the target determination result indicates normal, the target network traffic is determined to be normal traffic.

15. The protective device according to claim 14, characterized in that If the confidence level of the prediction result of the target flow detection model for the input flow characteristics reaches a confidence threshold, the determination result output by the target flow detection model is the prediction result; If the confidence level of the prediction result of the target flow detection model for the input flow characteristics is lower than the confidence threshold, the determination result output by the target flow detection model indicates suspiciousness; wherein the prediction result indicates normal or abnormality.

16. The protective device according to claim 12, characterized in that The determination result output by the target flow detection model indicates normal or abnormal, and the determination result also includes a confidence level. After the program instructions are read by the at least one processor, the protection device performs the following operations: If the confidence level in the target determination result is lower than the confidence threshold, determining that the target network traffic is suspicious traffic; If the target determination result indicates an abnormality and the confidence level in the target determination result reaches the confidence level threshold, determining that the target network traffic is attack traffic; If the target determination result indicates normal, and the confidence level in the target determination result reaches the confidence level threshold, the target network traffic is determined to be normal traffic.

17. The protective device according to any one of claims 12 to 16, characterized in that: After the program instructions are read by the at least one processor, the protection device further performs the following operations: After matching the target traffic features with the attack features in the feature library and determining whether the target network traffic is attack traffic or normal traffic based on the matching results, the target traffic features are labeled, and the labeled target traffic features are used as a set of new sample traffic features. The new sample traffic features are used to update the target traffic detection model.

18. An analytical device, characterized in that include: memory, a network interface, and at least one processor, The memory is used to store program instructions, After the at least one processor reads the program instructions stored in the memory, the analysis device is caused to perform the following operations: According to the target network scenario currently deployed by the protection device, a target traffic detection model corresponding to the target network scenario is obtained from multiple traffic detection models, the analysis device stores the multiple traffic detection models corresponding one-to-one to the multiple network scenarios, and the target network scenario is any network scenario among the multiple network scenarios, wherein the target traffic detection model is trained based on a target training sample set, and the target training sample set includes multiple groups of sample traffic features, each group of sample traffic features is respectively marked with a normal label or an abnormal label, the sample traffic features marked with the normal label are from known normal traffic, and the sample traffic features marked with the abnormal label are from known attack traffic; The target traffic detection model is sent to the protection device.

19. The analytical device according to claim 18, characterized in that After the program instructions are read by the at least one processor, the analysis device further performs the following operations: A universal traffic detection model is obtained by training based on a universal training sample set, wherein the universal training sample set includes multiple groups of sample traffic features, and the universal training sample set is obtained based on network traffic in the multiple network scenarios; Obtaining the target training sample set corresponding to the target network scenario, where the target training sample set is obtained based on network traffic in the target network scenario; The target training sample set is used to train the general flow detection model to obtain the target flow detection model.

20. The analytical device according to claim 19, characterized in that After the program instructions are read by the at least one processor, the analysis device further performs the following operations: Using network telemetry technology to collect new sample traffic features from the protection device in real time, and adding the new sample traffic features to the target training sample set; Periodically using the latest target training sample set to train the target flow detection model to obtain an updated target flow detection model; The updated target traffic detection model is sent to the protection device.

21. A protection system, characterized in that: The protection system includes a protection device, and the protection device is used to perform the actions performed by the protection device in any one of the methods according to claims 1 to 11.

22. The protection system according to claim 21, characterized in that The protection system further comprises an analysis device, which is configured to execute the actions executed by the analysis device in the method according to any one of claims 6 to 9.

23. A computer-readable storage medium, characterized in that The computer-readable storage medium stores instructions, which, when executed by the processor, implement the actions performed by the protection device in any one of the methods according to claims 1 to 11, or implement the actions performed by the analysis device in any one of the methods according to claims 6 to 9.

Images