WO2017206499A1

WO2017206499A1 - Network attack detection method and attack detection apparatus

Info

Publication number: WO2017206499A1
Application number: PCT/CN2016/112155
Authority: WO
Inventors: 周冲; 付天福; 刘金华
Original assignee: 华为技术有限公司
Priority date: 2016-05-31
Filing date: 2016-12-26
Publication date: 2017-12-07

Abstract

Disclosed is a network attack detection method, which is used for providing more diverse and deeper information for network attack detection. The network attack detection method provided in the present application comprises: acquiring information about P sessions forwarded by a forwarding device, wherein the P sessions respectively belong to one object of Q objects; then, an attack detection apparatus determining a data amount of each object of the Q objects, and determining a first object according to the data amount of each object; and then, collecting statistics of feature values of sessions of the first object within a second time period so as to obtain a statistical result, wherein the statistical result is used for determining whether there is an attack in a network. Also provided is a relevant attack detection apparatus.

Description

Network attack detection method and attack detection device

This application is required to be submitted to the China Patent Office on May 31, 2016, the application number is 201610380229.1, and the invention name is “Network Attack Detection Method and Attack Detection Device” and submitted to the Chinese Patent Office on June 28, 2016, and the application number is 201610495352.8. The priority of the Chinese patent application entitled "Network Attack Detection Method and Attack Detection Device" is incorporated herein by reference.

Technical field

The present application relates to the field of data processing, and in particular, to a network attack detection method and an attack detection apparatus.

Background technique

There are a lot of sessions in the Internet at all times, and these sessions make up a huge amount of data. A huge amount of data flow requires the network to perform accurate traffic monitoring, billing, and potential attack detection on the data stream. At this stage, packet sampling technology is generally used to detect whether the data stream forwarded by the forwarding device in the network is secure.

However, the existing packet sampling technology can analyze the obtained data traffic with very few features, and can only detect simple known network anomalies such as data traffic bursts. Because of the inability to perform in-depth analysis of the characteristics of data traffic, it is difficult to provide more useful information for the detection of network attacks, resulting in inefficient detection of attacks.

Summary of the invention

The present application provides a network attack detection method for providing more useful information for network attack detection.

The first aspect of the present application provides a network attack detection method, including: acquiring information of P sessions forwarded by a forwarding device in a network in a first time period. Each of the P sessions belongs to one of the Q objects, where P and Q are integers greater than or equal to 1, and P is greater than or equal to Q. Based on the information of the P sessions, the amount of data of each of the Q objects is determined. And determining, according to the data volume of each of the Q objects, the first object, and then counting the feature values of the plurality of sessions of the first object forwarded by the forwarding device in the second time period, to obtain a statistical result. Its The statistics are used to determine whether an attack exists on the network where the forwarding device is located. Through the method, the data flow is deeply analyzed, and the obtained statistical information can reflect the more diverse, deep, complex and accurate characteristics of the network data traffic, which is beneficial to the attack detection device to the unknown attack and hiding in the network. Deep attacks are detected.

Optionally, the amount of data of each of the Q objects may be calculated accurately or may be estimated.

Optionally, the second time period may be the same time period as the first time period, or may be a different time period.

Optionally, the data volume of each of the Q objects includes: the number of sessions of the session included in the first time period, or the data traffic of the session included in the first time period. The size, or the number of messages in the session included in the first time period.

Optionally, the attack detecting device may sort the Q objects according to the order of the data amount, and determine the first object, where the first object is: the sorted Q objects are sorted by the top N objects. The object in which N is an integer less than Q. This is advantageous for selecting an object with a large amount of data as the first object.

Optionally, the attack detection device may remove the preset M objects from the Q objects, and sort the remaining QM objects according to the data amount from large to small, and determine that the first object is: The preset M objects, and the sorted QM objects, sort the objects located in the top N objects, wherein the preset M objects can be set by the artificial designated or attack detection device, wherein M is smaller than An integer of Q, where N is an integer less than QM.

Optionally, the attack detection device may further input the obtained statistical result into a preset machine model, where the machine model is a classifier, and can determine whether there is an attack in the network according to the statistical result.

Optionally, the attack detection device may further compare the obtained statistical result with a preset baseline, where the baseline may be regarded as a boundary line of a normal or abnormal statistical result of the first object, or whether the statistical result of the first object is normal. The criteria or rules, by comparing the statistical results with the baseline, can determine whether there is an attack in the network.

Optionally, the attack detection device may also modify the preset baseline according to the statistical result to adapt to the changed network environment.

The second aspect of the present application provides an attack detection apparatus, including: an information acquisition module, configured to acquire information of P sessions forwarded by a forwarding device in a first time period, where each session of the P sessions belongs to Q One of the objects. a data amount determining module for using the P sessions Information that determines the amount of data for each of the Q objects. And an object determining module, configured to determine the first object according to the data amount of each of the Q objects. The eigenvalue statistic module is configured to collect the eigenvalues of the plurality of sessions of the first object that are forwarded by the forwarding device in the second time period, and obtain the statistic result, where the statistic result is used to determine whether there is an attack in the network where the forwarding device is located. The attack detection device provided by the present application can perform deep analysis on the data flow, and the obtained statistical information can reflect more diverse, deep, complex, and accurate characteristics of the network data traffic, and is beneficial to unknown attacks and deep hidden in the network. The attack is detected.

Optionally, the object determining module is specifically configured to: sort the Q objects according to the order of the data amount, and determine the first object, where the first object is: the sorted Q objects are ranked in the front An object among N objects, where N is an integer less than Q. This is advantageous for selecting an object with a large amount of data as the first object.

Optionally, the object determining module is further configured to: remove the preset M objects from the Q objects, and sort the remaining QM objects according to the data amount in descending order, and determine the first object. The first object is: the preset M objects, and the sorted QM objects among the objects located in the top N objects.

Optionally, the attack detection device may further include an attack determination module, where the attack determination module may be configured to input the obtained statistical result into a preset machine model, and determine, by the machine module, whether there is an attack in the network. The machine model is a classifier that can determine whether there is an attack in the network based on statistical results.

Optionally, the attack judging module may further compare the obtained statistical result with a preset baseline, where the baseline may be regarded as a boundary line of a normal or abnormal statistical result of the first object, or whether the statistical result of the first object is normal. The criteria or rules, by comparing the statistical results with the baseline, can determine whether there is an attack in the network.

Optionally, the attack judging module may also modify the preset baseline according to the statistical result to adapt to the changed network environment.

A third aspect of the present application provides another attack detection apparatus including a processor and a communication interface. The communication interface is configured to obtain information about P sessions forwarded by the forwarding device in the network in the first time period, and each of the P sessions belongs to one of the Q objects, where P and Q are both Is an integer greater than or equal to 1, and P is greater than or equal to Q. The processor is configured to: determine, according to information about the P sessions acquired by the communication interface, a data amount of each object in the Q objects; determine a first object according to a data volume of each object in the Q objects, and then determine The statistic value of the plurality of sessions of the first object forwarded by the forwarding device in the second time period is obtained, and a statistical result is obtained.

DRAWINGS

FIG. 1 is a schematic structural diagram of an available system according to an embodiment of the present application;

2 is a structural diagram of an attack detection apparatus according to an embodiment of the present application;

FIG. 3 is a flowchart of a network attack detection method according to an embodiment of the present application;

FIG. 4 is a structural diagram of another attack detection apparatus according to an embodiment of the present application.

detailed description

The present application provides an attack detection method for improving attack detection efficiency of a data stream. The present application also provides related attack detection devices, which will be separately described below.

FIG. 1 is a diagram of an available system architecture provided by the present application. The network may include multiple forwarding devices, such as the forwarding device 101, the forwarding device 102, and the forwarding device 103. Each forwarding device can be a router, a switch, a firewall, a packet transport network device, a wavelength division multiplexing device, an optical transport network device, a base station, or a base station controller.

The attack detection device 104 is configured to couple with one or more forwarding devices in the internetwork, and detect whether there is an attack in the packet sent and received by the forwarding device. For example, the attack detection device 104 is coupled to the forwarding device 103 for detecting whether there is an attack in the packet sent and received by the forwarding device 103. In the embodiment of the present application, the attack detection device 104 may be an independent physical device, such as a server. The attack detection device 104 may also be a function module deployed on a physical device, which is not limited in this application.

In one example in this application, a session (English: session) refers to a communication interaction between two devices in a network during a specific uninterrupted operation time. During a session, all messages transmitted between the two devices belong to the session. The packets belonging to the same session have matching address signals, for example, in the Transmission Control Protocol (English: Transmission Control Protocol; TCP) or User Datagram Protocol (English: User Datagram Protocol; UDP). The packets in a session can be identified by the quintuple information, that is, the packets of the same session have the same quintuple information, including the same source IP address, destination IP address, source port number, and destination. Port number and transport layer protocol number. In the Internet Control Message Protocol (ICMP), a message belonging to a session can be identified by a binary group information, and a message of the same session has the same binary group information, that is, The same source IP address and destination IP address.

In another example of the present application, a session refers to a communication interaction between two devices in a network during an uninterrupted, specific operational time. During a session, all messages transmitted between the two devices belong to the session.

For example, in the case that the message communicated between the first device and the second device is a TCP message, or in the case where the message communicated between the first device and the second device is a UDP message, the TCP report The quintuple information is carried in the text or UDP packet. Match the quintuple information of multiple messages in the same session. That is, in the quintuple information carried by the packet sent by the first device to the second device, the source IP address is the IP address of the first device, the source port number is the port number of the first device, and the destination IP address is the second. The IP address of the device, the destination port number is the port number of the second device; the quintuple information carried in the packet sent by the second device to the first device, the source IP address is the IP address of the second device, and the source port number It is the port number of the second device. The destination IP address is the IP address of the first device, and the destination port number is the port number of the first device. The transport layer protocol numbers used by the two devices are the same. These messages belong to the same TCP/UDP session.

For example, in a case where the message communicated between the first device and the second device is not a TCP message or a UDP message, for example, the message that is communicated between the first device and the second device is an ICMP message. In the following, it is also considered that multiple packets matching the two-group information belong to the same session. That is, in the binary information carried by the packet sent by the first device to the second device, the source IP address is the IP address of the first device, and the destination IP address is the IP address of the second device; the second device gives the first In the binary information carried in the packet sent by the device, the source IP address is the IP address of the second device, and the destination IP address is the IP address of the first device. The transmission of the packets sent between the two devices is used. Layer protocol numbers are the same. These messages belong to the same ICMP session.

The attack detection device 104 shown in FIG. 1 can be implemented by the attack detection device 200 shown in FIG. 2, and includes a processor 201, a memory 202, and a communication interface 203. Optionally, a bus 204 is also included. The processor 201, the memory 202, and the communication interface 203 can implement a communication connection with each other via the bus 204. Of course, communication can also be achieved by other means such as wireless transmission.

The memory 202 can include a volatile memory, such as a random Access memory (English: random-access memory, abbreviation: RAM); may also include non-volatile memory (English: non-volatile memory), such as read-only memory (English: read-only memory, abbreviation: ROM), Flash memory (English: flash memory), hard disk (English: hard disk drive, abbreviated: HDD) or SSD; the memory 202 may also include a combination of the above types of memory. When the technical solution provided by the present application is implemented by software, the program code for implementing the attack detection method provided in FIG. 3 of the present application may be saved in the memory 202 and executed by the processor 201.

The communication interface 203 can be a wired interface, such as a Fiber Distributed Data Interface (FDDI) or an Ethernet (English) interface. Network interface 503 can also be a wireless interface, such as a wireless local area network interface. The communication interface 203 is configured to acquire information of P sessions forwarded by the forwarding device in the first time period, and feature values of the plurality of sessions of the first object forwarded in the second time period.

The processor 201 can be a central processing unit (English: central processing unit, CPU for short), a hardware chip or a combination of a CPU and a hardware chip. When the processor 201 is running, by calling the program code of the memory 202, the following steps may be performed: the control communication interface 203 acquires information of the P sessions forwarded by the forwarding device in the first time period, and each session of the P sessions One of the Q objects, wherein P and Q are integers greater than or equal to 1, and P is greater than or equal to Q; determining the data amount of each of the Q objects according to the information of the P sessions Determining a first object according to the data amount of each object in the Q objects; collecting a feature value of the plurality of sessions of the first object forwarded by the forwarding device in the second time period, and obtaining a statistical result, the statistical result is used Determine whether there is an attack on the network where the forwarding device is located.

Optionally, the data volume of each object is the number of sessions of the session included in the first time period of each object, or the data traffic size of the session included in the first time period, or The number of packets of the session included in a period of time.

Optionally, the determining the first object according to the data volume of each of the Q objects includes: sorting the Q objects according to the order of the data amount, and determining that the first object is: An object that is located among the objects of the top N after sorting, where N is an integer smaller than the Q.

Optionally, the determining the first object according to the data volume of each of the Q objects may further include: removing the preset M objects from the Q objects, and removing the remaining QM objects Sorting according to the order of the data amount, and determining that the first object is: the preset M objects, and the sorted QM objects among the objects in the top N, wherein M is less than Q An integer, N is an integer less than Q-M.

Optionally, the processor 201 is further configured to input the statistical result into a preset machine model, and determine, by using the machine model, whether an attack exists in the network.

Optionally, the processor 201 is further configured to compare the statistical result with a preset baseline to determine whether an attack exists in the network.

Optionally, the processor 201 is further configured to: according to the statistical result, correct a preset baseline, where the preset baseline is used to determine whether an attack exists in the network.

FIG. 3 is a flowchart of a method for detecting network attacks provided by an embodiment of the present application. For example, the execution body of the method shown in FIG. 3 may be the attack detecting device 104 shown in FIG. 1. Or the attack detecting device 200 shown in FIG. 2. The forwarding device in the embodiment shown in FIG. 3 may be one or more of the forwarding devices 101-103 shown in FIG. 1. See Figure 3 for the basic process, including:

S301. Acquire information about P sessions forwarded by the forwarding device in the first time period. Each of the P sessions belongs to one of the Q objects, where P and Q are integers greater than or equal to 1, and P is greater than or equal to Q.

Specifically, the forwarding device includes the P sessions in a large number of sessions forwarded in the first time period. The attack detecting device acquires information of the P sessions. For example, the P sessions may be obtained by the forwarding device sampling according to a pre-sampling rule. The information of the P sessions may be that, when the forwarding device receives each of the P sessions, the packet in the session is mirrored, and is saved in the forwarding device, and then in the mirrored packet. Obtained; it can also be obtained directly during the forwarding process.

For example, after the forwarding device acquires the information of the P sessions, the information of the P sessions is sent to the attack detection device according to the pre-established connection, so that the attack detection device acquires the information of the P sessions. The information of the information obtained by the attack detection device may be in the form of the IPFIX data, or may be in the form of the NetFlow data, or other forms that the forwarding device or the attack detection device can support, which is not limited herein. The session information can include many parameters, such as session identifier, source/destination IP address, source/destination port, protocol type, service type, and traffic size. The information of the session can be reported to the attack detection device by the forwarding device. The attack detection device may also send an indication to the forwarding device indicating that the forwarding device reports the session information, and actively acquire the session information.

For example, the information of the P sessions may be sent by a forwarding device to the attack detection device. Alternatively, it may be sent by multiple forwarding devices to the attack detection device.

For example, the information of the P sessions may be sent by the forwarding device to the attack detection device at one time, or may be sent to the attack detection device multiple times.

In this application, the "object" is used to divide the session in the network. For some sorting, a session in the network can be associated with an object, that is, the certain session belongs to the certain object. A session belongs to an object, and it can be called an object including a session. An object can include one or more sessions. Among the P sessions acquired by the attack detecting device, each session belongs to one of the Q objects. For example, the session is divided according to the destination IP address, and the attack detection device analyzes the P session information to obtain three destination IP addresses, which are respectively a first IP address, a second IP address, and a third IP address, and the three IP addresses are respectively Corresponding to the first object, the second object, and the third object, respectively. And in the P sessions, the session with the first IP address as the destination address belongs to the first object, the session with the second IP address as the destination address belongs to the second object, and the session with the third IP address as the destination address is Belongs to the third object.

Of course, for different partitioning methods, the same session can belong to different objects. For example, the subnet segment of the destination IP is divided. Assume that the first IP address and the second IP address belong to the first subnet segment and the third IP address belongs to the second subnet segment. The network segments correspond to the fourth object and the fifth object, respectively. Then, the session with the first IP address as the destination address and the session with the second IP address as the destination IP address belong to the fourth object; the session with the third IP address as the destination address belongs to the fifth object.

In S301, each of the P sessions belongs to one of Q objects, and the Q objects are objects divided according to a specific manner.

In this application, the object is not limited to the form of an IP address, and various parameters in the session information may be used as an object. For example, the object may be a network segment (English: segment), a URL (English: website), The autonomous system (English: autonomous system, abbreviation: AS) can also be the physical address (such as city, province, or even country) or other address information determined by the geographic information system (English: geographic information system, abbreviation: GIS).

It should be noted that, because the message in the session is bidirectional, for example, the message sent by the responder in the direction of the session is a transmission direction, and the message sent by the initiator in the response direction of the session is another transmission direction. Therefore, the address information of the IP address, the network segment, the autonomous system, and the physical address in the present application refers to the source address or destination address of the packet transmitted in one direction of the bidirectional packet in the session. For example, in the above, the IP address is used as the partitioning method, and then the IP address 1 corresponds to The object includes session 1, which means that the source IP address of the packet in one direction is IP address 1 and the destination address of the packet in the other direction is IP address 1. The division of other address forms is the same as this example and will not be described again.

In addition, the object can also be in the form of a service type, such as a domain name system (English: domain name system, abbreviation: DNS) type, a file transfer protocol (English: file transfer protocol, abbreviation: FTP) type, a hypertext transfer protocol (English: Hypertext transfer protocol, abbreviation: HTTP) type and other business types.

In addition, the object can also be in other forms, which is not limited herein.

S302. Determine, according to the information of the P sessions, the amount of data of each of the Q objects.

For example, the data amount of each object is the number of sessions of the session included in the first time period of the object, or the data of the session included in the first time period. The size of the traffic, or the number of packets of the session included in the first time period.

The amount of data of each of the Q objects is obtained from the information of the P sessions. Therefore, the information of the P sessions should include the amount of data of each of the Q objects. For example, if the amount of data refers to the number of sessions of each of the Q objects, the information of the P sessions should include at least the session identifier of each session. For another example, if the data volume refers to the data traffic of each of the Q objects, the information of the P sessions should include at least the traffic size of each session.

In one example, the amount of data for each of the Q objects can be accurately calculated. Taking the data volume as the data traffic as an example, for each object, the session belonging to the object in the P sessions is determined, and the data traffic of each session in the session belonging to the object is calculated, and the sum of the data flows is calculated. As the data traffic of this object. For example, the size of the data traffic can be expressed in bits (in English: bit) or in bytes (in English: Byte).

In another example, the amount of data for each of the Q objects may be estimated. Still taking the data volume as an example, if the first time period is a long time period, such as one day, then the number of sessions sampled is a large value. If the data traffic of each session is counted, the calculation amount is too large, especially for some of the Q objects, the amount of data is small, and the object determined to be less likely to be the first object does not need to be accurate. registration. For example, in S301, the information of the P sessions is an example in which the forwarding device sends the attack detection device multiple times. If the information of the session that is sent several times starts, the data volume of an object is not large, so there is no Count the exact amount of data for that object, and the number of that object in the information of the session sent several times later As the volume becomes larger, it is possible to be selected as the first object, and at this time, the attack detecting device may have deleted the previous session information several times, so the total data amount of the object in the first time period can only be estimated. obtain.

For example, to estimate the amount of data for an object, you can use the Ld-Sketch algorithm. For the specific implementation of the Ld-sketch algorithm, see the article "LD-Sketch: A Distributed" published by Qun Huang, Patrick PCLee in 2014 at the Institute of Electrical and Electronics Engineers (abbreviation: IEEE). Sketching Design for Accurate and Scalable Anomaly Detection in Network Data Streams”.

S303. Determine a first object according to a data amount of each of the Q objects.

According to the information of the session, a large number of objects can be determined, but in the process of detecting the attack of the network, it is not necessary to pay attention to all the objects, and only a few key objects need to be studied according to the needs of the actual application. Therefore, in the present application, the attack detecting device filters one or more objects from the Q objects and analyzes the selected objects. The first object is included in the selected object.

Optionally, the attack detecting device may sort the Q objects according to the order of the data amount, and determine the first object. The first object is: the sorted objects among the Q objects are sorted among the objects of the top N, that is, the N objects having the largest amount of data among the Q objects. Where N is an integer less than Q.

Optionally, the attack detection device may further include preset M objects. The preset M objects can be set by the user. For example, the user can preset M objects to be observed. The preset M objects may also be correspondingly determined by the attack detecting means before the first time period by using a method similar to determining the first object. The attack detection device may also set a life cycle for the preset M objects, and the preset M objects are no longer set as preset objects after the end of the life cycle.

If the attack detection device includes preset M objects, the preset M objects may be removed from the Q objects, and the remaining QM objects are sorted according to the order of the data amount, and determined. The first object. The first object is: the preset M objects, and the sorted objects of the QM objects among the objects of the top N, that is, the N objects with the largest amount of data among the QM objects, where N Is an integer less than QM.

Optionally, the attack detecting device may further determine, as the first object, the object whose data amount exceeds the threshold in the Q objects.

S304. Count multiple sessions of the first object that are forwarded by the forwarding device in the second time period. The statistic value of the vocabulary is obtained, and the statistic result is used to determine whether there is an attack in the network where the forwarding device is located.

The feature value of the session refers to the value used to describe the feature of the session (English: feature). For example, the session may be characterized by the size of the session traffic, the average packet length in the session, the session termination reason, the session duration, the maximum packet length in the session, and the minimum packet length in the session. In the example where the session is a TCP session, the session may also be characterized by the number of packets whose value of a certain flag bit in the TCP session is equal to one.

Specifically, the plurality of sessions of the first object refer to a plurality of sessions belonging to the first object.

For example, the attack detection device acquires information of multiple sessions of the first object forwarded by the forwarding device in the second time period, where the information of each session includes the feature value of the session, or is included in the calculation Information about the feature value of the session. For example, the eigenvalue is the average packet length of the session, and the information of the session obtained from the forwarding device may directly include the average packet length of each session, and may also include the total number of bytes of the session and the total number of packets. The detecting device determines the average packet length of each session by the total number of bytes of the session and the total number of packets.

For example, after the attack detecting device acquires the feature value of each session of the first object in S304, the feature values of the plurality of sessions are further counted to obtain the statistical result. The statistical result may be the sum of the feature values of the multiple sessions, or may be obtained by performing other statistical operations on the feature values of the multiple sessions.

In one example, the second time period can be the same time period as the first time period. In this example, the information of the P sessions is acquired in S301, and the feature value of each session is already included, and the attack detecting device saves the feature value of the session.

In another example, the attack detection device may not save the information of the P sessions in the first time period. In this example, the attack detection device needs to acquire the first object that the forwarding device forwards in the second time period. The eigenvalue of each session in a session. The second time period can be after the first time period.

The attack detection device counts the feature values of the plurality of sessions of the first object forwarded by the forwarding device in the second time period, and obtains a statistical result. The statistics are used to determine whether there is an attack in the network where the forwarding device is located.

Optionally, the machine model is pre-stored in the attack detection device. The machine model is also called a classifier (English: classifier), and its essence can be a classification function or a classification model. For example, the machine The model can be a back propagation (abbreviation: BP) neural network model. It can divide the current input statistics into existing attacks and not based on the historical statistical results and the historical network. There are two types of attacks to determine if there is an attack in the network. In the present application, the attack detection device may input the statistical result into a preset machine model to determine whether there is an attack in the network where the forwarding device is located through the machine model.

Optionally, the attack detection device may be pre-configured with a baseline corresponding to the first object (English: baseline), and the baseline may be regarded as a standard or rule that the statistical result of the first object is normal or abnormal. The baseline can be a numerical value or a judgment condition. The baseline may be automatically generated by the attack detection device according to the statistics obtained in the previous attack detection process, which is not limited in this application. The attack detecting device compares the statistical result of the first object with the corresponding baseline, and can obtain whether the statistical result of the first object has an abnormality, thereby determining whether there is an attack in the network, and determining the presence and the abnormality of the attack. The result is related to the session.

It should be pointed out that the data flow in the network changes rapidly, so the criteria or rules for judging whether the statistical result of the first object is abnormal may also be changed. Therefore, if the baseline is used to determine whether there is an attack in the network, the baseline should be continuously corrected based on the statistical results. Therefore, in the present application, the attack detection device may adjust the baseline according to the determined statistical result. The specific adjustment algorithm includes averaging, weighting, smoothing, prediction, correction, or other algorithms, which is not limited herein. For example, if the traffic size of the session of the website www.baidu.com is 5M per unit time in the second time period, and the baseline of the data traffic size is 7M per unit time, the attack detection device uses a first-order smoothing algorithm to adjust the baseline. The smoothing coefficient is 0.4, and the adjusted baseline is unit time: 0.4 × 5M + (1 - 0.4) × 7M = 6.2M.

Optionally, the attack detection device may perform statistics on multiple feature values of the session included in the first object to obtain multiple baselines. Generate or modify a machine model based on multiple baselines.

The present invention provides an attack detection method, in which the attack detection device acquires information of P sessions forwarded by the forwarding device, wherein the P sessions belong to one of the Q objects, and then the attack detection device determines the Q objects. The amount of data of each object in the object, and determining the first object according to the data volume of each object, and then counting the feature values of the session of the first object in the second time period to obtain a statistical result, the statistical result is used to determine whether there is an attack in the network . The present application selects the first object of main concern on the basis of extracting the session information in the network, and then determines the feature value of the selected first object session, and statistically obtains statistics on the feature value of the session of the first object. result. This application performs a deep analysis of the data stream by such a method, and the obtained statistical information can reflect the number of networks. According to the more diverse, deep, complex and accurate traffic, the attack detection device can detect unknown attacks and deep hidden attacks in the network.

The embodiment shown in FIG. 3 provides a basic flow of the network attack detection method provided by the present application. The following describes the attack detection apparatus provided by the present application for implementing the foregoing network attack detection method. For the basic structure, refer to the following. Figure 4, including:

The information obtaining module 401 is configured to obtain information about P sessions forwarded by the forwarding device in the first time period, and each of the P sessions belongs to one of the Q objects. Wherein P and Q are integers greater than or equal to 1, and P is greater than or equal to Q.

The data amount determining module 402 is configured to determine, according to the information of the P sessions, the amount of data of each of the Q objects.

The object determining module 403 is configured to determine the first object according to the data amount of each of the Q objects. Optionally, the object determining module 403 sorts the Q objects according to the order of the data amount, and determines that the first object is the object that is ranked among the objects of the top N among the sorted Q objects. Where N is an integer less than Q. Optionally, the preset M objects are removed from the Q objects, and the remaining QM objects are sorted according to the data amount from large to small, and the first object is determined as: preset M objects. And sorting the objects among the top N objects among the sorted QM objects, M is an integer smaller than Q, and N is an integer smaller than QM.

The eigenvalue statistic module 404 is configured to count the eigenvalues of the plurality of sessions of the first object that are forwarded by the forwarding device in the second time period, and obtain a statistic result, where the statistic result is used to determine whether there is an attack in the network where the forwarding device is located. .

Optionally, the attack detection device may further include an attack determination module 405, configured to input the statistical result into the machine model, and determine, by using the machine model, whether there is an attack in the network.

Optionally, the attack determining module 405 is configured to compare the statistical result with a preset baseline to determine whether an attack exists in the network.

Optionally, the attack determination module 405 can also correct the preset baseline according to the statistical result.

For a detailed description of the attack detection apparatus shown in FIG. 4 and a specific application method, reference may be made to the method embodiment shown in FIG. 3, and details are not described herein.

Optionally, each module shown in FIG. 4 is only a functional division of the attack detection device. The attack detection device shown in FIG. 4 may be substantially a device with the attack detection device shown in FIG. 2, and FIG. 4 is The logical perspective is described, and Figure 2 is described from a structural perspective. For example, the information acquisition module 401 shown in FIG. 4 can be implemented by the communication interface 203 shown in FIG. 2, and the number shown in FIG. The data determination module 402, the object determination module 403, the feature value statistics module 404, and the attack determination module 405 can be implemented by the processor 201 shown in FIG.

A person skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working process of the system, the device and the module described above can refer to the corresponding process in the foregoing method embodiments, and details are not described herein again.

In the several embodiments provided by the present application, it should be understood that the disclosed system, apparatus, and method may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the modules is only a logical function division. In actual implementation, there may be another division manner, for example, multiple modules or components may be combined or Can be integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or module, and may be electrical, mechanical or otherwise.

The modules described as separate components may or may not be physically separated. The components displayed as modules may or may not be physical modules, that is, may be located in one place, or may be distributed to multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional module in each embodiment of the present application may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules.

The integrated modules, if implemented in the form of software functional modules and sold or used as separate products, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application, in essence or the contribution to the prior art, or all or part of the technical solution may be embodied in the form of a software product stored in a storage medium. A number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present application. The foregoing storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a ROM, a RAM, a magnetic disk, or an optical disk.

The above embodiments are only used to explain the technical solutions of the present application, and are not limited thereto; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still The technical solutions described in the embodiments are modified, or The technical features of the present invention are not limited to the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

A network attack detection method, characterized in that the method comprises:

Acquiring information of the P sessions forwarded by the forwarding device in the first time period, each of the P sessions belonging to one of the Q objects, wherein the P and the Q are greater than or equal to 1 An integer, and the P is greater than or equal to the Q;

Determining, according to information of the P sessions, a data amount of each of the Q objects;

Determining a first object according to a data amount of each of the Q objects;

The statistic value of the plurality of sessions of the first object that is forwarded by the forwarding device in the second time period is obtained, and the statistic result is obtained, where the statistic result is used to determine whether there is an attack in the network where the forwarding device is located.
The network attack detection method according to claim 1, wherein the data amount of each object is the number of sessions of the session included in the first time period of each object, or The data traffic size of the session included in the first time period, or the number of packets of the session included in the first time period.
The network attack detection method according to claim 1 or 2, wherein the determining the first object according to the data amount of each of the Q objects comprises:

Sorting the Q objects according to the order of the amount of data, and determining the first object, wherein the first object is an object that is sorted among the objects of the top N among the sorted Q objects. The N is an integer smaller than the Q.
The network attack detection method according to claim 1 or 2, wherein the determining the first object according to the data amount of each of the Q objects comprises:

Removing the preset M objects from the Q objects, and sorting the remaining QM objects in order of increasing data size, and determining the first object, the first object is The preset M objects, and the sorted QM objects, are sorted among the objects located in the top N, the M being an integer smaller than the Q, and the N being an integer smaller than the QM.
The network attack detection method according to any one of claims 1 to 4, wherein the method further comprises:

The statistical result is input into a preset machine model, and it is determined whether there is an attack in the network according to the machine model.
The network attack detecting method according to any one of claims 1 to 4, characterized in that The method further includes:

The statistical result is compared with a preset baseline to determine whether there is an attack in the network.
The network attack detection method according to any one of claims 1 to 6, wherein the method further comprises:

Based on the statistical result, the preset baseline is corrected, and the baseline is used to determine whether there is an attack in the network.
An attack detection device, comprising:

An information acquiring module, configured to acquire information of P sessions forwarded by the forwarding device in a first time period, where each of the P sessions belongs to one of Q objects, where the P and the Q are All are integers greater than or equal to 1, and the P is greater than or equal to the Q;

a data quantity determining module, configured to determine, according to information about the P sessions, a data amount of each of the Q objects;

An object determining module, configured to determine a first object according to an amount of data of each of the Q objects;

An eigenvalue statistic module is configured to collect a statistic value of the plurality of sessions of the first object that is forwarded by the forwarding device in the second time period, and obtain a statistic result, where the statistic result is used to determine that the forwarding device is located Whether there is an attack in the network.
The attack detecting apparatus according to claim 8, wherein the data amount of each object is the number of sessions of the session included in each of the objects in the first time period, or The size of the data traffic of the session included in the first time period, or the number of packets of the session included in the first time period.
The attack detection apparatus according to claim 8 or 9, wherein the object determination module is specifically configured to:

Sorting the Q objects according to the order of the amount of data, and determining the first object, wherein the first object is an object that is sorted among the objects of the top N among the sorted Q objects. The N is an integer smaller than the Q.
The attack detection apparatus according to claim 8 or 9, wherein the object determination module is specifically configured to:

Removing the preset M objects from the Q objects, and sorting the remaining QM objects in order of increasing data size, and determining the first object, the first object is Presetting the M objects, and sorting the sorted QM objects among the top N objects Object, the M is an integer smaller than the Q, and the N is an integer smaller than the Q-M.
The attack detection device according to any one of claims 8 to 11, wherein the device further comprises:

The attack judging module is configured to input the statistical result into a preset machine model, and determine, according to the machine model, whether there is an attack in the network.
The attack detection device according to any one of claims 8 to 11, wherein the device further comprises:

The attack judging module is configured to compare the statistical result with a preset baseline to determine whether an attack exists in the network.
The attack detection apparatus according to any one of claims 7 to 13, wherein the attack determination module is further configured to:

Based on the statistical result, the preset baseline is corrected, and the baseline is used to determine whether there is an attack in the network.