WO2020107446A1

WO2020107446A1 - Method and apparatus for obtaining attacker information, device, and storage medium

Info

Publication number: WO2020107446A1
Application number: PCT/CN2018/118691
Authority: WO
Inventors: 郝志向
Original assignee: 北京比特大陆科技有限公司
Priority date: 2018-11-30
Filing date: 2018-11-30
Publication date: 2020-06-04
Also published as: CN112789835A

Abstract

Embodiments of the present invention relate to a method and apparatus for obtaining attacker information, a device, and a storage medium. The method comprises: obtaining information of a target attacker in an actual environment according to information of the target attacker in a virtual network and collectable information of the attacker. According to the embodiments of the present invention, the information of the target attacker in the actual environment can be obtained, and a targeted protection strategy can be implemented, thereby helping improve network security.

Description

Method, device, equipment and storage medium for acquiring attacker information

Technical field

This application relates to the field of computer technology, for example, to an attacker information acquisition method, device, device, and storage medium.

Background technique

As the coverage of the Internet continues to expand, the importance of network security continues to increase. Facing endless new network intrusion technologies and increasingly frequent network intrusion behaviors, the demand for the source of network attacks is increasingly urgent.

In related technologies, the attacker usually obtains the information of the attacker at the Transmission Control Protocol (TCP)/Internet Protocol (IP) level, including the IP address and port number, and the attacker generally uses fake IP Address, so it is impossible to obtain valuable information related to the attacker, and thus cannot implement targeted protection strategies.

Summary of the invention

Embodiments of the present disclosure provide an attacker information acquisition method, device, device, and storage medium to acquire information related to the attacker, and can implement a targeted protection strategy.

An embodiment of the present disclosure provides an attacker information acquisition method, including:

According to the information of the target attacker in the virtual network and the information of the attacker that can be collected, the information of the target attacker in the actual environment is obtained.

In a possible implementation manner, before acquiring the information of the target attacker in the actual environment, the method further includes:

Obtain the information of the target attacker in the virtual network.

In a possible implementation manner, the acquiring the information of the target attacker in the virtual network includes:

Obtain the information of the target attacker in the virtual network according to the attack event information corresponding to the target attacker.

In a possible implementation manner, the attack event information includes at least one of the following: the name of the attack event, the time when the attack event occurred, the location where the attack event occurred, and the identification information of the attack event.

In a possible implementation manner, the information of the attacker that can be collected includes: information of the attacker that has been collected, or information of the attacker that is not currently collected, and the attacker that can be collected Information.

In a possible implementation manner, the acquiring the information of the target attacker in the actual environment according to the information of the target attacker in the virtual network and the information of the attacker that can be collected includes:

Determine whether the information of the attacker that can be collected exists in the virtual network of the target attacker;

If the information about the target attacker in the virtual network exists in the information about the attacker that can be collected, according to the information about the target attacker in the virtual network and the information about the attacker that can be collected To obtain information about the target attacker in the actual environment.

In a possible implementation, according to the information of the target attacker in the virtual network and the information of the attacker that can be collected, before obtaining the information of the target attacker in the actual environment, further includes :

The collected information of the attacker is stored in a database; the information of the attacker includes at least one of the following: information of the attacker in the virtual network or information of the attacker in the actual environment.

Determine whether the information of the target attacker in the virtual network exists in the database;

If the information of the target attacker in the virtual network exists in the database, the information of the target attacker in the actual environment is obtained from the database according to the information of the target attacker in the virtual network.

In the above embodiment, the collected information of the attacker can be stored in the database, and the information of the target attacker in the actual environment can be obtained by querying the database, and the efficiency is high.

In a possible implementation manner, the method further includes:

If the information of the target attacker in the virtual network does not exist in the database, the information of the target attacker in the virtual network is stored in the database.

In a possible implementation manner, the database includes: at least one piece of information, and each piece of information includes at least one of the following: information of an attacker in a virtual network, and information of the attacker in an actual environment.

In a possible implementation, the information of any attacker in the virtual network includes at least one of the following: the attacker's identity in the virtual network, domain name, IP address, media access control MAC address, and attack method 3. The hacking tools used.

In a possible implementation, the information of any attacker in the actual environment includes at least one of the following: the attacker's identity, age, attack record, and location of the network attack in the actual environment, and the attack The background and purpose of the occurrence.

In a possible implementation manner, the method further includes:

If the number of information entries included in the database is greater than a preset threshold, the frequency of use of each piece of information in the database is obtained;

Delete the information whose usage frequency is less than the preset frequency.

In a possible implementation manner, the deleting the information that the usage frequency is less than the preset frequency includes:

Obtain the user's operation instructions;

According to the user's operation instruction, delete the information whose usage frequency is less than the preset frequency.

An embodiment of the present disclosure also provides an attacker information acquisition device, including:

The first acquiring module is configured to acquire information of the target attacker in the actual environment according to the information of the target attacker in the virtual network and the information of the attacker that can be collected.

In a possible implementation manner, the device further includes:

The second obtaining module is configured to obtain information of the target attacker in the virtual network.

In a possible implementation manner, the second acquisition module is configured to:

In a possible implementation manner, the first acquisition module is configured to:

In a possible implementation manner, the device further includes:

The storage module is configured to store the collected information of the attacker in a database; the information of the attacker includes at least one of the following: information of the attacker in the virtual network or the attacker in the actual environment Information.

In a possible implementation manner, the storage module is configured to:

In a possible implementation manner, the information of any attacker in the actual environment includes at least one of the following: the identity, age, attack record, and location of the attacker in the actual environment.

In a possible implementation manner, the device further includes:

The third obtaining module is configured to: if the number of information items included in the database is greater than a preset threshold, obtain the frequency of use of each piece of information in the database;

The processing module is configured to delete information whose usage frequency is less than a preset frequency.

In a possible implementation manner, the processing module is configured to:

Obtain the user's operation instructions;

An embodiment of the present disclosure also provides a computer that includes the above attacker information acquisition device.

An embodiment of the present disclosure also provides a computer-readable storage medium that stores computer-executable instructions that are configured to perform the above-mentioned method for acquiring attacker information.

An embodiment of the present disclosure also provides a computer program product. The computer program product includes a computer program stored on a computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the The computer executes the aforementioned method for acquiring attacker information.

An embodiment of the present disclosure also provides an electronic device, including:

At least one processor; and

A memory communicatively connected to the at least one processor; wherein,

The memory stores instructions executable by the at least one processor, and when the instructions are executed by the at least one processor, the at least one processor executes the above-mentioned method for acquiring attacker information.

The method, device, equipment and storage medium for obtaining attacker information provided by the embodiments of the present disclosure obtain the target attacker's actual environment in accordance with the information of the target attacker in the virtual network and the information of the attacker that can be collected Information, you can get the information of the target attacker in the actual environment, you can implement targeted protection strategies, which helps to improve the security of the network.

BRIEF DESCRIPTION

One or more embodiments are exemplified by the corresponding drawings. These exemplary descriptions and the drawings do not constitute a limitation on the embodiments. Elements with the same reference numerals in the drawings are shown as similar elements. The drawings do not constitute a proportional limitation, and among them:

1 is a diagram of an application scenario provided by an embodiment of the present disclosure;

2 is a schematic flowchart of a method for obtaining attacker information according to an embodiment of the present disclosure;

3 is a schematic flowchart of a method for obtaining attacker information according to another embodiment of the present disclosure;

4 is a schematic structural diagram of an apparatus for obtaining attacker information according to an embodiment of the present disclosure;

5 is a schematic structural diagram of an apparatus for acquiring attacker information according to another embodiment of the present disclosure;

6 is a schematic structural diagram of an electronic device provided by an embodiment of the present disclosure.

detailed description

In order to understand the features and technical contents of the embodiments of the present disclosure in more detail, the following describes the implementation of the embodiments of the present disclosure in detail with reference to the drawings. The accompanying drawings are for reference only and are not intended to limit the embodiments of the present disclosure. In the following technical description, for convenience of explanation, various details are provided to provide a sufficient understanding of the disclosed embodiments. However, without these details, one or more embodiments can still be implemented. In other cases, to simplify the drawings, well-known structures and devices can be simplified.

First, the application scenarios involved in the embodiments of the present disclosure are introduced:

The method for obtaining attacker information provided by the embodiments of the present disclosure is applied to network traceability, and is used to determine the information of the network attacker, for example, including identity, location, etc. The identity includes, for example, name and account number, and the location includes, for example, its geographic location Virtual locations, such as IP addresses, MAC addresses, etc., can be used to obtain information about a cyber attacker after the cyber attack is carried out.

FIG. 1 is an application scenario diagram provided by an embodiment of the present disclosure. The method provided by the present disclosure may be implemented by an electronic device 12 such as a processor of an electronic device, or may be implemented by the electronic device 12 through data interaction with a server 11. Alternatively, it can be implemented by the server. The electronic device 12 and the server 11 may be connected via a network, such as 3G, 4G, or wireless fidelity (Wireless Fidelity, WIFI), wired network, and other communication networks.

The above electronic devices may include: smart phones, tablet computers, intelligent robots, wearable devices, computers and other devices.

The technical solution shown in the present application will be described in detail below through the following examples.

The following several embodiments may be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

The following uses electronic devices as the main body for explanation. The execution subject of the embodiment of the present disclosure may be an electronic device or an attacker information acquisition device provided in the electronic device. Among them, the attacker information acquisition device can be implemented by software, or by a combination of software and hardware.

FIG. 2 is a schematic flowchart of a method for acquiring attacker information provided by an embodiment of the present disclosure. As shown in FIG. 2, the method provided in this embodiment includes:

Step 201: Obtain the information of the target attacker in the virtual network.

In the embodiment of the present disclosure, the target attacker may be an attacker who is currently to be investigated or locked, for example, an attacker who currently carries out a network attack.

In this step, the information of the target attacker in the virtual network can be obtained from other devices, or the electronic device can directly obtain the information of the target attacker in the virtual network, such as the system generated during the attack process of the target attacker Logs to obtain information about the target attacker in the virtual network. Other devices such as other electronic devices or servers. When a network attack occurs, other devices may obtain the information of the target attacker who carried out the network attack in the virtual network and send it to the electronic device.

Among them, the system log includes, for example, the time when the network attack occurred, the hacking tool used for the network attack, the IP address, and the Media Access Control (Media Access Control, MAC for short) address.

In other embodiments of the present disclosure, step 201 may be implemented as follows:

According to the attack event information corresponding to the target attacker, obtain the information of the target attacker in the virtual network.

The attack event information may include at least one of the following: the name of the attack event, the time when the attack event occurred, the location where the attack event occurred, and the identification information of the attack event.

Among them, the attack event information can be obtained from the system log.

Step 202: Obtain the information of the target attacker in the actual environment according to the information of the target attacker in the virtual network and the information of the attacker that can be collected.

In this step, the information of the target attacker in the actual environment is obtained based on the obtained information of the target attacker in the virtual network and the information of the attacker that can be collected.

The information of the attacker that can be collected may be information of the attacker that has been collected, or information of the attacker that is not currently collected, and information of the attacker that can be collected. The information of the attacker includes: information of the attacker in the virtual network, and/or information of the attacker in the actual environment. The attacker can include the target attacker at any time.

The information of the attacker that is not currently collected may be, for example, information of the attacker that has been collected in other devices.

The information of the target attacker in the virtual network includes at least one of the following: the identity of the target attacker in the virtual network, domain name, IP address, attack method, hacking tool used

The information of the target attacker in the actual environment includes at least one of the following: the identity of the target attacker in the actual environment, age, attack record, location of the network attack, background and purpose of the attack.

For example, the purpose of the attack may be that the target attacker wants to obtain economic benefits, etc. The background of the attack may be that the target attacker is under poor economic conditions and is stimulated by external factors.

In an embodiment of the present disclosure, step 202 may be implemented as follows:

If the information of the attacker that can be collected includes the information of the target attacker, for example, the information of the target attacker in the virtual network, then the information of the target attacker in the virtual network and the information that can be collected The information of the attacker is related to the information of the target attacker in the actual environment. Among them, the information of the attacker that can be collected can be analyzed, filtered, and other operations to obtain the information of the target attacker in the actual environment

According to the information of the target attacker in the virtual network, the information of the target attacker in the actual environment can be queried from the information of the attacker that can be collected.

The method for obtaining the attacker information in this embodiment can obtain the information of the target attacker in the actual environment according to the information of the target attacker in the virtual network and the information of the attacker that can be collected, and the target attacker can be obtained The information in the actual environment can be implemented with targeted protection strategies, which helps to improve the security of the network.

FIG. 3 is a schematic flowchart of a method for acquiring attacker information according to another embodiment of the present disclosure. Based on the above embodiment, as shown in FIG. 3, the method provided in this embodiment includes:

Step 301: Store the collected information of the attacker in a database; the information of the attacker includes at least one of the following: information of the attacker in the virtual network or information of the attacker in the actual environment.

In this step, the collected information of the attacker can be stored in a database, and relevant information can be recorded and stored when a network attack occurs, or the collected information of the attacker can be obtained from other devices or networks.

Step 302: Determine whether the information of the target attacker in the virtual network exists in the database.

Step 303: If the information of the target attacker in the virtual network exists in the database, obtain the information of the target attacker in the actual environment from the database according to the information of the target attacker in the virtual network.

In this step, if the collected information of the target attacker is pre-stored in the database, for example, the information of the target attacker in the virtual network, then the information of the target attacker in the virtual network can be associated from the database Query the information of the target attacker in the actual environment.

Step 304: If the information of the target attacker in the virtual network does not exist in the database, store the information of the target attacker in the virtual network into the database.

In this step, if the information about the target attacker is not stored in the database, for example, the information of the target attacker in the virtual network, the information of the target attacker in the virtual network is stored in the database for subsequent use.

In other embodiments of the present disclosure, various attack data may be integrated into the database in advance. The attack data may include the attacker ID, domain name, attack method, hacking tool used, etc. When the visitor accesses the network, first Compare the visitor's relevant information with the data in the database. If the visitor's relevant information matches the data in the database, the visitor can be considered as an attacker, and the attacker can be intercepted. .

Based on the above embodiment, the database may include: at least one piece of information, and each piece of information includes at least one of the following: information of an attacker in the virtual network, and information of the attacker in the actual environment.

The collected attacker information stored in the database includes multiple pieces of attacker information, each piece of information includes: information of an attacker in a virtual network, and/or information of the attacker in the actual environment .

The information of any attacker in the virtual network includes at least one of the following: the attacker's identity ID, domain name, IP address, attack method, and hacking tool used in the virtual network.

Among them, the identity can be the attacker's account and password in the virtual network, the IP address can be the IP address of the attacker's device in the virtual network, and the MAC address can be the MAC of the attacker's device The address is the hardware address of the device and is used to define the network location of the device. Attack methods include, for example, denial of service attacks, physical layer line interception, and fragmented IP packet attacks.

Among them, the information of any attacker in the actual environment includes at least one of the following: the identity, age, attack record, and location of the attacker in the actual environment.

The attack record includes, for example, the historical record of the attacker's participation in the network attack, such as the time of the attack, the location of the network attack, the hacking tool used, and so on.

Based on the above embodiment, the method in this embodiment may further include:

If the number of information items included in the database is greater than the preset threshold, the frequency of use of each piece of information in the database is obtained;

Delete the information whose usage frequency is less than the preset frequency.

Wherein, deleting the information whose usage frequency is less than the preset frequency may be implemented as follows:

Obtain the user's operation instructions;

In this embodiment, the database data may be maintained periodically, or after receiving the user's instruction.

If it is detected that the number of information entries included in the database is greater than the preset threshold, in order to reduce unnecessary space occupation, the usage frequency of each piece of information in the database is obtained; information whose usage frequency is less than the preset frequency is deleted. For example, there is a lot of information that has not been used by attackers, or is used less frequently, such as once every few years, or used less often, etc., and the information can be deleted.

In this embodiment, the collected information of the attacker can be stored in the database, and the information of the target attacker in the actual environment can be obtained by querying the database, and the efficiency is high.

4 is a schematic structural diagram of an apparatus for acquiring attacker information according to an embodiment of the present disclosure. As shown in FIG. 4, the apparatus for obtaining attacker information provided in this embodiment includes:

The first obtaining module 401 is configured to obtain the information of the target attacker in the actual environment according to the information of the target attacker in the virtual network and the information of the attacker that can be collected.

In a possible implementation manner, as shown in FIG. 5, the device further includes:

The second obtaining module 402 is configured to obtain information of the target attacker in the virtual network.

In a possible implementation manner, the second obtaining module 402 is configured to:

In a possible implementation manner, the first obtaining module 401 is configured to:

In a possible implementation manner, the device further includes:

The storage module 403 is configured to store the collected information of the attacker in a database; the information of the attacker includes at least one of the following: the information of the attacker in the virtual network or the actual environment of the attacker in the actual environment Information.

In a possible implementation manner, the storage module 403 is configured to:

In a possible implementation manner, the device further includes:

The third obtaining module 404 is configured to: if the number of information items included in the database is greater than a preset threshold, obtain the frequency of use of each piece of information in the database;

The processing module 405 is configured to delete information whose usage frequency is less than a preset frequency.

In a possible implementation manner, the processing module 405 is configured to:

Obtain the user's operation instructions;

The device of this embodiment may be used to execute the technical solutions of the above method embodiments, and its implementation principles and technical effects are similar, and will not be repeated here.

An embodiment of the present disclosure also provides a computer-readable storage medium that stores computer-executable instructions that are configured to perform the above-mentioned attacker information acquisition method.

An embodiment of the present disclosure also provides a computer program product. The computer program product includes a computer program stored on a computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the The computer executes the above method for acquiring attacker information.

The aforementioned computer-readable storage medium may be a transient computer-readable storage medium or a non-transitory computer-readable storage medium.

An embodiment of the present disclosure also provides an electronic device, whose structure is shown in FIG. 6, the electronic device includes:

At least one processor (processor) 100, one processor 100 is taken as an example in FIG. 6; and the memory 101 may further include a communication interface (Communication) 102 and a bus 103. The processor 100, the communication interface 102, and the memory 101 can complete communication with each other through the bus 103. The communication interface 102 can be used for information transmission. The processor 100 may call logical instructions in the memory 101 to execute the method for acquiring attacker information in the foregoing embodiment.

In addition, the logic instructions in the above-mentioned memory 101 may be implemented in the form of software functional units and sold or used as independent products, and may be stored in a computer-readable storage medium.

The memory 101 is a computer-readable storage medium and can be used to store software programs and computer-executable programs, such as program instructions/modules corresponding to the methods in the embodiments of the present disclosure. The processor 100 executes functional applications and data processing by running software programs, instructions, and modules stored in the memory 101, that is, implementing the attacker information acquisition method in the foregoing method embodiments.

The memory 101 may include a storage program area and a storage data area, wherein the storage program area may store an operating system and application programs required for at least one function; the storage data area may store data created according to the use of a terminal device and the like. In addition, the memory 101 may include a high-speed random access memory, and may also include a non-volatile memory.

The technical solutions of the embodiments of the present disclosure may be embodied in the form of software products, which are stored in a storage medium and include one or more instructions to make a computer device (which may be a personal computer, server, or network) Equipment, etc.) to perform all or part of the steps of the method described in the embodiments of the present disclosure. The aforementioned storage medium may be a non-transitory storage medium, including: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk, etc. A medium that can store program codes may also be a transient storage medium.

When used in this application, although the terms "first", "second", etc. may be used in this application to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish one element from another. For example, without changing the meaning of the description, the first element can be called the second element, and likewise, the second element can be called the first element, as long as all occurrences of the "first element" are consistently renamed and all occurrences of The "second component" can be renamed consistently. The first element and the second element are both elements, but they may not be the same element.

The terms used in this application are only used to describe the embodiments and are not used to limit the claims. As used in the description of the embodiments and claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "said" are intended to include plural forms as well . Similarly, the term "and/or" as used in this application is meant to include any and all possible combinations of one or more associated lists. In addition, when used in this application, the term "comprise" and its variations "comprises" and/or includes etc. refer to the stated features, wholes, steps, operations, elements, and/or The presence of components does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components, and/or groups of these.

The various aspects, implementations, implementations or features in the described embodiments can be used alone or in any combination. Various aspects in the described embodiments may be implemented by software, hardware, or a combination of software and hardware. The described embodiments may also be embodied by a computer-readable medium that stores computer-readable code including instructions executable by at least one computing device. The computer-readable medium can be associated with any data storage device capable of storing data, which can be read by a computer system. Computer-readable media used for examples may include read-only memory, random access memory, CD-ROM, HDD, DVD, magnetic tape, optical data storage devices, and the like. The computer-readable medium may also be distributed in computer systems connected through a network, so that computer-readable codes can be stored and executed in a distributed manner.

The above technical description may refer to the accompanying drawings, which form a part of the present application, and the description shows an implementation according to the described embodiments in the drawings. Although these embodiments are described in sufficient detail to enable those skilled in the art to implement these embodiments, these embodiments are non-limiting; so that other embodiments can be used without departing from the scope of the described embodiments Changes can also be made under circumstances. For example, the sequence of operations described in the flowchart is non-limiting, so the sequence of two or more operations explained in the flowchart and described according to the flowchart may be changed according to several embodiments. As another example, in several embodiments, one or more operations illustrated in the flowchart and described in accordance with the flowchart are optional or may be deleted. In addition, certain steps or functions may be added to the disclosed embodiments, or two or more steps may be replaced in sequence. All these changes are considered to be included in the disclosed embodiments and claims.

In addition, terminology is used in the above technical description to provide a thorough understanding of the described embodiments. However, no excessively detailed details are required to implement the described embodiments. Therefore, the above description of the embodiments is presented for explanation and description. The embodiments presented in the above description and the examples disclosed according to these embodiments are provided separately to add context and help to understand the described embodiments. The above description is not intended to be without omission or to limit the described embodiments to the precise form of this disclosure. Based on the above teachings, several modifications, choices and changes are possible. In some cases, well-known processing steps are not described in detail to avoid unnecessarily affecting the described embodiments.

Claims

An attacker information acquisition method, which is characterized by:

According to the information of the target attacker in the virtual network and the information of the attacker that can be collected, the information of the target attacker in the actual environment is obtained.
The method according to claim 1, wherein before acquiring the information of the target attacker in the actual environment, further comprising:

Obtain the information of the target attacker in the virtual network.
The method according to claim 2, wherein the acquiring the information of the target attacker in the virtual network includes:

Obtain the information of the target attacker in the virtual network according to the attack event information corresponding to the target attacker.
The method according to claim 3, wherein the attack event information includes at least one of the following: the name of the attack event, the time when the attack event occurred, the location where the attack event occurred, and the identification information of the attack event.
The method according to any one of claims 1 to 4, wherein the information of the attacker that can be collected includes: information of the attacker that has been collected, or, of the attacker that is not currently collected Information, and information about attackers that can be collected.
The method according to any one of claims 1 to 4, wherein the target attacker is acquired based on the information of the target attacker in the virtual network and the information of the attacker that can be collected. Information in the actual environment, including:

Determine whether the information of the attacker that can be collected exists in the virtual network of the target attacker;

If the information about the target attacker in the virtual network exists in the information about the attacker that can be collected, according to the information about the target attacker in the virtual network and the information about the attacker that can be collected To obtain information about the target attacker in the actual environment.
The method according to any one of claims 1 to 4, wherein the target attacker is acquired based on the information of the target attacker in the virtual network and the information of the attacker that can be collected. Before the information in the actual environment, it also includes:

The collected information of the attacker is stored in a database; the information of the attacker includes at least one of the following: information of the attacker in the virtual network or information of the attacker in the actual environment.
The method according to claim 7, characterized in that, based on the information of the target attacker in the virtual network and the information of the attacker that can be collected, the information of the target attacker in the actual environment is obtained ,include:

Determine whether the information of the target attacker in the virtual network exists in the database;

If the information of the target attacker in the virtual network exists in the database, the information of the target attacker in the actual environment is obtained from the database according to the information of the target attacker in the virtual network.
The method of claim 8, further comprising:

If the information of the target attacker in the virtual network does not exist in the database, the information of the target attacker in the virtual network is stored in the database.
The method according to claim 7, wherein the database includes: at least one piece of information, and each piece of information includes at least one of the following: information of an attacker in the virtual network, information of the attacker in the actual environment .
The method according to claim 10, characterized in that

The information of any attacker in the virtual network includes at least one of the following: the attacker's identity ID, domain name, IP address, media access control MAC address, attack method, and hacking tool used in the virtual network.
The method according to claim 10, characterized in that

The information of any attacker in the actual environment includes at least one of the following: the identity of the attacker in the actual environment, age, attack record, and the location of the network attack, the background and purpose of the attack.
The method according to claim 10, further comprising:

If the number of information entries included in the database is greater than a preset threshold, the frequency of use of each piece of information in the database is obtained;

Delete the information whose usage frequency is less than the preset frequency.
The method according to claim 13, wherein the deleting the information that the usage frequency is less than the preset frequency includes:

Obtain the user's operation instructions;

According to the user's operation instruction, delete the information whose usage frequency is less than the preset frequency.
An attacker information acquisition device, which is characterized by comprising:

The first acquiring module is configured to acquire information of the target attacker in the actual environment according to the information of the target attacker in the virtual network and the information of the attacker that can be collected.
The device according to claim 15, further comprising:

The second obtaining module is configured to obtain information of the target attacker in the virtual network.
The apparatus according to claim 16, wherein the second acquisition module is configured to:

Obtain the information of the target attacker in the virtual network according to the attack event information corresponding to the target attacker.
The apparatus according to claim 17, wherein the attack event information includes at least one of the following: the name of the attack event, the time when the attack event occurred, the location where the attack event occurred, and the identification information of the attack event.
The device according to any one of claims 15 to 18, wherein the information of the attacker that can be collected includes: information of the attacker that has been collected, or, of the attacker that is not currently collected Information, and information about attackers that can be collected.
The apparatus according to any one of claims 15 to 18, wherein the first acquisition module is configured to:

Determine whether the information of the attacker that can be collected exists in the virtual network of the target attacker;

If the information about the target attacker in the virtual network exists in the information about the attacker that can be collected, according to the information about the target attacker in the virtual network and the information about the attacker that can be collected To obtain information about the target attacker in the actual environment.
The device according to any one of claims 15 to 18, further comprising:

The storage module is configured to store the collected information of the attacker in a database; the information of the attacker includes at least one of the following: information of the attacker in the virtual network or the attacker in the actual environment Information.
The apparatus according to claim 21, wherein the first acquisition module is configured to:

Determine whether the information of the target attacker in the virtual network exists in the database;

If the information of the target attacker in the virtual network exists in the database, the information of the target attacker in the actual environment is obtained from the database according to the information of the target attacker in the virtual network.
The apparatus according to claim 22, wherein the storage module is configured to:

If the information of the target attacker in the virtual network does not exist in the database, the information of the target attacker in the virtual network is stored in the database.
The apparatus according to claim 21, wherein the database includes: at least one piece of information, and each piece of information includes at least one of the following: information of an attacker in a virtual network, information of the attacker in an actual environment .
The device according to claim 24, characterized in that

The information of any attacker in the virtual network includes at least one of the following: the attacker's identity in the virtual network, domain name, IP address, media access control MAC address, attack method, and hacking tools used.
The device according to claim 24, characterized in that

The information of any attacker in the actual environment includes at least one of the following: the identity, age, attack record, and location of the attacker in the actual environment.
The device according to claim 21, further comprising:

The third obtaining module is configured to: if the number of information items included in the database is greater than a preset threshold, obtain the frequency of use of each piece of information in the database;

The processing module is configured to delete information whose usage frequency is less than a preset frequency.
The apparatus according to claim 27, wherein the processing module is configured to:

Obtain the user's operation instructions;

According to the user's operation instruction, delete the information whose usage frequency is less than the preset frequency.
A computer, characterized by comprising the device according to any one of claims 15-28.
An electronic device, characterized in that it includes:

At least one processor; and

A memory communicatively connected to the at least one processor; wherein,

The memory stores instructions executable by the at least one processor, and when the instructions are executed by the at least one processor, causes the at least one processor to perform the method of any one of claims 1-14 .
A computer-readable storage medium, characterized in that computer-executable instructions are stored, and the computer-executable instructions are configured to perform the method of any one of claims 1-14.
A computer program product, characterized in that the computer program product includes a computer program stored on a computer-readable storage medium, the computer program includes program instructions, and when the program instructions are executed by a computer, the computer Performing the method of any one of claims 1-14.