CN106850687A - Method and apparatus for detecting network attack - Google Patents

Abstract

The present application discloses methods and devices for detecting network attacks. A specific implementation of the method includes: determining the traffic characteristic information of the target computer room; determining whether the target computer room is under network attack according to the traffic characteristic information; in response to determining that the target computer room is under network attack, acquiring the data received by the target computer room The request feature information of the request; according to the obtained request feature information, determine the attack source information and/or attack target information of the network attack. This embodiment realizes quickly determining the attack source and/or attack target of the network attack when the target computer room is attacked by the network.

Description

Method and apparatus for detecting network attacks

technical field

The present application relates to the field of computer technology, specifically to the field of Internet technology, and in particular to a method and device for detecting network attacks.

Background technique

A network attack usually refers to an attack on the hardware and software of a network system and the data in the system. The scope of a network attack can range from simply making the server unable to provide normal services to completely destroying and controlling the server. With the rapid development of the Internet, there are more and more ways of network attacks. These network attacks not only affect the quality of network transmission and occupy a large amount of bandwidth resources, but also affect the quality of service provided by servers to users.

However, the existing methods for detecting network attacks usually have the following problem: the speed of determining the attack source information or attack target information of the network attack is relatively slow.

Contents of the invention

The purpose of this application is to propose an improved method and device for detecting network attacks, so as to solve the technical problems mentioned in the background technology section above.

In the first aspect, the embodiment of the present application provides a method for detecting a network attack, the method comprising: determining traffic characteristic information of a target computer room; determining whether the target computer room is under a network attack according to the traffic characteristic information; In response to determining that the target computer room is under a network attack, acquire request characteristic information of a data request received by the target computer room; determine attack source information and/or attack target information of the network attack according to the acquired request characteristic information.

In some embodiments, the request feature information includes at least one of the following: a source IP address from which the data request is sent, a destination IP address to which the data request is sent, and a transport used to transmit the data request. The protocol type of the protocol.

In some embodiments, the determining whether the source IP address is the attack source information according to the determined first traffic includes: for each source IP address in the obtained at least one source IP address , determining the first traffic generated by the data request sent from the source IP address received by the target computer room; and determining whether the source IP address is the attack source information according to the determined first traffic.

In some embodiments, the determining whether the source IP address is the attack source information according to the determined first traffic further includes: for each source IP address in the obtained at least one source IP address Address, in the request feature information of the data request received by the target computer room and sent from the source Internet protocol address, search for the preset protocol type; determine the data request transmitted by the transmission protocol of the found preset protocol type Whether the generated second traffic is greater than a preset second traffic threshold; in response to determining that the second traffic is greater than the preset second traffic threshold, determine that the source IP address is attack source information.

In some embodiments, the determining whether the source IP address is the attack source information according to the determined first traffic further includes: for each source IP address in the obtained at least one source IP address address, in response to determining that the source Internet protocol address is attack source information, obtain at least one destination Internet protocol address in the request feature information of the data request received by the target computer room and sent from the source Internet protocol address; For each destination IP address in the at least one destination IP address, determine whether the third traffic generated by the data request sent to the destination IP address is greater than a preset third traffic threshold; in response to determining that the third traffic is greater than A third traffic threshold is preset to determine that the destination IP address is attack target information.

In some embodiments, the traffic characteristic information includes at least one of the following: current traffic value, traffic value at a predetermined historical moment, and traffic average value within a predetermined time period before the current moment, and a switch is set in the target computer room; And the determining the traffic characteristic information of the target computer room includes: determining the traffic information of the target computer room through the counting information of the switch set in the target computer room, wherein the traffic information includes collection time and flow value; according to the The determined traffic information is to determine the traffic characteristic information.

In some embodiments, the determining whether the target computer room is under network attack according to the traffic feature information includes: importing the traffic feature information into a pre-established traffic anomaly detection model to obtain a The indication information of whether the network attack is received or not, wherein the traffic anomaly detection model is used to characterize the correspondence between the traffic feature information and the indication information.

In some embodiments, the method further includes the step of establishing a traffic anomaly detection model, wherein the step of establishing a traffic anomaly detection model includes: obtaining traffic characteristic information of the target computer room with known indication information; using machine learning The algorithm is based on the acquired traffic feature information and corresponding indication information, and trains the initial model to obtain the traffic anomaly detection model.

In the second aspect, the embodiment of the present application provides a device for detecting a network attack, the device comprising: a traffic characteristic information determination unit, configured to determine the traffic characteristic information of the target computer room; a network attack determination unit, configured to The traffic characteristic information, to determine whether the target computer room is under network attack; the acquisition unit is used to respond to determining that the target computer room is under network attack, and obtain the request characteristic information of the data request received by the target computer room; the attack information determination unit , configured to determine the attack source information and/or attack target information of the network attack according to the acquired request feature information.

In some embodiments, the request feature information includes at least one of the following: a source IP address from which the data request is sent, a destination IP address to which the data request is sent, and a transport used to transmit the data request. The protocol type of the protocol.

In some embodiments, the attack information determining unit is configured to: for each source IP address in at least one source IP address obtained, determine the IP address received by the target computer room and sent from the source IP address. The first traffic generated by the data request of the address; according to the determined first traffic, determine whether the source IP address is the attack source information.

In some embodiments, the attack information determining unit is further configured to: for each source Internet Protocol address in at least one source Internet Protocol address obtained, the information received in the target computer room and sent from the source Internet In the request feature information of the data request of the protocol address, search for the preset protocol type; determine whether the second traffic generated by the data request transmitted by the transmission protocol of the found preset protocol type is greater than the preset second traffic threshold; respond It is determined that the second traffic is greater than a preset second traffic threshold, and it is determined that the source IP address is attack source information.

In some embodiments, the attack information determining unit is further configured to: for each source Internet protocol address in the obtained at least one source Internet protocol address, in response to determining that the source Internet protocol address is attack source information, obtain At least one destination IP address in the request feature information of the data request received by the target computer room and sent from the source IP address; for each destination IP address in the at least one destination IP address, determine Whether the third traffic generated by the data request sent to the destination IP address is greater than the preset third traffic threshold; in response to determining that the third traffic is greater than the preset third traffic threshold, determine that the destination IP address is the attack target information.

In some embodiments, the traffic characteristic information includes at least one of the following: current traffic value, traffic value at a predetermined historical moment, and traffic average value within a predetermined time period before the current moment, and a switch is set in the target computer room; And the flow characteristic information determining unit is configured to: determine the flow information of the target computer room through the counting information of the switch set in the target computer room, wherein the flow information includes collection time and flow value; according to the determined The traffic information is used to determine the traffic feature information.

In some embodiments, the network attack determination unit is configured to: import the traffic feature information into a pre-established traffic anomaly detection model to obtain indication information indicating whether the target computer room is under a network attack, wherein the The traffic anomaly detection model described above is used to characterize the correspondence between traffic feature information and indication information.

In some embodiments, the device further includes an establishment unit configured to establish a traffic anomaly detection model, wherein the establishment of the traffic anomaly detection model includes: obtaining traffic characteristic information of the target computer room with known indication information; using a machine A learning algorithm, based on the acquired traffic feature information and corresponding indication information, trains an initial model to obtain the traffic anomaly detection model.

In a third aspect, an embodiment of the present application provides a device/terminal/server. The device/terminal/server includes: one or more processors; a storage device for storing one or more programs, when the one or more A plurality of programs are executed by the one or more processors, so that the one or more processors implement the method of the first aspect.

In a fourth aspect, the embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, the method in the first aspect is implemented.

The method and device for detecting network attacks provided by the embodiments of the present application determine the traffic characteristic information of the target computer room; determine whether the target computer room is under network attack according to the traffic characteristic information; Network attack, obtaining the request feature information of the data request received by the target computer room; determining the attack source information and/or attack target information of the network attack according to the obtained request feature information, so that the target computer room can be attacked by the network In the event of an attack, quickly determine the source and/or target of a cyber attack.

Description of drawings

Other characteristics, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

FIG. 1 is an exemplary system architecture diagram to which the present application can be applied;

FIG. 2 is a flowchart of an embodiment of a method for detecting a network attack according to the present application;

FIG. 3 is a schematic diagram of an application scenario of a method for detecting a network attack according to the present application;

FIG. 4 is a flowchart of another embodiment of a method for detecting a network attack according to the present application;

FIG. 5 is a schematic structural diagram of an embodiment of a device for detecting network attacks according to the present application;

Fig. 6 is a schematic structural diagram of a computer system suitable for realizing the monitoring server of the embodiment of the present application.

detailed description

The application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain related inventions, rather than to limit the invention. It should also be noted that, for the convenience of description, only the parts related to the related invention are shown in the drawings.

It should be noted that, in the case of no conflict, the embodiments in the present application and the features in the embodiments can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and embodiments. Those skilled in the art will also understand that although terms such as "first", "second" and "third" may be used herein to describe information such as various flow rates and flow thresholds, these flow rates, flow thresholds, etc. should not be limited by these terms. These terms are only used to distinguish one flow, flow threshold, etc. from other flows, flow thresholds, etc.

FIG. 1 shows an exemplary system architecture 100 to which embodiments of the method for detecting a network attack or the device for detecting a network attack of the present application can be applied.

As shown in FIG. 1 , the system architecture 100 may include terminal devices 101 , 102 , 103 , a network 104 , servers 105 , 106 and a monitoring server 107 . The network 104 serves as a medium for providing communication links between the terminal devices 101 , 102 , 103 and the servers 105 , 106 . Network 104 may include various connection types, such as wires, wireless communication links, or fiber optic cables, among others.

It should be noted that the servers 105 and 106 may be located in the same computer room, and the rectangular frame in FIG. 1 is used to represent the above computer room. The monitoring server 107 is used to monitor the above-mentioned computer room. The monitoring server 107 may be located in the above-mentioned computer room, or outside the above-mentioned computer room. The network 104 can also be used as a medium for providing a communication link between the monitoring server 107 and the electronic equipment used for data collection or data storage in the above-mentioned computer room.

The user 110 can use the terminal device 101 , 102 , 103 to interact with the server 105 , 106 through the network 104 to receive or send messages and the like. Various client applications may be installed on the terminal devices 101, 102, and 103, such as mail applications, game applications, instant messaging applications, video playback applications, search engine applications, and the like.

It should be noted that, in the actual scenario of detecting a network attack in this application, the user who initiates the network attack is usually a user who maliciously sends a large amount of data requests. The terminal device utilized by the user may be an electronic device with powerful computing functions, or even a server. Terminal devices 101, 102, 103 can be various electronic devices with display screens and support interactive functions, including but not limited to smart phones, tablet computers, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III, moving picture Expert Compression Standard Audio Layer 3), MP4 (Moving Picture Experts Group Audio Layer IV, Moving Picture Experts Compression Standard Audio Layer 4) Players, Laptop Portable Computers and Desktop Computers, etc.

The servers 105 , 106 may be servers that provide various services, for example, background servers that provide support for the terminal devices 101 , 102 , 103 . The background server can receive the data request from the terminal device, process the data, and feed back the processing result (for example, the request result of the data request) to the terminal device.

The monitoring server 107 may acquire traffic characteristic information and request characteristic information from the electronic equipment used for data collection or data storage in the computer room, and thereby determine the attack source information and/or attack target information of the network attack in the computer room.

It should be noted that the method for detecting a network attack provided by the embodiment of the present application is generally executed by the monitoring server 107 , and correspondingly, the device for detecting a network attack is generally set in the monitoring server 107 .

It should be understood that the numbers of terminal devices, networks, servers and monitoring servers in Fig. 1 are only illustrative. According to the realization requirements, there can be any number of terminal devices, networks, servers and monitoring servers.

Continuing to refer to FIG. 2 , a flow 200 of an embodiment of a method for detecting a network attack according to the present application is shown. The described method for detecting network attacks comprises the following steps:

Step 201, determine traffic characteristic information of a target computer room.

In this embodiment, the electronic device (for example, the monitoring server shown in FIG. 1 ) on which the method for detecting network attacks runs may determine the traffic characteristic information of the traffic of the target computer room monitored by the electronic device.

In this embodiment, the above traffic may be the traffic generated by the data request received by the server in the target computer room and the data sent out. The foregoing traffic may also be traffic generated by data requests received by servers in the target computer room. The foregoing traffic may also be traffic generated as a result of a request sent by a server in the target computer room.

In this embodiment, the traffic feature information may be information used to describe some key elements related to the traffic.

In some optional implementation manners of this embodiment, the traffic characteristic information may include but not limited to: a current traffic value, a traffic value at a predetermined historical moment, and a traffic average value within a predetermined time period before the current moment.

In this embodiment, the above-mentioned monitoring server can obtain traffic characteristic information from some electronic devices used for data collection or data storage in the computer room; the above-mentioned monitoring server can also have the data request received by the monitoring target computer room, and determine the above-mentioned The function of the traffic characteristic information of the traffic generated by the data request, and then obtain the above traffic characteristic information locally.

Step 202, according to the traffic feature information, determine whether the target computer room is under network attack.

In this embodiment, the electronic device on which the method for detecting a network attack (for example, the monitoring server shown in FIG. 1 ) can determine whether the target computer room is under a network attack according to traffic feature information.

It should be noted that determining whether the target computer room is under network attack can be understood as: whether the server set in the target computer room is under network attack. Multiple servers or multiple server clusters can be set up in the target computer room. When the total traffic received by the target computer room is abnormal, it is impossible to immediately determine which server or server cluster in the computer room is under network attack, so it is necessary to quickly locate which server or server cluster in the computer room is under network attack.

In some optional implementations of this embodiment, according to the traffic characteristic information, determining whether the target computer room is under network attack can be achieved in the following manner: determine whether the current traffic value is greater than the preset traffic threshold, and respond to determining whether the current traffic value is greater than Preset the traffic threshold to determine that the above-mentioned target computer room is under network attack.

Step 203, in response to determining that the target computer room is under a network attack, acquire request characteristic information of the data request received by the target computer room.

In this embodiment, the electronic device on which the method for detecting network attacks runs (for example, the monitoring server shown in FIG. 1 ) may respond to determining that the target computer room is subject to a network attack, and acquire the request for the data request received by the target computer room. characteristic information.

In this embodiment, the data request received by the target computer room may be a data request sent to a server in the target computer room. The above request characteristic information of the data request may be used to describe information of some key elements of the data request.

In this embodiment, the above-mentioned monitoring server may acquire request characteristic information from some electronic devices used for data collection or data storage in the computer room. The above-mentioned monitoring server may also have the function of monitoring the data requests received by the target computer room and extracting the request characteristic information, and then obtain the above-mentioned request characteristic information locally.

In some optional implementations of this embodiment, the above request feature information may include but not limited to: the source Internet Protocol (Internet Protocol, IP) address from which the data request is sent, the destination Internet address to which the data request is sent protocol address, the source media access control (Media Access Control, MAC) address from which the data request is sent, the destination media access control address to which the data request is sent, the protocol type of the transmission protocol used to transmit the data request, The number of bytes requested for the data. It should be noted that the IP address may be a virtual Internet Protocol address (Virtual Internet Protocol Address, VIP).

In some optional implementation manners of this embodiment, the foregoing protocol types include but are not limited to Transmission Control Protocol (Transmission Control Protocol, TCP) and User Datagram Protocol (User Datagram Protocol, UDP). It should be noted that the source IP address may also be called the source IP address, the destination IP address may also be called the destination IP address, the source media access control may also be called the source MAC address, and the destination media access control address may also be called Destination MAC address.

It should be noted that one data request may correspond to one request characteristic information used to describe the data request. It is also possible that multiple data requests correspond to one piece of request characteristic information used to describe the above multiple data requests.

Step 204: Determine attack source information and/or attack target information of the network attack according to the acquired request characteristic information.

In this embodiment, the electronic device on which the method for detecting a network attack runs (such as the monitoring server shown in FIG. 1 ) can determine the attack source information and/or attack target of the network attack from the acquired request feature information. information.

In this embodiment, the attack source information may be information indicating the attack source, and the attack source may be an electronic device such as a terminal or a server that users use to carry out network attacks. The above attack source information may include, but is not limited to, the Internet Protocol address, media access control address. The attack target information may be information used to indicate the attack target. The attack target may be the server where the website or service targeted by the network attack is located. The above attack target information may be the IP address or the media access control address.

It should be noted that, in practical applications, only the attack source information and/or the attack target information may be acquired, instead of performing positioning based on the attack source information and/or attack target information to determine the attack source and/or attack target.

In some optional implementation manners of this embodiment, after the attack source information is determined, the data request with the attack source information may be shielded, so as to prevent the attack of the attack source in time.

In some optional implementation manners of this embodiment, the attack source information of the network attack may be determined according to the acquired request feature information. The attack target information of the network attack may be determined according to the acquired request feature information. The attack source information and attack target information of the network attack may be determined according to the acquired request feature information.

In some optional implementation manners of this embodiment, step 204 may be implemented in the following manner: for each source Internet Protocol address in the obtained at least one source Internet Protocol address, determine the received, sent The first flow generated by the data request from the source IP address. In response to determining that the determined first traffic is greater than a preset first traffic threshold, it is determined that the source IP address is the attack source information. In response to determining that the source IP address is the attack source information, it is determined that the destination IP address to which the data request received by the target computer room and sent from the source IP address is sent is the attack target information. It should be noted that how to determine the traffic generated by the data request is well known to those skilled in the art, and will not be repeated here.

Continuing to refer to FIG. 3 , FIG. 3 is a schematic diagram of an application scenario of the method for detecting network attacks according to this embodiment. In the application scenario of FIG. 3 , the traffic generated by the data requests sent by the terminal 301 and the terminal 302 to the destination computer room is normal, and the traffic generated by the data request sent by the terminal 303 to the destination computer room is abnormal. Users conducting malicious network attacks can use the terminal 303 with powerful computing functions to send data requests to the server in the target computer room; the monitoring server obtains the traffic characteristic information of the target computer room; after that, the monitoring server can determine the target computer room based on the above traffic characteristic information Whether it is under network attack; then, the above-mentioned monitoring server can respond to determining that the target computer room is subject to a network attack, and obtain the request characteristic information of the data request received by the target computer room; finally, the above-mentioned monitoring server can determine the attack source information according to the above-mentioned request characteristic information ( For example, the IP address of the terminal 303) and/or attack target information (such as the virtual IP address of a server cluster in the computer room).

In the method provided by the above-mentioned embodiments of the present application, by determining the traffic characteristic information of the target computer room; according to the traffic characteristic information, determining whether the target computer room is under network attack; in response to determining that the target computer room is under network attack, obtaining the The request characteristic information of the data request received by the target computer room; according to the obtained request characteristic information, determine the attack source information and/or attack target information of the network attack, so that when the target computer room is under a network attack, quickly determine the network The source and/or target of the attack.

Further referring to FIG. 4 , it shows a flow 400 of still another embodiment of the method for detecting network attacks. The process 400 of the method for detecting network attacks includes the following steps:

Step 401, determine traffic characteristic information of a target computer room.

In this embodiment, the electronic device on which the method for detecting network attacks runs (for example, the monitoring server shown in FIG. 1 ) can determine the traffic feature information of the target computer room.

In this embodiment, the traffic characteristic information may include but not limited to: current traffic value, traffic value at a predetermined historical moment, and traffic average value within a predetermined time period before the current moment.

In some optional implementation manners of this embodiment, a switch is set in the target computer room, and step 401 may be implemented in the following manner: determine the flow rate of the target computer room through the counting information of the switch set in the target computer room information, wherein the flow information includes collection time and flow value; and the flow feature information is determined according to the determined flow information.

In some optional implementation manners of this embodiment, the flow information of the target equipment room is determined through the counting information of the switch set in the target equipment room, which may be achieved in the following manner: acquiring the counter information of the counter on the switch, The difference of the technical switch information collected at different times is taken as the flow value passing through the switch.

It should be noted that the number of switches set in the target computer room can be one or more. If multiple switches are set in the target computer room, the flow information of the target computer room is determined through the count information of all switches.

In some optional implementation manners of this embodiment, multiple electronic devices may be set to collect the counter information of the counter on the switch of the switch. In particular, the above-mentioned multiple electronic devices may be deployed in a load balancing manner, so that each electronic device among the above-mentioned multiple electronic devices does not appear to be overloaded. Alternatively, if one of the above multiple electronic devices fails, other electronic devices can replace the faulty electronic device. This method of load-balanced deployment of multiple electronic devices for collection can avoid single point failures and prevent data loss.

In some optional implementations of this embodiment, the flow feature information can be determined according to the determined flow information, which can be achieved in the following manner: the current flow value and the flow value at a predetermined historical moment can be determined through the collection time; The above-mentioned flow average value can be obtained by summing and averaging the flow values in the predetermined time period before the current moment.

Step 402, importing the traffic feature information into the pre-established traffic anomaly detection model to obtain indication information for indicating whether the target computer room is under network attack.

In this embodiment, the electronic device on which the method for detecting network attacks runs (such as the monitoring server shown in Figure 1 ) can import the traffic feature information into the pre-established traffic anomaly detection model, and obtain the information used to indicate the target computer room. An indication of whether it is under cyber attack. Here, the traffic anomaly detection model is used to characterize the correspondence between traffic feature information and indication information.

In some optional implementations of this embodiment, this implementation may also include the step of establishing a traffic anomaly detection model, wherein the step of establishing a traffic anomaly detection model includes: obtaining the known indication information of the target computer room Traffic feature information: using a machine learning algorithm to train an initial model based on the acquired traffic feature information and corresponding indication information to obtain the traffic anomaly detection model. Here, the initial model may be a model that can be used for classification, for example, a convolutional neural network model, a random forest model, an error backpropagation error neural network model, and the like.

Step 403, in response to determining that the target computer room is under a network attack, acquire request characteristic information of the data request received by the target computer room.

In this embodiment, the electronic device on which the method for detecting a network attack runs (for example, the monitoring server shown in FIG. 1 ) may respond to determining that the target computer room is under a network attack, and obtain the The request characteristic information of the data request.

In this embodiment, the request characteristic information may include but not limited to: the source IP address from which the data request is sent, the destination IP address to which the data request is sent, and the transmission protocol used to transmit the data request The protocol type and the number of bytes of the data request. For implementation details and technical effects of step 403, reference may be made to the description in step 203, which will not be repeated here.

Step 404: Determine the attack source information and attack target information of the network attack according to the acquired request characteristic information.

In this embodiment, the electronic device on which the method for detecting a network attack runs (such as the monitoring server shown in FIG. 1 ) can determine the attack source information and attack target information of the network attack according to the acquired request feature information. .

In some optional implementation manners of this embodiment, step 404 may be implemented in the following manner: for each source Internet Protocol address in the obtained at least one source Internet Protocol address, determine the received, sent The first flow generated by the data request from the source IP address. According to the determined first flow, determine whether the source IP address is the attack source information.

In some optional implementations of this embodiment, step 404 may be implemented in the following manner: for each source Internet Protocol address in the obtained at least one source Internet Protocol address, the received and sent Find the default protocol type from the request characteristic information of the data request of the source IP address. It is determined whether the second flow generated by the data request transmitted by using the found transmission protocol of the preset protocol type is greater than a preset second flow threshold. In response to determining that the second traffic is greater than a preset second traffic threshold, it is determined that the source IP address is attack source information. As an example, here, the preset protocol type may be UDP.

In some optional implementations of this embodiment, step 404 may be implemented in the following manner: for each source IP address in at least one source IP address obtained, in response to determining that the source IP address is an attack The source information is used to obtain at least one destination IP address in the request characteristic information of the data request received by the target computer room and sent from the source IP address. For each destination IP address in the at least one destination IP address, determine whether the third traffic generated by the data request sent to the destination IP address is greater than a preset third traffic threshold. In response to determining that the third traffic is greater than a preset third traffic threshold, it is determined that the destination IP address is attack target information.

As can be seen from FIG. 4 , compared with the embodiment corresponding to FIG. 2 , the process 400 of the method for detecting network attacks in this embodiment highlights the use of a pre-established traffic anomaly detection model to determine whether the target computer room is under network attack A step of. Therefore, the solution described in this embodiment can realize faster and more accurate determination of whether the target computer room is attacked by the network, and then determine the attack source information and attack target information more quickly.

Further referring to FIG. 5 , as an implementation of the methods shown in the above figures, the present application provides an embodiment of a device for detecting network attacks, which corresponds to the method embodiment shown in FIG. 2 , The device can be specifically applied to various electronic devices.

As shown in FIG. 5 , the apparatus 500 for detecting network attacks described in this embodiment includes: a traffic characteristic information determining unit 501 , a network attack determining unit 502 , an acquiring unit 503 and an attack information determining unit 504 . Wherein, the traffic characteristic information determination unit 501 is used to determine the traffic characteristic information of the target computer room; the network attack determination unit 502 is used to determine whether the target computer room is under a network attack according to the traffic characteristic information; the acquisition unit 503 is used to In response to determining that the target computer room is under a network attack, acquire request characteristic information of the data request received by the target computer room; the attack information determining unit 504 is configured to determine the attack source of the network attack according to the acquired request characteristic information information and/or target information.

In this embodiment, the specific processing of the traffic characteristic information determination unit 501, the network attack determination unit 502, the acquisition unit 503, and the attack information determination unit 504 of the device 500 can refer to step 201, step 202, and step 203 and step 204, which will not be repeated here.

In some optional implementations of this embodiment, the request characteristic information includes at least one of the following: the source IP address from which the data request is sent, the destination IP address to which the data request is sent, the The protocol type of the transport protocol utilized by the data request.

In some optional implementation manners of this embodiment, the attack information determining unit is configured to: for each source Internet Protocol address in the obtained at least one source Internet Protocol address, determine the . First flow generated by the data request sent from the source Internet Protocol address; according to the determined first flow, determine whether the source Internet Protocol address is the attack source information.

In some optional implementation manners of this embodiment, the attack information determining unit is further configured to: for each source Internet Protocol address in at least one source Internet Protocol address obtained, In the request feature information of the data request sent from the source Internet protocol address, search for the preset protocol type; determine whether the second traffic generated by the data request transmitted by the transmission protocol of the found preset protocol type is greater than the preset A second traffic threshold: in response to determining that the second traffic is greater than a preset second traffic threshold, determine that the source IP address is attack source information.

In some optional implementations of this embodiment, the attack information determining unit is further configured to: for each source IP address in the obtained at least one source IP address, in response to determining the source IP address The address is the attack source information, obtain at least one destination IP address in the request feature information of the data request received by the target computer room and sent from the source IP address; for each of the at least one destination IP address a destination IP address, determine whether the third traffic generated by the data request sent to the destination IP address is greater than a preset third traffic threshold; in response to determining that the third traffic is greater than a preset third traffic threshold, determine the third traffic The destination IP address is attack target information.

In some optional implementations of this embodiment, the traffic feature information includes at least one of the following: current traffic value, traffic value at a predetermined historical moment, and traffic average value within a predetermined time period before the current moment, the A switch is set in the target computer room; and the flow characteristic information determination unit is configured to: determine the flow information of the target computer room through the counting information of the switch set in the target computer room, wherein the flow information includes collection time and a flow value; according to the determined flow information, determine the flow characteristic information.

In some optional implementations of this embodiment, the traffic feature information is imported into a pre-established traffic anomaly detection model to obtain indication information indicating whether the target computer room is under network attack, wherein the traffic anomaly The detection model is used to characterize the correspondence between traffic feature information and indication information.

In some optional implementations of this embodiment, the device further includes an establishment unit (not shown), configured to establish a traffic anomaly detection model, wherein the establishment of the traffic anomaly detection model includes: acquiring known indication information The traffic feature information of the target computer room; using a machine learning algorithm, based on the acquired traffic feature information and corresponding indication information, training an initial model to obtain the traffic anomaly detection model.

For implementation details and technical effects of each unit of the device provided in this embodiment, reference may be made to descriptions in other embodiments of the present application, and details are not repeated here.

Referring now to FIG. 6 , it shows a schematic structural diagram of a computer system 600 suitable for implementing the server of the embodiment of the present application. The server shown in FIG. 6 is only an example, and should not limit the functions and scope of use of this embodiment of the present application.

As shown in FIG. 6 , a computer system 600 includes a central processing unit (CPU) 601 that can be programmed according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage section 608 into a random-access memory (RAM) 603 Instead, various appropriate actions and processes are performed. In the RAM 603, various programs and data necessary for the operation of the system 600 are also stored. The CPU 601 , ROM 602 , and RAM 603 are connected to each other via a bus 604 . An input/output (I/O) interface 605 is also connected to the bus 604 .

The following components are connected to the I/O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage section 608 including a hard disk, etc. and a communication section 609 including a network interface card such as a LAN card, a modem, or the like. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I/O interface 605 as needed. A removable medium 611 such as a magnetic disk, optical disk, magneto-optical disk, semiconductor memory, etc. is mounted on the drive 610 as necessary so that a computer program read therefrom is installed into the storage section 608 as necessary.

In particular, according to an embodiment of the present disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product, which includes a computer program carried on a computer-readable medium, where the computer program includes program codes for executing the methods shown in the flowcharts. In such an embodiment, the computer program may be downloaded and installed from a network via communication portion 609 and/or installed from removable media 611 . When the computer program is executed by the central processing unit (CPU) 601, the above-mentioned functions defined in the method of the present application are performed.

It should be noted that the computer-readable medium described in this application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the two. A computer readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to, electrical connections with one or more wires, portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable Programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, however, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, in which computer-readable program codes are carried. Such propagated data signals may take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device. . Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present application. In this regard, each block in a flowchart or block diagram may represent a module, program segment, or portion of code that contains one or more logical functions for implementing specified executable instructions. It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or they may sometimes be executed in the reverse order, depending upon the functionality involved. It should also be noted that each block of the block diagrams and/or flowchart illustrations, and combinations of blocks in the block diagrams and/or flowchart illustrations, can be implemented by a dedicated hardware-based system that performs the specified functions or operations , or may be implemented by a combination of dedicated hardware and computer instructions.

The units described in the embodiments of the present application may be implemented by software or by hardware. The described unit may also be set in a processor, for example, it may be described as: a processor includes a traffic characteristic information determining unit, a network attack determining unit acquiring a unit, and an attack information determining unit. Wherein, the names of these units do not limit the unit itself under certain circumstances, for example, the traffic feature information determining unit may also be described as "the unit for determining the traffic feature information of the target computer room".

As another aspect, the present application also provides a computer-readable medium. The computer-readable medium may be included in the device described in the above embodiments, or it may exist independently without being assembled into the device. The above-mentioned computer-readable medium carries one or more programs, and when the above-mentioned one or more programs are executed by the device, the device: determines the traffic characteristic information of the target computer room; determines the target computer room according to the traffic characteristic information Whether it is under network attack; in response to determining that the target computer room is under network attack, obtain the request characteristic information of the data request received by the target computer room; determine the attack source information of the network attack and/or according to the obtained request characteristic information or attack target information.

The above description is only a preferred embodiment of the present application and an illustration of the applied technical principle. Those skilled in the art should understand that the scope of the invention in this application is not limited to the technical solution formed by the specific combination of the above-mentioned technical features, and should also cover the technical solutions formed by the above-mentioned technical features or Other technical solutions formed by any combination of equivalent features. For example, a technical solution formed by replacing the above-mentioned features with technical features with similar functions disclosed in this application (but not limited to).

Claims (11)

1. a kind of method for detecting network attack, it is characterised in that methods described includes：

Determine the traffic characteristic information of target computer room；

According to the traffic characteristic information, determine whether the target computer room is subject to network attack；

In response to determining that the target computer room is subject to network attack, the request of the request of data that the target computer room is received is obtained Characteristic information；

According to acquired request characteristic information, the attack source information and/or target of attack information of the network attack are determined.

2. method according to claim 1, it is characterised in that the request characteristic information include it is following at least one：Institute State request of data from source internet protocol address, the request of data be sent to purpose internet protocol address, transmit the number According to the protocol type for asking utilized host-host protocol.

3. method according to claim 2, it is characterised in that the request characteristic information acquired in the basis, determines institute The attack source information and/or target of attack information of network attack are stated, including：

For each the source internet protocol address at least one acquired source internet protocol address, the target computer room is determined First flow produced by request of data receiving, from the source internet protocol address；According to identified first flow, Determine whether the source internet protocol address is the attack source information.

4. method according to claim 3, it is characterised in that first flow determined by the basis, determines the source net Whether internet protocol address is the attack source information, is also included：

For each the source internet protocol address at least one acquired source internet protocol address, connect in the target computer room In the request characteristic information of request of data receiving, from the source internet protocol address, preset protocol type is searched；It is determined that sharp Whether the second flow produced by request of data transmitted with the host-host protocol of the preset protocol type for finding is more than default the Two flow thresholds；In response to determining that the second flow is more than default second flow threshold value, determine that the source internet protocol address is Attack source information.

5. method according to claim 4, it is characterised in that the request characteristic information acquired in the basis, determines institute The attack source information and/or target of attack information of network attack are stated, is also included：

For each the source internet protocol address at least one acquired source internet protocol address, in response to determining the source net , to attack source information, obtaining data that the target computer room is received, from the source internet protocol address please for internet protocol address At least one of request characteristic information asked purpose internet protocol address；For the internet protocol address of at least one mesh In each purpose internet protocol address, it is determined that the 3rd flow being sent to produced by the request of data of the purpose internet protocol address Whether more than default 3rd flow threshold；In response to determining that the 3rd flow is more than default 3rd flow threshold, the mesh is determined Internet protocol address be target of attack information.

6. the method according to any one of claim 1-5, it is characterised in that the traffic characteristic information include it is following extremely One item missing：Flow in present flow rate value, the flow value at order history moment, the predetermined amount of time before current time is average Value, interchanger is provided with the target computer room；And

The traffic characteristic information for determining target computer room, including：

The count information of the interchanger by being set in the target computer room, determines the flow information of the target computer room, wherein, The flow information includes acquisition time and flow value；

According to identified flow information, the traffic characteristic information is determined.

7. method according to claim 6, it is characterised in that described according to the traffic characteristic information, determines the mesh Whether mark computer room is subject to network attack, including：

The traffic characteristic information is imported the Traffic anomaly detection model for pre-building, is obtained for indicating the target computer room Whether the configured information of network attack is subject to, wherein, the Traffic anomaly detection model is used to characterize traffic characteristic information and refer to Show the corresponding relation between information.

8. method according to claim 7, it is characterised in that methods described also includes setting up Traffic anomaly detection model Step, wherein, it is described to include the step of set up Traffic anomaly detection model：

Obtain the traffic characteristic information of the target computer room of known configured information；

Using machine learning algorithm, based on acquired traffic characteristic information and corresponding configured information, training initial model is obtained To the Traffic anomaly detection model.

9. a kind of device for detecting network attack, it is characterised in that described device includes：

Traffic characteristic information determination unit, the traffic characteristic information for determining target computer room；

Network attack determining unit, for according to the traffic characteristic information, determining whether the target computer room is attacked by network Hit；

Acquiring unit, in response to determining that the target computer room is subject to network attack, obtaining what the target computer room was received The request characteristic information of request of data；

Information determination unit is attacked, for the request characteristic information acquired in basis, the attack source letter of the network attack is determined Breath and/or target of attack information.

10. a kind of server, it is characterised in that the server includes：

One or more processors；

Storage device, for storing one or more programs,

When one or more of programs are by one or more of computing devices so that one or more of processor realities The existing method as described in any in claim 1-8.

A kind of 11. computer-readable recording mediums, are stored thereon with computer program, it is characterised in that the program is by processor The method as described in any in claim 1-8 is realized during execution.