WO2014146453A1 - 网络设备的安全预警方法、装置及存储介质 - Google Patents

网络设备的安全预警方法、装置及存储介质 Download PDF

Info

Publication number
WO2014146453A1
WO2014146453A1 PCT/CN2013/088306 CN2013088306W WO2014146453A1 WO 2014146453 A1 WO2014146453 A1 WO 2014146453A1 CN 2013088306 W CN2013088306 W CN 2013088306W WO 2014146453 A1 WO2014146453 A1 WO 2014146453A1
Authority
WO
WIPO (PCT)
Prior art keywords
network device
time
time node
attacked
preset threshold
Prior art date
Application number
PCT/CN2013/088306
Other languages
English (en)
French (fr)
Inventor
刘恩辉
沈艳慧
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Publication of WO2014146453A1 publication Critical patent/WO2014146453A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/069—Management of faults, events, alarms or notifications using logs of notifications; Post-processing of notifications

Definitions

  • the present invention relates to the field of network device security technologies, and in particular, to a network device security early warning method, device, and storage medium. Background technique
  • the commonly used network equipment security early warning systems are mainly based on the coverage rate of the entire network, and the information display of the early warning system is mostly static, and the security information of the network environment in which the current network equipment is located cannot be dynamically displayed in real time. Therefore, when the network environment in which the current network device is located is exploding a high-risk virus and the early warning system cannot clear the high-risk virus or perform system repair in time, the user may find it difficult to timely take effective measures to deal with it, and thus cannot effectively protect the network. The safety of the equipment. Summary of the invention
  • the embodiment of the invention provides a security early warning method, device and storage medium for a network device, which aims to solve the problem that the early warning information of the network device cannot be dynamically displayed in real time.
  • the embodiment of the invention discloses a security early warning method for a network device, which comprises the following steps: intercepting an event that poses a security threat to the network device;
  • the information of the intercepted event that poses a security threat to the network device is recorded in real time, and the information includes the number of times the network device is attacked by the event that constitutes the security threat;
  • the embodiment of the invention further discloses a security warning device for a network device, which comprises: An interception module, configured to intercept an event that poses a security threat to a network device;
  • a recording module configured to record, in real time, the intercepted information of an event that poses a security threat to the network device, where the attack information includes a number of times the network device is attacked by the event that constitutes the security threat; and a display module, configured to determine each time node Whether the number of times the network device is attacked reaches a preset threshold; if the number of attacks on the network device at the determined time node reaches a preset threshold, an alert message corresponding to the time node is sent.
  • the embodiment of the invention further discloses a storage medium comprising computer executable instructions, which are used to execute a security warning method of a network device when executed by a computer processor, the method comprising the following steps:
  • the information of the intercepted event that poses a security threat to the network device is recorded in real time, and the information includes the number of times the network device is attacked by the event that constitutes the security threat;
  • the embodiment of the present invention records the event of the security threat that the network device poses by intercepting the event that poses a security threat to the network device, and determines whether the number of attacks on the network device at the time node reaches a preset threshold, if it is determined On the time node, the number of attacks on the network device reaches a preset threshold, and the warning information corresponding to the time node is sent, thereby realizing the beneficial effect of dynamically displaying the protection state to the network device in real time, and improving the interaction capability with the network device.
  • FIG. 1 is a schematic flowchart of an embodiment of a security alerting method for a network device according to the present invention
  • FIG. 2 is a schematic diagram of timeline alert information display in an embodiment of a security alerting method for a network device provided by the present invention
  • FIG. 3 is a schematic diagram showing time axis security state information display in an embodiment of a security alert method for a network device provided by the present invention
  • FIG. 4 is a functional block diagram of an embodiment of a security alerting device for a network device provided by the present invention.
  • FIG. 5 is a schematic diagram of functional modules of still another embodiment of a security alerting device for a network device according to the present invention.
  • the implementation, functional features and advantages of the present invention will be further described with reference to the accompanying drawings. detailed description
  • FIG. 1 is a flow of an embodiment of a security alerting method for a network device according to the present invention.
  • the server may include a storage device, a processing device, and a display device.
  • the software program of the method can be stored in a storage device and executed by the processing device.
  • the display device provides an interface for displaying security warning information for the network device.
  • the security warning method for a network device according to an embodiment of the present invention includes the following steps:
  • Step S01 intercepting an event that poses a security threat to the network device
  • the server side monitors the security of the network device in real time, and intercepts the event (such as a malicious attack) that poses a security threat to the network device.
  • the server side identifies various information that may pose a threat to the security of the network device, and directly intercepts the above-mentioned malicious attack and the like that pose a security threat to the network device. For example, if the server detects that the malicious attack is a high-level attack such as a registry of a network device, the malicious attack is directly intercepted.
  • the server can determine whether the information transmitted on the network poses a threat to the security of the network device according to the virus database information stored in the database related to malicious attacks such as Trojans and worms, wherein the virus database information changes with the network information. Keep updating.
  • the server When the server detects that a network event in the network may pose a threat to the security of the network device, it may also send a prompt message to the network device for the network device to select whether to intercept the network event. For example, when the network device is ready to install a professional software, and the professional software needs to access a specific link on the network to obtain the network software, the server sends a reminder message to the network device whether to allow the network access. Device Selection.
  • step S02 the information of the intercepted event that poses a security threat to the network device is recorded in real time; the server side records in real time the information of the intercepted event that poses a security threat to the network device, such as the attack information of the malicious attack.
  • the recorded information about the events that pose a security threat to the network device includes: the time of attacking the network device, the number of attacks, the type of attack, and the specific location of the attacking network device (such as attacking the registry of the network device, attacking the chat tool on the network device) Attack network Prepare a specific type of file, etc.), the level of danger of the attack, and the number of attacks.
  • the server can dynamically update the virus database information according to the information recorded above. At the same time, the information recorded above is also an important basis for the subsequent display of the network device status to the network device in real time.
  • Step S03 determining whether the number of attacks on the network device at each time node reaches a preset threshold; if yes, executing step S04; if not, executing step S05;
  • Step S04 Sending an early warning message corresponding to the time node.
  • Step S05 Send security status information corresponding to the time node.
  • the server determines whether the number of attacks on the network device at each time node reaches a preset threshold according to the recorded information of the intercepted event that poses a security threat to the network device. If the number of times the network device is attacked reaches a preset threshold, the server sends an early warning message corresponding to the time node, and displays the warning information on the display device of the network device to prompt the network device to perform the timely operation. If the number of times the network device is attacked does not reach the preset threshold, the server side displays the security status information corresponding to the time node to the network device in real time. Of course, when the number of times the network device is attacked does not reach the preset threshold, the server may not send any information to the network device, because in the current state, the event intercepted by the server does not constitute sufficient security for the network device. Threat.
  • the step S02 of recording the intercepted information of the event that constitutes the security threat to the network device is recorded in real time before the step S03 of determining whether the number of times the network device is attacked reaches the preset threshold at each time node is performed.
  • the server needs to perform the steps of: setting a time axis according to a preset time period, and correspondingly speaking, according to the time position of the time node in the preset time period, at the time node corresponding to the time axis. mark.
  • step of the server side performing the setting time axis and correspondingly marking at the corresponding time node may also be before the execution of step SO1, and in each subsequent real-time process, intercepting the event that poses a security threat to the network device each time. When you do not need to perform the steps to set the time axis.
  • the preset time period may be set by the server by default (for example, set to 24 hours), or may be set by the server according to the specific requirements of the network device.
  • corresponding time nodes may be uniformly set on the time axis according to a preset time interval, for example, on a time axis with a time period of 24 hours, an average time interval is set every half hour.
  • each time node may also be non-uniformly set according to a preset duration. For example, when the network device is in a network state, a relatively dense time node is set, for example, one every ten minutes is set.
  • Time node When the device is in the disconnected state, set a sparse time node, such as setting a time node every hour.
  • This embodiment does not limit the specific setting manner when setting the time node on the time axis.
  • the server side sets the time node on the time axis, according to the time position of each time node in the preset time period, the corresponding mark is corresponding to the time node on the time axis.
  • the server in order to avoid waste of resources, can gradually set the mark at the corresponding time node on the time axis according to the advancement of time. For example, during the preset time period, on the time axis, only the corresponding time nodes less than or equal to the current time node should be marked.
  • the shape of the corresponding mark of the corresponding time node ⁇ 1 on the time axis may be a circle, a pentagonal star, a triangle or a polygon, etc., and the specific shape of the mark is not limited in this embodiment. In a preferred embodiment, the mark shape corresponding to the set time node is circular.
  • the size of the tag corresponding to each time node may be associated with the number of times the network device is attacked on the time node, so that each time node The size of the corresponding tag is obtained according to the number of times the network device is attacked at the time node; and the size of the tag corresponding to each time node is proportional to the number of times the network device is attacked at this time, that is, the network device at the time node The more times the attack is performed, the greater the target of the time node.
  • different colors can be set for the tags of each time node corresponding to the time axis. For example, when the number of times the network device is attacked on the determined time node does not reach the preset threshold, the color of the mark corresponding to the time node on the time axis is the first color; when the network device on the determined time node is When the number of attacks reaches or exceeds a preset threshold, the color of the mark corresponding to the time node on the time axis is the second color; and the second color and the first color are two different colors. For example, you can set the first color to be blue and the second color to be red; or, to set the first color to green and the second color to orange.
  • the preset threshold may be set according to the previously intercepted information of the event that poses a security threat to the network device.
  • the setting manner of the preset threshold may be: according to the distribution of the number of attacks of the network device in the information of the event that poses a security threat to the network device recorded by the server in a certain period of time, fitting the network The number of times the device was attacked and the curve of the time period; The curve of the fit; combined with the analysis result and the information contained in the recorded information, the information about the carrying capacity of the network device after the number of attacks reaches a certain value, the preset threshold is set, so that the network device can operate normally.
  • the setting manner of the preset threshold is: fitting the distribution of the number of times the network device recorded by the server in the past year is attacked, and fitting a normal distribution curve; analyzing each time on the normal distribution curve The number of attacks of the network device corresponding to the node and the running status information of the network device under the number of attacks, to find the critical value of the number of times the network device can be attacked; set the threshold to a preset threshold, or to ensure The network device can be operated normally and smoothly.
  • the preset threshold can be set to be smaller than the threshold, or the preset threshold is set according to the actual needs of the network device.
  • the early warning information corresponding to the time node is sent.
  • the warning information may be displayed by a display device of the network device to prompt the network device to perform timely processing.
  • the server may send the warning information to all network devices currently in the network, or may send the warning information only to certain network devices, for example, only some network devices that do not have anti-virus software installed or have no virus killing function enabled. Issue an alert message corresponding to the time node.
  • the scope of the early warning information sent by the server is not specifically limited in this embodiment.
  • the warning information includes specific color information representing a dangerous state of the current time node, a number of times the network device is attacked, and dangerous prompt information corresponding to the time node, and the dangerous prompt information may be displayed in a text form or in the form of an identifier. Show, such as showing a red exclamation mark.
  • the manner in which the server sends the early warning information is not specifically limited in this embodiment.
  • the manner in which the server sends the warning information may include: prompting the prompt information of the network device in the current network environment where the network device may have a large security threat directly on the display interface of the network device; or, the size of the mark corresponding to each time node on the time axis and Color to display the protection status of the network environment where the network device is currently located. Referring to FIG.
  • FIG. 2 is a schematic diagram showing the display of early warning information corresponding to a certain time node in an embodiment of the security early warning method of the network device provided by the present invention.
  • the shape of the mark corresponding to each time node is set to a circle; the size of the mark corresponding to the time node on the time axis reflects the number of times the network device is attacked at the time node, and the network device is The more times the node is attacked at this time, the larger the mark corresponding to the time node displayed on the time axis.
  • the specific color and size are used to display the warning information corresponding to the time node.
  • the corresponding time shown in FIG. 2 is 18.
  • the time node of :30 the number of times the network device is attacked reaches the preset threshold, then the time node corresponds to The tag and the time axis of the time node are displayed in red, and the network device is prompted to perform corresponding protection operations.
  • the prompt may be: automatically popping up an operation button for performing full disk killing on the network device, prompting the network device to perform full-disk antivirus; or, prompting the network device that the Internet currently has a large number of new high-risk vulnerabilities, and has not yet found effective
  • the way to repair the above high-risk vulnerabilities is to remind the network device to avoid the risky access to the Internet.
  • the server dynamically displays the number of times the network device corresponding to each time node of the network device is attacked and the corresponding protection status.
  • the server can dynamically and dynamically in the form of a floating small window on the network device interface. Shows the number of attacks on blocked viruses or malicious URLs. If, at a certain time, the server determines that the number of times the network device is attacked does not reach the preset threshold, the server sends a security status information corresponding to the time node.
  • the security status information includes the number of times the network device is attacked and the specific color information that represents the security status of the current node.
  • FIG. 3 is a schematic diagram showing the security status information corresponding to a certain time node in an embodiment of the security alerting method for a network device according to the present invention.
  • the shape of the mark corresponding to each time node shown in Fig. 3 is set to a circle.
  • the server determines that the number of attacks on the network device corresponding to each time node on the time axis has not reached the preset threshold, and uses the mark corresponding to the display color and size of the warning information corresponding to each time node.
  • the time axis of the security status information and the corresponding mark of each time node are displayed in blue.
  • the network device can acquire the number of attacks of the intercepted event that poses a security threat to the network device recorded by the server at any time node. As shown in Figure 3, if the server receives a request from the network device to obtain the number of attacks corresponding to the time node of 18:30, the server-side record is directly displayed on the corresponding flag of the node at 18:30. The relevant information intercepted on the node at that time "you clicked on the network device butler has intercepted the virus 2014".
  • FIG. 4 is a schematic diagram of functional modules of an embodiment of a security alerting device for a network device according to the present invention.
  • the security early warning device of the network device includes: an intercepting module 01, a recording module 02, and a display module 03.
  • the interception module 01 is configured to intercept an event that poses a security threat to the network device.
  • the interception module 01 monitors the security of the network device in real time, and intercepts the event (such as a malicious attack) that poses a security threat to the network device.
  • the interception module 01 identifies various information that may pose a threat to the security of the network device, and directly intercepts events such as malicious attacks that pose a security threat to the network device. For example, the interception module 01 detects that the malicious attack is a high-risk attack such as a registry of a network device, and directly intercepts the malicious attack. The interception module 01 can determine whether the information transmitted on the network poses a threat to the security of the network device according to the virus database information stored in the database related to malicious attacks such as Trojans and worms, wherein the virus database information changes rapidly with the network information. And constantly update.
  • the interception module 01 When the interception module 01 monitors that a network event in the network may pose a threat to the security of the network device, it may also send a prompt message to the network device for the network device to select whether to intercept the network event. For example, when the network device is ready to install a professional software, and the professional software needs to access a specific link on the network to obtain, the intercepting module 01 sends a reminder message to the network device whether to allow the network access. Network device selection.
  • the recording module 02 is configured to record in real time information of the intercepted event that poses a security threat to the network device.
  • the recording module 02 records the interception of the event that poses a security threat to the network device, such as the attack information of the malicious attack.
  • the recorded information about the events that pose a security threat to the network device includes: the time of attacking the network device, the number of attacks, the type of attack, and the specific location of the attacking network device (such as attacking the registry of the network device, attacking the chat tool on the network device) , attacking specific types of files on network devices, etc.), the level of danger of the attack.
  • the server can dynamically update the virus database information according to the information recorded by the recording module 02.
  • the information recorded by the recording module 02 is also an important basis for the subsequent display module 03 to display the state of the network device to the network device in real time.
  • the display module 03 is configured to determine whether the number of attacks on the network device at each time node reaches a preset threshold. If the number of attacks on the network device at the determined time node reaches a preset threshold, the corresponding time node is sent. Early warning information.
  • the display module 03 poses a security threat to the network device according to the intercepted record recorded by the recording module 02.
  • the information of the event determines whether the number of times the network device is attacked at each time node reaches a preset threshold. If the number of times the network device is attacked reaches a preset threshold, the display module 03 issues an alert message corresponding to the time node, and displays the alert information on the display device of the network device to prompt the network device in time. If the number of times the network device is attacked does not reach the preset threshold, the display module 03 displays the security status information corresponding to the time node to the network device in real time.
  • FIG. 5 is a schematic diagram of functional modules of still another embodiment of a security alerting device for a network device according to the present invention. The difference between this embodiment and the embodiment shown in Fig. 4 is that only the setting module 04 is added.
  • the security precaution device of the network device provided by the present invention further includes:
  • the setting module 04 is configured to set a time axis according to a preset time period; and according to the time position of the time node in the preset time period, perform corresponding target at the time node corresponding to the time axis.
  • the setting module 04 sets the time axis according to the preset time period, and according to the time position of each time node on the time axis in the preset time period, the corresponding time point on the time axis is marked accordingly.
  • the preset time period may be set by the setting module 04 by default (for example, set to 24 hours), or may be set by the setting module 04 according to the specific requirements of the network device.
  • the setting module 04 can uniformly set corresponding time nodes on the time axis according to a preset time interval, for example, on a time axis with a time period of 24 hours, an average time interval is set every half hour.
  • the setting module 04 can also set the time nodes non-uniformly according to the preset duration.
  • the setting module 04 sets a relatively dense time node, such as A time node is set every ten minutes; when the network device is in the network disconnected state, the setting module 04 sets a sparse time node, such as setting a time node every hour.
  • Setting module 04 When setting the time node on the time axis, you can select different setting modes according to the specific conditions, or make specific settings according to the running status of the network device.
  • the specific setting manner of the setting module 04 when setting the time node on the time axis is not limited in this embodiment. After setting the time node on the time axis, the setting module 04 according to the time position of each time node in the preset time period, corresponding to the corresponding mark at the time node on the time axis.
  • the setting module 04 can stepwise set the corresponding mark at the time node on the time axis according to the advancement of time. For example, at the preset During the time period, on the time axis, the setting module 04 only marks correspondingly at each time node corresponding to the current time node.
  • the shape of the corresponding mark made at the corresponding time node on the time axis may be a circle, a pentagonal star, a triangle or a polygon, etc., and the specific shape of the mark set by the setting module 04 is not limited in this embodiment.
  • the setting module 04 sets the mark shape corresponding to the time node to be circular.
  • the setting module 04 may associate the size of the tag corresponding to each time node with the number of times the network device is attacked on the time node, so that each The size of the tag corresponding to the time node is obtained according to the number of times the network device is attacked on the time node; and the size of the tag corresponding to each time node is proportional to the number of times the network device is attacked at this time, that is, at the time node. The more times a network device is attacked, the greater the tag corresponding to that time node.
  • the setting module 04 can set different colors for the tags corresponding to the time nodes on the timeline. For example, when the number of times the network device is attacked on the time node determined by the display module 03 does not reach the preset threshold, the setting module 04 sets the color of the mark corresponding to the time node on the time axis to be the first color; When the number of times the network device is attacked on the time node determined by the display module 03 reaches or exceeds the preset threshold, the setting module 04 sets the color of the mark corresponding to the time node on the time axis to be the second color; The two colors and the first color are two different colors. For example, the setting module 04 can be set to set the first color to blue and the second color to red; or, to set the first color to green and the second color to orange.
  • the preset threshold may be set according to the previously intercepted information of the event that poses a security threat to the network device.
  • the setting manner of the preset threshold may be: according to the distribution of the number of times the network device is attacked in the information of the intercepted event that poses a security threat to the network device recorded by the recording module 02 in a certain period of time, The number of times the network device is attacked and the curve of the time period; the curve fitted is analyzed; combined with the analysis result and the information recorded in the information, the information about the carrying capacity of the network device after the number of attacks reaches a certain value,
  • the preset threshold is described so that the network device can operate normally.
  • the setting manner of the preset threshold is: fitting the distribution of the number of times the network device recorded by the server in the past year is attacked, and fitting a normal distribution curve; analyzing each time on the normal distribution curve The number of times the network device corresponding to the node is attacked and the running status information of the network device under the number of attacks, to find out the number of attacks that the network device can carry.
  • the threshold value is set to a preset threshold, or in order to ensure that the network device can operate normally and smoothly, the preset threshold may be set to be smaller than the threshold, or the preset threshold may be determined according to the network device. Actual needs are set.
  • the display module 03 determines that the number of times the network device is attacked by the event that constitutes the security threat reaches a preset threshold, the alarm information corresponding to the time node is sent; the warning information may directly pass through the display module 03. Displaying on the display device of the network device to prompt the network device for timely processing.
  • the server may send the warning information to all network devices currently in the network, or may send the warning information only to certain network devices, for example, only some network devices that do not have anti-virus software installed or have no virus killing function enabled. Issue an alert message corresponding to the time node.
  • the scope of the warning information issued by the display module 03 in this embodiment is not specifically limited.
  • the warning information includes specific color information representing a dangerous state of the current time node, a number of times the network device is attacked, and dangerous prompt information corresponding to the time node, and the dangerous prompt information may be displayed in a text form or in the form of an identifier. Show, such as showing a red exclamation mark.
  • the manner in which the display module 03 issues the early warning information is not specifically limited in this embodiment.
  • the manner in which the display module 03 issues the warning information may include: prompting the prompt information of the network device in the current network environment where the network device may have a large security threat directly on the display interface of the network device; or, the size of the mark corresponding to each time node on the time axis And color to display the protection status of the network environment where the network device is currently located.
  • the display module 03 displays the warning information of the time axis. Please refer to the detailed description of the embodiment shown in FIG. 2, and details are not described herein again.
  • the display module 03 sends alert information to the network device, and prompts the network device to perform corresponding operations in various ways.
  • the prompting module may be: the display module 03 automatically pops up an operation button for performing a full-scale killing of the network device, prompting the network device to perform full-disk anti-virus; or, the display module 03 prompts the network device that the Internet currently has a large number of new high-risk vulnerabilities, and At present, no effective way has been found to repair the above-mentioned high-risk vulnerabilities, and the network devices are reminded to avoid the risky access to the Internet.
  • the display module 03 dynamically displays, in real time, the number of attacks by the network device at each time node on the network device interface to dynamically display the intercepted virus or malicious URL in real time in the form of a floating widget. If, at a certain time, the display module 03 determines that the number of times the network device is attacked does not reach the preset threshold, the server sends the security status information corresponding to the time node.
  • the security status information includes the number of times the network device is attacked and specific color information that represents the current node security status. For example, according to the number of times the network device is attacked, the corresponding time node is marked. Size, and use blue to display the time node.
  • the display module 03 displays the security status information of the time axis. Please refer to the detailed description of the embodiment in FIG. 3, and details are not described herein again.
  • the network device can acquire the number of attacks recorded by the recording module 02 on any time node regarding the event intercepted by the interception module 01 that poses a security threat to the network device.
  • the server receives the request sent by the network device to obtain the number of attacks corresponding to the time node of 18:30
  • the display module 03 directly displays the flag corresponding to the time node of 18:30.
  • the information recorded by the recording module 02 about the interception module 01 intercepted at the time node "The network device housekeeper that you clicked has intercepted the virus 2014".
  • the information of the intercepted event that poses a security threat to the network device is recorded in real time, and it is determined whether the number of attacks on the network device at the time node reaches a preset threshold, if a certain time When the number of times the network device is attacked reaches a preset threshold, the alarm information corresponding to the time node is sent, which realizes the beneficial effect of dynamically displaying the protection status to the network device in real time, and improves the interaction capability with the network device.
  • an embodiment of the present invention further discloses a storage medium including computer executable instructions for performing a security early warning method of a network device when executed by a computer processor, the method comprising the following Steps:
  • the information of the intercepted event that poses a security threat to the network device is recorded in real time, and the information includes the number of times the network device is attacked by the event that constitutes the security threat;

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

本发明公开一种网络设备的安全预警方法、装置及存储介质，该方法包括以下步骤：拦截对网络设备构成安全威胁的事件；实时记录所拦截的对网络设备构成安全威胁的事件的信息；判断各个时间节点上网络设备被攻击的次数是否达到预设阈值；若所判断的时间节点上网络设备被攻击的次数达到预设阈值，则动态显示对应该时间节点的预警信息；本发明具有实时向网络设备动态展示防护状态的有益效果，提高了与网络设备的互动能力。

Description

网络设备的安全预警方法、 装置及存储介质 本专利申请要求于 2013年 3月 20日提交的、 申请号为 201310091615.5、 申请人为腾讯科技（深圳）有限公司、 发明名称为 "网络设备的安全预警方 法及装置" 的中国专利申请的优先权， 该申请的全文以引用的方式并入本申 请中。 技术领域
本发明涉及网络设备安全技术领域， 尤其涉及一种网络设备的安全预警 方法、 装置及存储介质。 背景技术
目前常用的网络设备安全预警系统均以全网爆发的覆盖率为主， 且预警 系统的信息展示多数为静态的， 不能实时动态的展示当前网络设备所处的网 络环境的安全信息。 因此， 在当前网络设备所处的网络环境爆发高危病毒且 预警系统不能及时清除高危病毒或者进行系统修复时， 用户会因不易察觉而 很难及时釆取有效措施进行应对， 进而不能有效地保护网络设备的安全。 发明内容
本发明实施例提供一种网络设备的安全预警方法、 装置及存储介质， 旨 在解决网络设备的预警信息不能实时动态展示的问题。
本发明实施例公开了一种网络设备的安全预警方法， 包括以下步骤： 拦截对网络设备构成安全威胁的事件；
实时记录所拦截的对网络设备构成安全威胁的事件的信息， 所述信息包 括网络设备被所述构成安全威胁的事件所攻击的次数；
判断各个时间节点上网络设备被攻击的次数是否达到预设阔值； 若所判断的时间节点上网络设备被攻击的次数达到所述预设阔值， 则发 出对应该时间节点的预警信息。
本发明实施例还公开了一种网络设备的安全预警装置， 包括： 拦截模块， 用于拦截对网络设备构成安全威胁的事件；
记录模块， 用于实时记录所拦截的对网络设备构成安全威胁的事件的信 息， 所述攻击信息包括网络设备被所述构成安全威胁的事件所攻击的次数； 显示模块， 用于判断各个时间节点上网络设备被攻击的次数是否达到预 设阔值； 若所判断的时间节点上网络设备被攻击的次数达到预设阔值， 则发 出对应该时间节点的预警信息。
本发明实施例还公开了一种包含计算机可执行指令的存储介质， 所述计 算机可执行指令在由计算机处理器执行时用于执行一种网络设备的安全预警 方法， 所述方法包括以下步骤：
拦截对网络设备构成安全威胁的事件；
实时记录所拦截的对网络设备构成安全威胁的事件的信息， 所述信息包 括网络设备被所述构成安全威胁的事件所攻击的次数；
判断各个时间节点上网络设备被攻击的次数是否达到预设阔值； 若所判断的时间节点上网络设备被攻击的次数达到所述预设阔值， 则发 出对应该时间节点的预警信息。
本发明实施例通过拦截对网络设备构成安全威胁的事件， 实时记录拦截 的对网络设备构成安全威胁的事件的信息， 判断时间节点上网络设备被攻击 的次数是否达到预设阔值， 若所判断的时间节点上网络设备被攻击的次数达 到预设阔值， 则发出对应该时间节点的预警信息， 实现了实时向网络设备动 态展示防护状态的有益效果， 提高了与网络设备的互动能力。 附图说明
图 1是本发明提供的网络设备的安全预警方法的一实施例的流程示意图； 图 2是本发明提供的网络设备的安全预警方法的一实施例中时间轴线预 警信息显示示意图；
图 3 是本发明提供的网络设备的安全预警方法的一实施例中时间轴线安 全状态信息显示示意图；
图 4是本发明提供的网络设备的安全预警装置的一实施例的功能模块示 意图；
图 5是本发明提供的网络设备的安全预警装置的又一实施例的功能模块 示意图。 本发明内容的实现、 功能特点及优点将结合以下具体实施方式， 参照所 述附图做进一步说明。 具体实施方式
以下结合说明书附图及具体实施例进一步说明本发明的技术方案。 应当 理解， 此处所描述的具体实施例仅仅用以解释本发明， 并不用于限定本发明。
参照图 1 ,图 1是本发明提供的网络设备的安全预警方法的一实施例的流 中， 服务器端可包括存储装置、 处理装置和显示装置。 该方法的软件程序可 存储在存储装置中， 被处理装置执行， 显示装置提供一个界面， 用于显示对 网络设备的安全预警信息。 如图 1 所示， 本发明实施例提供的网络设备的安 全预警方法包括以下步骤：
步骤 S01、 拦截对网络设备构成安全威胁的事件；
服务器端对网络设备的安全进行实时监控， 当监控到对网络设备构成安 全威胁的事件（比如恶意攻击） 时， 对其进行拦截。
在一优选的实施例中， 服务器端识别可能会对网络设备的安全构成威胁 的各种信息， 并直接拦截上述恶意攻击等对网络设备构成安全威胁的事件。 比如， 服务器端检测到上述恶意攻击是针对于网络设备的注册表等危险等级 较高的攻击， 则直接对该恶意攻击进行拦截。 服务器端可以根据数据库中存 储的与木马、 蠕虫等恶意攻击相关的病毒库信息来判断网络上所传输的信息 是否对网络设备的安全构成威胁， 其中上述病毒库信息会随着网络信息的日 新月异而不断地进行更新。 服务器端在监控到网络中的某网络事件可能会对 网络设备的安全构成威胁时， 也可以向网络设备发出提示信息， 供网络设备 选择是否对该网络事件进行拦截操作。 比如， 在网络设备准备安装某专业软 件， 且该专业软件需要访问网络上的某个特定链接才可获取到时， 则服务器 端会向网络设备发出是否允许本次联网访问的提醒信息， 供网络设备选择。
步骤 S02、 实时记录所拦截的对网络设备构成安全威胁的事件的信息； 服务器端实时记录所拦截的对网络设备构成安全威胁的事件的信息， 比 如恶意攻击的攻击信息。 记录的对网络设备构成安全威胁的事件的信息包括： 对网络设备进行攻击的时间、 攻击次数、 攻击类型、 攻击网络设备的具体位 置 （比如攻击网络设备的注册表、 攻击网络设备上的聊天工具、 攻击网络设 备上特定类型的文件等）、 攻击的危险等级、 攻击数量。 服务器端可以根据上 述记录的信息， 动态更新病毒库信息； 同时， 上述记录的信息也是后续向网 络设备实时展示网络设备状态的重要依据。
步骤 S03、 判断各个时间节点上网络设备被攻击的次数是否达到预设阔 值； 若是， 则执行步骤 S04; 若否， 则执行步骤 S05;
步骤 S04、 发出对应该时间节点的预警信息。
步骤 S05、 发出对应该时间节点的安全状态信息。
服务器端根据记录的所拦截的对网络设备构成安全威胁的事件的信息， 判断各时间节点上网络设备被攻击的次数是否达到预设阔值。 若所判断的时 间节点上， 网络设备被攻击的次数达到预设阔值， 服务器端发出对应该时间 节点的预警信息， 并在网络设备的显示装置上显示该预警信息， 以提示网络 设备及时进行处理； 若所判断的时间节点上， 网络设备被攻击的次数没有达 到预置阔值， 则服务器端实时向网络设备显示对应该时间节点的安全状态信 息。 当然， 在网络设备被攻击的次数没有达到预置阔值时， 服务器端也可以 不发送任何信息至网络设备， 因为在当前状态下， 服务器端所拦截的事件没 有对网络设备的安全构成足够的威胁。
在一优选的实施例中， 在判断各个时间节点上网络设备被攻击的次数是 否达到预设阔值的步骤 S03执行之前， 实时记录所拦截的对网络设备构成安 全威胁的事件的信息的步骤 S02执行之后， 服务器端还需执行步骤： 按照预 设时间周期设置时间轴线， 依据所述时间节点在所述预设时间周期内的时间 位置， 在时间轴线上对应的所述时间节点处做相应的标记。 当然， 所述服务 器端执行设置时间轴线和在对应的时间节点处做相应标记的步骤也可以在步 骤 SO 1执行之前， 并在后续的实时过程中， 每次拦截对网络设备构成安全威 胁的事件时， 无需再执行设置时间轴线的步骤。
在所述按照预设时间周期设置时间轴线时， 所述预设时间周期可以由服 务器端默认设置 （比如设置为 24 小时）， 也可以由服务器端根据网络设备的 具体需求进行设置。 另外， 可以在所述时间轴线上按照预设时长的时间间隔， 均匀地设置对应的时间节点， 比如在时间周期为 24小时的时间轴线上， 平均 每隔半小时设置一个时间节点。 当然， 在预设时间周期的时间轴线上， 也可 以按照预设时长非均匀地设置各时间节点， 比如， 在网络设备处于联网状态 时， 设置较为密集的时间节点， 如每隔十分钟设置一个时间节点； 在网络设 备处于断网状态时， 设置较为稀疏的时间节点， 如每隔一小时设置一个时间 节点。 在时间轴线上设置时间节点时， 可根据具体情况釆取不同的设置方式， 或者根据网络设备的运行状态进行具体设置。 本实施例对在时间轴线上设置 时间节点时具体的设置方式不作限定。 服务器端在时间轴线上设置时间节点 后， 根据各时间节点在所述预设时间周期内的时间位置， 在所述时间轴线上 对应的所述时间节点处 ^1相应的标记。
在一优选的实施例中， 为了避免资源浪费， 服务器端可以依据时间的推 进逐步设置时间轴线上对应的时间节点处的标记。 比如， 在所述预设时间周 期内， 在所述时间轴线上， 仅在对应的小于或等于当前时间节点的各时间节 点^ ^目应标记。 在所述时间轴线上对应的时间节点所 ^1的相应标记的形状可 以为圓形、 五角星形、 三角形或多边形等， 本实施例对标记的具体形状不做 限定。 在一较佳的实施例中， 设置时间节点对应的标记形状为圓形。 进一步 地， 为了能够显著地标识网络设备在各时间节点上被攻击的次数， 可以将每 个时间节点对应的标记的大小与该时间节点上网络设备被攻击的次数建立关 联， 使每个时间节点对应的标记的大小根据该时间节点上网络设备被攻击的 次数而得到； 且在每个时间节点对应的标记的大小与此时网络设备被攻击的 次数成正比， 即在该时间节点上网络设备被攻击的次数越多， 该时间节点对 应的标己尤越大。
为了更进一步地提高与网络设备的互动能力， 可以给时间轴线上对应的 每个时间节点的标记设置不同的颜色。 比如， 当所判断的时间节点上网络设 备被攻击的次数未达到预设阔值时， 所述时间轴线上对应所述时间节点的标 记的颜色为第一颜色； 当所判断的时间节点上网络设备被攻击的次数达到或 超过预设阔值时， 所述时间轴线上对应所述时间节点的标记的颜色为第二颜 色； 所述第二颜色与所述第一颜色为两种不同的颜色。 比如， 可以设置第一 颜色为蓝色， 第二颜色为红色； 或者， 设置第一颜色为绿色， 第二颜色为橙 色等。
在判断各个时间节点上网络设备被攻击的次数是否达到预设阔值时， 所 述预设阔值可以根据之前所拦截过的对网络设备构成安全威胁的事件的信息 而设置。 具体的， 所述预设阔值的设置方式可以是： 根据一定时间段内服务 器端记录的所拦截的对网络设备构成安全威胁的事件的信息中网络设备被攻 击的次数分布情况， 拟合网络设备被攻击的次数与该时间段的曲线； 分析所 拟合的曲线； 结合分析结果及记录的信息中所包含的在攻击次数达到一定数 值后网络设备的承载能力这一信息， 设定所述预设阔值， 从而使网络设备能 够正常运行。 比如， 所述预设阔值的设置方式为： 拟合过去一年服务器端记 录的网络设备被攻击的次数分布情况， 拟合得出一正态分布曲线； 分析该正 态分布曲线上各时间节点对应的网络设备被攻击的次数及网络设备在该攻击 次数下的运行状态信息， 找出网络设备能够承载的被攻击次数的临界值； 设 定该临界值为预设阔值， 或者为了保证网络设备能够正常、 通畅的运行， 可 以设定该预设阔值小于该临界值， 或者该预设阔值根据网络设备的实际需求 进行设置。
在服务器端所判断的时间节点上网络设备被所述构成安全威胁的事件所 攻击的次数达到预设阔值时， 则发出对应该时间节点的预警信息。 所述预警 信息可以通过网络设备的显示装置进行显示， 以提示网络设备进行及时处理。 服务器端可以向当前在网的全部网络设备发出所述预警信息， 也可以只针对 某些网络设备发出所述预警信息， 比如只针对某些未安装杀毒软件或者未开 启病毒查杀功能的网络设备发出对应该时间节点的预警信息。 本实施例对服 务器端发出预警信息的范围不作具体限定。
所述预警信息包括代表当前时间节点危险状态的特定颜色信息、 网络设 备被攻击的次数及对应该时间节点的危险提示信息， 所述危险提示信息可以 以文字形式展现， 也可以以标识符的形式展现， 比如显示红色的感叹号等。 本实施例对服务器端发出预警信息的方式不作具体限定。 服务器端发出预警 信息的方式可包括： 直接在网络设备的显示界面上弹出网络设备当前所在网 络环境可能存在较大安全威胁的提示信息； 或者， 以时间轴线上对应各时间 节点的标记的大小和颜色来显示网络设备当前所在网络环境的防护状态。 参 照图 2,图 2是本发明提供的网络设备的安全预警方法的一实施例中对应某时 间节点的预警信息显示示意图。 如图 2 所示， 各时间节点所对应的标记的形 状被设置为圓形； 时间轴线上对应时间节点的标记的大小反应了网络设备在 该时间节点上被攻击的次数的多少， 网络设备在该时间节点上被攻击的次数 越多， 时间轴线上显示的对应该时间节点的标记就越大。 当服务器端所判断 的时间节点上网络设备被攻击的次数达到预设阔值时， 则用特定颜色和大小 的标记来显示对应该时间节点的预警信息， 比如图 2所示的对应时间为 18:30 的时间节点上， 网络设备被攻击的次数达到预设阔值， 则将该时间节点对应 的标记及该时间节点所在的时间轴线显示为红色， 并提示网络设备进行相应 的防护操作。 比如所述提示可为： 自动弹出对网络设备进行全盘查杀的操作 按钮， 提示网络设备进行全盘杀毒； 或者， 提示网络设备当前互联网有大量 的新生的高危漏洞爆发， 且目前尚未找出有效的方式进行上述高危漏洞的修 补， 提醒网络设备避免进行风险较大的访问互联网的操作。
在一优选的实施例中， 服务器端实时动态显示网络设备各时间节点对应 的网络设备被攻击的次数及对应的防护状态， 比如服务器端可以在网络设备 界面上以悬浮小窗口的形式实时动态地显示拦截的病毒或恶意网址的攻击次 数。 若在某时间节点上， 服务器端判断网络设备被攻击的次数未达到预置阔 值， 则服务器端发出对应该时间节点的安全状态信息。 所述安全状态信息包 括所述网络设备被攻击的次数及代表当前节点安全状态的特定颜色信息， 比 如根据网络设备被攻击的次数， 显示当前时间节点所对应标记的尺寸， 并用 蓝色来显示该时间节点所对应的标记的颜色。 请参照图 3 , 图 3是本发明提供 的网络设备的安全预警方法的一实施例中对应某时间节点的安全状态信息显 示示意图。 图 3所示的各时间节点所对应的标记的形状被设置为圓形。 如图 3 所示， 服务器端判断时间轴线上各时间节点对应的网络设备被攻击的次数均 未达到预设阔值， 则用各时间节点所对应的区别于预警信息的显示颜色和大 小的标记来显示各时间节点的安全防护状态， 比如设定安全状态信息下时间 轴线和各时间节点对应的标记均显示为蓝色。
在一优选的实施例中， 网络设备可以获取任一时间节点上服务器端记录 的所拦截的对网络设备构成安全威胁的事件的攻击次数。 如图 3 所示， 若服 务器端接收到网络设备发送的获取 18:30 这一时间节点所对应的攻击次数的 请求，则直接在 18:30这一时间节点所对应的标记上显示服务器端记录的在该 时间节点上所拦截的相关信息 "您单击的这一刻网络设备管家已拦截病毒 2014次"。
本实施例通过拦截对网络设备构成安全威胁的事件， 实时记录所拦截的 对网络设备构成安全威胁的事件的信息， 判断时间节点上网络设备被攻击的 次数是否达到预设阔值， 若所判断的时间节点上网络设备被攻击的次数达到 预设阔值， 则发出对应该时间节点的预警信息， 实现了实时向网络设备动态 展示防护状态的有益效果， 提高了与网络设备的互动能力。 参照图 4,图 4是本发明提供的网络设备的安全预警装置的一实施例的功 能模块示意图。 如图 4所示， 本发明提供的网络设备的安全预警装置包括： 拦截模块 01、 记录模块 02和显示模块 03。
拦截模块 01 , 用于拦截对网络设备构成安全威胁的事件。
拦截模块 01对网络设备的安全进行实时监控， 当监控到对网络设备构成 安全威胁的事件 （比如恶意攻击） 时， 对其进行拦截。
在一优选的实施例中， 拦截模块 01识别可能会对网络设备的安全构成威 胁的各种信息， 并直接拦截上述恶意攻击等对网络设备构成安全威胁的事件。 比如， 拦截模块 01端检测到上述恶意攻击是针对于网络设备的注册表等危险 等级较高的攻击， 则直接对该恶意攻击进行拦截。 拦截模块 01可以根据数据 库中存储的与木马、 蠕虫等恶意攻击相关的病毒库信息来判断网络上所传输 的信息是否对网络设备的安全构成威胁， 其中上述病毒库信息会随着网络信 息的日新月异而不断地进行更新。 拦截模块 01监控到网络中的某网络事件可 能会对网络设备的安全构成威胁时， 也可以向网络设备发出提示信息， 供网 络设备选择是否对该网络事件进行拦截操作。 比如， 在网络设备准备安装某 专业软件， 且该专业软件需要访问网络上的某个特定链接才可获取到时， 则 拦截模块 01会向网络设备发出是否允许本次联网访问的提醒信息， 供网络设 备选择。
记录模块 02 , 用于实时记录所拦截的对网络设备构成安全威胁的事件的 信息。
记录模块 02实时记录拦截模块 01拦截的对网络设备构成安全威胁的事件 的信息， 比如恶意攻击的攻击信息。 记录的对网络设备构成安全威胁的事件 的信息包括： 对网络设备进行攻击的时间、 攻击次数、 攻击类型、 攻击网络 设备的具体位置（比如攻击网络设备的注册表、 攻击网络设备上的聊天工具、 攻击网络设备上特定类型的文件等）、 攻击的危险等级。 服务器端可以根据记 录模块 02记录的信息， 动态更新病毒库信息； 同时， 记录模块 02记录的信息 也是后续显示模块 03向网络设备实时展示网络设备状态的重要依据。
显示模块 03， 用于判断各个时间节点上网络设备被攻击的次数是否达到 预设阔值， 若所判断的时间节点上网络设备被攻击的次数达到预设阔值， 则 发出对应该时间节点的预警信息。
显示模块 03根据记录模块 02记录的所拦截的对网络设备构成安全威胁 的事件的信息， 判断各时间节点上网络设备被攻击的次数是否达到预设阔值。 若所判断的时间节点上， 网络设备被攻击的次数达到预设阔值， 显示模块 03 发出对应该时间节点的预警信息， 并在网络设备的显示装置上显示该预警信 息， 以提示网络设备及时进行处理； 若所判断的时间节点上， 网络设备被攻 击的次数没有达到预置阔值， 则显示模块 03实时向网络设备显示对应该时间 节点的安全状态信息。
在一优选的实施例中， 请参照图 5 , 图 5是本发明提供的网络设备的安全 预警装置的又一实施例的功能模块示意图。 本实施例与图 4所述实施例的区 别是， 仅增加了设置模块 04。 如图 5所示， 本发明提供的网络设备的安全预 警装置还包括：
设置模块 04 , 用于按照预设时间周期设置时间轴线； 依据所述时间节点 在所述预设时间周期内的时间位置， 在时间轴线上对应的所述时间节点处做 相应的标己。
设置模块 04按照预设时间周期设置时间轴线， 依据时间轴线上各时间节 点在所述预设时间周期内的时间位置， 在所述时间轴线上对应的所述时间节 点处做相应的标记。 所述设置模块 04按照预设时间周期设置时间轴线时， 所 述预设时间周期可以由设置模块 04默认设置 (比如设置为 24小时 ), 也可以 由设置模块 04根据网络设备的具体需求进行设置。 另外， 设置模块 04可以 在所述时间轴线上按照预设时长的时间间隔， 均匀地设置对应的时间节点， 比如在时间周期为 24小时的时间轴线上，平均每隔半小时设置一个时间节点。 当然， 在预设时间周期的时间轴线上， 设置模块 04也可以按照预设时长非均 匀地设置各时间节点， 比如， 在网络设备处于联网状态时， 设置模块 04设置 较为密集的时间节点， 如每隔十分钟设置一个时间节点； 在网络设备处于断 网状态时， 设置模块 04设置较为稀疏的时间节点， 如每隔一小时设置一个时 间节点。 设置模块 04在时间轴线上设置时间节点时， 可根据具体情况釆取不 同的设置方式， 或者根据网络设备的运行状态进行具体设置。 本实施例对设 置模块 04在时间轴线上设置时间节点时具体的设置方式不作限定。 在时间轴 线上设置时间节点后， 设置模块 04根据各时间节点在所述预设时间周期内的 时间位置， 在所述时间轴线上对应的所述时间节点处 ^1相应的标记。
在一优选的实施例中， 为了避免资源浪费， 设置模块 04可以依据时间的 推进逐步设置时间轴线上对应的所述时间节点处的标记。 比如， 在所述预设 时间周期内， 在所述时间轴线上， 设置模块 04仅在对应的小于或等于当前时 间节点的各时间节点处做相应标记。 在所述时间轴线上对应的时间节点处所 做的相应标记的形状可以为圓形、 五角星形、 三角形或多边形等， 本实施例 对设置模块 04设置的标记的具体形状不做限定。 在一较佳的实施例中， 设置 模块 04设置时间节点对应的标记形状为圓形。 进一步地， 为了能够显著地标 识网络设备在各时间节点上被攻击的次数， 设置模块 04可以将每个时间节点 对应的标记的大小与该时间节点上网络设备被攻击的次数建立关联， 使每个 时间节点对应的标记的大小根据该时间节点上网络设备被攻击的次数而得 到； 且每个时间节点对应的标记的大小与此时网络设备被攻击的次数成正比， 即在该时间节点上网络设备被攻击的次数越多 , 该时间节点对应的标记就越 大。
为了更进一步地提高与网络设备的互动能力， 设置模块 04可以给时间轴 线上对应所述时间节点的标记设置不同的颜色。 比如， 当显示模块 03所判断 的时间节点上网络设备被攻击的次数未达到预设阔值时， 设置模块 04设置所 述时间轴线上对应所述时间节点的标记的颜色为第一颜色； 当显示模块 03所 判断的时间节点上网络设备被攻击的次数达到或超过预设阔值时， 设置模块 04设置所述时间轴线上对应所述时间节点的标记的颜色为第二颜色； 所述第 二颜色与所述第一颜色为两种不同的颜色。 比如， 设置模块 04设置可以设置 第一颜色为蓝色， 第二颜色为红色； 或者， 设置第一颜色为绿色， 第二颜色 为橙色等。
显示模块 03在判断各个时间节点上网络设备被攻击的次数是否达到预设 阔值时， 所述预设阔值可以根据之前所拦截的对网络设备构成安全威胁的事 件的信息而设置。 具体的， 所述预设阔值的设置方式可以是： 根据一定时间 段内记录模块 02记录的所拦截的对网络设备构成安全威胁的事件的信息中网 络设备被攻击的次数分布情况， 拟合网络设备被攻击的次数与该时间段的曲 线； 分析所拟合的曲线； 结合分析结果及记录的信息中所包含的在攻击次数 达到一定数值后网络设备的承载能力这一信息， 设定所述预设阔值， 从而使 网络设备能够正常运行。 比如， 所述预设阔值的设置方式为： 拟合过去一年 服务器端记录的网络设备被攻击的次数分布情况， 拟合得出一正态分布曲线； 分析该正态分布曲线上各时间节点对应的网络设备被攻击的次数及网络设备 在该攻击次数下的运行状态信息， 找出网络设备能够承载的被攻击次数的临 界值； 设定该临界值为预设阔值， 或者为了保证网络设备能够正常、 通畅的 运行， 可以设定该预设阔值小于该临界值， 或者该预设阔值可根据网络设备 的实际需求进行设置。
在显示模块 03判断某时间节点上网络设备被所述构成安全威胁的事件所 攻击的次数达到预设阔值时， 则发出对应该时间节点的预警信息； 所述预警 信息可以直接通过显示模块 03在网络设备的显示装置上进行显示， 以提示网 络设备进行及时处理。 服务器端可以向当前在网的全部网络设备发出所述预 警信息， 也可以只针对某些网络设备发出所述预警信息， 比如只针对某些未 安装杀毒软件或者未开启病毒查杀功能的网络设备发出对应该时间节点的预 警信息。 本实施例对显示模块 03发出预警信息的范围不作具体限定。
所述预警信息包括代表当前时间节点危险状态的特定颜色信息、 网络设 备被攻击的次数及对应该时间节点的危险提示信息， 所述危险提示信息可以 以文字形式展现， 也可以以标识符的形式展现， 比如显示红色的感叹号等。 本实施例对显示模块 03发出预警信息的方式不作具体限定。 显示模块 03发 出预警信息的方式可包括： 直接在网络设备的显示界面上弹出网络设备当前 所在网络环境可能存在较大安全威胁的提示信息； 或者， 以时间轴线上对应 各时间节点的标记的大小和颜色来显示网络设备当前所在网络环境的防护状 态。显示模块 03显示时间轴线的预警信息请参照图 2所述实施例的具体描述， 在此不再赘述。 显示模块 03向网络设备发送预警信息， 并提示网络设备进行 相应操作的具体方式有多种。 比如所述提示可为： 显示模块 03 自动弹出对网 络设备进行全盘查杀的操作按钮， 提示网络设备进行全盘杀毒； 或者， 显示 模块 03提示网络设备当前互联网有大量的新生的高危漏洞爆发， 且目前尚未 找出有效的方式进行上述高危漏洞的修补， 提醒网络设备避免进行风险较大 的访问互联网的操作。
在一优选的实施例中， 显示模块 03实时动态显示网络设备各时间节点对 网络设备界面上以悬浮小窗口的形式实时动态地显示拦截的病毒或恶意网址 的攻击次数。 若在某时间节点上， 显示模块 03判断网络设备被攻击的次数未 达到预置阔值， 则服务器端发出对应该时间节点的安全状态信息。 所述安全 状态信息包括所述网络设备被攻击的次数及代表当前节点安全状态的特定颜 色信息， 比如根据网络设备被攻击的次数， 显示当前时间节点所对应标记的 尺寸， 并用蓝色来显示该时间节点。 显示模块 03显示时间轴线的安全状态信 息请参照图 3所述实施例的具体描述， 在此不再赘述。
在一优选的实施例中， 网络设备可以获取任一时间节点上记录模块 02记 录的关于拦截模块 01所拦截的对网络设备构成安全威胁的事件的攻击次数。 如图 3所示，若服务器端接收到网络设备发送的获取 18:30这一时间节点所对 应的攻击次数的请求， 则显示模块 03直接在 18:30这一时间节点所对应的标 记上显示记录模块 02记录的关于拦截模块 01在该时间节点上所拦截的相关 信息 "您单击的这一刻网络设备管家已拦截病毒 2014次"。
本实施例通过拦截对网络设备构成安全威胁的事件， 实时记录所拦截的 对网络设备构成安全威胁的事件的信息， 判断时间节点上网络设备被攻击的 次数是否达到预设阔值， 若某时间节点上网络设备被攻击的次数达到预设阔 值， 则发出对应该时间节点的预警信息， 实现了实时向网络设备动态展示防 护状态的有益效果， 提高了与网络设备的互动能力。
另外， 本发明实施例还公开了一种包含计算机可执行指令的存储介质， 所述计算机可执行指令在由计算机处理器执行时用于执行一种网络设备的安 全预警方法， 所述方法包括以下步骤：
拦截对网络设备构成安全威胁的事件；
实时记录所拦截的对网络设备构成安全威胁的事件的信息， 所述信息包 括网络设备被所述构成安全威胁的事件所攻击的次数；
判断各个时间节点上网络设备被攻击的次数是否达到预设阔值； 若所判断的时间节点上网络设备被攻击的次数达到所述预设阔值， 则发 出对应该时间节点的预警信息。 以上所述仅为本发明的优选实施例， 并不能因此限制其专利保护范围， 凡是利用本发明说明书及附图内容所作的等效结构或等效流程变换， 直接或 间接运用在其他相关的技术领域， 均同理包括在本发明的专利保护范围内。

Claims

权 利 要 求 书
1、 一种网络设备的安全预警方法， 其特征在于， 包括以下步骤： 拦截对网络设备构成安全威胁的事件；
实时记录所拦截的对网络设备构成安全威胁的事件的信息， 所述信息包 括网络设备被所述构成安全威胁的事件所攻击的次数；
判断各个时间节点上网络设备被攻击的次数是否达到预设阔值； 若所判断的时间节点上网络设备被攻击的次数达到所述预设阔值， 则发 出对应该时间节点的预警信息。
2、 如权利要求 1所述的方法， 其特征在于， 在所述判断各个时间节点上 网络设备被攻击的次数是否达到预设阔值之后， 还包括：
若所判断的时间节点上网络设备被攻击的次数未达到所述预设阔值， 则 发出对应该时间节点的安全状态信息。
3、 如权利要求 1所述的方法， 其特征在于， 在所述判断各个时间节点上 网络设备被攻击的次数是否达到预设阔值之前， 还包括：
按照预设时间周期设置时间轴线；
依据所述时间节点在所述预设时间周期内的时间位置， 在所述时间轴线 上对应的所述时间节点处 ^1相应的标记。
4、 如权利要求 3所述的方法， 其特征在于， 所述在所述时间轴线上对应 的所述时间节点处做相应的标记， 包括：
在所述预设时间周期内， 在所述时间轴线上仅在对应的小于或等于当前 时间节点的各时间节点做相应的标记。
5、 如权利要求 3所述的方法， 其特征在于， 所述标记的大小根据在所述 对应的所述时间节点上网络设备被攻击的次数而得到且在所述对应的所述时 间节点上， 所述标记的大小与网络设备被攻击的次数成正比。
6、 如权利要求 3所述的方法， 其特征在于， 所述标记的形状为圓形
7、 如权利要求 3所述的方法， 其特征在于， 所述在所述时间轴线上对应 的所述时间节点处做相应的标记， 包括：
当所述时间节点上网络设备被攻击的次数未达到预设阔值时， 所述时间 轴线上对应所述时间节点的标记的颜色为第一颜色；
当所述时间节点上网络设备被攻击的次数达到或超过预设阔值时， 所述 时间轴线上对应所述时间节点的标记的颜色为第二颜色；
所述第二颜色与所述第一颜色为两种不同的颜色。
8、 如权利要求 7所述的方法， 其特征在于， 所述第二颜色为红色。
9、 如权利要求 1所述的方法， 其特征在于， 所述预警信息包括以文字形 式展现的危险提示信息。
10、 一种网络设备的安全预警装置， 其特征在于， 包括：
拦截模块， 用于拦截对网络设备构成安全威胁的事件；
记录模块， 用于实时记录所拦截的对网络设备构成安全威胁的事件的信 息， 所述信息包括网络设备被所述构成安全威胁的事件所攻击的次数；
显示模块， 用于判断各个时间节点上网络设备被攻击的次数是否达到预 设阔值； 若所判断的时间节点上网络设备被攻击的次数达到所述预设阔值， 则发出对应该时间节点的预警信息。
11、 如权利要求 10所述的装置， 其特征在于， 所述显示模块还用于： 若所判断的时间节点上网络设备被攻击的次数未达到所述预设阔值， 则 发出对应该时间节点的安全状态信息。
12、 如权利要求 10所述的装置， 其特征在于， 还包括：
设置模块， 用于按照预设时间周期设置时间轴线； 依据所述时间节点在 所述预设时间周期内的时间位置， 在所述时间轴线上对应的所述时间节点处 #丈相应的标己。
13、 如权利要求 12所述的装置， 其特征在于， 所述设置模块具体用于： 在所述预设时间周期内， 在所述时间轴线上仅在对应的小于或等于当前 时间节点的各时间节点处做相应的标记。
14、 如权利要求 12所述的装置， 其特征在于， 所述设置模块还用于： 根据在所述对应的所述时间节点上网络设备被攻击的次数来设置所述标 记的大小， 且在所述对应的所述时间节点上， 所述标记的大小与网络设备被 攻击的次数成正比。
15、 如权利要求 12所述的装置， 其特征在于， 所述标记的形状为圓形。
16、 如权利要求 12所述的装置， 其特征在于， 所述设置模块还用于： 当所述时间节点上网络设备被攻击的次数未达到预设阔值时， 设置所述 时间轴线上对应所述时间节点的标记的颜色为第一颜色；
当所述时间节点上网络设备被攻击的次数达到或超过预设阔值时， 设置 所述时间轴线上对应所述时间节点的标记的颜色为第二颜色；
设置的所述第二颜色与所述第一颜色为两种不同的颜色。
17、 如权利要求 16所述的装置， 其特征在于， 所述第二颜色为红色。
18、 如权利要求 10所述的装置， 其特征在于， 所述预警信息包括以文字 形式展现的危险提示信息。
19、 一种包含计算机可执行指令的存储介质， 所述计算机可执行指令在 由计算机处理器执行时用于执行一种网络设备的安全预警方法， 其特征在于， 所述方法包括以下步骤：
拦截对网络设备构成安全威胁的事件；
实时记录所拦截的对网络设备构成安全威胁的事件的信息， 所述信息包 括网络设备被所述构成安全威胁的事件所攻击的次数；
判断各个时间节点上网络设备被攻击的次数是否达到预设阔值； 若所判断的时间节点上网络设备被攻击的次数达到所述预设阔值， 则发 16
PCT/CN2013/088306 2013-03-20 2013-12-02 网络设备的安全预警方法、装置及存储介质 WO2014146453A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201310091615.5A CN104065622B (zh) 2013-03-20 2013-03-20 网络设备的安全预警方法及装置
CN201310091615.5 2013-03-20

Publications (1)

Publication Number Publication Date
WO2014146453A1 true WO2014146453A1 (zh) 2014-09-25

Family

ID=51553155

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2013/088306 WO2014146453A1 (zh) 2013-03-20 2013-12-02 网络设备的安全预警方法、装置及存储介质

Country Status (2)

Country Link
CN (1) CN104065622B (zh)
WO (1) WO2014146453A1 (zh)

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3513543B1 (en) * 2016-09-16 2021-05-12 Oracle International Corporation Dynamic policy injection and access visualization for threat detection
CN107169357A (zh) * 2017-05-12 2017-09-15 北京金山安全管理系统技术有限公司 预警显示处理方法、装置、存储介质和处理器
CN110032869B (zh) * 2019-04-19 2022-08-09 湖南科技学院 一种基于大数据的云计算防护预警系统
CN110324312A (zh) * 2019-05-22 2019-10-11 北京瀚海思创科技有限公司 网络攻击地图显示方法及存储介质
CN110336785A (zh) * 2019-05-22 2019-10-15 北京瀚海思创科技有限公司 网络攻击链图的可视化方法及存储介质
CN111046379B (zh) * 2019-12-06 2021-06-18 支付宝(杭州)信息技术有限公司 一种对抗攻击的监测方法和装置
CN114205212A (zh) * 2021-12-08 2022-03-18 国网冀北电力有限公司计量中心 一种网络安全预警方法、装置、设备及可读存储介质
CN116366372B (zh) * 2023-05-31 2023-08-04 北京嘉铭创新科技有限公司 一种网络攻击拦截方法、装置、设备及介质

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101594266A (zh) * 2009-07-01 2009-12-02 杭州华三通信技术有限公司 一种结构化查询语言注入攻击检测方法和装置

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101483515B (zh) * 2009-02-26 2011-02-02 杭州华三通信技术有限公司 Dhcp攻击防护方法和客户端设备

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101594266A (zh) * 2009-07-01 2009-12-02 杭州华三通信技术有限公司 一种结构化查询语言注入攻击检测方法和装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
GUO, SIWEN ET AL.: "Network Time Serial Data Mining Based on Wavelet Technique", COMPUTER ENGINEERING, vol. 33, no. 2, January 2007 (2007-01-01), pages 40 - 43 *

Also Published As

Publication number Publication date
CN104065622B (zh) 2018-10-19
CN104065622A (zh) 2014-09-24

Similar Documents

Publication Publication Date Title
WO2014146453A1 (zh) 网络设备的安全预警方法、装置及存储介质
US10467414B1 (en) System and method for detecting exfiltration content
CA3006003C (en) Dual memory introspection for securing multiple network endpoints
US10893068B1 (en) Ransomware file modification prevention technique
US10311235B2 (en) Systems and methods for malware evasion management
US10133866B1 (en) System and method for triggering analysis of an object for malware in response to modification of that object
Souppaya et al. Guide to malware incident prevention and handling for desktops and laptops
JP4914052B2 (ja) セキュリティポリシーを配布するための方法およびシステム
US9552479B2 (en) Malware detection and computer monitoring methods
US11997127B2 (en) Policy based vulnerability identification, correlation, remediation, and mitigation
AU2015201095A1 (en) Network security system with remediation based on value of attacked assets
US20090328210A1 (en) Chain of events tracking with data tainting for automated security feedback
US20190109824A1 (en) Rule enforcement in a network
US10142360B2 (en) System and method for iteratively updating network attack mitigation countermeasures
CN113449302A (zh) 一种检测恶意软件的方法
US8782754B2 (en) Implementing secured, event-based layered logout from a computer system
US10616245B2 (en) Real-time remediation respective of security incidents
Malik et al. Multi pronged approach for ransomware analysis
KR101614809B1 (ko) 엔드포인트 응용프로그램 실행 제어 시스템 및 그 제어 방법
KR101022167B1 (ko) 네트워크 자산의 취약성을 고려한 침입탐지시스템의로그최적화 장치
Cabaj et al. Developing malware evaluation infrastructure
KR20220086402A (ko) 클라우드 기반 통합 보안서비스 제공 시스템
Kakareka Detecting system intrusions
CN111680294A (zh) 一种基于高交互蜜罐技术的数据库监控方法、装置、设备
US20230418933A1 (en) Systems and methods for folder and file sequestration

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 13878869

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 02/02/2016)

122 Ep: pct application non-entry in european phase

Ref document number: 13878869

Country of ref document: EP

Kind code of ref document: A1