WO2017028789A1 - 网络攻击检测方法和设备 - Google Patents

网络攻击检测方法和设备 Download PDF

Info

Publication number
WO2017028789A1
WO2017028789A1 PCT/CN2016/095714 CN2016095714W WO2017028789A1 WO 2017028789 A1 WO2017028789 A1 WO 2017028789A1 CN 2016095714 W CN2016095714 W CN 2016095714W WO 2017028789 A1 WO2017028789 A1 WO 2017028789A1
Authority
WO
WIPO (PCT)
Prior art keywords
model
attack
probability
tuple
word
Prior art date
Application number
PCT/CN2016/095714
Other languages
English (en)
French (fr)
Inventor
申军利
Original Assignee
北京神州绿盟信息安全科技股份有限公司
北京神州绿盟科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京神州绿盟信息安全科技股份有限公司, 北京神州绿盟科技有限公司 filed Critical 北京神州绿盟信息安全科技股份有限公司
Priority to US15/745,057 priority Critical patent/US10645105B2/en
Priority to JP2018508155A priority patent/JP6567169B2/ja
Publication of WO2017028789A1 publication Critical patent/WO2017028789A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04B—TRANSMISSION
    • H04B1/00—Details of transmission systems, not covered by a single one of groups H04B3/00 - H04B13/00; Details of transmission systems not characterised by the medium used for transmission
    • H04B1/38—Transceivers, i.e. devices in which transmitter and receiver form a structural unit and in which at least one part is used for functions of transmitting and receiving
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/145—Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1483—Countermeasures against malicious traffic service impersonation, e.g. phishing, pharming or web spoofing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]

Definitions

  • the present application relates to the field of network security, and in particular, to a network attack detection method and device.
  • Network attacks are an important hidden danger affecting network security.
  • In order to ensure the safe operation of the network it is necessary to detect the attack behaviors in the network in time.
  • Existing cyber attack detection techniques use regular expressions in the feature library to match network transmission data such as HTTP (HyperText Transfer Protocol) requests to determine whether there is an attack in the transmitted data.
  • HTTP HyperText Transfer Protocol
  • This method needs to be based on a large number of regular expression feature libraries, but blind spots often appear in the feature library, and the features in the feature library often appear before and after the association, resulting in higher cost of adding new features, and may even appear new
  • the feature affects the old features, causing the old features to fail, thus failing to ensure the accuracy and reliability of the network attack detection.
  • the present application provides a network attack detection method and device for improving the accuracy of network attack detection.
  • each of the attack model databases stores Model tuples and the probability of occurrence of each model tuple, the probability of occurrence of each model word and each model word;
  • the method provided by the embodiment of the present application for determining whether the network to be detected, that is, the network transmission data, firstly performs word segmentation and tuple composition processing to obtain corresponding tuples; Pre-acquired storage model with each model tuple and its corresponding appearance probability and each model word and its corresponding probability of occurrence In the type database, matching the model tuple corresponding to each obtained tuple and the first word, thereby determining the attack probability of the to-be-detected string according to the occurrence probability of the corresponding model tuple and the corresponding model word, if the attack probability is greater than A certain threshold determines the string as a string with aggressive behavior.
  • the determining, according to the probability of occurrence of each corresponding model tuple and the probability of occurrence of each corresponding model word, determining an attack probability corresponding to the to-be-detected character string including:
  • the probability of occurrence of the corresponding attack model tuple and the probability of occurrence of the corresponding model word are summed to obtain an attack probability corresponding to the to-be-detected character string.
  • the obtaining the to-be-detected character string and performing word segmentation on the to-be-detected character string to obtain each word included in the to-be-detected character string further includes:
  • the probability of occurrence of each model word and model tuple stored in the attack model database is obtained based on statistical analysis of a large number of attack samples, the statistical characteristics of the attack sample can be reflected, and thus, based on the statistical feature, the detected feature can be detected.
  • the attack behavior detection result of the string is more accurate.
  • the determining the probability of occurrence of each model word included in the attack sample set includes:
  • Determining the probability of occurrence of each model word included in the attack sample set according to a ratio of the number of occurrences of each model word included in the attack sample set to the total number of all model words included in the attack sample set.
  • the determining the probability of occurrence of each model tuple included in the attack sample set includes:
  • w 1 ,...,w n-1 ,w n are n model words contained in any model tuple
  • w 1 ,...,w n-1 ) is the The probability of occurrence of a model tuple, n is an integer greater than or equal to 2
  • w n is the first model word in the model tuple
  • w 1 ,..., w n-1 is located after the first model word N-1 model words
  • #(w 1 ,...,w n-1 ,w n ) are the number of occurrences of any of the model tuples in all model tuples included in the attack sample set
  • # (w 1 , . . . , w n-1 ) is the number of times the model words w 1 , . . . , w n-1 co-occur in all of the sample strings contained in the attack sample set.
  • the above method is based on the analysis of the occurrence probability of each word and each tuple in a large number of attack sample strings, and the attack model database is obtained.
  • the specific form of the attack string is continuously updated, the characteristics of the attack behavior do not occur.
  • the nature changes that is, it tends to have a large number of attack sample strings with similar probability and statistical characteristics. Therefore, based on the attack model database, it is possible to accurately determine whether the string to be detected has an attack behavior.
  • the embodiment of the present application provides a network attack detection device, including:
  • a first acquiring module configured to acquire a character string to be detected, and perform word segmentation processing on the to-be-detected character string to obtain each word included in the to-be-detected character string;
  • a first determining module configured to perform a tuple generation process on the words according to a preset tuple composition rule to determine each tuple corresponding to the to-be-detected character string;
  • a second determining module configured to determine whether there is a model tuple corresponding to each tuple in the attack model database obtained in advance, whether there is a model word corresponding to the first word in each word,
  • the attack model database stores the appearance probability of each model tuple and each model tuple, the probability of occurrence of each model word and each model word;
  • a third determining module configured to acquire an occurrence probability of each corresponding model tuple and a corresponding model word when the second determining module determines that each corresponding model tuple and the corresponding model word exist, and according to the corresponding model tuple
  • the probability of occurrence and the probability of occurrence of each corresponding model word determine the attack probability corresponding to the character string to be detected;
  • a fourth determining module configured to determine, when the attack probability is greater than or equal to a preset probability threshold, that the to-be-detected character string is a character string having an aggressive behavior.
  • the third determining module is specifically configured to: add an occurrence probability of the corresponding attack model tuple and an appearance probability of the corresponding model word to obtain an attack probability corresponding to the to-be-detected character string.
  • it also includes:
  • a second acquiring module configured to acquire an attack sample set, where the attack sample set includes each attack sample string
  • a third acquiring module configured to separately perform word segmentation processing on each attack sample string to obtain the model words included in the attack sample set
  • a fifth determining module configured to perform a tuple generation process on the model words included in each attack sample string according to the preset tuple composition rule to determine the model elements included in the attack sample set Group
  • a sixth determining module configured to respectively determine an occurrence probability of the model words included in the attack sample set and an appearance probability of the model tuples included in the attack sample set;
  • a storage module configured to associate, in the attack model database, the model words included in the attack sample set with an appearance probability of each model word, and to include the models included in the attack sample set
  • the tuple is stored in the attack model database in association with the probability of occurrence of the model tuples.
  • the sixth determining module is specifically configured to:
  • Determining the probability of occurrence of each model word included in the attack sample set according to a ratio of the number of occurrences of each model word included in the attack sample set to the total number of all model words included in the attack sample set.
  • the sixth determining module is further configured to:
  • w 1 ,...,w n-1 ,w n are n model words contained in any model tuple
  • w 1 ,...,w n-1 ) is the The probability of occurrence of a model tuple, n is an integer greater than or equal to 2
  • w n is the first model word in the model tuple
  • w 1 ,..., w n-1 is located after the first model word N-1 model words
  • #(w 1 ,...,w n-1 ,w n ) are the number of occurrences of any of the model tuples in all model tuples included in the attack sample set
  • # (w 1 , . . . , w n-1 ) is the number of times the model words w 1 , . . . , w n-1 co-occur in all of the sample strings contained in the attack sample set.
  • the embodiment of the present application provides a network attack detection device, including: a transceiver and a processor;
  • the transceiver is configured to acquire a character string to be detected
  • the processor is configured to perform word segmentation processing on the to-be-detected character string to obtain each word included in the to-be-detected character string; perform tuple generation processing on each word according to a preset tuple composition rule, Determining each tuple corresponding to the to-be-detected character string;
  • the processor is further configured to determine whether there is a model tuple corresponding to each tuple in the attack model database obtained in advance, whether there is a model word corresponding to the first word in each word,
  • the attack model database stores the appearance probability of each model tuple and each model tuple, the occurrence probability of each model word and each model word; if present, the probability of occurrence of each corresponding model tuple and the corresponding model word And determining an attack probability corresponding to the to-be-detected character string according to an occurrence probability of each corresponding model tuple and an appearance probability of each corresponding model word; if the attack probability is greater than or equal to a preset probability threshold, determining the The detected string is a string with aggressive behavior.
  • the processor is specifically configured to:
  • the processor is further configured to:
  • the transceiver is further configured to: acquire an attack sample set, where the attack sample set includes each attack sample string;
  • the processor is further configured to perform word segmentation processing on each attack sample string to obtain the model words included in the attack sample set, and respectively perform the attacks according to the preset tuple composition rules.
  • the model words included in the sample string are subjected to a tuple generation process to determine the model tuples included in the attack sample set; respectively determining an occurrence probability of the model words included in the attack sample set and the The probability of occurrence of each of the model tuples included in the attack sample set;
  • the device further includes:
  • a memory configured to store, in the attack sample database, the model words included in the attack sample set and the appearance probability of each model word, and the model elements included in the attack sample set
  • the group is stored in the attack model database in association with the probability of occurrence of the model tuples.
  • the processor is specifically configured to:
  • Determining the probability of occurrence of each model word included in the attack sample set according to a ratio of the number of occurrences of each model word included in the attack sample set to the total number of all model words included in the attack sample set.
  • the processor is specifically configured to:
  • w 1 ,...,w n-1 ,w n are n model words contained in any model tuple
  • w 1 ,...,w n-1 ) is the The probability of occurrence of a model tuple, n is an integer greater than or equal to 2
  • w n is the first model word in the model tuple
  • w 1 ,..., w n-1 is located after the first model word N-1 model words
  • #(w 1 ,...,w n-1 ,w n ) are the number of occurrences of any of the model tuples in all model tuples included in the attack sample set
  • # (w 1 , . . . , w n-1 ) is the number of times the model words w 1 , . . . , w n-1 co-occur in all of the sample strings contained in the attack sample set.
  • Embodiment 1 is a flowchart of Embodiment 1 of a network attack detection method according to the present invention
  • Embodiment 2 is a flowchart of Embodiment 2 of a network attack detection method according to the present invention
  • Embodiment 3 is a schematic structural diagram of Embodiment 1 of a network attack detecting device according to the present invention.
  • Embodiment 4 is a schematic structural diagram of Embodiment 2 of a network attack detecting device according to the present invention.
  • FIG. 5 is a schematic structural diagram of Embodiment 3 of a network attack detecting device according to the present invention.
  • FIG. 1 is a flowchart of Embodiment 1 of a network attack detection method according to the present invention. As shown in FIG. 1 , the method includes the following steps:
  • Step 101 Obtain a character string to be detected, and perform word segmentation processing on the to-be-detected character string to obtain each word included in the to-be-detected character string.
  • the to-be-detected character string refers to network transmission data such as an HTTP request message. Based on semantics and character recognition, the character string to be detected is subjected to word segmentation to obtain each word contained therein.
  • a character string to be detected it is not completely composed of English words, and also includes components such as numbers and symbols. In this embodiment, these components are collectively referred to as words.
  • Step 102 Perform tuple generation processing on each word according to a preset tuple composition rule to determine each tuple corresponding to the to-be-detected character string.
  • the above-mentioned preset tuple composition rules for example, specify the tuple size, that is, the number of words contained in each tuple, and the positional relationship of each word in each tuple.
  • the word segmentation result of the character string S to be detected includes three words: A, B, and C in order.
  • the tuple composition rule stipulates that the size of the tuple is 2, that is, each tuple contains 2 words, and for each word, the corresponding tuple is composed of itself and a word adjacent thereto. Then, the tuple corresponding to the to-be-detected character string S includes two tuples (A, B) and (B, C).
  • Step 103 Determine whether there is a model tuple corresponding to each tuple in the attack model database obtained in advance, whether there is a model word corresponding to the first word in each word, and if yes, perform steps 104, otherwise, the end.
  • the attack model database stores the appearance probability of each model tuple and each model tuple, the probability of occurrence of each model word and each model word.
  • Step 104 Obtain an occurrence probability of each corresponding model tuple and a corresponding model word, and according to the corresponding modes The probability of occurrence of the type of tuple and the probability of occurrence of each corresponding model word determine the attack probability corresponding to the character string to be detected.
  • Step 105 If the attack probability is greater than or equal to a preset probability threshold, determine that the to-be-detected character string is a character string having an aggressive behavior.
  • the attack model database is pre-established, and is obtained by performing statistical analysis on a large number of attack sample strings obtained in advance, specifically, each model tuple stored in the attack model database and each model.
  • the probability of occurrence of tuples, the probability of occurrence of each model word and each model word is obtained by statistical analysis of a large number of attack sample strings.
  • Each model word includes each word obtained by separately segmenting a plurality of attack sample strings; each model tuple includes each tuple obtained by forming a tuple for each model word included in each attack sample string.
  • the attack model database After obtaining each word and each tuple included in the to-be-detected character string, querying the attack model database to determine whether there is a model tuple corresponding to each tuple in the attack model database, and whether there is a character to be detected.
  • the model word corresponding to the first word obtained after the word segmentation process. If so, the corresponding probability of occurrence is obtained separately.
  • the reason for determining whether there is a model word corresponding to the first word obtained after the word segmentation process to be detected is determined by the attack probability calculation formula of the character string to be detected, which will be described below.
  • the attack probability corresponding to the character string to be detected can be obtained as follows:
  • the first word obtained after the processing of the character string S to be detected is A.
  • the above-mentioned word A exists in the attack model database, as well as the tuple (A, B) and the tuple (B, C), and the probability of occurrence P of A (P) is p1, and the probability of occurrence of the tuple (A, B) is P.
  • B) p2
  • C) p3.
  • attack probability P(S) of the character string S to be detected is P(A)+P(A
  • C) p1+p2+p3.
  • (p1+p2+p3) is greater than the preset probability threshold p0, it indicates that the to-be-detected character string S has many tuples and words with attack characteristics. At this time, it is determined that the to-be-detected character string S has an aggressive behavior. String.
  • the network to be detected for determining whether the network to be detected, that is, the network transmission data, has a network attack behavior, first performing word segmentation and tuple composition processing to obtain corresponding tuples; and further, obtaining in advance Storing a model tuple corresponding to each model tuple and its corresponding appearance probability and each model word and its corresponding appearance probability, matching the obtained model tuple and the first word, thereby corresponding to the corresponding model tuple And an occurrence probability of the corresponding model word determines an attack probability of the to-be-detected character string, and if the attack probability is greater than a certain threshold, the word is determined
  • a string is a string with aggressive behavior.
  • Embodiment 2 is a flowchart of Embodiment 2 of the network attack detection method of the present invention. As shown in FIG. 2, before the step 101, the embodiment further includes the following steps:
  • Step 201 Acquire an attack sample set, where the attack sample set includes each attack sample string.
  • Each of the above attack sample strings is a pre-acquired string having a network attack behavior.
  • Step 202 Perform word segmentation processing on each attack sample string to obtain the model words included in the attack sample set.
  • each attack sample string is subjected to word segmentation processing to obtain a model word included in each attack sample string, and then, the model words included in each attack sample string are combined, and each of the attack sample sets is obtained. Model word.
  • Step 203 Perform tuple generation processing on the model words included in each attack sample string according to the preset tuple composition rule to determine the model tuples included in the attack sample set.
  • model words included in each attack sample string are subjected to tuple generation processing, and the model tuples included in each attack sample string are obtained, and then the model elements included in each attack sample string are combined. Group, get the model tuples contained in the attack sample set.
  • Step 204 Determine an occurrence probability of each model word included in the attack sample set and an appearance probability of each model tuple included in the attack sample set.
  • the attack sample set contains two attack sample strings S1 and S2
  • the S1 word segmentation result includes three model words A, B, and C in turn, and obtains two elements (A, B) and (B, C).
  • Group; S2 word segmentation results include three model words A, C, and D in turn, and two tuples (A, C) and (C, D) are obtained.
  • the probability of occurrence of each model word included in the attack sample set is determined as follows:
  • the probability of occurrence of each model word contained in the attack sample set is determined based on the ratio of the number of occurrences of each model word contained in the attack sample set to the total number of all model words contained in the attack sample set.
  • the number of occurrences is 2, and the total number of all model words contained in the attack sample set is 6, so that the probability of occurrence is 2/6.
  • the probability of occurrence of each model tuple contained in the attack sample set is determined according to the following formula:
  • w 1 ,...,w n-1 ,w n are n model words contained in any model tuple
  • w 1 ,...,w n-1 ) is the The probability of occurrence of a model tuple, n is an integer greater than or equal to 2
  • w n is the first model word in the model tuple
  • w 1 ,..., w n-1 is located after the first model word N-1 model words
  • #(w 1 ,...,w n-1 ,w n ) are the number of occurrences of any of the model tuples in all model tuples included in the attack sample set
  • # (w 1 , . . . , w n-1 ) is the number of times the model words w 1 , . . . , w n-1 co-occur in all of the sample strings contained in the attack sample set.
  • Step 205 Associate the model words included in the attack sample set with the appearance probability of each model word in the attack model database, and include the model tuples included in the attack sample set. And stored in the attack model database in association with the appearance probability of each model tuple.
  • an attack model database is obtained.
  • the specific form of the attack string is constantly updated, the characteristics of its attack behavior do not change substantially, that is, it often has a large number of attack sample strings with similar probability and statistical characteristics. Therefore, based on the attack model database, it is possible to accurately determine whether the string to be detected has an attack behavior.
  • the terminal device includes: a first obtaining module 11, a first determining module 12, a second determining module 13, and a third determining module 14.
  • the fourth determining module 15 is provided.
  • the first obtaining module 11 is configured to obtain a character string to be detected, and perform word segmentation processing on the to-be-detected character string to obtain each word included in the to-be-detected character string.
  • the first determining module 12 is configured to perform a tuple generation process on the words according to a preset tuple composition rule to determine each tuple corresponding to the to-be-detected character string.
  • the second determining module 13 is configured to determine whether there is a model tuple corresponding to each tuple in the attack model database obtained in advance, whether there is a model word corresponding to the first word in each word,
  • the attack model database stores the occurrence probability of each model tuple and each model tuple, the probability of occurrence of each model word and each model word.
  • the third determining module 14 is configured to: when the second determining module determines that each corresponding model tuple and the corresponding model word exist, acquire an occurrence probability of each corresponding model tuple and the corresponding model word, and according to the corresponding model element The probability of occurrence of the group and the probability of occurrence of each corresponding model word determine the attack probability corresponding to the character string to be detected.
  • the fourth determining module 15 is configured to determine that the to-be-detected character string is a character string having an aggressive behavior when the attack probability is greater than or equal to a preset probability threshold.
  • the third determining module 14 has a
  • the probability of occurrence of each of the corresponding attack model tuples and the probability of occurrence of the corresponding model words are summed to obtain an attack probability corresponding to the to-be-detected character string.
  • the device in this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 1 , and the implementation principle and technical effects are similar, and details are not described herein again.
  • Embodiment 2 is a schematic structural diagram of Embodiment 2 of the network attack detection device of the present invention. As shown in FIG. 4, on the basis of the embodiment shown in FIG. 3, the method further includes: a second obtaining module 21, a third obtaining module 22, and a fifth The determination module 23, the sixth determination module 24, and the storage module 25 are determined.
  • the second obtaining module 21 is configured to acquire an attack sample set, where the attack sample set includes each attack sample string.
  • the third obtaining module 22 is configured to perform word segmentation processing on each attack sample string to obtain the model words included in the attack sample set.
  • the fifth determining module 23 is configured to perform a tuple generation process on the model words included in each attack sample string according to the preset tuple composition rule to determine the models included in the attack sample set. Tuple.
  • the sixth determining module 24 is configured to respectively determine an occurrence probability of the model words included in the attack sample set and an appearance probability of the model tuples included in the attack sample set.
  • a storage module 25 configured to store, in the attack model database, the model words included in the attack sample set and the appearance probability of each model word, and the respective included in the attack sample set
  • the model tuple is stored in the attack model database in association with the probability of occurrence of the model tuples.
  • the sixth determining module 24 is specifically configured to:
  • Determining the probability of occurrence of each model word included in the attack sample set according to a ratio of the number of occurrences of each model word included in the attack sample set to the total number of all model words included in the attack sample set.
  • the sixth determining module 24 is further configured to:
  • w 1 ,...,w n-1 ,w n are n model words contained in any model tuple
  • w 1 ,...,w n-1 ) is the The probability of occurrence of a model tuple, n is an integer greater than or equal to 2
  • w n is the first model word in the model tuple
  • w 1 ,..., w n-1 is located after the first model word N-1 model words
  • #(w 1 ,...,w n-1 ,w n ) are the number of occurrences of any of the model tuples in all model tuples included in the attack sample set
  • # (w 1 , . . . , w n-1 ) is the number of times the model words w 1 , . . . , w n-1 co-occur in all of the sample strings contained in the attack sample set.
  • the device in this embodiment may be used to implement the technical solution of the method embodiment shown in FIG. 2, and the implementation principle and the technical effect are similar, and details are not described herein again.
  • the embodiment of the present application provides another network attack detecting device.
  • 5 is a schematic structural diagram of Embodiment 3 of a network attack detection device according to the present invention.
  • the network attack detection device 400 includes a transceiver 401, a processor 402, a memory 403, and a bus system 404.
  • the memory 403 is used to store a program.
  • the program can include program code, the program code including computer operating instructions.
  • the memory 403 may be a random access memory (RAM) or a non-volatile memory, such as at least one disk storage. Only one memory is shown in the figure, of course, the memory can also be set to a plurality as needed. Memory 403 can also be a memory in processor 402.
  • the memory 403 stores the following elements, executable modules or data structures, or a subset thereof, or an extended set thereof:
  • Operation instructions include various operation instructions for implementing various operations.
  • Operating system Includes a variety of system programs for implementing various basic services and handling hardware-based tasks.
  • the processor 402 controls the operation of the network attack detecting device 400, and the processor 402 may also be referred to as a CPU (Central Processing Unit).
  • the components of the network attack detecting device 400 are coupled together by a bus system 404.
  • the bus system 404 may include a power bus, a control bus, a status signal bus, and the like in addition to the data bus.
  • various buses are labeled as bus system 404 in the figure. For ease of representation, only the schematic drawing is shown in FIG.
  • Processor 402 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the foregoing method may be completed by an integrated logic circuit of hardware in the processor 402 or an instruction in a form of software.
  • the processor 402 described above may be a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, or discrete hardware. Component.
  • DSP digital signal processor
  • ASIC application specific integrated circuit
  • FPGA field programmable gate array
  • the methods, steps, and logical block diagrams disclosed in the embodiments of the present application can be implemented or executed.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present application may be directly implemented by the hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a conventional storage medium such as random access memory, flash memory, read only memory, programmable read only memory or electrically erasable programmable memory, registers, and the like.
  • the storage medium is located in the memory 403, and the processor 402 reads the information in the memory 403 and performs the following steps in conjunction with its hardware:
  • the transceiver 401 is configured to acquire a character string to be detected.
  • the processor 402 is configured to perform word segmentation processing on the to-be-detected character string to obtain each word included in the to-be-detected character string; and perform tuple generation processing on each word according to a preset tuple composition rule. Determine and treat Detecting each tuple corresponding to the string;
  • the processor 402 is further configured to determine whether there is a model tuple corresponding to each tuple in the attack model database obtained in advance, whether there is a model word corresponding to the first word in each word,
  • the attack model database stores the appearance probability of each model tuple and each model tuple, the occurrence probability of each model word and each model word; if present, acquires the appearance of each corresponding model tuple and the corresponding model word And determining, according to the probability of occurrence of each corresponding model tuple and the probability of occurrence of each corresponding model word, an attack probability corresponding to the to-be-detected character string; if the attack probability is greater than or equal to a preset probability threshold, determining The character string to be detected is a character string having an aggressive behavior.
  • the processor 402 is specifically configured to:
  • the probability of occurrence of the corresponding attack model tuple and the probability of occurrence of the corresponding model word are summed to obtain an attack probability corresponding to the to-be-detected character string.
  • the transceiver 401 is further configured to: acquire an attack sample set, where the attack sample set includes each attack sample string;
  • the processor 402 is further configured to:
  • a memory 403 configured to store, in association with each occurrence of the model words included in the attack sample set, an occurrence probability of each model word into the attack model database, and the models included in the attack sample set
  • the tuple is stored in the attack model database in association with the appearance probability of each model tuple
  • the processor 402 is specifically configured to:
  • the processor 402 is specifically configured to:
  • w 1 ,...,w n-1 ,w n are n model words contained in any model tuple
  • w 1 ,...,w n-1 ) is the The probability of occurrence of a model tuple, n is an integer greater than or equal to 2
  • w n is the first model word in the model tuple
  • w 1 ,..., w n-1 is located after the first model word N-1 model words
  • #(w 1 ,...,w n-1 ,w n ) are the number of occurrences of any of the model tuples in all model tuples included in the attack sample set
  • # (w 1 , . . . , w n-1 ) is the number of times the model words w 1 , . . . , w n-1 co-occur in all of the sample strings contained in the attack sample set.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
  • Machine Translation (AREA)

Abstract

一种网络攻击检测方法和设备，该方法包括：对待检测字符串进行分词处理得到各单词；确定与待检测字符串对应的各元组；确定攻击模型数据库中是否存在与各元组对应的模型元组，是否存在与各单词中的第一个单词对应的模型单词，攻击模型数据库中存储有各模型元组以及每个模型元组的出现概率，各模型单词以及每个模型单词的出现概率；若存在，则获取各对应模型元组以及对应模型单词的出现概率，并根据各对应模型元组的出现概率以及各对应模型单词的出现概率，确定待检测字符串对应的攻击概率；若攻击概率大于或等于预设概率阈值，则确定待检测字符串是具有攻击行为的字符串，从而保证能准确确定该待检测字符串是否具有攻击行为。

Description

网络攻击检测方法和设备
本申请要求在2015年8月17日提交中华人民共和国知识产权局、申请号为201510505895.9、发明名称为“网络攻击检测方法和设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及网络安全领域，尤其是涉及一种网络攻击检测方法和设备。
背景技术
网络攻击是影响网络安全的一个重要隐患，为了保证网络安全运行，需要及时检测出网络中存在的攻击行为。
现有的网络攻击检测技术都是使用特征库中的正则表达式来匹配诸如HTTP(HyperText Transfer Protocol，超文本传输协议)请求等网络传输数据，以此判定传输数据中是否存在攻击。
这种方式需要基于大量的正则表达式特征库，但该特征库中经常会出现盲点，而且特征库中的特征经常会出现前后关联的情况，导致添加新特征人工成本更高，甚至可能出现新特征影响旧特征，致使旧特征失效的情况，从而无法保证网络攻击检测的准确可靠。
发明内容
本申请提供一种网络攻击检测方法和设备，用以提高网络攻击检测的准确性。
本申请实施例提供的一种网络攻击检测方法，包括：
获取待检测字符串，并对所述待检测字符串进行分词处理，得到所述待检测字符串中包含的各单词；根据预设元组构成规则对所述各单词进行元组生成处理，以确定与所述待检测字符串对应的各元组；
确定预先获得的攻击模型数据库中，是否存在与所述各元组对应的模型元组，是否存在与所述各单词中的第一个单词对应的模型单词，所述攻击模型数据库中存储有各模型元组以及每个模型元组的出现概率，各模型单词以及每个模型单词的出现概率；
若存在，则获取各对应模型元组以及对应模型单词的出现概率，并根据所述各对应模型元组的出现概率以及各对应模型单词的出现概率，确定所述待检测字符串对应的攻击概率；若所述攻击概率大于或等于预设概率阈值，则确定所述待检测字符串是具有攻击行为的字符串。
本申请实施例提供的方法，针对当前待检测字符串即网络传输数据，在确定其是否具有网络攻击行为时，首先对其进行分词、元组构成处理，得到对应的各元组；进而，在预先获得的存储有各模型元组及其对应出现概率和各模型单词及其对应出现概率的攻击模 型数据库中，匹配与得到的各元组对应的模型元组和第一个单词，从而根据对应模型元组和对应模型单词的出现概率确定出该待检测字符串的攻击概率，如果攻击概率大于一定阈值，则确定该字符串为具有攻击行为的字符串。由于攻击模型数据库中存储的各模型单词和模型元组的出现概率是基于对大量攻击样本统计分析获得的，能够体现出攻击样本的统计特征，从而，基于该统计特征能够使得待检测字符串的攻击行为检测结果更加准确。
可选的，所述根据所述各对应模型元组的出现概率以及各对应模型单词的出现概率，确定所述待检测字符串对应的攻击概率，包括：
将所述各对应攻击模型元组的出现概率和所述对应模型单词的出现概率加和，得到所述待检测字符串对应的攻击概率。
进一步地，所述获取待检测字符串，并对所述待检测字符串进行分词处理，得到所述待检测字符串中包含的各单词之前，还包括：
获取攻击样本集，所述攻击样本集中包括各攻击样本字符串；
分别对所述各攻击样本字符串进行分词处理，得到所述攻击样本集中包含的所述各模型单词；
根据所述预设元组构成规则分别对所述各攻击样本字符串中包含的模型单词进行元组生成处理，以确定所述攻击样本集中包含的所述各模型元组；
分别确定所述攻击样本集中包含的所述各模型单词的出现概率以及所述攻击样本集中包含的所述各模型元组的出现概率；
将所述攻击样本集中包含的所述各模型单词与所述各模型单词的出现概率关联存储到所述攻击模型数据库中，以及将所述攻击样本集中包含的所述各模型元组与所述各模型元组的出现概率关联存储到所述攻击模型数据库中。
上述方法，由于攻击模型数据库中存储的各模型单词和模型元组的出现概率是基于对大量攻击样本统计分析获得的，能够体现出攻击样本的统计特征，从而，基于该统计特征能够使得待检测字符串的攻击行为检测结果更加准确。
可选的，所述确定所述攻击样本集中包含的所述各模型单词的出现概率，包括：
根据所述攻击样本集中包含的每个各模型单词的出现次数，与所述攻击样本集中包含的全部模型单词的总数的比值，确定所述攻击样本集中包含的每个模型单词的出现概率。
可选的，所述确定所述攻击样本集中包含的所述各模型元组的出现概率，包括：
根据如下公式确定所述攻击样本集中包含的所述各模型元组的出现概率：
P(wn|w1,...,wn-1)＝#(w1,...,wn-1,wn)/#(w1,...,wn-1)
其中，w1,...,wn-1,wn为任一模型元组中包含的n个模型单词，P(wn|w1,...,wn-1)为该任 一模型元组的出现概率，n为大于或等于2的整数，wn为模型元组中的第一个模型单词，w1,...,wn-1为位于第一个模型单词之后的n-1个模型单词；#(w1,...,wn-1,wn)为该任一模型元组在所述攻击样本集中包含的全部模型元组中出现的次数，#(w1,...,wn-1)为模型单词w1,...,wn-1在所述攻击样本集中包含的全部样本字符串中共同出现的次数。
上述方法，基于对大量攻击样本字符串中各单词和各元组出现概率的分析，得到了攻击模型数据库，虽然随着攻击字符串具体形式的不断更新，但是，其攻击行为的特征不会发生本质改变，即其往往会有大量攻击样本字符串具有类似的概率统计特征。从而，基于该攻击模型数据库，能够实现对待检测字符串是否具有攻击行为进行准确判定。
本申请实施例提供一种网络攻击检测设备，包括：
第一获取模块，用于获取待检测字符串，并对所述待检测字符串进行分词处理，得到所述待检测字符串中包含的各单词；
第一确定模块，用于根据预设元组构成规则对所述各单词进行元组生成处理，以确定与所述待检测字符串对应的各元组；
第二确定模块，用于确定预先获得的攻击模型数据库中，是否存在与所述各元组对应的模型元组，是否存在与所述各单词中的第一个单词对应的模型单词，所述攻击模型数据库中存储有各模型元组以及每个模型元组的出现概率，各模型单词以及每个模型单词的出现概率；
第三确定模块，用于在所述第二确定模块确定存在各对应模型元组和对应模型单词时，获取各对应模型元组以及对应模型单词的出现概率，并根据所述各对应模型元组的出现概率以及各对应模型单词的出现概率，确定所述待检测字符串对应的攻击概率；
第四确定模块，用于在所述攻击概率大于或等于预设概率阈值时，确定所述待检测字符串是具有攻击行为的字符串。
可选的，所述第三确定模块具体用于：将所述各对应攻击模型元组的出现概率和所述对应模型单词的出现概率加和，得到所述待检测字符串对应的攻击概率。
可选的，还包括：
第二获取模块，用于获取攻击样本集，所述攻击样本集中包括各攻击样本字符串；
第三获取模块，用于分别对所述各攻击样本字符串进行分词处理，得到所述攻击样本集中包含的所述各模型单词；
第五确定模块，用于根据所述预设元组构成规则分别对所述各攻击样本字符串中包含的模型单词进行元组生成处理，以确定所述攻击样本集中包含的所述各模型元组；
第六确定模块，用于分别确定所述攻击样本集中包含的所述各模型单词的出现概率以及所述攻击样本集中包含的所述各模型元组的出现概率；
存储模块，用于将所述攻击样本集中包含的所述各模型单词与所述各模型单词的出现概率关联存储到所述攻击模型数据库中，以及将所述攻击样本集中包含的所述各模型元组与所述各模型元组的出现概率关联存储到所述攻击模型数据库中。
可选的，所述第六确定模块具体用于：
根据所述攻击样本集中包含的每个各模型单词的出现次数，与所述攻击样本集中包含的全部模型单词的总数的比值，确定所述攻击样本集中包含的每个模型单词的出现概率。
可选的，所述第六确定模块还用于：
根据如下公式确定所述攻击样本集中包含的所述各模型元组的出现概率：
P(wn|w1,...,wn-1)＝#(w1,...,wn-1,wn)/#(w1,...,wn-1)
其中，w1,...,wn-1,wn为任一模型元组中包含的n个模型单词，P(wn|w1,...,wn-1)为该任一模型元组的出现概率，n为大于或等于2的整数，wn为模型元组中的第一个模型单词，w1,...,wn-1为位于第一个模型单词之后的n-1个模型单词；#(w1,...,wn-1,wn)为该任一模型元组在所述攻击样本集中包含的全部模型元组中出现的次数，#(w1,...,wn-1)为模型单词w1,...,wn-1在所述攻击样本集中包含的全部样本字符串中共同出现的次数。
本申请实施例提供一种网络攻击检测设备，包括：收发器、处理器；
所述收发器，用于获取待检测字符串；
所述处理器，用于对所述待检测字符串进行分词处理，得到所述待检测字符串中包含的各单词；根据预设元组构成规则对所述各单词进行元组生成处理，以确定与所述待检测字符串对应的各元组；
所述处理器，还用于确定预先获得的攻击模型数据库中，是否存在与所述各元组对应的模型元组，是否存在与所述各单词中的第一个单词对应的模型单词，所述攻击模型数据库中存储有各模型元组以及每个模型元组的出现概率，各模型单词以及每个模型单词的出现概率；若存在，则获取各对应模型元组以及对应模型单词的出现概率，并根据所述各对应模型元组的出现概率以及各对应模型单词的出现概率，确定所述待检测字符串对应的攻击概率；若所述攻击概率大于或等于预设概率阈值，则确定所述待检测字符串是具有攻击行为的字符串。
可选的，所述处理器具体用于：
将所述各对应攻击模型元组的出现概率和所述对应模型单词的出现概率加和，得到所 述待检测字符串对应的攻击概率。
可选的，所述处理器还用于：
所述收发器还用于：获取攻击样本集，所述攻击样本集中包括各攻击样本字符串；
所述处理器还用于：分别对所述各攻击样本字符串进行分词处理，得到所述攻击样本集中包含的所述各模型单词；根据所述预设元组构成规则分别对所述各攻击样本字符串中包含的模型单词进行元组生成处理，以确定所述攻击样本集中包含的所述各模型元组；分别确定所述攻击样本集中包含的所述各模型单词的出现概率以及所述攻击样本集中包含的所述各模型元组的出现概率；
所述设备还包括：
存储器，用于将所述攻击样本集中包含的所述各模型单词与所述各模型单词的出现概率关联存储到所述攻击模型数据库中，以及将所述攻击样本集中包含的所述各模型元组与所述各模型元组的出现概率关联存储到所述攻击模型数据库中。
可选的，所述处理器具体用于：
根据所述攻击样本集中包含的每个各模型单词的出现次数，与所述攻击样本集中包含的全部模型单词的总数的比值，确定所述攻击样本集中包含的每个模型单词的出现概率。
可选的，所述处理器具体用于：
根据如下公式确定所述攻击样本集中包含的所述各模型元组的出现概率：
P(wn|w1,...,wn-1)＝#(w1,...,wn-1,wn)/#(w1,...,wn-1)
其中，w1,...,wn-1,wn为任一模型元组中包含的n个模型单词，P(wn|w1,...,wn-1)为该任一模型元组的出现概率，n为大于或等于2的整数，wn为模型元组中的第一个模型单词，w1,...,wn-1为位于第一个模型单词之后的n-1个模型单词；#(w1,...,wn-1,wn)为该任一模型元组在所述攻击样本集中包含的全部模型元组中出现的次数，#(w1,...,wn-1)为模型单词w1,...,wn-1在所述攻击样本集中包含的全部样本字符串中共同出现的次数。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简要介绍。
图1为本发明网络攻击检测方法实施例一的流程图；
图2为本发明网络攻击检测方法实施例二的流程图；
图3为本发明网络攻击检测设备实施例一的结构示意图；
图4为本发明网络攻击检测设备实施例二的结构示意图；
图5为本发明网络攻击检测设备实施例三的结构示意图。
具体实施方式
为了使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请作进一步地详细描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其它实施例，都属于本申请保护的范围。
下面结合说明书附图对本申请实施例作进一步详细描述。
图1为本发明网络攻击检测方法实施例一的流程图，如图1所示，该方法包括如下步骤：
步骤101、获取待检测字符串，并对所述待检测字符串进行分词处理，得到所述待检测字符串中包含的各单词。
本实施例中，上述待检测字符串是指比如HTTP请求消息等网络传输数据。基于语义以及字符识别等方式，对待检测字符串进行分词处理，得到其中包含的各单词。
值得说明的是，对于一条待检测字符串来说，其并非完全由英文单词组成的，还包含数字、符号等组成部分，本实施例中，将这些组成部分统称为单词。
步骤102、根据预设元组构成规则对所述各单词进行元组生成处理，以确定与所述待检测字符串对应的各元组。
上述预设元组构成规则中比如规定了元组大小即每个元组中包含的单词数量，以及每个元组内各单词的位置关系。
举例来说，假设待检测字符串S的分词结果是依次包括：A、B、C三个单词。并且假设元组构成规则规定元组的大小为2即每个元组包含2个单词，且依次针对每个单词来说，其对应的元组由自身以及其后相邻的一个单词构成。那么，上述待检测字符串S对应的元组包括(A,B)和(B,C)这两个元组。
步骤103、确定预先获得的攻击模型数据库中，是否存在与所述各元组对应的模型元组，是否存在与所述各单词中的第一个单词对应的模型单词，若存在，则执行步骤104，否则，结束。
其中，所述攻击模型数据库中存储有各模型元组以及每个模型元组的出现概率，各模型单词以及每个模型单词的出现概率。
步骤104、获取各对应模型元组以及对应模型单词的出现概率，并根据所述各对应模 型元组的出现概率以及各对应模型单词的出现概率，确定所述待检测字符串对应的攻击概率。
步骤105、若所述攻击概率大于或等于预设概率阈值，则确定所述待检测字符串是具有攻击行为的字符串。
本实施例中，上述攻击模型数据库是预先建立的，是通过对预先获得的大量攻击样本字符串进行统计分析后获得的，具体来说，攻击模型数据库中存储的各模型元组以及每个模型元组的出现概率，各模型单词以及每个模型单词的出现概率，都是对大量攻击样本字符串统计分析获得的。
其中，各模型单词包括对大量攻击样本字符串分别分词处理后得到的各单词；各模型元组包括对每个攻击样本字符串中包含的各模型单词进行组建元组后得到的各元组。
具体的攻击模型数据库的建立过程将在后续实施例中描述。本实施例中，仅涉及攻击模型数据库的使用过程。
具体地，在获得了待检测字符串中包含的各单词以及各元组之后，查询攻击模型数据库，以确定攻击模型数据库中是否存在与各元组对应的模型元组，是否存在与待检测字符串分词处理后得到的第一个单词对应的模型单词。如果存在，则分别获得对应的出现概率。
其中，之所以是确定是否存在与待检测字符串分词处理后得到的第一个单词对应的模型单词，是由待检测字符串的攻击概率计算公式决定的，下面会介绍。
在得到各对应模型元组的出现概率以及与第一个单词对应的模型单词的出现概率之后，可以通过如下方式得到待检测字符串对应的攻击概率：
将各对应攻击模型元组的出现概率和对应模型单词的出现概率加和。
仍以上述举例来说，待检测字符串S分词处理后得到的第一个单词为A。假设攻击模型数据库中存在上述单词A，以及元组(A,B)和元组(B,C)，且A的出现概率P(A)＝p1，元组(A,B)的出现概率P(A|B)＝p2，元组(B,C)的出现概率P(B|C)＝p3。
从而，待检测字符串S的攻击概率P(S)＝P(A)+P(A|B)+P(B|C)＝p1+p2+p3。
进而，如果(p1+p2+p3)大于预设概率阈值p0，则说明该待检测字符串S中具有很多具有攻击特征的元组和单词，此时，确定待检测字符串S是具有攻击行为的字符串。
本实施例中，针对当前待检测字符串即网络传输数据，在确定其是否具有网络攻击行为时，首先对其进行分词、元组构成处理，得到对应的各元组；进而，在预先获得的存储有各模型元组及其对应出现概率和各模型单词及其对应出现概率的攻击模型数据库中，匹配与得到的各元组对应的模型元组和第一个单词，从而根据对应模型元组和对应模型单词的出现概率确定出该待检测字符串的攻击概率，如果攻击概率大于一定阈值，则确定该字 符串为具有攻击行为的字符串。由于攻击模型数据库中存储的各模型单词和模型元组的出现概率是基于对大量攻击样本统计分析获得的，能够体现出攻击样本的统计特征，从而，基于该统计特征能够使得待检测字符串的攻击行为检测结果更加准确。
图2为本发明网络攻击检测方法实施例二的流程图，如图2所示，在步骤101之前，本实施例中还包括如下步骤：
步骤201、获取攻击样本集，所述攻击样本集中包括各攻击样本字符串。
上述各攻击样本字符串是预先采集获得的具有网络攻击行为的字符串。
步骤202、分别对所述各攻击样本字符串进行分词处理，得到所述攻击样本集中包含的所述各模型单词。
参考上述实施例，对每个攻击样本字符串进行分词处理，得到每个攻击样本字符串中包括的模型单词，进而，合并各攻击样本字符串中包含的模型单词，得到攻击样本集中包含的各模型单词。
步骤203、根据所述预设元组构成规则分别对所述各攻击样本字符串中包含的模型单词进行元组生成处理，以确定所述攻击样本集中包含的所述各模型元组。
参考上述实施例，对每个攻击样本字符串中包含的模型单词进行元组生成处理，得到每个攻击样本字符串中包含的模型元组，进而，合并各攻击样本字符串中包含的模型元组，得到攻击样本集中包含的各模型元组。
步骤204、分别确定所述攻击样本集中包含的所述各模型单词的出现概率以及所述攻击样本集中包含的所述各模型元组的出现概率。
举例来说，假设攻击样本集中包含S1和S2两个攻击样本字符串，S1分词结果是依次包括A、B、C三个模型单词，得到(A,B)和(B,C)两个元组；S2分词结果是依次包括A、C、D三个模型单词，得到(A,C)和(C,D)两个元组。
其中，根据如下方式确定攻击样本集中包含的各模型单词的出现概率：
根据攻击样本集中包含的每个各模型单词的出现次数，与攻击样本集中包含的全部模型单词的总数的比值，确定攻击样本集中包含的每个模型单词的出现概率。
以上述举例来说，针对模型单词C来说，其出现次数为2，攻击样本集中包含的全部模型单词的总数为6，从而，其出现概率为2/6。
其中，根据如下公式确定攻击样本集中包含的各模型元组的出现概率：
P(wn|w1,...,wn-1)＝#(w1,...,wn-1,wn)/#(w1,...,wn-1)
其中，w1,...,wn-1,wn为任一模型元组中包含的n个模型单词，P(wn|w1,...,wn-1)为该任 一模型元组的出现概率，n为大于或等于2的整数，wn为模型元组中的第一个模型单词，w1,...,wn-1为位于第一个模型单词之后的n-1个模型单词；#(w1,...,wn-1,wn)为该任一模型元组在所述攻击样本集中包含的全部模型元组中出现的次数，#(w1,...,wn-1)为模型单词w1,...,wn-1在所述攻击样本集中包含的全部样本字符串中共同出现的次数。
以上述举例来说，针对元组(A,C)来说，其出现概率为P(A|C)＝#(A,C)/#(A)。
其中，#(A,C)＝1，#(A)＝2，则P(A|C)＝1/2。
步骤205、将所述攻击样本集中包含的所述各模型单词与所述各模型单词的出现概率关联存储到所述攻击模型数据库中，以及将所述攻击样本集中包含的所述各模型元组与所述各模型元组的出现概率关联存储到所述攻击模型数据库中。
本实施例中，基于对大量攻击样本字符串中各单词和各元组出现概率的分析，得到了攻击模型数据库。虽然随着攻击字符串具体形式的不断更新，但是，其攻击行为的特征不会发生本质改变，即其往往会有大量攻击样本字符串具有类似的概率统计特征。从而，基于该攻击模型数据库，能够实现对待检测字符串是否具有攻击行为进行准确判定。
图3为本发明网络攻击检测设备实施例一的结构示意图，如图3所示，该终端设备包括：第一获取模块11、第一确定模块12、第二确定模块13、第三确定模块14、第四确定模块15。
第一获取模块11，用于获取待检测字符串，并对所述待检测字符串进行分词处理，得到所述待检测字符串中包含的各单词。
第一确定模块12，用于根据预设元组构成规则对所述各单词进行元组生成处理，以确定与所述待检测字符串对应的各元组。
第二确定模块13，用于确定预先获得的攻击模型数据库中，是否存在与所述各元组对应的模型元组，是否存在与所述各单词中的第一个单词对应的模型单词，所述攻击模型数据库中存储有各模型元组以及每个模型元组的出现概率，各模型单词以及每个模型单词的出现概率。
第三确定模块14，用于在所述第二确定模块确定存在各对应模型元组和对应模型单词时，获取各对应模型元组以及对应模型单词的出现概率，并根据所述各对应模型元组的出现概率以及各对应模型单词的出现概率，确定所述待检测字符串对应的攻击概率。
第四确定模块15，用于在所述攻击概率大于或等于预设概率阈值时，确定所述待检测字符串是具有攻击行为的字符串。
其中，所述第三确定模块14具有用于：
将所述各对应攻击模型元组的出现概率和所述各对应模型单词的出现概率加和，得到所述待检测字符串对应的攻击概率。
本实施例的设备可以用于执行图1所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
图4为本发明网络攻击检测设备实施例二的结构示意图，如图4所示，在图3所示实施例的基础上，还包括：第二获取模块21、第三获取模块22、第五确定模块23、第六确定模块24、存储模块25。
第二获取模块21，用于获取攻击样本集，所述攻击样本集中包括各攻击样本字符串。
第三获取模块22，用于分别对所述各攻击样本字符串进行分词处理，得到所述攻击样本集中包含的所述各模型单词。
第五确定模块23，用于根据所述预设元组构成规则分别对所述各攻击样本字符串中包含的模型单词进行元组生成处理，以确定所述攻击样本集中包含的所述各模型元组。
第六确定模块24，用于分别确定所述攻击样本集中包含的所述各模型单词的出现概率以及所述攻击样本集中包含的所述各模型元组的出现概率。
存储模块25，用于将所述攻击样本集中包含的所述各模型单词与所述各模型单词的出现概率关联存储到所述攻击模型数据库中，以及将所述攻击样本集中包含的所述各模型元组与所述各模型元组的出现概率关联存储到所述攻击模型数据库中。
其中，所述第六确定模块24具体用于：
根据所述攻击样本集中包含的每个各模型单词的出现次数，与所述攻击样本集中包含的全部模型单词的总数的比值，确定所述攻击样本集中包含的每个模型单词的出现概率。
其中，所述第六确定模块24还用于：
根据如下公式确定所述攻击样本集中包含的所述各模型元组的出现概率：
P(wn|w1,...,wn-1)＝#(w1,...,wn-1,wn)/#(w1,...,wn-1)
其中，w1,...,wn-1,wn为任一模型元组中包含的n个模型单词，P(wn|w1,...,wn-1)为该任一模型元组的出现概率，n为大于或等于2的整数，wn为模型元组中的第一个模型单词，w1,...,wn-1为位于第一个模型单词之后的n-1个模型单词；#(w1,...,wn-1,wn)为该任一模型元组在所述攻击样本集中包含的全部模型元组中出现的次数，#(w1,...,wn-1)为模型单词w1,...,wn-1在所述攻击样本集中包含的全部样本字符串中共同出现的次数。
本实施例的设备可以用于执行图2所示方法实施例的技术方案，其实现原理和技术效果类似，此处不再赘述。
基于相同的技术构思，本申请实施例提供另一种网络攻击检测设备。图5为本发明网络攻击检测设备实施例三的结构示意图，该网络攻击检测设备400包括：收发器401、处理器402、存储器403和总线系统404；
其中，存储器403，用于存放程序。具体地，程序可以包括程序代码，程序代码包括计算机操作指令。存储器403可能为随机存取存储器(random access memory，简称RAM)，也可能为非易失性存储器(non-volatile memory)，例如至少一个磁盘存储器。图中仅示出了一个存储器，当然，存储器也可以根据需要，设置为多个。存储器403也可以是处理器402中的存储器。
存储器403存储了如下的元素，可执行模块或者数据结构，或者它们的子集，或者它们的扩展集：
操作指令：包括各种操作指令，用于实现各种操作。
操作系统：包括各种系统程序，用于实现各种基础业务以及处理基于硬件的任务。
处理器402控制网络攻击检测设备400的操作，处理器402还可以称为CPU(Central Processing Unit，中央处理单元)。具体的应用中，网络攻击检测设备400的各个组件通过总线系统404耦合在一起，其中总线系统404除包括数据总线之外，还可以包括电源总线、控制总线和状态信号总线等。但是为了清楚说明起见，在图中将各种总线都标为总线系统404。为便于表示，图5中仅是示意性画出。
上述本申请实施例揭示的方法可以应用于处理器402中，或者由处理器402实现。处理器402可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法的各步骤可以通过处理器402中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器402可以是通用处理器、数字信号处理器(DSP)、专用集成电路(ASIC)、现场可编程门阵列(FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器403，处理器402读取存储器403中的信息，结合其硬件执行以下步骤：
所述收发器401，用于获取待检测字符串；
所述处理器402，用于对所述待检测字符串进行分词处理，得到所述待检测字符串中包含的各单词；根据预设元组构成规则对所述各单词进行元组生成处理，以确定与所述待 检测字符串对应的各元组；
所述处理器402，还用于确定预先获得的攻击模型数据库中，是否存在与所述各元组对应的模型元组，是否存在与所述各单词中的第一个单词对应的模型单词，所述攻击模型数据库中存储有各模型元组以及每个模型元组的出现概率，各模型单词以及每个模型单词的出现概率；若存在，则获取各对应模型元组以及对应模型单词的出现概率，并根据所述各对应模型元组的出现概率以及各对应模型单词的出现概率，确定所述待检测字符串对应的攻击概率；若所述攻击概率大于或等于预设概率阈值，则确定所述待检测字符串是具有攻击行为的字符串。
可选的，所述处理器402具体用于：
将所述各对应攻击模型元组的出现概率和所述对应模型单词的出现概率加和，得到所述待检测字符串对应的攻击概率。
可选的，所述收发器401还用于：获取攻击样本集，所述攻击样本集中包括各攻击样本字符串；
所述处理器402还用于：
分别对所述各攻击样本字符串进行分词处理，得到所述攻击样本集中包含的所述各模型单词；根据所述预设元组构成规则分别对所述各攻击样本字符串中包含的模型单词进行元组生成处理，以确定所述攻击样本集中包含的所述各模型元组；分别确定所述攻击样本集中包含的所述各模型单词的出现概率以及所述攻击样本集中包含的所述各模型元组的出现概率。
存储器403，用于将所述攻击样本集中包含的所述各模型单词与所述各模型单词的出现概率关联存储到所述攻击模型数据库中，以及将所述攻击样本集中包含的所述各模型元组与所述各模型元组的出现概率关联存储到所述攻击模型数据库中
可选的，所述处理器402具体用于：
根据所述攻击样本集中包含的每个各模型单词的出现次数，与所述攻击样本集中包含的全部模型单词的总数的比值，确定所述攻击样本集中包含的每个模型单词的出现概率。。
可选的，所述处理器402具体用于：
根据如下公式确定所述攻击样本集中包含的所述各模型元组的出现概率：
P(wn|w1,...,wn-1)＝#(w1,...,wn-1,wn)/#(w1,...,wn-1)
其中，w1,...,wn-1,wn为任一模型元组中包含的n个模型单词，P(wn|w1,...,wn-1)为该任一模型元组的出现概率，n为大于或等于2的整数，wn为模型元组中的第一个模型单词， w1,...,wn-1为位于第一个模型单词之后的n-1个模型单词；#(w1,...,wn-1,wn)为该任一模型元组在所述攻击样本集中包含的全部模型元组中出现的次数，#(w1,...,wn-1)为模型单词w1,...,wn-1在所述攻击样本集中包含的全部样本字符串中共同出现的次数。
本申请是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
尽管已描述了本申请的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本申请范围的所有变更和修改。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (15)

  1. 一种网络攻击检测方法，其特征在于，包括：
    获取待检测字符串，并对所述待检测字符串进行分词处理，得到所述待检测字符串中包含的各单词；
    根据预设元组构成规则对所述各单词进行元组生成处理，以确定与所述待检测字符串对应的各元组；
    确定预先获得的攻击模型数据库中，是否存在与所述各元组对应的模型元组，是否存在与所述各单词中的第一个单词对应的模型单词，所述攻击模型数据库中存储有各模型元组以及每个模型元组的出现概率，各模型单词以及每个模型单词的出现概率；
    若存在，则获取各对应模型元组以及对应模型单词的出现概率，并根据所述各对应模型元组的出现概率以及各对应模型单词的出现概率，确定所述待检测字符串对应的攻击概率；
    若所述攻击概率大于或等于预设概率阈值，则确定所述待检测字符串是具有攻击行为的字符串。
  2. 根据权利要求1所述的方法，其特征在于，所述根据所述各对应模型元组的出现概率以及各对应模型单词的出现概率，确定所述待检测字符串对应的攻击概率，包括：
    将所述各对应攻击模型元组的出现概率和所述对应模型单词的出现概率加和，得到所述待检测字符串对应的攻击概率。
  3. 根据权利要求1所述的方法，其特征在于，所述获取待检测字符串，并对所述待检测字符串进行分词处理，得到所述待检测字符串中包含的各单词之前，还包括：
    获取攻击样本集，所述攻击样本集中包括各攻击样本字符串；
    分别对所述各攻击样本字符串进行分词处理，得到所述攻击样本集中包含的所述各模型单词；
    根据所述预设元组构成规则分别对所述各攻击样本字符串中包含的模型单词进行元组生成处理，以确定所述攻击样本集中包含的所述各模型元组；
    分别确定所述攻击样本集中包含的所述各模型单词的出现概率以及所述攻击样本集中包含的所述各模型元组的出现概率；
    将所述攻击样本集中包含的所述各模型单词与所述各模型单词的出现概率关联存储到所述攻击模型数据库中，以及将所述攻击样本集中包含的所述各模型元组与所述各模型元组的出现概率关联存储到所述攻击模型数据库中。
  4. 根据权利要求3所述的方法，其特征在于，所述确定所述攻击样本集中包含的所述各模型单词的出现概率，包括：
    根据所述攻击样本集中包含的每个各模型单词的出现次数，与所述攻击样本集中包含的全部模型单词的总数的比值，确定所述攻击样本集中包含的每个模型单词的出现概率。
  5. 根据权利要求3所述的方法，其特征在于，所述确定所述攻击样本集中包含的所述各模型元组的出现概率，包括：
    根据如下公式确定所述攻击样本集中包含的所述各模型元组的出现概率：
    P(wn|w1,...,wn-1)＝#(w1,...,wn-1,wn)/#(w1,...,wn-1)
    其中，w1,...,wn-1,wn为任一模型元组中包含的n个模型单词，P(wn|w1,...,wn-1)为该任一模型元组的出现概率，n为大于或等于2的整数，wn为模型元组中的第一个模型单词，w1,...,wn-1为位于第一个模型单词之后的n-1个模型单词；#(w1,...,wn-1,wn)为该任一模型元组在所述攻击样本集中包含的全部模型元组中出现的次数，#(w1,...,wn-1)为模型单词w1,...,wn-1在所述攻击样本集中包含的全部样本字符串中共同出现的次数。
  6. 一种网络攻击检测设备，其特征在于，包括：
    第一获取模块，用于获取待检测字符串，并对所述待检测字符串进行分词处理，得到所述待检测字符串中包含的各单词；
    第一确定模块，用于根据预设元组构成规则对所述各单词进行元组生成处理，以确定与所述待检测字符串对应的各元组；
    第二确定模块，用于确定预先获得的攻击模型数据库中，是否存在与所述各元组对应的模型元组，是否存在与所述各单词中的第一个单词对应的模型单词，所述攻击模型数据库中存储有各模型元组以及每个模型元组的出现概率，各模型单词以及每个模型单词的出现概率；
    第三确定模块，用于在所述第二确定模块确定存在各对应模型元组和对应模型单词时，获取各对应模型元组以及对应模型单词的出现概率，并根据所述各对应模型元组的出现概率以及各对应模型单词的出现概率，确定所述待检测字符串对应的攻击概率；
    第四确定模块，用于在所述攻击概率大于或等于预设概率阈值时，确定所述待检测字符串是具有攻击行为的字符串。
  7. 根据权利要求6所述的设备，其特征在于，所述第三确定模块具体用于：
    将所述各对应攻击模型元组的出现概率和所述对应模型单词的出现概率加和，得到所述待检测字符串对应的攻击概率。
  8. 根据权利要求6所述的设备，其特征在于，还包括：
    第二获取模块，用于获取攻击样本集，所述攻击样本集中包括各攻击样本字符串；
    第三获取模块，用于分别对所述各攻击样本字符串进行分词处理，得到所述攻击样本集中包含的所述各模型单词；
    第五确定模块，用于根据所述预设元组构成规则分别对所述各攻击样本字符串中包含的模型单词进行元组生成处理，以确定所述攻击样本集中包含的所述各模型元组；
    第六确定模块，用于分别确定所述攻击样本集中包含的所述各模型单词的出现概率以及所述攻击样本集中包含的所述各模型元组的出现概率；
    存储模块，用于将所述攻击样本集中包含的所述各模型单词与所述各模型单词的出现概率关联存储到所述攻击模型数据库中，以及将所述攻击样本集中包含的所述各模型元组与所述各模型元组的出现概率关联存储到所述攻击模型数据库中。
  9. 根据权利要求8所述的设备，其特征在于，所述第六确定模块具体用于：
    根据所述攻击样本集中包含的每个各模型单词的出现次数，与所述攻击样本集中包含的全部模型单词的总数的比值，确定所述攻击样本集中包含的每个模型单词的出现概率。
  10. 根据权利要求8所述的设备，其特征在于，所述第六确定模块还用于：
    根据如下公式确定所述攻击样本集中包含的所述各模型元组的出现概率：
    P(wn|w1,...,wn-1)＝#(w1,...,wn-1,wn)/#(w1,...,wn-1)
    其中，w1,...,wn-1,wn为任一模型元组中包含的n个模型单词，P(wn|w1,...,wn-1)为该任一模型元组的出现概率，n为大于或等于2的整数，wn为模型元组中的第一个模型单词，w1,...,wn-1为位于第一个模型单词之后的n-1个模型单词；#(w1,...,wn-1,wn)为该任一模型元组在所述攻击样本集中包含的全部模型元组中出现的次数，#(w1,...,wn-1)为模型单词w1,...,wn-1在所述攻击样本集中包含的全部样本字符串中共同出现的次数。
  11. 一种网络攻击检测设备，其特征在于，包括：收发器、处理器；
    所述收发器，用于获取待检测字符串；
    所述处理器，用于对所述待检测字符串进行分词处理，得到所述待检测字符串中包含的各单词；根据预设元组构成规则对所述各单词进行元组生成处理，以确定与所述待检测字符串对应的各元组；
    所述处理器，还用于确定预先获得的攻击模型数据库中，是否存在与所述各元组对应的模型元组，是否存在与所述各单词中的第一个单词对应的模型单词，所述攻击模型数据库中存储有各模型元组以及每个模型元组的出现概率，各模型单词以及每个模型单词的出 现概率；若存在，则获取各对应模型元组以及对应模型单词的出现概率，并根据所述各对应模型元组的出现概率以及各对应模型单词的出现概率，确定所述待检测字符串对应的攻击概率；若所述攻击概率大于或等于预设概率阈值，则确定所述待检测字符串是具有攻击行为的字符串。
  12. 根据权利要求11所述的设备，其特征在于，所述处理器具体用于：
    将所述各对应攻击模型元组的出现概率和所述对应模型单词的出现概率加和，得到所述待检测字符串对应的攻击概率。
  13. 根据权利要求11所述的设备，其特征在于，
    所述收发器还用于：获取攻击样本集，所述攻击样本集中包括各攻击样本字符串；
    所述处理器还用于：分别对所述各攻击样本字符串进行分词处理，得到所述攻击样本集中包含的所述各模型单词；根据所述预设元组构成规则分别对所述各攻击样本字符串中包含的模型单词进行元组生成处理，以确定所述攻击样本集中包含的所述各模型元组；分别确定所述攻击样本集中包含的所述各模型单词的出现概率以及所述攻击样本集中包含的所述各模型元组的出现概率；
    所述设备还包括：
    存储器，用于将所述攻击样本集中包含的所述各模型单词与所述各模型单词的出现概率关联存储到所述攻击模型数据库中，以及将所述攻击样本集中包含的所述各模型元组与所述各模型元组的出现概率关联存储到所述攻击模型数据库中。
  14. 根据权利要求13所述的设备，其特征在于，所述处理器具体用于：
    根据所述攻击样本集中包含的每个各模型单词的出现次数，与所述攻击样本集中包含的全部模型单词的总数的比值，确定所述攻击样本集中包含的每个模型单词的出现概率。
  15. 根据权利要求13所述的设备，其特征在于，所述处理器具体用于：
    根据如下公式确定所述攻击样本集中包含的所述各模型元组的出现概率：
    P(wn|w1,...,wn-1)＝#(w1,...,wn-1,wn)/#(w1,...,wn-1)
    其中，w1,...,wn-1,wn为任一模型元组中包含的n个模型单词，P(wn|w1,...,wn-1)为该任一模型元组的出现概率，n为大于或等于2的整数，wn为模型元组中的第一个模型单词，w1,...,wn-1为位于第一个模型单词之后的n-1个模型单词；#(w1,...,wn-1,wn)为该任一模型元组在所述攻击样本集中包含的全部模型元组中出现的次数，#(w1,...,wn-1)为模型单词w1,...,wn-1在所述攻击样本集中包含的全部样本字符串中共同出现的次数。
PCT/CN2016/095714 2015-08-17 2016-08-17 网络攻击检测方法和设备 WO2017028789A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US15/745,057 US10645105B2 (en) 2015-08-17 2016-08-17 Network attack detection method and device
JP2018508155A JP6567169B2 (ja) 2015-08-17 2016-08-17 サイバー攻撃の検出方法および検出装置

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510505895.9A CN105187408A (zh) 2015-08-17 2015-08-17 网络攻击检测方法和设备
CN201510505895.9 2015-08-17

Publications (1)

Publication Number Publication Date
WO2017028789A1 true WO2017028789A1 (zh) 2017-02-23

Family

ID=54909252

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/095714 WO2017028789A1 (zh) 2015-08-17 2016-08-17 网络攻击检测方法和设备

Country Status (4)

Country Link
US (1) US10645105B2 (zh)
JP (1) JP6567169B2 (zh)
CN (1) CN105187408A (zh)
WO (1) WO2017028789A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111984970A (zh) * 2019-05-22 2020-11-24 深信服科技股份有限公司 一种sql注入检测方法、系统及电子设备和存储介质

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105187408A (zh) 2015-08-17 2015-12-23 北京神州绿盟信息安全科技股份有限公司 网络攻击检测方法和设备
CN107797982B (zh) * 2016-08-31 2021-05-07 百度在线网络技术（北京）有限公司 用于识别文本类型的方法、装置和设备
CN109150886B (zh) * 2018-08-31 2021-07-27 腾讯科技（深圳）有限公司 结构化查询语言注入攻击检测方法及相关设备
CN112232076A (zh) * 2019-06-26 2021-01-15 腾讯科技（深圳）有限公司 脚本处理方法、装置及电子设备
CN111885000B (zh) * 2020-06-22 2022-06-21 网宿科技股份有限公司 一种基于图神经网络的网络攻击检测方法、系统及装置
CN112437084B (zh) * 2020-11-23 2023-02-28 上海工业自动化仪表研究院有限公司 一种攻击特征提取的方法
CN113890756B (zh) * 2021-09-26 2024-01-02 网易（杭州）网络有限公司 用户账号的混乱度检测方法、装置、介质和计算设备
CN114091568B (zh) * 2021-10-20 2023-10-03 华北电力大学 一种面向文本分类模型的字词双粒度对抗防御系统及方法
US20240061937A1 (en) * 2022-08-16 2024-02-22 Upsight Security Inc. Anti-malware behavioral graph engines, systems and methods
CN117527354A (zh) * 2023-11-08 2024-02-06 北京微步在线科技有限公司 一种攻击检测方法、装置、电子设备及存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101155182A (zh) * 2006-09-30 2008-04-02 阿里巴巴公司 一种基于网络的垃圾信息过滤方法和装置
CN102663093A (zh) * 2012-04-10 2012-09-12 中国科学院计算机网络信息中心 不良网站检测方法及设备
US20130086636A1 (en) * 2011-10-03 2013-04-04 Sergey Y. Golovanov System and method for restricting pathways to harmful hosts in computer networks
CN103678656A (zh) * 2013-12-23 2014-03-26 合肥工业大学 一种基于重复字串的微博新词非监督自动抽取方法
CN103813279A (zh) * 2012-11-14 2014-05-21 中国移动通信集团设计院有限公司 一种垃圾短信检测方法及装置
CN105187408A (zh) * 2015-08-17 2015-12-23 北京神州绿盟信息安全科技股份有限公司 网络攻击检测方法和设备

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2501771B2 (ja) * 1993-01-19 1996-05-29 インターナショナル・ビジネス・マシーンズ・コーポレイション 不所望のソフトウェア・エンティティの複数の有効なシグネチャを得る方法及び装置
JP2001356939A (ja) * 2000-06-13 2001-12-26 Tokyo Electric Power Co Inc:The ログ情報解析装置、方法および記録媒体
US7478033B2 (en) * 2004-03-16 2009-01-13 Google Inc. Systems and methods for translating Chinese pinyin to Chinese characters
CA2606998C (en) * 2005-05-05 2014-09-09 Ironport Systems, Inc. Detecting unwanted electronic mail messages based on probabilistic analysis of referenced resources
CN1889108B (zh) * 2005-06-29 2010-12-15 腾讯科技（深圳）有限公司 一种识别垃圾邮件的方法
JP5070124B2 (ja) * 2008-05-16 2012-11-07 ヤフー株式会社 フィルタリング装置、およびフィルタリング方法
US8381290B2 (en) * 2009-07-17 2013-02-19 Exelis Inc. Intrusion detection systems and methods
CN103313248B (zh) * 2013-04-28 2017-04-12 小米科技有限责任公司 一种识别垃圾信息的方法和装置

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101155182A (zh) * 2006-09-30 2008-04-02 阿里巴巴公司 一种基于网络的垃圾信息过滤方法和装置
US20130086636A1 (en) * 2011-10-03 2013-04-04 Sergey Y. Golovanov System and method for restricting pathways to harmful hosts in computer networks
CN102663093A (zh) * 2012-04-10 2012-09-12 中国科学院计算机网络信息中心 不良网站检测方法及设备
CN103813279A (zh) * 2012-11-14 2014-05-21 中国移动通信集团设计院有限公司 一种垃圾短信检测方法及装置
CN103678656A (zh) * 2013-12-23 2014-03-26 合肥工业大学 一种基于重复字串的微博新词非监督自动抽取方法
CN105187408A (zh) * 2015-08-17 2015-12-23 北京神州绿盟信息安全科技股份有限公司 网络攻击检测方法和设备

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111984970A (zh) * 2019-05-22 2020-11-24 深信服科技股份有限公司 一种sql注入检测方法、系统及电子设备和存储介质
CN111984970B (zh) * 2019-05-22 2023-11-07 深信服科技股份有限公司 一种sql注入检测方法、系统及电子设备和存储介质

Also Published As

Publication number Publication date
JP2018530046A (ja) 2018-10-11
US10645105B2 (en) 2020-05-05
CN105187408A (zh) 2015-12-23
JP6567169B2 (ja) 2019-08-28
US20180212986A1 (en) 2018-07-26

Similar Documents

Publication Publication Date Title
WO2017028789A1 (zh) 网络攻击检测方法和设备
US9990583B2 (en) Match engine for detection of multi-pattern rules
TWI486810B (zh) 在狀態機晶格中之計數器操作
US20180322200A1 (en) Analytics based on pipes programming model
WO2016180268A1 (zh) 一种文本聚合方法及装置
AU2017200892A1 (en) API version testing based on query schema
US10452421B2 (en) Identifying kernel data structures
US9384236B2 (en) Method and system for operating on database queries
US11556812B2 (en) Method and device for acquiring data model in knowledge graph, and medium
US10395033B2 (en) System, apparatus and method for performing on-demand binary analysis for detecting code reuse attacks
US20160171104A1 (en) Detecting multistep operations when interacting with web applications
CN111159413A (zh) 日志聚类方法、装置、设备及存储介质
CN110222790B (zh) 用户身份识别方法、装置及服务器
WO2019091018A1 (zh) 知识图谱建立方法、装置、计算机设备及计算机存储介质
US9026612B2 (en) Generating a custom parameter rule based on a comparison of a run-time value to a request URL
CN116415564B (zh) 基于知识图谱的功能点扩增方法和系统
WO2019161618A1 (zh) 字符串解析方法、装置、设备及计算机可读存储介质
CN114201756A (zh) 一种智能合约代码片段的漏洞检测方法和相关装置
US9361579B2 (en) Large scale probabilistic ontology reasoning
CN116383412B (zh) 基于知识图谱的功能点扩增方法和系统
US20160063394A1 (en) Computing Device Classifier Improvement Through N-Dimensional Stratified Input Sampling
EP1710718A2 (en) Systems and methods for performing streaming checks on data format for UDTs
US20180046712A1 (en) Artificial intelligence content detection system
WO2023092719A1 (zh) 病历数据的信息抽取方法、终端设备及可读存储介质
US20180091404A1 (en) Identifying problematic messages

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16836653

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 15745057

Country of ref document: US

ENP Entry into the national phase

Ref document number: 2018508155

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16836653

Country of ref document: EP

Kind code of ref document: A1