WO2017107804A1 - 发现DDoS攻击的方法及装置 - Google Patents

发现DDoS攻击的方法及装置 Download PDF

Info

Publication number
WO2017107804A1
WO2017107804A1 PCT/CN2016/109604 CN2016109604W WO2017107804A1 WO 2017107804 A1 WO2017107804 A1 WO 2017107804A1 CN 2016109604 W CN2016109604 W CN 2016109604W WO 2017107804 A1 WO2017107804 A1 WO 2017107804A1
Authority
WO
WIPO (PCT)
Prior art keywords
attack
central control
network protocol
host
ddos attack
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2016/109604
Other languages
English (en)
French (fr)
Inventor
李然
王海东
宋加生
崔一山
张建飞
梁永喜
周晓敏
叶根深
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Alibaba Group Holding Ltd
Original Assignee
Alibaba Group Holding Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alibaba Group Holding Ltd filed Critical Alibaba Group Holding Ltd
Publication of WO2017107804A1 publication Critical patent/WO2017107804A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Definitions

  • the present application relates to the field of DDoS attack defense, and in particular, to a method and device for discovering a DDoS attack.
  • a DDoS attack is when a hacker controls a large number of downtimes and consumes computing resources of the attack target to prevent the target from providing services to legitimate users.
  • the existing DDoS defense system mainly protects the target from the DDoS attack of the attacker, and the attacker is generally controlled by the hacker. Therefore, the existing DDoS defense system cannot know the true attacker behind it. Who. The most basic DDoS attack is to use a reasonable service request to occupy too many service resources, so that legitimate users can not get the response of the service.
  • the existing DDoS defense system mainly determines whether the DDoS attack is based on the traffic. However, when the attacker starts to launch the DDoS attack, the initial traffic is small, and it is impossible to accurately determine whether to be attacked at the first time.
  • An object of the present application is to provide a method and apparatus for discovering a DDoS attack, which can be used to know a central control host that controls a DDoS attack and a target host that attacks it.
  • a method for discovering a DDoS attack includes the following steps:
  • the step of performing network protocol analysis on the DDoS attack program sample to extract the network protocol used by the DDoS attack program sample includes:
  • the DDoS attack program samples are disassembled and analyzed to restore the network protocol used by the DDoS attack program sample.
  • the step of performing network protocol analysis on the DDoS attack program sample to extract the network protocol used by the DDoS attack program sample includes:
  • the step of searching for a host running the DDoS attack control program based on the network protocol on the network to determine a central control host for controlling the DDoS attack includes:
  • the host that matches the returned packet with the expected result is determined as the central control host that controls the DDoS attack.
  • the step of simulating the attack controlled by the central control host according to the network protocol, so as to receive the attack command issued by each of the central control hosts to the downtime device includes:
  • the IP address of the attack target, the IP address of the central control host, and the attack type are extracted by parsing the attack command.
  • the step of simulating the attack controlled by the central control host according to the network protocol, so as to receive the attack command issued by each of the central control hosts to the downtime further includes:
  • the method further includes: outputting the extracted attack target IP address, the IP address of the central control host, and the attack type.
  • an apparatus for discovering a DDoS attack comprising:
  • An analyzing unit configured to perform network protocol analysis on the DDoS attack program sample, to extract a network protocol used by the DDoS attack program sample;
  • a searching unit configured to search, on the network, a host running a DDoS attack control program based on the network protocol to determine a central control host for controlling a DDoS attack;
  • a discovery unit configured to simulate a downtime controlled by the central control host according to the network protocol, so as to receive an attack command issued by each of the central control hosts to the downtime machine to find an attack.
  • the analyzing unit is further configured to:
  • the DDoS attack program samples are disassembled and analyzed to restore the network protocol used by the DDoS attack program sample.
  • the analyzing unit is further configured to:
  • the searching unit includes:
  • a sending unit configured to send, to each host in the network, a data packet of the network protocol
  • a detecting unit configured to detect whether the received data packet returned by each host matches the expected result
  • a determining unit configured to determine a host that matches the returned data packet with the expected result as a central control host that controls the DDoS attack.
  • the discovery unit includes:
  • An analog unit configured to send an online protocol in the network protocol to each of the scanned central control hosts to simulate a downtime controlled by the central control host;
  • a receiving unit configured to receive an attack command issued by at least one of the scanned central control hosts
  • the parsing unit is configured to extract an IP address of the attack target, an IP address of the central control host, and an attack type by parsing the attack instruction.
  • the discovery unit further includes:
  • a heartbeat packet sending unit configured to send a heartbeat packet of the network protocol to each of the central control hosts to maintain a communication connection with each of the central control hosts.
  • the device further includes: an output unit, configured to output and display the extracted IP address of the attack target, the IP address of the central control host, and the attack type.
  • the existing DDoS defense system can only know which attackers are attacked, and cannot know the central control host that controls the downtime to launch an attack. It is difficult to correlate who is behind the real attacker.
  • the present application is able to know the central control host that controls the downtime to launch a DDoS attack, and thus can associate the real attacker behind it.
  • This application monitors the central control host that controls the DDoS attack, and at the initial moment when the attack is initiated, it can obtain the target host to attack and the attack mode used.
  • FIG. 2 is a flowchart of step S120 of an embodiment of the present application.
  • step S130 is a flowchart of an embodiment of step S130 according to an embodiment of the present application.
  • step S130 is a flowchart of another embodiment of step S130 according to an embodiment of the present application.
  • Figure 5 is a schematic diagram of an apparatus according to an embodiment of the present application.
  • FIG. 6 is a schematic diagram of a searching unit 520 in an apparatus according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic diagram of an implementation manner of a discovery unit 530 in an apparatus according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic diagram of another implementation manner of the discovery unit 530 in the device according to the embodiment of the present application.
  • Computer device also referred to as “computer” in the context, is meant an intelligent electronic device that can perform predetermined processing, such as numerical calculations and/or logical calculations, by running a predetermined program or instruction, which can include a processor and The memory is executed by the processor to execute a predetermined process pre-stored in the memory to execute a predetermined process, or is executed by hardware such as an ASIC, an FPGA, a DSP, or the like, or a combination of the two.
  • Computer devices include, but are not limited to, servers, personal computers, notebook computers, tablets, smart phones, and the like.
  • the computer device includes a user device and a network device.
  • the user equipment includes, but is not limited to, a computer, a smart phone, a PDA, etc.
  • the network device includes but is not limited to a single network server, a server group composed of multiple network servers, or a cloud computing based computer Or a cloud composed of a network server, wherein cloud computing is a type of distributed computing, a super virtual computer composed of a group of loosely coupled computers.
  • the computer device can be operated separately to implement the present application, and can also access the network and implement the application through interaction with other computer devices in the network.
  • the network in which the computer device is located includes, but is not limited to, the Internet, a wide area network, a metropolitan area network, a local area network, a VPN network, and the like.
  • the user equipment, the network equipment, the network, and the like are only examples, and other existing or future computer equipment or networks may be applicable to the present application, and should also be included in the scope of the present application. It is included here by reference.
  • FIG. 1 is a flowchart of a method for discovering a DDoS attack according to an embodiment of the present application.
  • Method 1 according to the present application includes at least step 110, step 120 and step 130.
  • the present application can search for a central control host that controls the DDoS attack of the medium type and the target host that is attacked based on the currently available DDoS attack program samples.
  • step 110 a network communication protocol analysis is performed on a DDoS attack program sample to extract a network protocol used by the DDoS attack program sample.
  • a hacker invades a host with security vulnerabilities to gain control and installs a DDoS attack program on each compromised host.
  • the host that is hacked and controlled is down.
  • the DDoS attack control program is pre-installed by the hacker on the central control host.
  • the DDoS attack control program is used to communicate with the DDoS attack program installed on the downtime to control the downtime to initiate a DDoS attack to the target host.
  • the central control host (DDoS attack control program) performs network communication with multiple downtime (DDoS attack programs) through a pre-agreed network protocol to issue DDoS attack commands to the downtime.
  • the network protocol includes, but is not limited to, an online protocol, a heartbeat packet, an instruction protocol when launching an attack, and an instruction protocol when the attack is stopped.
  • step S110 includes but is not limited to the following two types:
  • the machine code of the DDoS attack program sample is translated into assembly code, and the code implementation logic of the DDoS attack program sample processing network protocol is analyzed according to the translated assembly code, thereby restoring the DDoS attack program sample The network protocol used.
  • the DDoS attack program sample is run on any host, and the packet capture analysis is performed on the host running the DDoS attack program sample, and the DDoS attack program sample is analyzed by packet capture analysis.
  • the network protocol used When you perform packet capture analysis, you can use existing capture software.
  • step 120 a host running a DDoS attack control program based on the network protocol is searched on the network to determine a central control host for controlling DDoS attacks.
  • the central control host communicates with multiple downtimes through pre-agreed network protocols to issue DDoS attack commands. Therefore, the data packets of the network protocol are sent to each host on the network, and it is detected whether the data packet returned by each host is the same as the data packet expected by the protocol, and the host that runs the DDoS attack control program of the network protocol can be found. And can be sure It is a central control host that controls DDoS attacks.
  • the network protocol may be input to a scanner program based on network protocol detection, and the scanner program performs network-wide scanning according to the network protocol to scan a central control host that controls DDoS attacks.
  • the scanner program can scan the central control host that controls the DDoS attack by performing the following steps S121-S123, and output the scanned IP address list of the central control host for use in the next step (step S130).
  • step S120 specifically includes the following steps:
  • Step S121 sending a data packet of the network protocol to each host in the network.
  • Step S122 detecting whether the received data packet returned by each host matches the predetermined result.
  • step S123 the host that matches the returned data packet with the expected result is determined as the central control host that controls the DDoS attack.
  • the predetermined result is a response result that the protocol expects the host using the network protocol to reply when receiving the data packet of the network protocol. If the data packet returned by a host matches the expected result, it means that the host runs a DDoS central control program based on the network protocol, and the host can be determined as the central control host for controlling the DDoS attack. For example, if the data packet "aaabbbccc" is sent, the expected reply is "haha”. If a host replies with "haha”, it is considered to be the central control host running the DDoS attack control program. Otherwise, it is considered not to run the DDoS. The central control host of the attack control program.
  • step 130 the downtime controlled by the central control host is simulated according to the network protocol, so as to receive an attack command issued by each of the central control hosts to the downtime machine to find an attack.
  • step S130 specifically includes the following steps:
  • Step S131 sending an online protocol in the network protocol to each of the scanned central control hosts to simulate a downtime.
  • the central control host When the central control host launches the DDoS attack, it communicates with multiple controlled devices through the pre-agreed network protocol. Therefore, according to the analyzed network protocol of the DDoS attack program sample, the communication can be communicated with each scanned central control host. Simulated into a machine, so that each Control the host for monitoring. Specifically, the online protocol in the network protocol is sent to each of the scanned central control hosts to indicate that the instructions can be received, thereby disguising as a downtime.
  • Step S132 receiving an attack command sent by at least one of the scanned central control hosts
  • the central control host When the central control host prepares to launch an attack, it will issue an attack command to each downtime. Therefore, the simulated opportunity receives the attack command issued by the central control host that launched the attack.
  • Step S133 Extract the IP address of the attack target, the IP address of the central control host, and the attack type by parsing the attack command.
  • the command data is parsed, and the IP address of the attack target (target host), the IP address of the central control host that launched the attack, and the attack type can be extracted.
  • the attack types are, for example, a TCP SYN attack, a UDP flood attack (UDP flood attack), a CC attack, a DNS reflection, and the like.
  • step S130 further includes step S134.
  • Step S134 sending a heartbeat packet of the network protocol to each central control host to maintain a communication connection with each central control host.
  • a heartbeat packet is a custom structure that is sent between a client and a server at a certain time interval to notify the other party of its own state. In some network protocols, it is required to send a heartbeat packet at a certain time interval and report its own state. Therefore, if the analyzed network protocol of the DDoS includes a heartbeat packet, the network needs to be sent to each central control host. Heartbeat packets in the protocol to maintain communication connections with the various central control hosts. In step S134, it may be executed when the attack command issued by the central control host is not received, so as to maintain the connection with each central control host.
  • steps S110, S120 and S130 may be performed in the same device or in different devices.
  • the performance performed to improve the steps may be performed on different computers respectively.
  • the method of the present application may further include the step of outputting the displayed IP address of the attack target, the IP address of the central control host, and the attack type.
  • the IP address of the extracted attack target (the IP address of the target host), the IP address of the central control host, and the attack type can also be sent to the attack target, so that the attacked host adopts DDoS defense measures.
  • the existing DDoS defense system can only know which downtimes are attacked, and cannot know the central control host that controls the downtime to launch an attack. It is difficult to correlate who is behind the real attacker.
  • the present application is able to know the central control host that controls the downtime to launch an attack, and thus can associate the real attacker behind it. This application monitors the central control host that controls the downtime attack. At the initial moment when the attack is initiated, it can obtain the target host to be attacked and the attack mode used.
  • Figure 5 is a schematic diagram of a device 5 for discovering DDoS, the device comprising:
  • the analyzing unit 510 is configured to perform network protocol analysis on the DDoS attack program sample to extract a network protocol used by the DDoS attack program sample;
  • the searching unit 520 is configured to search, on the network, a host running a DDoS attack control program based on the network protocol to determine a central control host for controlling a DDoS attack;
  • the discovery unit 530 is configured to simulate the downtime controlled by the central control host according to the network protocol, so as to receive an attack command issued by each of the central control hosts to the downtime machine to find an attack.
  • the analyzing unit 510 is further configured to:
  • the DDoS attack program samples are disassembled and analyzed to restore the network protocol used by the DDoS attack program sample.
  • the analyzing unit 510 is further configured to:
  • FIG. 6 is a schematic structural diagram of a searching unit 520 according to an embodiment of the present application.
  • the searching unit 520 includes:
  • a sending unit 521 configured to send, to each host in the network, a data packet of the network protocol
  • the detecting unit 522 is configured to detect whether the received data packet returned by each host matches the expected result
  • a determining unit 523 configured to determine, as a control, a host that matches the returned data packet with the expected result
  • the central control host for DDoS attacks configured to determine, as a control, a host that matches the returned data packet with the expected result
  • FIG. 7 is a schematic structural diagram of a discovery unit 530 according to an embodiment of the present application.
  • the discovery unit 530 includes:
  • the simulation unit 531 is configured to send, to each of the scanned central control hosts, an online protocol in the network protocol to simulate a downtime controlled by the central control host;
  • the receiving unit 532 is configured to receive an attack command issued by at least one of the scanned central control hosts;
  • the parsing unit 533 is configured to extract an IP address of the attack target, an IP address of the central control host, and an attack type by parsing the attack command.
  • FIG. 8 is a schematic structural diagram of a discovery unit 530 according to another embodiment of the present application. Referring to FIG. 8, based on the embodiment shown in FIG. 7, the discovery unit 530 further includes:
  • the heartbeat packet sending unit 534 is configured to send the heartbeat packets of the network protocol to the respective central control hosts to maintain a communication connection with the respective central control hosts.
  • the device 5 further includes: an output unit, configured to output and display the extracted IP address of the attack target, the IP address of the central control host, and the attack type.
  • the present application can be implemented in software and/or a combination of software and hardware.
  • the various devices of the present application can be implemented using an application specific integrated circuit (ASIC) or any other similar hardware device.
  • the software program of the present application can be executed by a processor to implement the steps or functions described above.
  • the software programs (including related data structures) of the present application can be stored in a computer readable recording medium such as a RAM memory, a magnetic or optical drive or a floppy disk and the like.
  • some of the steps or functions of the present application may be implemented in hardware, for example, as a circuit that cooperates with a processor to perform various steps or functions.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer And Data Communications (AREA)

Abstract

本申请提供了一种发现DDoS攻击的方法及装置。其方法包括：对DDoS攻击程序样本进行网络协议分析，以提取出所述DDoS攻击程序样本所使用的网络协议；在网络上查找运行有基于所述网络协议的DDoS攻击控制程序的主机，以确定为控制DDoS攻击的中控主机；根据所述网络协议模拟受中控主机控制的傀儡机，以便接收到所述各个中控主机向傀儡机下达的攻击指令而发现攻击。根据本申请的技术方案，能够获知控制傀儡机发动DDoS攻击的中控主机，进而可以关联出背后的真正攻击者。

Description

发现DDoS攻击的方法及装置 技术领域
本申请涉及DDoS攻击防御领域，尤其涉及一种发现DDoS攻击的方法及装置。
背景技术
DDoS攻击是指黑客通过控制大量的傀儡机，消耗攻击目标的计算资源阻止目标为合法用户提供服务。现有的DDoS防御系统，主要是保护目标免受攻击者的DDoS攻击，而攻击者一般是由黑客控制的傀儡机，因此，现有的DDoS防御系统，是无法获知背后的真正攻击者到底是谁。最基本的DDoS攻击主要是利用合理的服务请求来占用过多的服务资源，从而使合法用户无法得到服务的响应。现有的DDoS防御系统，主要根据流量判断是否受到DDoS攻击，然而，在攻击者开始发动DDoS攻击时，由于初始流量较小，无法在第一时间准确判断是否要被攻击。
发明内容
本申请的一个目的是提供一种发现DDoS攻击的方法及装置，能够获知控制傀儡机发动DDoS攻击的中控主机以及其攻击的目标主机。
根据本申请的一方面，提供了一种发现DDoS攻击的方法，其中，该方法包括以下步骤：
对DDoS攻击程序样本进行网络协议分析，以提取出所述DDoS攻击程序样本所使用的网络协议；
在网络上查找运行有基于所述网络协议的DDoS攻击控制程序的主机，以确定为控制DDoS攻击的中控主机；
根据所述网络协议模拟受中控主机控制的傀儡机，以便接收到所述各个中控主机向傀儡机下达的攻击指令而发现攻击。
可选地，对DDoS攻击程序样本进行网络协议分析，以提取出所述DDoS攻击程序样本所使用的网络协议的步骤包括：
对所述DDoS攻击程序样本进行反汇编分析，以还原出所述DDoS攻击程序样本所述使用的网络协议。
可选地，对DDoS攻击程序样本进行网络协议分析，以提取出所述DDoS攻击程序样本所使用的网络协议的步骤包括：
运行所述DDoS攻击程序样本，以通过抓包分析来分析出所述DDoS攻击程序样本所使用的网络协议。
可选地，在网络上查找运行有基于所述网络协议的DDoS攻击控制程序的主机，以确定为控制DDoS攻击的中控主机的步骤包括：
向网络中的各个主机发送所述网络协议的数据包；
检测接收到的各个主机返回的数据包是否与预期结果匹配；
将返回的数据包与预期结果匹配的主机确定为控制DDoS攻击的中控主机。
可选地，根据所述网络协议模拟受中控主机控制的傀儡机，以便接收到所述各个中控主机向傀儡机下达的攻击指令而发现攻击的步骤包括：
向扫描出的各个中控主机发送所述网络协议中的上线协议，以模拟受中控主机控制的傀儡机；
接收扫描出的各个中控主机中至少一个下达的攻击指令；
通过解析所述攻击指令，提取出攻击目标的IP地址、中控主机的IP地址以及攻击类型。
可选地，根据所述网络协议模拟受中控主机控制的傀儡机，以便接收到所述各个中控主机向傀儡机下达的攻击指令而发现攻击的步骤还包括：
向所述各个中控主机发送所述网络协议的心跳包，以维持与所述各个中控主机的通信连接。
可选地，该方法还包括：将提取出的攻击目标IP地址、中控主机的IP地址、以及攻击类型进行输出显示。
根据本申请的另一方面，还提供了一种发现DDoS攻击的装置，其中，该装置包括：
分析单元，用于对DDoS攻击程序样本进行网络协议分析，以提取出所述DDoS攻击程序样本所使用的网络协议；
查找单元，用于在网络上查找运行有基于所述网络协议的DDoS攻击控制程序的主机，以确定为控制DDoS攻击的中控主机；
发现单元，用于根据所述网络协议模拟受中控主机控制的傀儡机，以便接收到所述各个中控主机向傀儡机下达的攻击指令而发现攻击。
可选地，所述分析单元进一步用于：
对所述DDoS攻击程序样本进行反汇编分析，以还原出所述DDoS攻击程序样本所述使用的网络协议。
可选地，所述分析单元进一步用于：
运行所述DDoS攻击程序样本，以通过抓包分析来分析出所述DDoS攻击程序样本所使用的网络协议。
可选地，所述查找单元包括：
发送单元，用于向网络中的各个主机发送所述网络协议的数据包；
检测单元，用于检测接收到的各个主机返回的数据包是否与预期结果匹配；
确定单元，用于将返回的数据包与预期结果匹配的主机确定为控制DDoS攻击的中控主机。
可选地，所述发现单元包括：
模拟单元，用于向扫描出的各个中控主机发送所述网络协议中的上线协议，以模拟受中控主机控制的傀儡机；
接收单元，用于接收扫描出的各个中控主机中至少一个下达的攻击指令；
解析单元，用于通过解析所述攻击指令，提取出攻击目标的IP地址、中控主机的IP地址、以及攻击类型。
可选地，所述发现单元还包括：
心跳包发送单元，用于向所述各个中控主机发送所述网络协议的心跳包，以维持与所述各个中控主机的通信连接。
可选地，该装置还包括：输出单元，用于将提取出的攻击目标的IP地址、中控主机的IP地址以及攻击类型进行输出显示。
与现有技术相比，本申请的实施例具有以下优点：
1)现有的DDoS防御系统，只能获知被哪些傀儡机所攻击，并不能获知控制傀儡机发起攻击的中控主机，也就很难关联出背后的真正攻击者是谁。与之相比，本申请能够获知控制傀儡机发动DDoS攻击的中控主机，进而可以关联出背后的真正攻击者。
2)本申请对控制傀儡机发动DDoS攻击的中控主机进行监控，在攻击发起的初始时刻，就能够获取其要攻击的目标主机以及使用的攻击方式。
附图说明
通过阅读参照以下附图所作的对非限制性实施例所作的详细描述，本申请的其它特征、目的和优点将会变得更明显：
图1为本申请一个实施例提供的方法的流程图；
图2为本申请一个实施例的步骤S120的流程图；
图3为本申请一个实施例的步骤S130的一种实施方式的流程图；
图4为本申请一个实施例的步骤S130的另一种实施方式的流程图；
图5为本申请一个实施例提供的装置示意图；
图6为本申请实施例提供的装置中查找单元520的示意图；
图7为本申请实施例提供的装置中发现单元530的一种实施方式的示意图；
图8为本申请实施例提供的装置中发现单元530的另一种实施方式的示意图。
附图中相同或相似的附图标记代表相同或相似的部件。
具体实施方式
在更加详细地讨论示例性实施例之前应当提到的是，一些示例性实施例被描述成作为流程图描绘的处理或方法。虽然流程图将各项操作描述成顺序的处理，但是其中的许多操作可以被并行地、并发地或者同时实施。此外，各项操作的顺序可以被重新安排。当其操作完成时所述处理可以被终止，但是还可以具有未包括在附图中的附加步骤。所述处理可以对应于方法、函数、规程、子例程、子程序等等。
在上下文中所称“计算机设备”，也称为“电脑”，是指可以通过运行预定程序或指令来执行数值计算和/或逻辑计算等预定处理过程的智能电子设备，其可以包括处理器与存储器，由处理器执行在存储器中预存的存续指令来执行预定处理过程，或是由ASIC、FPGA、DSP等硬件执行预定处理过程，或是由上述二者组合来实现。计算机设备包括但不限于服务器、个人电脑、笔记本电脑、平板电脑、智能手机等。
所述计算机设备包括用户设备与网络设备。其中，所述用户设备包括但不限于电脑、智能手机、PDA等；所述网络设备包括但不限于单个网络服务器、多个网络服务器组成的服务器组或基于云计算(Cloud Computing)的由大量计算机或网络服务器构成的云，其中，云计算是分布式计算的一种，由一群松散耦合的计算机集组成的一个超级虚拟计算机。其中，所述计算机设备可单独运行来实现本申请，也可接入网络并通过与网络中的其他计算机设备的交互操作来实现本申请。其中，所述计算机设备所处的网络包括但不限于互联网、广域网、城域网、局域网、VPN网络等。
需要说明的是，所述用户设备、网络设备和网络等仅为举例，其他现有的或今后可能出现的计算机设备或网络如可适用于本申请，也应包含在本申请保护范围以内，并以引用方式包含于此。
后面所讨论的方法(其中一些通过流程图示出)可以通过硬件、软件、固件、中间件、微代码、硬件描述语言或者其任意组合来实施。当 用软件、固件、中间件或微代码来实施时，用以实施必要任务的程序代码或代码段可以被存储在机器或计算机可读介质(比如存储介质)中。(一个或多个)处理器可以实施必要的任务。
这里所公开的具体结构和功能细节仅仅是代表性的，并且是用于描述本申请的示例性实施例的目的。但是本申请可以通过许多替换形式来具体实现，并且不应当被解释成仅仅受限于这里所阐述的实施例。
应当理解的是，虽然在这里可能使用了术语“第一”、“第二”等等来描述各个单元，但是这些单元不应当受这些术语限制。使用这些术语仅仅是为了将一个单元与另一个单元进行区分。举例来说，在不背离示例性实施例的范围的情况下，第一单元可以被称为第二单元，并且类似地第二单元可以被称为第一单元。这里所使用的术语“和/或”包括其中一个或更多所列出的相关联项目的任意和所有组合。
这里所使用的术语仅仅是为了描述具体实施例而不意图限制示例性实施例。除非上下文明确地另有所指，否则这里所使用的单数形式“一个”、“一项”还意图包括复数。还应当理解的是，这里所使用的术语“包括”和/或“包含”规定所陈述的特征、整数、步骤、操作、单元和/或组件的存在，而不排除存在或添加一个或更多其他特征、整数、步骤、操作、单元、组件和/或其组合。
还应当提到的是，在一些替换实现方式中，所提到的功能/动作可以按照不同于附图中标示的顺序发生。举例来说，取决于所涉及的功能/动作，相继示出的两幅图实际上可以基本上同时执行或者有时可以按照相反的顺序来执行。
下面结合附图对本申请作进一步详细描述。
图1为本申请一个实施例的发现DDoS攻击方法流程图。根据本申请的方法1至少包括步骤110、步骤120和步骤130。本申请能够基于目前能够获取到的DDoS攻击程序样本，查找控制该中类型的DDoS攻击的中控主机以及被攻击的目标主机。
参考图1，在步骤110中，对DDoS攻击程序样本进行网络通信协议分析，以提取出所述DDoS攻击程序样本所使用的网络协议。
黑客入侵有安全漏洞的主机获取控制权，并在每台被入侵的主机中安装DDoS攻击程序，其中，被黑客入侵并控制的主机为傀儡机。发动DDoS攻击时，黑客通过中控主机控制这些傀儡机向目标主机发动DDoS攻击。中控主机上被黑客事先安装了DDoS攻击控制程序，该DDoS攻击控制程序用于与傀儡机上安装的DDoS攻击程序进行通信，以控制傀儡机向目标主机发起DDoS攻击。中控主机(DDoS攻击控制程序)通过预先约定的网络协议与多个傀儡机(DDoS攻击程序)进行网络通信，以便向傀儡机下达DDoS攻击指令。因此，根据DDoS攻击程序样本可以分析出中控主机与傀儡机进行通信的网络协议。所述网络协议包括但不限于：上线协议、心跳包、发动攻击时的指令协议和停止攻击时的指令协议。
步骤S110的具体实现方式包括但不限于以下两种：
(1)对所述DDoS攻击程序样本进行反汇编分析，以还原出所述DDoS样本的网络协议。
具体地，将所述DDoS攻击程序样本的机器代码翻译成汇编代码，根据翻译成的汇编代码分析出所述DDoS攻击程序样本处理网络协议的代码实现逻辑，从而还原出所述DDoS攻击程序样本所使用的网络协议。
(2)运行所述DDoS攻击程序样本，以通过抓包分析来分析出所述DDoS攻击程序样本所使用的网络协议。
具体而言，在任意一台主机上运行所述DDoS攻击程序样本，并在运行所述DDoS攻击程序样本的主机上进行抓包分析，通过抓包分析即可分析出所述DDoS攻击程序样本所使用的网络协议。进行抓包分析时，可以使用现有的抓包软件。
参考图1，在步骤120中，在网络上查找运行有基于所述网络协议的DDoS攻击控制程序的主机，以确定为控制DDoS攻击的中控主机。
中控主机通过预先约定的网络协议与多个傀儡机进行网络通信，以便下达DDoS攻击指令。因此，向网络上的各个主机发送所述网络协议的数据包，并检测各个主机返回的数据包是否与协议期望的数据包相同，能查找到运行所述网络协议的DDoS攻击控制程序的主机,并可以确 定为控制DDoS攻击的中控主机。
具体地，可以将所述网络协议输入到基于网络协议探测的扫描器程序，由该扫描器程序根据所述网络协议进行全网扫描，以扫描出控制DDoS攻击的中控主机。利用扫描器程序可以通过执行以下的步骤S121～S123扫描出控制DDoS攻击的中控主机，并输出扫描出的中控主机的IP地址列表，以备下一个步骤(步骤S130)中使用。
参考图2，步骤S120具体包括以下步骤：
步骤S121，向网络中的各个主机发送所述网络协议的数据包。
步骤S122，检测接收到的各个主机返回的数据包是否与预定结果匹配。
步骤S123，将返回的数据包与预期结果匹配的主机确定为控制DDoS攻击的中控主机。
所述预定结果就是协议期望的使用所述网络协议的主机在接收到所述网络协议的数据包时回复的应答结果。如果一个主机返回的数据包与预期结果匹配，则表示该主机上运行着基于该网络协议进行通信的DDoS中控程序，则可以将该主机确定为控制DDoS攻击的中控主机。例如，发送数据包“aaabbbccc”，期望的回复是“haha”，如果某个主机回复的是“haha”，则认为是运行该DDoS攻击控制程序的中控主机，反之，则认为不是运行该DDoS攻击控制程序的中控主机。
参考图1，在步骤130中，根据所述网络协议模拟受中控主机控制的傀儡机，以便接收到所述各个中控主机向傀儡机下达的攻击指令而发现攻击。
参考图3，在一个具体实施方式中，步骤S130具体包括以下步骤：
步骤S131，向扫描出的各个中控主机发送所述网络协议中的上线协议，以模拟傀儡机。
中控主机在发动DDoS攻击时，通过预先约定的网络协议与其控制的多台傀儡机进行通信，因此，根据分析出的该DDoS攻击程序样本的网络协议与扫描出的各个中控主机进行通信能够模拟成傀儡机，以便对各个中 控主机进行监控。具体而言，向扫描出的各个中控主机发送所述网络协议中的上线协议，以表明可以接收其指令，从而伪装成傀儡机。
步骤S132，接收扫描出的各个中控主机中的至少一个发送的攻击指令；
当中控主机准备发动攻击时，会向各个傀儡机下达攻击指令，因此，模拟成的傀儡机会接收到发动攻击的中控主机下达的攻击指令。
步骤S133，通过解析所述攻击指令，提取出攻击目标的IP地址、中控主机的IP地址以及攻击类型。
接收到攻击指令后，对指令数据进行解析，能够提取出攻击目标(目标主机)的IP地址、发动攻击的中控主机的IP地址以及攻击类型。所述攻击类型例如，TCP SYN攻击、UDP flood攻击(UDP洪水攻击)、CC攻击、DNS反射等。
参考图4，在上述实施方式的基础上，步骤S130还包括步骤S134。
步骤S134，向各个中控主机发送所述网络协议的心跳包，以维持与各个中控主机的通信连接。
心跳包是在客户端和服务器间按照一定的时间间隔发送的、用于通知对方自己状态的一个自定义的结构体。在某些网络协议中，要求按一定的时间间隔发送心跳包，报告自己的状态，因此，如果分析出的所述DDoS的网络协议中包含心跳包，则需要向各个中控主机发送所述网络协议中的心跳包，以便在维持与各个中控主机的通信连接。步骤S134，可以在没有接收到中控主机下达的攻击指令时执行，以维持与各个中控主机的连接。
应注意，上述步骤S110、步骤S120和步骤S130可以在同一设备中执行，亦可在不同设备中执行，例如，为提高各个步骤执行的性能可以分别在不同的计算机上执行。
基于上述实施例，本申请的方法还可以包括将提取出的攻击目标的IP地址、中控主机的IP地址以及攻击类型进行输出显示的步骤。还可以将提取的攻击目标的IP地址(目标主机的IP地址)、中控主机的IP地址以及攻击类型发送给攻击目标，以便受到攻击的主机采取DDoS防御措施。
现有的DDoS防御系统，只能获知被哪些傀儡机所攻击，并不能获知控制傀儡机发起攻击的中控主机，也就很难关联出背后的真正攻击者是谁。与之相比，本申请能够获知控制傀儡机发起攻击的中控主机，进而可以关联出背后的真正攻击者。本申请对控制傀儡机发动攻击的中控主机进行监控，在攻击发起的初始时刻，就能够获取其要攻击的目标主机，以及使用的攻击方式。
基于与方法同样的发明构思，本申请还提供一种发现DDoS攻击的装置。图5所示为发现DDoS的装置5示意图，该装置包括：
分析单元510，用于对DDoS攻击程序样本进行网络协议分析，以提取出所述DDoS攻击程序样本所使用的网络协议；
查找单元520，用于在网络上查找运行有基于所述网络协议的DDoS攻击控制程序的主机，以确定为控制DDoS攻击的中控主机；
发现单元530，用于根据所述网络协议模拟受中控主机控制的傀儡机，以便接收到所述各个中控主机向傀儡机下达的攻击指令而发现攻击。
可选地，所述分析单元510进一步用于：
对所述DDoS攻击程序样本进行反汇编分析，以还原出所述DDoS攻击程序样本所述使用的网络协议。
可选地，所述分析单元510进一步用于：
运行所述DDoS攻击程序样本，以通过抓包分析来分析出所述DDoS攻击程序样本所使用的网络协议。
图6为根据本申请一个实施例的查找单元520的结构示意图。参考图6，可选地，所述查找单元520包括：
发送单元521，用于向网络中的各个主机发送所述网络协议的数据包；
检测单元522，用于检测接收到的各个主机返回的数据包是否与预期结果匹配；
确定单元523，用于将返回的数据包与预期结果匹配的主机确定为控 制DDoS攻击的中控主机。
图7为根据本申请一个实施例的发现单元530的结构示意图。参考图7，所述发现单元530包括：
模拟单元531，用于向扫描出的各个中控主机发送所述网络协议中的上线协议，以模拟受中控主机控制的傀儡机；
接收单元532，用于接收扫描出的各个中控主机中至少一个下达的攻击指令；
解析单元533，用于通过解析所述攻击指令，提取出攻击目标的IP地址、中控主机的IP地址、以及攻击类型。
图8为根据本申请另一个实施例的发现单元530的结构示意图。参考图8，基于上述图7所示的实施例，所述发现单元530还包括：
心跳包发送单元534，用于向所述各个中控主机发送所述网络协议的心跳包，以维持与所述各个中控主机的通信连接。
可选地，该装置5还包括：输出单元，用于将提取出的攻击目标的IP地址、中控主机的IP地址以及攻击类型进行输出显示。
需要注意的是，本申请可在软件和/或软件与硬件的组合体中被实施，例如，本申请的各个装置可采用专用集成电路(ASIC)或任何其他类似硬件设备来实现。在一个实施例中，本申请的软件程序可以通过处理器执行以实现上文所述步骤或功能。同样地，本申请的软件程序(包括相关的数据结构)可以被存储到计算机可读记录介质中，例如，RAM存储器，磁或光驱动器或软磁盘及类似设备。另外，本申请的一些步骤或功能可采用硬件来实现，例如，作为与处理器配合从而执行各个步骤或功能的电路。
对于本领域技术人员而言，显然本申请不限于上述示范性实施例的细节，而且在不背离本申请的精神或基本特征的情况下，能够以其他的具体形式实现本申请。因此，无论从哪一点来看，均应将实施例看作是示范性的，而且是非限制性的，本申请的范围由所附权利要求而不是上 述说明限定，因此旨在将落在权利要求的等同要件的含义和范围内的所有变化涵括在本申请内。不应将权利要求中的任何附图标记视为限制所涉及的权利要求。此外，显然“包括”一词不排除其他单元或步骤，单数不排除复数。系统权利要求中陈述的多个单元或装置也可以由一个单元或装置通过软件或者硬件来实现。第一，第二等词语用来表示名称，而并不表示任何特定的顺序。
虽然前面特别示出并且描述了示例性实施例，但是本领域技术人员将会理解的是，在不背离权利要求书的精神和范围的情况下，在其形式和细节方面可以有所变化。

Claims (14)

  1. 一种发现DDoS攻击的方法，其特征在于，该方法包括以下步骤：
    对DDoS攻击程序样本进行网络协议分析，以提取出所述DDoS攻击程序样本所使用的网络协议；
    在网络上查找运行有基于所述网络协议的DDoS攻击控制程序的主机，以确定为控制DDoS攻击的中控主机；
    根据所述网络协议模拟受中控主机控制的傀儡机，以便接收到所述各个中控主机向傀儡机下达的攻击指令而发现攻击。
  2. 根据权利要求1所述的方法，其特征在于，对DDoS攻击程序样本进行网络协议分析，以提取出所述DDoS攻击程序样本所使用的网络协议的步骤包括：
    对所述DDoS攻击程序样本进行反汇编分析，以还原出所述DDoS攻击程序样本所述使用的网络协议。
  3. 根据权利要求1所述的方法，其特征在于，对DDoS攻击程序样本进行网络协议分析，以提取出所述DDoS攻击程序样本所使用的网络协议的步骤包括：
    运行所述DDoS攻击程序样本，以通过抓包分析来分析出所述DDoS攻击程序样本所使用的网络协议。
  4. 根据权利要求1所述的方法，其特征在于，在网络上查找运行有基于所述网络协议的DDoS攻击控制程序的主机，以确定为控制DDoS攻击的中控主机的步骤包括：
    向网络中的各个主机发送所述网络协议的数据包；
    检测接收到的各个主机返回的数据包是否与预期结果匹配；
    将返回的数据包与预期结果匹配的主机确定为控制DDoS攻击的中控主机。
  5. 根据权利要求1所述的方法，其特征在于，根据所述网络协议模拟受中控主机控制的傀儡机，以便接收到所述各个中控主机向傀儡机下达的 攻击指令而发现攻击的步骤包括：
    向扫描出的各个中控主机发送所述网络协议中的上线协议，以模拟受中控主机控制的傀儡机；
    接收扫描出的各个中控主机中至少一个下达的攻击指令；
    通过解析所述攻击指令，提取出攻击目标的IP地址、中控主机的IP地址以及攻击类型。
  6. 根据权利要求5所述的方法，其特征在于，根据所述网络协议模拟受中控主机控制的傀儡机，以便接收到所述各个中控主机向傀儡机下达的攻击指令而发现攻击的步骤还包括：
    向所述各个中控主机发送所述网络协议的心跳包，以维持与所述各个中控主机的通信连接。
  7. 根据权利要求5所述的方法，其特征在于，还包括：将提取出的攻击目标IP地址、中控主机的IP地址、以及攻击类型进行输出显示。
  8. 一种发现DDoS攻击的装置，其特征在于，该装置包括：
    分析单元，用于对DDoS攻击程序样本进行网络协议分析，以提取出所述DDoS攻击程序样本所使用的网络协议；
    查找单元，用于在网络上查找运行有基于所述网络协议的DDoS攻击控制程序的主机，以确定为控制DDoS攻击的中控主机；
    发现单元，用于根据所述网络协议模拟受中控主机控制的傀儡机，以便接收到所述各个中控主机向傀儡机下达的攻击指令而发现攻击。
  9. 根据权利要求8所述的装置，其特征在于，所述分析单元进一步用于：
    对所述DDoS攻击程序样本进行反汇编分析，以还原出所述DDoS攻击程序样本所述使用的网络协议。
  10. 根据权利要求8所述的装置，其特征在于，所述分析单元进一步用于：
    运行所述DDoS攻击程序样本，以通过抓包分析来分析出所述DDoS 攻击程序样本所使用的网络协议。
  11. 根据权利要求8所述的装置，其特征在于，所述查找单元包括：
    发送单元，用于向网络中的各个主机发送所述网络协议的数据包；
    检测单元，用于检测接收到的各个主机返回的数据包是否与预期结果匹配；
    确定单元，用于将返回的数据包与预期结果匹配的主机确定为控制DDoS攻击的中控主机。
  12. 根据权利要求8所述的装置，其特征在于，所述发现单元包括：
    模拟单元，用于向扫描出的各个中控主机发送所述网络协议中的上线协议，以模拟受中控主机控制的傀儡机；
    接收单元，用于接收扫描出的各个中控主机中至少一个下达的攻击指令；
    解析单元，用于通过解析所述攻击指令，提取出攻击目标的IP地址、中控主机的IP地址、以及攻击类型。
  13. 根据权利要求12所述的装置，其特征在于，所述发现单元还包括：
    心跳包发送单元，用于向所述各个中控主机发送所述网络协议的心跳包，以维持与所述各个中控主机的通信连接。
  14. 根据权利要求12所述的装置，其特征在于，还包括：输出单元，用于将提取出的攻击目标的IP地址、中控主机的IP地址以及攻击类型进行输出显示。
PCT/CN2016/109604 2015-12-24 2016-12-13 发现DDoS攻击的方法及装置 Ceased WO2017107804A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510990022.1A CN106921612A (zh) 2015-12-24 2015-12-24 发现DDoS攻击的方法及装置
CN201510990022.1 2015-12-24

Publications (1)

Publication Number Publication Date
WO2017107804A1 true WO2017107804A1 (zh) 2017-06-29

Family

ID=59089090

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/109604 Ceased WO2017107804A1 (zh) 2015-12-24 2016-12-13 发现DDoS攻击的方法及装置

Country Status (2)

Country Link
CN (1) CN106921612A (zh)
WO (1) WO2017107804A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112261029A (zh) * 2020-10-16 2021-01-22 北京锐驰信安技术有限公司 一种基于养殖的DDoS恶意代码检测及溯源方法
CN113515750A (zh) * 2021-07-22 2021-10-19 苏州知微安全科技有限公司 一种高速流量下的攻击检测方法及装置
CN114844666A (zh) * 2022-03-16 2022-08-02 西安交通大学 网络流量分析与重构方法及装置
CN114866347A (zh) * 2022-07-06 2022-08-05 浙江御安信息技术有限公司 一种基于人工智能进行DDoS攻击识别的网络安全预警方法

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108200041A (zh) * 2017-12-28 2018-06-22 贵阳忆联网络有限公司 一种防护ddos攻击的方法及系统
CN112398781B (zh) * 2019-08-14 2022-04-08 大唐移动通信设备有限公司 一种攻击测试方法、主机服务器及控制服务器

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101321171A (zh) * 2008-07-04 2008-12-10 北京锐安科技有限公司 一种检测分布式拒绝服务攻击的方法及设备
CN101360019A (zh) * 2008-09-18 2009-02-04 华为技术有限公司 一种僵尸网络的检测方法、系统和设备
CN102546298A (zh) * 2012-01-06 2012-07-04 北京大学 一种基于主动探测的僵尸网络家族检测方法
US20130074183A1 (en) * 2011-09-16 2013-03-21 Electronics And Telecommunications Research Institute Method and apparatus for defending distributed denial-of-service (ddos) attack through abnormally terminated session

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103997489B (zh) * 2014-05-09 2017-02-22 北京神州绿盟信息安全科技股份有限公司 一种识别DDoS僵尸网络通信协议的方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101321171A (zh) * 2008-07-04 2008-12-10 北京锐安科技有限公司 一种检测分布式拒绝服务攻击的方法及设备
CN101360019A (zh) * 2008-09-18 2009-02-04 华为技术有限公司 一种僵尸网络的检测方法、系统和设备
US20130074183A1 (en) * 2011-09-16 2013-03-21 Electronics And Telecommunications Research Institute Method and apparatus for defending distributed denial-of-service (ddos) attack through abnormally terminated session
CN102546298A (zh) * 2012-01-06 2012-07-04 北京大学 一种基于主动探测的僵尸网络家族检测方法

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112261029A (zh) * 2020-10-16 2021-01-22 北京锐驰信安技术有限公司 一种基于养殖的DDoS恶意代码检测及溯源方法
CN113515750A (zh) * 2021-07-22 2021-10-19 苏州知微安全科技有限公司 一种高速流量下的攻击检测方法及装置
CN113515750B (zh) * 2021-07-22 2022-06-28 苏州知微安全科技有限公司 一种高速流量下的攻击检测方法及装置
CN114844666A (zh) * 2022-03-16 2022-08-02 西安交通大学 网络流量分析与重构方法及装置
CN114844666B (zh) * 2022-03-16 2023-06-06 西安交通大学 网络流量分析与重构方法及装置
CN114866347A (zh) * 2022-07-06 2022-08-05 浙江御安信息技术有限公司 一种基于人工智能进行DDoS攻击识别的网络安全预警方法
CN114866347B (zh) * 2022-07-06 2022-09-30 浙江御安信息技术有限公司 一种基于人工智能进行DDoS攻击识别的网络安全预警方法

Also Published As

Publication number Publication date
CN106921612A (zh) 2017-07-04

Similar Documents

Publication Publication Date Title
EP4026297B1 (en) Honeypots for infrastructure-as-a-service security
WO2017107804A1 (zh) 发现DDoS攻击的方法及装置
US12058148B2 (en) Distributed threat sensor analysis and correlation
CN111988339B (zh) 一种基于dikw模型的网络攻击路径发现、提取和关联的方法
EP3214568B1 (en) Method, apparatus and system for processing cloud application attack behaviours in cloud computing system
JP4755658B2 (ja) 解析システム、解析方法および解析プログラム
US11489853B2 (en) Distributed threat sensor data aggregation and data export
US9875355B1 (en) DNS query analysis for detection of malicious software
EP2769570B1 (en) Mobile risk assessment
JP5009244B2 (ja) マルウェア検知システム、マルウェア検知方法及びマルウェア検知プログラム
CN109951359B (zh) 分布式网络资产异步扫描方法及设备
EP2836954B1 (en) Opportunistic system scanning
US20160239330A1 (en) Dynamic Reconfiguration Of Resources In A Virtualized Network
Martin et al. Fending off IoT-hunting attacks at home networks
CN112600852A (zh) 漏洞攻击处理方法、装置、设备及存储介质
US20180302418A1 (en) Method and system for detection and interference of network reconnaissance
US20230370482A1 (en) Method for identifying successful attack and protection device
JP5389855B2 (ja) 解析システム、解析方法および解析プログラム
CN106878240B (zh) 僵尸主机识别方法及装置
CN111049784B (zh) 一种网络攻击的检测方法、装置、设备及存储介质
CN103561063B (zh) 一种登录机顶盒的方法及终端
CN107454043A (zh) 一种网络攻击的监控方法及装置
US10581916B2 (en) System and method for identifying cyber-attacks
CN119232408A (zh) 网络地址转换行为检测方法及装置
TW201828144A (zh) 發現ＤＤｏＳ攻擊的方法及裝置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16877615

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16877615

Country of ref document: EP

Kind code of ref document: A1