WO2017193271A1 - 检测网络攻击的方法及设备 - Google Patents

检测网络攻击的方法及设备 Download PDF

Info

Publication number
WO2017193271A1
WO2017193271A1 PCT/CN2016/081503 CN2016081503W WO2017193271A1 WO 2017193271 A1 WO2017193271 A1 WO 2017193271A1 CN 2016081503 W CN2016081503 W CN 2016081503W WO 2017193271 A1 WO2017193271 A1 WO 2017193271A1
Authority
WO
WIPO (PCT)
Prior art keywords
sessions
feature information
session
network
type
Prior art date
Application number
PCT/CN2016/081503
Other languages
English (en)
French (fr)
Inventor
付天福
周冲
刘子宜
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN201680001495.7A priority Critical patent/CN108028832A/zh
Priority to PCT/CN2016/081503 priority patent/WO2017193271A1/zh
Priority to EP16901226.7A priority patent/EP3361694A4/en
Publication of WO2017193271A1 publication Critical patent/WO2017193271A1/zh
Priority to IL259293A priority patent/IL259293A/en
Priority to US15/993,485 priority patent/US20180278632A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the embodiments of the present invention relate to the field of network security technologies, and in particular, to a method and a device for detecting a network attack.
  • DoS denial of service
  • a DoS attack sends an attack packet to the target device targeted by the network attack, and occupies the target device or network resources. As a result, the target device or the network cannot run normally.
  • devices on the network use packet random sampling technology to detect network attacks.
  • the method of randomly sampling a packet to detect a network attack is to collect a certain percentage of the data traffic received by the network device during the target time period, obtain the feature information of each packet, and then perform statistical analysis on the characteristics of the packet. Therefore, it is determined whether the network where the network device is located is attacked by the network during the target time period.
  • the attack packets of these network attacks account for a small proportion of the data traffic of the entire network, but consume a lot of resources for the target device. It is difficult to collect enough such network attack packets by random sampling of packets. Therefore, it is difficult to detect such network attacks by statistical analysis of the characteristics of random sampling of messages.
  • the embodiment of the present invention provides a method and a device for detecting a network attack, which are used to detect a network attack that is difficult to detect by a random sampling technique.
  • an embodiment of the present invention provides a method for detecting a network attack.
  • the method includes: collecting feature information of each of the N sessions in the network, where N is an integer greater than 1; obtaining a statistical result, the statistical result is that each session in the N sessions is one a sampling unit, using the feature information as a sample value, and performing statistics on the feature information of the N sessions; if the difference between the statistical result and the reference result exceeds a preset condition, determining the The internet Attacked by the network.
  • a session-based network attack has the following characteristics: A device that initiates a network attack occupies a large number of sessions and occupies resources of the target device. Since only a small number of packets are required to initiate a session, but the resources of the device are occupied a lot, if the number of network attack packets is small, the target device may be greatly damaged. If the packet is used as the sampling unit, the network attack packets that meet the above-mentioned spoofing network attack characteristics are small in the data traffic, which makes it difficult to collect such network attack packets.
  • the session is used as the sampling unit. Whether it is a network attack message with only one session establishment request or a normal session with large data traffic, it is counted as a session in the sampling statistics, so there is a high probability.
  • the session type network attack is identified.
  • the feature information is a value indicating a size
  • the statistical result is a Gini coefficient.
  • the obtaining the statistical result includes: sorting the N sessions according to the order of the feature information from small to large; selecting M sessions from the N sessions, and acquiring M coordinates in a coordinate system, The M coordinates are in one-to-one correspondence with the M sessions, and the a-th coordinate of the M sessions corresponds to the b-th session of the sorted N sessions, and the a-th coordinate is (b) /N, w/W), wherein the w is the sum of the feature information of the b sessions with the smallest feature information in the N sessions, and the W is the feature information of the N sessions
  • the M is an integer greater than 1 and less than or equal to the N
  • the a is an integer greater than or equal to 1 and less than or equal to the integer M
  • the b is an integer greater than or equal to 1 and less than or equal to the integer of N;
  • the statistical result is information entropy.
  • the obtaining the statistical result includes: calculating, according to the feature information of each session in the N sessions, an occurrence probability of each type of session in the N types of sessions, in the N sessions Each session belongs to a type of session in the n-type session, the n being an integer greater than or equal to 1 and less than or equal to the N; calculating the probability according to the occurrence probability of each type of session in the n-type session Information entropy.
  • the statistical result is a convolution
  • the feature information of each of the N sessions includes a first type of feature information and a second type of feature information, where One type of feature information is a numerical value representing a size, and the second type of feature information is a numerical value indicating a size.
  • the obtaining the statistical result includes: constructing a first discrete sequence according to the first type of feature information of each of the N sessions; and according to the second type of features of each of the N sessions Information Constructing a second discrete sequence; calculating the convolution of the first discrete sequence and the second discrete sequence.
  • the statistical result is a vector sum
  • the feature information of each session in the N sessions includes p-type feature information
  • the p is an integer greater than 1.
  • the obtaining the statistical result includes: constructing N vectors, the N vectors are in one-to-one correspondence with the N sessions, each of the N vectors having p dimensions, the p dimensions and the The p-type feature information is in one-to-one correspondence; the vector sum of the N vectors is calculated.
  • the statistical result is a vector product
  • the feature information of each session in the N sessions includes p-type feature information
  • the p is an integer greater than 1.
  • the obtaining the statistical result includes: constructing N vectors, the N vectors are in one-to-one correspondence with the N sessions, each of the N vectors having p dimensions, the p dimensions and the The p-type feature information is in one-to-one correspondence; the vector product of the N vectors is calculated.
  • the embodiments of the present application provide various statistical methods to make the solution more flexible and applicable.
  • the feature information includes: quintuple information, packet number information, and number of bytes One or more of information, time information, time to live (English: Time To Live; TTL) information, message length information, geographic information, or average message length.
  • the method further includes: determining, according to the statistical result, The source of the network attack; or, according to the statistical result, the target of the network attack is determined.
  • an embodiment of the present invention provides an apparatus for detecting a network attack.
  • the apparatus comprises at least one unit for implementing the method provided by the first aspect or any one of the possible embodiments of the first aspect.
  • an embodiment of the present invention provides an apparatus for detecting a network attack.
  • the apparatus for detecting a network attack may implement the method provided by any one of the first aspect or the first aspect of the first aspect.
  • the device includes a processor and a network interface, the processor The method is configured to: collect feature information of each session in each of the N sessions in the network by using a network interface, where N is an integer greater than 1; and obtain a statistical result, the statistical result is one for each session in the N sessions.
  • the sampling unit uses the feature information as a sample value to obtain statistics on the feature information of the N sessions; if the difference between the statistical result and the reference result exceeds a preset condition, it is determined that the network is attacked by the network.
  • FIG. 1 is a schematic diagram of an implementation environment provided by an embodiment of the present application.
  • FIG. 2 is a block diagram of an apparatus for detecting a network attack according to an embodiment of the present application
  • FIG. 3 is a flowchart of a method for detecting a network attack according to an embodiment of the present application
  • 4A is a flowchart of a method for detecting a network attack according to another embodiment of the present application.
  • 4B is a schematic diagram of a Lorentz curve according to another embodiment of the present application.
  • FIG. 5 is a flowchart of a method for detecting a network attack according to another embodiment of the present application.
  • FIG. 6 is a flowchart of a method for detecting a network attack according to another embodiment of the present application.
  • FIG. 7 is a flowchart of a method for detecting a network attack according to another embodiment of the present application.
  • FIG. 8 is a flowchart of a method for detecting a network attack according to another embodiment of the present application.
  • FIG. 9 is a block diagram of an apparatus for detecting a network attack according to another embodiment of the present application.
  • module may be implemented by hardware, or may be implemented by a combination of hardware and software, or may be implemented by a program or an instruction stored in a memory capable of implementing certain functions; "Unit” refers to a functional structure that is logically divided. The “unit” can be implemented by pure hardware or by a combination of hardware and software.
  • a session (English: session) refers to a communication interaction between two devices during a specific operation time that is not interrupted. During a session, all messages transmitted between the two devices belong to the session.
  • the message communicated between the first device and the second device is a Transmission Control Protocol (English: Transmission Control Protocol; TCP) message, or in the first device
  • TCP Transmission Control Protocol
  • UDP User Datagram Protocol
  • the TCP packet or the UDP packet carries the quintuple information. Match the quintuple information of multiple messages in the same session. That is, in the quintuple information carried by the packet sent by the first device to the second device, the source IP address is the IP address of the first device, the source port number is the port number of the first device, and the destination IP address is the second.
  • the IP address of the device, the destination port number is the port number of the second device; the quintuple information carried in the packet sent by the second device to the first device, the source IP address is the IP address of the second device, and the source port number It is the port number of the second device.
  • the destination IP address is the IP address of the first device, and the destination port number is the port number of the first device.
  • the transport layer protocol numbers used by the two devices are the same. These messages belong to the same TCP/UDP session.
  • the message communicated between the first device and the second device is not a TCP message or a UDP message, for example, communication between the first device and the second device
  • the message is an Internet Control Message Protocol (ICMP) message
  • ICMP Internet Control Message Protocol
  • the source IP address is the IP address of the first device
  • the destination IP address is the IP address of the second device
  • the second device gives the first
  • the source IP address is the IP address of the second device
  • the destination IP address is the IP address of the first device.
  • the transmission of the packets sent between the two devices is used. Layer protocol numbers are the same. These messages belong to the same ICMP session.
  • a session can have an explicit connection establishment process and a disconnection process. For example, during a TCP session, a three-way handshake is used between two ports on two devices (English: three-way) Handshake) Establish a TCP connection and disconnect the TCP connection by four waves (four-way handshake) when the session is completed.
  • a session can also have no connection establishment process, for example, UDP is used for communication between two ports of two devices for a continuous period of time.
  • the first message in the connection establishment process can be used as the start of the session, and the last message in the connection disconnection process is terminated as a session.
  • the first handshake message is used as the start of the session
  • the fourth wave of the TCP session is the fourth wave of the handshake as the termination of the session.
  • the message is a network attack message
  • the protocol used in the message is a protocol with a clear connection establishment process and a disconnection process, such as TCP
  • the session may still have no complete setup process and termination process.
  • the device that initiates the network attack does not send any packet after only three handshakes, or the device that initiates the network attack does not perform subsequent response after initiating the first handshake, or initiates
  • the device of the network attack sends a malformed message whose identifier bit does not match the protocol definition.
  • the judgment of the start and end of the session may be the same as the start or end of the session without the connection establishment process described above, or the start or end of the session may be determined for the type of the common network attack message. Conditions are set.
  • the session random sampling technique is used to collect the packets in several sessions in the network according to the preset sampling rules, and extract the feature information of each session from the collected packets, and use the session information Perform statistical analysis on the feature information of these sessions for the unit to detect network attacks.
  • the number of messages to be collected depends on the feature information of the session to be extracted. For example, when the feature information of the session to be extracted is quintuple information, only one message of each session needs to be collected. For example, when the feature information of the session to be extracted is the packet number information, all the messages of the session need to be collected.
  • FIG. 1 is a schematic diagram of an implementation environment provided by an embodiment of the present application, which may be a network system that performs communication based on TCP/IP.
  • the The implementation environment includes a network 10 including a plurality of network devices 110, and a device for detecting network attacks (hereinafter referred to as "detection devices") 120.
  • detection devices a device for detecting network attacks
  • the network 10 can be an operator network or a local area network.
  • the network device 110 can be a switch, a router, a wavelength division multiplexing device, a packet transport network device, an optical transport network device, a firewall, or a data center.
  • the networking structure of several network devices 110 in the network 10 is not limited.
  • the networking structure may be a centralized networking structure, a distributed networking structure, or the like.
  • the network device 110 performs session sampling according to a preset sampling rule. That is, the network device 110 extracts the packets in the plurality of sessions, and acquires the feature information of each of the plurality of sessions.
  • the network device 110 extracts the packets in the session, and the network device 110 mirrors the packet every time a packet is received, and saves the mirrored packet for the preset time period. Obtain the feature information of the session to which the packet belongs, and forward the original packet according to the transmission path.
  • the feature information of the session is collected from the message without any special description, and the feature information of the session is collected from the mirrored and saved message.
  • the network device 110 determines that the session to which the message belongs can be performed by the following method.
  • the network device 110 obtains the quintuple information in the message as the first quintuple information.
  • the network device 110 determines whether the first quintuple information is stored in the session information table. If the first quintuple information is stored, it indicates that the packet belongs to the same session as the packet previously received by the network device 110.
  • the network device 110 identifies the session to which the message belongs; if the first quintuple information is not stored in the session information table, the source IP address and the destination IP address in the first quintuple information are mutually And changing, the source port address and the destination port address in the first quintuple information are exchanged to obtain the second quintuple information, and determining whether the second quintuple information is stored in the session information table, if The second quintuple information is stored in the session information table, and the packet is also in the same session as the packet received by the network device 110.
  • the network device 110 identifies the session to which the packet belongs.
  • the network device 110 If the first quintuple information and the second quintuple information are not present in the session information table, the network device 110 has not received the message belonging to the session, and the network device 110 is in the The first quintuple information or the second quintuple information is added to the session information table. Certainly, the first quintuple information and the second quintuple information may also be calculated by using the same hash function by the first quintuple information and the second quintuple information, respectively. The first hash value and the second hash value. Through the above steps, the network device 110 collects the received message within the preset time period, and identifies each message. The session to which it belongs.
  • the sampling rule of the session on the network device 110 may be configured by the network administrator on the network device 110 or may be sent by the detecting device 120.
  • the sampling rule may be a session in which a preset ratio is extracted within a preset time period. After extracting the session, the network device 110 extracts feature information of each session in the extracted session and sends it to the detecting device 120.
  • the detection device 120 establishes a communication connection with a number of network devices 110 in the network 10.
  • the detection device 120 establishes a communication connection with the network device 110 in the network 10 for session sampling.
  • the network device 110 for performing session sampling may be one network device 110 in the network 10 or multiple network devices 110.
  • the detecting device 120 receives the session feature information transmitted by the network device 110.
  • the detecting device 120 is configured to perform statistical analysis on the feature information of the session to detect whether the network 10 is attacked by the network.
  • the detection device 120 can be a standalone server. Of course, in other possible implementations, the detecting device 120 can also be implemented by software or hardware modules of one of the network devices 110 in the network 10.
  • the detecting device 200 can also be a cluster composed of a plurality of network devices.
  • FIG. 2 is a block diagram of a device (hereinafter referred to as “detecting device”) 200 for detecting a network attack provided by an embodiment of the present application.
  • the detecting device 200 can include a processor 210, a memory 220, a network interface 230, and a bus 240. Memory 220 and network interface 230 are coupled to processor 210 via bus 240.
  • the detecting device 200 is configured to detect whether the network is attacked by a network.
  • the detection device 200 can be the detection device 120 shown in FIG.
  • the detecting device 200 can be a stand-alone server or a software or hardware module on a network device in the network.
  • the detecting device 200 can also be a cluster composed of multiple network devices.
  • Processor 210 includes one or more processing cores.
  • the processor 210 executes various functional applications and data processing by running software programs and modules.
  • the processor 210 includes an arithmetic logic component, a register component, and a control component.
  • the processor 210 can be an independent central processor, or can be an embedded processor, such as a microprocessor (English: Micro Processor Unit; abbreviation: MPU) , Microcontroller (English: Microcontroller Unit; abbreviation: MCU) or Digital Signal Processor (English: Embedded Digital Signal Processor; Abbreviation: EDS).
  • MPU Micro Processor Unit
  • MCU Microcontroller
  • EDS Digital Signal Processor
  • the memory 220 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (English: Static Random Access Memory; SRAM), electrically erasable programmable read only Memory (English: Electrically Erasable Programmable Read-Only Memory; abbreviation: EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Read-Only Memory (English: Programmable Read-Only Memory; Abbreviation: PROM) , read only memory (English: Read Only Memory; abbreviation: ROM), magnetic memory, flash memory, disk or optical disk.
  • the memory 220 can be used to store software programs as well as executable instructions such as modules.
  • the network interface 230 can be a wired interface, such as a Fiber Distributed Data Interface (FDDI) or an Ethernet (English) interface.
  • Network interface 230 can also be a wireless interface, such as a wireless local area network interface.
  • Processor 210 is configured to execute instructions stored in memory 220.
  • the processor 210 implements the following method: collecting feature information of each session in each of the N sessions in the network, where N is an integer greater than 1; obtaining a statistical result, the statistical result is each of N sessions If the difference between the statistical result and the reference result exceeds the preset condition, the network is attacked by the network.
  • Network interface 230 is used for external communication, and network interface 230 can include multiple types of interfaces.
  • the network interface 230 is configured to send an instruction to randomly sample a session to a network device in the network, to receive feature information of the session from the network device, and the like.
  • the memory 220 can store the operating system 222 and the application modules 224 required for at least one function.
  • the operating system 222 can be an operating system such as a real time operating system (English: Real Time eXecutive; abbreviation: RTX), LINUX, UNIX, WINDOWS, or OS X.
  • the application module 224 can include an acquisition module 224a, an acquisition module 224b, and a determination module 224c.
  • the collecting module 224a is configured to collect feature information of each session in the N sessions in the network, where N is an integer greater than 1.
  • the obtaining module 224b is configured to obtain a statistical result, where the statistical result is in N sessions.
  • Each session is a sampling unit, and the feature information is used as a sample value to obtain statistics on the feature information of the N sessions; the determining module 224c is configured to: if the difference between the statistical result and the reference result exceeds a preset condition, Make sure the network is attacked by the network.
  • the detecting device 200 may further include an input/output component (not shown).
  • the input/output components include a display for displaying information and an input device such as a mouse or a keyboard for inputting information by the user. Therein, the display and input device are in communication with the processor 210.
  • FIG. 3 illustrates a method for detecting a network attack provided by an embodiment of the present application.
  • the method can be applied to the implementation environment shown in FIG. 1, and the step execution body of FIG. 3 can be the detecting device 120 or the detecting device 200 shown in FIG. 2.
  • the method can include the following steps.
  • S301 Collect feature information of each session in the N sessions in the network, where N is an integer greater than 1.
  • a session in a network means that packets belonging to the session are transmitted in devices of the network.
  • the two devices participating in the session may all be devices in the network; only one of the devices may be devices in the network; and two devices that may also participate in the session are not devices in the network.
  • the message of the session is forwarded in the forwarding device of the network.
  • the feature information of the session may include directly collecting the acquired feature information from the message included in the session, and may also include the feature information obtained by processing the directly acquired feature information.
  • the processing step may be performed by a network device that performs session sampling, or may be implemented by a detecting device.
  • the network device may be the network device 110 in the network in the implementation environment shown in FIG. For example, after receiving the instruction for randomly sampling the session sent by the detecting device 120, the network device 110 collects the packets of the session in the network according to the preset sampling rule, extracts the feature information of the session, and sends the signature information to the detection. Device 120.
  • the feature information of a session may include one or more pieces of information used to describe the characteristics of the session.
  • the feature information of the session includes, but is not limited to, quintuple information, number of messages in the session, number of bytes, time information, TTL information, message length information, geographic information, and average length of the message.
  • the quintuple information includes: destination IP address, source IP address, destination port number, source port number, and protocol number.
  • the number of packets includes, but is not limited to, one or more of the number of uplink packets, the number of downlink packets, the number of uplink fragments (in English: fragment), and the number of downlink fragmented packets.
  • the number of bytes information includes, but is not limited to, one or more of an upstream byte number and a downstream byte number.
  • the time information includes but is not limited to: one or more of an uplink packet interval time, a downlink packet interval time, and a session duration.
  • the TTL information includes but is not limited to one or more of an uplink maximum TTL, a downlink maximum TTL, an uplink minimum TTL, and a downlink minimum TTL.
  • the packet length information includes, but is not limited to, one or more of an uplink maximum packet length, a downlink maximum packet length, an uplink minimum packet length, and a downlink minimum packet length.
  • Geographic information includes one or more of source geographic information and destination geographic information. The geographic information can be obtained by IP address conversion. The attribution of the source IP address is the source geographic information, and the attribution of the destination IP address is the destination geographic information.
  • the geographic information may also be obtained from a geographic information system (English: Geographic Information System; GIS for short) according to an IP address.
  • Message average The length may include one or more of an average length of the uplink packet and an average length of the downlink packet.
  • the average packet length can be obtained by dividing the total number of bytes obtained by sampling by the total number of packets obtained by sampling.
  • the feature information of the session includes, but is not limited to, quintuple information, number of packets of the session, number of bytes, time information, TTL information, and packet length.
  • quintuple information One or more of information, geographic information, average message length, health status of a TCP session, or statistical results of out-of-order messages.
  • the packet number information may include the number of uplink packets, the number of downlink packets, the number of uplink fragmented packets, the number of downlink fragmented packets, and the synchronization of TCP sessions (English: synchronize; short: syn) packets, TCP End of session (English: finish; abbreviation: fin) number of packets, confirmation of TCP session (English: acknowledgment; abbreviation: ack), number of packets, reset of TCP session (English: reset; abbreviation: rst) One or more of the number of urgent (English: urgent: abbreviation: urg) packets and TCP session push (English: push; abbreviation: psh) packets.
  • the time information may include one or more of an uplink packet interval time, a downlink packet interval time, a session duration, a server response time of the TCP session, and a client response time of the TCP session.
  • the health status of the TCP session includes information related to the performance of the quality of service (English: Quality of Service; QoS) of the TCP session, such as one or more of the successful establishment of the TCP connection, the number of lost packets, the delay, and the like. .
  • QoS Quality of Service
  • the statistics result of the out-of-order message refers to the statistical result of the case that the packet sent later in a session arrives at the target device earlier than the previously transmitted packet.
  • the uplink packet refers to the packet sent to the device
  • the downlink packet refers to the packet sent from the device.
  • the uplink and downlink may be defined by the network device 110.
  • the first device and the second device perform a session, and the uplink packet may be sent by the first device to the second device, and the downlink packet may be sent by the second device to the first device.
  • the uplink packet may be sent by the second device to the first device, and the downlink packet may be sent by the first device to the second device.
  • the quintuple information, the source address, the destination address, and the source geographic information of the session information in this application may be
  • the destination geographic information refers to the quintuple information, source address, destination address, source geographic information, or destination geographic information of packets transmitted in a direction in two-way packets in the session.
  • S302 Obtain a statistical result, where the statistical result is that each of the N sessions is a sampling unit (English: sampling unit), and the feature information is a sample (English: sample) value, The result of the statistical analysis of the feature information of the N sessions.
  • the statistical result is a statistically obtained result of sample values of each sampling unit according to a specific statistical method.
  • taking each session as a sampling unit means that one session is the smallest unit of statistics.
  • Taking the feature information as a sample value means that each feature information is feature information of a certain session, and the statistical result reflects a correlation characteristic of the feature information.
  • the statistical result is used to reflect the distribution feature of the average length of the packets in each session, such as whether the average length of the packets in each session is close.
  • the statistical result is used to reflect the distribution characteristics of the destination geographic information of each session, such as the distribution of the geographic location pointed to by the destination geographic information of each session.
  • the statistical result may be any one of a Gini coefficient, an information entropy, a convolution, a vector, and a vector product.
  • the statistical result may be a result obtained by statistically obtaining a type of feature information of each session, or may be a result obtained by statistically obtaining a plurality of types of feature information of each session.
  • the statistical result is the Gini coefficient and the feature information is the average length of the message of the session
  • the Gini coefficient is a result of statistical acquisition of the feature information based on the average length of the message of the session.
  • the statistical result is a vector sum
  • the first type of feature information is the number of uplink packets of the session
  • the second type of feature information is the number of downlink packets of the session, where the vector sum is a session-based uplink.
  • the two types of feature information, the number of packets and the number of downlink packets are statistically obtained.
  • the detecting device determines that the network is attacked by the network.
  • the statistical results are the same as the reference results.
  • the statistical result and the reference result are both a value indicating a size
  • the preset condition may be a preset value.
  • the statistical result and the reference result are not values indicating a size
  • the preset condition may be other conditions that reflect the difference between the two results, for example, the statistical result and the reference result are respectively a multi-dimensional vector, the pre- The condition is that the difference between the vector length of the statistical result and the vector length of the reference result does not exceed the first preset value, and the difference between the vector angle of the statistical result and the vector angle of the reference result does not exceed the second preset value.
  • the reference result is the statistical result of the feature information of the session in the case where the network is not attacked by the network.
  • the reference result is obtained by using S301 and S302 at different times. Obtaining a plurality of statistical results, if the differences between the plurality of statistical results are within a certain range, the average of the statistical results is used as the reference result.
  • the detecting device further determines a source of the network attack according to the statistical result, or determines a target of the network attack according to the statistical result.
  • the source of the network attack may include: an IP address of the device that initiates the network attack, a port number of the device that initiates the network attack, and a geographical location of the device that initiates the network attack;
  • the target of the network attack may include: One or more of the IP address of the device attacked by the network, the port number of the device attacked by the network, and the geographic location of the device attacked by the network.
  • a session that plays a major role in the difference between the statistical result and the reference result is obtained, and information of devices participating in the sessions is analyzed to determine a source or target of the network attack.
  • the statistical result is a Gini coefficient
  • the feature information of the session is the average length of the message, and the lengths of the packets of a certain type of network attack are the same, for example, the first length
  • the session of the network attack The average length of the message is also approximately equal to the first length. That is, the difference between the average packet length of the session of the network attack and the first length is less than a preset value.
  • the detecting device acquires a session in which the difference between the average length of the packet and the first length is less than a preset value, and analyzes the geographic information of the device participating in the session. It is assumed that the detecting device determines that the probability that the IP address of the initiator of the session is in the first subnet segment is large in these sessions, for example, the number of sessions of the initiator's IP address in the first subnet segment accounts for these sessions. 80% of the total number, it can be determined that the device that initiated the network attack is the device of the first IP subnet segment.
  • the method provided in this embodiment obtains statistical results by collecting feature information of each session in multiple sessions in the network, and if the difference between the statistical result and the reference result exceeds a preset condition, To determine that the network is being attacked by the network.
  • a session-based network attack has the following characteristics: A device that initiates a network attack occupies a large number of sessions and occupies resources of the target device. Since only a small number of packets are required to initiate a session, but the resources of the device are occupied a lot, if the number of network attack packets is small, the target device may be greatly damaged.
  • the packet is used as the sampling unit, the network attack packets that meet the above-mentioned session-based network attack characteristics have a small proportion in the data traffic, which makes it difficult to collect such network attack packets.
  • the session is sampled.
  • the unit whether it is a network attack message with only one session establishment request, or a normal session with large data traffic, is used as one in the sampling statistics.
  • the sessions are used for statistics, so there is a high probability of identifying the session-like network attack.
  • the session random sampling technique can restore the characteristics of the session well, such as the IP address distribution characteristics and geographical distribution characteristics of the session, the technical effects of effectively detecting IP distribution anomalies and geographical distribution anomalies are achieved.
  • Table-1 exemplarily shows several statistical methods, and characteristic information applicable to each statistical method (hiccup means applicable).
  • the feature information of the session may further include the average length of the message, the source geographic information, and the destination geographic information.
  • the feature information is a numerical value indicating a size
  • the statistical method is a Gini coefficient statistical method
  • the statistical result is a Gini coefficient
  • the Gini coefficient is an indicator of the fairness of income distribution as defined by the American economist Albert Hirschmann in 1943 according to the Lorenz curve.
  • the Gini coefficient is a proportional value that ranges between 0 and 1.
  • the Gini coefficient is used to reflect the distribution average degree of the value of the feature information of each session.
  • the Gini coefficient is used as a feature reference for network attack analysis. When the Gini coefficient changes significantly compared with the reference result, it can be judged that the network has an abnormality, which is one of the effective criteria for confirming that the network is attacked by the network. .
  • the reference result is a Gini coefficient calculated by the following steps in the case where the network is not attacked by the network.
  • S302 shown in FIG. 3 may specifically include:
  • S401 Sort the N sessions according to the feature information of each session in the N sessions from small to large.
  • the M sessions selecting M sessions from the N sessions, acquiring M coordinates in a coordinate system, the M coordinates are in one-to-one correspondence with the M sessions, and the a-th coordinate in the M sessions corresponds to In the bth session of the sorted N sessions, the a-th coordinate is (b/N, w/W), wherein the w is the smallest value of the feature information in the N sessions.
  • the horizontal axis represents the session ratio
  • the vertical axis represents the cumulative distribution value of the feature information ratio corresponding to the session ratio.
  • the Lorentz curve is constructed in the coordinate system according to the M coordinates acquired by the method in S402.
  • the area of the non-shaded portion enclosed by the line connecting the coordinates (0, 0) and the coordinates (1, 1) and the Lorentz curve is A, and the Lorentz curve and the coordinate axis are shown.
  • the area of the shaded area enclosed by the area is B,
  • the Gini coefficient is 0; the value of the feature information in one session is W, and the feature information of the other sessions is When the value is 0, the Gini coefficient is 1.
  • Gini coefficient statistical method is exemplified by several illustrative examples.
  • the feature information of the session is the average length of the uplink message.
  • the cumulative distribution of the average length of the uplink message is the vertical axis, and the Lorenz curve is constructed, and the Gini coefficient is calculated according to the Lorentz curve.
  • the average length of the uplink messages of the 10 sessions is: 4, 4, 6, 8, 8, 8, 10, 12, 16, 24 in descending order.
  • select M 5, that is, select 5 sessions from the above 10 sessions.
  • the selected five sessions are the sorted second session, the sorted fourth session, the sorted sixth session, the sorted eighth session, and the sorted tenth session.
  • the M coordinates obtained in step 401 are (20%, 8%), (40%, 22%), (60%, 38%), (80%, 60%), and (100%, 100%).
  • the above coordinates are sequentially connected to obtain a Lorenz curve, and then the Gini coefficient can be calculated according to the Lorentz curve.
  • the Gini coefficient reflects the average degree of distribution of the average length of the upstream messages for each session.
  • the Gini coefficient is significantly different from the reference result.
  • the Gini coefficient is significantly smaller than the reference result. Therefore, based on the degree of change of the Gini coefficient compared to the reference result, it is possible to detect whether there is a cyber attack.
  • the feature information of the session is the number of syn messages in the TCP session.
  • the Gini coefficient reflects the average degree of distribution of the number of syn messages in each TCP session.
  • the syn packet is a packet sent by the client to the server when the TCP connection is established through a three-way handshake.
  • the number of syn packets is usually small and the number is stable.
  • the ratio will become more uneven, at which time the Gini coefficient is greater than the reference result, and the difference between the Gini coefficient and the reference result is greater than a preset value. For example, in a normal session, two syn messages are generated during a TCP three-way handshake, and the number of syn packets in a session is more than two. Therefore, based on the difference in the Gini coefficient from the reference result, it is possible to detect whether there is a cyber attack.
  • the feature information of the session is the ground distance between the source device and the destination device.
  • the cumulative distribution of the surface distance ratio between the source device and the destination device is the vertical axis, and the Lorenz curve is constructed, and the Gini coefficient is calculated according to the Lorentz curve.
  • the ground distance between the source device and the destination device may be determined according to the source geographic information and the destination geographic information.
  • the Gini coefficient reflects the average degree of distribution of the surface distances corresponding to each session.
  • the ratio will become more even, the Gini coefficient is smaller than the reference result, and the difference between the Gini coefficient and the reference result is greater than the preset value. Therefore, based on the difference in the Gini coefficient from the reference result, it is possible to detect whether there is a cyber attack.
  • Gini coefficient statistical method can also be applied to statistically analyze other various feature information.
  • S302 can include:
  • n is an integer greater than 1 and less than or equal to N;
  • Information entropy is an indicator used to measure the amount of information contained in a piece of information.
  • Information entropy is mathematically a A more abstract concept that understands information entropy as the probability of occurrence of a particular piece of information. The calculation formula of information entropy is as follows:
  • H represents information entropy.
  • n represents the number of values of the elements, that is, the number of conversation types in this embodiment.
  • p i represents the probability of occurrence of the element of the i-th value, 1 ⁇ i ⁇ n and i, n are integers, that is, the probability of occurrence of the i-th session in this embodiment.
  • the feature information of multiple sessions belonging to the same type of session is the same or belongs to the same classification standard.
  • Each of the N sessions belongs to a certain type of session in a class n session and does not belong to other n-1 class sessions.
  • the feature information of the session is the source IP address of the uplink packet in the session, and the source IP address of the uplink packet in the N sessions has n different values, and the session with the same source IP address of the uplink packet belongs to the session.
  • a type of conversation For example, the feature information of the session is the source IP address of the uplink packet, and the subnet network segment to which the source IP address of the uplink packet belongs to the N sessions has n different values, and the source IP address of the uplink packet. Sessions whose addresses belong to the same subnet segment belong to a type of session.
  • information entropy is used as a network attack.
  • the network may be abnormal, which is one of the effective criteria for confirming that the network is attacked by the network.
  • the reference result is the information entropy calculated by the above steps in the case that the network is not attacked by the network.
  • the session information is the source IP address of the uplink packet, and the session with the same source IP address of the uplink packet belongs to the same type of session.
  • the source IP addresses of the uplink messages of the 10 sessions are: IP address 1, IP address 2, IP address 3, IP address 1, IP address 1, IP address 1, IP Address 4, IP address 4, IP address 2, IP address 1.
  • the probability of occurrence of a class-like session is 0.2
  • the probability of occurrence of a class of sessions whose source IP address is IP address 3 is 0.1
  • the probability of occurrence of a class of packets whose source IP address of the uplink packet is IP address 4 is 0.2.
  • the information entropy is calculated by substituting the number of categories of the session and the probability of occurrence of each type of session into equation (1).
  • the information entropy reflects the various types of sessions with the same source IP address of the upstream message.
  • the degree of equality of occurrence For example, the larger the information entropy, the more average the probability of occurrence of the above four types of sessions; the smaller the information entropy, the more uneven the probability of occurrence of the above four types of sessions.
  • the probability that the source IP address of the uplink packet is the above four source IP addresses is equal, and the network is received by the device initiated by the IP address 1 during the target time period.
  • the attack is performed, the source IP address of the uplink packet is higher than that of other types of sessions.
  • the information entropy is smaller than the reference result.
  • the reference result is an information entropy calculated according to the source IP address of the received uplink message of multiple sessions in the case that the network is not attacked by the network.
  • the source IP address of the uplink packet whose occurrence probability is significantly increased compared with the normal value may be extracted, and the IP address of the initiated network attack is further analyzed.
  • the session information is the source IP address of the uplink packet.
  • the source IP address of the uplink packet belongs to the same type of session.
  • the source IP address of the uplink packet of the above 10 sessions is taken as an example. Assume that IP address 1 and IP address 2 belong to the same subnet segment, and are recorded as subnet segment 1, IP address 3, and IP address. 4 belongs to the same subnet segment and is recorded as subnet segment 2.
  • the above-mentioned 10 sessions can be classified into two types.
  • the source IP address of the uplink packet belongs to the subnet segment 1 and the source IP address of the uplink packet belongs to the subnet segment 2
  • the probability of a conversation is 0.3.
  • the information entropy is calculated by substituting the number of categories of the session and the probability of occurrence of each type of session into equation (1).
  • the information entropy reflects the degree of occurrence of the probability of occurrence of various types of sessions in which the source IP address of the uplink packet belongs to the same subnet segment.
  • the probability of occurrence of a type of session corresponding to the subnet segment is far greater than that of other types of sessions.
  • the information entropy is significantly smaller than the reference. result. Therefore, based on the difference in information entropy compared to the result of the parameter, it is possible to detect whether there is a network attack.
  • the reference result is an information entropy calculated according to the source IP address of the received uplink message of multiple sessions in the case that the network is not attacked by the network.
  • the subnet network segment whose occurrence probability is significantly increased compared with the normal value may be extracted, and the subnet network segment that initiates the network attack is further analyzed.
  • the feature information of the session is the number of uplink packets, and the sessions in which the number of uplink packets belong to the same value interval belong to the same type of session.
  • the probability of occurrence of a type of session in which the number of uplink packets belongs to the above (a) value interval is 0.6, and the probability of occurrence of a type of session in which the number of uplink packets belongs to the above (b) type of value interval is 0.3, and the uplink is upward.
  • the probability of occurrence of a type of session in which the number of messages belongs to the above-mentioned (c) type of value interval is 0.1.
  • the information entropy is calculated by substituting the number of categories of the session and the probability of occurrence of each type of session into equation (1).
  • the information entropy reflects the degree of equality of the probability of occurrence of various types of sessions in which the number of uplink packets belongs to different value ranges.
  • the network attack session includes only the message for requesting the establishment of the session, and does not include the message for transmitting data, the (a)th
  • the probability of occurrence of a type of session in the value interval is much larger than that of other types of sessions.
  • the information entropy is significantly smaller than the reference result. Therefore, based on the difference in information entropy compared to the reference result, it is possible to detect whether there is a network attack.
  • the above examples are only schematic and explanatory.
  • the information entropy statistical method can also be applied to statistically analyze other various feature information.
  • the statistical method is a convolution statistical method, and the statistical result is convolution.
  • the feature information of each of the N sessions shown includes first type feature information and second type feature information, the first type feature information is a value indicating a size, and the second type feature information is a value indicating a size.
  • S302 can include:
  • the execution order of S601 and S602 is not limited, and S601 may be performed before S602, may be performed after S602, or simultaneously with S602.
  • S601 may be performed before S602 as an example, but the present application is not limited thereto.
  • Convolution is the result of summing two variables over a range.
  • both variables are discrete variables and are convoluted into discrete convolutions accordingly.
  • the calculation formula for convolution is as follows:
  • x(n) and h(n) correspond to a first discrete sequence and a second discrete sequence, respectively
  • y(n) is a discrete sequence obtained by a convolution operation.
  • the first discrete sequence x(n) is a sequence of the first type of feature information of each of the N sessions, and the i-th element of the first discrete sequence x(n) represents the first of the i-th session.
  • Class characteristic information the second discrete sequence h(n) is a sequence composed of the second type of feature information of each session in the N sessions, and the i-th element in the second discrete sequence x(n) represents the i-th session
  • the convolution operation result y(n) embodies the relationship between the first type of feature information and the second type of feature information.
  • the first type of feature information and the second type of feature information are all represented by a numerical value indicating the size.
  • convolution is used as a feature reference for network attack analysis.
  • the convolution changes greatly compared with the reference result, it can be judged that the network has an abnormality, which is one of the effective criteria for confirming that the network is attacked by the network.
  • the reference result is the information entropy calculated by the above steps in the case that the network is not attacked by the network.
  • the first type of feature information is the start time of the session
  • the second type of feature information is the session duration
  • the start time of the session can be converted to a value indicating the size by setting the reference time to 0, representing the start time of the session as the time interval from the reference time.
  • the reference time is 0, the reference time is 11:20, and the start time is 15 seconds after the reference time, and the start time is 15.
  • the start time of the session may be the time when the network device that obtains the session feature information receives the first packet in the session, or the timestamp information in the first packet of the session, which is not limited in this application.
  • the session duration is the length of time elapsed from the start of the session to the end of the session.
  • the i-th element in the first discrete sequence x(n) represents a starting moment of the i-th session; according to N sessions
  • the session duration of each session in the middle constructs a second discrete sequence h(n), and the i-th element in the second discrete sequence h(n) represents the session duration of the i-th session.
  • the convolution of the first discrete sequence x(n) and the second discrete sequence h(n) is calculated according to equation (2).
  • the convolution is used to reflect the probability density distribution of the session duration in the time domain, embodying the distribution characteristics of the session duration of the N sessions over the time domain.
  • the distribution density of the session with a short session duration in the time domain is significantly increased compared with the reference result.
  • a session with a short duration can be a session that contains only one or two messages.
  • the way of network attack is to initiate a session establishment request and no longer respond. Then the session ends after the attacked device sends a response message.
  • a normal session has a complete setup process and data interaction, so the session lasts longer than this class.
  • a session of a cyber attack is therefore, based on the difference between the convolution calculation result and the reference result, it is possible to detect whether there is a network attack.
  • the first type of feature information of each session is the session duration
  • the second type of feature information is the average length of the message.
  • the convolution calculation results are significantly different from the reference results. Therefore, based on the difference between the convolution calculation result and the reference result, it is possible to detect whether there is a network attack.
  • the first type of feature information of each session is the start time of the session
  • the second type of feature information is the minimum packet length of the uplink.
  • the i-th element in the first discrete sequence x(n) represents a starting moment of the i-th session; according to N sessions
  • the second smallest sequence h(n) is constructed for the uplink minimum message length of each session, and the i-th element of the second discrete sequence h(n) represents the uplink minimum message length of the i-th session.
  • the convolution of the first discrete sequence x(n) and the second discrete sequence h(n) is calculated according to equation (2).
  • the convolution is used to reflect the probability density distribution of the uplink minimum message length in the time domain.
  • the statistical result is larger than the reference result, and the difference between the statistical result and the reference result is greater than the preset value. Therefore, based on the difference between the convolution calculation result and the reference result, it is possible to detect whether there is a network attack.
  • the convolution statistics method can also be applied to statistically analyze other various feature information.
  • the statistical method is a vector and a statistical method, and the statistical result is a vector sum, and the feature information of each session in the N sessions includes p-type feature information.
  • the p is an integer greater than one. Accordingly, as shown in FIG. 7, S302 includes:
  • N vectors where the N vectors are in one-to-one correspondence with the N sessions, and the N Each of the vectors has p dimensions, and the p dimensions are in one-to-one correspondence with the p-type feature information;
  • a certain dimension of the vector corresponds to a certain feature information of the session, and may be that the value of the certain dimension is equal to the value of the certain feature information, or may refer to the certain dimension.
  • the value is a fixed ratio to the certain feature information.
  • the value of the first dimension of the vector corresponds to the number of uplink packets of the session
  • the value of the second dimension of the vector corresponds to the number of downlink packets of the session.
  • the value of the first dimension of the vector corresponds to the longitude of the destination geographic information of the uplink packet of the session
  • the value of the second dimension of the vector corresponds to the latitude of the destination geographic information of the uplink packet of the session.
  • the vector sum is used as a feature reference for network attack analysis.
  • the network may be abnormal, as one of the effective criteria for confirming that the network is attacked by the network.
  • the reference result is a vector sum calculated by the above steps in the case where the network is not attacked by the network. For example, when the magnitude of the vector sum changes greatly compared to the size of the reference result, and the angle ⁇ between the direction of the vector sum and the direction of the reference result is greater than a certain value, it is confirmed that there is a network attack.
  • the feature information of each session includes the longitude of the destination geographic information of the uplink packet and the latitude of the destination geographic information of the uplink packet.
  • the feature vectors corresponding to each session are constructed with the latitude and longitude coordinates of the destination geographic information of the uplink message of each session, and the vector sum of the feature vectors corresponding to each session is calculated.
  • the feature vector corresponding to each session is a two-dimensional feature vector, and the two dimensions of the feature vector respectively correspond to the longitude and latitude of the destination geographic information of the uplink message.
  • the difference between the vector sum and the reference result is greater than a preset condition, for example, the vector length of the statistical result and the reference result and/or the above-mentioned angle ⁇ is greater than a preset. value. Therefore, based on the difference between the vector and the reference result, it is possible to detect whether there is a network attack.
  • the destination geographic information of the uplink packet causing the vector and the significant change may be extracted, and the region determined to be attacked by the network is further analyzed.
  • the feature information of each session includes the number of uplink packets and the number of downlink packets.
  • the feature vector corresponding to each session is a two-dimensional feature vector, and the two dimensions of the feature vector respectively correspond to the number of uplink packets and the number of downlink packets.
  • the number of uplink packets increases significantly compared with the normal situation, so that the difference between the statistical result and the reference result is greater than the preset condition. Therefore, based on the difference between the vector and the reference result, it is possible to detect whether there is a network attack.
  • the feature information of each session includes the number of uplink bytes and the number of downlink bytes.
  • the feature vector corresponding to each session is constructed with the number of uplink bytes and the number of downlink bytes of each session, and the vector sum of the feature vectors corresponding to each session is calculated.
  • the feature vector corresponding to each session is a two-dimensional feature vector, and the two dimensions of the feature vector correspond to the number of uplink bytes and the number of downlink bytes, respectively.
  • the difference between the statistical result and the reference result is greater than the preset condition because the number of uplink bytes is significantly increased. Therefore, based on the difference between the vector and the reference result, it is possible to detect whether there is a network attack.
  • the statistical method is a vector product statistical method, and the statistical result is a vector product.
  • the feature information of each of the N sessions includes p-type feature information, and the p is an integer greater than 1. Accordingly, as shown in FIG. 7, S302 includes:
  • N vectors where the N vectors are in one-to-one correspondence with the N sessions, each of the N vectors has p dimensions, and the p dimensions and the p-type feature information are One correspondence
  • the vector product is used as a feature reference for network attack analysis.
  • the reference result is a vector product calculated by the above steps in the case where the network is not attacked by the network. For example, when the statistical result and the reference result are greater than the preset condition, it is confirmed that there is a network attack.
  • the vector product statistical method reference may be made to the above illustrative examples using vector and statistical methods, and details are not described herein again.
  • FIG. 9 is a block diagram of an apparatus for detecting a network attack according to another embodiment of the present application.
  • the device may include an acquisition unit 910, an acquisition unit 920, and a determination unit 930.
  • the collecting unit 910 is configured to collect feature information of each session in the N sessions in the network, where N is an integer greater than 1.
  • the obtaining unit 920 is configured to obtain a statistical result, and send the statistical result to the determining unit 930.
  • the statistical result is that each of the N sessions collected by the collecting unit 910 is a sampling unit, and the feature is The information is a sample value, and the result obtained by counting the feature information of the N sessions is obtained.
  • the determining unit 930 is configured to determine that the network is attacked by the network if the difference between the statistical result received from the obtaining unit 920 and the reference result exceeds a preset condition.
  • the device provided in this embodiment acquires statistical results by collecting feature information of each session in multiple sessions in the network, and if the difference between the statistical result and the reference result exceeds a preset condition, To determine that the network is being attacked by the network.
  • a session-based network attack has the following characteristics: A device that initiates a network attack occupies a large number of sessions and occupies resources of the target device. Since only a small number of packets are required to initiate a session, but the resources of the device are occupied a lot, if the number of network attack packets is small, the target device may be greatly damaged.
  • the packet is used as the sampling unit, the network attack packets that meet the above-mentioned session-based network attack characteristics have a small proportion in the data traffic, which makes it difficult to collect such network attack packets.
  • the session is sampled.
  • the unit whether it is a network attack message with only one session establishment request, or a normal session with large data traffic, is counted as a session in the sample statistics, so there is a high probability of identifying the session type network attack. .
  • the feature information is a numerical value indicating a size
  • the statistical result is a Gini coefficient.
  • the obtaining unit 920 is specifically configured to: sort the N sessions according to the feature information of each session in each of the N sessions collected by the collecting unit 910; select from the N sessions M sessions, acquiring M coordinates in a coordinate system, the M coordinates are in one-to-one correspondence with the M sessions, and the a-th coordinate in the M sessions corresponds to the b-th in the N sessions Sessions, the a-th coordinate is (b/N, w/W), wherein And w is the sum of the feature information of the b sessions with the smallest feature information in the N sessions, where W is the sum of the feature information of the N sessions, and the M is greater than 1 and less than or equal to An integer of N, the a is an integer greater than or equal to 1 and less than or equal to the M, and the b is an integer greater than or equal to 1 and less than or equal to
  • the statistical result is information entropy.
  • the obtaining unit 920 is specifically configured to calculate, according to the feature information of each session in each of the N sessions collected by the collecting unit 910, the probability of occurrence of each type of session in the N sessions in the N sessions, the N Each session in the session belongs to a type of session in the n-type session, and n is an integer greater than 1 and less than or equal to N; the information entropy is calculated according to the probability of occurrence of each type of session in the n-type session.
  • the statistical result is a convolution
  • the feature information of each session in the N sessions includes the first type of feature information and the second type of feature information.
  • the first type of feature information is a numerical value indicating a size
  • the second type of feature information is a numerical value indicating a size.
  • the acquiring unit 920 is specifically configured to: construct a first discrete sequence according to the first type of feature information of each of the N sessions collected by the collecting unit 910; and each session of the N sessions collected by the collecting unit 910
  • the second type of feature information constructs a second discrete sequence; and calculates a convolution of the first discrete sequence and the second discrete sequence.
  • the statistical result is a vector sum
  • the feature information of each session in the N sessions includes p-type feature information, and the p is greater than 1.
  • the obtaining unit 920 is specifically configured to: construct N vectors, where the N vectors are in one-to-one correspondence with the N sessions, each of the N vectors has p dimensions, and the p dimensions One-to-one correspondence with the p-type feature information; calculating a vector sum of the N vectors.
  • the statistical result is a vector product
  • feature information of each session in the N sessions includes p-type feature information, and the p is greater than 1.
  • the obtaining unit 920 is specifically configured to: construct N vectors, where the N vectors are in one-to-one correspondence with the N sessions, each of the N vectors has p dimensions, and the p dimensions One-to-one correspondence with the p-type feature information; calculating a vector product of the N vectors.
  • the feature information includes one or more of quintuple information, packet number information, byte number information, time information, TTL information, message length information, geographic information, or average message length. .
  • the determining unit 930 is further configured to: determine, according to the statistical result received from the obtaining unit 920, a source of the network attack; Alternatively, the target of the cyber attack is determined based on the statistical result received from the obtaining unit 920.
  • a person skilled in the art may understand that all or part of the steps of implementing the above embodiments may be completed by hardware, or may be instructed by a program to execute related hardware, and the program may be stored in a computer readable storage medium.
  • the storage medium mentioned may be a read only memory, a magnetic disk or an optical disk or the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请实施例提供了一种检测网络攻击的方法及设备，涉及网络安全技术领域，所述方法包括：采集网络中的N个会话中每个会话的特征信息，N为大于1的整数；获取统计结果，该统计结果为以N个会话中的每个会话为一个采样单元，以特征信息为样本值，对N个会话的特征信息进行统计后得到的结果；如果统计结果和参考结果之间的差异超过预设条件，确定网络受到网络攻击。本申请解决了采用报文随机抽样技术，因难以采集到足够的在数据流量中所占比例较小的网络攻击报文，导致难以检测到此类网络攻击的技术问题。在本申请实施例中，由于以会话为抽样单位，而非以报文为抽样单位，故可有效检测出会话类网络攻击。

Description

检测网络攻击的方法及设备 技术领域
本申请实施例涉及网络安全技术领域，特别涉及一种检测网络攻击的方法及设备。
背景技术
网络攻击是网络中重要安全问题。例如：拒绝服务(英文：denial of service；缩写：DoS)攻击是一种常见的网络攻击。DoS攻击通过向网络攻击针对的目标设备发送攻击报文，占用目标设备或者网络的资源，从而导致目标设备或网络无法正常的运行。
通常情况下，网络中的设备会采用报文随机抽样技术实现对网络攻击的检测。报文随机抽样检测网络攻击的方法是，采集目标时间段内，网络设备接收到的数据流量中一定比例的报文，获取每个报文的特征信息，然后对这些报文的特征进行统计分析，从而判断该网络设备所在的网络在该目标时段内是否受到网络攻击。
然而，存在一些网络攻击，这些网络攻击的攻击报文在网络整体的数据流量中所占比例较小，却对目标设备的资源消耗很大。通过报文随机抽样难以采集到足够的此类网络攻击报文，因此通过报文随机抽样的特征进行统计分析，难以检测到此类网络攻击。
发明内容
本申请实施例提供了一种检测网络攻击的方法及设备，用于检测一些报文随机抽样技术难以检测到的网络攻击。
第一方面，本发明实施例提供了一种检测网络攻击的方法。该方法包括：采集网络中的N个会话中每个会话的特征信息，所述N为大于1的整数；获取统计结果，所述统计结果为以所述N个会话中的每个会话为一个采样单元，以所述特征信息为样本值，对所述N个会话的所述特征信息进行统计后得到的结果；如果所述统计结果和参考结果之间的差异超过预设条件，确定所述网络 受到网络攻击。
通过会话随机抽样，并以会话为单位对会话的特征信息进行统计分析，可以有效检测出一些传统的报文随机抽样难以检测出的会话类网络攻击。会话类网络攻击存在如下特点：发起网络攻击的设备通过发起大量会话，占用目标设备的资源。由于发起一个会话只需要少量的报文，但是对设备的资源占用很多，因此在网络攻击报文的数量不大的情况下，就可以对目标设备造成较大的损害。若以报文为抽样单位，由于符合上述会话类网络攻击特性的网络攻击报文在数据流量中占比很小，导致此类网络攻击报文很难被采集。而本申请中以会话为抽样单位，无论是只有一个会话建立请求的网络攻击报文，还是包括数据流量较大的正常会话，在抽样统计中都作为一个会话来进行统计，因此有较大概率识别出所述会话类网络攻击。
在第一方面的第一种可能的实施方式中，所述特征信息是表示大小的数值，所述统计结果为基尼系数。所述获取统计结果，包括：按所述特征信息从小到大的顺序，对所述N个会话排序；从所述N个会话中选择M个会话，在坐标系中获取M个坐标，所述M个坐标与所述M个会话一一对应，所述M个会话中的第a个坐标对应于所述排序后的N个会话中的第b个会话，所述第a个坐标为(b/N,w/W)，其中，所述w为所述N个会话中特征信息最小的b个会话的所述特征信息之和，所述W为所述N个会话的所述特征信息之和，所述M为大于1且小于等于所述N的整数，所述a为大于等于1且小于等于所述M的整数，所述b为大于等于1且小于等于所述N的整数；根据所述M个坐标，在所述坐标系中获取洛伦兹曲线；根据所述洛伦兹曲线计算所述基尼系数。
在第一方面的第二种可能的实施方式中，所述统计结果为信息熵。所述获取统计结果，包括：根据所述N个会话中每个会话的特征信息，计算n类会话中的每一类会话在所述N个会话中的出现概率，所述N个会话中的每一个会话属于所述n类会话中的一类会话，所述n为大于等于1且小于等于所述N的整数；根据所述n类会话中每一类会话的所述出现概率计算所述信息熵。
在第一方面的第三种可能的实施方式中，所述统计结果为卷积，所述N个会话中每个会话的特征信息包括第一类特征信息和第二类特征信息，所述第一类特征信息是表示大小的数值，所述第二类特征信息是表示大小的数值。所述获取统计结果，包括：根据所述N个会话中每个会话的所述第一类特征信息，构建第一离散序列；根据所述N个会话中每个会话的所述第二类特征信息，构 建第二离散序列；计算所述第一离散序列和所述第二离散序列的所述卷积。
在第一方面的第四种可能的实施方式中，所述统计结果为向量和，所述N个会话中每个会话的特征信息包括p类特征信息，所述p为大于1的整数。所述获取统计结果，包括：构建N个向量，所述N个向量与所述N个会话一一对应，所述N个向量中的每个向量具有p个维度，所述p个维度与所述p类特征信息一一对应；计算所述N个向量的向量和。
在第一方面的第五种可能的实施方式中，所述统计结果为向量积，所述N个会话中每个会话的特征信息包括p类特征信息，所述p为大于1的整数。所述获取统计结果，包括：构建N个向量，所述N个向量与所述N个会话一一对应，所述N个向量中的每个向量具有p个维度，所述p个维度与所述p类特征信息一一对应；计算所述N个向量的向量积。
本申请实施例提供了多种统计方法，使得方案的灵活性和适用性更佳。
结合第一方面或者第一方面的任意一种可能的实施方式，在第一方面的第六种可能的实施方式中，所述特征信息包括：五元组信息、报文数信息、字节数信息、时间信息、生存周期(英文：Time To Live；缩写：TTL)信息、报文长度信息、地理信息或报文平均长度中的一种或多种。
通过上述方式，采集多种类型的特征信息，有助于从多个不同维度检测网络攻击，有助于提高网络攻击的检测精度。
结合第一方面或者第一方面的任意一种可能的实施方式，在第一方面的第七种可能的实施方式中，所述确定网络受到网络攻击之后，还包括：根据所述统计结果，确定所述网络攻击的来源；或者，根据所述统计结果，确定所述网络攻击的目标。
通过上述方式，进一步确定网络攻击的来源或者目标，对网络攻击的发起方进行准确定位，有助于对其进行及时有效的遏制；另外，对网络攻击的遭受方进行准确定位，有助于其针对网络攻击采取及时有效的应对策略。
第二方面，本发明实施例提供了一种检测网络攻击的设备。该设备包括至少一个单元，该至少一个单元用于实现上述第一方面或者第一方面的任意一种可能的实施方式所提供的方法。
第三方面，本发明实施例提供了一种检测网络攻击的设备。所述检测网络攻击的设备可以实施上述第一方面或第一方面的任一一种可能的实施方式所提供的方法。在一种可能的设计中，该设备包括处理器以及网络接口，处理器 用于执行以下操作：通过网络接口采集网络中的N个会话中每个会话的特征信息，N为大于1的整数；获取统计结果，该统计结果为以N个会话中的每个会话为一个采样单元，以特征信息为样本值，对N个会话的特征信息进行统计后得到的结果；如果统计结果和参考结果之间的差异超过预设条件，确定网络受到网络攻击。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本申请一个实施例提供的实施环境的示意图；
图2是本申请一个实施例提供的检测网络攻击的设备的框图；
图3是本申请一个实施例提供的检测网络攻击的方法的流程图；
图4A是本申请另一实施例提供的检测网络攻击的方法的流程图；
图4B是本申请另一实施例涉及的洛伦兹曲线的示意图；
图5是本申请另一实施例提供的检测网络攻击的方法的流程图；
图6是本申请另一实施例提供的检测网络攻击的方法的流程图；
图7是本申请另一实施例提供的检测网络攻击的方法的流程图；
图8是本申请另一实施例提供的检测网络攻击的方法的流程图；
图9是本申请另一实施例提供的检测网络攻击的设备的框图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施方式作进一步地详细描述。
在本文中提及的“模块”是可以由硬件实现，也可以由软硬件的结合实现，还可以由存储在存储器中的能够实现某些功能的程序或指令实现；在本文中提及的“单元”是指按照逻辑划分的功能性结构，该“单元”可以由纯硬件实现，或者由软硬件的结合实现。
在本文中提及的“若干个”是指一个或多个，“多个”是指两个或两个以上。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B， 可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。字符“/”一般表示前后关联对象是一种“或”的关系。
在对本申请实施例进行介绍之前，首先对本申请实施例中涉及的会话进行说明。
本申请中，会话(英文：session)指的是在一个不中断的特定操作时间内，两个设备之间的通信交互。在一个会话期间，两个设备之间相互传输的所有报文都属于该会话。
在“会话”的一种示例中，在第一设备和第二设备之间通信的报文是传输控制协议(英文：Transmission Control Protocol；缩写：TCP)报文的情况下，或者在第一设备和第二设备之间通信的报文是用户数据报协议(英文：User Datagram Protocol；缩写：UDP)报文的情况下，该TCP报文或UDP报文中携带五元组信息。同一个会话的多个报文的五元组信息相匹配。即，第一设备给第二设备发送的报文所携带的五元组信息中，源IP地址是第一设备的IP地址，源端口号是第一设备的端口号，目的IP地址是第二设备的IP地址，目的端口号是第二设备的端口号；第二设备给第一设备发送的报文所携带的五元组信息中，源IP地址是第二设备的IP地址，源端口号是第二设备的端口号，目的IP地址是第一设备的IP地址，目的端口号是第一设备的端口号；两个设备之间相互发送的报文所采用的传输层协议号都相同。这些报文都属于同一个TCP/UDP会话。
在“会话”的另一种示例中，在第一设备和第二设备之间通信的报文不是TCP报文或UDP报文的情况下，例如在第一设备和第二设备之间通信的报文是因特网控制消息协议(英文：Internet Control Message Protocol；缩写：ICMP)报文的情况下，也可以认为二元组信息相匹配的多个报文属于同一个会话的报文。即，第一设备给第二设备发送的报文所携带的二元组信息中，源IP地址是第一设备的IP地址，目的IP地址是第二设备的IP地址；第二设备给第一设备发送的报文所携带的二元组信息中，源IP地址是第二设备的IP地址，目的IP地址是第一设备的IP地址；两个设备之间相互发送的报文所采用的传输层协议号都相同。这些报文都属于同一个ICMP会话。
本申请中，对于会话的两个设备之间是否需要建立连接不作限定。一个会话可以是有明确的连接建立过程和连接断开过程。例如，TCP会话(英文：TCP session)过程中，两个设备的两个端口之间采用三次握手(英文：three-way  handshake)建立TCP连接，在会话完成时再通过四次挥手(英文：four-way handshake)断开TCP连接。一个会话也可以没有连接建立过程，例如两个设备的两个端口之间在一个连续的时间段内使用UDP进行通信。
对于有明确的连接建立过程和连接断开过程的会话，可将连接建立过程中的第一个报文作为会话的开始，将连接断开过程中的最后一个报文作为会话的终止。例如TCP会话的三次握手中第一次握手的报文作为会话的开始，TCP会话的四次挥手中第四次挥手的报文作为会话的终止。对于没有连接建立过程的会话，在两个设备间传输的某个报文之前的第一预设时长内，没有这两个设备间传输的报文，则认为该报文是该会话的第一个报文；在两个设备间传输某个报文之后，如果在第二预设时长内有下一个报文传输，则该下一个报文与之前传输的报文属于一个会话；如果在所述第二预设时长内未有下一个报文传输，则认为会话终止。
当然，本领域技术人员可以理解的是，如果报文是网络攻击报文，那么即使在报文所使用的协议是有明确的连接建立过程和断开过程的协议，例如TCP的情况下，一个会话依然可能没有完整的建立过程和终止过程，例如发起网络攻击的设备只进行三次握手之后不再发送任何报文，或者发起网络攻击的设备在发起第一握手之后不进行后续的应答，或者发起网络攻击的设备发送标识位与协议定义不符的畸形报文。这种情况下，对会话开始和终止的判断，可以采用与上述没有连接建立过程的会话的开始或终止相同的判断方法，或者针对常见的网络攻击报文的类型对判断会话的开始或终止的条件进行设定。
在本申请实施例中，采用会话随机抽样技术，按照预设的抽样规则，采集网络中的若干个会话中的报文，通过从采集的报文中提取每个会话的特征信息，并以会话为单位对这些会话的特征信息进行统计分析，检测网络攻击。需要说明的是，对于每一个会话，在提取该会话的特征信息时，所需采集的报文的数量依据所要提取的会话的特征信息而定。例如，当所要提取的会话的特征信息为五元组信息时，仅需采集每个会话的一个报文即可。再例如，当所要提取的会话的特征信息为报文数信息时，需要采集会话的所有报文。
下面，通过几个实施例对本申请提供的技术方案进行详细介绍和说明。
请参考图1，其示出了本申请一个实施例提供的实施环境的示意图，该实施环境可以是基于TCP/IP进行通信的网络系统。示例性地，如图1所示，该 实施环境包括：包括有若干台网络设备110的网络10，以及检测网络攻击的设备(以下简称“检测设备”)120。
举例来说，网络10可以是运营商网络，也可以是局域网。网络设备110可以是交换机，路由器，波分复用设备，分组传送网设备，光传送网设备，防火墙，或数据中心等。在本实施例中，对网络10中的若干台网络设备110的组网结构并不限定。例如，该组网结构可以是集中式组网结构、分布式组网结构，等等。
网络设备110在转发报文的过程中，按照预设的抽样规则进行会话抽样。即，网络设备110抽取若干个会话中的报文，获取该若干个会话中每个会话的特征信息。
举例来说，网络设备110抽取若干个会话中的报文，可以是在预设的时间段内，网络设备110每接收到一个报文，就镜像该报文，保存该镜像的报文用于获取该报文所属的会话的特征信息，并将原报文按照传输路径转发。本申请中，在没有特殊说明的情况下，在从报文中采集会话的特征信息均指从被镜像并保存的报文中采集会话的特征信息。
举例来说，网络设备110判断报文所属的会话，可以采用如下的方法进行。网络设备110获取报文中的五元组信息作为第一五元组信息。网络设备110判断会话信息表中是否存储了所述第一五元组信息，如果存储了所述第一五元组信息，则说明该报文与网络设备110此前接收的报文属于同一个会话，则网络设备110标识该报文所属的会话；如果所述会话信息表中没有存储所述第一五元组信息，则将该第一五元组信息中的源IP地址与目的IP地址互换，将该第一五元组信息中的源端口地址与目的端口地址互换，获得第二五元组信息，判断所述会话信息表中是否存储了所述第二五元组信息，如果所述会话信息表中存储了所述第二五元组信息，则同样说明该报文与网络设备110此前接收的报文属于同一个会话，网络设备110标识该报文所属的会话；如果所述会话信息表中既不存在所述第一五元组信息也不存在所述第二五元组信息，则说明网络设备110此前没有接收过属于该会话的报文，网络设备110在所述会话信息表中增加所述第一五元组信息或所述第二五元组信息。当然，所述第一五元组信息和所述第二五元组信息，也可以分别是所述第一五元组信息和所述第二五元组信息通过同一个哈希函数计算得到的第一哈希值和第二哈希值。通过上述步骤，网络设备110采集到了预设时间段内接收的报文，并且标识出了每个报文 所属的会话。
网络设备110上的会话的所述抽样规则可以是网络管理员在该网络设备110上配置的，也可以是检测设备120发送的。举例来说，所述抽样规则可以是预设时间段内抽取预设比例的会话。抽取所述会话后，网络设备110提取被抽取的会话中每个会话的特征信息，并发送给检测设备120。
检测设备120与网络10中的若干台网络设备110建立通信连接。具体来说，检测设备120与网络10中用于进行会话抽样的网络设备110建立通信连接。用于进行会话抽样的网络设备110，可以是网络10中的一个网络设备110，也可以是多个网络设备110。检测设备120接收网络设备110发送的会话特征信息。检测设备120用于对会话的特征信息进行统计分析，检测网络10是否受到网络攻击。
在一种实现方式中，检测设备120可以是一台独立的服务器。当然，在其它可能的实现方式中，检测设备120也可由网络10中的某一台网络设备110的软件或硬件模块实现。该检测设备200也可以是多个网络设备组成的集群。
请参考图2，其示出了本申请一个实施例提供的检测网络攻击的设备(以下简称“检测设备”)200的框图。该检测设备200可以包括：处理器210、存储器220、网络接口230以及总线240。存储器220和网络接口230通过总线240与处理器210相连。检测设备200用于检测网络是否受到网络攻击。结合参考图1所示实施环境，该检测设备200可以是图1中所示的检测设备120。该检测设备200可以是一台独立的服务器，也可以是网络中的一台网络设备上的软件或硬件模块，该检测设备200也可以是多个网络设备组成的集群。
处理器210包括一个或者一个以上处理核心。处理器210通过运行软件程序以及模块，从而执行各种功能应用以及数据处理。处理器210包括运算逻辑部件、寄存器部件以及控制部件等，处理器210可以是独立的中央处理器，或者也可以是嵌入式处理器，比如微处理器(英文：Micro Processor Unit；缩写：MPU)、微控制器(英文：Microcontroller Unit；缩写：MCU)或者数字信号处理器(英文：Embedded Digital Signal Processor；缩写：EDSP)等。
存储器220可以由任何类型的易失性或非易失性存储设备或者它们的组合实现，如静态随机存取存储器(英文：Static Random Access Memory；缩写：SRAM)，电可擦除可编程只读存储器(英文：Electrically Erasable Programmable  Read-Only Memory；缩写：EEPROM)，可擦除可编程只读存储器(英文：Erasable Programmable Read Only Memory；缩写：EPROM)，可编程只读存储器(英文：Programmable Read-Only Memory；缩写：PROM)，只读存储器(英文：Read Only Memory；缩写：ROM)，磁存储器，快闪存储器，磁盘或光盘。存储器220可用于存储软件程序以及模块等可执行的指令。
网络接口230可以是有线接口，例如光纤分布式数据接口(英文：Fiber Distributed Data Interface；简称：FDDI)、以太网(英文：Ethernet)接口。网络接口230也可以是无线接口，例如无线局域网接口。
处理器210被配置为执行存储器220中存储的指令。处理器210通过执行该指令来实现下述方法：采集网络中的N个会话中每个会话的特征信息，N为大于1的整数；获取统计结果，该统计结果为以N个会话中的每个会话为一个采样单元，以特征信息为样本值，对N个会话的特征信息进行统计后得到的结果；如果统计结果和参考结果之间的差异超过预设条件，确定网络受到网络攻击。
网络接口230用于对外通信，网络接口230可以包括多种类型接口。例如，网络接口230用于向网络中的网络设备发送对会话进行随机抽样的指令，从网络设备接收会话的特征信息，等等。
可选地，存储器220可存储操作系统222以及至少一个功能所需的应用程序模块224。操作系统222可以是实时操作系统(英文：Real Time eXecutive；缩写：RTX)、LINUX、UNIX、WINDOWS或OS X之类的操作系统。应用程序模块224可以包括：采集模块224a、获取模块224b和确定模块224c。其中，采集模块224a，用于采集网络中的N个会话中每个会话的特征信息，N为大于1的整数；获取模块224b，用于获取统计结果，该统计结果为以N个会话中的每个会话为一个采样单元，以特征信息为样本值，对N个会话的特征信息进行统计后得到的结果；确定模块224c，用于如果统计结果和参考结果之间的差异超过预设条件，确定网络受到网络攻击。
可选地，检测设备200还可以包括输入/输出组件(图中未示出)。输入/输出组件包括有用于显示信息的显示器和用于用户输入信息的诸如鼠标、键盘之类的输入设备。其中，显示器和输入设备与处理器210通信。
请参考图3，其示出了本申请一个实施例提供的一种检测网络攻击的方法 的流程图。例如，该方法可应用于图1所示实施环境中，图3的步骤执行主体可以是检测设备120或者图2所示的检测设备200。该方法可包括如下步骤。
S301，采集网络中的N个会话中每个会话的特征信息，N为大于1的整数。
具体来说，某个网络中的会话是指属于该会话的报文在该网络的设备中传输。参与所述会话的两个设备可以都是所述网络中的设备；也可以只有其中一个设备是所述网络中的设备；还可以参与所述会话的两个设备都不是所述网络中的设备，所述会话的报文在该网络的转发设备中被转发。
举例来说，会话的特征信息可以包括从会话所包括的报文中直接采集获取的特征信息，也可以包括对所述直接采集获取的特征信息进行加工处理后得到的特征信息。对于加工处理得到的特征信息，所述加工处理步骤可以是进行会话抽样的网络设备实施的，也可以是检测设备实施的。
其中，网络设备可以是图1所示实施环境中的网络中的网络设备110。例如，网络设备110接收到检测设备120下发的对会话进行随机抽样的指令之后，按照预设的抽样规则，采集网络中的若干个会话的报文，提取会话的特征信息，并发送给检测设备120。
举例来说，会话的特征信息可以包括一种或多种用于描述会话的特征的信息。
举例来说，会话的特征信息包括但不限于：五元组信息、会话的报文数信息、字节数信息、时间信息、TTL信息、报文长度信息、地理信息和报文平均长度中的一种或多种。五元组信息包括：目的IP地址、源IP地址、目的端口号、源端口号和协议号。报文数信息包括但不限于：上行报文数、下行报文数、上行分片(英文：fragment)报文数和下行分片报文数中的一种或多种。字节数信息包括但不限于：上行字节数和下行字节数中的一种或多种。时间信息包括但不限于：上行报文间隔时间、下行报文间隔时间和会话持续时间中的一种或多种。TTL信息包括但不限于：上行最大TTL、下行最大TTL、上行最小TTL和下行最小TTL中的一种或多种。报文长度信息包括但不限于：上行最大报文长度、下行最大报文长度、上行最小报文长度和下行最小报文长度中的一种或多种。地理信息包括源地理信息和目的地理信息中的一种或多种。地理信息可由IP地址转换得到，源IP地址的归属地即为源地理信息，目的IP地址的归属地即为目的地理信息。所述地理信息也可以根据IP地址从地理信息系统(英文：Geographic Information System；简称：GIS)查询获取。报文平均 长度可以包括上行报文平均长度和下行报文平均长度中的一种或多种。报文平均长度可根据采样得到的总字节数除以采样得到的总报文数得到。
举例来说，在所述会话为TCP会话的示例中，会话的特征信息包括但不限于：五元组信息、会话的报文数信息、字节数信息、时间信息、TTL信息、报文长度信息、地理信息、报文平均长度、TCP会话的健康状态或乱序报文的统计结果中的一种或多种。其中，报文数信息可以包括上行报文数、下行报文数、上行分片报文数、下行分片报文数、TCP会话的同步(英文：synchronize；简称：syn)报文数、TCP会话的结束(英文：finish；简称：fin)报文数、TCP会话的确认(英文：acknowledge；简称：ack)报文数、TCP会话的复位(英文：reset；简称：rst)报文数、TCP会话的紧急(英文：urgent；简称：urg)报文数和TCP会话的推送(英文：push；简称：psh)报文数中的一种或多种。时间信息可以包括上行报文间隔时间、下行报文间隔时间、会话持续时间、TCP会话的服务器响应时间和TCP会话的客户端响应时间中的一种或多种。TCP会话的健康状态包括与TCP会话的服务质量(英文：Quality of Service；缩写：QoS)性能相关的信息，如TCP连接是否成功建立、丢包数、延迟，等等中的一种或多种。乱序报文的统计结果是指对一个会话中在后发送的报文比在先发送的报文更早到达目标设备的情况的统计结果。
需要说明的是，对于进行某个会话的一台设备而言，上行报文是指发送至该设备的报文，下行报文是指从该设备发出的报文。对于获取会话的特征信息的网络设备110而言，上行和下行可以是网络设备110定义的。例如，第一设备和第二设备进行会话，上行报文可以是由所述第一设备发送给所述第二设备的，下行报文可以是由所述第二设备发送给所述第一设备的；当然，上行报文也可以是由所述第二设备发送给所述第一设备的，下行报文可以是由所述第一设备发送给所述第二设备的。
需要说明的是，由于会话中的报文是双向的，例如包括上行报文和下行报文，因此本申请中会话的特征信息中，五元组信息、源地址、目的地址、源地理信息或目的地理信息，均指会话中双向报文中某一个方向传输的报文的五元组信息、源地址、目的地址、源地理信息或目的地理信息。
S302，获取统计结果，所述统计结果为以所述N个会话中的每个会话为一个采样单元(英文：sampling unit)，以所述特征信息为样本(英文：sample)值，对所述N个会话的所述特征信息进行统计后得到的结果。
具体来说，所述统计结果是根据特定的统计方法，对每个采样单元的样本值进行统计获得的结果。具体来说，以每个会话为一个采样单元是指，一个会话是统计的最小单位。以所述特征信息为样本值是指，每一个特征信息都是某个会话的特征信息，所述统计结果反映的是所述特征信息的相关特性。
例如，当特征信息为报文平均长度时，统计结果用于反映各个会话的报文平均长度的分布特征，如各个会话的报文平均长度是否接近。再例如，当特征信息为目的地理信息时，统计结果用于反映各个会话的目的地理信息的分布特征，如各个会话的目的地理信息所指向的地理位置的分布。举例来说，所述统计结果可以是基尼系数(英文：Gini coefficient)、信息熵、卷积、向量和或向量积中的任意一种。对于上述列举的各种统计结果，以及获取上述各种统计结果的统计方法，在下文将分别进行详细介绍和说明。
当然，本领域技术人员可以理解的是，所述统计结果可以是对每个会话的一类特征信息进行统计获得的结果，也可以是对每个会话的多类特征信息进行统计获得的结果。例如，在下文的统计结果是基尼系数、特征信息是会话的报文平均长度的示例中，所述基尼系数是基于会话的报文平均长度这一类特征信息进行统计获取的结果。又例如，在下文的统计结果是向量和、第一类特征信息是会话的上行报文数、第二类特征信息是会话的下行报文数的示例中，所述向量和是基于会话的上行报文数以及下行报文数这两类特征信息进行统计获取的结果。
S303，如果统计结果和参考结果之间的差异超过预设条件，确定网络受到网络攻击。
举例来说，如果统计结果和参考结果之间的差异超过预设条件，检测设备确定网络受到网络攻击。其中，统计结果和参考结果的类型相同。
在一种示例中，统计结果和参考结果均为一个表示大小的数值，则所述预设的条件可以是预设值。在另一种示例中，统计结果和参考结果不是表示大小的数值，则所述预设条件可以是其他反映两个结果差异的条件，例如统计结果和参考结果分别是一个多维向量，所述预设的条件是：统计结果的向量长度与参考结果的向量长度之差不超过第一预设值，并且统计结果的向量角度与参考结果的向量角度之差不超过第二预设值。
参考结果是在网络未受到网络攻击的情况下会话的特征信息的统计结果。可选地，通过如下方式获取参考结果：在多个不同的时间，采用S301和S302 获取多个统计结果，如果所述多个统计结果彼此之间的差异均在一定的范围内，则将这些统计结果的平均值作为所述参考结果。
可选地，在确定网络受到网络攻击的情况下，检测设备还根据所述统计结果确定网络攻击的来源，或者根据所述统计结果确定网络攻击的目标。例如，网络攻击的来源可包括：发起网络攻击的设备的IP地址、发起网络攻击的设备的端口号、发起网络攻击的设备所在的地理位置中的一个或多个；网络攻击的目标可包括：受到网络攻击的设备的IP地址、受到网络攻击的设备的端口号、受到网络攻击的设备的地理位置中的一个或多个。
举例来说，获取对所述统计结果与所述参考结果的差异起主要作用的会话，分析参与这些会话的设备的信息，从而确定网络攻击的来源或目标。例如，在下文关于统计结果是基尼系数的示例中，假设会话的特征信息是报文平均长度，某类网络攻击的报文的长度均相同，例如均为第一长度，则该网络攻击的会话的报文平均长度也约等于所述第一长度。即此类网络攻击的会话的报文平均长度与所述第一长度之差小于预设值。大量此类网络攻击的会话导致会话的报文平均长度比正常情况下分布更均衡，因此统计结果的基尼系数显著小于参考结果的基尼系数。检测设备获取报文平均长度与所述第一长度之差小于预设值的会话，分析参与这些会话的设备的地理信息。假设检测设备确定这些会话中，会话的发起方的IP地址在第一子网网段的概率较大，例如会话的发起方的IP地址在所述第一子网网段的会话数量占这些会话的总数的80％，即可确定发起网络攻击的设备是所述第一IP子网网段的设备。
综上所述，本实施例提供的方法，通过采集网络中的多个会话中每个会话的特征信息，获取统计结果，并在统计结果和参考结果之间的差异超过预设条件的情况下，确定网络受到网络攻击。通过会话随机抽样，并以会话为单位对会话的特征信息进行统计分析，可以有效检测出一些传统的报文随机抽样难以检测出的会话类网络攻击。会话类网络攻击存在如下特点：发起网络攻击的设备通过发起大量会话，占用目标设备的资源。由于发起一个会话只需要少量的报文，但是对设备的资源占用很多，因此在网络攻击报文的数量不大的情况下，就可以对目标设备造成较大的损害。若以报文为抽样单位，由于符合上述会话类网络攻击特性的网络攻击报文在数据流量中占比很小，导致此类网络攻击报文很难被采集；而本申请中以会话为抽样单位，无论是只有一个会话建立请求的网络攻击报文，还是包括数据流量较大的正常会话，在抽样统计中都作为一 个会话来进行统计，因此有较大概率识别出所述会话类网络攻击。
此外，由于会话随机抽样技术能够很好地还原会话的特征，如会话的IP地址分布特征、地域分布特征等，达到了有效检测IP分布异常和地域分布异常的技术效果。
参考如下表-1，其示例性地示出了几种统计方法，以及每一种统计方法适用的特征信息(打√表示适用)。
Figure PCTCN2016081503-appb-000001
Figure PCTCN2016081503-appb-000002
表-1
需要说明的是，在上述表-1中，仅是示例性地列举了会话的几种特征信息，在实际应用中，会话的特征信息还可包括报文平均长度、源地理信息到目的地理信息的经纬度距离、源地理信息到目的地理信息的地表距离，等等。因此，每一种统计方法的适用范围包括但不限于上述表-1所提供的特征信息。
下面，针对上文列举的几种统计方法，分别进行介绍和说明。
在基于图3所示实施例提供的一个可选实施例中，所述特征信息是表示大小的数值，统计方法为基尼系数统计方法，统计结果为基尼系数。
基尼系数是1943年美国经济学家阿尔伯特·赫希曼根据洛伦兹曲线(英文：Lorenz curve)所定义的判断收入分配公平程度的指标。基尼系数是一个比例值，其取值范围在0和1之间。在本实施例中，采用基尼系数来反映各个会话的特征信息的取值的分布平均程度。在本实施例中，将基尼系数作为网络攻击分析的特征参考，当基尼系数相较于参考结果发生较大幅度变化时，可判断网络存在异常，作为确认网络受到网络攻击的有效判据之一。在本实施例中，参考结果是在网络未受到网络攻击的情况下，采用下述步骤计算得到的基尼系数。
如图4A所示，图3所示的S302可以具体包括：
S401，按N个会话中每个会话的特征信息从小到大的顺序，对所述N个会话排序；
S402，从所述N个会话中选择M个会话，在坐标系中获取M个坐标，所述M个坐标与所述M个会话一一对应，所述M个会话中的第a个坐标对应于所述排序后的N个会话中的第b个会话，所述第a个坐标为(b/N,w/W)，其中，所述w为所述N个会话中特征信息的值最小的b个会话的所述特征信息之和，所述W为所述N个会话的所述特征信息之和，所述M为大于1且小于等于所述N的整数，所述a为大于等于1且小于等于所述M的整数，所述b为大于等于1且小于等于所述N的整数；
S403，根据所述M个坐标，在所述坐标系中获取洛伦兹曲线；
S404，根据所述洛伦兹曲线计算基尼系数。
结合参考图4B，横轴表示会话比例，纵轴表示会话比例对应的特征信息比例的累积分布值。具体来说，假设N个会话中特征信息的取值最小的b个会话的特征信息的取值之和为w，全部N个会话中所有会话的特征信息的取值之和为W，则步骤401排序后的N个会话中，第b个会话对应的坐标为
Figure PCTCN2016081503-appb-000003
也即上述M个坐标中的第a个坐标为
Figure PCTCN2016081503-appb-000004
如图4B所示。
举例来说，按照S402中的方法获取的所述M个坐标，在坐标系中构建洛伦兹曲线。如图4B所示，连接坐标(0，0)和坐标(1，1)的直线与洛伦兹曲线围合而成的非阴影部分区域的面积为A，所述洛伦兹曲线与坐标轴围合而成的阴影部分区域的面积为B，
Figure PCTCN2016081503-appb-000005
用此定义，在N个会话中每个会话的特征信息的取值均相等的情况下，基尼系数为0；在1个会话的特征信息的取值为W，而其它各个会话的特征信息的取值均为0的情况下，基尼系数为1。由上述定义可以确定：基尼系数越大，表示N个会话中每个会话的特征信息的取值的分布越不平均；反之，基尼系数越小，表示N个会话中每个会话的特征信息的取值的分布越平均。
下面，通过几个示意性例子对基尼系数统计方法进行举例说明。
1、会话的特征信息为上行报文平均长度。
以会话比例为横轴，上行报文平均长度比例的累积分布值为纵轴，构建洛伦兹曲线，根据洛伦兹曲线计算基尼系数。示例性地，假设N＝10，该10个会话的上行报文平均长度从小到大依次为：4、4、6、8、8、8、10、12、16、24。例如，选择M＝5，即从上述10个会话中选择5个会话。选择的5个会话分别是排序后的第2个会话、排序后的第4个会话、排序后的第6个会话、排序后的第8个会话以及排序后的第10个会话。则步骤401中获取的M个坐标分别是(20％，8％)、(40％，22％)、(60％，38％)、(80％，60％)和(100％，100％)，依次连接上述各个坐标得到洛伦兹曲线，而后便可根据洛伦兹曲线计算基尼系数。
在此示意性例子中，基尼系数反映了各个会话的上行报文平均长度的分布平均程度。当网络在目标时段内受到报文长度固定的会话类网络攻击时，基尼系数相较于参考结果会有较大差异，例如基尼系数显著小于参考结果。因此，根据基尼系数相较于参考结果的变化程度，即可检测出是否存在网络攻击。
2、会话的特征信息为TCP会话中的syn报文数。
以会话比例为横轴，syn报文数比例的累积分布值为纵轴，构建洛伦兹曲线，根据洛伦兹曲线计算基尼系数。在此示意性例子中，基尼系数反映了各个TCP会话中的syn报文数的分布平均程度。syn报文是采用三次握手建立TCP连接时客户端向服务器发送的报文，syn报文数通常较少且数量较为稳定。当网络在目标时段内受到syn报文数量多于正常值的会话类网络攻击时，则包括正常的会话和网络攻击的会话在内的N个会话中，syn报文的数量分布与参考结果相比会变得更不平均，此时基尼系数大于参考结果，并且所述基尼系数与参考结果之差大于预设值。例如，正常会话在TCP三次握手的过程中会出现两个syn报文，而上述会话类网络攻击在一个会话中syn报文的数量超过两个。因此，根据基尼系数相较于参考结果的差异程度，即可检测出是否存在网络攻击。
3、会话的特征信息为源设备和目的设备之间的地表距离。
以会话比例为横轴，源设备和目的设备之间的地表距离比例的累积分布值为纵轴，构建洛伦兹曲线，根据洛伦兹曲线计算基尼系数。其中，源设备和目的设备之间的地表距离可根据源地理信息和目的地理信息确定。在此示意性例子中，基尼系数反映了各个会话对应的地表距离的分布平均程度。当网络在目标时段内受到从某一源设备到某一目的设备的会话类网络攻击时，N个会话中地表距离相同的会话的数量与参考结果相比增多，地表距离的分布与参考结果相比会变得更为平均，基尼系数小于参考结果，且基尼系数与参考结果之差大于预设值。因此，根据基尼系数相较于参考结果的差异程度，即可检测出是否存在网络攻击。
当然，上述例子仅是示意性和解释性的，除上述例子中涉及的特征信息之外，基尼系数统计方法还可适用于统计分析其它多种特征信息。
在基于图3所示实施例提供的另一可选实施例中，统计方法为信息熵统计方法，统计结果为信息熵。相应地，如图5所示，S302可以包括：
S501，根据N个会话中每个会话的特征信息，计算n类会话中的每一类会话在N个会话中的出现概率，所述N个会话中每一个会话属于所述n类会话中的一类会话，n为大于1且小于等于N的整数；
S502，根据所述n类会话中每一类会话的出现概率计算信息熵。
信息熵是用于衡量一段信息所含的信息量的指标。信息熵在数学上是一个 较为抽象的概念，可将信息熵理解为某种特定信息的出现概率。信息熵的计算公式如下：
Figure PCTCN2016081503-appb-000006
其中，H表示信息熵。n表示元素的取值种数，即本实施例中会话种类的数量。pi表示第i种取值的元素的出现概率，1≤i≤n且i、n均为整数，即本实施例中第i类会话出现的概率。信息熵越大，表示各元素的出现概率越均等；反之，信息熵越小，表示各元素的出现概率越不均等。
在本实施例中，属于同一类会话的多个会话的特征信息相同或者属于同一分类标准。所述N个会话中的每一个会话属于n类会话中的某一类会话，并且不属于其他n-1类会话。例如，会话的特征信息为该会话中上行报文的源IP地址，所述N个会话中上行报文的源IP地址有n种不同的取值，上行报文的源IP地址相同的会话属于一类会话。再例如，会话的特征信息为上行报文的源IP地址，所述N个会话中的上行报文的源IP地址所属的子网网段有n种不同的取值，上行报文的源IP地址属于同一子网网段的会话属于一类会话。
在本实施例中，将信息熵作为网络攻击，当信息熵相较于参考结果的差异较大时，可确定网络存在异常，作为确认网络受到网络攻击的有效判据之一。在本实施例中，参考结果是在网络未受到网络攻击的情况下，采用上述步骤计算得到的信息熵。
下面，通过几个示意性例子对信息熵统计方法进行举例说明。
1、会话的特征信息为上行报文的源IP地址，上行报文的源IP地址相同的会话属于同一类会话。
示例性地，假设N＝10，该10个会话的上行报文的的源IP地址依次为：IP地址1、IP地址2、IP地址3、IP地址1、IP地址1、IP地址1、IP地址4、IP地址4、IP地址2、IP地址1。则n＝4，即上述10个会话可分为4类，上行报文的源IP地址为IP地址1的一类会话的出现概率为0.5、上行报文的源IP地址为IP地址2的一类会话的出现概率为0.2、上行报文的源IP地址为IP地址3的一类会话的出现概率为0.1、上行报文的源IP地址为IP地址4的一类会话的出现概率为0.2。将会话的分类数量和每一类会话的出现概率代入公式(1)计算信息熵。
在此示意性例子中，信息熵反映了上行报文的源IP地址相同的各类会话 的出现概率的均等程度。例如，信息熵越大，说明上述4类会话的出现概率越平均；信息熵越小，说明上述4类会话的出现概率越不平均。举例来说，当网络未受到攻击时，上行报文的源IP地址是上述4个源IP地址的会话出现的概率是均等的，当网络在目标时段内受到来自IP地址1的设备发起的网络攻击时，上行报文的源IP地址为IP地址1的会话比例高于其它几类会话，则此时信息熵小于参考结果。因此，根据信息熵相较于参考结果的差异，即可检测出是否存在网络攻击。例如，信息熵小于参考结果，并且参考结果与所述信息熵之差大于预设值时，确定存在网络攻击。在此示意性例子中，参考结果是在网络未受到网络攻击的情况下，根据采集的多个会话的上行报文的源IP地址计算得到的信息熵。
可选地，在确定网络受到网络攻击的情况下，可提取出现概率相较于正常值显著增大的上行报文的源IP地址，进一步分析确定发起网络攻击的IP地址。
2、会话的特征信息为上行报文的源IP地址，上行报文的源IP地址属于同一子网网段的会话属于同一类会话。
示例性地，仍然以上述10个会话的上行报文的源IP地址为例，假设IP地址1和IP地址2属于同一子网网段，记为子网网段1，IP地址3和IP地址4属于同一子网网段，记为子网网段2。则上述10个会话可分为2类，上行报文的源IP地址属于子网网段1的一类会话的出现概率为0.7、上行报文的源IP地址属于子网网段2的一类会话的出现概率为0.3。将会话的分类数量和每一类会话的出现概率代入公式(1)计算信息熵。
在此示意性例子中，信息熵反映了上行报文的源IP地址属于同一子网网段的各类会话的出现概率的均等程度。当网络在目标时段内受到来自某一子网网段的会话类网络攻击时，该子网网段所对应的一类会话的出现概率远远大于其它几类会话，此时信息熵显著小于参考结果。因此，根据信息熵相较于参结果的差异，即可检测出是否存在网络攻击。在此示意性例子中，参考结果是在网络未受到网络攻击的情况下，根据采集的多个会话的上行报文的源IP地址计算得到的信息熵。可选地，在确定网络受到网络攻击的情况下，可提取出现概率相较于正常值显著增大的子网网段，进一步分析确定发起网络攻击的子网网段。
3、会话的特征信息为上行报文数，上行报文数属于同一取值区间的会话属于同一类会话。
示例性地，所述n＝3，即将N个会话依据上行报文数这一特征信息将N个会话分为3类：(a)上行报文数大于等于1且小于等于2，(b)上行报文数大于等于3且小于等于10，(c)上行报文数大于10。假设N＝10，该10个会话的上行报文数依次为：1、1、1、4、6、1、1、6、12、1。则上行报文数属于上述第(a)种取值区间的一类会话的出现概率为0.6，上行报文数属于上述第(b)种取值区间的一类会话的出现概率为0.3，上行报文数属于上述第(c)种取值区间的一类会话的出现概率为0.1。将会话的分类数量和每一类会话的出现概率代入公式(1)计算信息熵。
在此示意性例子中，信息熵反映了上行报文数属于各个不同取值区间的各类会话的出现概率的均等程度。当网络在目标时段内受到大量空会话的会话类网络攻击时，例如网络攻击会话中仅包括用于请求建立会话的报文，而不包括用于传输数据的报文，则第(a)种取值区间的一类会话的出现概率远远大于其它几类会话，此时信息熵显著小于参考结果。因此，根据信息熵相较于参考结果的差异，即可检测出是否存在网络攻击。
当然，上述例子仅是示意性和解释性的，除上述例子中涉及的特征信息之外，信息熵统计方法还可适用于统计分析其它多种特征信息。
在基于图3所示实施例提供的另一可选实施例中，统计方法为卷积统计方法，统计结果为卷积。所示N个会话中每个会话的特征信息包括第一类特征信息和第二类特征信息，所述第一类特征信息是表示大小的数值，所述第二类特征信息是表示大小的数值。相应地，如图6所示，S302可以包括：
S601，根据N个会话中每个会话的第一类特征信息，构建第一离散序列；
S602，根据N个会话中每个会话的第二类特征信息，构建第二离散序列；
S603，计算所述第一离散序列和所述第二离散序列的卷积。
此外，在本实施例中，对S601和S602的执行先后顺序不做限定，S601可以在S602之前执行，也可在S602之后执行，或者和S602同时执行。在图6中，仅以S601在S602之前执行为例，但并不对本申请构成限定。
卷积是两个变量在某范围内相乘后求和的结果。在本实施例中，两个变量均为离散变量，相应地卷积为离散卷积。卷积的计算公式如下：
Figure PCTCN2016081503-appb-000007
其中，*表示卷积运算，x(n)和h(n)分别对应第一离散序列和第二离散序列，y(n)是经过卷积运算后得到的离散序列。其中，第一离散序列x(n)是N个会话中每个会话的第一类特征信息构成的序列，第一离散序列x(n)中的第i个元素表示第i个会话的第一类特征信息；第二离散序列h(n)是N个会话中每个会话的第二类特征信息构成的序列，第二离散序列x(n)中的第i个元素表示第i个会话的第二类特征信息。卷积运算结果y(n)体现了第一类特征信息与第二类特征信息之间的关联关系。上述第一类特征信息和第二类特征信息均以一个指示大小的数值表示。
在本实施例中，将卷积作为网络攻击分析的特征参考，当卷积相较于参考结果发生较大幅度变化时，可判断网络存在异常，作为确认网络受到网络攻击的有效判据之一。在本实施例中，参考结果是在网络未受到网络攻击的情况下，采用上述步骤计算得到的信息熵。
下面，通过几个示意性例子对卷积统计方法进行举例说明。
1、第一类特征信息为会话的起始时刻，第二类特征信息为会话持续时间。
举例来说，可以通过将参考时刻设置为0，将会话的起始时刻表示为与参考时刻的时间间隔，将会话的起始时刻转换为指示大小的数值。例如参考时刻为0，参考时刻为11时20分，起始时刻在参考时刻之后15秒，则起始时刻为15。会话的起始时刻，可以是获取会话特征信息的网络设备接收到会话中第一个报文的时刻，也可以是会话的第一个报文中的时间戳信息，本申请不作限定。会话持续时间是指从会话的起始时刻至终止时刻所经过的时长。根据N个会话中每个会话的起始时刻构建第一离散序列x(n)，第一离散序列x(n)中的第i个元素表示第i个会话的起始时刻；根据N个会话中每个会话的会话持续时间构建第二离散序列h(n)，第二离散序列h(n)中的第i个元素表示第i个会话的会话持续时间。按照公式(2)，计算第一离散序列x(n)和第二离散序列h(n)的卷积。
在此示意性例子中，卷积用于反映会话持续时间在时域上的概率密度分布，体现了N个会话的会话持续时间在时域上的分布特性。当网络在目标时段内受到大量的会话持续时间很短的会话类网络攻击时，会话持续时间很短的会话在时域上的分布密度与参考结果相比会显著增大。例如，持续时间很短的会话，可以是只包含一到两个报文的会话。例如网络攻击的方式是只发起会话建立请求，不再进行回应。那么该会话在受攻击设备发送回应报文之后就结束了。而正常的会话有完整的建立过程，以及数据的交互，因此会话持续时间长于此类 网络攻击的会话。因此，根据卷积计算结果和参考结果之间的差异，即可检测出是否存在网络攻击。
2、每个会话的第一类特征信息为会话持续时间，第二类特征信息为报文平均长度。
根据N个会话中每个会话的会话持续时间构建第一离散序列x(n)，第一离散序列x(n)中的第i个元素表示第i个会话的会话持续时间；根据N个会话中每个会话的报文平均长度构建第二离散序列h(n)，第二离散序列h(n)中的第i个元素表示第i个会话的报文平均长度。按照公式(2)，计算第一离散序列x(n)和第二离散序列h(n)的卷积。
当网络在目标时段内受到大量的会话持续时间很短且报文平均长度较小的会话类网络攻击时，如同步洪水攻击，卷积计算结果相较于参考结果有显著差异。因此，根据卷积计算结果和参考结果之间的差异，即可检测出是否存在网络攻击。
3、每个会话的第一类特征信息为会话的起始时刻，第二类特征信息为上行最小报文长度。
根据N个会话中每个会话的起始时刻构建第一离散序列x(n)，第一离散序列x(n)中的第i个元素表示第i个会话的起始时刻；根据N个会话中每个会话的上行最小报文长度构建第二离散序列h(n)，第二离散序列h(n)中的第i个元素表示第i个会话的上行最小报文长度。按照公式(2)，计算第一离散序列x(n)和第二离散序列h(n)的卷积。
在此示意性例子中，卷积用于反映上行最小报文长度在时域上的概率密度分布。当网络在目标时段内受到报文长度很短的大量会话的会话类网络攻击时，统计结果与参考结果相比会大，且统计结果与参考结果之差大于预设值。因此，根据卷积计算结果和参考结果之间的差异，即可检测出是否存在网络攻击。
当然，上述例子仅是示意性和解释性的，除上述例子中涉及的特征信息之外，卷积统计方法还可适用于统计分析其它多种特征信息。
在基于图3所示实施例提供的另一可选实施例中，统计方法为向量和统计方法，统计结果为向量和，所述N个会话中每个会话的特征信息包括p类特征信息，所述p为大于1的整数。相应地，如图7所示，S302包括：
S701，构建N个向量，所述N个向量与所述N个会话一一对应，所述N 个向量中的每个向量具有p个维度，所述p个维度与所述p类特征信息一一对应；
S702，计算N个向量的向量和。
具体来说，向量的某个维度与会话的某个特征信息对应，可以是指所述某个维度的取值与所述某个特征信息的取值相等，也可以是指所述某个维度的取值与所述某个特征信息成固定的比例。
例如，向量的第一维度的取值与会话的上行报文数对应，向量的第二维度的取值与会话的下行报文数对应。再例如，向量的第一维度的取值与会话的上行报文的目的地理信息的经度对应，向量的第二维度的取值与会话的上行报文的目的地理信息的纬度对应。
在本实施例中，将向量和作为网络攻击分析的特征参考，当向量和相较于参考结果发生较大幅度变化时，可判断网络存在异常，作为确认网络受到网络攻击的有效判据之一。在本实施例中，参考结果是在网络未受到网络攻击的情况下，采用上述步骤计算得到的向量和。例如，当向量和的大小相较于参考结果的大小发生大幅变化，且向量和的方向与参考结果的方向之间的夹角θ大于一定值时，确认存在网络攻击。
下面，通过几个示意性例子对向量和统计方法进行举例说明。
1、每个会话的特征信息包括上行报文的目的地理信息的经度和上行报文的目的地理信息的纬度。
以每一个会话的上行报文的目的地理信息的经纬度坐标，构建每一个会话对应的特征向量，并计算各个会话对应的特征向量的向量和。其中，每一个会话对应的特征向量为二维特征向量，特征向量的两个维度分别对应上行报文的目的地理信息的经度和纬度。
当网络在目标时段内受到针对某一地域的会话类网络攻击时，向量和相较于参考结果差异大于预设条件，例如统计结果与参考结果的向量长度和/或上述夹角θ大于预设值。因此，根据向量和相较于参考结果的差异，即可检测出是否存在网络攻击。
可选地，在确认存在网络攻击的情况下，可提取引起向量和发生上述显著变化的上行报文的目的地理信息，进一步分析确定受到网络攻击的地域。
2、每个会话的特征信息包括上行报文数和下行报文数。
以每一个会话的上行报文数和下行报文数构建每一个会话对应的特征向 量，并计算各个会话对应的特征向量的向量和。其中，每一个会话对应的特征向量为二维特征向量，特征向量的两个维度分别对应上行报文数和下行报文数。
当网络在目标时段内受到具有大量上行报文的会话类网络攻击时，由于上行报文数与正常情况相比显著增加，使得统计结果与参考结果的差异大于预设条件。因此，根据向量和相较于参考结果的差异，即可检测出是否存在网络攻击。
3、每个会话的特征信息包括上行字节数和下行字节数。
以每一个会话的上行字节数和下行字节数构建每一个会话对应的特征向量，并计算各个会话对应的特征向量的向量和。其中，每一个会话对应的特征向量为二维特征向量，特征向量的两个维度分别对应上行字节数和下行字节数。
当网络在目标时段内受到具有大量字节的会话类网络攻击时，由于上行字节数显著增加，使得统计结果与参考结果的差异大于预设条件。因此，根据向量和相较于参考结果的差异，即可检测出是否存在网络攻击。
当然，上述例子仅是示意性和解释性的，除上述例子中涉及的特征信息之外，向量和统计方法还可适用于统计分析其它多种特征信息。
在基于图3所示实施例提供的另一可选实施例中，统计方法为向量积统计方法，统计结果为向量积。所述N个会话中每个会话的特征信息包括p类特征信息，所述p为大于1的整数。相应地，如图7所示，S302包括：
S801，构建N个向量，所述N个向量与所述N个会话一一对应，所述N个向量中的每个向量具有p个维度，所述p个维度与所述p类特征信息一一对应；
S802，计算N个向量的向量积。
在本实施例中，将向量积作为网络攻击分析的特征参考，当向量积相较于参考结果发生较大幅度变化时，可判断网络存在异常，作为确认网络受到网络攻击的有效判据之一。在本实施例中，参考结果是在网络未受到网络攻击的情况下，采用上述步骤计算得到的向量积。例如，统计结果与参考结果大于预设条件时，，确认存在网络攻击。此外，采用向量积统计方法的示意性例子可参考上述采用向量和统计方法的示意性例子，此处不再赘述。
在本申请实施例中，提供了多种统计方法。在实际应用中，可采用上述任意一种或多种的组合，对会话类网络攻击进行分析检测。
下述为本申请设备实施例，可以用于执行本申请方法实施例。对于本申请设备实施例中未披露的细节，请参照本申请方法实施例。
请参考图9，其示出了本申请另一实施例提供的检测网络攻击的设备的框图。该设备可以包括：采集单元910、获取单元920和确定单元930。
采集单元910，用于采集网络中的N个会话中每个会话的特征信息，N为大于1的整数。
获取单元920，用于获取统计结果，并将统计结果发送给确定单元930；所述统计结果为以所述采集单元910采集的N个会话中的每个会话为一个采样单元，以所述特征信息为样本值，对所述N个会话的所述特征信息进行统计后得到的结果。
确定单元930，用于在从获取单元920接收的统计结果和参考结果之间的差异超过预设条件的情况下，确定网络受到网络攻击。
综上所述，本实施例提供的设备，通过采集网络中的多个会话中每个会话的特征信息，获取统计结果，并在统计结果和参考结果之间的差异超过预设条件的情况下，确定网络受到网络攻击。通过会话随机抽样，并以会话为单位对会话的特征信息进行统计分析，可以有效检测出一些传统的报文随机抽样难以检测出的会话类网络攻击。会话类网络攻击存在如下特点：发起网络攻击的设备通过发起大量会话，占用目标设备的资源。由于发起一个会话只需要少量的报文，但是对设备的资源占用很多，因此在网络攻击报文的数量不大的情况下，就可以对目标设备造成较大的损害。若以报文为抽样单位，由于符合上述会话类网络攻击特性的网络攻击报文在数据流量中占比很小，导致此类网络攻击报文很难被采集；而本申请中以会话为抽样单位，无论是只有一个会话建立请求的网络攻击报文，还是包括数据流量较大的正常会话，在抽样统计中都作为一个会话来进行统计，因此有较大概率识别出所述会话类网络攻击。
在基于图9所示实施例提供的一个可选实施例中，所述特征信息是表示大小的数值，所述统计结果为基尼系数。所述获取单元920，具体用于：按采集单元910采集的所述N个会话中每个会话的特征信息从小到大的顺序，对所述N个会话排序；从所述N个会话中选择M个会话，在坐标系中获取M个坐标，所述M个坐标与所述M个会话一一对应，所述M个会话中的第a个坐标对应于所述N个会话中的第b个会话，所述第a个坐标为(b/N,w/W)，其中，所述 w为所述N个会话中特征信息最小的b个会话的所述特征信息之和，所述W为所述N个会话的所述特征信息之和，所述M为大于1且小于等于所述N的整数，所述a为大于等于1且小于等于所述M的整数，所述b为大于等于1且小于等于所述N的整数；根据所述M个坐标，在所述坐标系中获取洛伦兹曲线；根据所述洛伦兹曲线计算所述基尼系数。
在基于图9所示实施例提供的另一可选实施例中，所述统计结果为信息熵。所述获取单元920，具体用于：根据采集单元910采集的N个会话中每个会话的特征信息，计算n类会话中的每一类会话在N个会话中的出现概率，所述N个会话中的每一个会话属于所述n类会话中的一类会话，n为大于1且小于等于N的整数；根据所述n类会话中每一类会话的出现概率计算所述信息熵。
在基于图9所示实施例提供的另一可选实施例中，所述统计结果为卷积，所述N个会话中每个会话的特征信息包括第一类特征信息和第二类特征信息，所述第一类特征信息是表示大小的数值，所述第二类特征信息是表示大小的数值。所述获取单元920，具体用于：根据采集单元910采集的N个会话中每个会话的第一类特征信息，构建第一离散序列；根据采集单元910采集的N个会话中每个会话的第二类特征信息，构建第二离散序列；计算第一离散序列和第二离散序列的卷积。
在基于图9所示实施例提供的另一可选实施例中，所述统计结果为向量和，所述N个会话中每个会话的特征信息包括p类特征信息，所述p为大于1的整数。所述获取单元920，具体用于：构建N个向量，所述N个向量与所述N个会话一一对应，所述N个向量中的每个向量具有p个维度，所述p个维度与所述p类特征信息一一对应；计算所述N个向量的向量和。
在基于图9所示实施例提供的另一可选实施例中，所述统计结果为向量积，所述N个会话中每个会话的特征信息包括p类特征信息，所述p为大于1的整数。所述获取单元920，具体用于：构建N个向量，所述N个向量与所述N个会话一一对应，所述N个向量中的每个向量具有p个维度，所述p个维度与所述p类特征信息一一对应；计算所述N个向量的向量积。
可选地，所述特征信息包括：五元组信息、报文数信息、字节数信息、时间信息、TTL信息、报文长度信息、地理信息或报文平均长度中的一种或多种。
可选地，在基于图9所示实施例提供的另一可选实施例中，所述确定单元930，还用于：根据从获取单元920接收的统计结果，确定网络攻击的来源； 或者，根据从获取单元920接收的统计结果，确定网络攻击的目标。
需要说明的是：上述实施例提供的设备在实现其功能时，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将设备的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。另外，上述实施例提供的设备与方法实施例属于同一构思，其具体实现过程详见方法实施例，这里不再赘述。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
以上所述仅为本申请的较佳实施例，并不用以限制本申请，凡在本申请的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (21)

  1. 一种检测网络攻击的方法，其特征在于，所述方法包括：
    采集网络中的N个会话中每个会话的特征信息，所述N为大于1的整数；
    获取统计结果，所述统计结果为以所述N个会话中的每个会话为一个采样单元，以所述特征信息为样本值，对所述N个会话的所述特征信息进行统计后得到的结果；
    如果所述统计结果和参考结果之间的差异超过预设条件，确定所述网络受到网络攻击。
  2. 根据权利要求1所述的方法，其特征在于，所述特征信息是表示大小的数值，所述统计结果为基尼系数；所述获取统计结果，包括：
    按所述特征信息从小到大的顺序，对所述N个会话排序；
    从所述N个会话中选择M个会话，在坐标系中获取M个坐标，所述M个坐标与所述M个会话一一对应，所述M个会话中的第a个坐标对应于所述排序后N个会话中的第b个会话，所述第a个坐标为(b/N,w/W)，其中，所述w为所述N个会话中特征信息最小的b个会话的所述特征信息之和，所述W为所述N个会话的所述特征信息之和，所述M为大于1且小于等于所述N的整数，所述a为大于等于1且小于等于所述M的整数，所述b为大于等于1且小于等于所述N的整数；
    根据所述M个坐标，在所述坐标系中获取洛伦兹曲线；
    根据所述洛伦兹曲线计算所述基尼系数。
  3. 根据权利要求1所述的方法，其特征在于，所述统计结果为信息熵，所述获取统计结果，包括：
    根据所述N个会话中每个会话的特征信息，计算n类会话中的每一类会话在所述N个会话中的出现概率，所述N个会话中的每一个会话属于所述n类会话中的一类会话，所述n为大于等于1且小于等于所述N的整数；
    根据所述n类会话中每一类会话的所述出现概率计算所述信息熵。
  4. 根据权利要求1所述的方法，其特征在于，所述统计结果为卷积，所述 N个会话中每个会话的特征信息包括第一类特征信息和第二类特征信息，所述第一类特征信息是表示大小的数值，所述第二类特征信息是表示大小的数值；所述获取统计结果，包括：
    根据所述N个会话中每个会话的所述第一类特征信息，构建第一离散序列；
    根据所述N个会话中每个会话的所述第二类特征信息，构建第二离散序列；
    计算所述第一离散序列和所述第二离散序列的所述卷积。
  5. 根据权利要求1所述的方法，其特征在于，所述统计结果为向量和，所述N个会话中每个会话的特征信息包括p类特征信息，所述p为大于1的整数；所述获取统计结果，包括：
    构建N个向量，所述N个向量与所述N个会话一一对应，所述N个向量中的每个向量具有p个维度，所述p个维度与所述p类特征信息一一对应；
    计算所述N个向量的向量和。
  6. 根据权利要求1所述的方法，其特征在于，所述统计结果为向量积，所述N个会话中每个会话的特征信息包括p类特征信息，所述p为大于1的整数；所述获取统计结果，包括：
    构建N个向量，所述N个向量与所述N个会话一一对应，所述N个向量中的每个向量具有p个维度，所述p个维度与所述p类特征信息一一对应；
    计算所述N个向量的向量积。
  7. 根据权利要求1至6任一项所述的方法，其特征在于，所述确定所述网络受到网络攻击之后，还包括：
    根据所述统计结果，确定所述网络攻击的来源；或者，
    根据所述统计结果，确定所述网络攻击的目标。
  8. 一种检测网络攻击的设备，其特征在于，所述设备包括：
    采集单元，用于采集网络中的N个会话中每个会话的特征信息，所述N为大于1的整数；
    获取单元，用于获取统计结果，所述统计结果为以所述N个会话中的每个会话为一个采样单元，以所述特征信息为样本值，对所述N个会话的所述特征 信息进行统计后得到的结果；
    确定单元，用于在所述统计结果和参考结果之间的差异超过预设条件的情况下，确定所述网络受到网络攻击。
  9. 根据权利要求8所述的设备，其特征在于，所述特征信息是表示大小的数值，所述统计结果为基尼系数；
    所述获取单元，具体用于：
    按所述特征信息从小到大的顺序，对所述N个会话排序；
    从所述N个会话中选择M个会话，在坐标系中获取M个坐标，所述M个坐标与所述M个会话一一对应，所述M个会话中的第a个坐标对应于所述排序后的N个会话中的第b个会话，所述第a个坐标为(b/N,w/W)，其中，所述w为所述N个会话中特征信息最小的b个会话的所述特征信息之和，所述W为所述N个会话的所述特征信息之和，所述M为大于1且小于等于所述N的整数，所述a为大于等于1且小于等于所述M的整数，所述b为大于等于1且小于等于所述N的整数；
    根据所述M个坐标，在所述坐标系中获取洛伦兹曲线；
    根据所述洛伦兹曲线计算所述基尼系数。
  10. 根据权利要求8所述的设备，其特征在于，所述统计结果为信息熵；
    所述获取单元，具体用于：
    根据所述N个会话中每个会话的特征信息，计算n类会话中的每一类会话在所述N个会话中的出现概率，所述N个会话中的每一个会话属于所述n类会话中的一类会话，所述n为大于等于1且小于等于所述N的整数；
    根据所述n类会话中每一类会话的所述出现概率计算所述信息熵。
  11. 根据权利要求8所述的设备，其特征在于，所述统计结果为卷积，所述N个会话中每个会话的特征信息包括第一类特征信息和第二类特征信息，所述第一类特征信息是表示大小的数值，所述第二类特征信息是表示大小的数值；
    所述获取单元，具体用于：
    根据所述N个会话中每个会话的所述第一类特征信息，构建第一离散序列；
    根据所述N个会话中每个会话的所述第二类特征信息，构建第二离散序列；
    计算所述第一离散序列和所述第二离散序列的所述卷积。
  12. 根据权利要求8所述的设备，其特征在于，所述统计结果为向量和，所述N个会话中每个会话的特征信息包括p类特征信息，所述p为大于1的整数；
    所述获取单元，具体用于：
    构建N个向量，所述N个向量与所述N个会话一一对应，所述N个向量中的每个向量具有p个维度，所述p个维度与所述p类特征信息一一对应；
    计算所述N个向量的向量和。
  13. 根据权利要求8所述的设备，其特征在于，所述统计结果为向量积，所述N个会话中每个会话的特征信息包括p类特征信息，所述p为大于1的整数；
    所述获取单元，具体用于：
    构建N个向量，所述N个向量与所述N个会话一一对应，所述N个向量中的每个向量具有p个维度，所述p个维度与所述p类特征信息一一对应；
    计算所述N个向量的向量积。
  14. 根据权利要求8至13任一项所述的设备，其特征在于，所述确定单元，还用于：
    根据所述统计结果，确定所述网络攻击的来源；或者，
    根据所述统计结果，确定所述网络攻击的目标。
  15. 一种检测网络攻击的设备，其特征在于，所述设备包括：处理器以及网络接口，所述处理器用于执行以下操作：
    通过所述网络接口采集网络中的N个会话中每个会话的特征信息，所述N为大于1的整数；
    获取统计结果，所述统计结果为以所述N个会话中的每个会话为一个采样单元，以所述特征信息为样本值，对所述N个会话的所述特征信息进行统计后得到的结果；
    如果所述统计结果和参考结果之间的差异超过预设条件，确定所述网络受 到网络攻击。
  16. 根据权利要求15所述的设备，其特征在于，所述特征信息是表示大小的数值，所述统计结果为基尼系数；所述获取统计结果，包括：
    按所述特征信息从小到大的顺序，对所述N个会话排序；
    从所述N个会话中选择M个会话，在坐标系中获取M个坐标，所述M个坐标与所述M个会话一一对应，所述M个会话中的第a个坐标对应于所述排序后的N个会话中的第b个会话，所述第a个坐标为(b/N,w/W)，其中，所述w为所述N个会话中特征信息最小的b个会话的所述特征信息之和，所述W为所述N个会话的所述特征信息之和，所述M为大于1且小于等于所述N的整数，所述a为大于等于1且小于等于所述M的整数，所述b为大于等于1且小于等于所述N的整数；
    根据所述M个坐标，在所述坐标系中获取洛伦兹曲线；
    根据所述洛伦兹曲线计算所述基尼系数。
  17. 根据权利要求15所述的设备，其特征在于，所述统计结果为信息熵，所述获取统计结果，包括：
    根据所述N个会话中每个会话的特征信息，计算n类会话中的每一类会话在所述N个会话中的出现概率，所述N个会话中的每一个会话属于所述n类会话中的一类会话，所述n为大于等于1且小于等于所述N的整数；
    根据所述n类会话中每一类会话的所述出现概率计算所述信息熵。
  18. 根据权利要求15所述的设备，其特征在于，所述统计结果为卷积，所述N个会话中每个会话的特征信息包括第一类特征信息和第二类特征信息，所述第一类特征信息是表示大小的数值，所述第二类特征信息是表示大小的数值；所述获取统计结果，包括：
    根据所述N个会话中每个会话的所述第一类特征信息，构建第一离散序列；
    根据所述N个会话中每个会话的所述第二类特征信息，构建第二离散序列；
    计算所述第一离散序列和所述第二离散序列的所述卷积。
  19. 根据权利要求15所述的设备，其特征在于，所述统计结果为向量和， 所述N个会话中每个会话的特征信息包括p类特征信息，所述p为大于1的整数；所述获取统计结果，包括：
    构建N个向量，所述N个向量与所述N个会话一一对应，所述N个向量中的每个向量具有p个维度，所述p个维度与所述p类特征信息一一对应；
    计算所述N个向量的向量和。
  20. 根据权利要求15所述的设备，其特征在于，所述统计结果为向量积，所述N个会话中每个会话的特征信息包括p类特征信息，所述p为大于1的整数；所述获取统计结果，包括：
    构建N个向量，所述N个向量与所述N个会话一一对应，所述N个向量中的每个向量具有p个维度，所述p个维度与所述p类特征信息一一对应；
    计算所述N个向量的向量积。
  21. 根据权利要求15至20任一项所述的设备，其特征在于，所述处理器，还用于执行以下操作：
    根据所述统计结果，确定所述网络攻击的来源；或者，
    根据所述统计结果，确定所述网络攻击的目标。
PCT/CN2016/081503 2016-05-10 2016-05-10 检测网络攻击的方法及设备 WO2017193271A1 (zh)

Priority Applications (5)

Application Number Priority Date Filing Date Title
CN201680001495.7A CN108028832A (zh) 2016-05-10 2016-05-10 检测网络攻击的方法及设备
PCT/CN2016/081503 WO2017193271A1 (zh) 2016-05-10 2016-05-10 检测网络攻击的方法及设备
EP16901226.7A EP3361694A4 (en) 2016-05-10 2016-05-10 Method and device for detecting network attack
IL259293A IL259293A (en) 2016-05-10 2018-05-13 Method and processor for protection against network attack
US15/993,485 US20180278632A1 (en) 2016-05-10 2018-05-30 Method and device for detecting network attack

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/081503 WO2017193271A1 (zh) 2016-05-10 2016-05-10 检测网络攻击的方法及设备

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/993,485 Continuation US20180278632A1 (en) 2016-05-10 2018-05-30 Method and device for detecting network attack

Publications (1)

Publication Number Publication Date
WO2017193271A1 true WO2017193271A1 (zh) 2017-11-16

Family

ID=60266104

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/081503 WO2017193271A1 (zh) 2016-05-10 2016-05-10 检测网络攻击的方法及设备

Country Status (5)

Country Link
US (1) US20180278632A1 (zh)
EP (1) EP3361694A4 (zh)
CN (1) CN108028832A (zh)
IL (1) IL259293A (zh)
WO (1) WO2017193271A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114666398A (zh) * 2020-12-07 2022-06-24 深信服科技股份有限公司 应用分类方法、装置、设备及存储介质
CN115037528A (zh) * 2022-05-24 2022-09-09 天翼云科技有限公司 一种异常流量检测方法及装置
CN116112265A (zh) * 2023-02-13 2023-05-12 山东云天安全技术有限公司 一种异常会话的确定方法、电子设备及存储介质

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11973614B2 (en) * 2018-12-13 2024-04-30 Comcast Cable Communications, Llc Methods and systems for communication
CN112839017B (zh) * 2019-11-25 2022-06-03 中移(苏州)软件技术有限公司 一种网络攻击检测方法及其装置、设备和存储介质
CN112866179B (zh) * 2019-11-27 2023-06-27 北京沃东天骏信息技术有限公司 限流方法和限流装置
CN113055335B (zh) * 2019-12-26 2022-09-30 中国电信股份有限公司 用于检测通信异常的方法、装置、网络系统和存储介质
CN112329678B (zh) * 2020-11-12 2023-03-24 山东师范大学 一种基于信息融合的单目行人3d定位的方法

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2007060379A (ja) * 2005-08-25 2007-03-08 Nippon Telegr & Teleph Corp <Ntt> Ｓｉｐサーバにおける攻撃防御方法、システム及びプログラム
CN102202064A (zh) * 2011-06-13 2011-09-28 刘胜利 基于网络数据流分析的木马通信行为特征提取方法
CN102882894A (zh) * 2012-10-30 2013-01-16 杭州迪普科技有限公司 一种识别攻击的方法及装置
US20130042322A1 (en) * 2011-08-10 2013-02-14 Electronics And Telecommunications Research Institute SYSTEM AND METHOD FOR DETERMINING APPLICATION LAYER-BASED SLOW DISTRIBUTED DENIAL OF SERVICE (DDoS) ATTACK
CN104796405A (zh) * 2015-03-18 2015-07-22 深信服网络科技（深圳）有限公司 反弹连接检测方法和装置
CN105530243A (zh) * 2015-12-03 2016-04-27 中国南方电网有限责任公司信息中心 一种网络攻击事件定量分级算法的实现方法

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101272254B (zh) * 2008-05-09 2010-09-29 华为技术有限公司 生成攻击特征库的方法、防范网络攻击的方法以及装置
CN101355463B (zh) * 2008-08-27 2011-04-20 成都市华为赛门铁克科技有限公司 网络攻击的判断方法、系统和设备
US20110138463A1 (en) * 2009-12-07 2011-06-09 Electronics And Telecommunications Research Institute Method and system for ddos traffic detection and traffic mitigation using flow statistics
US9282113B2 (en) * 2013-06-27 2016-03-08 Cellco Partnership Denial of service (DoS) attack detection systems and methods
CN104935609A (zh) * 2015-07-17 2015-09-23 北京京东尚科信息技术有限公司 网络攻击检测方法及检测设备

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2007060379A (ja) * 2005-08-25 2007-03-08 Nippon Telegr & Teleph Corp <Ntt> Ｓｉｐサーバにおける攻撃防御方法、システム及びプログラム
CN102202064A (zh) * 2011-06-13 2011-09-28 刘胜利 基于网络数据流分析的木马通信行为特征提取方法
US20130042322A1 (en) * 2011-08-10 2013-02-14 Electronics And Telecommunications Research Institute SYSTEM AND METHOD FOR DETERMINING APPLICATION LAYER-BASED SLOW DISTRIBUTED DENIAL OF SERVICE (DDoS) ATTACK
CN102882894A (zh) * 2012-10-30 2013-01-16 杭州迪普科技有限公司 一种识别攻击的方法及装置
CN104796405A (zh) * 2015-03-18 2015-07-22 深信服网络科技（深圳）有限公司 反弹连接检测方法和装置
CN105530243A (zh) * 2015-12-03 2016-04-27 中国南方电网有限责任公司信息中心 一种网络攻击事件定量分级算法的实现方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3361694A4 *

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114666398A (zh) * 2020-12-07 2022-06-24 深信服科技股份有限公司 应用分类方法、装置、设备及存储介质
CN114666398B (zh) * 2020-12-07 2024-02-23 深信服科技股份有限公司 应用分类方法、装置、设备及存储介质
CN115037528A (zh) * 2022-05-24 2022-09-09 天翼云科技有限公司 一种异常流量检测方法及装置
CN115037528B (zh) * 2022-05-24 2023-11-03 天翼云科技有限公司 一种异常流量检测方法及装置
CN116112265A (zh) * 2023-02-13 2023-05-12 山东云天安全技术有限公司 一种异常会话的确定方法、电子设备及存储介质
CN116112265B (zh) * 2023-02-13 2023-07-28 山东云天安全技术有限公司 一种异常会话的确定方法、电子设备及存储介质

Also Published As

Publication number Publication date
EP3361694A1 (en) 2018-08-15
EP3361694A4 (en) 2019-01-02
US20180278632A1 (en) 2018-09-27
CN108028832A (zh) 2018-05-11
IL259293A (en) 2018-07-31

Similar Documents

Publication Publication Date Title
WO2017193271A1 (zh) 检测网络攻击的方法及设备
US9654484B2 (en) Detecting DGA-based malicious software using network flow information
US10505952B2 (en) Attack detection device, attack detection method, and attack detection program
US7779133B2 (en) Estimation of web client response time
WO2016106592A1 (zh) 一种特征信息分析方法及装置
Xue et al. Towards detecting target link flooding attack
Sanmorino et al. DDoS attack detection method and mitigation using pattern of the flow
WO2017020712A1 (zh) 量化防御结果的方法、装置及系统
US20140373146A1 (en) Dos detection and mitigation in a load balancer
JP2007184799A (ja) パケット通信装置
US9800593B2 (en) Controller for software defined networking and method of detecting attacker
Scholz et al. SYN flood defense in programmable data planes
KR20110070464A (ko) 트래픽 수집장치, 트래픽 분석장치, 시스템 및 그 분석방법
KR20180052324A (ko) 분산 반사 서비스 거부 공격 탐지 장치 및 방법
CN113364804B (zh) 一种流量数据的处理方法和装置
Sen A robust mechanism for defending distributed denial of service attacks on web servers
CN114338120B (zh) 一种扫段攻击检测方法、装置、介质和电子设备
CN107070851B (zh) 基于网络流的连接指纹生成和垫脚石追溯的系统和方法
Zhou et al. Online internet traffic measurement and monitoring using spark streaming
Bala et al. Quality based Bottom-up-Detection and Prevention Techniques for DDOS in MANET
CN111953810A (zh) 识别代理互联网协议地址的方法、装置及存储介质
WO2022267490A1 (zh) 攻击识别方法、装置及系统、计算机可读存储介质
Cusack et al. Detecting and tracing slow attacks on mobile phone user service
Wong et al. An efficient distributed algorithm to identify and traceback ddos traffic
Ohsita et al. Detecting Distributed Denial-of-Service Attacks by analyzing TCP SYN packets statistically

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 259293

Country of ref document: IL

NENP Non-entry into the national phase

Ref country code: DE