WO2021196691A1 - 一种网络攻击检测方法及装置 - Google Patents

一种网络攻击检测方法及装置 Download PDF

Info

Publication number
WO2021196691A1
WO2021196691A1 PCT/CN2020/133366 CN2020133366W WO2021196691A1 WO 2021196691 A1 WO2021196691 A1 WO 2021196691A1 CN 2020133366 W CN2020133366 W CN 2020133366W WO 2021196691 A1 WO2021196691 A1 WO 2021196691A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
network traffic
protection device
attack
network protection
Prior art date
Application number
PCT/CN2020/133366
Other languages
English (en)
French (fr)
Inventor
李世光
许梦雯
焦丽娟
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP20928449.6A priority Critical patent/EP4089972A4/en
Publication of WO2021196691A1 publication Critical patent/WO2021196691A1/zh
Priority to US17/956,591 priority patent/US20230025946A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/145—Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design
    • H04L41/145—Network analysis or design involving simulating, designing, planning or modelling of a network
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/23—Updating
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/22—Matching criteria, e.g. proximity measures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/16—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks using machine learning or artificial intelligence
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/168—Implementing security features at a particular protocol layer above the transport layer

Definitions

  • the embodiments of the present application relate to the field of computer network technology, and further relate to the application of artificial intelligence (AI) technology in the field of computer networks, and in particular to a method and device for detecting network attacks.
  • AI artificial intelligence
  • Network protection equipment (such as security gateway equipment or firewalls) detects the traffic flowing through the network protection equipment to confirm whether the network has intrusion attacks or malicious communications and other attacks, and promptly block the attacks if there are attacks. To ensure network security.
  • IPS technology is mainly used to detect malicious traffic (or called attack traffic)
  • AV technology is mainly used to detect malicious files.
  • the methods of using IPS technology and AV technology for network attack detection are similar, including: pre-stored in the signature database of network protection equipment the attack characteristics of a large number of known malicious traffic or malicious files extracted by the network security solution provider; network protection equipment Extract the key content of the traffic or file that reaches the network protection device, and then compare the extracted key content with the attack signatures stored in the signature database. If the extracted key content contains the attack signatures in the signature database, then determine the The traffic or files are offensive.
  • the embodiments of the present application provide a network attack detection method and device, which can improve the network adaptability and detection effect of network protection equipment.
  • the embodiments of the present application provide a network attack detection method, which can be applied to an intrusion prevention system (IPS) to block malicious traffic (that is, to prevent malicious attacks). It can also be applied to anti-virus (AV) to prevent malicious files (that is, to defend against viruses).
  • the method includes: the network protection device obtains first key data from the received first network traffic, and matches the first key data with an attack feature in a feature database to obtain a first matching result.
  • the first key data is data obtained from the designated field of the analysis result after the network protection device performs protocol analysis on one or more packets contained in the first network traffic.
  • the first matching result includes the first key data and the attack features included in the feature database.
  • the network protection device determines that the first network traffic is offensive according to the first matching result, the network protection device obtains a target attack detection model based on the first network traffic.
  • the target attack detection model is used to identify one or more attack characteristics, and the one or more attack characteristics are different from the attack characteristics in the signature database. Then the network protection device receives the second network traffic, and the network protection device determines whether the second network traffic is offensive based on the target attack detection model.
  • the network protection device before the network protection device performs network attack detection, the network protection device pre-stores a signature database.
  • the signature database contains a variety of known attack signatures provided by network security solution providers.
  • the network protection device After receiving the first network traffic, the network protection device first matches the first key data extracted from the first network traffic with the attack characteristics in the signature database, and determines whether the first network traffic is offensive according to the matching result. If it is determined that the first network traffic is offensive according to the matching result of the signature database, the first network traffic is used as a black sample for training the target attack detection model to obtain the target attack detection model.
  • the target attack detection model can identify new attack features that are not included in the signature database, and these new attack features may be closely related to the actual network traffic in the network environment where the network protection equipment is deployed.
  • the network protection equipment detects the subsequent traffic flowing through the network protection equipment according to the target attack detection model obtained by training.
  • the above-mentioned target attack detection model is obtained in real time based on the malicious traffic continuously appearing in the actual network environment where the network protection device is located.
  • the network protection device uses the target attack detection model to detect subsequent network traffic, so that the network protection
  • the device has certain detection capabilities for some malicious traffic that attempts to evade detection through the new variant, thereby improving the network adaptability and detection effect of the network protection device.
  • an attack detection model is pre-stored in the network protection device, and the attack detection model is based on a sample set ( Or sample library) the attack detection model obtained by training.
  • the network protection equipment will update the attack detection model. For example, if the first network traffic is offensive, the network protection device adds the first network traffic as a new black sample to the sample set, obtains the target attack detection model based on the updated sample set, and uses the target attack detection model to update
  • the attack detection model in the model library uses the target attack detection model to replace the existing attack detection model.
  • the attack detection model before the update is referred to as the original attack detection model. In this way, the original attack detection model is continuously replaced by a target attack detection model trained based on a new sample set.
  • the above-mentioned network protection device matching the first key data with the attack characteristics in the signature database specifically includes: the network protection device determines whether the first key data includes the attack characteristics in the signature database. Specifically, the network protection equipment compares the first key data with each attack feature in the signature database, and if the first key data contains a certain attack feature in the signature database, the attack feature is recorded to obtain the first key data. Match results. The first matching result includes the attack feature in the matching, that is, the attack feature contained in both the first key data and the feature database. The network protection device determines whether the first network traffic is offensive based on the attack characteristics in the matching and the attack discrimination strategy.
  • the network protection device matches the key data of the network traffic with the attack characteristics in the signature database, and determines whether the network traffic is offensive according to the matching result.
  • the network protection equipment conducts localized attack detection model training based on the offensive network traffic (that is, the attack detection model training is performed on the network protection equipment), which is consistent with the current situation.
  • the embodiment of the present application there is no need to transmit the network traffic to the cloud for training, which can ensure that data privacy is not leaked.
  • the above-mentioned network protection device determines whether the second network traffic is offensive based on the target attack detection model specifically includes: the network protection device obtains the second key data from the second network traffic, and the second key data The data is input to the target attack detection model, and according to the output of the target attack detection model, it is determined whether the second network traffic is offensive.
  • the second key data is data obtained from the designated field of the analysis result after the network protection device performs protocol analysis on one or more packets contained in the second network traffic.
  • the second key data is input into the target attack detection model, and the network protection device uses the target attack detection model to reason about the second key data.
  • the target attack detection model outputs the inference result, which is the detection result of the second network traffic using the target attack detection model, that is, the second network traffic is offensive or the second network traffic is not offensive.
  • the above process of determining whether the second network traffic is aggressive based on the target attack detection model corresponds to the above process of training the target attack detection model.
  • the target attack detection model is obtained based on the random forest algorithm.
  • the network protection device uses the corresponding random forest classifier to determine whether the second network traffic is offensive.
  • the foregoing designated field is a hypertext transfer protocol (hypertext transfer protocol, HTTP) payload of one or more packets included in the network traffic.
  • HTTP hypertext transfer protocol
  • the first key data is data obtained from the HTTP payload field of the analysis result after the network protection device performs application layer protocol analysis on one or more packets contained in the first network traffic.
  • the second key data is data obtained from the HTTP payload field of the analysis result after the network protection device performs application layer protocol analysis on one or more packets contained in the second network traffic.
  • the aforementioned designated field is the HTTP payload of one or more packets contained in the network traffic.
  • the above-mentioned first key data is the first network traffic obtained after the network protection device performs application layer protocol analysis on one or more packets contained in the first network traffic, and reorganizes the HTTP payload field of the analysis result.
  • the above-mentioned second key data is the file carried by the second network traffic after the network protection device performs application layer protocol analysis on one or more packets contained in the second network traffic, and reorganizes the HTTP payload field of the analysis result. data.
  • the network protection device before the network protection device inputs the second key data into the target attack detection model, and determines whether the second network traffic is offensive according to the output of the target attack detection model, the network provided by the embodiment of the present application
  • the attack detection method further includes: the network protection device matches the second key data with the attack characteristics in the signature database to obtain a second matching result, and determines that the second network traffic is not offensive according to the second matching result.
  • the second matching result includes the second key data and the attack features included in the feature database.
  • the network protection device matches the second key data with the attack features in the signature database to obtain a second matching result. If the second matching result is empty, the network protection device determines that the second network traffic is not offensive.
  • the network protection device after receiving the second network traffic, the network protection device first detects the second network traffic based on the feature matching detection method. After the first detection, if the network protection device determines that the second network traffic is not offensive, the network protection device then performs a second detection on the second network traffic based on the detection method of the attack detection model, and according to the attack detection model To determine whether the second network traffic is offensive. In this way, using the attack detection model as a supplement to the signature database can improve the detection effect of network attack detection to a certain extent, and more reliably detect whether there is malicious traffic in the network.
  • the network attack detection method provided in the embodiment of the present application further includes: in the case that the network protection device determines that the second network traffic is offensive based on the target attack detection model, the network protection device follows the first prediction Let the action respond to the second network traffic.
  • the first preset action is used for the network protection device to respond to offensive network traffic.
  • the foregoing first preset action includes blocking or warning.
  • the network protection device responding to the second network traffic according to the first preset action specifically includes: the network protection device stops sending the second network traffic to the next hop device of the network protection device .
  • the network protection device can prevent the second network traffic from flowing from the network protection device to the next hop device of the network protection device, further avoiding the second network traffic from continuing to flow into other devices in the network, and can prevent network attacks in time.
  • the network protection device responding to the second network traffic according to the first preset action information specifically includes: the network protection device outputs alarm information through an output device, and receives a response to the alarm information.
  • the instruction includes a first instruction and a second instruction.
  • the network protection device stops sending the second network traffic to the next hop device of the network protection device.
  • the network protection device sends the second network traffic to the next hop device of the network protection device.
  • the response of the network protection equipment is an online response method, that is, after the network protection equipment outputs the alarm information, it waits for the user’s feedback on the alarm information (that is, the above-mentioned first and second instructions), and then according to the user’s Feedback and take corresponding actions.
  • the network protection device when the first preset action is an alarm, the network protection device outputs the alarm information through the output device, and stops sending the second network traffic to the next hop device of the network protection device. Or, the network protection device outputs the alarm information through the output device, and sends the second network traffic to the next hop device of the network protection device.
  • the response of the network protection equipment is an offline response method, that is, after the network protection equipment outputs the alarm information (the alarm information is only used to notify the user), the network protection equipment does not need to wait for the user's feedback on the alarm information, but Respond in time according to preset actions.
  • the network attack detection method provided in the embodiment of the present application further includes: when the network protection device determines that the second network traffic is not offensive based on the target attack detection model, the network protection device follows the second The preset action is an action response to the first network traffic. The second preset action is used for the network protection device to respond to non-aggressive network traffic.
  • the second preset action is release.
  • the aforementioned network protection device's action response to the second network traffic according to the second preset action specifically includes: the network protection device sends the second network traffic to the next hop device of the network protection device.
  • the method for the network protection device to obtain a target attack detection model based on the first network traffic specifically includes: the network protection device adds the first network traffic as a black sample to the first sample set, thereby obtaining the second Sample set.
  • the network protection equipment trains the second sample set based on a predetermined algorithm to obtain a target attack detection model.
  • the first sample set includes at least one black sample.
  • the first sample set further includes at least one white sample.
  • the foregoing predetermined algorithm is one of a machine learning algorithm or an artificial intelligence algorithm, such as decision tree, random forest, Bayes, convolutional neural network (convolutional neural network, CNN), deep Algorithms such as deep neural networks (DNN).
  • a machine learning algorithm such as decision tree, random forest, Bayes, convolutional neural network (convolutional neural network, CNN), deep Algorithms such as deep neural networks (DNN).
  • CNN convolutional neural network
  • DNN deep Algorithms
  • the target attack detection model trained based on the random forest algorithm is the random forest classifier, which is used to classify the test sample, that is, to determine whether the test sample is a black sample or a white sample.
  • the test sample is network traffic
  • the random forest classifier obtained by the training is used to determine whether the network traffic is offensive or not. It should be understood that the training process of the random forest classifier is the training process of multiple decision trees included in the random forest classifier.
  • the network attack detection method provided in the embodiment of the present application further includes: if the network protection device determines that the first network traffic is offensive according to the first matching result, the network protection device responds to the first network traffic according to the first preset action. A network traffic responds to actions.
  • the network attack detection method provided in the embodiment of the present application further includes: if the network protection device determines that the first network traffic is not offensive according to the first matching result, the network protection device determines the first network traffic based on the original attack detection model. 1. Whether the network traffic is offensive.
  • the original attack detection model is obtained by training the first sample set based on a predetermined algorithm.
  • the network protection device determines that the first network traffic is not aggressive.
  • an embodiment of the present application provides a network attack detection device, including: a detection module, an analysis module, and a receiving module.
  • the detection module is configured to obtain the first key data from the first network traffic received by the receiving module, and match the first key data with the attack feature in the feature database to obtain the first matching result.
  • the first key data is data obtained from the designated field of the analysis result after the detection module performs protocol analysis on one or more packets contained in the first network traffic.
  • the first matching result includes the first key data and the attack features included in the feature database.
  • the analysis module is configured to obtain a target attack detection model based on the first network flow when the detection module determines that the first network flow is aggressive according to the first matching result.
  • the target attack detection model is used to identify one or more attack characteristics, which are different from the attack characteristics in the signature database.
  • the receiving module is used for receiving the second network traffic.
  • the determining module is used to determine whether the second network traffic is offensive based on the target attack detection model.
  • the above detection module is specifically configured to obtain second key data from the second network traffic, input the second key data into the target attack detection model, and determine the second network based on the output of the target attack detection model Whether the traffic is offensive.
  • the second key data is data obtained from the designated field of the analysis result after the detection module performs protocol analysis on one or more packets contained in the second network traffic.
  • the aforementioned designated field is the HTTP payload of one or more packets contained in the network traffic.
  • the first key data is data obtained from the HTTP payload field of the analysis result after the detection module performs application layer protocol analysis on one or more packets contained in the first network traffic.
  • the second key data is data obtained from the HTTP payload field of the analysis result after the detection module performs application layer protocol analysis on one or more packets contained in the second network traffic.
  • the aforementioned designated field is the HTTP payload of one or more packets contained in the network traffic.
  • the first key data is the first network traffic carried by the detection module after the detection module performs application layer protocol analysis on one or more packets contained in the first network traffic, and reorganizes the HTTP payload field of the analysis result.
  • the second key data is the file data carried by the second network traffic obtained after the detection module performs application layer protocol analysis on one or more packets contained in the second network traffic, and reorganizes the HTTP payload field of the analysis result.
  • the above detection module is also used to match the second key data with the attack features in the signature database to obtain a second matching result, and according to the second matching result, it is determined that the second network traffic is not aggressive .
  • the second matching result includes the second key data and the attack features included in the feature database.
  • the network attack detection device provided in the embodiment of the present application further includes a processing module.
  • the processing module is configured to perform an action response to the second network traffic according to the first preset action when the detection module determines that the second network traffic is offensive based on the target attack detection model.
  • the foregoing first preset action includes blocking or warning.
  • the network attack detection device provided in the embodiment of the present application further includes a sending module.
  • the aforementioned processing module is specifically configured to control the sending module to stop sending the second network traffic to the next hop device of the network protection device.
  • the above-mentioned processing module is specifically configured to control the sending module to output the alarm information through the output device, and control the receiving module to receive an instruction returned for the alarm information.
  • the instruction includes a first instruction and a second instruction.
  • the sending module stops sending the second network traffic to the next hop device of the network protection device.
  • the sending module sends the second network traffic to the next hop device of the network protection device.
  • the processing module is specifically configured to control the sending module to output the alarm information through the output device, and stop sending the second network traffic to the next hop device of the network protection device.
  • the control sending module outputs the alarm information through the output device, and sends the second network traffic to the next hop device of the network protection device.
  • the above-mentioned processing module is further configured to perform an action response to the second network traffic according to the second preset action when the detection module determines that the second network traffic is not aggressive based on the target attack detection model.
  • the above-mentioned second preset action is release.
  • the foregoing processing module is specifically configured to send the second network traffic to the next hop device of the network protection device.
  • the above analysis module is specifically configured to add the first network traffic as a black sample to the first sample set, so as to obtain the second sample set.
  • the first sample set includes at least one black sample.
  • the second sample set is trained to obtain a target attack detection model.
  • the above-mentioned detection module is further configured to perform an action response to the first network traffic according to the first preset action when it is determined that the first network traffic is aggressive according to the first matching result.
  • the above-mentioned detection module is further configured to determine whether the first network traffic is offensive based on the original attack detection model when it is determined that the first network traffic is not offensive according to the first matching result.
  • the attack detection model is trained on the first sample set based on a predetermined algorithm.
  • an embodiment of the present application provides a network protection device, including a memory and at least one processor connected to the memory.
  • the memory is used to store instructions. After the instructions are read by at least one processor, the network protection device executes the first aspect or the method in any one of the possible implementations of the first aspect. For details, refer to the detailed description above. I won't repeat it here.
  • an embodiment of the present application provides a computer-readable storage medium for storing computer software instructions used for the above-mentioned network protection device, which includes instructions for executing the above-mentioned first aspect or any possible implementation of the above-mentioned aspects The way the program is designed.
  • the embodiments of the present application provide a computer program product containing instructions, which when run on a computer, cause the computer to execute the method described in the first aspect or any one of the possible implementations of the first aspect .
  • an embodiment of the present application provides a chip including a memory and a processor.
  • the memory is used to store computer instructions.
  • the processor is configured to call and run the computer instructions from the memory to execute the above-mentioned first aspect and any possible implementation of the first aspect.
  • FIG. 1 is a schematic diagram of an application scenario of a network attack detection method provided by an embodiment of the application
  • FIG. 2A is a schematic diagram 1 of a network attack detection method provided by an embodiment of this application.
  • 2B is a schematic flowchart of a method for detecting a network attack provided by an embodiment of this application;
  • 2C is a second schematic diagram of a network attack detection method provided by an embodiment of the application.
  • FIG. 2D is a second schematic diagram of a network attack detection method provided by an embodiment of this application.
  • 2E is a third schematic diagram of a network attack detection method provided by an embodiment of this application.
  • FIG. 2F is a fourth schematic diagram of a network attack detection method provided by an embodiment of this application.
  • FIG. 3 is a schematic structural diagram of a network protection device provided by an embodiment of this application.
  • FIG. 4 is a schematic structural diagram of a network attack detection device provided by an embodiment of the application.
  • first and second in the description and claims of the embodiments of the present application are used to distinguish different objects, rather than to describe a specific order of objects.
  • first network traffic and the second network traffic are used to distinguish different network traffic, not to describe the specific sequence of network traffic;
  • first key data and the second key data are used to distinguish different key data , Rather than describing a specific order of key data.
  • multiple processing units refer to two or more processing units; multiple systems refer to two or more systems.
  • Network protection equipment used for network security protection.
  • Network protection equipment can detect and resist network attacks and viruses to ensure the safe transmission of data.
  • firewalls and security gateway equipment are all network protection equipment.
  • the firewall is deployed at the boundary of the protected network to filter the data flow entering and leaving the protected network, manage the access behavior of entering and leaving the network, and detect and alert network attacks.
  • the firewall is mainly used to resist external attacks and protect the protected network.
  • the security gateway device not only has the function of a firewall, but also has the function of defending against network intrusion and anti-virus.
  • the network protection equipment detects the traffic flowing through the network protection equipment to confirm whether the network has attack behaviors such as intrusion attacks or malicious communication, and promptly blocks the attack behaviors in the presence of attack behaviors to ensure protected Network security.
  • the embodiments of the present application provide a network attack detection method and device.
  • the network protection device obtains the first key data from the first network traffic received by the network protection device, and determines whether the first network traffic is offensive based on the attack characteristics in the signature database. If the network protection device determines that the first network traffic is offensive, the network protection device obtains a target attack detection model based on the first network traffic, and the target attack detection model is used to identify one or more attack characteristics, and the one or more attack characteristics It is different from the attack signature in the signature database. Furthermore, when the network protection device receives the second network traffic, the network protection device determines whether the second network traffic is offensive based on the target attack detection model.
  • the target attack detection model is dynamically obtained according to the malicious traffic continuously appearing in the actual network environment where the network protection equipment is located.
  • the target attack detection model has some characteristics for the attack features not included in the signature database. Recognition ability. In other words, through the target attack detection model, it is possible to learn the attack characteristics that are not included in the signature database in the actual network environment where the network protection equipment is located.
  • the network protection equipment uses the target attack detection model to detect subsequent network traffic, so that the network protection equipment has a certain detection ability for some malicious traffic that tries to evade detection through the new deformation, which can improve the network adaptability and detection effect of the network protection equipment.
  • the specific uses of the network attack detection method provided by the embodiments of this application include but are not limited to: operating system vulnerability detection (such as SMB service vulnerability detection, Apache vulnerability detection, Struts2 component vulnerability detection), application software vulnerability detection, and Web application intrusion detection ( For example, SQL injection detection, XSS cross-site attack detection), command and control server communication (ie C&C communication) detection (such as malicious traffic detection such as bots, Trojan horses, and worms).
  • operating system vulnerability detection such as SMB service vulnerability detection, Apache vulnerability detection, Struts2 component vulnerability detection
  • application software vulnerability detection for example, SQL injection detection, XSS cross-site attack detection), command and control server communication (ie C&C communication) detection (such as malicious traffic detection such as bots, Trojan horses, and worms).
  • C&C communication command and control server communication
  • FIG. 1 is a schematic diagram of an application scenario of the network attack detection method provided by an embodiment of the application.
  • the network protection device is a firewall (FW_1) or a security gateway device (GW_2).
  • the firewall or security gateway device is located on the transmission path of network traffic (two-way data flow) between the protected network and the Internet.
  • the analysis device hosts 3) is used to train an attack detection model based on training samples (for example, the sample set in the embodiment of this application), and the firewall (FW_1) is used to detect whether the network traffic has an attack sex.
  • the analysis device and the firewall (network protection device) are integrated in the same physical device.
  • the analysis device and the firewall are implemented by different physical devices that are communicatively coupled with each other, which is not limited in the embodiment of the present application.
  • the network attack detection method provided by the embodiments of the present application can be applied to an intrusion prevention system (IPS) to prevent malicious traffic (ie, to prevent malicious attacks), and can also be applied to an antivirus (AV) to prevent malicious files (ie, to prevent viruses).
  • IPS intrusion prevention system
  • AV antivirus
  • the method for detecting a network attack provided in an embodiment of the present application includes step 200 to step 204.
  • the network protection equipment executes Figure 2A, Figure 2C, Figure 2D, Figure 2E, and Figure 2F.
  • the analysis device and the network protection device are implemented by different physical devices, the analysis device executes steps 202, 2021, and 2022 in FIG. 2A, FIG. 2C, FIG. 2D, FIG. 2E, and FIG.
  • the network protection equipment performs step 200, step 201, step 203, step 204, step 2041, and step 2042 in Figure 2A, step 2042' shown in Figure 2C, step 204' shown in Figure 2D, and step 204' shown in Figure 2E.
  • the method for detecting a network attack provided by the analysis device and the network protection device are integrated into the same physical device (ie, the network protection device) is taken as an example.
  • Step 200 The network protection device obtains first key data from the received first network traffic.
  • the first network traffic is traffic between the protected network passing through the firewall (FW_1) and the Internet.
  • the first key data is data obtained from the designated field of the analysis result after the network protection device performs protocol analysis on one or more packets contained in the first network traffic.
  • the object detected by the network protection device is network traffic (that is, one or more packets contained in the network traffic, or one or more pieces of quintuple information are the same).
  • the object detected by the network protection device is the file carried by the network traffic.
  • network traffic includes several messages.
  • the network protection device caches the messages contained in the first network traffic, then parses one or more messages contained in the first network traffic, and obtains the first key data from the specified field of the analysis result.
  • the first key data is that the network protection device responds to the first Data obtained from the HTTP payload field of the analysis result after one or more packets contained in the network traffic are parsed by the application layer protocol.
  • the above-mentioned first key data is that the network protection device performs application layer protocol analysis on one or more packets contained in the first network traffic, and reorganizes the HTTP payload field of the analysis result Then, the file data carried by the first network traffic is obtained.
  • the above-mentioned first key data is that the network protection device obtains from the HTTP payload field of the analysis result after the application layer protocol analysis of the packet contained in the attack traffic
  • the data is a uniform resource locator (URL), and the URL (that is, the first key data) is:
  • the aforementioned first key data is after the network protection device performs protocol analysis on one of the multiple packets contained in the first network traffic
  • the data obtained from the specified field of the analysis result, or the first key data is that after the network protection device performs protocol analysis on at least two of the multiple packets contained in the first network traffic, it is specified from the analysis result
  • the data obtained in the field, that is, the first key data is composed of the data in the specified field of the respective analysis results of at least two of the multiple packets contained in the first network traffic.
  • Step 201 The network protection device matches the first key data with the attack signature in the signature database to obtain a first matching result.
  • the above-mentioned signature database contains a variety of attack signatures, which are the attack signatures of a large number of known malicious traffic or malicious files extracted by the network security solution provider and stored (loaded) in the network in advance. In protective equipment.
  • the above-mentioned network protection device matching the first key data with the attack characteristics in the signature database specifically includes: the network protection device determines whether the first key data includes the attack characteristics in the signature database. Specifically, the network protection equipment compares the first key data with each attack feature in the signature database, and if the first key data contains a certain attack feature in the signature database, then the attack feature is recorded to obtain the first key data. Match results.
  • the first matching result includes the attack feature in the matching, that is, the attack feature contained in both the first key data and the feature database.
  • the network protection device determines whether the first network traffic is offensive based on the attack characteristics in the matching and the attack discrimination strategy. There are many types of attack identification strategies, and it is difficult to list them one by one here.
  • the attack discrimination strategy also includes strategies defined from the dimensions of similarity, probability, regularity, etc. The attack discrimination strategy is specifically selected according to actual needs, which is not limited in the embodiment of the present application.
  • the network protection device determines that the first network traffic is not offensive (that is, the first network traffic is not offensive).
  • the method in which the network protection device matches the first key data with the attack features in the signature database, and determines whether the first network traffic is aggressive according to the first matching result is called a detection method based on feature matching.
  • the simplest attack discrimination strategy is adopted in this embodiment, that is, when the number of attack characteristics of the network protection device in matching is greater than or equal to 1, it is determined that the first network traffic is offensive.
  • the first key data is the URL obtained by the above analysis:
  • Step 202 If the network protection device determines that the first network traffic is offensive according to the first matching result, the network protection device obtains a target attack detection model based on the first network traffic.
  • the target attack detection model is used to detect whether the network traffic subsequently received by the network protection device is offensive.
  • the target attack detection model is used to identify one or more attack characteristics, and the one or more attack characteristics are different from the attack characteristics in the above-mentioned signature database.
  • the target attack detection model obtained based on the first network traffic is used to identify the attack characteristics of "select”, “top”, “password”, and “admin”, that is, based on the target attack detection model, network protection
  • the device can determine that the network traffic with the above-mentioned “select”, “top”, “password”, and "admin” characteristics is offensive.
  • the network protection device before the network protection device performs network attack detection, the network protection device has a feature library and a model library stored in advance.
  • the signature database is the signature database containing multiple attack features in the foregoing embodiment, and the attack detection model is stored in the model database.
  • the attack detection model in the model library is an attack detection model trained on a sample set composed of a large number of known malicious traffic (including traffic that initiates network attacks through messages or traffic that carries malicious files). In the process of network protection equipment detecting network traffic, the network protection equipment will update the attack detection model.
  • the network protection device adds the first network traffic as a new black sample to the sample set, obtains the target attack detection model based on the updated sample set, and uses the target attack detection model to update
  • the attack detection model in the model library uses the target attack detection model to replace the existing attack detection model.
  • the attack detection model before the update is referred to as the original attack detection model. In this way, the original attack detection model is continuously replaced by a target attack detection model trained based on a new sample set.
  • the attack detection model in the above model library is pre-stored (loaded) in the network protection equipment, and the attack detection model is the attack detection obtained by the network security solution provider training a large number of known malicious traffic or malicious files Model
  • the above specific method of training a large number of known malicious traffic or malicious files to obtain an attack detection model refers to the related content of the prior art, which will not be repeated here.
  • step 201 in combination with the description of step 201, it can be known that when the first key data includes an attack feature in the signature database, the network protection device determines that the first network traffic is offensive. At this time, the network protection device obtains a target attack detection model based on the first network traffic.
  • the network protection device obtains the target attack detection model through step 2021 to step 2022.
  • Step 2021 The network protection device adds the first network traffic as a black sample to the first sample set, thereby obtaining a second sample set.
  • the above-mentioned first sample set includes at least one black sample.
  • the first sample set further includes at least one white sample.
  • the first sample set is a sample set corresponding to the original attack detection model, that is, the original attack detection model is obtained by training based on the first sample set.
  • Step 2022 the network protection device trains the second sample set based on a predetermined algorithm to obtain a target attack detection model.
  • the foregoing predetermined algorithm is one of a machine learning algorithm or an artificial intelligence algorithm, such as decision tree, random forest, Bayesian, CNN, DNN and other algorithms.
  • the target attack detection model obtained by the network protection equipment based on the random forest algorithm training is the random forest classifier.
  • the random forest classifier is used to classify the test sample, that is, to determine whether the test sample is a black sample or a white sample.
  • the test sample is an unclassified network traffic
  • the random forest classifier obtained by the training is used to determine whether the network traffic is offensive or not.
  • the training process of the random forest classifier is the training process of multiple decision trees included in the random forest classifier.
  • a term frequency-inverse document frequency (term frequency-inverse document frequency, TF-IDF) technology is used to extract the characteristics of the sample.
  • TF-IDF term frequency-inverse document frequency
  • other feature extraction techniques are used to extract the features of the sample, which is not limited in the embodiment of the present application.
  • the prediction sample (for example, the second network traffic in the following embodiment) can be subsequently predicted based on the random forest classifier.
  • the specific process will be introduced in the following embodiment.
  • Step 203 The network protection device receives the second network traffic.
  • Step 204 The network protection device determines whether the second network traffic is offensive based on the target attack detection model.
  • the network protection device determines whether the second network traffic is offensive through step 2041 to step 2042.
  • Step 2041 The network protection device obtains second key data from the second network traffic.
  • the second key data is data obtained from the specified field of the analysis result after the network protection device performs protocol analysis on one or more packets contained in the second network traffic.
  • the second key data is data obtained from the HTTP payload field of the analysis result after the network protection device performs application layer protocol analysis on one or more packets contained in the second network traffic; or
  • the aforementioned second key data is the second network obtained after the network protection device performs application layer protocol analysis on one or more packets contained in the second network traffic of the network protection device, and reorganizes the HTTP payload field of the analysis result File data carried by the traffic.
  • the above second key data is that after the network protection device analyzes the packets contained in the second network traffic by the application layer protocol, the HTTP payload from the analysis result
  • the data obtained by the field, the data is a URL
  • the URL that is, the second key data
  • Step 2042 The network protection device inputs the second key data into the target attack detection model, and determines whether the second network traffic is offensive according to the output of the target attack detection model.
  • the second key data is input into the target attack detection model, and the network protection device uses the target attack detection model to reason about the second key data.
  • the target attack detection model outputs a reasoning result, and the reasoning result is the detection result of the second network traffic using the target attack detection model, that is, the second network traffic is offensive or the second network traffic is not offensive.
  • the foregoing process of determining whether the second network traffic is aggressive based on the target attack detection model corresponds to the foregoing process of training the target attack detection model. For example, if the target attack detection model is obtained based on the random forest algorithm, when determining whether the second network traffic is offensive according to the target attack detection model, the network protection equipment uses the corresponding random forest classifier to determine whether the second network traffic has Offensive.
  • the target attack detection model is the random forest classifier obtained by the above training.
  • the network protection device extracts multi-dimensional features from the second key data (similar to the above extraction The method of the multi-dimensional feature of each sample of the second sample set is similar), and then the multi-dimensional feature of the second key data is used as the input of the random forest classifier, and then the random forest classifier outputs the prediction result of the second network traffic, that is, the first Second, the network traffic is offensive or not.
  • the output result of the random forest classifier is a result of voting on the outputs of multiple decision trees included in the random forest classifier.
  • the network protection device inputs the second key data into the target attack detection model, and determines whether the second network traffic is offensive according to the output of the target attack detection model, which is called a detection method based on the attack detection model.
  • FIG. 2B is a schematic diagram of a process of implementing network attack detection by using the network attack detection method provided by an embodiment of the present application. Refer to FIG. 2B to further understand the steps described in the above embodiment.
  • the processing flow indicated by the label “1" in FIG. 2B is the processing flow of the first network traffic received by the network protection device, and the processing flow indicated by the label "2" in FIG. The processing flow of network traffic.
  • the network protection device after receiving the first network traffic, the network protection device first matches the first key data extracted from the first network traffic with the attack characteristics in the signature database. When it is determined that the first network traffic is offensive according to the matching result of the signature database, the first network traffic is added to the sample set as a black sample for training the target attack detection model. Then, feature extraction is performed on all samples in the sample set, and the extracted features are used for model training to obtain a target attack detection model, and the target attack detection model is used to update the attack detection model in the model library. When the network protection device receives the second network traffic, the network protection device performs feature extraction on the second network traffic (similar to the above-mentioned method for feature extraction on the samples in the sample set).
  • the target attack detection model (the latest attack detection model obtained from the model library, that is, the target attack detection model obtained based on the first network traffic), so as to determine the detection result according to the output of the target attack detection model (That is, whether the second network traffic is offensive).
  • the embodiment of the present application provides a method for detecting a network attack.
  • a network protection device obtains the first key data from the first network traffic received by the network protection device (the first key data is related to one or more of the first network traffic). After the protocol is analyzed for each message, the data obtained from the specified field of the analysis result), and the first key data is matched with the attack feature in the signature database to obtain the matching result, the matching result includes the first key data and Attack signatures included in the signature database. If the network protection device determines that the first network traffic is offensive according to the matching result, the network protection device obtains a target attack detection model based on the first network traffic. The target attack detection model is used to identify one or more attack characteristics, which are different from the attack characteristics in the signature database.
  • the network protection device determines whether the second network traffic is offensive based on the target attack detection model. Since the target attack detection model is obtained in real time based on the malicious traffic that continuously appears in the actual network environment where the network protection equipment is located, and the target attack detection model can identify more attack features that are not included in the signature database, the network protection equipment uses The target attack detection model detects subsequent network traffic, so that network protection equipment has certain detection capabilities for malicious traffic that attempts to evade detection through new variants, thereby improving the network adaptability and detection effect of the network protection equipment.
  • the network protection device matches the key data of the network traffic with the attack characteristics in the signature database, and determines whether the network traffic is offensive according to the matching result.
  • the network protection equipment For offensive network traffic (such as the above-mentioned first network traffic), the network protection equipment performs localized attack detection model training based on the offensive network traffic (that is, the attack detection model training is performed on the network protection equipment), and Compared with the prior art transmitting a large amount of known malicious traffic to the cloud for attack detection model training, in the embodiment of the present application, there is no need to transmit the network traffic to the cloud for training, which can ensure that data privacy is not leaked.
  • step 2042 that is, the network protection device inputs the second key data into the target attack detection model, and according to the output of the target attack detection model, it is determined whether the second network traffic has (Aggressiveness)
  • the network attack detection method provided in the embodiment of the present application further includes step 2042':
  • Step 2042' the network protection device matches the second key data with the attack characteristics in the signature database to obtain a second matching result, and determines that the second network traffic is not offensive according to the second matching result.
  • the network protection device matches the second key data with the attack features in the signature database to obtain a second matching result. If the second matching result is empty, the network protection device determines that the second network traffic is not offensive.
  • the second key data is data obtained from the designated field of the analysis result after the network protection device performs protocol analysis on one or more packets included in the second network traffic.
  • the process of matching the second key data with the attack characteristics in the signature database is similar to the process of matching the first key data with the attack characteristics in the signature database in step 201. Therefore, for step 2042'
  • step 201 in the above-mentioned embodiment, which will not be repeated here.
  • the network protection device after receiving the second network traffic, the network protection device first detects the second network traffic for the first time through the feature matching-based detection method in step 2042'. After the first detection, if the network protection device determines that the second network traffic is not offensive, the network protection device performs a second detection on the second network traffic through the detection method based on the attack detection model in step 2042. , And determine whether the second network traffic is offensive according to the output of the attack detection model. In this way, using the attack detection model as a supplement to the signature database can improve the detection effect of network attack detection to a certain extent, and more reliably detect whether there is malicious traffic in the network.
  • the above second key data is the URL obtained by parsing the second network traffic:
  • the signature database contains one or more attack characteristics, and the one or more attack characteristics is referred to as the first attack characteristic.
  • the target attack detection model can identify one or more attack features, and the one or more attack features are called the second attack feature. Combining the description of the foregoing embodiment, it can be seen that the first attack feature is different from the second attack feature.
  • the network protection device transmits a message containing the first attack feature
  • the first attack feature is easy to be tampered with (for example, after being renamed, coded, etc.). ).
  • the second attack characteristic is not easy to be tampered with.
  • the first key data obtained from the first network traffic is:
  • the second key number obtained from the second network traffic is:
  • the second key data does not include the first attack feature.
  • the detection method based on feature matching has no effect on the second network.
  • the attacker may execute the "select top 1password from[admin]" statement in the above URL to obtain the user name, resulting in a successful attack.
  • the network protection device continues to detect the second network traffic based on the target attack detection model, because the target attack detection model can identify "select” , “Top”, “password”, "admin”, so the detection result of the network protection device is: the second network traffic is offensive.
  • the network protection device determines that the second network traffic is offensive according to the second matching result, the network protection device omits performing the above step 2042 and related steps after step 2042, and directly according to the following
  • the described first preset action is an action response to the second network traffic.
  • Network protection equipment usually contains two independent functional modules, which are called signature database matching engine and model matching module.
  • the signature database matching engine is used to match key data with the attack signatures in the signature database.
  • the model matching module is used to determine whether the network traffic is offensive based on the attack detection model.
  • the performance of the signature database matching engine is generally higher than that of the model matching module. Therefore, in the network traffic processing flow, the above signature database matching engine is placed in front of the above model matching module. If the signature database matching engine can directly judge The network traffic is offensive, so the model matching module is omitted to process the network traffic, which can significantly improve the processing performance of network protection equipment and reduce the transmission delay caused by security protection.
  • the network protection device when the network protection device determines that the second network traffic is offensive according to the signature database, the network protection device adds the second network traffic to the sample set to update the attack detection model again.
  • the network protection device performs the following process: the network protection device obtains a new target attack detection model based on the second network traffic, and updates the attack detection model (that is, replaces the target obtained based on the first network traffic with the new target attack detection model Attack detection model). After that, the network protection device continues to detect the next network traffic (such as the third network traffic) received by the network protection device, and the network protection device determines the target attack detection model based on the new target attack detection model (the attack detection model obtained based on the second network traffic) Whether the next network traffic received by the network protection device is offensive.
  • the next network traffic such as the third network traffic
  • the network attack detection method provided in the embodiment of the present application further includes step 204'.
  • Step 204' In a case where the network protection device determines that the second network traffic is offensive based on the target attack detection model, the network protection device responds to the second network traffic according to the first preset action.
  • Step 200 to step 204, step 2021, step 2022, step 2041, step 2042', and step 2042 in FIG. 2D are similar to the implementation in FIG. 2C, and the description will not be repeated here.
  • the network protection device detects the network traffic flowing through the network protection device, and can respond to the network traffic flowing through the network protection device according to the detection result and the preset action.
  • the first preset action is used for the network protection device to respond to aggressive network traffic
  • the second preset action is used for the network protection device to respond to non-aggressive network traffic.
  • the network protection device detects that the network traffic flowing through the network protection device is offensive
  • the network protection device responds to the network traffic according to the first preset action.
  • the network protection device detects that the network traffic flowing through the network protection device is not aggressive (that is, non-aggressive)
  • the network protection device responds to the network traffic according to the second preset action.
  • the first preset action includes blocking or warning
  • the second preset action includes releasing.
  • first predetermined action or second predetermined action in the embodiment of the present application can be replaced with another action, which is not limited in the embodiment of the present application.
  • first preset action can be replaced with release.
  • the network protection device determines that the second network traffic is offensive and the first preset action is blocking, the network protection device performs the first preset action on the second network
  • the traffic response to the action includes: the network protection device stops sending the second network traffic to the next hop device of the network protection device. In this way, the network protection device can prevent the second network traffic from flowing from the network protection device to the next hop device of the network protection device, further avoiding the second network traffic from continuing to flow into other devices in the network, and can prevent network attacks in time.
  • step 204' in an implementation manner, if the network protection device determines that the second network traffic is offensive, and the first preset action is an alarm, the network protection device responds to the second network traffic according to the first preset action
  • the action response includes the following method A, method B, or method C.
  • Method A The network protection device outputs alarm information through an output device, and receives an indication returned for the alarm information.
  • the foregoing instructions for returning the alarm information include a first instruction and a second instruction.
  • the network protection device stops sending the second network traffic to the next hop device of the network protection device.
  • the network protection device sends the second network traffic to the next hop device of the network protection device.
  • the response of the network protection device in method A is an online response method, that is, after the network protection device outputs the alarm information, it waits for the user's feedback on the alarm information (that is, the above-mentioned first and second instructions), and then according to the user's Feedback and take corresponding actions.
  • Method B The network protection device outputs alarm information through the output device, and stops sending the second network traffic to the next hop device of the network protection device.
  • Method C The network protection device outputs the alarm information through the output device, and sends the second network traffic to the next hop device of the network protection device.
  • the response of the network protection equipment in methods B and C is an offline response method, that is, after the network protection equipment outputs alarm information (the alarm information is only used to notify the user), the network protection equipment does not need to wait for the user's feedback on the alarm information , But respond in time according to preset actions.
  • the network attack detection method provided in the embodiment of the present application further includes step 204".
  • Step 204" in the case that the network protection device determines that the second network traffic is not offensive based on the target attack detection model, the network protection device responds to the second network traffic according to the second preset action.
  • the second preset action is used for the network protection device to respond to non-aggressive network traffic, and the second preset action includes release.
  • step 204" in one implementation, if the network protection device determines that the second network traffic is not offensive and the first preset action is the direction, the network protection device performs the second preset action on the second network traffic.
  • Performing an action response includes: the network protection device sends the second network traffic to the next hop device of the network protection device.
  • Step 200 to step 204, step 2021, step 2022, step 2041, step 2042', and step 2042 in FIG. 2E are similar to the implementation in FIG. 2C, and the description will not be repeated here.
  • the network protection device determines whether the second network traffic is offensive based on the target attack detection model, and responds with corresponding actions. After that, the network protection device continues to use the network attack detection method provided in the embodiment of this application. The next network traffic received by the network protection device performs network attack detection.
  • the network protection device when the network protection device matches the above-mentioned first key data (the first key data is obtained from the first network traffic) with the attack characteristics in the signature database, and the matching result indicates When the key data does not include the attack feature in the signature database, the network protection device releases the packet contained in the first network traffic buffered in the network protection device.
  • step 201 that is, the network protection device matches the first key data with the attack characteristics in the signature database to obtain the first matching result
  • the attack detection method provided by the embodiment of the present application It also includes step 201':
  • Step 201' If the network protection device determines that the first network traffic is aggressive according to the first matching result, the network protection device responds to the first network traffic according to the first preset action.
  • Step 200 to step 204, step 2021, step 2022, step 2041, step 2042', and step 2042 in FIG. 2F are similar to the implementation in FIG. 2C, and the description will not be repeated here.
  • the network protection device when the network protection device determines that the first network traffic is offensive according to the first matching result, the network protection device performs step 202 (obtaining a target attack detection model based on the first network traffic) and also performs step 201'. It should be noted that the embodiment of this application does not limit the order in which the network protection device performs step 202 and step 201', that is, network protection first performs step 202 and then step 201', or first performs step 201' and then performs step 202, or both Step 202 and step 201' are performed.
  • the network protection device determines whether the first network traffic is aggressive based on the original attack detection model.
  • the original attack detection model is obtained by training the above-mentioned first sample set based on a predetermined algorithm.
  • the network protection device after the network protection device receives the first network traffic, the network protection device first detects the first network traffic based on the feature matching detection method. After the first detection, if the network protection equipment determines that the first network traffic is not offensive, the network protection equipment performs a second detection on the first network traffic based on the original attack detection model; and according to the output of the original attack detection model , Determine whether the first network traffic is offensive, and then the network protection device responds to the first network traffic with corresponding actions.
  • the above-mentioned original attack detection model is actually based on the sample set pre-stored by the network protection device (the sample set pre-stored by different network protection devices can be the same , Can also be different)
  • the original attack detection model obtained by training.
  • the above-mentioned original attack detection model may be the original attack detection model, or it may be trained based on the updated sample set based on the pre-saved sample set , Another attack detection model that is different from the original attack detection model, which is not limited in the embodiment of this application.
  • the update of the attack detection model is performed in real time.
  • the network protection device determines the offensive network traffic according to the signature database, it immediately adds the offensive network traffic as a new black sample to the sample.
  • the set thus updates the sample set, and retrains the attack detection model based on the updated sample set.
  • the update of the attack detection model is performed periodically. For example, every time the network protection device determines the offensive network traffic according to the signature database, it immediately adds the offensive network traffic as a new black sample to the sample.
  • the collection thus updates the sample set, and the network protection equipment regularly retrains the attack detection model according to the updated sample set according to a set cycle (for example, every 24 hours or every week).
  • the network protection device when the network protection device determines that the first network traffic is offensive based on the original attack detection model, the network protection device responds to the first network traffic according to the first preset action. In the case that the network protection device determines that the first network traffic is not offensive based on the original attack detection model, the network protection device responds to the first network traffic according to the second preset action.
  • the network protection device since the process of the network protection device's action response to the first network traffic is similar to the process of the network protection device's action response to the above-mentioned second network traffic, the network protection device acts on the first network traffic.
  • the description of the response reference may be made to the relevant description of the above-mentioned embodiment, which will not be repeated here.
  • FIG. 3 is a schematic structural diagram of a network protection device provided by an embodiment of the present application.
  • the network protection device 300 shown in FIG. 3 is an integrated device of the firewall and the analysis device in the application scenario shown in FIG. Network protection equipment.
  • the network protection device 300 includes at least one processor 301 and a memory 302.
  • the processor 301 includes one or more central processing units (CPU).
  • the CPU is a single-core CPU (single-CPU) or a multi-core CPU (multi-CPU).
  • the memory 302 includes but is not limited to random access memory (RAM), read only memory (ROM), erasable programmable read-only memory (erasable programmable read-only memory, EPROM), fast Flash memory, or optical memory, etc.
  • RAM random access memory
  • ROM read only memory
  • EPROM erasable programmable read-only memory
  • fast Flash memory or optical memory, etc.
  • the code of the operating system is stored in the memory 302.
  • the processor 301 implements the method in the foregoing embodiment by reading instructions stored in the memory 302, or the processor 301 implements the method in the foregoing embodiment by using internally stored instructions.
  • the processor 301 implements the method in the foregoing embodiment by reading the instructions stored in the memory 302
  • the memory 302 stores instructions for implementing the network attack detection method provided in the embodiments of the present application.
  • the network protection device 300 After the program code stored in the memory 302 is read by the at least one processor 301, the network protection device 300 performs the following operations: obtains the first key data from the first network traffic, and compares the first key data with the attack characteristics in the signature database Perform matching to obtain a first matching result.
  • the first key data is data obtained from a specified field of the analysis result after protocol analysis of one or more packets contained in the first network traffic.
  • the first matching result includes The first key data and the attack signature contained in the signature database; if the network protection device determines that the first network traffic is offensive according to the first matching result, a target attack detection model is obtained based on the first network traffic, and the target attack detection model is used for Identify one or more attack characteristics, the one or more attack characteristics are different from the attack characteristics in the signature database; and then determine whether the second network traffic is offensive based on the target attack detection model.
  • the network protection device 300 shown in FIG. 3 further includes a network interface 303.
  • the network interface 303 is a wired interface, such as a fiber distributed data interface (FDDI) or a gigabit ethernet (GE) interface.
  • the network interface 303 is a wireless interface.
  • the network interface 303 is used to receive network traffic, such as the aforementioned first network traffic and the second network traffic.
  • the network interface 303 is configured to send network traffic to other devices in the network according to the determination result of the processor 301 on whether the network traffic is offensive.
  • the memory 302 is used to store the network traffic received by the network interface 303.
  • the memory 302 is also used to store a sample set (used to train an attack detection model) and an attack detection model.
  • At least one processor 301 further executes the method described in the foregoing method embodiment according to the entries stored in the memory 302. For more details of the processor 301 implementing the foregoing functions, please refer to the descriptions in the foregoing method embodiments, and will not be repeated here.
  • the network protection device 300 further includes a bus 304, and the aforementioned processor 301 and the memory 302 are usually connected to each other through the bus 304, or are connected to each other in other ways.
  • the network protection device 300 further includes an input and output interface 305, which is used to connect with an input device to receive detection requirements input by the user through the input device (for example, to detect network traffic of a specified protocol, network traffic of a specified network segment ).
  • Input devices include but are not limited to keyboards, touch screens, microphones, etc.
  • the input and output interface 305 is also used to connect to an output device and output the detection result of the processor 301 (that is, whether the network traffic is aggressive).
  • Output devices include but are not limited to displays, printers, etc.
  • the network protection equipment provided in the embodiments of the present application is used to execute the network attack detection methods provided in the foregoing method embodiments. Since the target attack detection model obtained by the network protection device based on the first network traffic can identify more attack characteristics, the network protection device performs attack detection on the second network traffic based on the target attack detection model, which can improve the detection effect of the network attack detection.
  • Fig. 4 is a schematic structural diagram of a network attack detection device provided by an embodiment of the present application.
  • the network attack detection device 400 includes a detection module 401, an analysis module 402, and a receiving module 403.
  • the detection module 401 is configured to obtain the first key data from the first network traffic received by the receiving module 403, and to match the first key data with the attack characteristics in the signature database to obtain the first matching result, the first key data It is the data obtained from the specified field of the analysis result after the detection module 401 performs protocol analysis on one or more packets contained in the first network traffic.
  • the first matching result contains the first key data and the signature database contains both Attack characteristics.
  • the aforementioned specified field is the Hypertext Transfer Protocol HTTP payload of one or more packets
  • the first key data is after the detection module 401 performs application layer protocol analysis on one or more packets contained in the first network traffic, Data obtained from the HTTP payload field of the analysis result.
  • the first key data is the first network traffic carried by the detection module 401 after the detection module 401 performs application layer protocol analysis on one or more packets contained in the first network traffic, and reorganizes the HTTP payload field of the analysis result.
  • File data is the Hypertext Transfer Protocol HTTP payload of one or more packets
  • the analysis module 402 is configured to obtain a target attack detection model based on the first network traffic when the detection module 401 determines that the first network traffic is offensive according to the first matching result, and the target attack detection model is used to identify one or more Attack characteristics, the one or more attack characteristics are different from the attack characteristics in the signature database.
  • the receiving module 403 is configured to receive the second network traffic.
  • the detection module 401 is further configured to determine whether the second network traffic is offensive based on the target attack detection model.
  • the detection module 401 is specifically configured to obtain the second key data from the second network traffic, input the second key data into the target attack detection model, and determine whether the second network traffic has the output of the target attack detection model. Aggressiveness.
  • the second key data is data obtained from the designated field of the analysis result after the detection module 401 performs protocol analysis on one or more packets contained in the second network traffic.
  • the above specified field is the Hypertext Transfer Protocol HTTP payload of one or more packets
  • the second key data is after the detection module 401 performs application layer protocol analysis on one or more packets contained in the second network traffic, Data obtained from the HTTP payload field of the analysis result, or, the second key data is that the detection module 401 performs application layer protocol analysis on one or more packets contained in the second network traffic, and analyzes the HTTP payload field of the analysis result After the reorganization, the file data carried by the second network traffic is obtained.
  • the detection module 401 is further configured to match the second key data with the attack characteristics in the signature database to obtain a second matching result, and determine that the second network traffic is not aggressive according to the second matching result.
  • the second matching result includes the second key data and the attack features included in the signature database.
  • the network protection device 400 further includes a processing module 404.
  • the processing module 404 is configured to perform an action response to the second network traffic according to the first preset action when the detection module 401 determines that the second network traffic is offensive based on the target attack detection model.
  • the first preset action includes blocking or warning.
  • the network attack detection apparatus 400 provided in the embodiment of the present application further includes a sending module 405.
  • the processing module 404 is specifically configured to control the sending module 405 to stop sending the second network traffic to the next hop device of the network protection device.
  • the processing module 404 is specifically configured to control the sending module 405 to output the alarm information through the output device, and control the receiving module 403 to receive an instruction for the return of the alarm information.
  • the instruction includes the first instruction or the second instruction. instruct.
  • the sending module 405 stops sending the second network traffic to the next hop device of the network protection device.
  • the sending module 405 sends the second network traffic to the next hop device of the network protection device.
  • the processing module 404 is specifically configured to control the sending module 405 to output alarm information through the output device, and stop sending the second network traffic to the next hop device of the network protection device.
  • the processing module 404 is specifically configured to control the sending module 405 to output the alarm information through the output device, and send the second network traffic to the next hop device of the network protection device.
  • the processing module 404 is further configured to perform an action response to the second network traffic according to the second preset action when the detection module 401 determines that the second network traffic is not aggressive based on the target attack detection model.
  • the second preset action is release.
  • the processing module 404 is specifically configured to control the sending module 405 to send the second network traffic to the next hop device of the network protection device.
  • the analysis module 402 is specifically configured to add the first network traffic as a black sample to the first sample set, thereby obtaining a second sample set.
  • the first sample set includes at least one black sample; and based on a predetermined algorithm , Train the second sample set to obtain the target attack detection model.
  • the detection module 401 is further configured to determine whether the first network traffic is offensive based on the original attack detection model when it is determined that the first network traffic is not offensive according to the first matching result, the original attack detection model It is obtained by training the first sample set based on a predetermined algorithm.
  • the device embodiment described in FIG. 4 is only schematic.
  • the division of the above-mentioned modules is only a logical function division, and there may be other division methods in actual implementation, for example, multiple modules or components can be combined or integrated. To another system, or some features can be ignored, or not implemented.
  • the functional modules in the various embodiments of the present application may be integrated into one processing module, or each module may exist alone physically, or two or more modules may be integrated into one module.
  • the above-mentioned modules in Figure 4 can be implemented in the form of hardware or software functional units.
  • the detection module 401, the analysis module 402, and the processing module 404 may be implemented by software function modules generated by at least one processor 301 in FIG. 3 after reading the program code stored in the memory.
  • the above-mentioned modules in FIG. 4 can also be implemented by different hardware in the network protection equipment.
  • the detection module 401 and the analysis module 402 are implemented by a part of the processing resources in the at least one processor 301 in FIG. 3 (for example, one of the multi-core processors). Core or two cores), and the processing module 404 is implemented by the remaining processing resources of at least one processor 301 in FIG. 3 (for example, other cores in a multi-core processor), or a field-programmable gate array Array, FPGA), or a programmable device such as a coprocessor.
  • the receiving module 403 and the sending module 405 are implemented by the network interface 303 in FIG. 3.
  • the above functional modules can also be implemented by a combination of software and hardware.
  • the analysis module 402 is implemented by a hardware programmable device, and the detection module 401 and the processing module 404 are generated by the CPU after reading the program code stored in the memory.
  • Software function module is implemented by a hardware programmable device.
  • the above embodiments it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • a software program it can be implemented in the form of a computer program product in whole or in part.
  • the computer program product includes one or more computer instructions.
  • the computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instruction may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer instruction may be transmitted from a website, computer, server, or data center through a cable (Such as coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (such as infrared, wireless, microwave, etc.) to another website, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center integrated with one or more available media.
  • the usable medium can be a magnetic medium (for example, a floppy disk, a magnetic disk, a tape), an optical medium (for example, a digital video disc (DVD)), or a semiconductor medium (for example, a solid state drive (SSD)), etc. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Data Mining & Analysis (AREA)
  • Artificial Intelligence (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Evolutionary Computation (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Databases & Information Systems (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Evolutionary Biology (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Medical Informatics (AREA)
  • Software Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种网络攻击检测方法及装置，涉及计算机网络技术领域，能够提升网络防护设备的网络适应性和检测效果。该方法包括：网络防护设备从接收的第一网络流量中获取第一关键数据，并将第一关键数据与特征库中的攻击特征进行匹配从而获得第一匹配结果。第一匹配结果包含第一关键数据和特征库中均包含的攻击特征。如果网络防护设备根据第一匹配结果确定第一网络流量不具有攻击性，网络防护设备基于第一网络流量获得目标攻击检测模型。目标攻击检测模型用于识别一个或多个攻击特征，该一个或多个攻击特征与特征库中的攻击特征不同。当网络防护设备接收第二网络流量时，网络防护设备基于目标攻击检测模型确定第二网络流量是否具有攻击性。

Description

一种网络攻击检测方法及装置
本申请要求于2020年03月31日提交国家知识产权局、申请号为202010245563.2、申请名称为“一种网络攻击检测方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及计算机网络技术领域，进一步涉及人工智能(artificial intelligence，AI)技术在计算机网络领域中的应用，尤其涉及一种网络攻击检测方法及装置。
背景技术
网络防护设备(例如安全网关设备或者防火墙)通过对流经该网络防护设备的流量进行检测从而确认网络是否存在入侵攻击或恶意通信等攻击行为，并在存在攻击行为的情况下及时地阻断攻击行为以保证网络安全。
目前，网络防护设备通过应用入侵防御系统(intrusion prevention system，IPS)技术或反病毒(anti-virus，AV)技术进行网络攻击检测和防护。例如，IPS技术主要用于检测恶意流量(或称为攻击流量)，AV技术主要用于检测恶意文件。采用IPS技术和AV技术进行网络攻击检测的方法是类似的，包括：网络防护设备的特征库中预先存储网络安全解决方案提供商提取的大量已知恶意流量或恶意文件的攻击特征；网络防护设备提取到达该网络防护设备的流量或文件的关键内容，然后将提取的关键内容与特征库中预先存储的攻击特征进行比对，若提取的关键内容中包含特征库中的攻击特征，则确定该流量或文件具有攻击性。
然而，上述方法中，由于网络防护设备的特征库中包含的攻击特征是基于已知的(或常见的)恶意流量或恶意文件提取的，对于未知的恶意流量或恶意文件(或者在已知的恶意流量或恶意文件的基础上经过特征变形的恶意流量或恶意文件)的检测效果不佳。如此，可能使得网络安全存在较大的威胁。
发明内容
本申请实施例提供一种网络攻击检测方法及装置，能够提升网络防护设备的网络适应性和检测效果。
为达到上述目的，本申请实施例采用如下技术方案：
第一方面，本申请实施例提供一种网络攻击检测方法，能应用于入侵防御系统(IPS)，阻止恶意流量(即防御恶意攻击)。也能应用于反病毒(AV)，阻止恶意文件(即防御病毒)。该方法包括：网络防护设备从接收的第一网络流量中获取第一关键数据，并且将该第一关键数据与特征库中的攻击特征进行匹配从而获得第一匹配结果。该第一关键数据是网络防护设备对第一网络流量中包含的一个或多个报文进行协议解析后，从解析结果的指定字段中获得的数据。第一匹配结果包含第一关键数据和特征库中均包含的攻击特征。如果网络防护设备根据第一匹配结果确定第一网络流量具有攻击性，网络防护设备基于第一网络流量获得目标攻击检测模型。该目标攻击 检测模型用于识别一个或多个攻击特征，该一个或多个攻击特征与特征库中的攻击特征不同。然后网络防护设备接收第二网络流量，并且网络防护设备基于目标攻击检测模型确定第二网络流量是否具有攻击性。
本申请实施例中，在网络防护设备进行网络攻击检测之前，网络防护设备上预先存储有特征库。特征库包含网络安全解决方案提供商提供的多种已知攻击特征。网络防护设备接收到第一网络流量之后，首先将从第一网络流量中提取的第一关键数据与特征库中的攻击特征进行匹配，根据匹配结果确定第一网络流量是否具有攻击性。如果根据特征库的匹配结果确定第一网络流量具有攻击性，则将第一网络流量作为用于训练目标攻击检测模型的黑样本从而获取目标攻击检测模型。目标攻击检测模型能够识别出未包含在特征库中的新的攻击特征，而这些新的攻击特征可能是与网络防护设备所部署的网络环境中的实际网络流量密切相关的。网络防护设备根据训练得到的目标攻击检测模型对流经该网络防护设备的后续流量进行检测。本申请实施例中，上述目标攻击检测模型是根据网络防护设备所处的实际网络环境中不断出现的恶意流量实时获取的，网络防护设备利用目标攻击检测模型对后续网络流量进行检测，使得网络防护设备对一些通过新的变形试图规避检测的恶意流量具有一定的检测能力，从而提升网络防护设备的网络适应性和检测效果。
可选地，网络防护设备中预先存储有攻击检测模型，该攻击检测模型是根据由大量已知恶意流量(包括通过报文发起网络攻击的流量、或者承载恶意文件的流量)构成的样本集(或样本库)训练得到的攻击检测模型。在网络防护设备检测网络流量的过程中，网络防护设备会更新攻击检测模型。例如，如果第一网络流量具有攻击性，则网络防护设备将第一网络流量作为一个新的黑样本加入样本集，基于更新后的样本集获得目标攻击检测模型，并使用该目标攻击检测模型更新模型库中的攻击检测模型，即使用目标攻击检测模型替换已有的攻击检测模型。为了便于描述，本申请实施例中，将更新前的攻击检测模型称为原攻击检测模型，如此，原攻击检测模型不断地被基于新的样本集训练得到的目标攻击检测模型替换。
可选地，上述网络防护设备将第一关键数据与特征库中的攻击特征进行匹配具体包括：网络防护设备确定该第一关键数据中是否包含特征库中的攻击特征。具体的，网络防护设备分别将第一关键数据与特征库中的各攻击特征进行对比，若第一关键数据中包含特征库中的某一攻击特征，则记录下该攻击特征，从而得到第一匹配结果。该第一匹配结果包含匹配中的攻击特征，即第一关键数据和特征库中均包含的攻击特征。网络防护设备根据匹配中的攻击特征，基于攻击判别策略，确定第一网络流量是否具有攻击性。
进一步的，本申请实施例提供的网络攻击检测方法，网络防护设备将网络流量的关键数据与特征库中的攻击特征进行匹配，并根据匹配结果确定网络流量是否具有攻击性。对具有攻击性的网络流量(例如第一网络流量)，网络防护设备基于具有攻击性的网络流量进行本地化的攻击检测模型训练(即在该网络防护设备上进行攻击检测模型训练)，与现有技术中将大量的已知恶意流量传输至云端进行攻击检测模型训练相比，本申请实施例中，无需将该网络流量传输至云端进行训练，如此能够保证数据隐私不被泄露。
一种可能的实现方式中，上述网络防护设备基于目标攻击检测模型，确定第二网络流量是否具有攻击性具体包括：网络防护设备从第二网络流量中获取第二关键数据，将该第二关键数据输入目标攻击检测模型，并根据目标攻击检测模型的输出，确定第二网络流量是否具有攻击性。该第二关键数据是网络防护设备对第二网络流量中包含的一个或者多个报文进行协议解析后，从解析结果的指定字段中获得的数据。
具体的，将该第二关键数据输入目标攻击检测模型，网络防护设备使用该目标攻击检测模型对第二关键数据进行推理。该目标攻击检测模型输出推理结果，该推理结果也就是采用目标攻击检测模型对第二网络流量的检测结果，即该第二网络流量具有攻击性或者该第二网络流量不具有攻击性。
本申请实施例中，上述基于目标攻击检测模型确定第二网络流量是否具有攻击性的过程与上述训练目标攻击检测模型的过程是相对应的，例如，目标攻击检测模型是基于随机森林算法得到的，则根据目标攻击检测模型确定第二网络流量是否具有攻击性时，网络防护设备采用对应的随机森林分类器确定该第二网络流量是否具有攻击性。
一种可能的实现方式中，上述指定字段是网络流量包含的一个或者多个报文的超文本传输协议(hypertext transfer protocol，HTTP)载荷。具体的，第一关键数据是网络防护设备对第一网络流量中包含的一个或者多个报文进行应用层协议解析后，从解析结果的HTTP载荷字段中获得的数据。第二关键数据是网络防护设备对第二网络流量中包含的一个或者多个报文进行应用层协议解析后，从解析结果的HTTP载荷字段中获得的数据。
一种可能的实现方式中，上述指定字段是网络流量包含的一个或者多个报文的HTTP载荷。具体的，上述第一关键数据是网络防护设备对第一网络流量中包含的一个或者多个报文进行应用层协议解析，并对解析结果的HTTP载荷字段进行重组后，获得的第一网络流量承载的文件数据。上述第二关键数据是网络防护设备对第二网络流量中包含的一个或者多个报文进行应用层协议解析，并对解析结果的HTTP载荷字段进行重组后，获得的第二网络流量承载的文件数据。
一种可能的实现方式中，在网络防护设备将第二关键数据输入目标攻击检测模型，并根据目标攻击检测模型的输出，确定第二网络流量是否具有攻击性之前，本申请实施例提供的网络攻击检测方法还包括：网络防护设备将第二关键数据与特征库中的攻击特征进行匹配从而获得第二匹配结果，并且根据第二匹配结果确定第二网络流量不具有攻击性。第二匹配结果包含第二关键数据和特征库中均包含的攻击特征。
网络防护设备将第二关键数据与特征库中的攻击特征进行匹配从而获得第二匹配结果，该第二匹配结果为空，则网络防护设备确定第二网络流量不具有攻击性。
本申请实施例中，网络防护设备接收到第二网络流量之后，首先基于特征匹配的检测方法对该第二网络流量进行第一次检测。经过第一检测之后，若网络防护设备确定该第二网络流量不具有攻击性的，则网络防护设备再基于攻击检测模型的检测方法对第二网络流量进行第二次检测，并根据攻击检测模型的输出，确定该第二网络流量是否具有攻击性。如此，将攻击检测模型作为特征库的补充，在一定程度上能够提升网络攻击检测的检测效果，更加可靠地检测网络中是否存在恶意流量。
一种可能的实现方式中，本申请实施例提供的网络攻击检测方法还包括：在网络 防护设备基于目标攻击检测模型确定第二网络流量具有攻击性的情况下，该网络防护设备按照第一预设动作对第二网络流量进行动作响应。第一预设动作用于网络防护设备对具有攻击性的网络流量进行动作响应。
一种可能的实现方式中，上述第一预设动作包括阻断或告警。
当第一预设动作为阻断时，网络防护设备按照第一预设动作对第二网络流量进行动作响应具体包括：网络防护设备停止向该网络防护设备的下一跳设备发送第二网络流量。如此，网络防护设备能够阻止第二网络流量从网络防护设备流入该网络防护设备的下一跳设备，进一步避免第二网络流量继续流入网络中的其他设备，能够及时阻止网络攻击。
当第一预设动作为告警时，该网络防护设备按照第一预设动作信息对第二网络流量进行动作响应具体包括：网络防护设备通过输出设备输出告警信息，并接收针对该告警信息返回的指示。该指示包括第一指示和第二指示。当该指示为第一指示时，网络防护设备停止向该网络防护设备的下一跳设备发送第二网络流量。当该指示为第二指示时，网络防护设备向该网络防护设备的下一跳设备发送第二网络流量。此时，网络防护设备的响应是一种在线的响应方式，即网络防护设备输出告警信息之后，等待用户对于该告警信息的反馈(即上述第一指示和第二指示)，然后再根据用户的反馈进行相应的动作。
或，当第一预设动作为告警时，该网络防护设备通过输出设备输出告警信息，并停止向该网络防护设备的下一跳设备发送第二网络流量。或，该网络防护设备通过输出设备输出告警信息，并向该网络防护设备的下一跳设备发送第二网络流量。此时，网络防护设备的响应是一种离线的响应方式，即网络防护设备输出告警信息(该告警信息仅用于通知用户)之后，网络防护设备无需等待用户对该告警信息的反馈，而是根据预先设定的动作及时进行响应。
一种可能的实现方式中，本申请实施例提供的网络攻击检测方法还包括：在网络防护设备基于目标攻击检测模型确定第二网络流量不具有攻击性的情况下，该网络防护设备按照第二预设动作对第一网络流量进行动作响应。该第二预设动作用于网络防护设备对无攻击性的网络流量进行动作响应。
一种可能的实现方式中，第二预设动作为放行。上述网络防护设备按照第二预设动作对第二网络流量进行动作响应具体包括：网络防护设备向该网络防护设备的下一跳设备发送第二网络流量。
一种可能的实现方式中，上述网络防护设备基于第一网络流量获得目标攻击检测模型的方法具体包括：网络防护设备将第一网络流量作为一个黑样本加入第一样本集，从而得到第二样本集。并且网络防护设备基于预定算法，对第二样本集进行训练，得到目标攻击检测模型。该第一样本集中包括至少一个黑样本。
可选地，为了提高机器学习(或人工智能)算法的精确性，例如对于不同类别样本聚类的准确性，第一样本集中还包括至少一个白样本。
可选地，本申请实施例中，上述预定算法为机器学习算法或人工智能算法中的一种，例如决策树、随机森林、贝叶斯、卷积神经网络(convolutional neural network，CNN)、深度神经网络(deep neural networks，DNN)等算法。
预定算法为随机森林算法时，基于随机森林算法训练得到的目标攻击检测模型即为随机森林分类器，该随机森林分类器用于对测试样本进行分类，即确定测试样本是黑样本还是白样本。在本申请实施例中，该测试样本为网络流量，该训练得到的随机森林分类器用于确定该网络流量具有攻击性，还是不具有攻击性。应理解，随机森林分类器的训练过程即就是随机森林分类器包含的多个决策树的训练过程。
一种可能的实现方式中，本申请实施例提供的网络攻击检测方法还包括：如果网络防护设备根据第一匹配结果确定第一网络流量具有攻击性，网络防护设备按照第一预设动作对第一网络流量进行动作响应。
一种可能的实现方式中，本申请实施例提供的网络攻击检测方法还包括：如果网络防护设备根据第一匹配结果确定第一网络流量不具有攻击性，网络防护设备基于原攻击检测模型确定第一网络流量是否具有攻击性。该原攻击检测模型是基于预定算法，对第一样本集训练得到的。
上述第一匹配结果为空时，即第一关键数据中不包含特征库中的攻击特征时，网络防护设备确定第一网络流量不具有攻击性。
第二方面，本申请实施例提供一种网络攻击检测装置，包括：检测模块、分析模块以及接收模块。其中，检测模块用于从接收模块接收的第一网络流量中获取第一关键数据，并且将第一关键数据与特征库中的攻击特征进行匹配从而获得第一匹配结果。第一关键数据是检测模块对第一网络流量包含的一个或多个报文进行协议解析后，从解析结果的指定字段中获得的数据。第一匹配结果包含第一关键数据和特征库中均包含的攻击特征。分析模块用于在检测模块根据第一匹配结果确定第一网络流量具有攻击性的情况下，基于第一网络流量获得目标攻击检测模型。目标攻击检测模型用于识别一个或多个攻击特征，该一个或多个攻击特征与特征库中的攻击特征不同。接收模块用于接收第二网络流量。确定模块用于基于目标攻击检测模型确定第二网络流量是否具有攻击性。
一种可能的实现方式中，上述检测模块具体用于从第二网络流量中获取第二关键数据，将第二关键数据输入目标攻击检测模型，并根据目标攻击检测模型的输出，确定第二网络流量是否具有攻击性。该第二关键数据是检测模块对第二网络流量中包含的一个或多个报文进行协议解析后，从解析结果的指定字段中获得的数据。
一种可能的实现方式中，上述指定字段是网络流量包含的一个或多个报文的HTTP载荷。具体的，第一关键数据是检测模块对第一网络流量中包含的一个或者多个报文进行应用层协议解析后，从解析结果的HTTP载荷字段中获得的数据。第二关键数据是检测模块对第二网络流量中包含的一个或多个报文进行应用层协议解析后，从解析结果的HTTP载荷字段中获得的数据。
一种可能的实现方式中，上述指定字段是网络流量包含的一个或者多个报文的HTTP载荷。具体的，第一关键数据是检测模块对第一网络流量中包含的一个或者多个报文进行应用层协议解析，并对解析结果的HTTP载荷字段进行重组后，获得的第一网络流量承载的文件数据。第二关键数据是检测模块对第二网络流量中包含的一个或者多个报文进行应用层协议解析，并对解析结果的HTTP载荷字段进行重组后，获得的第二网络流量承载的文件数据。
一种可能的实现方式中，上述检测模块还用于将第二关键数据与特征库中的攻击特征进行匹配从而获得第二匹配结果，并且根据第二匹配结果确定第二网络流量不具有攻击性。第二匹配结果包含第二关键数据和特征库中均包含的攻击特征。
一种可能的实现方式中，本申请实施例提供的网络攻击检测装置还包括处理模块。处理模块用于在上述检测模块基于目标攻击检测模型确定第二网络流量具有攻击性的情况下，按照第一预设动作对该第二网络流量进行动作响应。
一种可能的实现方式中，上述第一预设动作包括阻断或告警。
一种可能的实现方式中，本申请实施例中提供的网络攻击检测装置还包括发送模块。
当第一预设动作为阻断时，上述处理模块，具体用于控制发送模块停止向网络防护设备的下一跳设备发送第二网络流量。
当第一预设动作为告警时，上述处理模块具体用于控制发送模块通过输出设备输出告警信息，并控制接收模块接收针对该告警信息返回的指示。该指示包括第一指示和第二指示。当该指示为第一指示时，发送模块停止向网络防护设备的下一跳设备发送第二网络流量。当该指示为第二指示时，发送模块向该网络防护设备的下一跳设备发送第二网络流量。
或，当第一预设动作为告警时，上述处理模块具体用于控制发送模块通过输出设备输出告警信息，并停止向该网络防护设备的下一跳设备发送第二网络流量。或，控制发送模块通过输出设备输出告警信息，并向该网络防护设备的下一跳设备发送第二网络流量。
一种可能的实现方式中，上述处理模块还用于在检测模块基于目标攻击检测模型确定第二网络流量不具有攻击性的情况下，按照第二预设动作对第二网络流量进行动作响应。
一种可能的实现方式中，上述第二预设动作为放行。上述处理模块具体用于向网络防护设备的下一跳设备发送第二网络流量。
一种可能的实现方式中，上述分析模块具体用于将第一网络流量作为一个黑样本加入第一样本集，从而得到第二样本集。该第一样本集中包括至少一个黑样本。并且基于预定算法，对该第二样本集进行训练，得到目标攻击检测模型。
一种可能的实现方式中，上述检测模块还用于在根据第一匹配结果确定第一网络流量具有攻击性的情况下，按照第一预设动作对第一网络流量进行动作响应。
一种可能的实现方式中，上述检测模块还用于在根据第一匹配结果确定第一网络流量不具有攻击性的情况下，基于原攻击检测模型确定第一网络流量是否具有攻击性，该原攻击检测模型是基于预定算法，对第一样本集训练得到的。
第三方面，本申请实施例提供一种网络防护设备，包括存储器和与该存储器连接的至少一个处理器。存储器用于存储指令，该指令被至少一个处理器读取后，网络防护设备执行上述第一方面或第一方面的任意一种可能的实现方式中的方法，具体参见上文的详细描述，此处不再赘述。
第四方面，本申请实施例提供一种计算机可读存储介质，用于储存为上述网络防护设备所用的计算机软件指令，其包含用于执行上述第一方面或上述方面的任意一种 可能的实现方式所设计的程序。
第五方面，本申请实施例提供一种包含指令的计算机程序产品，当其在计算机上运行时，使得计算机执行上述第一方面或第一方面的任意一种可能的实现方式中所述的方法。
第六方面，本申请实施例提供一种芯片，包括存储器和处理器。存储器用于存储计算机指令。处理器用于从存储器中调用并运行该计算机指令，以执行上述第一方面及其第一方面任意可能的实现方式中的方法。
附图说明
图1为本申请实施例提供的网络攻击检测方法的应用场景示意图；
图2A为本申请实施例提供的一种网络攻击检测方法示意图一；
图2B为本申请实施例提供的一种网络攻击检测方法流程示意图；
图2C为本申请实施例提供的一种网络攻击检测方法示意图二；
图2D为本申请实施例提供的一种网络攻击检测方法示意图二；
图2E为本申请实施例提供的一种网络攻击检测方法示意图三；
图2F为本申请实施例提供的一种网络攻击检测方法示意图四；
图3为本申请实施例提供的一种网络防护设备的结构示意图；
图4为本申请实施例提供的一种网络攻击检测装置的结构示意图。
具体实施方式
本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示存在三种关系，例如，A和/或B，表示：单独存在A，同时存在A和B，单独存在B这三种情况。
本申请实施例的说明书和权利要求书中的术语“第一”和“第二”等是用于区别不同的对象，而不是用于描述对象的特定顺序。例如，第一网络流量和第二网络流量等是用于区别不同的网络流量，而不是用于描述网络流量的特定顺序；第一关键数据和第二关键数据等是用于区别不同的关键数据，而不是用于描述关键数据的特定顺序。
在本申请实施例的描述中，除非另有说明，“多个”的含义是指两个或两个以上。例如，多个处理单元是指两个或两个以上的处理单元；多个系统是指两个或两个以上的系统。
首先对本申请实施例提供的一种网络攻击检测的方法及装置中涉及的一些概念做解释说明。
网络防护设备：用于网络安全防护，网络防护设备能够检测并抵御网络攻击和病毒等，以保证数据安全传输，例如防火墙、安全网关设备(如路由器、交换机)等都属于网络防护设备。其中，防火墙部署于受保护的网络的边界，用于对进、出受保护的网络的数据流进行过滤，管理进、出网络的访问行为，并对网络攻击进行检测和报警。防火墙主要用于抵御外部攻击，保护受保护的网络。安全网关设备不但具有防火墙的功能，而且还具有防御网络入侵以及防病毒功能等等。具体的，网络防护设备对对流经该网络防护设备的流量进行检测从而确认网络是否存在入侵攻击或恶意通信等攻击行为，并在存在攻击行为的情况下及时地阻断攻击行为以保证受保护的网络的安全。
基于传统技术存在的问题，本申请实施例提供一种网络攻击检测方法及装置。网 络防护设备从该网络防护设备接收的第一网络流量中获取该第一关键数据，并基于特征库中的攻击特征判别第一网络流量是否具有攻击性。如果网络防护设备确定第一网络流量具有攻击性，该网络防护设备基于第一网络流量获得目标攻击检测模型，该目标攻击检测模型用于识别一个或多个攻击特征，该一个或多个攻击特征与特征库中的攻击特征不同。进而当该网络防护设备接收到第二网络流量时，该网络防护设备基于上述目标攻击检测模型确定第二网络流量是否具有攻击性。通过本申请实施例提供的技术方案，根据网络防护设备所处的实际网络环境中不断出现的恶意流量动态地获取目标攻击检测模型，目标攻击检测模型对于一些未包含在特征库中的攻击特征具有识别能力。换句话说，通过目标攻击检测模型，能够因地制宜地学习到网络防护设备所处的实际网络环境中未包含在特征库中的攻击特征。网络防护设备利用目标攻击检测模型对后续网络流量进行检测，使得网络防护设备对一些通过新的变形试图规避检测的恶意流量具有一定的检测能力，能够提升网络防护设备的网络适应性和检测效果。
本申请实施例提供的网络攻击检测方法的具体用途包括但不限于：操作系统漏洞利用检测(例如SMB服务漏洞检测、Apache漏洞检测、Struts2组件漏洞检测)、应用软件漏洞检测、Web应用入侵检测(例如SQL注入检测、XSS跨站攻击检测)、命令与控制服务器(command and control server)通信(即C&C通信)检测(例如僵尸、木马、蠕虫等恶意流量检测)。
示例性的，图1为本申请实施例提供的网络攻击检测方法的一种应用场景示意图。图1所示的网络中，网络防护设备为防火墙(FW_1)或安全网关设备(GW_2)。防火墙或安全网关设备位于受保护网络与Internet之间网络流量(双向数据流)的传输路径上。结合图1，本申请实施例中，分析设备(host 3)用于根据训练样本(例如本申请实施例中的样本集)进行攻击检测模型训练，防火墙(FW_1)用于检测网络流量是否具有攻击性。可选地，分析设备与防火墙(网络防护设备)集成在同一物理设备中，可替换地，分析设备与防火墙由相互有通信耦合的不同物理设备实现，本申请实施例不作限定。
本申请实施例提供的网络攻击检测方法能应用于入侵防御系统(IPS)，阻止恶意流量(即防御恶意攻击)，也能应用于反病毒(AV)，阻止恶意文件(即防御病毒)。如图2A所示，本申请实施例提供网络攻击检测方法包括步骤200至步骤204。
分析设备(例如图1中的host 3)与网络防护设备(例如图1中的防火墙)集成实现的情况下，由网络防护设备执行图2A、图2C、图2D、图2E以及图2F所示的步骤201至步骤204，步骤2021、步骤2022、步骤2041以及步骤2042，图2C所示的步骤2042'，图2D所示的步骤204'，图2E所示的步骤204"，图2F所示的步骤201'。在分析设备与网络防护设备由不同物理设备实现的情况下，由分析设备执行图2A、图2C、图2D、图2E以及图2F中的步骤202、步骤2021以及步骤2022，由网络防护设备执行图2A中的步骤200、步骤201、步骤203、步骤204、步骤2041以及步骤2042，图2C所示的步骤2042'，图2D所示的步骤204'，图2E所示的步骤204"，图2F所示的步骤201'。以下实施例，以分析设备与网络防护设备集成于同一个物理设备(即网络防护设备)的实现方式为例来介绍提供的网络攻击检测方法。
步骤200、网络防护设备从接收的第一网络流量中获取第一关键数据。
可选地，在图1所示的场景中，第一网络流量是流经防火墙(FW_1)的受保护网络与Internet之间的流量。其中，该第一关键数据是网络防护设备对第一网络流量中包含的一个或多个报文进行协议解析后，从解析结果的指定字段中获得的数据。
本申请实施例提供的网络攻击检测方法用于入侵防御时，网络防护设备检测的对象是网络流量(即该网络流量包含的一个或多个报文，或者，一条或多条五元组信息相同的会话，其中一条会话包括多个报文)；本申请实施例提供的网络攻击检测方法用于反病毒时，网络防护设备检测的对象是网络流量所承载的文件。
应理解，网络流量包括若干报文。网络防护设备接收到第一网络流量后，缓存第一网络流量包含的报文，然后解析该第一网络流量包含的一个或多个报文，并从解析结果的指定字段获取第一关键数据。
可选地，如果网络防护设备用于入侵防御，上述指定字段是第一网络流量包含的一个或者多个报文的超文本传输协议HTTP载荷，则上述第一关键数据是网络防护设备对第一网络流量中包含的一个或者多个报文进行应用层协议解析后，从解析结果的HTTP载荷字段中获得的数据。或者，如果网络防护设备用于反病毒，上述第一关键数据是网络防护设备对第一网络流量中包含的一个或者多个报文进行应用层协议解析，并对解析结果的HTTP载荷字段进行重组后，获得的第一网络流量承载的文件数据。
示例性的，以第一网络流量为SQL注入的攻击流量为例，上述第一关键数据是网络防护设备对该攻击流量包含的报文进行应用层协议解析后，从解析结果的HTTP载荷字段获得的数据，该数据为统一资源定位符(uniform resource locator，URL)，该URL(即第一关键数据)为：
GET/index.php？id＝123or 1＝1and(select top 1password from[admin])
在一种实施方式中，当第一网络流量包含多个报文时，上述第一关键数据是网络防护设备对该第一网络流量包含的多个报文中的一个报文进行协议解析后，从解析结果的指定字段中获得的数据，或者该第一关键数据是网络防护设备对该第一网络流量包含的多个报文中的至少两个报文进行协议解析后，从解析结果的指定字段中获得的数据，也就是说，该第一关键数据由该第一网络流量包含的多个报文中的至少两个报文各自的解析结果的指定字段的数据组合而成，本申请实施例不作限定。
步骤201、网络防护设备将第一关键数据与特征库中的攻击特征进行匹配从而获得第一匹配结果。
本申请实施例中，上述特征库中包含多种攻击特征，该多种攻击特征是网络安全解决方案提供商提取的大量已知恶意流量或恶意文件的攻击特征，并预先存储(加载)在网络防护设备中的。
在一种实施方式中，上述网络防护设备将第一关键数据与特征库中的攻击特征进行匹配具体包括：网络防护设备确定该第一关键数据中是否包含特征库中的攻击特征。具体的，网络防护设备分别将第一关键数据与特征库中的各攻击特征进行对比，若第一关键数据中包含特征库中的某一攻击特征，则记录下该攻击特征，从而得到第一匹配结果。该第一匹配结果包含匹配中的攻击特征，即第一关键数据和特征库中均包含的攻击特征。网络防护设备根据匹配中的攻击特征，基于攻击判别策略，确定第一网络流量是否具有攻击性。攻击判别策略有很多种，在这里难以一一列举，仅以两个例 子进行举例说明，例如，网络防护设备在匹配中的攻击特征的数目超过设定阈值时，确定第一网络流量具有攻击性；或者网络防护设备在匹配中的攻击特征组成的序列符合预定的匹配规则时，确定第一网络流量具有攻击性。攻击判别策略还包括从相似度、概率、正则等维度定义的策略，具体根据实际需求选择攻击判别策略，本申请实施例不作限定。
如果第一匹配结果为空，即第一关键数据中不包含特征库中的攻击特征，则网络防护设备确定第一网络流量不具有攻击性(即第一网络流量无攻击性)。
以上实施例中，网络防护设备将第一关键数据与特征库中的攻击特征进行匹配，并根据第一匹配结果确定第一网络流量是否具攻击性的方法称为基于特征匹配的检测方法。
为了描述简单起见，在本实施例中采用最简单的攻击判别策略，即网络防护设备在匹配中的攻击特征的数目大于或者等于1时，确定第一网络流量具有攻击性。
结合上述示例，第一关键数据为上述解析得到的URL：
GET/index.php？id＝123or 1＝1and(select top 1password from[admin])
网络防护设备将该第一关键数据与特征库中的攻击特征进行匹配，假设特征库中的攻击特征为“1＝1”(当然特征库中还可能包含其他攻击特征)，可见该第一关键数据中包含特征库中的攻击特征“1＝1”，则确定该第一网络流量具有攻击性。
步骤202、如果网络防护设备根据第一匹配结果确定第一网络流量具有攻击性，网络防护设备基于第一网络流量获得目标攻击检测模型。
目标攻击检测模型用于检测网络防护设备后续接收的网络流量是否具攻击性。目标攻击检测模型用于识别一个或多个攻击特征，该一个或多个攻击特征与上述特征库中的攻击特征不同。
结合上述示例，假设基于第一网络流量获得的目标攻击检测模型用于识别“select”，“top”，“password”，“admin”这几个攻击特征，即基于该目标攻击检测模型，网络防护设备能够确定具有上述“select”，“top”，“password”，“admin”这些特征的网络流量具有攻击性。
本申请实施例中，在网络防护设备进行网络攻击检测之前，网络防护设备上预先存储有特征库和模型库。特征库即为上述实施例中的包含多种攻击特征的特征库，该模型库中存储有攻击检测模型。该模型库中的攻击检测模型是根据由大量已知恶意流量(包括通过报文发起网络攻击的流量、或者承载恶意文件的流量)构成的样本集训练得到的攻击检测模型。在网络防护设备检测网络流量的过程中，网络防护设备会更新攻击检测模型。例如，如果第一网络流量具有攻击性，则网络防护设备将第一网络流量作为一个新的黑样本加入样本集，基于更新后的样本集获得目标攻击检测模型，并使用该目标攻击检测模型更新模型库中的攻击检测模型，即使用目标攻击检测模型替换已有的攻击检测模型。为了便于描述，本申请实施例中，将更新前的攻击检测模型称为原攻击检测模型，如此，原攻击检测模型不断地被基于新的样本集训练得到的目标攻击检测模型替换。
应理解，上述模型库中的攻击检测模型是预先存储(加载)在网络防护设备中的，该攻击检测模型是网络安全解决方案提供商对大量已知恶意流量或恶意文件进行训练 得到的攻击检测模型，上述对大量已知恶意流量或恶意文件进行训练得到攻击检测模型的具体方法参考现有技术的相关内容，此处不再赘述。
本申请实施例中，结合步骤201的描述可知，当第一关键数据包含特征库中的攻击特征时，网络防护设备确定该第一网络流量具有攻击性。此时，该网络防护设备基于该第一网络流量获得目标攻击检测模型。
可选地，如图2A所示，网络防护设备通过步骤2021至步骤2022获得目标攻击检测模型。
步骤2021、网络防护设备将第一网络流量作为一个黑样本加入第一样本集，从而得到第二样本集。
上述第一样本集中包括至少一个黑样本。可选地，为了提高机器学习(或人工智能)算法的精确性，例如对于不同类别样本聚类的准确性，第一样本集中还包括至少一个白样本。该第一样本集为原攻击检测模型对应的样本集，即原攻击检测模型是基于第一样本集训练得到的。
步骤2022、网络防护设备基于预定算法，对第二样本集进行训练，得到目标攻击检测模型。
可选地，本申请实施例中，上述预定算法为机器学习算法或人工智能算法中的一种，例如决策树、随机森林、贝叶斯、CNN、DNN等算法。
示例性的，以上述预定算法为随机森林算法为例，网络防护设备基于随机森林算法训练得到的目标攻击检测模型即为随机森林分类器。该随机森林分类器用于对测试样本进行分类，即确定测试样本是黑样本还是白样本。在本申请实施例中，该测试样本为一个未分类的网络流量，该训练得到的随机森林分类器用于确定该网络流量具有攻击性，还是不具有攻击性。应理解，随机森林分类器的训练过程即就是随机森林分类器包含的多个决策树的训练过程。
下面简单介绍一下基于随机森林算法训练目标攻击检测模型(随机森林分类器)的过程。
S1、对于第二样本集中的每一个样本，提取样本的多维特征。
可选地，采用词频-反文档频率(term frequency–inverse document frequency，TF-IDF)技术提取样本的特征。或者，采用其他特征提取的技术提取样本的特征，本申请实施例不作限定。
S2、对于随机森林分类器包含的多个决策树中的每一个决策树，从第二样本集中随机且有放回地抽取多个样本作为该决策树的训练集。
S3、基于每个决策树的训练集中包含的多个样本对应的多维特征训练决策树。
对于决策树的训练过程可参考现有技术的相关内容，在此不作详述。
上述训练得到随机森林分类器之后，后续可基于该随机森林分类器对预测样本(例如下述实施例中的第二网络流量)进行预测，具体过程将在下述实施例中介绍。
步骤203、网络防护设备接收第二网络流量。
步骤204、网络防护设备基于目标攻击检测模型确定第二网络流量是否具有攻击性。
可选地，如图2A所示，网络防护设备通过步骤2041至步骤2042确定第二网络 流量是否具有攻击性。
步骤2041、网络防护设备从第二网络流量中获取第二关键数据。
第二关键数据是网络防护设备对第二网络流量包含的一个或多个报文进行协议解析后，从解析结果的指定字段中获得的数据。
与上述第一关键数据类似，第二关键数据是网络防护设备对第二网络流量中包含的一个或者多个报文进行应用层协议解析后，从解析结果的HTTP载荷字段中获得的数据；或者，上述第二关键数据是网络防护设备对网络防护设备第二网络流量中包含的一个或者多个报文进行应用层协议解析，并对解析结果的HTTP载荷字段进行重组后，获得的第二网络流量承载的文件数据。
示例性的，仍以第二网络流量为SQL注入的攻击流量为例，上述第二关键数据是网络防护设备对第二网络流量包含的报文进行应用层协议解析后，从解析结果的HTTP载荷字段获得的数据，该数据为URL，并且该URL(即第二关键数据)为：
GET/index.php？id＝123or(IF((USER()LIKE'ro％'),1,0))＝1and(select top 1password from[admin])
步骤2042、网络防护设备将第二关键数据输入目标攻击检测模型，并根据目标攻击检测模型的输出，确定第二网络流量是否具有攻击性。
具体的，将该第二关键数据输入目标攻击检测模型，网络防护设备使用目标攻击检测模型对第二关键数据进行推理。该目标攻击检测模型输出推理结果，该推理结果也就是采用目标攻击检测模型对第二网络流量的检测结果，即该第二网络流量具有攻击性或者该第二网络流量不具有攻击性。
需要说明的是，本申请实施例中，上述基于目标攻击检测模型确定第二网络流量是否具有攻击性的过程与上述训练目标攻击检测模型的过程是相对应的。例如，若目标攻击检测模型是基于随机森林算法得到的，则根据目标攻击检测模型确定第二网络流量是否具有攻击性时，网络防护设备采用对应的随机森林分类器确定该第二网络流量是否具有攻击性。
示例性的，假设目标攻击检测模型为上述训练得到的随机森林分类器，上述从第二网络流量中获得第二关键数据之后，网络防护设备从该第二关键数据中提取多维特征(与上述提取第二样本集的各个样本的多维特征的方法类似)，然后将第二关键数据的多维特征作为随机森林分类器的输入，进而该随机森林分类器输出对第二网络流量的预测结果，即第二网络流量具有攻击性，还是不具有攻击性。应理解，该随机森林分类器的输出结果是一种对该随机森林分类器包含的多个决策树的输出进行投票的结果。
以上实施例中，网络防护设备将第二关键数据输入目标攻击检测模型，并根据目标攻击检测模型的输出，确定第二网络流量是否具有攻击性称为基于攻击检测模型的检测方法。
图2B为采用本申请实施例提供的网络攻击检测方法实现网络攻击检测的流程示意图，参考图2B以进一步理解上述实施例描述的各个步骤。图2B中的标号“1”指示的处理流程是网络防护设备对接收到的第一网络流量的处理流程，图2B中的标号“2”指示的处理流程是网络防护设备对接收到的第二网络流量的处理流程。
如图2B所示，网络防护设备接收到第一网络流量之后，首先将从第一网络流量中提取的第一关键数据与特征库中的攻击特征进行匹配。根据特征库的匹配结果确定第一网络流量具有攻击性时，将第一网络流量作为用于训练目标攻击检测模型的黑样本加入到样本集中。然后对样本集中的所有样本进行特征提取，将提取的特征用于模型训练，从而得到目标攻击检测模型，并利用该目标攻击检测模型更新模型库中的攻击检测模型。当网络防护设备接收到第二网络流量时，该网络防护设备对第二网络流量进行特征特取(与上述对样本集中的样本进行特征提取的方法类似)。然后将提取的特征作为目标攻击检测模型(从模型库中获取的最新的攻击检测模型，即基于第一网络流量获得的目标攻击检测模型)的输入，从而根据目标攻击检测模型的输出确定检测结果(即第二网络流量是否具有攻击性)。
本申请实施例提供一种网络攻击检测方法，网络防护设备从该网络防护设备接收的第一网络流量中获取该第一关键数据(该第一关键数据对第一网络流量中包含的一个或多个报文进行协议解析后，从解析结果的指定字段中获得的数据)，并且将该第一关键数据与特征库中的攻击特征进行匹配从而获得匹配结果，该匹配结果包含第一关键数据和特征库中均包含的攻击特征。如果网络防护设备根据匹配结果确定第一网络流量具有攻击性，网络防护设备基于第一网络流量获得目标攻击检测模型。目标攻击检测模型用于识别一个或多个攻击特征，该一个或多个攻击特征与特征库中的攻击特征不同。进而当网络防护设备接收到第二网络流量时，网络防护设备基于目标攻击检测模型确定第二网络流量是否具有攻击性。由于目标攻击检测模型是根据网络防护设备所处的实际网络环境中不断出现的恶意流量实时获取的，并且目标攻击检测模型能够识别更多未包含在特征库中的攻击特征，因此网络防护设备利用该目标攻击检测模型对后续网络流量进行检测，使得网络防护设备对一些通过新的变形试图规避检测的恶意流量具有一定的检测能力，从而提升网络防护设备的网络适应性和检出效果。
进一步的，本申请实施例提供的网络攻击检测方法，网络防护设备将网络流量的关键数据与特征库中的攻击特征进行匹配，并根据匹配结果确定网络流量是否具有攻击性。对具有攻击性的网络流量(例如上述第一网络流量)，网络防护设备基于具有攻击性的网络流量进行本地化的攻击检测模型训练(即在该网络防护设备上进行攻击检测模型训练)，与现有技术中将大量的已知恶意流量传输至云端进行攻击检测模型训练相比，本申请实施例中，无需将该网络流量传输至云端进行训练，如此能够保证数据隐私不被泄露。
可选地，结合图2A，如图2C所示，在上述步骤2042(即网络防护设备将第二关键数据输入目标攻击检测模型，并根据目标攻击检测模型的输出，确定第二网络流量是否具有攻击性)之前，本申请实施例提供的网络攻击检测方法还包括步骤2042'：
步骤2042'、网络防护设备将第二关键数据与特征库中的攻击特征进行匹配从而获得第二匹配结果，并且根据第二匹配结果确定第二网络流量不具有攻击性。
网络防护设备将第二关键数据与特征库中的攻击特征进行匹配从而获得第二匹配结果，该第二匹配结果为空，则网络防护设备确定第二网络流量不具有攻击性。
该第二关键数据是网络防护设备对第二网络流量包含的一个或多个报文进行协议解析后，从解析结果的指定字段中获得的数据，具体参见上述实施例的相关描述。本 申请实施例中，将上述第二关键数据与特征库的攻击特征进行匹配的过程与上述步骤201中将第一关键数据与特征库中的攻击特征进行匹配的过程类似，因此对于步骤2042'的详细描述可参考上述实施例中对于步骤201的相关描述，此处不再赘述。
结合上述实施例的描述可知，网络防护设备接收到第二网络流量之后，首先通过上述步骤2042'中的基于特征匹配的检测方法对该第二网络流量进行第一次检测。经过第一检测之后，若网络防护设备确定该第二网络流量不具有攻击性的，则网络防护设备再通过上述步骤2042中的基于攻击检测模型的检测方法对第二网络流量进行第二次检测，并根据攻击检测模型的输出，确定该第二网络流量是否具有攻击性。如此，将攻击检测模型作为特征库的补充，在一定程度上能够提升网络攻击检测的检测效果，更加可靠地检测网络中是否存在恶意流量。
示例性的，仍以第二网络流量为SQL注入的攻击流量为例，上述第二关键数据是从第二网络流量中解析得到的URL：
GET/index.php？id＝123or(IF((USER()LIKE'ro％'),1,0))＝1and(select top 1password from[admin])
首先，网络防护设备将第二关键数据与特征库中的攻击特征进行匹配，假设特征库中的攻击特征为“1＝1”(当然特征库中还可能包含其他攻击特征)，可见上述第二关键数据中不包含特征库中的“1＝1”(该第二关键数据中也不包含特征库中的其他攻击特征)。然后，网络防护设备再基于目标攻击检测模型，对第二网络流量进行检测。结合上述示例，由于基于第一网络流量获得的目标攻击检测模型能够识别“select”，“top”，“password”，“admin”这几个攻击特征，因此网络防护设备基于该目标攻击检测模型确定上述第二网络流量具有攻击性。
本申请实施例中，特征库中包含一个或多个攻击特征，将该一个或多个攻击特征称为第一攻击特征。目标攻击检测模型能够识别一个或多个攻击特征，将该一个或多个攻击特征称为第二攻击特征。结合上述实施例的描述可知，第一攻击特征与第二攻击特征不同，网络防护设备传输包含第一攻击特征的报文的过程中，第一攻击特征容易被篡改(例如经过改名、编码等变形)。网络防护设备传输包含第二攻击特征的报文的过程中，第二攻击特征不易被篡改。
示例性的，以第一网络流量和第二网络流量为例，从第一网络流量中获得的第一关键数据为：
GET/index.php？id＝123or 1＝1and(select top 1password from[admin])
从第二网络流量中获得的第二关键数为：
GET/index.php？id＝123or(IF((USER()LIKE'ro％'),1,0))＝1and(select top 1password from[admin])
结合上述实施例中的示例可知，第一关键数据中包含第一攻击特征(即“1＝1”)，第二关键数据中不包含上述第一攻击特征。并且在第二网络流量中，上述第一攻击特征已经变形为“(IF((USER()LIKE'ro％'),1,0))＝1”，基于特征匹配的检测方法对第二网络流量进行检测时，由于第二网络流量中不包含第一攻击特征(即“1＝1”)。若特征库中不包含该变形后的攻击特征“(IF((USER()LIKE'ro％'),1,0))＝1”，在这种情况下，网络防护设备确定第二网络流量不具有攻击性。这样攻击者可能将执行上述URL 中“select top 1password from[admin]”语句，从而获取到用户名，导致攻击成功。本申请实施例中，在第二网络流量中不包含上述第一攻击特征的情况下，网络防护设备继续基于目标攻击检测模型检测该第二网络流量，由于该目标攻击检测模型能够识别“select”，“top”，“password”，“admin”，因此网络防护设备的检测结果是：该第二网络流量具有攻击性。
需要说明的是，在一种实施方式中，如果网络防护设备根据第二匹配结果确定第二网络流量具有攻击性，网络防护设备省略执行上述步骤2042以及步骤2042之后的相关步骤，直接根据下文所描述的第一预设动作对第二网络流量进行动作响应。网络防护设备中通常包含两个独立的功能模块，分别被称为特征库匹配引擎和模型匹配模块。特征库匹配引擎用于将关键数据与特征库中的攻击特征进行匹配。模型匹配模块用于基于攻击检测模型判断网络流量是否具有攻击性。特征库匹配引擎的性能一般高于与模型匹配模块的性能，因此在对于网络流量的处理流程中，将上述特征库匹配引擎置于上述模型匹配模块的前面，若根据特征库匹配引擎能直接判断网络流量具有攻击性，则省略对模型匹配模块对网络流量进行处理，可以显著提高网络防护设备的处理性能，降低因安全防护带来的传输延时。
可选地，在网络防护设备根据特征库判断出第二网络流量具有攻击性的情况下，网络防护设备将第二网络流量加入样本集从而再次更新攻击检测模型。该网络防护设备执行如下过程：网络防护设备基于该第二网络流量获得新的目标攻击检测模型，并更新攻击检测模型(即用该新的目标攻击检测模型替换上述基于第一网络流量获得的目标攻击检测模型)。之后网络防护设备继续检测该网络防护设备接收的下一网络流量(例如第三网络流量)，并且网络防护设备基于该新的目标攻击检测模型(基于第二网络流量获得的攻击检测模型)确定该网络防护设备接收的下一网络流量是否具有攻击性。
可选地，结合图2C，如图2D所示，在上述步骤204之后，本申请实施例提供的网络攻击检测方法还包括步骤204'。
步骤204'、在网络防护设备基于目标攻击检测模型确定第二网络流量具有攻击性的情况下，该网络防护设备按照第一预设动作对第二网络流量进行动作响应。
图2D中的步骤200至步骤204，步骤2021，步骤2022，步骤2041、步骤2042'以及步骤2042与图2C中的实现方式类似，在这里不再重复描述。
本申请实施例中，网络防护设备对流经该网络防护设备的网络流量进行检测，并且能够根据检测结果和预设动作对流经该网络防护设备的网络流量进行相应的动作响应。例如第一预设动作用于网络防护设备对具有攻击性的网络流量进行动作响应，第二预设动作用于网络防护设备对无攻击性的网络流量进行动作响应。当网络防护设备检测出流经该网络防护设备的网络流量具有攻击性时，网络防护设备按照第一预设动作对该的网络流量进行动作响应。当网络防护设备检测出流经该网络防护设备的网络流量不具有攻击性(即无攻击性)时，网络防护设备按照第二预设动作对该网络流量进行动作响应。
可选地，上述第一预设动作包括阻断或告警，上述第二预设动作包括放行。
需要说明的是，本申请实施例中的上述第一预设动作或第二预设动作可替换为其 他的动作，本申请实施例不作限定。例如，上述第一预设动作可替换为放行。
结合步骤204'，在一种实现方式中，若网络防护设备确定第二网络流量具有攻击性，且上述第一预设动作为阻断，则网络防护设备按照第一预设动作对第二网络流量进行动作响应，包括：网络防护设备停止向该网络防护设备的下一跳设备发送第二网络流量。如此，网络防护设备能够阻止第二网络流量从网络防护设备流入该网络防护设备的下一跳设备，进一步避免第二网络流量继续流入网络中的其他设备，能够及时阻止网络攻击。
结合步骤204'，在一种实现方式中，若网络防护设备确定第二网络流量具有攻击性，且上述第一预设动作为告警，则网络防护设备按照第一预设动作对第二网络流量进行动作响应包括下述方式A、方式B或方式C。
方式A、网络防护设备通过输出设备输出告警信息，并接收针对该告警信息返回的指示。
上述针对该告警信息返回的指示包括第一指示和第二指示。当该指示为第一指示时，网络防护设备停止向该网络防护设备的下一跳设备发送第二网络流量。当该指示为第二指示时，网络防护设备向该网络防护设备的下一跳设备发送第二网络流量。
方式A中网络防护设备的响应是一种在线的响应方式，即网络防护设备输出告警信息之后，等待用户对于该告警信息的反馈(即上述第一指示和第二指示)，然后再根据用户的反馈进行相应的动作。
方式B、网络防护设备通过输出设备输出告警信息，并停止向该网络防护设备的下一跳设备发送第二网络流量。
方式C、网络防护设备通过输出设备输出告警信息，并向该网络防护设备的下一跳设备发送第二网络流量。
方式B和方式C中网络防护设备的响应是一种离线的响应方式，即网络防护设备输出告警信息(该告警信息仅用于通知用户)之后，网络防护设备无需等待用户对该告警信息的反馈，而是根据预先设定的动作及时进行响应。
可选地，结合图2C，如图2E所示，在上述步骤204之后，本申请实施例提供的网络攻击检测方法还包括步骤204"。
步骤204"、在网络防护设备基于目标攻击检测模型确定第二网络流量不具有攻击性的情况下，该网络防护设备按照第二预设动作对第二网络流量进行动作响应。
结合上述实施例的描述可知，第二预设动作用于网络防护设备对无攻击性的网络流量进行动作响应，该第二预设动作包括放行。
结合步骤204"，在一种实现方式中，若网络防护设备确定第二网络流量不具有攻击性，且第一预设动作为方向，则网络防护设备按照第二预设动作对第二网络流量进行动作响应，包括：网络防护设备向该网络防护设备的下一跳设备发送第二网络流量。
图2E中的步骤200至步骤204，步骤2021，步骤2022，步骤2041、步骤2042'以及步骤2042与图2C中的实现方式类似，在这里不再重复描述。
本申请实施例中，网络防护设备基于目标攻击检测模型确定第二网络流量是否具有攻击性，并且进行相应的动作响应，之后该网络防护设备继续采用本申请实施例提供的网络攻击检测方法对该网络防护设备接收的下一网络流量进行网络攻击检测。
可选地，本申请实施例中，当网络防护设备将上述第一关键数据(该第一关键数据是从第一网络流量中获取的)与特征库中的攻击特征进行匹配，并且匹配结果指示该关键数据不包含特征库中的攻击特征时，网络防护设备释放缓存在该网络防护设备中的第一网络流量包含的报文。
结合图2C，如图2F所示，在步骤201(即网络防护设备将第一关键数据与特征库中的攻击特征进行匹配从而获得第一匹配结果)之后，本申请实施例提供的攻击检测方法还包括步骤201'：
步骤201'、如果网络防护设备根据第一匹配结果确定第一网络流量具有攻击性，网络防护设备按照第一预设动作对第一网络流量进行动作响应。
图2F中的步骤200至步骤204，步骤2021，步骤2022，步骤2041、步骤2042'以及步骤2042与图2C中的实现方式类似，在这里不再重复描述。
关于网络防护设备按照第一预设动作对第一网络流量进行动作响应的详细描述可参见上述实施例中网络防护设备按照第一预设动作对第二网络流量进行动作响应(即步骤204')的相关描述，此处不再赘述。
本申请实施例中，网络防护设备根据第一匹配结果确定该第一网络流量具有攻击性时，该网络防护设备既执行步骤202(基于该第一网络流量获得目标攻击检测模型)，也执行步骤201'。需要说明的是，本申请实施例不限定网络防护设备执行步骤202和步骤201'的顺序，即网络防护先执行步骤202后执行步骤201'，或者先执行步骤201'后执行步骤202，或者同时执行步骤202和步骤201'。
需要说明的是，本申请实施例中，如果网络防护设备根据第一匹配结果确定第一网络流量不具有攻击性，网络防护设备基于原攻击检测模型确定第一网络流量是否具有攻击性。该原攻击检测模型是基于预定算法，对上述第一样本集训练得到的。
结合上述实施例的描述可知，网络防护设备接收到第一网络流量之后，首先网络防护设备基于特征匹配的检测方法对第一网络流量进行第一次检测。经过第一检测之后，若网络防护设备确定第一网络流量不具有攻击性的，则网络防护设备再基于原攻击检测模型对第一网络流量进行第二次检测；并根据原攻击检测模型的输出，确定第一网络流量是否具有攻击性，进而网络防护设备对该第一网络流量进行相应的动作响应。
可选地，若第一网络流量是网络防护设备首次接收的网络流量，则上述原攻击检测模型实际上是基于网络防护设备预先保存的样本集(不同的网络防护设备预存的样本集既可以相同，也可以不同)训练得到的原始攻击检测模型。若第一网络流量不是该网络防护设备首次接收的网络流量，则上述原攻击检测模型可能是原始攻击检测模型，也可能是根据在预先保存的样本集的基础上更新后的样本集训练出的、有别于原始攻击检测模型的另一攻击检测模型，本申请实施例不作限定。可选地，攻击检测模型的更新是实时执行的，例如网络防护设备每次根据特征库确定出具有攻击性的网络流量后，立刻将该具有攻击性的网络流量作为一个新的黑样本加入样本集从而更新样本集，并基于更新的样本集来重新训练攻击检测模型。可替换地，攻击检测模型的更新是定期执行的，例如网络防护设备每次根据特征库确定出具有攻击性的网络流量后，立刻将该具有攻击性的网络流量作为一个新的黑样本加入样本集从而更新样本集，网 络防护设备按照设定的周期(例如每24小时、或每星期)，定期根据更新的样本集来重新训练攻击检测模型。
可选地，本申请实施例中，在网络防护设备基于原攻击检测模型确定第一网络流量具有攻击性的情况下，该网络防护设备按照第一预设动作对第一网络流量进行动作响应。在网络防护设备基于原攻击检测模型确定第一网络流量不具有攻击性的情况下，该网络防护设备按照第二预设动作对第一网络流量进行动作响应。
本申请实施例中，由于网络防护设备对第一网络流量进行动作响应的过程与该网络防护设备对上述第二网络流量进行动作响应的过程类似，因此对于网络防护设备对第一网络流量进行动作响应的描述可参考上述实施例的相关描述，此处不再赘述。
相应地，本申请实施例还提供了一种网络防护设备，用以实施上述实施例描述的网络攻击检测方法。图3是本申请实施例提供的网络防护设备的结构示意图。可选地，图3所示的网络防护设备300是图1所示应用场景中的防火墙和分析设备的集成设备、图2A、图2C、图2D、图2E或图2F所示方法示意图中的网络防护设备。该网络防护设备300包括至少一个处理器301和存储器302。
其中，处理器301包括一个或多个中央处理器(central processing unit，CPU)。该CPU为单核CPU(single-CPU)或多核CPU(multi-CPU)。
存储器302包括但不限于是随机存取存储器(random access memory，RAM)、只读存储器(read only memory，ROM)、可擦除可编程只读存储器(erasable programmable read-only memory，EPROM)、快闪存储器、或光存储器等。存储器302中保存有操作系统的代码。
可选地，处理器301通过读取存储器302中保存的指令实现上述实施例中的方法，或者，处理器301通过内部存储的指令实现上述实施例中的方法。在处理器301通过读取存储器302中保存的指令实现上述实施例中的方法的情况下，存储器302中保存实现本申请实施例提供的网络攻击检测方法的指令。
存储器302中存储的程序代码被至少一个处理器301读取后，网络防护设备300执行以下操作：从第一网络流量中获取第一关键数据，并且将第一关键数据与特征库中的攻击特征进行匹配从而获得第一匹配结果，该第一关键数据是对第一网络流量中包含的一个或者多个报文进行协议解析后，从解析结果的指定字段中获得的数据，第一匹配结果包含第一关键数据和特征库中均包含的攻击特征；如果网络防护设备根据第一匹配结果确定第一网络流量具有攻击性，基于第一网络流量获得目标攻击检测模型，该目标攻击检测模型用于识别一个或多个攻击特征，该一个或多个攻击特征与特征库中的攻击特征不同；进而基于目标攻击检测模型确定第二网络流量是否具有攻击性。
可选地，图3所示的网络防护设备300还包括网络接口303。网络接口303是有线接口，例如光纤分布式数据接口(fiber distributed data interface，FDDI)、千兆以太网(gigabit ethernet，GE)接口。或者，网络接口303是无线接口。网络接口303用于接收网络流量，如上述第一网络流量和第二网络流量。或者，网络接口303用于根据处理器301对网络流量是否有攻击性的确定结果向网络中的其他设备发送网络流量。
存储器302用于存储网络接口303接收到的网络流量，可选地，存储器302还有 用于存储样本集(用于训练攻击检测模型)以及攻击检测模型等。至少一个处理器301进一步根据存储器302保存的这些条目来执行上述方法实施例所描述的方法。处理器301实现上述功能的更多细节请参考前面各个方法实施例中的描述，在这里不再重复。
可选地，网络防护设备300还包括总线304，上述处理器301、存储器302通常通过总线304相互连接，或采用其他方式相互连接。
可选地，网络防护设备300还包括输入输出接口305，输入输出接口305用于与输入设备连接，接收用户通过输入设备输入的检测需求(例如检测指定协议的网络流量，指定网段的网络流量)。输入设备包括但不限于键盘、触摸屏、麦克风等等。输入输出接口305还用于与输出设备连接，输出处理器301的检测结果(即网络流量是否具有攻击性)。输出设备包括但不限于显示器、打印机等等。
本申请实施例提供的网络防护设备用于执行上述各个方法实施例提供的网络攻击检测方法。由于网络防护设备基于第一网络流量获得的目标攻击检测模型能够识别更多攻击特征，因此网络防护设备基于该目标攻击检测模型对第二网络流量进行攻击检测，能够提升网络攻击检测的检测效果。
图4是本申请实施例提供的一种网络攻击检测装置的结构示意图。该网络攻击检测装置400包括检测模块401、分析模块402以及接收模块403。
检测模块401，用于从接收模块403接收的第一网络流量中获取第一关键数据，并且将第一关键数据与特征库中的攻击特征进行匹配从而获得第一匹配结果，该第一关键数据是检测模块401对第一网络流量中包含的一个或多个报文进行协议解析后，从解析结果的指定字段中获得的数据，该第一匹配结果包含第一关键数据和特征库中均包含的攻击特征。
其中，上述指定字段是一个或多个报文的超文本传输协议HTTP载荷，该第一关键数据是检测模块401对第一网络流量中包含的一个或者多个报文进行应用层协议解析后，从解析结果的HTTP载荷字段中获得的数据。或，第一关键数据是检测模块401对第一网络流量中包含的一个或者多个报文进行应用层协议解析，并对解析结果的HTTP载荷字段进行重组后，获得的第一网络流量承载的文件数据。
分析模块402，用于在检测模块401根据第一匹配结果确定第一网络流量具有攻击性的情况下，基于第一网络流量获得目标攻击检测模型，该目标攻击检测模型用于识别一个或多个攻击特征，该一个或多个攻击特征与特征库中的攻击特征不同。
接收模块403，用于接收第二网络流量。
检测模块401，还用于基于目标攻击检测模型确定第二网络流量是否具有攻击性。
可选地，检测模块401，具体用于从第二网络流量中获取第二关键数据，将第二关键数据输入目标攻击检测模型，并根据目标攻击检测模型的输出，确定第二网络流量是否具有攻击性，该第二关键数据是检测模块401对第二网络流量中包含的一个或多个报文进行协议解析后，从解析结果的指定字段中获得的数据。
其中，上述指定字段是一个或多个报文的超文本传输协议HTTP载荷，该第二关键数据是检测模块401对第二网络流量中包含的一个或多个报文进行应用层协议解析后，从解析结果的HTTP载荷字段中获得的数据，或，第二关键数据是检测模块401对第二网络流量中包含的一个或者多个报文进行应用层协议解析，并对解析结果的 HTTP载荷字段进行重组后，获得的第二网络流量承载的文件数据。
可选地，检测模块401，还用于将第二关键数据与特征库中的攻击特征进行匹配从而获得第二匹配结果，并且根据第二匹配结果确定第二网络流量不具有攻击性，该第二匹配结果包含第二关键数据和特征库中均包含的攻击特征。
可选地，网络防护设备400还包括处理模块404。
处理模块404，用于在检测模块401基于目标攻击检测模型确定第二网络流量具有攻击性的情况下，按照第一预设动作对第二网络流量进行动作响应。可选地，第一预设动作包括阻断或告警。
可选地，本申请实施例提供的网络攻击检测装置400还包括发送模块405。
当第一预设动作为阻断时，处理模块404，具体用于控制发送模块405停止向网络防护设备的下一跳设备发送第二网络流量。
当第一预设动作为告警时，处理模块404，具体用于控制发送模块405通过输出设备输出告警信息，并控制接收模块403接收针对告警信息返回的指示，该指示包括第一指示或第二指示。当该指示为第一指示时，发送模块405停止向网络防护设备的下一跳设备发送第二网络流量。当指示为第二指示时，发送模块405向网络防护设备的下一跳设备发送第二网络流量。或，处理模块404，具体用于控制发送模块405通过输出设备输出告警信息，并停止向网络防护设备的下一跳设备发送第二网络流量。或，处理模块404，具体用于控制发送模块405通过输出设备输出告警信息，并向网络防护设备的下一跳设备发送第二网络流量。
可选地，处理模块404，还用于在检测模块401基于目标攻击检测模型确定第二网络流量不具有攻击性的情况下，按照第二预设动作对第二网络流量进行动作响应。
可选地，第二预设动作为放行。处理模块404，具体用于控制发送模块405向网络防护设备的下一跳设备发送第二网络流量。
可选地，分析模块402，具体用于将第一网络流量作为一个黑样本加入第一样本集，从而得到第二样本集，该第一样本集中包括至少一个黑样本；并且基于预定算法，对第二样本集进行训练，得到目标攻击检测模型。
可选地，检测模块401，还用于在根据第一匹配结果确定第一网络流量不具有攻击性的情况下，基于原攻击检测模型确定第一网络流量是否具有攻击性，该原攻击检测模型是基于预定算法，对第一样本集训练得到的。
图4所描述的装置实施例仅仅是示意性的，例如，上述模块的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个模块或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。在本申请各个实施例中的各功能模块可以集成在一个处理模块中，也可以是各个模块单独物理存在，也可以两个或两个以上模块集成在一个模块中。图4中上述各个模块既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。例如，采用软件实现时，上述检测模块401、分析模块402以及处理模块404可以是由图3中的至少一个处理器301读取存储器中存储的程序代码后，生成的软件功能模块来实现。图4中上述各个模块也可以由网络防护设备中的不同硬件分别实现，例如检测模块401和分析模块402由图3中的至少一个处理器301中的一部分处理资源(例如多核处理器中的一个核或两个核)实 现，而处理模块404由图3中至少一个处理器301中的其余部分处理资源(例如多核处理器中的其他核)，或者采用现场可编程门阵列(field－programmable gate array，FPGA)、或协处理器等可编程器件来完成。接收模块403和发送模块405由图3中的网络接口303实现。显然上述功能模块也可以采用软件硬件相结合的方式来实现，例如分析模块402由硬件可编程器件实现，而检测模块401和处理模块404是由CPU读取存储器中存储的程序代码后，生成的软件功能模块。
图4中检测模块401，分析模块402、接收模块403、处理模块404以及发送模块405实现上述功能的更多细节请参考前面各个方法实施例中的描述，在这里不再重复。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件程序实现时，可以全部或部分地以计算机程序产品的形式实现。该计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行该计算机指令时，全部或部分地产生按照本申请实施例中的流程或功能。该计算机可以是通用计算机、专用计算机、计算机网络或者其他可编程装置。该计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，该计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))方式或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心传输。该计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包括一个或多个可用介质集成的服务器、数据中心等数据存储设备。该可用介质可以是磁性介质(例如，软盘、磁盘、磁带)、光介质(例如，数字视频光盘(digital video disc，DVD))、或者半导体介质(例如固态硬盘(solid state drives，SSD))等。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的范围。这样，倘若对本申请的这些修改和变型属于本申请权利要求的范围之内，则本申请也意图包括这些改动和变型在内。

Claims (24)

  1. 一种网络攻击检测方法，其特征在于，包括：
    网络防护设备从接收的第一网络流量中获取第一关键数据，并且将所述第一关键数据与特征库中的攻击特征进行匹配从而获得第一匹配结果，所述第一关键数据是所述网络防护设备对所述第一网络流量中包含的一个或者多个报文进行协议解析后，从解析结果的指定字段中获得的数据，所述第一匹配结果包含所述第一关键数据和所述特征库中均包含的攻击特征；
    如果所述网络防护设备根据所述第一匹配结果确定所述第一网络流量具有攻击性，所述网络防护设备基于所述第一网络流量获得目标攻击检测模型，所述目标攻击检测模型用于识别一个或多个攻击特征，所述一个或多个攻击特征与所述特征库中的攻击特征不同；
    所述网络防护设备接收第二网络流量；
    所述网络防护设备基于所述目标攻击检测模型确定所述第二网络流量是否具有攻击性。
  2. 根据权利要求1所述的方法，其特征在于，所述网络防护设备基于所述目标攻击检测模型确定所述第二网络流量是否具有攻击性，包括：
    所述网络防护设备从所述第二网络流量中获取第二关键数据，所述第二关键数据是所述网络防护设备对所述第二网络流量中包含的一个或者多个报文进行协议解析后，从解析结果的所述指定字段中获得的数据；
    所述网络防护设备将所述第二关键数据输入所述目标攻击检测模型，并根据所述目标攻击检测模型的输出，确定所述第二网络流量是否具有攻击性。
  3. 根据权利要求2所述的方法，其特征在于，其中所述指定字段是所述一个或者多个报文的超文本传输协议HTTP载荷，
    所述第一关键数据是所述网络防护设备对所述第一网络流量中包含的一个或者多个报文进行应用层协议解析后，从解析结果的HTTP载荷字段中获得的数据；
    所述第二关键数据是所述网络防护设备对所述第二网络流量中包含的一个或者多个报文进行应用层协议解析后，从解析结果的HTTP载荷字段中获得的数据。
  4. 根据权利要求2所述的方法，其特征在于，其中所述指定字段是所述一个或者多个报文的HTTP载荷，
    所述第一关键数据是所述网络防护设备对所述第一网络流量中包含的一个或者多个报文进行应用层协议解析，并对解析结果的HTTP载荷字段进行重组后，获得的所述第一网络流量承载的文件数据；
    所述第二关键数据是所述网络防护设备对所述第二网络流量中包含的一个或者多个报文进行应用层协议解析，并对解析结果的HTTP载荷字段进行重组后，获得的所述第二网络流量承载的文件数据。
  5. 根据权利要求2所述的方法，其特征在于，在所述网络防护设备将所述第二关键数据输入所述目标攻击检测模型，并根据所述目标攻击检测模型的输出，确定所述第二网络流量是否具有攻击性之前，所述方法还包括：
    所述网络防护设备将所述第二关键数据与所述特征库中的攻击特征进行匹配从而 获得第二匹配结果，并且根据所述第二匹配结果确定所述第二网络流量不具有攻击性，所述第二匹配结果包含所述第二关键数据和所述特征库中均包含的攻击特征。
  6. 根据权利要求1至5任一项所述的方法，其特征在于，所述方法还包括：
    在所述网络防护设备基于所述目标攻击检测模型确定所述第二网络流量具有攻击性的情况下，所述网络防护设备按照第一预设动作对所述第二网络流量进行动作响应。
  7. 根据权利要求6所述的方法，其特征在于，所述第一预设动作包括阻断或告警；
    所述第一预设动作为阻断，所述网络防护设备按照所述第一预设动作对所述第二网络流量进行动作响应，包括：
    所述网络防护设备停止向所述网络防护设备的下一跳设备发送所述第二网络流量；
    所述第一预设动作为告警，所述网络防护设备按照所述第一预设动作对所述第二网络流量进行动作响应，包括：
    所述网络防护设备通过输出设备输出告警信息，并接收针对所述告警信息返回的指示，所述指示包括第一指示和第二指示；当所述指示为第一指示时，所述网络防护设备停止向所述网络防护设备的下一跳设备发送所述第二网络流量；当所述指示为第二指示时，所述网络防护设备向所述网络防护设备的下一跳设备发送所述第二网络流量；或，
    所述网络防护设备通过输出设备输出告警信息，并停止向所述网络防护设备的下一跳设备发送所述第二网络流量；或，
    所述网络防护设备通过输出设备输出告警信息，并向所述网络防护设备的下一跳设备发送所述第二网络流量。
  8. 根据权利要求1至7任一项所述的方法，其特征在于，所述方法还包括：
    在所述网络防护设备基于所述目标攻击检测模型确定所述第二网络流量不具有攻击性的情况下，所述网络防护设备按照第二预设动作对所述第二网络流量进行动作响应。
  9. 根据权利要求8所述的方法，其特征在于，
    所述第二预设动作为放行，所述网络防护设备按照所述第二预设动作对所述第二网络流量进行动作响应，包括：
    所述网络防护设备向所述网络防护设备的下一跳设备发送所述第二网络流量。
  10. 根据权利要求1至9任一项所述的方法，其特征在于，所述网络防护设备基于所述第一网络流量获得目标攻击检测模型，包括：
    所述网络防护设备将所述第一网络流量作为一个黑样本加入第一样本集，从而得到第二样本集，所述第一样本集中包括至少一个黑样本；
    所述网络防护设备基于预定算法，对所述第二样本集进行训练，得到所述目标攻击检测模型。
  11. 根据权利要求10所述的方法，其特征在于，所述方法还包括：
    如果所述网络防护设备根据所述第一匹配结果确定所述第一网络流量不具有攻击性，所述网络防护设备基于原攻击检测模型确定所述第一网络流量是否具有攻击性，所述原攻击检测模型是基于所述预定算法，对所述第一样本集训练得到的。
  12. 一种网络攻击检测装置，其特征在于，包括：检测模块、分析模块以及接收 模块；
    所述检测模块，用于从所述接收模块接收的第一网络流量中获取第一关键数据，并且将所述第一关键数据与特征库中的攻击特征进行匹配从而获得第一匹配结果，所述第一关键数据是所述检测模块对所述第一网络流量中包含的一个或多个报文进行协议解析后，从解析结果的指定字段中获得的数据，所述第一匹配结果包含所述第一关键数据和所述特征库中均包含的攻击特征；
    所述分析模块，用于在所述检测模块根据所述第一匹配结果确定所述第一网络流量具有攻击性的情况下，基于所述第一网络流量获得目标攻击检测模型，所述目标攻击检测模型用于识别一个或多个攻击特征，所述一个或多个攻击特征与所述特征库中的攻击特征不同；
    所述接收模块，用于接收第二网络流量；
    所述检测模块，还用于基于所述目标攻击检测模型确定所述第二网络流量是否具有攻击性。
  13. 根据权利要求12所述的网络攻击检测装置，其特征在于，
    所述检测模块，具体用于从所述第二网络流量中获取第二关键数据，将所述第二关键数据输入所述目标攻击检测模型，并根据所述目标攻击检测模型的输出，确定所述第二网络流量是否具有攻击性，所述第二关键数据是所述检测模块对所述第二网络流量中包含的一个或多个报文进行协议解析后，从解析结果的指定字段中获得的数据。
  14. 根据权利要求13所述的网络攻击检测装置，其特征在于，其中所述指定字段是所述一个或多个报文的超文本传输协议HTTP载荷，
    所述第一关键数据是所述检测模块对所述第一网络流量中包含的一个或者多个报文进行应用层协议解析后，从解析结果的HTTP载荷字段中获得的数据；
    所述第二关键数据是所述检测模块对所述第二网络流量中包含的一个或多个报文进行应用层协议解析后，从解析结果的HTTP载荷字段中获得的数据。
  15. 根据权利要求13所述的网络攻击检测装置，其特征在于，其中所述指定字段是所述一个或者多个报文的HTTP载荷，
    所述第一关键数据是所述检测模块对所述第一网络流量中包含的一个或者多个报文进行应用层协议解析，并对解析结果的HTTP载荷字段进行重组后，获得的所述第一网络流量承载的文件数据；
    所述第二关键数据是所述检测模块对所述第二网络流量中包含的一个或者多个报文进行应用层协议解析，并对解析结果的HTTP载荷字段进行重组后，获得的所述第二网络流量承载的文件数据。
  16. 根据权利要求13所述的网络攻击检测装置，其特征在于，
    所述检测模块，还用于将所述第二关键数据与所述特征库中的攻击特征进行匹配从而获得第二匹配结果，并且根据所述第二匹配结果确定所述第二网络流量不具有攻击性，所述第二匹配结果包含所述第二关键数据和所述特征库中均包含的攻击特征。
  17. 根据权利要求12至16任一项所述的网络攻击检测装置，其特征在于，所述网络攻击检测装置还包括处理模块；
    所述处理模块，用于在所述检测模块基于所述目标攻击检测模型确定所述第二网 络流量具有攻击性的情况下，按照第一预设动作对所述第二网络流量进行动作响应。
  18. 根据权利要求17所述的网络攻击检测装置，其特征在于，所述网络攻击检测装置还包括发送模块，所述第一预设动作包括阻断或告警；
    所述第一预设动作为阻断，所述处理模块，具体用于控制所述发送模块停止向网络防护设备的下一跳设备发送所述第二网络流量；
    所述第一预设动作为告警，所述处理模块，具体用于控制所述发送模块通过输出设备输出告警信息，并控制所述接收模块接收针对所述告警信息返回的指示，所述指示包括第一指示或第二指示；当所述指示为所述第一指示时，所述发送模块停止向所述网络防护设备的下一跳设备发送所述第二网络流量；当所述指示为所述第二指示时，所述发送模块向所述网络防护设备的下一跳设备发送所述第二网络流量；或，
    所述处理模块，具体用于控制所述发送模块通过输出设备输出告警信息，并停止向所述网络防护设备的下一跳设备发送所述第二网络流量；或，控制所述发送模块通过输出设备输出告警信息，并向所述网络防护设备的下一跳设备发送所述第二网络流量。
  19. 根据权利要求12至18任一项所述的网络攻击检测装置，其特征在于，
    处理模块，还用于在所述检测模块基于所述目标攻击检测模型确定所述第二网络流量不具有攻击性的情况下，按照第二预设动作对所述第二网络流量进行动作响应。
  20. 根据权利要求19所述的网络攻击检测装置，其特征在于，
    所述第二预设动作为放行，所述处理模块，具体用于控制发送模块向网络防护设备的下一跳设备发送所述第二网络流量。
  21. 根据权利要求12至20任一项所述的网络攻击检测装置，其特征在于，
    所述分析模块，具体用于将所述第一网络流量作为一个黑样本加入第一样本集，从而得到第二样本集，所述第一样本集中包括至少一个黑样本；并且基于预定算法，对所述第二样本集进行训练，得到所述目标攻击检测模型。
  22. 根据权利要求21所述的网络攻击检测装置，其特征在于，
    所述检测模块，还用于在根据所述第一匹配结果确定所述第一网络流量不具有攻击性的情况下，基于原攻击检测模型确定所述第一网络流量是否具有攻击性，所述原攻击检测模型是基于所述预定算法，对所述第一样本集训练得到的。
  23. 一种网络防护设备，其特征在于，包括存储器和与所述存储器连接的至少一个处理器，
    所述存储器用于存储指令，所述指令被所述至少一个处理器读取后，所述网络防护设备执行以下操作：从接收的第一网络流量中获取第一关键数据，并且将所述第一关键数据与特征库中的攻击特征进行匹配从而获得第一匹配结果，所述第一关键数据是所述网络防护设备对所述第一网络流量中包含的一个或者多个报文进行协议解析后，从解析结果的指定字段中获得的数据，所述第一匹配结果包含所述第一关键数据和所述特征库中均包含的攻击特征；如果所述网络防护设备根据所述第一匹配结果确定所述第一网络流量具有攻击性，基于所述第一网络流量获得目标攻击检测模型，所述目标攻击检测模型用于识别一个或多个攻击特征，所述一个或多个攻击特征与所述特征库中的攻击特征不同；接收第二网络流量；并基于所述目标攻击检测模型确定所述第 二网络流量是否具有攻击性。
  24. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质包括计算机指令，当所述计算机指令在计算机上运行时，以执行如权利要求1至11任一项所述的网络攻击检测方法。
PCT/CN2020/133366 2020-03-31 2020-12-02 一种网络攻击检测方法及装置 WO2021196691A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP20928449.6A EP4089972A4 (en) 2020-03-31 2020-12-02 NETWORK ATTACK DETECTION METHOD AND APPARATUS
US17/956,591 US20230025946A1 (en) 2020-03-31 2022-09-29 Network Attack Detection Method and Apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010245563.2 2020-03-31
CN202010245563.2A CN113472721B (zh) 2020-03-31 2020-03-31 一种网络攻击检测方法及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/956,591 Continuation US20230025946A1 (en) 2020-03-31 2022-09-29 Network Attack Detection Method and Apparatus

Publications (1)

Publication Number Publication Date
WO2021196691A1 true WO2021196691A1 (zh) 2021-10-07

Family

ID=77865458

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/133366 WO2021196691A1 (zh) 2020-03-31 2020-12-02 一种网络攻击检测方法及装置

Country Status (4)

Country Link
US (1) US20230025946A1 (zh)
EP (1) EP4089972A4 (zh)
CN (1) CN113472721B (zh)
WO (1) WO2021196691A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114338202A (zh) * 2021-12-30 2022-04-12 奇安信科技集团股份有限公司 网络攻击结果的检测方法、装置、计算设备及存储介质
CN115277244A (zh) * 2022-08-05 2022-11-01 四川启睿克科技有限公司 一种工业互联网的入侵检测系统及方法
CN115801456A (zh) * 2023-01-31 2023-03-14 天翼云科技有限公司 网络攻击检测方法、装置、电子设备及存储介质
CN116319005A (zh) * 2023-03-21 2023-06-23 上海安博通信息科技有限公司 结合自然语言处理模型的攻击检测方法、装置及处理系统

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11770405B2 (en) * 2020-09-10 2023-09-26 Arbor Networks, Inc. Automated selection of DDoS countermeasures using statistical analysis
CN114363053A (zh) * 2021-12-31 2022-04-15 深信服科技股份有限公司 一种攻击识别方法、装置及相关设备
CN114567480B (zh) * 2022-02-28 2024-03-12 天翼安全科技有限公司 有效攻击告警识别的方法、装置、安全网络及存储介质
CN114567605B (zh) * 2022-02-28 2023-12-01 天翼安全科技有限公司 一种安全引擎的调度方法、装置及可读存储介质
CN115150160A (zh) * 2022-06-29 2022-10-04 北京天融信网络安全技术有限公司 一种网络攻击特征的检测方法及系统
CN116743508B (zh) * 2023-08-15 2023-11-14 四川新立高科科技有限公司 一种电力系统网络攻击链检测方法、装置、设备及介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105656886A (zh) * 2015-12-29 2016-06-08 北京邮电大学 一种基于机器学习的网站攻击行为的检测方法及装置
US20170142136A1 (en) * 2015-11-16 2017-05-18 Electronics And Telecommunications Research Institute Method and apparatus for detecting network attacks and generating attack signatures based on signature merging
CN107241352A (zh) * 2017-07-17 2017-10-10 浙江鹏信信息科技股份有限公司 一种网络安全事件分类与预测方法及系统
CN107835201A (zh) * 2017-12-14 2018-03-23 华中师范大学 网络攻击检测方法及装置

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110238855A1 (en) * 2000-09-25 2011-09-29 Yevgeny Korsunsky Processing data flows with a data flow processor
CN107153584A (zh) * 2016-03-03 2017-09-12 中兴通讯股份有限公司 异常检测方法及装置
US10855701B2 (en) * 2017-11-03 2020-12-01 F5 Networks, Inc. Methods and devices for automatically detecting attack signatures and generating attack signature identifications
CN108718310B (zh) * 2018-05-18 2021-02-26 安徽继远软件有限公司 基于深度学习的多层次攻击特征提取及恶意行为识别方法
CN109858248B (zh) * 2018-12-26 2021-06-29 中国科学院信息工程研究所 恶意Word文档检测方法和装置
CN110149315A (zh) * 2019-04-24 2019-08-20 南京邮电大学 异常网络流量检测方法、可读存储介质和终端
CN110855676B (zh) * 2019-11-15 2021-08-31 腾讯科技（深圳）有限公司 网络攻击的处理方法、装置及存储介质

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170142136A1 (en) * 2015-11-16 2017-05-18 Electronics And Telecommunications Research Institute Method and apparatus for detecting network attacks and generating attack signatures based on signature merging
CN105656886A (zh) * 2015-12-29 2016-06-08 北京邮电大学 一种基于机器学习的网站攻击行为的检测方法及装置
CN107241352A (zh) * 2017-07-17 2017-10-10 浙江鹏信信息科技股份有限公司 一种网络安全事件分类与预测方法及系统
CN107835201A (zh) * 2017-12-14 2018-03-23 华中师范大学 网络攻击检测方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4089972A4

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114338202A (zh) * 2021-12-30 2022-04-12 奇安信科技集团股份有限公司 网络攻击结果的检测方法、装置、计算设备及存储介质
CN115277244A (zh) * 2022-08-05 2022-11-01 四川启睿克科技有限公司 一种工业互联网的入侵检测系统及方法
CN115277244B (zh) * 2022-08-05 2023-07-25 四川启睿克科技有限公司 一种工业互联网的入侵检测系统及方法
CN115801456A (zh) * 2023-01-31 2023-03-14 天翼云科技有限公司 网络攻击检测方法、装置、电子设备及存储介质
CN115801456B (zh) * 2023-01-31 2023-06-23 天翼云科技有限公司 网络攻击检测方法、装置、电子设备及存储介质
CN116319005A (zh) * 2023-03-21 2023-06-23 上海安博通信息科技有限公司 结合自然语言处理模型的攻击检测方法、装置及处理系统

Also Published As

Publication number Publication date
EP4089972A4 (en) 2023-07-05
CN113472721A (zh) 2021-10-01
US20230025946A1 (en) 2023-01-26
CN113472721B (zh) 2022-12-06
EP4089972A1 (en) 2022-11-16

Similar Documents

Publication Publication Date Title
WO2021196691A1 (zh) 一种网络攻击检测方法及装置
Rehman Javed et al. Ensemble adaboost classifier for accurate and fast detection of botnet attacks in connected vehicles
RU2680736C1 (ru) Сервер и способ для определения вредоносных файлов в сетевом трафике
Kaur et al. Hybrid intrusion detection and signature generation using deep recurrent neural networks
US11783035B2 (en) Multi-representational learning models for static analysis of source code
Comar et al. Combining supervised and unsupervised learning for zero-day malware detection
Kambar et al. A survey on mobile malware detection methods using machine learning
US20160241574A1 (en) Systems and methods for determining trustworthiness of the signaling and data exchange between network systems
US11615184B2 (en) Building multi-representational learning models for static analysis of source code
US11228610B2 (en) System and method for classifying cyber security threats using natural language processing
JP5832951B2 (ja) 攻撃判定装置、攻撃判定方法及び攻撃判定プログラム
Zagrouba et al. Machine learning based attacks detection and countermeasures in IoT
JP2023528439A (ja) 推定無罪（ｉｕｐｇ）、敵対的耐性および偽陽性耐性のあるディープラーニングモデル
Amrollahi et al. Enhancing network security via machine learning: opportunities and challenges
Fallah et al. Android malware detection using network traffic based on sequential deep learning models
Ochieng et al. Optimizing computer worm detection using ensembles
Sagu et al. Machine learning techniques for securing IoT environment
Pashamokhtari et al. AdIoTack: Quantifying and refining resilience of decision tree ensemble inference models against adversarial volumetric attacks on IoT networks
Pratomo et al. Blatta: Early exploit detection on network traffic with recurrent neural networks
Shabtai et al. Monitoring, analysis, and filtering system for purifying network traffic of known and unknown malicious content
Choi et al. Implementation and Design of a Zero‐Day Intrusion Detection and Response System for Responding to Network Security Blind Spots
CN111416812B (zh) 一种恶意脚本检测方法、设备及存储介质
Bakaletz A Machine Learning Approach for Reconnaissance Detection to Enhance Network Security
US20220407871A1 (en) Massive vulnerable surface protection
Chacko et al. Intrusion Detection using Machine Learning Techniques: An exhaustive review

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20928449

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2020928449

Country of ref document: EP

Effective date: 20220808

NENP Non-entry into the national phase

Ref country code: DE