WO2021253899A1

WO2021253899A1 - Targeted attack detection method and apparatus, and computer-readable storage medium

Info

Publication number: WO2021253899A1
Application number: PCT/CN2021/081482
Authority: WO
Inventors: 刘伯仲; 王远
Original assignee: 深信服科技股份有限公司
Priority date: 2020-06-16
Filing date: 2021-03-18
Publication date: 2021-12-23
Also published as: CN111756720B; CN111756720A

Abstract

A targeted attack detection method. The targeted attack detection method comprises the following steps: acquiring attacked information corresponding to a device; determining a first attack parameter corresponding to the attacked information, source IP addresses of which are the same; and according to the first attack parameter and a reference parameter, determining, from the source IP addresses, a target source IP address at which a targeted attack is performed on the device. Further provided are a targeted attack detection apparatus and a computer-readable storage medium. By means of the present invention, the network security of a device is ensured.

Description

Targeted attack detection method and device and computer readable storage medium

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on June 16, 2020, the application number is 202010556949.5, and the invention title is "targeted attack detection method and its device and computer-readable storage medium", and its entire content Incorporated in this application by reference.

Technical field

The present invention relates to the field of network security, in particular to a targeted attack detection method and device and computer readable storage medium.

Background technique

With the development of Internet+ and informatization, cyber attacks have become more and more common, and the threats caused by them have become more and more serious. In order to reduce losses, enterprises have also begun to attach importance to and invest heavily in safety construction. Companies purchase multiple security software with different functions according to different needs, such as firewalls, Internet behavior management, terminal security, database security, and so on. These softwares face a serious problem: a large number of alarm logs are generated locally, and it is difficult for security operation and maintenance personnel to deal with them one by one.

Some security software, such as SIEM (Security Information and Event Management, security information and event management), through the unified collection and management of logs, play a role in reducing alarms to a certain extent. However, because these software are deployed locally, only the partial situation of the attack can be seen, and the targeted attack on the device cannot be accurately detected, resulting in lower network security guarantee for the device.

The foregoing content is only used to assist in understanding the technical solutions of the present invention, and does not mean that the foregoing content is recognized as prior art.

Summary of the invention

The main purpose of the present invention is to provide a targeted attack detection method and device and computer readable storage medium, which are aimed at solving the problem of low network security guarantee of equipment.

In order to achieve the above objective, the present invention provides a targeted attack detection method, which includes the following steps:

Obtain the attacked information corresponding to the device;

Determining the first attack parameter corresponding to the attacked information with the same source IP address;

According to the first attack parameter and the reference parameter, in each of the source IP addresses, a target source IP address for a targeted attack on the device is determined.

In an embodiment, the step of determining a target source IP address for a targeted attack on the device in each of the source IP addresses according to the first attack parameter and the reference parameter includes:

Determining a ratio between the first attack parameter and a second attack parameter, the reference parameter includes a second attack parameter, and the second attack parameter is determined according to each attacked information of the device;

The source IP address corresponding to the ratio greater than the preset ratio is determined as the target source IP address of the targeted attack on the device.

Compare the first attack parameter with the preset parameter, where the reference parameter includes the preset parameter;

The source IP address corresponding to the first attack parameter that is greater than or equal to the preset parameter is determined as the target source IP address of the targeted attack on the device.

In an embodiment, after the step of determining a target source IP address for a targeted attack on the device in each of the source IP addresses according to the first attack parameter and the reference parameter, the method further includes:

Generating description information of a targeted attack according to the attacked information corresponding to the target source address;

Output the description information.

In an embodiment, the step of generating description information of a targeted attack according to the attacked information corresponding to the target source IP address includes:

Determine the attacked network segment of the device according to the attacked information corresponding to each target source IP address;

Aggregating each of the attacked network segments to obtain the attacked aggregate network segment, where the description information includes the attacked aggregate network segment.

In an embodiment, the step of generating description information for a sexual attack according to the attacked information corresponding to the target source IP address includes:

Determine, according to the attacked information corresponding to each target source IP address, an attack characteristic of each target source IP address for a targeted attack on the device;

Determine the attack network segment corresponding to each target source IP address corresponding to the same attack feature;

Aggregating each of the attacking network segments to obtain an attacking aggregated network segment, where the description information includes the attacking aggregated network segment.

In an embodiment, the first attack parameter includes the number of attacks on the device by the source IP address or the cumulative attack duration of the attack on the device by the source IP address.

To achieve the above objective, the present invention also provides a targeted attack detection device, the targeted attack detection device includes:

Obtain the module to obtain the attacked information corresponding to the device;

A determining module, configured to determine the first attack parameter corresponding to the attacked information with the same source IP address;

The determining module is further configured to determine a target source IP address for a targeted attack on the device in each of the source IP addresses according to the first attack parameter and the reference parameter.

To achieve the above objective, the present invention also provides a targeted attack detection device, which includes a memory, a processor, and a targeted attack detection program stored in the memory and running on the processor When the targeted attack detection program is executed by the processor, each step of the above-mentioned targeted attack detection method is realized.

To achieve the above objective, the present invention also provides a computer-readable storage medium that stores a targeted attack detection program, and the targeted attack detection program is executed by the processor as described above The individual steps of the targeted attack detection method.

According to the targeted attack detection method and device and computer-readable storage medium proposed in the embodiment of the present invention, the targeted attack detection device obtains the attacked information corresponding to the device, and determines the first attack parameter corresponding to the attacked information with the same source IP address , And determine the target source IP address of the targeted attack on the device in each source IP address according to the first attack parameter and the reference parameter. Since the targeted detection device collects the attacked information of the device and determines the attack parameters of each attacked information of the same source IP address, the source IP address of the targeted attack on the device is accurately determined according to the attack parameters, so that the device is more targeted. The source IP address of the attack adopts corresponding protective measures to ensure the network security of the device.

Description of the drawings

FIG. 1 is a schematic diagram of the hardware of a targeted attack detection device involved in a solution of an embodiment of the present invention;

2 is a schematic flowchart of the first embodiment of the targeted attack detection method of the present invention;

3 is a schematic diagram of the detailed process of step S30 in the second embodiment of the targeted attack detection method of the present invention;

4 is a schematic diagram of the detailed flow of step S30 in the third embodiment of the targeted attack detection method of the present invention;

FIG. 5 is a schematic flowchart of a fourth embodiment of the targeted attack detection method of the present invention;

FIG. 6 is a detailed flowchart of step S40 in the fifth embodiment of the targeted attack detection method of the present invention;

FIG. 7 is a detailed flowchart of step S40 in the sixth embodiment of the targeted attack detection method of the present invention;

Figure 8 is a schematic diagram of functional modules of the targeted attack detection device of the present invention.

detailed description

It should be understood that the specific embodiments described here are only used to explain the present invention, but not used to limit the present invention.

The main solution of the embodiment of the present invention is: obtain the attacked information corresponding to the device; determine the first attack parameter corresponding to the attacked information with the same source IP address; In the source IP address, a target source IP address for a targeted attack on the device is determined.

The present invention provides a solution. Since the targeted detection device collects the attacked information of the equipment and determines the attack parameters of the attacked information of the same source IP address, the source of the targeted attack on the equipment is accurately determined according to the attack parameters. The IP address enables the device to adopt corresponding protective measures against the source IP address of the targeted attack, ensuring the network security of the device.

As an implementation manner, the targeted attack detection device may be as shown in FIG. 1.

Referring to FIG. 1, FIG. 1 is a targeted attack detection device involved in a solution of an embodiment of the present invention. The targeted attack detection device may include a processor 1001, such as a CPU, a memory 1002, and a communication bus 1003. Among them, the communication bus 1003 is used to realize the connection and communication between these components. The memory 1003 may be a high-speed RAM memory, or a non-volatile memory (non-volatile memory), such as a magnetic disk memory. Optionally, the memory 1002 may also be a storage device independent of the aforementioned processor 1001. As a computer storage medium, the memory 1002 may include a targeted attack detection program. The processor 1001 may be used to call a targeted attack detection program stored in the memory 1002, and perform the following operations:

Obtain the attacked information corresponding to the device;

In an embodiment, the processor 1001 may call a targeted attack detection program stored in the memory 1005, and also perform the following operations:

Output the description information.

In this embodiment, according to the above solution, the targeted attack detection device obtains the attacked information corresponding to the device, and determines the first attack parameter corresponding to the attacked information with the same source IP address, and according to the first attack parameter and the reference parameter in each source IP The address determines the source IP address of the target for targeted attacks on the device. Since the targeted detection device collects the attacked information of the device and determines the attack parameters of each attacked information of the same source IP address, the source IP address of the targeted attack on the device is accurately determined according to the attack parameters, so that the device is more targeted. The source IP address of the attack adopts corresponding protective measures to ensure the network security of the device.

Based on the hardware architecture of the above-mentioned targeted attack detection device, various embodiments of the targeted attack detection method of the present invention are proposed.

Referring to Fig. 2, Fig. 2 is a first embodiment of a method for detecting a targeted attack according to the present invention. The method for detecting a targeted attack includes:

Step S10, obtain the attacked information corresponding to the device;

In this embodiment, the execution subject is a targeted attack detection device. The targeted attack detection device communicates with the cloud, or the targeted attack detection device is the cloud. The device is equipped with multiple security software, which can be applications such as firewall, Internet behavior management, terminal security, and database security. The device can be registered on the cloud, so that the security software in the device can upload the security data to the cloud, and classify each security data as the security data corresponding to the device. Specifically, when the security software detects that the device is under attack, it generates security data and sends the security data to the cloud. The cloud receives the security data, determines the device where the security software that sends the security data is located, and stores the security data in association with the device. Of course, the security data also includes the log data of key security events generated by the operating system of the device. The log data records the time when the attack is detected, the type of the event, and the actors associated with the event, and some logs also contain the risk level of the alarm. . For ease of description, the device used below refers to the targeted attack detection device. Of course, the device itself can be used as a targeted attack detection device, that is, the targeted attack detection device collects security data about itself under attack.

The device can perform targeted attack detection on the device regularly, and can also perform targeted attack detection based on the targeted attack detection request sent by the device. At this time, the device obtains the attacked information corresponding to the device, and there are multiple attacked information. It should be noted that the device first obtains the security data corresponding to the device from the cloud, and the security data may be the security data in the most recent time period, for example, the most recent week. The device will clean the safety data first, that is, filter the data that does not meet the requirements in the safety data, remove redundant data or erroneous data, and only retain valid data. The data to be cleaned generally includes the following forms: 1) Analyze log records with incorrect format, such as log length that does not meet the requirements; 2) Analyze logs with incorrect content, such as IP address, port number, and other information that is not in the normal range; 3) The parsing information does not meet the requirements of the detection logic, for example, the parsing result shows that the log is a communication behavior between intranet hosts.

After the security data is cleaned, feature extraction is performed on the cleaned security data. The feature refers to the feature of the network attack, so as to obtain the attacked information containing the feature data. The characteristic data can be information such as the source IP, destination IP, alarm type, and time of alarm generation of the firewall data terminal.

Step S20: Determine the first attack parameter corresponding to the attacked information with the same source IP address;

The device is equipped with detection rules for targeted attacks, and the detection rules can include one or more, which can be set according to the actual situation. The device needs to obtain the first attack parameter corresponding to each attacked information with the same source IP address to determine whether the first attack parameter meets the detection rule. If the first attack parameter meets the detection rule, the source IP corresponding to the first attack parameter can be determined The address carried out a targeted attack on the device. The first attack parameter includes the number of attacks on the device by the source IP address or the cumulative attack duration of the attack on the device by the source IP address.

After obtaining each attacked information corresponding to the device, the device determines each attacked information with the same source IP address. Specifically, the attacked information includes the active IP address, and the device traverses each attacked information to determine each attacked information with the same source IP address. The device counts the first attack parameters while traversing each attacked information. After the device completes the traversal of each attacked information, the first attack parameter can be obtained by statistics. Of course, the device can also classify each attacked information, the source IP address of each attacked information after classification is the same, and the first attack parameter is determined for each source IP address after classification.

Step S30: Determine a target source IP address for a targeted attack on the device in each of the source IP addresses according to the first attack parameter and the reference parameter.

The detection rules can be set by reference parameters. That is, the device judges whether the first attack parameter matches the reference parameter, and if they match, it can be determined that the source IP address corresponding to the first attack parameter has carried out a targeted attack on the device, and the source IP address is the target source IP address. The reference parameter includes a preset parameter or a second attack parameter, and the type of the reference parameter is the same as the type of the first attack parameter. For example, if the first attack parameter is the number of attacks, the preset parameter may be the preset number of attacks; if the first attack parameter is the cumulative attack duration, the preset parameter may be the preset attack duration. The second attack parameter is determined by all the attacked information of the device, and the second attack parameter includes the total number of attacks for which the device is attacked or the cumulative total attack duration for which the device is attacked.

After obtaining the first attack parameter corresponding to each source IP address, the device determines whether each first attack parameter matches the reference parameter. For example, the first attack parameter is the number of attacks, and the reference parameter is the preset number of attacks. If the first attack parameter is greater than or equal to the preset number of attacks, it can be determined that the first attack parameter matches the reference parameter. The device determines each source IP address that matches the reference parameter as the target source IP address, and the target source IP address is the source IP address that initiates a targeted attack on the device.

In the technical solution provided in this embodiment, the targeted attack detection apparatus obtains the attacked information corresponding to the device, and determines the first attack parameter corresponding to the attacked information with the same source IP address, and compares the first attack parameter with the reference parameter according to the first attack parameter and the reference parameter. In each source IP address, the target source IP address for targeted attacks on the device is determined. Since the targeted detection device collects the attacked information of the device and determines the attack parameters of each attacked information of the same source IP address, the source IP address of the targeted attack on the device is accurately determined according to the attack parameters, so that the device is more targeted. The source IP address of the attack adopts corresponding protective measures to ensure the network security of the device.

Referring to Fig. 3, Fig. 3 is a second embodiment of the targeted attack detection method of the present invention. Based on the first embodiment, the step S30 includes:

Step S31: Determine a ratio between the first attack parameter and the second attack parameter, the reference parameter includes a second attack parameter, and the second attack parameter is determined according to each attacked information of the device;

Step S32: Determine the source IP address corresponding to the ratio that is greater than the preset ratio as the target source IP address for a targeted attack on the device.

In this embodiment, the reference parameter includes the second attack parameter, and the second attack parameter includes the total number of attacks in which the device is attacked or the cumulative total attack time period in which the device is attacked. The device is acquiring the first attack parameter and the second attack parameter, and then calculates the ratio between the first attack parameter and the second attack parameter. It should be noted that the time windows corresponding to the first attack parameter and the second attack parameter are the same. For example, the first attack parameter is the number of attacks, the second number of attacks is the total number of attacks, the number of attacks is determined by the attacked information in the first set in the target time window, and the total number of attacks is determined by the device in the target time window The attacked information is confirmed.

After determining the ratio, the device judges whether the ratio is greater than the preset ratio. If the ratio is greater than the preset ratio, it can be determined that the source IP address of the first attack parameter corresponding to the ratio is the target source IP address, that is, the target source IP address vs. the device Carried out a targeted attack. The first attack parameter includes the number of attacks or the accumulated attack time, and the ratio is the ratio between the number of attacks and the total number of attacks, or the ratio between the accumulated attack time and the accumulated attack time. The two ratios correspond to different preset ratios. . The device determines the corresponding preset ratio according to the specific ratio to determine the target source IP address.

In the technical solution provided in this embodiment, the device determines the ratio between the first attack parameter and the second attack parameter, and judges whether the ratio is greater than the preset ratio, and if it is greater, the source IP address corresponding to the first attack parameter is taken as Target source IP address, so as to accurately determine the source IP address for targeted attacks on the device.

Referring to Figure 4, Figure 4 is a third embodiment of the targeted attack detection method of the present invention. Based on the first embodiment, the step S30 includes:

Step S33: Compare the first attack parameter with the preset parameter, where the reference parameter includes the preset parameter;

Step S34: Determine the source IP address corresponding to the first attack parameter that is greater than or equal to the preset parameter as the target source IP address for the targeted attack on the device.

In this embodiment, the reference parameters include preset parameters. The preset parameters are of the same type as the first attack parameter. When the first attack parameter is the number of attacks, the preset parameter is the preset number of attacks; when the first attack parameter is the cumulative duration of the attack, the preset parameter is the preset attack duration.

The device compares the first attack parameter with the preset parameter, and if the first attack parameter is greater than or equal to the preset parameter, the source IP address corresponding to the first attack parameter is determined as the target source IP address for the targeted attack on the device . For example, if the number of first attacks is 50 times, and the preset number of attacks is 30 times, at this time, it can be determined that the source IP address corresponding to the first attack parameter is the target source IP address.

In the technical solution provided in this embodiment, the device determines to compare the first attack parameter with the preset parameter, and if the first attack parameter is greater than the preset parameter, the source IP address corresponding to the first attack parameter is used as the target source IP address, In this way, the source IP address of the targeted attack on the device can be accurately determined.

Referring to Fig. 5, Fig. 5 is a fourth embodiment of the targeted attack detection method of the present invention. Based on any one of the first to third embodiments, after the step S30, the method further includes:

Step S40, generating description information of a targeted attack according to the attacked information corresponding to the target source IP address;

Step S50, output the description information.

After determining the target source IP address, the device obtains each attacked information corresponding to the target source IP address, and analyzes each attacked information, thereby generating description information of a targeted attack. The description information can include the attack behavior parameters of the target source IP address on the device. The attack behavior parameters include the identity ID of the attacker, the identity ID of the victim, the attack type, attack time, etc. The attacker ID can be its IP address, attack type It can be vulnerability scanning, password blasting, etc. That is, the device extracts attack behavior parameters from each attacked information to obtain the description information of the targeted attack. The device outputs description information. If the device itself is a device, the description information is displayed; if the device is in the cloud, the description information is output to the device, so that the device adopts corresponding protective measures based on the description information.

It should be noted that after the device generates the description information, it can generate the prompt information according to the description information, and output the prompt information and the description information at the same time. The prompt message can be: the source IP address has targeted the device, and it is recommended to isolate the source IP address. Of course, the source IP address in the prompt message needs to be written directly.

In the technical solution provided in this embodiment, the device determines the various attacked information corresponding to the target source IP address to determine the description information of the target source IP address for the targeted attack on the device, and then outputs the description information so that the device can be based on the description information Adopt corresponding protective measures to protect the equipment safely.

Referring to Fig. 6, Fig. 6 is a fifth embodiment of the targeted attack detection method of the present invention. Based on the fourth embodiment, the step S40 includes:

Step S41: Determine the attacked network segment of the device according to the attacked information corresponding to each target source IP address;

Step S42: Aggregate each of the attacked network segments to obtain the attacked aggregate network segment, where the description information includes the attacked aggregate network segment.

In this embodiment, the description information includes the attacked aggregate network segment of the device. Network segment refers to the part of a computer network that can communicate directly with the same physical layer equipment. The attacked aggregate network segment refers to the attacked part of the network where the device is located.

The device determines the attacked network segment of the device according to the attacked information corresponding to each target source IP address. There are multiple attacked network segments. The device aggregates the attacked network segments to obtain the attacked aggregate network segment. The attacked aggregate network segment can be the network segment with the most attacks, or it can be composed of each attacked network segment. Set, and there is no overlapping attacked network segment in the set.

In the technical solution provided in this embodiment, the device determines the attacked network segment of the device according to the attacked information of each target source IP address, and then aggregates the attacked network segments to obtain the attacked aggregate network segment, so that the device can know The attacked network segment, so that the device adopts corresponding protection measures according to the attacked aggregate network segment.

Referring to Fig. 7, Fig. 7 is a sixth embodiment of a targeted attack detection method of the present invention. Based on the fourth or fifth embodiment, the step S40 includes:

Step S43: According to the attacked information corresponding to each target source IP address, determine the attack characteristics of each target source IP address for a targeted attack on the device;

Step S44: Determine the attack network segment corresponding to each target source IP address corresponding to the same attack feature;

Step S45: Aggregate each of the attacked network segments to obtain an attacked aggregated network segment, wherein the description information includes the attacked aggregated network segment.

In this embodiment, the attacker can use multiple source IP addresses to perform targeted attacks on the device, that is, the attacker uses multiple network segments to attack the device. Therefore, the description information may include the aggregated network segment where the attacker performs a targeted attack on the device, and the aggregated network segment is the attack aggregated network segment.

In this regard, after determining multiple target source IP addresses, the device needs to judge each target source IP address to determine the target source IP address belonging to the same attacker. Specifically, the device first determines the attack feature corresponding to each target source IP address, and the attack feature can be determined by each attacked information corresponding to the target source IP address. The attack feature is the attack behavior parameter of the target source IP address on the device. For the attack behavior parameter, refer to the above description, which will not be repeated here. After determining the attack characteristics corresponding to each target source IP address, the device makes similar judgments on each attack characteristic, and puts the similar attack characteristics into one category. The target source IP address corresponding to this type of attack characteristic constitutes the first The second set, that is, the attackers corresponding to each target source IP address in the second set are the same. It should be noted that each attack feature consists of multiple features, for example, attack type and attack frequency. If the attack type is the same and the attack frequency is in the same range, it can be determined that the two attack characteristics are similar.

After obtaining the second set, the device can determine the attack network segment used by each target source IP address in the second set to perform a targeted attack on the device, and the attack network segment is determined by the attacked information corresponding to the target source IP address. Therefore, each attack network segment used by the attacker corresponding to the second set can be determined, and the device aggregates each attack network segment to attack the aggregate network segment. The attack aggregate network segment can be the attacker targeting the device. The network segment with the most frequent sexual attacks can also be a collection composed of various attack network segments, and the attack network segments in the collection do not overlap.

Of course, the device can directly traverse the attack characteristics of each target source IP address to determine each target source IP address of the same attack characteristic, and when traversing to the target source IP address of the same attack characteristic, determine the target source IP address corresponding Attack the network segment. After the device traverses each attack feature, it can determine the attack network segment corresponding to each target source IP address corresponding to the same attack feature, and finally aggregate each attack network to obtain the attack aggregation network segment.

In the technical solution provided in this embodiment, the device determines the attack characteristics of each target source IP address for a targeted attack on the device according to the attacked information corresponding to each target source IP address, so as to determine each of the attackers belonging to the same attacker according to the attack characteristics. The target source IP address is used to determine the attack network segments used by the attacker to target the device. Finally, the attack network segments are aggregated to obtain the attack aggregate network segment, so that the device adopts corresponding protection measures according to the attack aggregate network segment.

The invention also provides a targeted attack detection device.

Referring to FIG. 8, FIG. 8 is a schematic diagram of functional modules of a targeted attack detection device according to the present invention. The targeted attack detection device 100 includes:

The obtaining module 110 obtains the attacked information corresponding to the device;

The determining module 120 is configured to determine the first attack parameter corresponding to the attacked information with the same source IP address;

The determining module 120 is further configured to determine a target source IP address for a targeted attack on the device in each of the source IP addresses according to the first attack parameter and the reference parameter.

The targeted detection apparatus 100 is also used to implement various embodiments of the targeted attack detection method. For details, refer to the above-mentioned embodiments, and details are not described herein again.

The present invention also provides a targeted attack detection device. The targeted attack detection device includes a memory, a processor, and a targeted attack detection program stored in the memory and running on the processor. When the attack detection program is executed by the processor, each step of the targeted attack detection method described in the above embodiment is implemented.

The present invention also provides a computer-readable storage medium, the computer-readable storage medium stores a targeted attack detection program, and when the targeted attack detection program is executed by the processor, the targeted attack as described in the above embodiment is achieved The various steps of the attack detection method.

It should be noted that in this article, the terms "include", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements not only includes those elements, It also includes other elements not explicitly listed, or elements inherent to the process, method, article, or system. If there are no more restrictions, the element defined by the sentence "including a..." does not exclude the existence of other identical elements in the process, method, article, or system that includes the element.

The sequence numbers of the foregoing embodiments of the present invention are only for description, and do not represent the superiority or inferiority of the embodiments.

Through the description of the above implementation manners, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform. Of course, it can also be implemented by hardware, but in many cases the former is better.的实施方式。 Based on this understanding, the technical solution of the present invention essentially or the part that contributes to the existing technology can be embodied in the form of a software product, and the computer software product is stored in a storage medium (such as ROM/RAM) as described above. , Magnetic disk, optical disk), including several instructions to make a terminal device (can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) execute the method described in each embodiment of the present invention.

The above are only the preferred embodiments of the present invention, and do not limit the scope of the present invention. Any equivalent structure or equivalent process transformation made by using the content of the description and drawings of the present invention, or directly or indirectly applied to other related technical fields , The same reason is included in the scope of patent protection of the present invention.

Claims

A targeted attack detection method, characterized in that the targeted attack detection method includes the following steps:

Obtain the attacked information corresponding to the device;

Determining the first attack parameter corresponding to the attacked information with the same source IP address;

According to the first attack parameter and the reference parameter, in each of the source IP addresses, a target source IP address for a targeted attack on the device is determined.
The method for detecting a targeted attack according to claim 1, wherein the target of the targeted attack on the device is determined in each of the source IP addresses according to the first attack parameter and the reference parameter The steps for the source IP address include:

Determining a ratio between the first attack parameter and a second attack parameter, the reference parameter includes a second attack parameter, and the second attack parameter is determined according to each attacked information of the device;

The source IP address corresponding to the ratio that is greater than the preset ratio is determined as a target source IP address for a targeted attack on the device.
The method for detecting a targeted attack according to claim 1, wherein the target of the targeted attack on the device is determined in each of the source IP addresses according to the first attack parameter and the reference parameter The steps for the source IP address include:

Compare the first attack parameter with the preset parameter, where the reference parameter includes the preset parameter;

The source IP address corresponding to the first attack parameter that is greater than or equal to the preset parameter is determined as the target source IP address of the targeted attack on the device.
The method for detecting a targeted attack according to claim 1, wherein the target of the targeted attack on the device is determined in each of the source IP addresses according to the first attack parameter and the reference parameter After the source IP address step, it also includes:

Generating description information of a targeted attack according to the attacked information corresponding to the target source address;

Output the description information.
The targeted attack detection method according to claim 4, wherein the step of generating description information of the targeted attack according to the attacked information corresponding to the target source IP address comprises:

Determine the attacked network segment of the device according to the attacked information corresponding to each target source IP address;

Aggregating each of the attacked network segments to obtain the attacked aggregate network segment, where the description information includes the attacked aggregate network segment.
The targeted attack detection method according to claim 4, wherein the step of generating description information of the targeted attack according to the attacked information corresponding to the target source IP address comprises:

Determine, according to the attacked information corresponding to each target source IP address, an attack characteristic of each target source IP address for a targeted attack on the device;

Determine the attack network segment corresponding to each target source IP address corresponding to the same attack feature;

Aggregating each of the attacking network segments to obtain an attacking aggregated network segment, where the description information includes the attacking aggregated network segment.
The targeted attack detection method according to any one of claims 1-6, wherein the first attack parameter includes the number of attacks on the device by the source IP address or the number of attacks on the device by the source IP address. The cumulative attack duration of the attack.
A targeted attack detection device, characterized in that the targeted attack detection device includes:

Obtain the module to obtain the attacked information corresponding to the device;

A determining module, configured to determine the first attack parameter corresponding to the attacked information with the same source IP address;

The determining module is further configured to determine a target source IP address for a targeted attack on the device in each of the source IP addresses according to the first attack parameter and the reference parameter.
A targeted attack detection device, characterized in that the targeted attack detection device includes a memory, a processor, and a targeted attack detection program stored in the memory and running on the processor. When the attack detection program is executed by the processor, each step of the targeted attack detection method according to any one of claims 1-7 is realized.
A computer-readable storage medium, characterized in that the computer-readable storage medium stores a targeted attack detection program, and when the targeted attack detection program is executed by the processor, the implementation is as in any one of claims 1-7. Each step of the targeted attack detection method described in the item.