CN108810014A - Attack alarm method and device - Google Patents

Abstract

The present invention relates to the technical field of information security, and in particular to an attack event warning method and device. The method includes: monitoring whether there is an attack behavior that attacks a target object; Behavior type; according to the behavior type of the attack behavior, determine the attack threat degree of the attack behavior to the target object; after the attack behavior completes the attack on the target object, obtain the information used to characterize the attack behavior An attack result indicating whether the attack on the target object is successful; according to the attack threat level and the attack result, an alarm is given to the attack behavior. The present invention combines the attack threat degree and the attack result of the attack behavior to give an alarm to the attack behavior, so that the threat of the attack behavior to the target object can be determined more accurately, and the warning of the attack behavior is improved. Accuracy.

Description

Attack event warning method and device

technical field

The invention relates to the technical field of information security, in particular to an attack event warning method and device.

Background technique

Information security mainly includes the following five aspects, that is, the need to ensure the confidentiality, authenticity, integrity, unauthorized copying and security of the parasitic system of information. Specifically, information security itself can include how to prevent the leakage of commercial enterprise secrets, Prevent teenagers from browsing bad information and leaking personal information. The information security system in the network environment is the key to ensuring information security, as long as there are security holes, it can threaten the overall security.

In the prior art, when the attack behavior attacks the target object, the threat situation of the attack event to the target object is usually determined according to the vulnerability level of the target object targeted by the attack behavior, so that the attack can be realized according to the determined threat situation. Behavior alerts, however, the threat situation determined by the above method is often inaccurate, which leads to a technical problem of low accuracy in the attack behavior alerts.

Contents of the invention

In view of the above problems, the present invention is proposed to provide an attack event warning method and device that overcome the above problems or at least partially solve the above problems.

According to a first aspect of the present invention, a method for alerting an attack event is provided, the method comprising:

Monitor whether there is an attack on the target object;

When the presence of the attacking behavior is detected, determining the behavior type of the attacking behavior;

According to the behavior type of the attack behavior, determine the attack threat level of the attack behavior to the target object;

After the attack behavior completes the attack on the target object, acquiring an attack result used to characterize whether the attack behavior on the target object is successful;

According to the attack threat level and the attack result, an alarm is given to the attack behavior.

Preferably, the monitoring whether there is an attack on the target object includes:

Monitoring whether there is an attack request of the attack behavior on the target object;

Wherein, if the attack request is detected, it indicates that the attack behavior exists; otherwise, it indicates that the attack behavior does not exist.

Preferably, when the presence of the attacking behavior is detected, determining the behavior type of the attacking behavior includes:

When it is detected that the attack request exists, the behavior type of the attack behavior is determined according to the attack request.

Preferably, according to the behavior type of the attack behavior, determining the attack threat degree of the attack behavior to the target object includes:

According to the behavior type of the aggressive behavior, the threat score of the aggressive behavior is determined from a preset correspondence between the behavior type and the threat score, wherein the threat score of the aggressive behavior is used to characterize the aggressive behavior The level of attack threat to the target object.

Preferably, after the attack behavior completes the attack on the target object and before acquiring the attack result for characterizing whether the attack behavior on the target object is successful, the method further includes:

Obtain a response message of the target object to the attack behavior;

Wherein, the acquisition of the attack result used to characterize whether the attack on the target object is successfully attacked by the attack behavior includes:

An attack result for representing whether the attack on the target object is successfully attacked by the attack behavior is acquired according to the response message.

Preferably, the attack result is an attack result weight.

Preferably, when the attack result is the weight of the attack result, the alerting of the attack behavior according to the attack threat degree and the attack result includes:

multiplying the threat score of the attack behavior by the weight of the attack result to obtain the attack score;

The attack behavior is alerted according to the attack score.

Preferably, the alerting the attack behavior according to the attack score includes:

judging whether the attack score is higher than a preset warning threshold;

When the attack score is higher than the preset high alarm threshold, an alarm message is sent to the user.

Preferably, when there are multiple aggressive behaviors, after obtaining the attack score of each aggressive behavior, the method further includes:

All the attack behaviors are sorted according to the attack scores, and an attack ranking result for representing the threat of all the attack behaviors to the target object is obtained.

Preferably, the target object is hardware, software, system or protocol in the client or server.

According to a second aspect of the present invention, an attack event warning device is provided, the device comprising:

A monitoring module, configured to monitor whether there is an attack behavior on the target object;

A first determination module, configured to determine the behavior type of the attack when the presence of the attack is detected;

The second determination module is configured to determine the degree of attack threat of the attack behavior to the target object according to the behavior type of the attack behavior;

A first acquiring module, configured to acquire an attack result indicating whether the attack on the target object by the attack behavior is successful after the attack on the target object is completed by the attack behavior;

An alarm module, configured to alarm the attack behavior according to the attack threat level and the attack result.

Preferably, the monitoring module is specifically used for:

Monitoring whether there is an attack request of the attack behavior on the target object;

Wherein, if the attack request is detected, it indicates that the attack behavior exists; otherwise, it indicates that the attack behavior does not exist.

Preferably, the first determination module is specifically used for:

When it is detected that the attack request exists, the behavior type of the attack behavior is determined according to the attack request.

Preferably, the second determination module is specifically used for:

According to the behavior type of the aggressive behavior, the threat score of the aggressive behavior is determined from a preset correspondence between the behavior type and the threat score, wherein the threat score of the aggressive behavior is used to characterize the aggressive behavior The level of attack threat to the target object.

Preferably, the device also includes:

A second acquiring module, configured to acquire a response message of the target object to the attack behavior;

Wherein, the first acquisition module is specifically used for:

An attack result for representing whether the attack on the target object is successfully attacked by the attack behavior is acquired according to the response message.

Preferably, the attack result is an attack result weight.

Preferably, when the attack result is the weight of the attack result, the alarm module includes:

an obtaining unit, configured to multiply the threat score of the attack behavior by the weight of the attack result to obtain the attack score;

An alarm unit, configured to alarm the attack behavior according to the attack score.

Preferably, the alarm unit includes:

a judging subunit, configured to judge whether the attack score is higher than a preset warning threshold;

The sending subunit is configured to send warning information to the user when the attack score is higher than a preset high warning threshold.

Preferably, when there are multiple attacks, the device further includes:

The sorting module is configured to sort all the attacking behaviors according to the attack scores, and obtain an attack sorting result for representing the threat of all the attacking behaviors to the target object.

Preferably, the target object is hardware, software, system or protocol in the client or server.

According to a third aspect of the present invention, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, any method step in the first aspect of the present invention is implemented.

According to a fourth aspect of the present invention, a computer device is provided, including a memory, a processor, and a computer program stored on the memory and operable on the processor, when the processor executes the program, the computer program according to the present invention is realized. Any method step of the first aspect.

According to the attack event alarm method and device of the present invention, by monitoring whether there is an attack behavior that attacks the target object, when the presence of the attack behavior is detected, the behavior type of the attack behavior is determined, and the attack behavior is determined according to the behavior type of the attack behavior The degree of attack threat to the target object. After the attack behavior completes the attack on the target object, the attack result used to characterize whether the attack behavior is successful on the target object is obtained. Finally, according to the attack threat degree and attack result, the attack behavior Alerting, because the attack threat degree of the attack behavior and the attack result are combined to consider the attack behavior, so that the threat of the attack behavior to the target object can be determined more accurately, and the warning of the attack behavior can be improved. Accuracy.

The above description is only an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention, it can be implemented according to the contents of the description, and in order to make the above and other purposes, features and advantages of the present invention more obvious and understandable , the specific embodiments of the present invention are enumerated below.

Description of drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiment. The drawings are only for the purpose of illustrating a preferred embodiment and are not to be considered as limiting the invention. Also throughout the drawings, the same components are represented by the same reference figures. In the attached picture:

Fig. 1 shows the flowchart of the attack event warning method in the embodiment of the present invention;

FIG. 2 shows a structural diagram of an attack event warning device in an embodiment of the present invention;

Fig. 3 shows a structural diagram of a computer device in an embodiment of the present invention.

Detailed ways

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided for more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

An embodiment of the present invention provides an attack event alarm method, which can be applied to a server or a client, as shown in FIG. 1 , the method includes:

Step 101: Monitor whether there is an attack behavior on the target object.

Step 102: When an attack behavior is detected, determine the behavior type of the attack behavior.

Step 103: According to the behavior type of the attack behavior, determine the degree of attack threat of the attack behavior to the target object.

Step 104: After the attack behavior completes the attack on the target object, obtain an attack result for representing whether the attack behavior on the target object is successful.

Step 105: Alarming the attack behavior according to the attack threat level and the attack result.

Specifically, if the attack event warning method of the present invention is applied in the server, the target object can be hardware, software, system or protocol in the server; if the attack event warning method of the present invention is applied in the client, the target object Can be hardware, software, system or protocol in the client. However, the attack behavior corresponds to the type of the target object, that is, the attack behavior is a behavior that can cause a security threat to the target object. For example, if the target object is a system, software or protocol in the PC client, the corresponding attack behavior can be Overflow, free re-reference, array out of bounds, denial of service, double free, kernel extraction, privilege commission \ bypass, logic vulnerability, information leakage, DLL hijacking and XSS, etc., if the target object is the system, software or protocol in the client , the corresponding attack behaviors can be information leakage, XSS, code execution, logical loopholes, phishing fraud and denial of service, etc. If the target object is the system, software or protocol in the server, the corresponding attack behaviors can be remote code execution, DOS , suspected intrusion or high-risk ports, etc.

Further, in step 101, for how to monitor whether there is an attack behavior, the embodiment of the present invention provides the following implementation manner: monitor whether there is an attack request of the attack behavior on the target object.

Specifically, when the attack behavior attempts to attack the target object, an attack request is usually sent out. By monitoring whether there is an attack request, it can be judged whether there is an attack behavior. If there is an attack request detected, it indicates that there is an attack on the target object. Behavior, if no attack request is detected, it indicates that there is no attack behavior to attack the target object.

Further, the attack request includes the behavior type of the attack behavior, that is, the behavior type of the attack behavior can be known according to the attack request. In step 102, when an attack request is detected, the behavior type of the attack behavior is determined according to the attack request.

Further, after the behavior type of the attack behavior is determined, in step 103, for how to determine the attack threat degree of the attack behavior to the target object, the embodiment of the present invention provides the following implementation: according to the behavior type of the attack behavior, from the preset In the corresponding relationship between the behavior type and the threat score, the threat score of the attack behavior is determined, wherein the threat score of the attack behavior is used to represent the attack threat degree of the attack behavior to the target object.

Specifically, in the embodiment of the present invention, the corresponding relationship between the behavior type and the threat score is established in advance, wherein the behavior type with a higher degree of threat to the safety of the target object has a higher corresponding threat score, For high-risk attack behaviors, medium-risk attack behaviors, and low-risk attack behaviors, the threats to the security of the target object caused by the above three attack behaviors are reduced in turn, that is, the threat level of high-risk attack behaviors to the security of the target object is higher than that of Medium-risk attack behavior, the threat degree of medium-risk attack behavior to the security of the target object is higher than that of low-risk attack behavior, and the threat score corresponding to high-risk attack behavior is greater than the threat score of medium-risk attack behavior, the threat of medium-risk attack behavior The score is greater than the threat score for low-risk aggressive behavior. For example, if the behavior type of the attack behavior is XSS attack behavior, the full name of XSS attack behavior is cross-site scripting attack, and XSS attack behavior is a computer security hole in WEB applications, which allows malicious WEB users to implant code into other In the page used by the user, the threat to the security of the target object is very high, which is a high-risk attack behavior. Therefore, the XSS attack behavior has a high threat score, such as 8 points; if the behavior type of the attack behavior is an information leakage attack Behaviors that pose a general threat to the security of the target object belong to medium-risk attack behaviors. Therefore, information leakage attack behaviors have a threat score at an intermediate score, such as 5 points.

Further, after the behavior type of the aggressive behavior is determined, based on the behavior type of the aggressive behavior, the threat score of the aggressive behavior is found from the pre-established correspondence between the behavior type and the threat score. For example, if it is determined that the behavior type of the attack behavior is an XSS attack behavior, it is found from the correspondence between the pre-established behavior type and the threat score that the threat score corresponding to the XSS attack behavior is 8 points. If the behavior type of the behavior is an information leakage attack behavior, the threat score corresponding to the information leakage attack behavior is found to be 5 points from the pre-established correspondence between the behavior type and the threat score.

Further, after the threat score of the attack behavior is determined, in step 104, after the attack behavior completes the attack on the target object, an attack result for indicating whether the attack behavior on the target object is successful is obtained. For how to know the attack result of the attack behavior, the embodiment of the present invention provides the following implementation: After the attack behavior completes the attack on the target object, firstly obtain the response message of the target object to the attack behavior, wherein the response message contains information used to characterize the attack. Behavior the attack result of whether the attack on the target object is successful, and then determine the attack result according to the response message, and the attack result includes two cases of attack success and attack failure.

Further, in the embodiment of the present invention, the attack results can be implemented in the form of attack result weights. Specifically, the weight corresponding to the attack result being a successful attack is higher than the weight corresponding to the attack result being an attack failure, and the attack result weight The assigned specific value can be adjusted according to the actual situation. Usually, the setting range of the attack result weight is 0 to 1, that is, the weight corresponding to the attack result being a successful attack and the weight corresponding to an attack result being a failure are both in the Choose from 0 to 1, but the selection needs to satisfy: the weight corresponding to the attack result is the attack success is higher than the weight corresponding to the attack result is the attack failure, for example, set the weight corresponding to the attack result as the attack success is 1, and at the same time, set the weight corresponding to the attack failure as the attack result to 0.2.

It should be noted that, for attack behaviors belonging to different behavior types, their corresponding attack result weights can be set to be different or the same. For example, for two attack behaviors with different behavior types, that is, the behavior type of the first attack behavior is different from the behavior type of the second attack behavior, and the first attack behavior corresponds to two attack results: attack success and attack failure. The second attack behavior also corresponds to two attack results: attack success and attack failure. The weight of the attack result corresponding to the attack success corresponding to the first attack behavior is the weight of the first attack result, and the attack result corresponding to the attack failure corresponding to the first attack behavior The weight is the second attack result weight, the attack result weight corresponding to the attack success corresponding to the second attack behavior is the third attack result weight, the attack result weight corresponding to the attack failure corresponding to the second attack behavior is the fourth attack result weight, Therefore, when setting the weight, under the condition that the weight of the first attack result is set higher than the weight of the second attack result, and the weight of the third attack result is set higher than the weight of the fourth attack result, in the first case Next, the weight of the first attack result can be set to be higher than the weight of the third attack result. At the same time, the weight of the second attack result can be higher than the weight of the fourth attack result, and the weight of the second attack result can also be equal to the weight of the fourth attack result. The second attack result weight can also be lower than the fourth attack result weight; in the second case, the first attack result weight can be set to be equal to the third attack result weight, and at the same time, the second attack result weight can be higher than the fourth attack result weight Result weight, the second attack result weight can also be equal to the fourth attack result weight, the second attack result weight can also be lower than the fourth attack result weight; in the third case, the first attack result weight can be set to be lower than The third attack result weight, meanwhile, the second attack result weight may be higher than the fourth attack result weight, the second attack result weight may also be equal to the fourth attack result weight, and the second attack result weight may be lower than the fourth attack result weight .

Further, in the embodiment of the present invention, when the attack result is the weight of the attack result, and the attack threat degree is the threat score, in step 105, how to alert the attack behavior according to the attack threat degree and the attack result, the embodiment of the present invention The following implementation methods are provided: multiply the threat score of the attack behavior by the weight of the attack result to obtain the attack score, and send an alarm to the attack behavior according to the attack score.

Specifically, the threat score is obtained when the attack behavior attempts to attack the target object, and the attack result weight is obtained when the attack behavior completes the attack on the target object. After obtaining the threat score and attack result weight respectively, the threat score and The product of the attack result weights is used as the attack score. For example, for an attack behavior, the obtained threat score is 7, and the obtained attack result weight is 0.3, then the attack score of the attack behavior is 7*0.3, namely The attack score was 2.1.

Further, after the attack score is obtained, the attack behavior is alerted according to the attack score. Specifically, a preset warning threshold can be set in advance, so that after the attack score is obtained, it is first judged whether the attack score is higher than the preset warning threshold. If If the attack score is higher than the preset alarm threshold, an alarm message will be sent to the user to remind the user of the threat of the attack behavior to the target object. Wherein, the warning information may be text warning information, may also be sound warning information, may also be light warning information, and may also be sound and light warning information. When the warning information is text warning information, the warning information contains the attack score of the attack behavior; when the warning information contains sound warning information, the higher the attack score, the higher the sound frequency, and the lower the attack score, the lower the sound frequency. In this way, the user can intuitively know the threat level of the attack behavior to the target object according to the sound alarm information; when the alarm information includes light alarm information, the higher the attack score, the higher the light flicker frequency, and the lower the attack score, the higher the light flicker rate. The lower the value, the user can intuitively know the threat level of the attack behavior to the target object according to the light alarm information.

In the embodiment of the present invention, for the target object, when there are multiple attack behaviors, one attack behavior corresponds to one attack score, and after obtaining the attack scores of each attack behavior, all attack behaviors can Sorting is performed to obtain the attack ranking result used to characterize the threat situation of all attack behaviors to the target object. For example, for a target object, when there are 3 aggressive behaviors, namely the first aggressive behavior, the second aggressive behavior and the third aggressive behavior, the first attack score of the first aggressive behavior is 10, and the second aggressive behavior’s score is 10. After the second attack score is 8 and the third attack score of the third attack behavior is 5, the above three attack scores are sorted according to the attack score. If they are sorted from high to low, the obtained attack The sorting result is: first attack behavior - second attack behavior - third attack behavior. According to the attack sorting results, it can be intuitively understood that all attack behaviors are threats to the target object, that is, the first attack behavior poses a threat to the security of the target object. The degree of threat is higher than that of the second attack behavior, and the degree of threat to the security of the target object caused by the second attack behavior is higher than that of the third attack behavior.

The method for alerting an attack event according to the embodiment of the present invention will be described in detail below with reference to a specific example.

If the target object is the operating system of the client, then monitor whether there is an attack behavior that attacks the operating system, if there is a first attack request corresponding to the first attack behavior and a second attack request corresponding to the second attack behavior When requesting, the behavior type of the first attack behavior can be determined according to the first attack request, and the behavior type of the second attack behavior can be determined according to the second attack request. If the behavior type of the first attack behavior is an XSS attack behavior, the second The behavior type of the attack behavior is information leakage attack behavior. From the correspondence between the preset behavior type and the threat score, the threat score of the first attack behavior can be determined to be 8 according to the XSS attack behavior. According to the information leakage attack behavior, it can be It is determined that the threat score of the second attack behavior is 5. After the first attack behavior and the second attack behavior complete the attack on the target object, the target object will generate a first response message corresponding to the first attack behavior, and a response message corresponding to the second attack behavior. For the second response message corresponding to the second attack behavior, if for the first attack behavior and the second attack behavior, the weight of the attack result corresponding to the preset attack success is 1, and the weight of the attack result corresponding to the preset attack failure is 0.2, if the first response message represents the failure of the first attack behavior, it is determined that the attack result weight of the first attack behavior is 0.2, and if the second response message represents the success of the second attack behavior, then the weight of the second attack behavior is determined The weight of the attack result is 1, so the attack score of the first attack behavior can be calculated as 8*0.2, which is 1.6, and the attack score of the second attack behavior can be calculated as 5*1, or 5. If the preset alarm threshold is 4, Then, the second attack behavior is alerted, and at the same time, the first attack behavior and the second attack behavior can also be sorted according to the attack score from high to low, and the attack ranking result is: first attack behavior-second attack behavior.

Based on the same inventive concept, an embodiment of the present invention also provides an attack event warning device, as shown in Figure 2, the device includes:

A monitoring module 201, configured to monitor whether there is an attack on the target object;

The first determining module 202 is configured to determine the behavior type of the attacking behavior when the presence of the attacking behavior is detected;

The second determination module 203 is configured to determine the degree of attack threat of the attack behavior to the target object according to the behavior type of the attack behavior;

The first acquiring module 204 is configured to acquire an attack result indicating whether the attack on the target object by the attack behavior is successful after the attack on the target object is completed by the attack behavior;

The alarm module 205 is configured to alarm the attack behavior according to the attack threat level and the attack result.

Preferably, the monitoring module 201 is specifically used for:

Monitoring whether there is an attack request of the attack behavior on the target object;

Wherein, if the attack request is detected, it indicates that the attack behavior exists; otherwise, it indicates that the attack behavior does not exist.

Preferably, the first determination module 202 is specifically used for:

When it is detected that the attack request exists, the behavior type of the attack behavior is determined according to the attack request.

Preferably, the second determining module 203 is specifically used for:

According to the behavior type of the aggressive behavior, the threat score of the aggressive behavior is determined from a preset correspondence between the behavior type and the threat score, wherein the threat score of the aggressive behavior is used to characterize the aggressive behavior The level of attack threat to the target object.

Preferably, the device also includes:

A second acquiring module, configured to acquire a response message of the target object to the attack behavior;

Wherein, the first acquisition module is specifically used for:

An attack result used to characterize whether the attack on the target object is successfully attacked by the attack behavior is obtained according to the response message.

Preferably, the attack result is an attack result weight.

Preferably, when the attack result is the weight of the attack result, the alarm module 205 includes:

an obtaining unit, configured to multiply the threat score of the attack behavior by the weight of the attack result to obtain the attack score;

An alarm unit, configured to alarm the attack behavior according to the attack score.

Preferably, the alarm unit includes:

a judging subunit, configured to judge whether the attack score is higher than a preset warning threshold;

The sending subunit is configured to send warning information to the user when the attack score is higher than a preset high warning threshold.

Preferably, when there are multiple attacks, the device further includes:

The sorting module is configured to sort all the attacking behaviors according to the attack scores, and obtain an attack sorting result for representing the threat of all the attacking behaviors to the target object.

Preferably, the target object is hardware, software, system or protocol in the client or server.

Based on the same inventive concept, an embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the method steps described in the foregoing embodiments are implemented.

Based on the same inventive concept, the embodiment of the present invention also provides a computer device, as shown in Figure 3, for the convenience of description, only the parts related to the embodiment of the present invention are shown, and the specific technical details are not disclosed, please refer to this Invention Examples Methods Section. The computer device can be any terminal device including mobile phone, tablet computer, PDA (Personal Digital Assistant, personal digital assistant), POS (Point of Sales, sales terminal), vehicle-mounted computer, etc. Taking the computer device as a mobile phone as an example:

Fig. 3 shows a block diagram of a part of the structure related to the computer device provided by the embodiment of the present invention. Referring to FIG. 3 , the computer device includes: a memory 301 and a processor 302 . Those skilled in the art can understand that the structure of the computer device shown in FIG. 3 is not limited to the computer device, and may include more or less components than shown in the figure, or combine some components, or arrange different components.

The following is a specific introduction to each component of the computer device in conjunction with FIG. 3:

The memory 301 can be used to store software programs and modules, and the processor 302 executes various functional applications and data processing by running the software programs and modules stored in the memory 301 . The memory 301 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application program required by a function (such as a sound playback function, an image playback function, etc.) and the like; the storage data area can store data (such as audio data, phone book, etc.) and so on. In addition, the memory 301 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid-state storage devices.

The processor 302 is the control center of the computer device, and performs various functions and processes data by running or executing software programs and/or modules stored in the memory 301 and calling data stored in the memory 301 . Optionally, the processor 302 may include one or more processing units; preferably, the processor 302 may integrate an application processor and a modem processor, wherein the application processor mainly processes operating systems, user interfaces, and application programs, etc. , the modem processor mainly handles wireless communications.

In this embodiment of the present invention, the processor 302 included in the computer device may have a function corresponding to any method step in the foregoing embodiments.

According to the attack event alarm method and device of the present invention, by monitoring whether there is an attack behavior that attacks the target object, when the presence of the attack behavior is detected, the behavior type of the attack behavior is determined, and the attack behavior is determined according to the behavior type of the attack behavior The degree of attack threat to the target object. After the attack behavior completes the attack on the target object, the attack result used to characterize whether the attack behavior is successful on the target object is obtained. Finally, according to the attack threat degree and attack result, the attack behavior Alerting, because the attack threat degree of the attack behavior and the attack result are combined to consider the attack behavior, so that the threat of the attack behavior to the target object can be determined more accurately, and the warning of the attack behavior can be improved. Accuracy.

The algorithms and displays presented herein are not inherently related to any particular computer, virtual system, or other device. Various generic systems can also be used with the teachings based on this. The structure required to construct such a system is apparent from the above description. Furthermore, the present invention is not specific to any particular programming language. It should be understood that various programming languages can be used to implement the content of the present invention described herein, and the above description of specific languages is for disclosing the best mode of the present invention.

In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure the understanding of this description.

Similarly, it should be appreciated that in the foregoing description of exemplary embodiments of the invention, in order to streamline this disclosure and to facilitate an understanding of one or more of the various inventive aspects, various features of the invention are sometimes grouped together in a single embodiment, figure, or its description. This method of disclosure, however, is not to be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art can understand that the modules in the device in the embodiment can be adaptively changed and arranged in one or more devices different from the embodiment. Modules or units or components in the embodiments may be combined into one module or unit or component, and furthermore may be divided into a plurality of sub-modules or sub-units or sub-assemblies. All features disclosed in this specification (including accompanying claims, abstract and drawings) and any method or method so disclosed may be used in any combination, except that at least some of such features and/or processes or units are mutually exclusive. All processes or units of equipment are combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will understand that although some embodiments described herein include some features included in other embodiments but not others, combinations of features from different embodiments are meant to be within the scope of the invention. and form different embodiments. For example, in the following claims, any of the claimed embodiments may be used in any combination.

The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art should understand that a microprocessor or a digital signal processor (DSP) may be used in practice to implement some or all functions of some or all components in the embodiments of the present invention. The present invention can also be implemented as an apparatus or an apparatus program (for example, a computer program and a computer program product) for performing a part or all of the methods described herein. Such a program for realizing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet site, or provided on a carrier signal, or provided in any other form.

It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means can be embodied by one and the same item of hardware. The use of the words first, second, and third, etc. does not indicate any order. These words can be interpreted as names.

A1. An attack event warning method, characterized in that the method comprises:

Monitor whether there is an attack on the target object;

When the presence of the attacking behavior is detected, determining the behavior type of the attacking behavior;

According to the behavior type of the attack behavior, determine the attack threat level of the attack behavior to the target object;

After the attack behavior completes the attack on the target object, acquiring an attack result used to characterize whether the attack behavior on the target object is successful;

According to the attack threat level and the attack result, an alarm is given to the attack behavior.

A2, according to the attack event warning method described in A1, it is characterized in that whether there is an attack behavior that attacks the target object in the monitoring, including:

Monitoring whether there is an attack request of the attack behavior on the target object;

Wherein, if the attack request is detected, it indicates that the attack behavior exists; otherwise, it indicates that the attack behavior does not exist.

A3, according to the attack event warning method described in A2, it is characterized in that, when the described attack behavior is detected, determining the behavior type of the attack behavior includes:

When it is detected that the attack request exists, the behavior type of the attack behavior is determined according to the attack request.

A4, according to the attack event warning method described in A1, it is characterized in that, according to the behavior type of the attack behavior, determining the attack threat degree of the attack behavior to the target object includes:

According to the behavior type of the aggressive behavior, the threat score of the aggressive behavior is determined from a preset correspondence between the behavior type and the threat score, wherein the threat score of the aggressive behavior is used to characterize the aggressive behavior The level of attack threat to the target object.

A5. The attack event warning method according to A1, characterized in that, after the attack behavior completes the attack on the target object, and after the acquisition is used to characterize the attack behavior on the target object Whether the attack results in success, the method also includes:

Obtain a response message of the target object to the attack behavior;

Wherein, the acquisition of the attack result used to characterize whether the attack on the target object is successfully attacked by the attack behavior includes:

An attack result for representing whether the attack on the target object is successfully attacked by the attack behavior is acquired according to the response message.

A6. The attack event warning method according to A1, wherein the attack result is an attack result weight.

A7. The attack event warning method according to A4, wherein when the attack result is the weight of the attack result, the attack behavior is alerted according to the attack threat degree and the attack result, including :

multiplying the threat score of the attack behavior by the weight of the attack result to obtain the attack score;

The attack behavior is alerted according to the attack score.

A8. The attack event warning method according to A7, wherein the warning of the attack behavior according to the attack score includes:

judging whether the attack score is higher than a preset warning threshold;

When the attack score is higher than the preset high alarm threshold, an alarm message is sent to the user.

A9, according to the attack event warning method described in A7, it is characterized in that, when there are a plurality of said attack behaviors, after obtaining the attack score of each attack behavior, the method also includes:

All the attack behaviors are sorted according to the attack scores, and an attack ranking result for representing the threat of all the attack behaviors to the target object is obtained.

A10. The attack event warning method according to A1, wherein the target object is hardware, software, system or protocol in the client or server.

B11. An attack event warning device, characterized in that the device includes:

A monitoring module, configured to monitor whether there is an attack behavior on the target object;

A first determination module, configured to determine the behavior type of the attack when the presence of the attack is detected;

The second determination module is configured to determine the degree of attack threat of the attack behavior to the target object according to the behavior type of the attack behavior;

A first acquiring module, configured to acquire an attack result indicating whether the attack on the target object by the attack behavior is successful after the attack on the target object is completed by the attack behavior;

An alarm module, configured to alarm the attack behavior according to the attack threat level and the attack result.

B12, according to the attack event warning device described in B11, it is characterized in that the monitoring module is specifically used for:

Monitoring whether there is an attack request of the attack behavior on the target object;

Wherein, if the attack request is detected, it indicates that the attack behavior exists; otherwise, it indicates that the attack behavior does not exist.

B13, according to the attack event warning device described in B12, it is characterized in that the first determination module is specifically used for:

When it is detected that the attack request exists, the behavior type of the attack behavior is determined according to the attack request.

B14, according to the attack event warning device described in B11, it is characterized in that the second determination module is specifically used for:

According to the behavior type of the aggressive behavior, the threat score of the aggressive behavior is determined from a preset correspondence between the behavior type and the threat score, wherein the threat score of the aggressive behavior is used to characterize the aggressive behavior The level of attack threat to the target object.

B15, according to the attack event warning device described in B11, it is characterized in that, described device also comprises:

A second acquiring module, configured to acquire a response message of the target object to the attack behavior;

Wherein, the first acquisition module is specifically used for:

An attack result for representing whether the attack on the target object is successfully attacked by the attack behavior is acquired according to the response message.

B16. The attack event warning device according to B11, wherein the attack result is the weight of the attack result.

B17, according to the attack event warning device described in B14, it is characterized in that, when the attack result is the weight of the attack result, the warning module includes:

an obtaining unit, configured to multiply the threat score of the attack behavior by the weight of the attack result to obtain the attack score;

An alarm unit, configured to alarm the attack behavior according to the attack score.

B18. The attack event warning device according to B17, wherein the warning unit includes:

a judging subunit, configured to judge whether the attack score is higher than a preset warning threshold;

The sending subunit is configured to send warning information to the user when the attack score is higher than a preset high warning threshold.

B19, according to the attack event warning device described in B17, it is characterized in that, when there are a plurality of said attack behaviors, the device also includes:

The sorting module is configured to sort all the attacking behaviors according to the attack scores, and obtain an attack sorting result for representing the threat of all the attacking behaviors to the target object.

B20. The attack event warning device according to B11, wherein the target object is hardware, software, system or protocol in the client or server.

C21. A computer-readable storage medium, on which a computer program is stored, characterized in that, when the program is executed by a processor, the method steps according to any one of claims A1-A10 are implemented.

D22. A computer device, comprising a memory, a processor, and a computer program stored in the memory and operable on the processor, characterized in that, when the processor executes the program, any one of the claims in A1-A10 is realized The method steps described are required.

Claims (10)

1. An attack event warning method, characterized in that the method comprises: Monitor whether there is an attack on the target object; When the presence of the attacking behavior is detected, determining the behavior type of the attacking behavior; According to the behavior type of the attack behavior, determine the attack threat level of the attack behavior to the target object; After the attack behavior completes the attack on the target object, acquiring an attack result used to characterize whether the attack behavior on the target object is successful; According to the attack threat level and the attack result, an alarm is given to the attack behavior. 2. The attack event warning method according to claim 1, wherein said monitoring whether there is an attack behavior attacking the target object comprises: Monitoring whether there is an attack request of the attack behavior on the target object; Wherein, if the attack request is detected, it indicates that the attack behavior exists; otherwise, it indicates that the attack behavior does not exist. 3. The attack event warning method according to claim 2, wherein when the attack is detected, determining the behavior type of the attack includes: When it is detected that the attack request exists, the behavior type of the attack behavior is determined according to the attack request. 4. The attack event warning method according to claim 1, wherein, according to the behavior type of the attack behavior, determining the attack threat degree of the attack behavior to the target object comprises: According to the behavior type of the aggressive behavior, the threat score of the aggressive behavior is determined from a preset correspondence between the behavior type and the threat score, wherein the threat score of the aggressive behavior is used to characterize the aggressive behavior The level of attack threat to the target object. 5. The attack event warning method according to claim 1, characterized in that, after the attack behavior completes the attack on the target object, and after the acquisition is used to characterize the attack behavior on the target object Before the attack results in whether the attack is successful, the method further includes: Obtain a response message of the target object to the attack behavior; Wherein, the acquisition of the attack result used to characterize whether the attack on the target object is successfully attacked by the attack behavior includes: An attack result for representing whether the attack on the target object is successfully attacked by the attack behavior is acquired according to the response message. 6. The attack event warning method according to claim 1, wherein the attack result is an attack result weight. 7. The attack event warning method according to claim 4, wherein when the attack result is an attack result weight, the attack behavior is alerted according to the attack threat degree and the attack result ,include: multiplying the threat score of the attack behavior by the weight of the attack result to obtain the attack score; The attack behavior is alerted according to the attack score. 8. An attack event warning device, characterized in that the device comprises: A monitoring module, configured to monitor whether there is an attack behavior on the target object; A first determination module, configured to determine the behavior type of the attack when the presence of the attack is detected; The second determination module is configured to determine the degree of attack threat of the attack behavior to the target object according to the behavior type of the attack behavior; A first acquiring module, configured to acquire an attack result indicating whether the attack on the target object by the attack behavior is successful after the attack on the target object is completed by the attack behavior; An alarm module, configured to alarm the attack behavior according to the attack threat level and the attack result. 9. A computer-readable storage medium, on which a computer program is stored, wherein, when the program is executed by a processor, the method steps according to any one of claims 1-7 are implemented. 10. A computer device, comprising a memory, a processor, and a computer program stored on the memory and operable on the processor, characterized in that, when the processor executes the program, it realizes any of claims 1-7. The method steps of a claim.