CN115086068A - A network intrusion detection method and device - Google Patents

Abstract

The embodiment of the invention relates to the technical field of computer security, and provides a network intrusion detection method and a network intrusion detection device.

Description

A network intrusion detection method and device

technical field

The invention relates to the technical field of computer security, in particular to a network intrusion detection method and device.

Background technique

In recent years, the global network security situation has become increasingly severe, and security incidents such as network attacks and data leakage have occurred frequently. Network intrusion detection technology monitors network communication data packets through certain technical means, and analyzes these data packets to find out whether there is malicious behavior in the network that may affect the network security of subsequent devices.

Intrusion Detection System (IDS for short) is a network security device that monitors network transmissions in real time and issues alerts or takes proactive measures when suspicious transmissions are found. It differs from other network security devices in that: IDS is a proactive security technology.

Therefore, how to effectively improve the detection rate of network intrusion detection is a technical problem that those skilled in the art urgently need to solve.

SUMMARY OF THE INVENTION

In order to improve the detection rate of network intrusion detection, the present invention provides a network intrusion detection method and a device for realizing the method.

A first aspect provides a network intrusion detection method, comprising:

Analyze and process the network traffic captured from the network device to be detected to obtain the analysis data;

Perform intrusion detection on the parsed data to obtain a target file; wherein, the target file includes a first target file and a second target file, the first target file is a file based on a remote desktop protocol, and the second target file It is a file whose format cannot be recognized;

When the first target file is obtained, the following operations are performed: parsing the current first target file to obtain the configuration items of the current first target file; based on the preset first intrusion detection strategy and the current first target file a configuration item, performing intrusion detection on the current first target file; wherein, the first intrusion detection strategy is determined based on all configuration items of the known remote desktop protocol-based file;

When obtaining the second target file, perform the following operations: connect the first binary data corresponding to the current second target file to the end of the second binary data corresponding to the preset security file, and obtain the target binary data ; Based on a preset second intrusion detection strategy, intrusion detection is performed on the target binary data; wherein, the security file includes a portable executable PE file and an executable and linkable format ELF file, the second intrusion detection The detection strategy corresponds to the type of the security document.

In a possible design, the first intrusion detection strategy is specifically determined based on the following manner:

Get the score value assigned to each configuration item of a known Remote Desktop Protocol-based file;

Obtain the classification results of threat level classification for all configuration items of known Remote Desktop Protocol-based files;

determining a threat threshold corresponding to each threat level based on the score value and the classification result;

Based on the threat threshold corresponding to each threat level, the first intrusion detection strategy is determined.

In a possible design, determining a threat threshold corresponding to each threat level based on the score value and the classification result, including:

The following formula is used to determine the threat threshold corresponding to each threat level:

Among them, Vi is the threat threshold of the _ith threat level, Cij is the score value of the _jth configuration item in the ith threat level , and n is the total number of configuration items in the ith threat level .

In a possible design, after the obtaining the score value assigned to each configuration item of the known Remote Desktop Protocol-based file, the method further includes: all configuration items based on the known Remote Desktop Protocol-based file and the score value corresponding to each configuration item to obtain the configuration item score value library;

The performing intrusion detection on the current first target file based on the preset first intrusion detection strategy and the configuration item of the current first target file includes:

Obtain the security reference value of the current first target file based on the configuration item score value library and the configuration item of the current first target file;

Based on the security reference value and the first intrusion detection strategy, intrusion detection is performed on the current first target file.

In a possible design, the security reference value of the current first target file is obtained based on the configuration item score value library and the configuration item of the current first target file, including:

The following formula is used to obtain the security reference value of the current first target file:

Wherein, S is the security reference value of the current first target file, is the score value of the jth configuration item in the current first target file, and k is the total number of configuration items in the current first target file.

In a possible design, the performing intrusion detection on the current first target file based on the security reference value and the first intrusion detection strategy includes:

Compare the security reference value with the threat threshold value corresponding to each threat level included in the first intrusion detection strategy to obtain the threat level of the current first target file, so as to complete the intrusion detection on the current first target file .

In a possible design, after the intrusion detection is performed on the target binary data, the method further includes:

In response to the detection result being that the second target file is a dangerous file, the network traffic corresponding to the second target file is released, so that the terminal device receiving the network traffic executes the process of calling the second target file. monitoring, so that the process calling the second target file can be determined as a malicious process.

In a second aspect, a network intrusion detection device includes:

The parsing module is used for parsing and processing the network traffic captured from the network device to be detected to obtain parsing data;

A detection module, configured to perform intrusion detection on the parsed data to obtain a target file; wherein, the target file includes a first target file and a second target file, and the first target file is a file based on a remote desktop protocol, so The second target file is a file whose format cannot be recognized;

a first execution module, configured to perform the following operations when obtaining the first target file: perform parsing processing on the current first target file to obtain configuration items of the current first target file; based on a preset first intrusion detection strategy and the configuration items of the current first target file, perform intrusion detection on the current first target file; wherein, the first intrusion detection strategy is determined based on all configuration items of the known remote desktop protocol-based file;

The second execution module is configured to perform the following operation when obtaining the second target file: connect the first binary data corresponding to the current second target file to the second binary data corresponding to the preset security file At the end, the target binary data is obtained; based on a preset second intrusion detection strategy, intrusion detection is performed on the target binary data; wherein, the security file includes a PE file and an ELF file, and the second intrusion detection strategy is related to all corresponding to the type of security document described above.

The beneficial effect of the present invention is that the analysis data is obtained by analyzing the network traffic captured from the network device to be detected, and then the intrusion detection is performed on the analysis data to obtain the target file including the first target file and the second target file. Finally, the preset first intrusion detection strategy and the second intrusion detection strategy are respectively used to perform intrusion detection on the first target file and the second target file, which can effectively improve the detection rate of network intrusion detection.

Description of drawings

In order to illustrate the embodiments of the present invention or the technical solutions in the prior art more clearly, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the drawings in the following description are For some embodiments of the present invention, for those of ordinary skill in the art, other drawings can also be obtained according to these drawings without creative effort.

FIG. 1 is a flowchart of a network intrusion detection method provided by an embodiment of the present invention;

2 is a hardware architecture diagram of an electronic device provided by an embodiment of the present invention;

FIG. 3 is a structural diagram of a network intrusion detection apparatus according to an embodiment of the present invention.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative work are protected by the present invention. scope.

Referring to FIG. 1, an embodiment of the present invention provides a network intrusion detection method, which is applied to an intrusion detection system. The method includes:

Analyze and process the network traffic captured from the network device to be detected to obtain the analysis data;

Intrusion detection is performed on the parsed data to obtain a target file; wherein, the target file includes a first target file and a second target file, the first target file is a file based on the remote desktop protocol, and the second target file is a file whose format cannot be identified;

When the first target file is obtained, perform the following operations: perform parsing processing on the current first target file to obtain the configuration item of the current first target file; based on the preset first intrusion detection strategy and the configuration item of the current first target file , performing intrusion detection on the current first target file; wherein, the first intrusion detection strategy is determined based on all configuration items of the known remote desktop protocol-based file;

When obtaining the second target file, perform the following operations: connect the first binary data corresponding to the current second target file to the end of the second binary data corresponding to the preset security file to obtain target binary data; based on The preset second intrusion detection strategy performs intrusion detection on the target binary data; wherein, the security files include PE files and ELF files, and the second intrusion detection strategy corresponds to the type of security files.

In the embodiment of the present invention, the parsed data is obtained by analyzing the network traffic captured from the network device to be detected, and then the parsed data is subjected to intrusion detection to obtain the target file including the first target file and the second target file, Finally, the preset first intrusion detection strategy and the second intrusion detection strategy are respectively used to perform intrusion detection on the first target file and the second target file, which can effectively improve the detection rate of network intrusion detection.

The following describes how each step shown in FIG. 1 is performed.

The intrusion detection system is deployed in the network device to be detected (such as a firewall) in the form of software to monitor all network traffic data packets transmitted through the network device to be detected. The network traffic data packets include but are not limited to IP data packets, TCP data packets, UDP data packets and ICMP data packets.

The parsing process completes functions such as decoding of network traffic, protocol preprocessing, protocol identification, and application identification, which are well known to those skilled in the art and will not be described in detail here. Among them, the identified protocols include but are not limited to: IP (Internet Protocol, the protocol for interconnection between networks), TCP (Transmission Control Protocol, Transmission Control Protocol), UDP (User Datagram Protocol, User Datagram Protocol), ICMP (Internet Control Protocol) ManagemetProtocol Version6, Internet Control Information Protocol Version 6); supports but is not limited to identifying the following application layer protocols: HTTP (Hyper Text Transfer Protocol over Secure Socket Layer), FTP (File Transfer Protocol, file transfer protocol), TLS (Transport Layer Security), SMB (Server Message Block, protocol name), DNS (Domain Name System, Domain Name Resolution Protocol), SSH (Secure Shell, Secure Shell Protocol), SMTP (Simple Mail Transfer Protocol, Simple Mail Transfer Protocol), DHCP (Dynamic Host Configuration Protocol, Dynamic Host Configuration Protocol).

Intrusion detection refers to detecting whether the parsed data is malicious data, and specific detection methods include but are not limited to streaming estimation detection and file extraction, etc., which are well known to those skilled in the art and will not be repeated here.

In some related technologies, hackers will use emails, chats, etc. to induce users to click on relevant links, and then load malicious Remote Desktop Protocol (RDP)-based files, which will lead to the user's computer and the remote controlled by the hacker. The server establishes a connection, and the hacker can control the user's computer to perform related malicious operations through the remote server.

Specifically, the hacker may pre-set configuration items such as drive mapping, USB device mapping, printer mapping, and clipboard mapping in the loaded malicious Remote Desktop Protocol-based file, so that the hacker can manipulate the remote server to target the user's computer. Perform related malicious actions, such as stealing the contents of important files from the user's computer. Therefore, it is necessary to perform intrusion detection on files based on Remote Desktop Protocol.

In other related technologies, in order to improve the detection efficiency, the intrusion detection system will classify according to the file format, and execute different detection strategies for different file formats. For file formats that are not recognized by the intrusion detection system, the intrusion detection system usually does not process (eg delete) the files in this format. Therefore, hackers usually change the format of dangerous files to prevent the detection of dangerous files by intrusion detection systems.

Specifically, the hacker will extract the malicious code in the dangerous file to generate a file in a format that cannot be recognized by the intrusion detection system, and then use a file without malicious code to open the generated new file in the user's computer to obtain the malicious code. And execute malicious code, which is detrimental to the security of the user's computer. Therefore, it is necessary to perform intrusion detection on files based on Remote Desktop Protocol.

To sum up, in order to effectively improve the detection rate of network intrusion detection, the above two types of target files (that is, the first target file based on the remote desktop protocol and the second target file whose format cannot be recognized by the intrusion detection system) can be detected. Perform intrusion detection.

The following focuses on how to effectively check out the first target file and the second target file.

After obtaining the first target file through intrusion detection, the first target file is parsed to obtain the configuration items of the first target file, and then based on the preset first intrusion detection strategy and the obtained configuration items of the first target file , perform intrusion detection on the current first target file, so that it can be determined whether the first target file is a dangerous file (for example, the first target file whose threat level determined below is a medium security threat or a high security threat is determined as a dangerous file), Therefore, the detection rate of network intrusion detection can be effectively improved.

In some embodiments, the first intrusion detection strategy is specifically determined based on the following manner:

Step A1, obtain the score value given for each configuration item of the known remote desktop protocol-based file;

Step A2, obtaining the classification result of the threat level classification performed for all configuration items of the known remote desktop protocol-based file;

Step A3, based on the score value and the classification result, determine the threat threshold corresponding to each threat level;

Step A4: Determine a first intrusion detection strategy based on a threat threshold corresponding to each threat level.

In this embodiment, the threat threshold corresponding to each threat level is calculated by assigning a score value to each configuration item of the known remote desktop protocol-based file and classifying the threat level, and then the threat threshold value is used to calculate the threat threshold value. Develop a first intrusion detection strategy. In this way, in the subsequent intrusion detection on the first target file, the intrusion detection result of the first target file can be obtained according to the score value of the configuration item in the first target file and the first intrusion detection strategy.

In step A1, the staff can list all configuration items in the known remote desktop protocol-based files in advance, and then score the security of each configuration item according to prior knowledge (such as an expert security knowledge base) (ie assigning a score value), so that the user's computer can obtain the score value assigned to each configuration item of the known Remote Desktop Protocol-based file.

In some embodiments, the score value assigned to each configuration item of the known RDP file obtained by the user's computer can be referred to in Table 1. It should be noted that only some configuration items of known RDP files and their score values are listed in Table 1.

Table 1

In step A2, for example, the threat levels may be classified into three categories, namely, high security threats, medium security threats, and low security threats. Of course, it can also be divided into more or less threat levels, and the number of threat levels is not limited here.

In some embodiments, high security threats may include configuration items such as drive mapping, clipboard mapping, USB device mapping, and printer mapping, for example, medium security threats may include configuration items such as smart card mapping, and low security threats may include remote application icons, for example and configuration items such as screen display mode.

In some embodiments, the classification results of the threat level for all configuration items of the known Remote Desktop Protocol-based files obtained by the user's computer can be seen in Table 2. It should be noted that, Table 2 only lists some configuration items and threat levels of known Remote Desktop Protocol-based files that are the same as Table 1.

Table 2

In addition, the sequence of steps A1 and A2 is not specifically limited here, that is, step A1 may be performed first and then step A2 may be performed, or step A2 may be performed first and then step A1 may be performed.

After steps A1 and A2, the configuration items in each threat level are assigned a score value, so that the threat threshold of each threat level can be determined to facilitate subsequent intrusion detection on the first target file.

In some embodiments, step A3 may specifically include:

The following formula is used to determine the threat threshold corresponding to each threat level:

Among them, Vi is the threat threshold of the _ith threat level, Cij is the score value of the _jth configuration item in the ith threat level , and n is the total number of configuration items in the ith threat level .

For example, as shown in Table 1 and Table 2, the above formulas can be used to calculate the threat thresholds corresponding to the threat levels of high security threat, medium security threat and low security threat respectively, so that high security threat and medium security threat can be calculated. The threat thresholds for low and low security threats are 85, 10, and 1, respectively.

It should be noted that taking the average value of the configuration items in each threat level as the threat threshold can avoid that when the threat level is less divided and the scores of different configuration items in each threat level are far apart, it is still possible to obtain a more objective and Accurate threat thresholds of each threat level are used to improve the accuracy of intrusion detection on the first target file.

In step A3, the threat threshold of each threat level may also be determined in other ways, for example, the lowest score value of the configuration item in each threat level may be used as the threat threshold of the threat level. Of course, the median value of the configuration items in each threat level can also be used as the threat threshold of the threat level, so the method for determining the threat threshold is not specifically limited here.

It should be noted that when the first target file is detected, the intrusion detection system will first perform parsing processing on the first target file to obtain the configuration items in the first target file, and then use the preset first intrusion detection strategy and analysis. The obtained configuration item of the first target file is used to perform intrusion detection on the first target file. Here, the embodiment of the present invention does not specifically limit the way of parsing and processing the first target file, for example, it may be regular matching.

In some embodiments, after step A1, the method further includes: obtaining a configuration item score value library based on all configuration items of the known remote desktop protocol-based file and the score value corresponding to each configuration item;

Based on the preset first intrusion detection strategy and the configuration items of the current first target file, intrusion detection is performed on the current first target file, including:

Step B1, based on the configuration item score value library and the configuration item of the current first target file, obtain the safety reference value of the current first target file;

Step B2: Perform intrusion detection on the current first target file based on the security reference value and the first intrusion detection strategy.

In this embodiment, the score value of the configuration item of the first target file is obtained by using the configuration item score value library, and the security reference value of the first target file is determined according to the score value of the configuration item of the first target file. The security reference value and the threat threshold corresponding to each threat level included in the first intrusion detection strategy are compared to obtain the threat level of the first target file, so as to complete the intrusion detection of the first target file.

In step B1, the configuration item score value library can be used to match the score value of the configuration item of the first target file obtained by parsing, and then use the score value of the configuration item of the first target file to calculate the safety reference value, so as to facilitate the subsequent comparison of The first target file is subjected to intrusion detection.

In some embodiments, step B1 may specifically include:

The following formula is used to obtain the security reference value of the current first target file:

Wherein, S is the security reference value of the current first target file, D _j is the score value of the jth configuration item in the current first target file, and k is the total number of configuration items in the current first target file.

In this embodiment, the sum of the score values of all the configuration items in the first target file is used as the security reference value of the first target file, compared with the average value and the highest value of the score values of all the configuration items in the first target file. , the lowest value and other values as the safety reference value of the first target file. The former method can prevent that when the number of configuration items in the first target file is small and the difference between the scores of different configuration items is large, it is still possible to obtain a more objective value. and an accurate security reference value for characterizing the threat level of the first target file, so that the accuracy of intrusion detection on the first target file can be improved.

Of course, the safety reference value of the first target file can also be determined in other ways. For example, the average value of all configuration items in the first target file or the highest score value in the configuration items can be used as the safety reference value. The determination method is not specifically limited.

In some embodiments, step B2 may specifically include:

The security reference value and the threat threshold corresponding to each threat level included in the first intrusion detection strategy are compared to obtain the current threat level of the first target file, so as to complete the intrusion detection of the current first target file.

For example, the obtained security reference value can be compared with the determined threat threshold corresponding to each threat level. If the security reference value is greater than or equal to the threat threshold of high security threat, that is, when S≥V3, it means that the first target file has a The threat level is the high security threat level; if the security reference value is greater than or equal to the threat threshold of the medium security threat and less than the threat threshold of the high security threat, that is, when S<V3 and S≥V2, it means that the threat level of the first target file is Medium security threat level; if the security reference value is greater than or equal to the threat threshold of low security threat and less than the threat threshold of medium security threat, that is, when S<V2 and S≥V1, it means that the threat level of the first target file is a low security threat level. In this way, the intrusion detection result of the first target file (that is, the threat level of the first target file) can be obtained, and then corresponding operations can be performed according to the threat level of the first target file, such as prohibiting the operation, and the user will Choose whether to run, allow to run, etc.

After obtaining the second target file through intrusion detection, firstly connect the first binary data corresponding to the current second target file to the end of the second binary data corresponding to the preset security file to obtain the target binary data. Converting files in a format that cannot be recognized by the intrusion detection system into files in a format that can be recognized by the intrusion detection system (that is, including PE files and ELF files), so that intrusion detection can be performed on the second target file, thus solving the intrusion detection system. The problem that the files in the unrecognized format cannot be effectively detected can effectively improve the detection rate of network intrusion detection.

It should be noted that "a format that cannot be recognized by the intrusion detection system" can be understood as: neither a file format known to those skilled in the art nor a pre-recognized file format in the intrusion detection system. On the contrary, "a format that can be recognized by the intrusion detection system" can be understood as: either a file format well-known to those skilled in the art, or a file format pre-set and identifiable in the intrusion detection system.

Among them, PE files and ELF files are selected as security files, considering that these two types of files can be executed by the computer itself, which is beneficial to the subsequent intrusion detection of target binary data.

It should also be noted that Portable Executable (PE) is a file format for executable files, object files and dynamic link libraries, mainly used on 32-bit and 64-bit Windows operating systems . "Portable" refers to the generality of the file format, which can be used on many different operating systems and architectures. The PE file format encapsulates some information necessary for the Windows operating system to load executable program code. This information includes dynamic link libraries, API import and export tables, resource management data, and thread-local storage data. In the Windows NT operating system, the PE file format is mainly used for EXE files, DLL files, SYS (drivers) and other file types. The Extensible Firmware Interface (EFI) technical specification states that the PE format is a standard executable file format in the EFI environment, beginning with a DOS header.

The Executable and Linkable Format (ELF), often referred to as the ELF format, is a standard file format for executables, objects, shared libraries, and core dumps in computer science.

In order to ensure the comprehensiveness and accuracy of the detection of the second target file, it may be considered to set the number of target binary data and the number of security files to be the same. That is to say, the first binary data corresponding to the second target file is copied multiple times, and each set of the copied first binary data is respectively connected to the second and second binary data of each different type of security file. At the end of the binary data, various target binary data are obtained.

It should be noted that the second intrusion detection strategy preset in the intrusion detection system may be obtained based on existing mature detection strategies, and these detection strategies are well known to those skilled in the art, and the specific detection strategies will not be repeated here. .

If the detection result of the intrusion detection system is that the second target file is a dangerous file, it means that there is malicious code in the second target file, which is likely to be called by a related malicious process in the user's computer to complete the infection of the user's computer. .

In order to solve this technical problem, in some embodiments, it also includes:

In response to the detection result being that the second target file is a dangerous file, the network traffic corresponding to the second target file is released, so that the terminal device receiving the network traffic monitors the process of calling the second target file, so that the call to the second target file can be monitored. The process of the target file is determined to be a malicious process.

In this embodiment, when it is determined that the second target file is a dangerous file, the intrusion detection system can release the network traffic corresponding to the second target file. The corresponding network traffic is released, which is beneficial to monitor and analyze the process associated with the second target file by using the subsequent terminal device. That is, when it is determined that the second target file is a dangerous file, the terminal device (such as a user's computer) that receives network traffic monitors the process that calls the second target file (for example, using hook technology), so that the process that calls the second target file is It is determined to be a malicious process, and the malicious process can be further processed (such as deletion or further related analysis), thus ensuring that the user's computer will not be infected by viruses, and at the same time, relevant analysis of such viruses is also carried out, which is beneficial to the staff Master the attack habits of such viruses.

As shown in FIG. 2 and FIG. 3 , an embodiment of the present invention provides a network intrusion detection apparatus. The apparatus embodiment may be implemented by software, or may be implemented by hardware or a combination of software and hardware. From a hardware perspective, as shown in FIG. 2 , it is a hardware architecture diagram of an electronic device where a network intrusion detection apparatus provided by an embodiment of the present invention is located, except for the processor, memory, network interface, and In addition to the non-volatile memory, the electronic device where the apparatus in the embodiment is located may also generally include other hardware, such as a forwarding chip responsible for processing messages, and so on. Taking software implementation as an example, as shown in FIG. 3 , as a logical device, it is formed by reading the corresponding computer program in the non-volatile memory into the memory through the CPU of the electronic device where it is located.

As shown in FIG. 3 , a network intrusion detection device provided by this embodiment includes:

The parsing module is used for parsing and processing the network traffic captured from the network device to be detected to obtain parsing data;

A detection module, configured to perform intrusion detection on the parsed data to obtain a target file; wherein, the target file includes a first target file and a second target file, and the first target file is a file based on a remote desktop protocol, so The second target file is a file whose format cannot be recognized;

a first execution module, configured to perform the following operations when obtaining the first target file: perform parsing processing on the current first target file to obtain configuration items of the current first target file; based on a preset first intrusion detection strategy and the configuration items of the current first target file, perform intrusion detection on the current first target file; wherein, the first intrusion detection strategy is determined based on all configuration items of the known remote desktop protocol-based file;

The second execution module is configured to perform the following operation when obtaining the second target file: connect the first binary data corresponding to the current second target file to the second binary data corresponding to the preset security file At the end, the target binary data is obtained; based on a preset second intrusion detection strategy, intrusion detection is performed on the target binary data; wherein, the security file includes a PE file and an ELF file, and the second intrusion detection strategy is related to all corresponding to the type of security document described above.

In an embodiment of the present invention, the first intrusion detection strategy is specifically determined based on the following manner:

Get the score value assigned to each configuration item of a known Remote Desktop Protocol-based file;

Obtain the classification results of threat level classification for all configuration items of known Remote Desktop Protocol-based files;

determining a threat threshold corresponding to each threat level based on the score value and the classification result;

Based on the threat threshold corresponding to each threat level, the first intrusion detection strategy is determined.

In an embodiment of the present invention, determining a threat threshold corresponding to each threat level based on the score value and the classification result includes:

The following formula is used to determine the threat threshold corresponding to each threat level:

为第i个威胁等级的威胁阈值，为第i个威胁等级中第j个配置项的分数值，n为第i个威胁等级中的配置项的总个数。in,

is the threat threshold of the ith threat level, is the score value of the jth configuration item in the ith threat level, and n is the total number of configuration items in the ith threat level.

In an embodiment of the present invention, the first execution module is further configured to perform the following operation: based on all the configuration items of the known remote desktop protocol-based file and the score value corresponding to each configuration item, obtain the configuration item score Numeric library;

When the first execution module executes the intrusion detection on the current first target file based on the preset first intrusion detection strategy and the configuration item of the current first target file, it is configured to perform the following operations:

Obtain the security reference value of the current first target file based on the configuration item score value library and the configuration item of the current first target file;

Based on the security reference value and the first intrusion detection strategy, intrusion detection is performed on the current first target file.

In an embodiment of the present invention, when the first execution module executes the configuration item based on the configuration item score value library and the current first target file to obtain the security reference value of the current first target file, the first execution module is configured to execute Do as follows:

The following formula is used to obtain the security reference value of the current first target file:

Wherein, S is the security reference value of the current first target file, D _j is the score value of the jth configuration item in the current first target file, and k is the total number of configuration items in the current first target file.

In an embodiment of the present invention, when the first execution module performs the intrusion detection on the current first target file based on the security reference value and the first intrusion detection strategy, the first execution module is configured to perform the following operations:

Compare the security reference value with the threat threshold value corresponding to each threat level included in the first intrusion detection strategy to obtain the threat level of the current first target file, so as to complete the intrusion detection on the current first target file .

In an embodiment of the present invention, the second execution module is further configured to perform the following operations: in response to the detection result being that the second target file is a dangerous file, release the network traffic corresponding to the second target file, So that the terminal device receiving the network traffic monitors the process calling the second target file, so that the process calling the second target file can be determined as a malicious process.

It can be understood that the structures illustrated in the embodiments of the present invention do not constitute a specific limitation on a network intrusion detection apparatus. In other embodiments of the present invention, a network intrusion detection apparatus may include more or less components than shown, or some components are combined, or some components are split, or different components are arranged. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

Since the information exchange and execution process among the modules in the above apparatus are based on the same concept as the method embodiments of the present invention, the specific content can be found in the descriptions in the method embodiments of the present invention, and will not be repeated here.

An embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, a network in any embodiment of the present invention is implemented Intrusion detection method.

Embodiments of the present invention further provide a computer-readable storage medium, where a computer program is stored on the computer-readable storage medium, and when executed by a processor, the computer program causes the processor to execute any implementation of the present invention An example of a network intrusion detection method.

Specifically, it is possible to provide a system or device equipped with a storage medium on which software program codes for implementing the functions of any one of the above-described embodiments are stored, and make a computer (or CPU or MPU of the system or device) ) to read and execute the program code stored in the storage medium.

In this case, the program code itself read from the storage medium can implement the functions of any of the above-described embodiments, and thus the program code and the storage medium storing the program code form part of the present invention.

Examples of storage media for providing program code include floppy disks, hard disks, magneto-optical disks, optical disks (eg, CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), Magnetic tapes, non-volatile memory cards and ROMs. Alternatively, the program code may be downloaded from a server computer over a communications network.

In addition, it should be clear that part or all of the actual operations can be implemented not only by executing the program code read out by the computer, but also by the operating system or the like operating on the computer based on the instructions of the program code, so as to realize the above-mentioned embodiments. Function of any one of the embodiments.

In addition, it can be understood that the program code read from the storage medium is written into the memory provided in the expansion board inserted into the computer or into the memory provided in the expansion module connected with the computer, and then based on the program code The instructions cause the CPU or the like installed on the expansion board or expansion module to perform part and all of the actual operations, so as to realize the functions of any one of the above-mentioned embodiments.

It should be noted that, in this document, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply a relationship between these entities or operations. There is no such actual relationship or sequence. Furthermore, the terms "comprising", "comprising" or any other variation thereof are intended to encompass a non-exclusive inclusion such that a process, method, article or device comprising a list of elements includes not only those elements, but also includes not explicitly listed or other elements inherent to such a process, method, article or apparatus. Without further limitation, an element qualified by the phrase "comprising a..." does not preclude the presence of additional identical elements in the process, method, article, or device that includes the element.

Those of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiments can be completed by program instructions related to hardware, the aforementioned program can be stored in a computer-readable storage medium, and when the program is executed, execute It includes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other mediums that can store program codes.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, but not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that it can still be The technical solutions described in the foregoing embodiments are modified, or some technical features thereof are equivalently replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims (8)

1. A method for network intrusion detection, comprising:

analyzing the network traffic captured from the network equipment to be detected to obtain analysis data;

carrying out intrusion detection on the analyzed data to obtain a target file; the target files comprise a first target file and a second target file, wherein the first target file is a file based on a remote desktop protocol, and the second target file is a file with a format which cannot be identified by an intrusion detection system;

when the first target file is obtained, the following operations are executed: analyzing the current first target file to obtain a configuration item of the current first target file; carrying out intrusion detection on the current first target file based on a preset first intrusion detection strategy and the configuration item of the current first target file; wherein the first intrusion detection policy is determined based on all configuration items of a known remote desktop protocol-based file;

when the second target file is obtained, the following operations are executed: connecting the first binary data corresponding to the current second target file to the tail of the second binary data corresponding to the preset safety file to obtain target binary data; carrying out intrusion detection on the target binary data based on a preset second intrusion detection strategy; the security file comprises a portable executive PE file and an executable ELF file in a linkable format, and the second intrusion detection strategy corresponds to the type of the security file.

2. The method according to claim 1, characterized in that the first intrusion detection policy is determined based on:

acquiring a score value given to each configuration item of a known file based on a remote desktop protocol;

obtaining classification results of threat level classification for all configuration items of known files based on a remote desktop protocol;

determining a threat threshold corresponding to each threat level based on the score value and the classification result;

and determining a first intrusion detection strategy based on the threat threshold corresponding to each threat level.

3. The method of claim 2, wherein determining a threat threshold corresponding to each threat level based on the score value and the classification result comprises:

determining a threat threshold corresponding to each threat level as follows:

wherein,V _i is a firstiA threat threshold for each of the threat levels,C _ij is as followsiFirst in individual threat leveljThe score value of each of the configuration items,nis as followsiTotality of configuration items in individual threat levelsAnd (4) the number.

4. The method of claim 2, further comprising, after the obtaining the score value assigned to each configuration item of the known remote desktop protocol-based file: obtaining a configuration item point value library based on all configuration items of a known file based on a remote desktop protocol and a point value corresponding to each configuration item;

the intrusion detection is carried out on the current first target file based on the preset first intrusion detection strategy and the configuration item of the current first target file, and the intrusion detection method comprises the following steps:

obtaining a security reference value of the current first target file based on the configuration item point value library and the configuration item of the current first target file;

and carrying out intrusion detection on the current first target file based on the security reference value and the first intrusion detection strategy.

5. The method of claim 4, wherein obtaining the security reference value of the current first target file based on the configuration item score value database and the configuration item of the current first target file comprises:

obtaining a security reference value of the current first target file by adopting the following method:

wherein,Sis the security reference value of the current first target file,D _j is the first target file in the current first target filejThe score value of each of the configuration items,kis the total number of configuration items in the current first target file.

6. The method of claim 4, wherein the performing intrusion detection on the current first target file based on the security reference value and the first intrusion detection policy comprises:

and comparing the security reference value with threat threshold values corresponding to each threat level and included in the first intrusion detection strategy to obtain the threat level of the current first target file so as to complete intrusion detection on the current first target file.

7. The method of any of claims 1-6, further comprising, after said intrusion detection on said target binary data:

and in response to the detection result that the second target file is a dangerous file, releasing the network traffic corresponding to the second target file, so that the terminal device receiving the network traffic monitors a process calling the second target file, and the process calling the second target file can be determined as a malicious process.

8. A network intrusion detection device, comprising:

the analysis module is used for analyzing and processing the network traffic captured from the network equipment to be detected to obtain analysis data;

the detection module is used for carrying out intrusion detection on the analyzed data to obtain a target file; the target files comprise a first target file and a second target file, the first target file is a file based on a remote desktop protocol, and the second target file is a file of which the format cannot be identified;

a first executing module, configured to, when the first target file is obtained, execute the following operations: analyzing the current first target file to obtain a configuration item of the current first target file; carrying out intrusion detection on the current first target file based on a preset first intrusion detection strategy and the configuration item of the current first target file; wherein the first intrusion detection policy is determined based on all configuration items of a known remote desktop protocol-based file;

a second executing module, configured to, when the second target file is obtained, execute the following operations: connecting the first binary data corresponding to the current second target file to the tail of the second binary data corresponding to the preset safety file to obtain target binary data; carrying out intrusion detection on the target binary data based on a preset second intrusion detection strategy; the security file comprises a PE file and an ELF file, and the second intrusion detection strategy corresponds to the type of the security file.

Images