CN115086068B - A network intrusion detection method and device - Google Patents

Abstract

The embodiment of the invention relates to the technical field of computer security, and provides a network intrusion detection method and a network intrusion detection device.

Description

Method and device for network intrusion detection

technical field

The invention relates to the technical field of computer security, in particular to a network intrusion detection method and device.

Background technique

In recent years, the global network security situation has become increasingly severe, and security incidents such as network attacks and data leakage have occurred frequently. Network intrusion detection technology monitors network communication data packets through certain technical means, and analyzes these data packets to find out whether there are malicious behaviors in the network that may affect the network security of subsequent devices.

Intrusion Detection System ("IDS" for short) is a network security device that monitors network transmissions in real time, and sends an alarm or takes active response measures when suspicious transmissions are found. It differs from other network security devices in that: IDS is a proactive security protection technology.

Therefore, how to effectively improve the detection rate of network intrusion detection is a technical problem urgently needed to be solved by those skilled in the art.

Contents of the invention

In order to improve the detection rate of network intrusion detection, the invention provides a network intrusion detection method and a device for realizing the method.

In the first aspect, a network intrusion detection method includes:

Analyzing and processing the network traffic captured from the network device to be detected to obtain the analyzed data;

performing intrusion detection on the parsed data to obtain a target file; wherein, the target file includes a first target file and a second target file, the first target file is a file based on the remote desktop protocol, and the second target file is a file in an unrecognized format;

When obtaining the first target file, perform the following operations: analyze and process the current first target file to obtain the configuration items of the current first target file; based on the preset first intrusion detection strategy and the current first target file Configuration items, performing intrusion detection on the current first target file; wherein, the first intrusion detection strategy is determined based on all configuration items of known remote desktop protocol-based files;

When obtaining the second target file, perform the following operations: connect the first binary data corresponding to the current second target file to the end of the second binary data corresponding to the preset security file to obtain the target binary data ; Based on the preset second intrusion detection strategy, perform intrusion detection on the target binary data; wherein, the security file includes a portable executable PE file and an executable and linkable format ELF file, and the second intrusion The detection policy corresponds to the type of the security file.

In a possible design, the first intrusion detection strategy is specifically determined based on the following manner:

Obtain the score value assigned to each configuration item of a known remote desktop protocol-based file;

Obtain the classification results of the threat level classification performed on all configuration items of known remote desktop protocol-based files;

determining a threat threshold corresponding to each threat level based on the score value and the classification result;

Based on the threat threshold corresponding to each threat level, a first intrusion detection strategy is determined.

In a possible design, the determining a threat threshold corresponding to each threat level based on the score value and the classification result includes:

Use the following formula to determine the threat threshold corresponding to each threat level:

Among them, V _i is the threat threshold of the i -th threat level, C _ij is the score value of the j -th configuration item in the i -th threat level, and n is the total number of configuration items in the i -th threat level.

In a possible design, after the acquisition of the score value assigned to each configuration item of the known remote desktop protocol-based file, it further includes: all configuration items based on the known remote desktop protocol-based file and the score value corresponding to each configuration item to obtain the configuration item score value database;

The intrusion detection of the current first target file based on the preset first intrusion detection strategy and configuration items of the current first target file includes:

Obtaining a security reference value of the current first target file based on the configuration item score database and the configuration items of the current first target file;

Based on the security reference value and the first intrusion detection strategy, perform intrusion detection on the current first target file.

In a possible design, the obtaining the security reference value of the current first target file based on the configuration item score database and the configuration items of the current first target file includes:

The following formula is used to obtain the safety reference value of the current first target file:

Wherein, S is the security reference value of the current first target file, is the score value of the jth configuration item in the current first target file, and k is the total number of configuration items in the current first target file.

In a possible design, the performing intrusion detection on the current first target file based on the security reference value and the first intrusion detection strategy includes:

Comparing the security reference value with the threat threshold corresponding to each threat level included in the first intrusion detection strategy to obtain the threat level of the current first target file, so as to complete the intrusion detection of the current first target file .

In a possible design, after the intrusion detection is performed on the target binary data, it further includes:

Responding to the detection result that the second target file is a dangerous file, release the network traffic corresponding to the second target file, so that the terminal device receiving the network traffic performs the process of invoking the second target file monitoring, so that the process calling the second target file can be determined as a malicious process.

In a second aspect, a network intrusion detection device includes:

The parsing module is used for parsing and processing the network traffic captured from the network device to be detected to obtain parsing data;

A detection module, configured to perform intrusion detection on the parsed data to obtain a target file; wherein the target file includes a first target file and a second target file, the first target file is a file based on the remote desktop protocol, and the The second target file is a file whose format cannot be recognized;

The first execution module is configured to perform the following operations when obtaining the first target file: analyze and process the current first target file to obtain the configuration items of the current first target file; based on the preset first intrusion detection strategy and the configuration items of the current first target file, and perform intrusion detection on the current first target file; wherein, the first intrusion detection strategy is determined based on all configuration items of known remote desktop protocol-based files;

The second execution module is configured to perform the following operations when obtaining the second target file: connect the first binary data corresponding to the current second target file to the second binary data corresponding to the preset security file At the end of , the target binary data is obtained; based on the preset second intrusion detection strategy, an intrusion detection is performed on the target binary data; wherein, the security file includes a PE file and an ELF file, and the second intrusion detection strategy and the corresponding to the type of security file described above.

The beneficial effect of the present invention is that the analysis data is obtained by analyzing the network flow captured from the network device to be detected, and then the analysis data is subjected to intrusion detection to obtain the target file including the first target file and the second target file , and finally use the preset first intrusion detection strategy and the second intrusion detection strategy to perform intrusion detection on the first target file and the second target file, which can effectively improve the detection rate of network intrusion detection.

Description of drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are For some embodiments of the present invention, those skilled in the art can also obtain other drawings based on these drawings without creative effort.

Fig. 1 is a flow chart of a network intrusion detection method provided by an embodiment of the present invention;

Fig. 2 is a hardware architecture diagram of an electronic device provided by an embodiment of the present invention;

Fig. 3 is a structural diagram of a network intrusion detection device provided by an embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of the embodiments of the present invention, but not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative work belong to the protection of the present invention. scope.

Please refer to FIG. 1, an embodiment of the present invention provides a network intrusion detection method, which is applied to an intrusion detection system, and the method includes:

Analyzing and processing the network traffic captured from the network device to be detected to obtain the analyzed data;

Performing intrusion detection on the parsed data to obtain a target file; wherein, the target file includes a first target file and a second target file, the first target file is a file based on the remote desktop protocol, and the second target file is a file whose format cannot be recognized;

When obtaining the first target file, perform the following operations: analyze and process the current first target file to obtain the configuration items of the current first target file; based on the preset first intrusion detection strategy and the configuration items of the current first target file , performing intrusion detection on the current first target file; wherein, the first intrusion detection policy is determined based on all configuration items of known remote desktop protocol-based files;

When obtaining the second target file, perform the following operations: connect the first binary data corresponding to the current second target file to the end of the second binary data corresponding to the preset security file to obtain the target binary data; The preset second intrusion detection strategy performs intrusion detection on the target binary data; wherein, the security file includes a PE file and an ELF file, and the second intrusion detection strategy corresponds to the type of the security file.

In the embodiment of the present invention, the analysis data is obtained by analyzing the network traffic captured from the network device to be detected, and then the analysis data is subjected to intrusion detection to obtain the target file including the first target file and the second target file, Finally, the preset first intrusion detection strategy and the second intrusion detection strategy are used to perform intrusion detection on the first target file and the second target file, which can effectively improve the detection rate of network intrusion detection.

The execution manner of each step shown in FIG. 1 is described below.

The intrusion detection system is deployed in the network device to be detected (such as a firewall) in the form of software to monitor all network traffic data packets transmitted through the network device to be detected. Wherein, the network traffic data packets include but not limited to IP data packets, TCP data packets, UDP data packets and ICMP data packets.

The parsing process is to complete functions such as network traffic decoding, protocol preprocessing, protocol identification, and application identification, which are well known to those skilled in the art and will not be described in detail here. Among them, the identified protocols include but are not limited to: IP (Internet Protocol, a protocol for interconnecting networks), TCP (Transmission Control Protocol, Transmission Control Protocol), UDP (User Datagram Protocol, User Datagram Protocol), ICMP (Internet Control ManagemetProtocol Version6, Internet Control Information Protocol Version 6); supports and is not limited to identifying the following application layer protocols: HTTP (Hyper Text Transfer Protocol over Secure Socket Layer, Hypertext Transfer Security Protocol), FTP (File Transfer Protocol, File Transfer Protocol), TLS (Transport Layer Security, secure transport layer protocol), SMB (Server Message Block, protocol name), DNS (Domain Name System, domain name resolution protocol), SSH (Secure Shell, secure shell protocol), SMTP (Simple Mail Transfer Protocol, Simple Mail Transfer Protocol), DHCP (Dynamic Host Configuration Protocol, Dynamic Host Configuration Protocol).

Intrusion detection refers to detecting whether the parsed data is malicious data. The specific detection means include but not limited to stream estimation detection and file extraction, which are well known to those skilled in the art and will not be described here.

In some related technologies, hackers will use email, chat, etc. to induce users to click on relevant links, and then load malicious files based on Remote Desktop Protocol (RDP), which will cause the user's computer and the remote computer controlled by the hacker to The server establishes a connection. At this time, the hacker can control the user's computer to perform related malicious operations through the remote server.

Specifically, the hacker may have preset configuration items such as drive mapping, USB device mapping, printer mapping, and clipboard mapping in the loaded malicious remote desktop protocol-based file, so that the hacker can control the remote server. Perform related malicious operations, such as stealing the contents of important files in the user's computer. Therefore, it is necessary to perform intrusion detection on files based on Remote Desktop Protocol.

In other related technologies, in order to improve the detection efficiency, the intrusion detection system will classify according to the file format, and implement different detection strategies for different file formats. For a file format that the intrusion detection system cannot recognize, the intrusion detection system usually does not process (for example, delete) the file in this format. Therefore, hackers usually change the format of dangerous files to prevent the intrusion detection system from checking out the dangerous files.

Specifically, the hacker will extract the malicious code in the dangerous file to generate a file in a format that cannot be recognized by the intrusion detection system, and then use a file without malicious code to open the generated new file in the user's computer to obtain the malicious code And execute malicious code, which is detrimental to the security of the user's computer. Therefore, it is necessary to perform intrusion detection on files based on Remote Desktop Protocol.

To sum up, in order to effectively improve the detection rate of network intrusion detection, the above two types of target files (that is, the first target file based on the remote desktop protocol and the second target file whose format cannot be recognized by the intrusion detection system) can be Perform intrusion detection.

The following focuses on how to effectively check out the first target file and the second target file.

After the first target file is obtained through intrusion detection, the first target file is parsed first to obtain the configuration items of the first target file, and then based on the preset first intrusion detection strategy and the obtained configuration items of the first target file , perform intrusion detection on the current first target file, so as to determine whether the first target file is a dangerous file (for example, determine the first target file whose threat level is medium security threat or high security threat determined below as a dangerous file), Therefore, the detection rate of network intrusion detection can be effectively improved.

In some implementation manners, the first intrusion detection strategy is specifically determined based on the following manner:

Step A1, obtaining the score value assigned to each configuration item of the known remote desktop protocol-based file;

Step A2, obtaining the classification result of the threat level classification for all configuration items of the known remote desktop protocol-based files;

Step A3, based on the score value and the classification result, determine the threat threshold corresponding to each threat level;

Step A4, based on the threat threshold corresponding to each threat level, determine a first intrusion detection strategy.

In this embodiment, the threat threshold corresponding to each threat level is calculated by assigning a score value to each configuration item of the known remote desktop protocol-based file and classifying the threat level, and then using the threat threshold to Develop a first intrusion detection strategy. In this way, when subsequent intrusion detection is performed on the first target file, the intrusion detection result of the first target file can be obtained according to the score value of the configuration item in the first target file and the first intrusion detection strategy.

In step A1, the staff can list all configuration items in the known remote desktop protocol-based files in advance, and then score the security of each configuration item according to prior knowledge (such as expert security knowledge base) (ie assigned score value), so that the user computer can obtain the score value assigned to each configuration item of the known remote desktop protocol-based file.

In some implementation manners, the score value assigned to each configuration item of the known RDP file obtained by the user computer can be referred to Table 1. It should be noted that only some configuration items and their score values of known RDP files are listed in Table 1.

Table 1

In step A2, for example, the threat levels may be divided into three categories, namely, high security threat, medium security threat, and low security threat. Of course, it can also be divided into more or less threat levels, and the number of threat levels is not limited here.

In some implementations, high security threats may include configuration items such as drive mapping, clipboard mapping, USB device mapping, and printer mapping, for example, medium security threats may include configuration items such as smart card mapping, and low security threats may include, for example, remote application icons and screen display mode and other configuration items.

In some implementation manners, the classification result of the threat level classification obtained by the user computer for all configuration items of known remote desktop protocol-based files can be referred to in Table 2. It should be noted that Table 2 only lists some configuration items and their threat levels of the same known remote desktop protocol-based files as those in Table 1.

Table 2

In addition, the order of steps A1 and A2 is not specifically limited here, that is, step A1 may be executed first and then step A2 may be executed, or step A2 may be executed first and then step A1 may be executed.

After steps A1 and A2, the configuration items in each threat level are given a score value, so that the threat threshold of each threat level can be determined to facilitate the subsequent intrusion detection of the first target file.

In some embodiments, step A3 may specifically include:

Use the following formula to determine the threat threshold corresponding to each threat level:

Among them, V _i is the threat threshold of the i -th threat level, C _ij is the score value of the j -th configuration item in the i -th threat level, and n is the total number of configuration items in the i -th threat level.

For example, as shown in Table 1 and Table 2, the above formulas can be used to calculate the threat thresholds corresponding to the threat levels of high security threat, medium security threat and low security threat, so that the high security threat, medium security threat Threat thresholds for low and low security threats are 85, 10, and 1, respectively.

It should be noted that using the mean value of the configuration items in each threat level as the threat threshold can avoid obtaining more objective and Accurate threat thresholds of each threat level are used to improve the accuracy of intrusion detection of the first target file.

In step A3, the threat threshold of each threat level may also be determined in other ways, for example, the lowest score value of the configuration item in each threat level may be used as the threat threshold of the threat level. Of course, the median value of the configuration items in each threat level may also be used as the threat threshold of the threat level, so the method of determining the threat threshold is not specifically limited here.

It should be noted that when the first target file is detected, the intrusion detection system will first analyze the first target file to obtain the configuration items in the first target file, and then use the preset first intrusion detection strategy and analysis The obtained configuration items of the first target file are used to perform intrusion detection on the first target file. Here, the embodiment of the present invention does not specifically limit the parsing and processing manner of the first target file, for example, regular matching may be used.

In some implementations, after step A1, further comprising: obtaining a configuration item score value database based on all configuration items of known remote desktop protocol-based files and a score value corresponding to each configuration item;

Based on the preset first intrusion detection policy and the configuration items of the current first target file, the intrusion detection is performed on the current first target file, including:

Step B1, based on the configuration item score database and the configuration items of the current first target file, obtain the security reference value of the current first target file;

Step B2: Perform intrusion detection on the current first target file based on the security reference value and the first intrusion detection strategy.

In this embodiment, the score value of the configuration item of the first target file is obtained by using the configuration item score value library, and the security reference value of the first target file is determined according to the score value of the configuration item of the first target file, by The security reference value is compared with the threat threshold corresponding to each threat level included in the first intrusion detection strategy to obtain the threat level of the first target file, so as to complete the intrusion detection of the first target file.

In step B1, the configuration item score value library can be used to match the score value of the configuration item of the first target file obtained by parsing, and then use the score value of the configuration item of the first target file to calculate a security reference value, so as to facilitate subsequent The first object file is subjected to intrusion detection.

In some embodiments, step B1 may specifically include:

The following formula is used to obtain the safety reference value of the current first target file:

Wherein, S is the security reference value of the current first target file, Dj is the score value of the _jth configuration item in the current first target file, and k is the total number of configuration items in the current first target file.

In this embodiment, the sum of the score values of all configuration items in the first target file is used as the safety reference value of the first target file, compared with the average value and the highest value of the score values of all configuration items in the first target file , the lowest value and other values as the safety reference value of the first target file, the former method can prevent more objective and an accurate security reference value for characterizing the threat level of the first target file, so that the accuracy of intrusion detection of the first target file can be improved.

Of course, the safety reference value of the first target file can also be determined in other ways. For example, the mean value of all configuration items in the first target file or the highest score value in the configuration item can be used as the safety reference value. Here, the safety reference value The determination method is not specifically limited.

In some embodiments, step B2 may specifically include:

The security reference value is compared with the threat threshold corresponding to each threat level included in the first intrusion detection strategy to obtain the threat level of the current first target file, so as to complete the intrusion detection of the current first target file.

For example, the obtained security reference value can be compared with the threat threshold corresponding to each determined threat level, and if the security reference value is greater than or equal to the threat threshold of high security threat, that is, S≥V3, it means that the first target file The threat level is a high security threat level; if the security reference value is greater than or equal to the threat threshold of the medium security threat and less than the threat threshold of the high security threat, that is, when S<V3 and S≥V2, it means that the threat level of the first target file is Medium security threat level; if the security reference value is greater than or equal to the threat threshold of low security threat and less than the threat threshold of medium security threat, that is, when S<V2 and S≥V1, it means that the threat level of the first target file is low security threat level. In this way, the intrusion detection result of the first target file (that is, the threat level of the first target file) can be obtained, and then corresponding operations can be performed according to the threat level of the first target file, such as prohibiting execution, and prompting the user to Choose whether to run, allow to run, and other operations.

After obtaining the second target file through intrusion detection, firstly connect the first binary data corresponding to the current second target file to the end of the second binary data corresponding to the preset security file to obtain the target binary data, namely Files in a format that cannot be recognized by the intrusion detection system are converted into files in a format that can be recognized by the intrusion detection system (that is, including PE files and ELF files), so that intrusion detection can be performed on the second target file, thereby solving the problem of intrusion detection system The problem that the files in the unrecognized format cannot be effectively detected can effectively improve the detection rate of network intrusion detection.

It should be noted that "a format that cannot be recognized by the intrusion detection system" can be understood as: neither a file format well-known to those skilled in the art, nor a file format pre-set to be recognized by the intrusion detection system. On the contrary, "a format that can be recognized by the intrusion detection system" can be understood as: it can belong to a file format well known to those skilled in the art, or it can belong to a file format that is preset in the intrusion detection system and can be recognized.

Among them, PE files and ELF files are selected as security files, because these two types of files can be executed by the computer itself, so it is beneficial to the subsequent intrusion detection of the target binary data.

It should also be noted that Portable Executable (PE) is a file format for executable files, object files, and dynamic link libraries, mainly used on 32-bit and 64-bit Windows operating systems . "Portable" refers to the generality of the file format, which can be used on many different operating systems and architectures. The PE file format encapsulates some information necessary for the Windows operating system to load executable program code. This information includes dynamic link libraries, API import and export tables, resource management data, and thread-local storage data. In the Windows NT operating system, the PE file format is mainly used for EXE files, DLL files, SYS (drivers) and other file types. The Extensible Firmware Interface (EFI) Technical Specification states that the PE format is a standard executable file format in the EFI environment, beginning with a DOS header.

Executable and Linkable Format (ELF), often referred to as the ELF format, is a standard file format for executables, object files, shared libraries, and core dumps in computer science.

In order to ensure the comprehensiveness and accuracy of the detection of the second target file, it may be considered to set the number of target binary data and the number of security files to be the same. That is to say, the first binary data corresponding to the second target file is copied multiple times, and each set of copied first binary data is respectively connected to the second binary data of each different type of security file. At the end of the binary data, a variety of target binary data can be obtained.

It should be noted that the second intrusion detection strategy preset in the intrusion detection system can be obtained based on existing mature detection strategies, which are well known to those skilled in the art, and the specific detection strategies will not be repeated here. .

If the detection result of the intrusion detection system is that the second target file is a dangerous file, it means that there is malicious code in the second target file, and it is likely to be invoked by a related malicious process in the user's computer to complete the infection of the user's computer .

In order to solve this technical problem, in some embodiments, it also includes:

In response to the detection result that the second target file is a dangerous file, the network traffic corresponding to the second target file is released, so that the terminal device receiving the network traffic monitors the process of calling the second target file, so that the second target file can be called. The process of the target file is determined to be malicious.

In this embodiment, when it is determined that the second target file is a dangerous file, the intrusion detection system can release the network traffic corresponding to the second target file, so that on the premise that the second target file is known to be a dangerous file, it will instead The release of the corresponding network traffic is beneficial to monitor and analyze the process associated with the second target file by using the subsequent terminal device. That is, when it is determined that the second target file is a dangerous file, the terminal device (such as a user computer) receiving network traffic monitors (for example, using hook technology) the process that calls the second target file, so that the process that calls the second target file It is determined to be a malicious process, and the malicious process can be further processed (such as deletion or further related analysis), thus ensuring that the user's computer will not be infected by viruses, and at the same time, relevant analysis of such viruses is also carried out, which is beneficial to the staff Master the attack habits of such viruses.

As shown in FIG. 2 and FIG. 3 , an embodiment of the present invention provides a network intrusion detection device. The device embodiments can be implemented by software, or by hardware or a combination of software and hardware. From the hardware level, as shown in Figure 2, it is a hardware architecture diagram of an electronic device where a network intrusion detection device is provided in an embodiment of the present invention, except for the processor, memory, network interface, and In addition to the non-volatile memory, the electronic device in which the device in the embodiment is located may generally include other hardware, such as a forwarding chip responsible for processing messages, and the like. Taking software implementation as an example, as shown in Figure 3, as a device in a logical sense, it is formed by reading the corresponding computer program in the non-volatile memory into the memory and running it through the CPU of the electronic device where it is located.

As shown in Figure 3, a network intrusion detection device provided in this embodiment includes:

The parsing module is used for parsing and processing the network traffic captured from the network device to be detected to obtain parsing data;

A detection module, configured to perform intrusion detection on the parsed data to obtain a target file; wherein the target file includes a first target file and a second target file, the first target file is a file based on the remote desktop protocol, and the The second target file is a file whose format cannot be recognized;

The first execution module is configured to perform the following operations when obtaining the first target file: analyze and process the current first target file to obtain the configuration items of the current first target file; based on the preset first intrusion detection strategy and the configuration items of the current first target file, and perform intrusion detection on the current first target file; wherein, the first intrusion detection strategy is determined based on all configuration items of known remote desktop protocol-based files;

The second execution module is configured to perform the following operations when obtaining the second target file: connect the first binary data corresponding to the current second target file to the second binary data corresponding to the preset security file At the end of , the target binary data is obtained; based on the preset second intrusion detection strategy, an intrusion detection is performed on the target binary data; wherein, the security file includes a PE file and an ELF file, and the second intrusion detection strategy and the corresponding to the type of security file described above.

In an embodiment of the present invention, the first intrusion detection strategy is specifically determined based on the following manner:

Obtain the score value assigned to each configuration item of a known remote desktop protocol-based file;

Obtain the classification results of the threat level classification performed on all configuration items of known remote desktop protocol-based files;

determining a threat threshold corresponding to each threat level based on the score value and the classification result;

Based on the threat threshold corresponding to each threat level, a first intrusion detection strategy is determined.

In an embodiment of the present invention, the determining a threat threshold corresponding to each threat level based on the score value and the classification result includes:

Use the following formula to determine the threat threshold corresponding to each threat level:

为第i个威胁等级的威胁阈值，为第i个威胁等级中第j个配置项的分数值，n为第i个威胁等级中的配置项的总个数。in,

is the threat threshold of the i -th threat level, is the score value of the j -th configuration item in the i -th threat level, and n is the total number of configuration items in the i -th threat level.

In one embodiment of the present invention, the first execution module is further configured to perform the following operations: based on all configuration items of known remote desktop protocol-based files and the score value corresponding to each configuration item, obtain the configuration item score numerical library;

The first execution module is used to perform the following operations when performing intrusion detection on the current first target file based on the preset first intrusion detection strategy and configuration items of the current first target file:

Obtaining a security reference value of the current first target file based on the configuration item score database and the configuration items of the current first target file;

Based on the security reference value and the first intrusion detection strategy, perform intrusion detection on the current first target file.

In one embodiment of the present invention, when the first execution module executes the configuration item based on the configuration item score value database and the current first target file to obtain the security reference value of the current first target file, it is used to execute Do as follows:

The following formula is used to obtain the safety reference value of the current first target file:

Wherein, S is the security reference value of the current first target file, Dj is the score value of the _jth configuration item in the current first target file, and k is the total number of configuration items in the current first target file.

In one embodiment of the present invention, the first execution module is configured to perform the following operations when executing the intrusion detection on the current first target file based on the security reference value and the first intrusion detection strategy:

Comparing the security reference value with the threat threshold corresponding to each threat level included in the first intrusion detection strategy to obtain the threat level of the current first target file, so as to complete the intrusion detection of the current first target file .

In an embodiment of the present invention, the second execution module is further configured to perform the following operations: in response to the detection result that the second target file is a dangerous file, release the network traffic corresponding to the second target file, The terminal device receiving the network traffic monitors the process calling the second target file, so that the process calling the second target file can be determined as a malicious process.

It can be understood that the structure shown in the embodiment of the present invention does not constitute a specific limitation on a network intrusion detection device. In other embodiments of the present invention, a network intrusion detection device may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange different components. The illustrated components may be realized in hardware, software, or a combination of software and hardware.

The information interaction and execution process among the modules in the above-mentioned device are based on the same concept as the method embodiment of the present invention, and the specific content can refer to the description in the method embodiment of the present invention, and will not be repeated here.

An embodiment of the present invention also provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, a network in any embodiment of the present invention is implemented. Intrusion detection method.

The embodiment of the present invention also provides a computer-readable storage medium, the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the processor executes any implementation of the present invention. A network intrusion detection method in the example.

Specifically, a system or device equipped with a storage medium may be provided, on which the software program code for realizing the functions of any of the above embodiments is stored, and the computer (or CPU or MPU of the system or device) ) to read and execute the program code stored in the storage medium.

In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, so the program code and the storage medium storing the program code constitute a part of the present invention.

Examples of storage media for providing program code include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), Tape, non-volatile memory card, and ROM. Alternatively, the program code can be downloaded from a server computer via a communication network.

In addition, it should be clear that not only by executing the program code read by the computer, but also by making the operating system on the computer complete part or all of the actual operations through instructions based on the program code, so as to realize the function of any one of the embodiments.

In addition, it can be understood that the program code read from the storage medium is written into the memory provided in the expansion board inserted into the computer or written into the memory provided in the expansion module connected to the computer, and then based on the program code The instruction causes the CPU installed on the expansion board or the expansion module to perform some or all of the actual operations, thereby realizing the functions of any one of the above-mentioned embodiments.

It should be noted that in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is a relationship between these entities or operations. There is no such actual relationship or sequence. Furthermore, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus comprising a set of elements includes not only those elements, but also includes elements not expressly listed. other elements of or also include elements inherent in such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising a" does not exclude the presence of additional same elements in the process, method, article or apparatus comprising said element.

Those of ordinary skill in the art can understand that all or part of the steps to realize the above method embodiments can be completed by program instructions related hardware, and the aforementioned programs can be stored in a computer-readable storage medium. When the program is executed, the It includes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other various media that can store program codes.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still be Modifications are made to the technical solutions described in the foregoing embodiments, or equivalent replacements are made to some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims (8)

1. A network intrusion detection method, characterized in that, comprising: Analyzing and processing the network traffic captured from the network device to be detected to obtain the analyzed data; performing intrusion detection on the parsed data to obtain a target file; wherein, the target file includes a first target file and a second target file, the first target file is a file based on the remote desktop protocol, and the second target file It is a file whose format cannot be recognized by the intrusion detection system; When obtaining the first target file, perform the following operations: analyze and process the current first target file to obtain the configuration items of the current first target file; based on the preset first intrusion detection strategy and the current first target file Configuration items, performing intrusion detection on the current first target file; wherein, the first intrusion detection strategy is determined based on all configuration items of known remote desktop protocol-based files; When obtaining the second target file, perform the following operations: connect the first binary data corresponding to the current second target file to the end of the second binary data corresponding to the preset security file to obtain the target binary data ; Based on the preset second intrusion detection strategy, perform intrusion detection on the target binary data; wherein, the security file includes a portable executable PE file and an executable and linkable format ELF file, and the second intrusion The detection policy corresponds to the type of the security file. 2. The method according to claim 1, wherein the first intrusion detection strategy is specifically determined based on the following manner: Obtain the score value assigned to each configuration item of a known remote desktop protocol-based file; Obtain the classification results of the threat level classification performed on all configuration items of known remote desktop protocol-based files; determining a threat threshold corresponding to each threat level based on the score value and the classification result; Based on the threat threshold corresponding to each threat level, a first intrusion detection strategy is determined. 3. The method according to claim 2, wherein said determining a threat threshold corresponding to each threat level based on said score value and said classification result comprises: The threat thresholds corresponding to each threat class are determined as follows:

Among them, V _i is the threat threshold of the i -th threat level, C _ij is the score value of the j -th configuration item in the i -th threat level, and n is the total number of configuration items in the i -th threat level. 4. The method according to claim 2, characterized in that, after said obtaining the score value assigned to each configuration item of the file based on the known remote desktop protocol, further comprising: All the configuration items of the protocol file and the score value corresponding to each configuration item to obtain the configuration item score value database; The intrusion detection of the current first target file based on the preset first intrusion detection strategy and configuration items of the current first target file includes: Obtaining a security reference value of the current first target file based on the configuration item score database and the configuration items of the current first target file; Based on the security reference value and the first intrusion detection strategy, perform intrusion detection on the current first target file. 5. The method according to claim 4, characterized in that, obtaining the security reference value of the current first target file based on the configuration item score database of the configuration item and the configuration item of the current first target file includes: The safety reference value of the current first target file is obtained in the following manner:

Wherein, S is the security reference value of the current first target file, D _j is the score value of the jth configuration item in the current first target file found based on the configuration item score value database, and k is the current first target file The total number of configuration items in . 6. The method according to claim 4, wherein said performing intrusion detection on the current first target file based on said security reference value and said first intrusion detection strategy comprises: Comparing the security reference value with the threat threshold corresponding to each threat level included in the first intrusion detection strategy to obtain the threat level of the current first target file, so as to complete the intrusion detection of the current first target file . 7. The method according to any one of claims 1-6, further comprising: after the intrusion detection is performed on the target binary data: Responding to the detection result that the second target file is a dangerous file, release the network traffic corresponding to the second target file, so that the terminal device receiving the network traffic performs the process of invoking the second target file monitoring, so that the process calling the second target file can be determined as a malicious process. 8. A network intrusion detection device, characterized in that it comprises: The parsing module is used for parsing and processing the network traffic captured from the network device to be detected to obtain parsing data; A detection module, configured to perform intrusion detection on the parsed data to obtain a target file; wherein the target file includes a first target file and a second target file, the first target file is a file based on the remote desktop protocol, and the The second target file is a file whose format cannot be recognized; The first execution module is configured to perform the following operations when obtaining the first target file: analyze and process the current first target file to obtain the configuration items of the current first target file; based on the preset first intrusion detection strategy and the configuration items of the current first target file, and perform intrusion detection on the current first target file; wherein, the first intrusion detection strategy is determined based on all configuration items of known remote desktop protocol-based files; The second execution module is configured to perform the following operations when obtaining the second target file: connect the first binary data corresponding to the current second target file to the second binary data corresponding to the preset security file At the end of , the target binary data is obtained; based on the preset second intrusion detection strategy, an intrusion detection is performed on the target binary data; wherein, the security file includes a PE file and an ELF file, and the second intrusion detection strategy and the corresponding to the type of security file described above.

Images