CN112351008B - Network attack analysis method, device, readable storage medium and computer equipment - Google Patents

Abstract

The invention discloses a network attack analysis method, a device, a readable storage medium and computer equipment, wherein the network attack analysis method comprises the following steps: when a network attack alarm occurs, reading a first object entity selected by a user; analyzing the first object entity through a preset analysis query interface to generate first query result data, wherein the analysis query interface has query logic information; extracting the query result data to generate a second object entity; analyzing the second object entity through the analysis query interface to generate second query result data; and acquiring the relation between the first query result data and the second query result data, connecting the first object entity and the second object entity through a relation graph, and displaying the relation graph. The method and the device can solve the problems that the learning cost is high and the incidence relation behind the data cannot be visually seen in the prior art.

Description

Network attack analysis method, device, readable storage medium and computer equipment

technical field

The present invention relates to the technical field of network security, and in particular, to a network attack analysis method, device, readable storage medium and computer equipment.

Background technique

In today's network, there are all kinds of hackers with different purposes to carry out network attacks on other individuals or enterprises on the Internet, in order to achieve their goals such as gaining interests, increasing prestige, and political intentions. In the past security incidents, enterprises have problems with the ability to perceive the lost hosts in the network, and often fail to detect attacks in the network at the first time. Hackers conduct long-term lurking within the organization, collecting information, stealing sensitive data, and even destroying them.

In order to strengthen the security awareness of enterprises, more and more enterprises are currently establishing log analysis platforms. However, the current log analysis platform still has the following problems: the current log analysis platform requires complicated data query statements every time the data is retrieved, and the query syntax of different log platforms is not the same, which causes high learning costs for users; , the existing log analysis platform is mainly displayed in the form of a list. When the threat source is traced, the results displayed in the form of a list cannot intuitively see the relationship behind the data.

SUMMARY OF THE INVENTION

Therefore, an object of the present invention is to propose a network attack analysis method, so as to solve the problem of high learning cost and inability to intuitively see the correlation behind the data in the prior art.

The present invention provides a network attack analysis method, comprising:

When a network attack alarm occurs, read the first object entity selected by the user;

Analyze the first object entity through a preset analysis query interface to generate first query result data, and the analysis query interface has query logic information;

extracting the query result data to generate a second object entity;

Analyze the second object entity through the analysis query interface to generate second query result data;

Obtain the relationship between the first query result data and the second query result data, connect the first object entity and the second object entity through a relationship diagram, and display the relationship diagram.

According to the network attack analysis method provided by the present invention, by encapsulating the query interface, the user can directly call the query interface through an interactive method to obtain the desired query result data, which reduces the threshold of network threat traceability and log analysis, and the learning cost is low. And convenient and convenient. In addition, displaying query results through a relational graph structure allows users to intuitively analyze the relationship between behaviors, locate attack sources more quickly, evaluate the impact of attacks more quickly, and help users quickly understand the relationship behind the data.

In addition, according to the above-mentioned network attack analysis method of the present invention, it can also have the following additional technical features:

Further, the analysis query interface includes an alarm name query interface, a source address and destination address query interface, a source port and destination port query interface, and an HTTP query interface;

The alarm name query interface is used to search for the alarm name according to the source address, or search for the alarm name according to the destination address, or search for the alarm name according to the source host, or search for the alarm name according to the destination host, or search for the alarm name according to the domain name;

The source address and destination address query interface is used to search for the source address according to the alarm name, or search for the destination address according to the alarm name, or search for the destination address according to the source address and the alarm name, or search for the source address according to the destination address and the alarm name, or according to the alarm name. Source address and destination port search destination address;

The source port and destination port query interface is used to search for the destination port according to the source address, or search for the source port according to the destination address and the alarm name, or search for the destination port according to the source address and the alarm name;

The HTTP query interface is used to search the request URL according to the alarm name, or search the request URL according to the source address, or search for the HTTP return status code according to the alarm name, or search for the HTTP return status code according to the source address.

Further, the analysis query interface further includes a DNS domain name query interface, and the DNS domain name query interface is used to search the DNS domain name according to the source address and the alarm name.

Further, the method specifically includes:

When a network attack alarm occurs, read the alarm object entity;

Obtain the source address of the alarm object entity through the source address and destination address query interfaces in the analysis query interface;

Select the source address as the object entity, and call the alarm name query interface in the analysis query interface to obtain other alarms related to the source address;

Select other alarms related to the source address as object entities, and call the source port and destination port query interfaces in the analysis query interface to obtain the destination port;

Select the destination port as the object entity, and call the source address and destination address query interface in the analysis query interface to obtain the destination address;

Select the destination address as the object entity, and call the alarm name query interface in the analysis query interface to obtain other alarms related to the destination address;

The relationship between each query result data of the analysis query interface is acquired, each object entity is connected through a relationship diagram, and the relationship diagram is displayed.

Further, the first object entity includes source address, destination address, source port, destination port, transmission protocol, application protocol, alarm name, event name, file name, virus name, DNS domain name, request URL, HTTP return status code , process name, user name, operation, and operation result.

Another object of the present invention is to provide a network attack analysis device to solve the problems of low test efficiency and high test cost in the prior art.

The present invention provides a network attack analysis device, comprising:

a first reading module, configured to read the first object entity selected by the user when a network attack alarm occurs;

a first analysis module, configured to analyze the first object entity through a preset analysis and query interface to generate first query result data, and the analysis and query interface has query logic information;

an extraction and generation module for extracting the query result data to generate a second object entity;

a second analysis module, configured to analyze the second object entity through the analysis query interface to generate second query result data;

The first display module is used to obtain the relationship between the first query result data and the second query result data, connect the first object entity and the second object entity through a relationship diagram, and The relationship diagram is shown.

According to the network attack analysis device provided by the present invention, by encapsulating the query interface, the user can directly call the query interface through an interactive method to obtain the desired query result data, thereby lowering the threshold of network threat tracing and log analysis, and the learning cost is low. And convenient and convenient. In addition, displaying query results through a relational graph structure allows users to intuitively analyze the relationship between behaviors, locate attack sources more quickly, evaluate the impact of attacks more quickly, and help users quickly understand the relationship behind the data.

In addition, according to the above-mentioned network attack analysis device of the present invention, it can also have the following additional technical features:

Further, the analysis query interface includes an alarm name query interface, a source address and destination address query interface, a source port and destination port query interface, and an HTTP query interface;

The alarm name query interface is used to search for the alarm name according to the source address, or search for the alarm name according to the destination address, or search for the alarm name according to the source host, or search for the alarm name according to the destination host, or search for the alarm name according to the domain name;

The source address and destination address query interface is used to search for the source address according to the alarm name, or search for the destination address according to the alarm name, or search for the destination address according to the source address and the alarm name, or search for the source address according to the destination address and the alarm name, or according to the alarm name. Source address and destination port search destination address;

The source port and destination port query interface is used to search for the destination port according to the source address, or search for the source port according to the destination address and the alarm name, or search for the destination port according to the source address and the alarm name;

The HTTP query interface is used to search the request URL according to the alarm name, or search the request URL according to the source address, or search for the HTTP return status code according to the alarm name, or search for the HTTP return status code according to the source address.

Further, the analysis query interface further includes a DNS domain name query interface, and the DNS domain name query interface is used to search the DNS domain name according to the source address and the alarm name.

Further, the first object entity includes source address, destination address, source port, destination port, transmission protocol, application protocol, alarm name, event name, file name, virus name, DNS domain name, request URL, HTTP return status code , process name, user name, operation, and operation result.

Additionally, in one example, the apparatus includes:

The second reading module is used to read the alarm object entity when a network attack alarm occurs;

a first query module, configured to obtain the source address of the alarm object entity through the source address and destination address query interfaces in the analysis query interface;

a second query module, configured to select the source address as an object entity, and call the alarm name query interface in the analysis query interface to acquire other alarms related to the source address;

a third query module, configured to select other alarms related to the source address as object entities, and call the source port and destination port query interfaces in the analysis query interface to obtain the destination port;

a fourth query module, configured to select the destination port as an object entity, and call the source address and destination address query interface in the analysis query interface to obtain the destination address;

a fifth query module, configured to select the destination address as an object entity, and call the alarm name query interface in the analysis query interface to acquire other alarms related to the destination address;

The second display module is used for acquiring the relationship between each query result data of the analysis query interface, connecting each object entity through a relationship diagram, and displaying the relationship diagram.

The present invention also provides a readable storage medium on which a computer program is stored, and when the program is executed by a processor, implements the steps of the above network attack analysis method.

The present invention also provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, the processor implementing the steps of the network attack analysis method when the processor executes the program.

Additional aspects and advantages of the present invention will be set forth, in part, from the following description, and in part will be apparent from the following description, or may be learned from the embodiments of the invention.

Description of drawings

The above and/or additional aspects and advantages of embodiments of the present invention will become apparent and readily understood from the following description of the embodiments in conjunction with the accompanying drawings, wherein:

1 is a flowchart of a network attack analysis method according to an embodiment of the present invention;

2 is a flowchart of a network attack analysis method according to another embodiment of the present invention;

3 is a schematic diagram of a relationship network between an exemplary plurality of object entities;

4 is a structural block diagram of a network attack analysis apparatus according to an embodiment of the present invention;

5 is a structural block diagram of a network attack analysis apparatus according to another embodiment of the present invention;

FIG. 6 is an internal structure diagram of a computer device according to an embodiment of the present invention.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments These are some embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

Referring to FIG. 1 , a network attack analysis method proposed by an embodiment of the present invention includes at least steps S101 to S105.

In S101, when a network attack alarm occurs, the first object entity selected by the user is read. When a user observes a suspicious event that needs to be analyzed in the daily operation and maintenance work, that is, when a network attack alarm occurs, a visual interaction interface is provided for the user. The user can interact by clicking on the first object entity, and then select the analysis query interface. Issue a query task.

The first object entity includes but is not limited to source address, destination address, source port, destination port, transmission protocol, application protocol, alarm name, event name, file name, virus name, DNS domain name, request URL, HTTP return status code , process name, user name, operation, and operation result.

In S102, the first object entity is analyzed through a preset analysis and query interface to generate first query result data, and the analysis and query interface has query logic information.

Among them, the user can write the query logic information in the analysis query interface in advance, and then encapsulate the analysis query interface for calling when needed.

Specifically, the analysis query interface includes an alarm name query interface, a source address and destination address query interface, a source port and destination port query interface, and an HTTP query interface.

The alarm name query interface is used to search for the alarm name according to the source address, or search for the alarm name according to the destination address, or search for the alarm name according to the source host, or search for the alarm name according to the destination host, or search for the alarm name according to the domain name.

The source address and destination address query interface is used to search for the source address according to the alarm name, or search for the destination address according to the alarm name, or search for the destination address according to the source address and the alarm name, or search for the source address according to the destination address and the alarm name, or according to the alarm name. The source address and destination port search for the destination address.

The source port and destination port query interface is used to search for the destination port according to the source address, or search for the source port according to the destination address and the alarm name, or search for the destination port according to the source address and the alarm name.

The HTTP query interface is used to search the request URL according to the alarm name, or search the request URL according to the source address, or search for the HTTP return status code according to the alarm name, or search for the HTTP return status code according to the source address.

Optionally, the analysis query interface further includes a DNS domain name query interface, and the DNS domain name query interface is used to search the DNS domain name according to the source address and the alarm name.

In S103, the query result data is extracted to generate a second object entity. Among them, the query result data obtained in the previous step is used as a new object entity again.

The second object entity also includes but is not limited to source address, destination address, source port, destination port, transmission protocol, application protocol, alarm name, event name, file name, virus name, DNS domain name, request URL, HTTP return status code, process name, user name, operation, operation result.

In S104, the second object entity is analyzed through the analysis query interface to generate second query result data. The analysis can be performed by analyzing any query interface among the alarm name query interface, source address and destination address query interface, source port and destination port query interface, HTTP query interface, and DNS domain name query interface in the query interface.

In S105, the relationship between the first query result data and the second query result data is acquired, the first object entity and the second object entity are connected through a relationship graph, and the relationship is Figure to show. The relationship between the first object entity and the second object entity can be established according to the relationship between the two query result data, and then displayed to the user in the form of a relationship diagram. ,

In addition, it should be noted that if the user's analysis query requirements cannot be satisfied in the preset analysis query interface, the user can also independently add a new query interface to call.

According to the network attack analysis method provided in this embodiment, by encapsulating the query interface, the user can directly call the query interface through an interactive method to obtain the desired query result data, which reduces the threshold for network threat tracing and log analysis, and the learning cost is low , and convenient and convenient. In addition, displaying query results through a relational graph structure allows users to intuitively analyze the relationship between behaviors, locate attack sources more quickly, evaluate the impact of attacks more quickly, and help users quickly understand the relationship behind the data.

Another embodiment of the present invention proposes a network attack analysis method, which is based on the previous embodiment, taking ElasticSearch as a data warehouse and Python programming to implement a data query interface as an example for detailed description, please refer to FIG. 2, this implementation The example method includes steps S201 to S207.

S201, when a network attack alarm occurs, read the alarm object entity. Among them, when an alarm occurs, we want to trace the process and scope of the entire event through the alarm. For example, if it is detected that "the host scans a specific port and then launches an attack on the port", it will read " After the host scans a specific port, it initiates an attack against the port" This alarm object entity.

S202: Obtain the source address of the alarm object entity through the source address and destination address query interfaces in the analysis query interface. Among them, by analyzing the source address and destination address query interface in the query interface, on the alarm object entity “host scans a specific port and then initiates an attack on the port”, select “search for source address based on alarm name” to obtain the source that triggers the alarm. Address "172.16.100.21".

S203: Select the source address as the object entity, and call the alarm name query interface in the analysis query interface to acquire other alarms related to the source address. Among them, select the source address "172.16.100.21" as the object entity, call the alarm name query interface in the analysis query interface "Search the alarm name according to the source address" to get other related four alarms of the source address "Intranet host initiates a specific port scan. ", "Vulnerability Attack - Wannacry Attack", "Vulnerability Attack", "Threat Intelligence Hit - Communication between Intranet Hosts and Malicious Domain Names".

S204: Select other alarms related to the source address as object entities, and call the source port and destination port query interfaces in the analysis query interface to obtain the destination port.

Among them, select the alarm object entity "Intranet host initiates a specific port scan", and call the source port and destination port query interface in the analysis query interface "Search destination port according to source address and alarm name" to obtain the source address "172.16.100.21". 445 port initiates scanning behavior.

Select the alarm object entity "vulnerability attack-Wannacry attack", and call the source address and destination address query interface in the analysis query interface "Search destination address according to source address and alarm name" to obtain the source address "172.16.100.21" has attacked the destination address" 172.16.100.134", "172.16.100.18".

Select the alarm object entity "vulnerability attack", and call the source address and destination address query interface in the analysis query interface "search the destination address according to the source address and alarm name" to obtain the source address "172.16.100.21" that has attacked the destination address "172.16.100.134". ", "172.16.100.18".

Select the alarm object entity "Threat Intelligence Hit - Communication between Intranet Hosts and Malicious Domain Names", and call the DNS domain name query interface in the analysis query interface "Search DNS domain name according to source address and alarm name" to obtain the source address "172.16.100.21" that has been accessed Malicious domain name "morning.circle.net".

S205: Select the destination port as the object entity, and call the source address and destination address query interfaces in the analysis query interface to obtain the destination address. Among them, select the destination port object entity "445", call the source address and destination address query interface in the analysis query interface "search for the destination address according to the source address and the destination port", and obtain the source address "172.16.100.21" and visit the destination address "172.16. 100.147", "172.16.100.157", "172.16.100.174", "172.16.100.217", "172.16.100.17", "172.16.100.18", "172.16.100.134" port "445".

S206: Select the destination address as the object entity, and call the alarm name query interface in the analysis query interface to acquire other alarms related to the destination address. Among them, select the destination address "172.16.100.134" as the object entity, call the alarm name query interface "Search alarm name according to source address" in the analysis query interface, and get the destination address. There is also an alarm "Threat Intelligence Hit - Intranet Host and Malicious Domain Name" Communication”, call the DNS domain name query interface “Search DNS domain name according to source address and alarm name” in the analysis query interface again, and get the destination address “172.16.100.134” that has visited the malicious domain name “morning.circle.net”.

In the same way, you can also select the destination address "172.16.100.18" as the object entity, and call the alarm name query interface "Search alarm name according to source address" in the analysis query interface to get the destination source address. There is also an alarm "Threat Intelligence Hit - Intranet Host". "Communicate with malicious domain name", call the DNS domain name query interface in the analysis query interface again "Search DNS domain name according to the source address and alarm name" to get the destination address "172.16.100.18" once visited the malicious domain name "morning.circle.net".

S207: Acquire the relationship between each query result data of the analysis query interface, connect each object entity through a relationship diagram, and display the relationship diagram.

Among them, as shown in Figure 3, the relationship network between each object entity is obtained, and the conclusion can be clearly drawn from the relationship network: the source address "172.16.100.21" is infected with the virus to the "445" of the intranet host. "After scanning the port, the vulnerability attack was launched on the hosts "172.16.100.134" and "172.16.100.18". The malicious domain name "morning.circle.net" is connected.

Referring to FIG. 4 , a network attack analysis device according to an embodiment of the present invention includes:

The first reading module 11 is configured to read the first object entity selected by the user when a network attack alarm occurs;

a first analysis module 12, configured to analyze the first object entity through a preset analysis and query interface to generate first query result data, and the analysis and query interface has query logic information;

Extraction and generation module 13, for extracting the query result data to generate the second object entity;

A second analysis module 14, configured to analyze the second object entity through the analysis query interface to generate second query result data;

The first display module 15 is configured to obtain the relationship between the first query result data and the second query result data, connect the first object entity and the second object entity through a relationship diagram, and The relationship diagram is displayed.

In this embodiment, the analysis query interface includes an alarm name query interface, a source address and destination address query interface, a source port and destination port query interface, and an HTTP query interface;

The alarm name query interface is used to search for the alarm name according to the source address, or search for the alarm name according to the destination address, or search for the alarm name according to the source host, or search for the alarm name according to the destination host, or search for the alarm name according to the domain name;

The source address and destination address query interface is used to search for the source address according to the alarm name, or search for the destination address according to the alarm name, or search for the destination address according to the source address and the alarm name, or search for the source address according to the destination address and the alarm name, or according to the alarm name. Source address and destination port search destination address;

The source port and destination port query interface is used to search for the destination port according to the source address, or search for the source port according to the destination address and the alarm name, or search for the destination port according to the source address and the alarm name;

The HTTP query interface is used to search the request URL according to the alarm name, or search the request URL according to the source address, or search for the HTTP return status code according to the alarm name, or search for the HTTP return status code according to the source address.

In this embodiment, the analysis query interface further includes a DNS domain name query interface, and the DNS domain name query interface is used to search the DNS domain name according to the source address and the alarm name.

In this embodiment, the first object entity includes source address, destination address, source port, destination port, transmission protocol, application protocol, alarm name, event name, file name, virus name, DNS domain name, request URL, HTTP return Any of status code, process name, user name, operation, and operation result.

According to the network attack analysis device provided in this embodiment, by encapsulating the query interface, the user can directly call the query interface through an interactive method to obtain the desired query result data, which reduces the threshold for network threat tracing and log analysis, and the learning cost is low , and convenient and convenient. In addition, displaying query results through a relational graph structure allows users to intuitively analyze the relationship between behaviors, locate attack sources more quickly, evaluate the impact of attacks more quickly, and help users quickly understand the relationship behind the data.

Referring to FIG. 5 , a network attack analysis apparatus proposed by another embodiment of the present invention includes:

The second reading module 21 is configured to read the alarm object entity when a network attack alarm occurs;

a first query module 22, configured to obtain the source address of the alarm object entity through the source address and destination address query interfaces in the analysis query interface;

The second query module 23 is configured to select the source address as the object entity, and call the alarm name query interface in the analysis query interface to obtain other alarms related to the source address;

The third query module 24 is configured to select other alarms related to the source address as object entities, and call the source port and destination port query interfaces in the analysis query interface to obtain the destination port;

The fourth query module 25 is configured to select the destination port as the object entity, and call the source address and destination address query interface in the analysis query interface to obtain the destination address;

a fifth query module 26, configured to select the destination address as an object entity, and call the alarm name query interface in the analysis query interface to acquire other alarms related to the destination address;

The second display module 27 is configured to acquire the relationship between each query result data of the analysis query interface, connect each object entity through a relationship diagram, and display the relationship diagram.

It should be pointed out that, for the specific limitation of the network attack analysis apparatus, please refer to the limitation of the network attack analysis method above, which will not be repeated here. All or part of the modules in the above network attack analysis device can be implemented by software, hardware and combinations thereof. The above modules can be embedded in or independent of the processor in the computer device in the form of hardware, or stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

In one embodiment, a computer device is provided, and the computer device may be a terminal, and its internal structure diagram may be as shown in FIG. 6 . The computer equipment includes a processor, memory, a communication interface, a display screen, and an input device connected by a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium, an internal memory. The nonvolatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the execution of the operating system and computer programs in the non-volatile storage medium. The communication interface of the computer device is used for wired or wireless communication with an external terminal, and the wireless communication can be realized by WIFI, operator network, NFC (Near Field Communication) or other technologies. The computer program, when executed by a processor, implements a video frame prediction method. The display screen of the computer equipment may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer equipment may be a touch layer covered on the display screen, or a button, a trackball or a touchpad set on the shell of the computer equipment , or an external keyboard, trackpad, or mouse.

Those skilled in the art can understand that the structure shown in FIG. 6 is only a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer equipment to which the solution of the present application is applied. Include more or fewer components than shown in the figures, or combine certain components, or have a different arrangement of components.

In one embodiment, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, the processor implementing the above-mentioned network attack analysis method when the program is executed. step.

The implementation principles and technical effects of the computer equipment provided by the above embodiments are similar to those of the above method embodiments, and details are not described herein again.

In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, implements the steps of the above-mentioned network attack analysis method.

The implementation principles and technical effects of the computer-readable storage medium provided by the foregoing embodiments are similar to those of the foregoing method embodiments, and details are not described herein again.

Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage In the medium, when the computer program is executed, it may include the processes of the above-mentioned method embodiments. Wherein, any reference to memory, storage, database or other media used in the various embodiments provided in this application may include at least one of non-volatile and volatile memory. The non-volatile memory may include Read-Only Memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, and the like. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, the RAM may be in various forms, such as static random access memory (Static Random Access Memory, SRAM) or dynamic random access memory (Dynamic Random Access Memory, DRAM).

The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, all It is considered to be the range described in this specification.

The above-mentioned embodiments only represent several embodiments of the present application, and the descriptions thereof are relatively specific and detailed, but should not be construed as a limitation on the scope of the invention patent. It should be noted that, for those skilled in the art, without departing from the concept of the present application, several modifications and improvements can be made, which all belong to the protection scope of the present application. Therefore, the scope of protection of the patent of the present application shall be subject to the appended claims.

Claims (10)

1. A network attack analysis method, comprising:

when a network attack alarm occurs, reading a first object entity selected by a user;

analyzing the first object entity through a preset analysis query interface to generate first query result data, wherein the analysis query interface has query logic information;

extracting the query result data to generate a second object entity;

analyzing the second object entity through the analysis query interface to generate second query result data;

and acquiring the relationship between the first query result data and the second query result data, connecting the first object entity and the second object entity through a relationship graph, and displaying the relationship graph.

2. The network attack analysis method according to claim 1, wherein the analysis query interface comprises an alarm name query interface, a source address and destination address query interface, a source port and destination port query interface, and an HTTP query interface;

the alarm name query interface is used for searching an alarm name according to a source address, or searching an alarm name according to a destination address, or searching an alarm name according to a source host, or searching an alarm name according to a destination host, or searching an alarm name according to a domain name;

the source address and destination address query interface is used for searching a source address according to an alarm name, or searching a destination address according to the source address and the alarm name, or searching a source address according to the destination address and the alarm name, or searching a destination address according to the source address and a destination port;

the source port and the destination port query interface are used for searching the destination port according to a source address, or searching the source port according to a destination address and an alarm name, or searching the destination port according to the source address and the alarm name;

the HTTP query interface is used for searching the request URL according to the alarm name, or searching the request URL according to the source address, or searching the HTTP return status code according to the alarm name, or searching the HTTP return status code according to the source address.

3. The network attack analysis method according to claim 2, wherein the analysis query interface further comprises a DNS domain name query interface for searching for a DNS domain name according to the source address and the alarm name.

4. The network attack analysis method according to claim 1, wherein the method specifically comprises:

when a network attack alarm occurs, reading an alarm object entity;

obtaining the source address of the alarm object entity through the source address and the destination address query interface in the analysis query interface;

selecting the source address as an object entity, and calling an alarm name query interface in the analysis query interface to acquire other alarms related to the source address;

selecting other alarms related to the source address as object entities, and calling a source port and a destination port query interface in the analysis query interface to acquire a destination port;

selecting the destination port as an object entity, and calling a source address in the analysis query interface and a destination address query interface to acquire a destination address;

selecting the destination address as an object entity, and calling an alarm name query interface in the analysis query interface to acquire other alarms related to the destination address;

and obtaining the relationship among the query result data of the analysis query interface, connecting the object entities through a relationship graph, and displaying the relationship graph.

5. The network attack analysis method according to claim 1, wherein the first object entity comprises any one of a source address, a destination address, a source port, a destination port, a transport protocol, an application protocol, an alarm name, an event name, a file name, a virus name, a DNS domain name, a request URL, an HTTP return status code, a process name, a user name, an operation, and an operation result.

6. A cyber attack analysis apparatus, comprising:

the first reading module is used for reading a first object entity selected by a user when a network attack alarm occurs;

the first analysis module is used for analyzing the first object entity through a preset analysis query interface to generate first query result data, and the analysis query interface has query logic information;

the extraction generation module is used for extracting the query result data to generate a second object entity;

the second analysis module is used for analyzing the second object entity through the analysis query interface to generate second query result data;

and the first display module is used for acquiring the relationship between the first query result data and the second query result data, connecting the first object entity and the second object entity through a relationship graph, and displaying the relationship graph.

7. The apparatus according to claim 6, wherein the analysis query interface comprises an alarm name query interface, a source address and destination address query interface, a source port and destination port query interface, and an HTTP query interface;

the alarm name query interface is used for searching an alarm name according to a source address, or searching an alarm name according to a destination address, or searching an alarm name according to a source host, or searching an alarm name according to a destination host, or searching an alarm name according to a domain name;

the source address and destination address query interface is used for searching a source address according to an alarm name, or searching a destination address according to the source address and the alarm name, or searching a source address according to the destination address and the alarm name, or searching a destination address according to the source address and a destination port;

the source port and the destination port query interface are used for searching the destination port according to a source address, or searching the source port according to a destination address and an alarm name, or searching the destination port according to the source address and the alarm name;

the HTTP query interface is used for searching the request URL according to the alarm name, or searching the request URL according to the source address, or searching the HTTP return status code according to the alarm name, or searching the HTTP return status code according to the source address.

8. The cyber attack analysis device according to claim 7, wherein the analysis query interface further comprises a DNS domain name query interface for searching a DNS domain name according to a source address and an alarm name.

9. A readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out the method according to any one of claims 1-5.

10. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the processor implements the method according to any of claims 1 to 5 when executing the program.

Images