CN115766175A - Network intrusion detection method and electronic device - Google Patents

Abstract

The application provides a network intrusion detection method and electronic equipment, and relates to the technical field of network security. The network intrusion detection method comprises the following steps: and responding to the received data packet to be detected, and determining a target detection chain, wherein the target detection chain comprises a plurality of detection nodes, and each detection node is respectively used for identifying different network intrusion types. And determining the detection sequence of each detection node to the data packet to be detected according to the detection priority of each detection node. And determining a target detection node required by detecting the data packet to be detected according to the detection sequence, and detecting the data packet to be detected by using the target detection node. And after detecting that the data packet to be detected is abnormal, marking the data packet to be detected according to the network intrusion type corresponding to the target detection node, and stopping detection. Therefore, the network intrusion behavior can be detected through limited computing resources.

Description

Network intrusion detection method and electronic device

【Technical field】

The present application relates to the technical field of network security, in particular to a network intrusion detection method and electronic equipment.

【Background technique】

With the wide application of Internet of Things technology, various Internet of Things devices are more and more closely related to people's daily production and life. For purposes such as maintaining user data security, IoT devices should have the ability to detect network intrusions.

However, IoT devices often have small storage space, low operating memory, and low CPU frequency, and detecting network intrusion requires strong data processing capabilities. Therefore, how to realize the detection of network intrusion on resource-constrained IoT devices is a problem to be solved.

【Content of invention】

Embodiments of the present application provide a network intrusion detection method and an electronic device, which can be used to detect network intrusion behaviors on Internet of Things devices with limited resources.

In the first aspect, the embodiment of the present application provides a network intrusion detection method, including: in response to the received data packet to be tested, determine the target detection chain required to detect the data packet to be tested, the target detection chain includes a plurality of detection nodes, Each detection node is used to identify different types of network intrusions; according to the detection priority of each detection node, determine the detection order of each detection node for the data packet to be tested; according to the detection order, determine the target detection node required to detect the data packet to be tested ;Use the target detection node to detect the data packet to be tested; in the case of detecting the abnormality of the data packet to be tested, mark the data packet to be tested according to the network intrusion type corresponding to the target detection node, and stop the detection.

Through the above technical solution, based on limited computing resources, the type of network intrusion that users are more concerned about can be preferentially detected, and only the network intrusion type with the highest priority is output, so that the detection of network intrusion behavior can be realized through limited computing resources.

In one of the possible implementations, in response to the received data packet to be tested, determining the target detection chain required to detect the data packet to be tested includes: in response to the received data packet to be tested, determining the corresponding the protocol type; determine the target detection chain required to detect the data packet to be tested according to the protocol type corresponding to the data packet to be tested.

In this implementation, different detection chains are used to detect the data packets to be tested of different protocol types, so that the subsequent detection results of the data packets to be tested of different protocol types can be easily output to the user.

In one of the possible implementations, each detection node is configured with an enable control bit; before using the target detection node to detect the data packet to be tested, the above method also includes: according to the enable control bit of the target detection node, determine the target detection Node is enabled.

In this implementation, limited computing resources can be used to detect the types of network intrusions that users are concerned about, reducing unnecessary detection processes, and the types of network intrusions to be detected can change dynamically based on user needs and changes in the network environment, so that It meets users' needs for network intrusion detection while saving computing resources.

In one possible implementation manner, using the target detection node to detect the data packet to be tested includes: using pre-configured intrusion behavior parameters in the target detection node to perform parameter matching on the data packet to be tested.

In one possible implementation manner, detecting an abnormality of the data packet to be tested includes: detecting that a behavior parameter of the data packet to be tested is consistent with a pre-configured intrusion behavior parameter in the target detection node.

In this implementation manner, only network intrusion behaviors with characteristic behavior characteristics can be detected through preset intrusion behavior parameters, thereby further reducing the consumption of computing resources.

In one possible implementation, in response to the received data packet to be tested, before determining the target detection chain required to detect the data packet to be tested, the above method further includes: according to the detection switch identification of the network intrusion detection, determine the network The intrusion detection is in the activated state; wherein, the value of the detection switch identifier is set according to the pre-received detection instruction.

In this implementation manner, the received data packets can be detected only when the user starts the network intrusion detection, so that the purpose of defending against network attacks can be realized with less computing resources.

In one possible implementation, after determining that the network intrusion detection is in the activated state according to the detection switch identification of the network intrusion detection, the above method further includes: comparing the device information carried by the data packet to be tested with the device information contained in the detection white list Perform a comparison; according to the comparison result, it is determined that the sending and receiving devices of the data packets to be tested are all untrusted devices.

In this implementation manner, network intrusion detection can be performed only on the data packets of the device to be detected, so that the purpose of defending against network attacks can be achieved with less computing resources.

In one possible implementation manner, when it is detected that the data packet to be tested is normal, the above method further includes: determining a new target detection node according to the detection order, and using the new target detection node to detect the data packet to be tested.

In a second aspect, the embodiment of the present application provides an electronic device, including: at least one processor; and at least one memory connected in communication with the processor, wherein: the memory stores a program executable by the processor Instructions, the processor invokes the program instructions to execute the method as described in the first aspect.

In the third aspect, the embodiment of the present application provides a chip, the chip includes a processor and a data interface, the processor reads the instructions stored in the memory through the data interface, and can execute the method as described in the first aspect .

In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, where the computer-readable storage medium stores computer instructions, and the computer instructions cause the computer to execute the method as described in the first aspect.

【Description of drawings】

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the accompanying drawings that need to be used in the embodiments. Obviously, the accompanying drawings in the following description are only some embodiments of the present application. Those of ordinary skill in the art can also obtain other drawings based on these drawings without any creative effort.

FIG. 1 is a schematic structural diagram of an Internet of Things device provided by an embodiment of the present application;

FIG. 2 is a flowchart of a network intrusion detection method provided in an embodiment of the present application;

FIG. 3 is a schematic structural diagram of a detection chain provided in an embodiment of the present application;

FIG. 4 is a flowchart of another network intrusion detection method provided by the embodiment of the present application;

FIG. 5 is a schematic structural diagram of a network intrusion detection device provided in an embodiment of the present application;

FIG. 6 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.

【Detailed ways】

In order to better understand the technical solutions of the present application, the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings.

It should be clear that the described embodiments are only some of the embodiments of the present application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of this application.

Terms used in the embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to limit the present application. The singular forms "a", "said" and "the" used in the embodiments of this application and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise.

The present application may provide an Internet of Things device. The Internet of Things device may be any type of Internet of Things device. The Internet of Things device may also have the characteristics of small storage space, low operating memory, and low CPU main frequency. The IoT device provided in this application can be used to implement the network intrusion detection method provided in this application, so as to realize effective detection of network intrusion based on limited computing resources.

FIG. 1 is a schematic structural diagram of an Internet of Things device provided by an embodiment of the present application. As shown in FIG. 1 , the IoT device 100 provided by the embodiment of the present application may include three functional units, namely an interface unit 11 , a data receiving unit 12 and a network intrusion detection unit 13 .

Wherein, the interface unit 11 can be used to receive instruction information, and the instruction information can be an AT (Attention) command triggered by the user on the Internet of Things device 100, or can be an AT command triggered by the user on other Internet of Things devices, and is triggered by other things. The networked device sends to the IoT device 100. In this application, the specific content of each command information received by the interface unit 11 will be described later.

The data receiving unit 12 can be adapted to an interface of a Transmission Control Protocol/Internet Protocol (TCP/IP) protocol stack, and receive network data packets sent by other IoT devices 200 .

The network intrusion detection unit 13 may be used to implement the network intrusion detection method provided in this application.

The specific implementation of the network intrusion detection method provided by this application will be described below.

Fig. 2 is a flow chart of a network intrusion detection method provided in the embodiment of the present application. As shown in Fig. 2, the above-mentioned network intrusion detection method may include:

Step 101, in response to the received data packet to be tested, determine a target detection chain required to detect the data packet to be tested, the target detection chain includes a plurality of detection nodes, and each detection node is used to identify different types of network intrusions.

In the embodiment of the present application, multiple detection chains may be pre-configured in the IoT device. Each detection chain can be used to detect data packets of different protocol types to be tested, and each detection chain can include multiple detection nodes, and each detection node can be used to identify different network intrusion types. Exemplarily, different protocol types may include but not limited to TCP, User Datagram Protocol (User Datagram Protocol, UDP), Internet Control Message Protocol (Internet ControlMessage Protocol, ICMP) and so on. Network intrusion types under each protocol type may include, but are not limited to, flood attacks, host service detection attacks (scans initiated on specific ports), port scan attacks (continuous scans that do not distinguish specific ports), protocol abnormal packet attacks, and the like.

Based on the above description, after receiving the data packets to be tested sent by other IoT devices, the protocol type of the data packets to be tested can be identified first. Specifically, the protocol type of the data packet to be tested can be determined according to the protocol number carried by the data packet to be tested. Then, according to the recognized protocol type, the target detection chain required to detect the data packet to be tested can be determined from each detection chain.

Through the above implementation, different detection chains can be used to detect data packets of different protocol types to be tested, so that the subsequent detection results of data packets to be tested of different protocol types can be easily output to the user.

Step 102, according to the detection priority of each detection node, determine the detection sequence of the data packets to be tested by each detection node.

In the embodiment of the present application, the user can dynamically configure the detection priority of each detection node in each detection chain according to the detection requirements in the current network environment.

Specifically, the Internet of Things device may receive a detection priority setting instruction from a user based on the interface unit 11 . The detection priority setting instruction can be sent to the IoT device in the form of an AT command, for example. Furthermore, the network intrusion detection unit 13 may configure the detection priority of each detection node in each detection chain according to the detection priority setting instruction.

Figure 3 shows a schematic diagram of the structure of the detection chain. As shown in FIG. 3 , the detection chain may include multiple detection nodes, and the detection nodes are configured with detection priorities, and the number of detection nodes corresponding to each detection priority may be one or more. Taking FIG. 3 as an example, 0 may represent the highest detection priority, and there may be, for example, two detection nodes with a detection priority of 1.

After receiving the data packets to be tested, the detection order of the data packets to be tested by each detection node can be respectively determined according to the pre-configured detection priority. In the embodiment of the present application, the higher the detection priority, the higher the detection order of the data packets to be tested. The detection order of each detection node with the same detection priority can be set arbitrarily.

Through this implementation method, based on limited computing resources, the type of network intrusion that users are more concerned about can be preferentially detected.

Step 103, according to the detection order, determine the target detection node required to detect the data packet to be tested.

In a possible implementation manner, the number of detection nodes corresponding to the same detection priority is one. At this time, the number of object detection nodes is one. Then, in the following step 104, using the target detection node to detect the data packet to be tested may be to use the one target detection node to detect the data packet to be tested.

In another possible implementation manner, there are multiple detection nodes corresponding to the same detection priority. At this time, the number of target detection nodes is multiple. Then, in the following step 104, using the target detection nodes to detect the data packets to be tested may be to sequentially use the multiple target detection nodes to detect the data packets to be tested, and the detection order of the multiple target detection nodes is not limited, Detection can be performed in any order.

Step 104, using the target detection node to detect the data packet to be tested.

In the embodiment of the present application, as shown in FIG. 3 , each detection node may also be configured with an enable control bit, and the enable control bit may be used to indicate the enable state of the detection node. Users can dynamically configure the enabling status of each detection node in each detection chain according to the type of network intrusion that needs to be detected in the current network environment. For the type of network intrusion that needs to be detected, the enable control bit of the corresponding detection node can be set to the enabled state; on the contrary, for the type of network intrusion that does not need to be detected, the enable control bit of the corresponding detection node can be set to is not enabled.

The configuration of the enabled state can also be realized based on the interface unit 11 receiving an AT command. For details, refer to the aforementioned configuration process of the detection priority, which will not be repeated here.

Through the above implementation, limited computing resources can be used to detect the type of network intrusion that users are concerned about, reducing unnecessary detection processes, and the type of network intrusion to be detected can be dynamically changed based on user needs and changes in the network environment, so that It meets users' needs for network intrusion detection while saving computing resources.

Based on the above description, when any target detection node is used to detect the data packet to be tested, first, the enable state of the enable control bit of the target detection node can be determined. Then, when it is determined that the target detection node is in an enabled state, the target detection node may be used to detect the data packet to be tested. On the contrary, when it is determined that the target detection node is in the disabled state, the target detection node may be skipped, return to step 103, and determine the next target detection node to detect the data packet to be tested according to the detection order.

The specific manner of using any detection node to detect the data packet to be tested will be described below.

In the embodiment of the present application, according to the different network intrusion types identified by each detection node, intrusion behavior parameters can be configured in each detection node in advance, and the intrusion behavior parameters match the network intrusion types identified by the detection nodes.

For example, when the type of network intrusion identified by the detection node is a protocol abnormal data packet attack, the intrusion behavior parameter configured in the detection node may be a combination of abnormal protocol packets. Due to the various combinations of fields in the abnormal protocol message, if all of them are detected, it will take up a lot of computing resources. Therefore, in the embodiment of this application, the abnormal protocol message combination configured in the detection node can only include the most concerned by the user. The combination of abnormal protocol packets can be configured by the user according to the needs of the current network environment, thus saving computing resources.

For the convenience of understanding, the above abnormal protocol packet combination is described. It can be understood that a data packet usually includes multiple fields, and different assignments of each field have different specific meanings. When a protocol abnormal data packet attack occurs, there is an abnormality in each field of the data packet message. This abnormality may include an abnormal value of a certain field, and each field is normal but the combination of several fields is abnormal (for example, the value meaning of each field contrary, etc.).

In another example, when the type of network intrusion identified by the detection node is a flood attack, the intrusion behavior parameter configured in the detection node may be a data packet sending frequency threshold. When the sending frequency of the data packets to be tested reaches the threshold set in the detection node, the detection node can determine that the data packets to be tested are abnormal and there is a flood attack.

The configuration methods of intrusion behavior parameters corresponding to other network intrusion types are similar to the above, and will not be repeated here.

Based on the above description, for any detection node, the parameters of the data packets to be tested can be matched by using the pre-configured intrusion behavior parameters in the detection node. When it is determined that the behavior parameter of the data packet to be tested is consistent with the intrusion behavior parameter configured in the detection node, it can be determined that the data packet to be tested is an abnormal data packet. At this time, the following step 106 may be performed. On the contrary, when it is determined that the behavior parameter of the data packet to be tested is inconsistent with the intrusion behavior parameter configured in the detection node, it can be determined that the data packet to be tested is a normal data packet. At this point, the above step 103 can be returned to determine a new target detection node, and use the new target detection node to continue detecting the data packet to be tested to determine whether the data packet to be tested belongs to other types of network intrusion.

Step 105, determine whether an abnormality is detected in the data packet to be tested. If yes, execute step 106; otherwise, return to step 103.

Step 106: Mark the data packet to be tested according to the network intrusion type corresponding to the target detection node, and stop the detection.

In a possible implementation manner, the number of detection nodes with the same detection priority is one. At this point, the data packet to be tested can be marked according to the network intrusion type corresponding to the single detection node, and detection by subsequent detection nodes with low detection priority is stopped. Therefore, only the network intrusion type with the highest priority can be output, saving computing resources.

In a possible implementation manner, there are multiple detection nodes with the same detection priority. At this time, after the multiple detection nodes are all detected, the data packets to be tested can be marked according to the network intrusion types corresponding to the multiple detection nodes, and the detection by subsequent detection nodes with low detection priority is stopped. Therefore, multiple network intrusion types may be output on the basis of outputting the network intrusion type with the highest priority. The relationship between the multiple network intrusion types may be, for example, mutually contained or mutually independent.

Through the above technical solution, the detection of various network intrusion behaviors can be realized through limited computing resources, which is beneficial to the detection of network intrusion behaviors on Internet of Things devices with limited resources.

Fig. 4 is a flowchart of another network intrusion detection method provided by the embodiment of the present application. As shown in Fig. 4, in response to the received data packet to be tested, the target required for detecting the data packet to be tested is determined in the foregoing embodiment Before detecting the chain, the network intrusion detection method provided in the embodiment of the present application may also include:

Step 201, in response to the received data packet to be tested, determine that the network intrusion detection is in the activated state according to the detection switch identification.

In the embodiment of the present application, the user can also dynamically activate the network intrusion detection function according to his own needs or changes in the network environment.

Specifically, the Internet of Things device may receive a detection instruction from a user based on the interface unit 11, and the detection instruction may include a detection startup instruction or a detection shutdown instruction. The detection startup instruction and detection shutdown instruction may be sent in the form of AT commands, for example. In response to the received detection start instruction, the Internet of Things device may set the detection switch identifier to a first value, and the first value may be used to represent that the network intrusion detection is in a start state. In response to the received detection disabling instruction, the Internet of Things device may set the detection switch identifier to a second value, and the second value may be used to indicate that the network intrusion detection is in a disabling state.

Based on the above description, after receiving the data packet to be tested, the value of the detection switch identification can be read first, and according to the value of the detection switch identification, it can be determined whether the network intrusion detection is in the activated state. When it is determined that the network intrusion detection is in the activated state, the following step 202 can be normally performed; otherwise, the current process can be stopped until it is detected that the network intrusion detection is in the activated state.

Through the above implementation, the received data packets can be detected only when the user starts the network intrusion detection, thereby reducing unnecessary detection consumption and realizing the purpose of defending against network attacks with less computing resources.

Step 202, according to the pre-configured detection white list, it is determined that the sending and receiving devices of the data packets to be tested are all untrusted devices.

In the embodiment of the present application, further, the IoT device may also be configured with a detection whitelist. The detection whitelist may include device information of trusted devices, such as quintuple information of trusted devices. Moreover, the information for detecting trusted devices in the whitelist can be dynamically configured by the user, such as adding trusted devices, deleting some trusted devices, and so on.

Based on the configured detection white list, if it is determined that the user has activated the network intrusion detection function, it can further detect whether the sending and receiving device of the data packet to be tested is a trusted device in the detection white list. Specifically, the device information carried in the data packet to be tested may be compared with the device information of trusted devices included in the detection white list. Wherein, the device information carried in the data packet to be tested may be, for example, 5-tuple information of the sending and receiving device. If the device information carried by the data packet to be tested is consistent with the device information of any trusted device in the detection whitelist, it means that the sending and receiving device of the data packet to be tested is a trusted device. At this time, the detection of the data packet to be tested can be terminated process. On the contrary, if the device information carried by the data packet to be tested is inconsistent with the device information of all trusted devices in the detection whitelist, it means that the sending and receiving devices of the data packet to be tested are all untrusted devices. At this time, further execution In step 101 of the foregoing embodiment, the target detection chain required for detecting the data packet to be tested is determined, and the detection process of the data packet to be tested is started.

In another implementation manner, alternatively, the foregoing detection whitelist may also be, for example, a detection blacklist, and the detection blacklist may include device information of untrustworthy devices. Therefore, only the data packets of the untrusted devices recorded in the blacklist can be detected, which is not limited in the present application.

Through this implementation, network intrusion detection can be performed only on the data packets of the device to be detected, thereby reducing unnecessary detection consumption, saving computing resources, and achieving the purpose of defending against network attacks with less computing resources.

FIG. 5 is a schematic structural diagram of a network intrusion detection device provided by an embodiment of the present application. As shown in FIG. 5 , the above apparatus may include: a response module 51 , a first determination module 52 , a second determination module 53 , an execution module 54 and a marking module 55 .

The response module 51 is configured to determine the target detection chain required to detect the data packet to be tested in response to the received data packet to be tested. The target detection chain includes a plurality of detection nodes, and each detection node is used to identify different types of network intrusions .

The first determination module 52 is configured to determine the detection order of the data packets to be tested by each detection node according to the detection priority of each detection node.

The second determination module 53 is configured to determine the target detection nodes required to detect the data packets to be detected according to the detection order.

The execution module 54 is configured to use the target detection node to detect the data packet to be tested.

The marking module 55 is configured to mark the data packet to be tested according to the network intrusion type corresponding to the target detection node and stop the detection after detecting the abnormality of the data packet to be tested.

In a specific implementation manner, the response module 51 is specifically used to, in response to the received data packet to be tested, determine the protocol type corresponding to the data packet to be tested; Package required object detection chain.

In a specific implementation manner, each detection node is configured with an enable control bit; the execution module 54 is also configured to determine that the target detection node is in an enabled state according to the enable control bit of the target detection node.

In a specific implementation manner, the execution module 54 is specifically configured to perform parameter matching on the data packets to be tested by using the intrusion behavior parameters pre-configured in the target detection node.

In a specific implementation manner, the execution module 54 is specifically configured to detect that the behavior parameter of the data packet to be tested is consistent with the pre-configured intrusion behavior parameter in the target detection node.

In a specific implementation manner, the response module 51 is further configured to determine that the network intrusion detection is in the activated state according to the detection switch identification of the network intrusion detection; wherein, the value of the detection switch identification is set according to the detection instruction received in advance.

In a specific implementation, the response module 51 is also used to compare the device information carried by the data packet to be tested with the device information contained in the detection white list; determine the sending and receiving device of the data packet to be tested according to the comparison result Both are untrusted devices.

In a specific implementation manner, when it is detected that the data packet to be tested is normal, the second determination module 53 is also used to determine a new target detection node according to the detection sequence, and the execution module 54 is also used to use the new target detection node The target detection node detects the data packet to be tested.

Through the above technical solution, the detection of network intrusion behavior can be realized on the Internet of Things device with limited resources.

FIG. 6 is a schematic structural diagram of another electronic device provided by an embodiment of the present application. As shown in Figure 6, the above-mentioned electronic device may include at least one processor; and at least one memory connected in communication with the above-mentioned processor, wherein: the memory stores program instructions executable by the processor, and the above-mentioned processor calls the above-mentioned program instructions to be able to Execute the network intrusion detection method provided in the embodiment of the present application.

This embodiment does not limit the specific form of the above-mentioned electronic equipment.

FIG. 6 shows a block diagram of an exemplary electronic device suitable for implementing embodiments of the present application. The electronic device shown in FIG. 6 is only an example, and should not limit the functions and scope of use of the embodiment of the present application.

As shown in Figure 6, the electronic device takes the form of a general-purpose computing device. The components of the electronic device may include, but are not limited to: one or more processors 410, a memory 430, and a communication bus 440 connecting different system components (including the memory 430 and the processor 410).

Communication bus 440 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus structures. For example, these architectures include but are not limited to Industry Standard Architecture (Industry Standard Architecture; hereinafter referred to as: ISA) bus, Micro Channel Architecture (Micro Channel Architecture; hereinafter referred to as: MAC) bus, enhanced ISA bus, video electronics standard Association (Video Electronics Standards Association; hereinafter referred to as: VESA) local bus and peripheral component interconnection (Peripheral Component Interconnection; hereinafter referred to as: PCI) bus.

Electronic devices typically include a variety of computer system readable media. These media can be any available media that can be accessed by the electronic device and include both volatile and nonvolatile media, removable and non-removable media.

The memory 430 may include a computer system-readable medium in the form of a volatile memory, such as a random access memory (Random Access Memory; RAM for short) and/or a cache memory. The electronic device may further include other removable/non-removable, volatile/nonvolatile computer system storage media. Although not shown in FIG. 6, a disk drive for reading and writing to a removable nonvolatile disk (such as a "floppy disk") may be provided, as well as a disk drive for a removable nonvolatile disk (such as a CD-ROM (Compact Disc Read Only Memory (hereinafter referred to as: CD-ROM), Digital Video Disc Read Only Memory (hereinafter referred to as: DVD-ROM) or other optical media) read and write optical disc drives. In these cases, each drive may be connected to communication bus 440 through one or more data media interfaces. The memory 430 may include at least one program product having a set (for example, at least one) of program modules configured to perform the functions of the various embodiments of the present application.

A program/utility having a set (at least one) of program modules may be stored in memory 430, such program modules including - but not limited to - an operating system, one or more application programs, other program modules, and program data , each or some combination of these examples may include implementations of network environments. The program modules generally perform the functions and/or methods in the embodiments described herein.

The electronic device can also communicate with one or more external devices (e.g., keyboards, pointing devices, displays, etc.), and with one or more devices that enable a user to interact with the electronic device, and/or communicate with one or more Any device (eg, network card, modem, etc.) capable of communicating with one or more other computing devices communicates. Such communication may occur through communication interface 420 . Moreover, the electronic device can also communicate with one or more networks (such as a local area network (Local Area Network; hereinafter referred to as: LAN), a wide area network (Wide Area Network; hereinafter referred to as: WAN) and/or public network, such as the Internet), the above-mentioned network adapter can communicate with other modules of the electronic device through the communication bus 440 . It should be appreciated that although not shown in FIG. 6 , other hardware and/or software modules may be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, disk arrays (Redundant Arrays of Independent Drives; hereinafter referred to as: RAID) system, tape drive and data backup storage system, etc.

The processor 410 executes various functional applications and network intrusion detection by running the program stored in the memory 430, for example, implements the network intrusion detection method provided in the embodiment of the present application.

The embodiment of the present application further provides a computer-readable storage medium, where the computer-readable storage medium stores computer instructions, and the computer instructions cause the computer to execute the network intrusion detection method provided in the embodiment of the present application.

Any combination of one or more computer-readable storage media may be used for the above-mentioned computer-readable storage medium. The computer readable medium may be a computer readable signal medium or a computer readable storage medium. A computer readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (non-exhaustive list) of computer-readable storage media include: electrical connections with one or more conductors, portable computer disks, hard disks, random access memory (RAM), read-only memory (ReadOnly Memory; hereinafter referred to as: ROM), erasable programmable read-only memory (Erasable Programmable ReadOnly Memory; hereinafter referred to as: EPROM) or flash memory, optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, Or any suitable combination of the above. In this document, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

A computer readable signal medium may include a data signal carrying computer readable program code in baseband or as part of a carrier wave. Such propagated data signals may take many forms, including - but not limited to - electromagnetic signals, optical signals, or any suitable combination of the foregoing. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device. .

Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including - but not limited to - wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

In the description of this specification, descriptions referring to the terms "one embodiment", "some embodiments", "example", "specific examples", or "some examples" mean that specific features described in connection with the embodiment or example , structure, material or characteristic is included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms are not necessarily directed to the same embodiment or example. Furthermore, the described specific features, structures, materials or characteristics may be combined in any suitable manner in any one or more embodiments or examples. In addition, those skilled in the art can combine and combine different embodiments or examples and features of different embodiments or examples described in this specification without conflicting with each other.

In addition, the terms "first" and "second" are used for descriptive purposes only, and cannot be interpreted as indicating or implying relative importance or implicitly specifying the quantity of indicated technical features. Thus, the features defined as "first" and "second" may explicitly or implicitly include at least one of these features. In the description of the present application, "plurality" means at least two, such as two, three, etc., unless otherwise specifically defined.

Any process or method descriptions in flowcharts or otherwise described herein may be understood to represent a module, segment or portion of code comprising one or more executable instructions for implementing custom logical functions or steps of a process , and the scope of preferred embodiments of the present application includes additional implementations in which functions may be performed out of the order shown or discussed, including in substantially simultaneous fashion or in reverse order depending on the functions involved, which shall It should be understood by those skilled in the art to which the embodiments of the present application belong.

In the several embodiments provided in this application, it should be understood that the disclosed devices and methods may be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined Or it can be integrated into another system, or some features can be ignored, or not implemented. In another point, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit. The above-mentioned integrated units can be implemented in the form of hardware, or in the form of hardware plus software functional units.

The above is only a preferred embodiment of the application, and is not intended to limit the application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the application should be included in the application. within the scope of protection.

Claims (12)

1. A method for network intrusion detection, comprising:

determining a target detection chain required for detecting the data packet to be detected in response to the received data packet to be detected, wherein the target detection chain comprises a plurality of detection nodes, and each detection node is respectively used for identifying different network intrusion types;

determining the detection sequence of each detection node to the data packet to be detected according to the detection priority of each detection node;

determining a target detection node required for detecting the data packet to be detected according to the detection sequence;

detecting the data packet to be detected by using the target detection node;

and under the condition that the data packet to be detected is detected to be abnormal, marking the data packet to be detected according to the network intrusion type corresponding to the target detection node, and stopping detection.

2. The method of claim 1, wherein determining a target detection chain required for detecting the data packet to be detected in response to the received data packet to be detected comprises:

responding to a received data packet to be detected, and determining a protocol type corresponding to the data packet to be detected;

and determining a target detection chain required for detecting the data packet to be detected according to the protocol type corresponding to the data packet to be detected.

3. The method of claim 1, wherein each of the detection nodes is configured with an enable control bit; before the target detection node is used to detect the data packet to be detected, the method further includes:

and determining that the target detection node is in an enabled state according to the enable control bit of the target detection node.

4. The method as claimed in claim 1 or 3, wherein detecting the data packet to be detected by the target detection node comprises:

and carrying out parameter matching on the data packet to be detected by utilizing the intrusion behavior parameters pre-configured in the target detection node.

5. The method of claim 4, wherein detecting the anomaly in the data packet to be tested comprises:

and detecting that the behavior parameters of the data packet to be detected are consistent with the intrusion behavior parameters pre-configured in the target detection node.

6. The method of claim 1, wherein in response to a received data packet under test, prior to determining a target detection chain required to detect the data packet under test, the method further comprises:

determining that the network intrusion detection is in a starting state according to a detection switch identifier of the network intrusion detection;

and the value of the detection switch identification is set according to a detection instruction received in advance.

7. The method of claim 6, wherein after determining that the network intrusion detection is in the enabled state according to the detection switch identifier of the network intrusion detection, the method further comprises:

comparing the equipment information carried by the data packet to be detected with the equipment information contained in the detection white list;

and according to the comparison result, determining that the receiving and sending equipment of the data packet to be tested is all untrustworthy equipment.

8. The method according to claim 1, wherein in case that it is detected that the data packet to be tested is normal, the method further comprises:

and determining a new target detection node according to the detection sequence, and detecting the data packet to be detected by using the new target detection node.

9. A network intrusion detection device, comprising:

the system comprises a response module, a detection module and a processing module, wherein the response module is used for responding to a received data packet to be detected and determining a target detection chain required for detecting the data packet to be detected, the target detection chain comprises a plurality of detection nodes, and each detection node is respectively used for identifying different network intrusion types;

a first determining module, configured to determine, according to the detection priority of each detection node, a detection order of each detection node for the data packet to be detected;

a second determining module, configured to determine, according to the detection order, a target detection node required for detecting the data packet to be detected;

the execution module is used for detecting the data packet to be detected by using the target detection node;

and the marking module is used for marking the data packet to be detected according to the network intrusion type corresponding to the target detection node and stopping detection under the condition of detecting the abnormality of the data packet to be detected.

10. An electronic device, comprising:

at least one processor; and

at least one memory communicatively coupled to the processor, wherein:

the memory stores program instructions executable by the processor, the processor invoking the program instructions to perform the method of any of claims 1 to 8.

11. A computer-readable storage medium, storing computer instructions, the computer instructions causing the computer to perform the method of any of claims 1 to 8.

12. A chip, characterized in that it comprises a processor and a data interface, the processor being able to execute the method according to any one of claims 1 to 8 by reading instructions stored on a memory via the data interface.

Images