METHOD AND APPARATUS FOR PROCESSING NETWORK ATTACK

• US 20090282478A1
• Filed: 05/04/2009
• Published: 11/12/2009
• Est. Priority Date: 05/09/2008
• Status: Abandoned Application

• Current Assignee: Chengdu Huawei Symantec Technologies Company Limited (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Chengdu Huawei Symantec Technologies Company Limited (Huawei Investment & Holding Co., Ltd.)
• Inventors: Jiang, Wu
• Application Number:
  US12/435,001
• Publication Number:
  US 20090282478A1
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

A network attack processing method and a processing apparatus are disclosed herein. The method may include; after determining an attacked object, searching for a recorded attack event related to the attacked object to determine a controlled host in an attack network; searching for a recorded control event related to the controlled host to determine a controlling host in the attack network; and determining a detected host which performs similar communication with the multiple controlling hosts as an attack manipulator. Accordingly, embodiments for a processing apparatus adapted to perform the methods are disclosed herein.

Claims

1. A method for processing network attack, comprising:

after determining an attacked object, searching for a recorded attack event related to the attacked object to determine a controlled host in an attack network;

searching for a recorded control event related to the controlled host to determine a controlling host in the attack network; and

determining a detected host which performs the same communication with multiple controlling hosts as an attack manipulator.

2. The method for processing network attack of claim 1, wherein determining an attacked object comprises:

determining the attached object according to priority information of traffic exception events.

3. The method for processing network attack of claim 1, wherein searching for a recorded attack event related to the attacked object comprises:

searching a created attack real-time list for the attack event targeted at the attacked object by using an IP address of the determined attacked object as a matching condition.

4. The method for processing network attack of claim 3, wherein the attack real-time list is obtained after sorting information of multiple events by destination IP addresses, wherein the multiple events include one or more following events:

frequency over-threshold event, DDOS attack event, connection exhaustion event, and mass spam send event.

5. The method for processing network attack of claim 1, wherein the searching for a recorded control event related to the controlled host comprises:

searching a created control real-time list for the control event targeted at the controlled host by using an IP address of the controlled object as a match condition.

6. The method for processing network attack of claim 5, wherein the control real-time list is obtained after sorting collected information of various control events by source IP addresses.

7. An apparatus for processing network attack, comprising:

an attacked object modeling module, adapted to determine an attacked object;

a topology module, adapted to, after the attacked object modeling module determines the attacked object, search for a recorded attack event related to the attacked object to determine a controlled host in an attack network, and search for a recorded control event related to the controlled host to determine a controlling host in the attack network; and

a communication analysis module, adapted to determine a detected host which performs the same communication with multiple controlling hosts as an attack manipulator.

8. The apparatus for processing network attack of claim 7, further comprising:

an event collecting module, adapted to collect event information from logs according preset conditions;

wherein the attacked object modeling module is further adapted to determine the attacked object according to a priority of the traffic exception event collected by the event collecting module.

9. The apparatus for processing network attack of claim 8, further comprising:

an attack correlating module, adapted to sort the information on of multiple events in the event collecting module by destination IP addresses and create an attack real-time list;

wherein the topology module is further adapted to search the attack real-time list for the recorded attack events related to the attacked object.

10. The apparatus for processing network attack of claim 8, further comprising:

a control correlating module, adapted to sort the information of various control events in the event collecting module by the source IP address and create a control real-time list;

wherein the topology module is further adapted to search the control real-time list for the recorded control event related to the controlled host.

11. The apparatus for processing network attack of claim 10, wherein the topology module further comprises:

a first processing unit, adapted to search the attack real-time list created by the attack correlating module for the attack event targeted at the attacked object by using an IP address of the attacked object as a match condition, and determine the controlled host in the attack network;

a second processing unit, adapted to search the control real-time list created by the control correlating module for the control event targeted at the controlled host by using the IP address of the controlled object as a match condition, and determine the controlling host in the attack network.

12. A network analyzing monitor center, comprising:

an attacked object modeling module adapted to determine the attacked object;

a topology module adapted to, after the attacked object modeling module determines the attacked object, search for a recorded attack event related to the attacked object to determine a controlled host in an attack network, and search for a recorded control event related to the controlled host to determine a controlling host in the attack network; and

a communication analysis module adapted to determine a detected host which performs the same communication with the multiple controlling hosts as an attack manipulator.

13. The network analyzing monitor center of claim 12, further comprising:

an event collecting module adapted to collect event information from logs according preset conditions;

wherein the attacked object modeling module is further adapted to determine the attacked object according to a priority of the traffic exception event collected by the event collecting module.

14. The network analyzing monitor center of claim 13, further comprising:

an attack correlating module, adapted to sort the information on of multiple events in the event collecting module by destination IP addresses and create an attack real-time list;

wherein the topology module is further adapted to search the attack real-time list for the recorded attack events related to the attacked object.

15. The network analyzing monitor center of claim 13, further comprising:

a control correlating module adapted to sort the information of various control events in the event collecting module by the source IP address and create a control real-time list;

wherein the topology module is further adapted to search the control real-time list for the recorded control event related to the controlled host.

16. The network analyzing monitor center of claim 15, wherein the topology module further comprises:

a first processing unit adapted to, search the attack real-time list created by the attack correlating module for the attack event targeted at the attacked object by using the IP address of the attacked object as a match condition, and determine the controlled host in the attack network; and

a second processing unit, adapted to, search the control real-time list created by the control correlating module for the control event targeted at the controlled host by using the IP address of the controlled object as a match condition, and determine the controlling host in the attack network.