Patent Description:
A worm has been a major threat to the information security industry. The worm can exploit a security vulnerability, replicate itself, and propagate through a network. The worm can propagate by using file sharing, network sharing, a social network, instant messaging, a removable driver, an email attachment, text information, a software vulnerability, and the like.

Under control of a worm program, a worm-infected host scans for target detection to determine whether other hosts in the network have a vulnerability, open a special port, or the like. When the worm discovers a vulnerability on another host in the network, the worm attacks the vulnerable host and then transfers load to successfully infect the host.

In view of the worm propagation feature, in a current worm detection technology, a quantity of other hosts scanned by a host in a network in a period of time is counted. If the quantity is greater than a threshold, it is determined that the host is worm-infected and is attacking other hosts. Certainly, there are many similar worm detection technologies. For example, statistics may be collected on whether a quantity of destination ports scanned by a host in a network in a period of time exceeds a threshold. If the quantity of the scanned destination ports exceeds the threshold, it is determined that the host is worm-infected and is attacking other hosts.

In the foregoing worm detection technology, a worm-infected host can be detected in the network, but a large quantity of false positives may also exist. Many enterprises have very complex services, and a host in an enterprise network may scan a large quantity of hosts in a period of time for a normal service. In the foregoing worm detection technology, a normal host may be mistakenly determined as a worm-infected host. Therefore, the current worm detection technology has relatively low identification accuracy. Document <NPL> focuses on the feasibility of accurately detecting unknown worm activity in individual computers while minimizing the required set of features collected from the monitored computer. Document <NPL> describes a worm behavior and propagation model, and then based thereon, a new approach for early detection of internet worms is proposed. Document <CIT> relates to methods, system, and media for detecting malware. A network may be monitored for a configured time interval collecting all of or some of the network traffic or samples of the network traffic. Feature vectors may be extracted from the network traffic resulting in feature vectors. One or more machine learning models may be applied to the feature vectors producing a score. The score may indicate the presence of malware or the presence of a particular type of malware. One or more scores obtained by applying learning models may be fused by another machine learning model into a resulting score. A threshold value may be calculated to accompany a score indicating the likelihood that the traffic sample indicates the presence of malware and the likely effectiveness of planned remediation effort. An alert may be generated from the score and the threshold when the threshold is exceeded. Document <NPL> proposes an anomaly-based detection technique designed to protect internal networks from scanning worm infections. Document <CIT> discloses a method for detecting worm activity based on flow information. According to the propagation characteristics of the worm, the method calculates the detailed activity characteristics of the worm through the previous traffic information, and uses these features to detect the real-time traffic information to determine the activity of the worm.

Embodiments of this application provide a worm detection method and a network device, to improve worm identification accuracy. In particular, embodiments of the present application are defined by the independent claims. Additional features of embodiments of the invention are presented in the dependent claims. In the following, parts of the description and drawings referring to former embodiments which do not necessarily comprise all features to implement embodiments of the claimed invention are not represented as embodiments of the invention but as examples useful for understanding the embodiments of the invention. Embodiments of the present application (or the present disclosure) provide a worm detection method and a network device.

According to a first aspect, an embodiment of this application provides a worm detection method. The method includes the following steps: obtaining first session information of a first host in a first time window, where the first session information is session information of the first host actively connecting to one or more other hosts; determining, based on the first session information, a data feature corresponding to the first host, where the data feature corresponding to the first host is used to describe behavior of the first host accessing the one or more other hosts; and analyzing, based on a worm detection model, the data feature corresponding to the first host to obtain a prediction result, where the worm detection model is a model generated by training, by using a preset training method, data features corresponding to a plurality of hosts in a first network in which the first host is located, and the prediction result is used to indicate whether the first host is worm-infected.

In the first aspect, the worm detection model is trained by pre-learning network behavior of each host in a network accessing one or more other hosts, and then whether a host in the network is worm-infected is determined based on the worm detection model and network behavior of the host, to generate the prediction result for indicating whether the host is worm-infected. The worm detection method according to this embodiment of this application may be applicable to different networks. In other words, a corresponding worm detection model is trained based on network behavior of hosts on each different network. Compared with a conventional technology of detecting and determining worm infection by using a same threshold for all networks without distinction, this method can reduce a false positive rate to some extent, thereby improving worm identification accuracy.

Optionally, in a possible implementation of the first aspect, the worm detection method may further include the following steps: obtaining session information corresponding to each of at least two hosts in a preset time period, where the session information corresponding to each host is session information of each host actively connecting to one or more other hosts, and the at least two hosts are hosts in the first network; determining, based on the session information corresponding to each host, a data feature corresponding to each host, where the data feature corresponding to each host is used to describe behavior of each host accessing the one or more other hosts; and training, according to a preset training method, the data feature corresponding to each host to generate the worm detection model.

The worm detection model may learn network behavior of each host in a network accessing one or more other hosts, and a successfully trained worm detection model can determine, based on network behavior of a host in the network, whether the host is worm-infected.

Optionally, in a possible implementation of the first aspect, the data feature corresponding to each host is determined in the following manner. The preset time period is divided into a plurality of time windows, and a time length of each of the plurality of time windows is the same as a time length of the first time window. Session information corresponding to one host is selected from the session information corresponding to each of the at least two hosts, and data features corresponding to the selected host in the plurality of time windows are obtained respectively by using the following steps, until the session information corresponding to each of the at least two hosts is processed, so as to obtain data features corresponding to each host in the plurality of time windows respectively. The following steps include: allocating, based on start time of the session information corresponding to the selected host, the session information corresponding to the selected host to the plurality of time windows, to obtain session information corresponding to the selected host in the plurality of time windows respectively; determining, based on session information corresponding to the selected host in a second time window in the plurality of time windows, a data feature corresponding to the selected host in the second time window; and obtaining by analogy a data feature corresponding to the selected host in each of the plurality of time windows.

Optionally, in a possible implementation of the first aspect, a propagation chain between hosts is established in the following manner. A byte quantity of each session corresponding to the first host in the first time window is obtained. Each session corresponding to the first host is a session generated when the first host actively connects to another host. A byte quantity of each session corresponding to a second host in a third time window is obtained. The second host is a host to which the first host actively connects in the first time window. The second host is a worm-infected host. Each session corresponding to the second host is a session generated when the second host actively connects to another host. A time length of the third time window is the same as a time length of the first time window. Start time of the first time window is earlier than or equal to start time of the third time window. Whether both the byte quantity of each session corresponding to the first host in the first time window and the byte quantity of each session corresponding to the second host in the third time window meet a first condition is determined. The first condition is used to describe a worm probe process and a worm load transfer process. If both the byte quantity of each session corresponding to the first host in the first time window and the byte quantity of each session corresponding to the second host in the third time window meet the first condition, a similarity between the byte quantity of each session corresponding to the first host in the first time window and the byte quantity of each session corresponding to the second host in the third time window is calculated. A propagation chain between the first host and the second host is established when the similarity is greater than a threshold.

If the start time of the first time window corresponding to the first host is earlier than the start time of the third time window corresponding to the second host, the first host actively connects to the second host in the first time window, and there is a high similarity between the byte quantity of each session corresponding to the first host and the byte quantity of each session corresponding to the second host, the worm-infected first host probably propagates a worm virus to the second host, and therefore, a propagation chain between the first host and the second host may be established. A propagation chain can provide a user with richer and more intuitive information about worm propagation, helping accurately assess impact of a worm in a network in which an infected host is located.

Optionally, in a possible implementation of the first aspect, this embodiment of this application provides a plurality of types of data features generated based on session information, and the data features are useful for constructing a differentiated worm detection model. Specifically, the first session information includes information about at least two sessions. Information about each session in the information about the at least two sessions includes at least one of a <NUM>-tuple of the session, a byte of the session, a packet quantity of the session, a transmission control protocol flag of the session, start time of the session, or end time of the session. The data feature corresponding to the first host includes at least one of a quantity of hosts whose port is scanned, a percentage of a request-packet byte quantity in a total packet byte quantity, a quantity of short sessions, a percentage of the quantity of short sessions in a quantity of all sessions, or a quantity of connected network segments. The quantity of hosts whose port is scanned is a maximum quantity of different hosts on which a same destination port is accessed by the first host. The short session is a session whose ratio of a byte quantity of the session to a packet quantity of the session is less than a threshold.

Optionally, in a possible implementation of the first aspect, the session information corresponding to each host includes information about at least two sessions corresponding to each host. Information about each session in the information about the at least two sessions corresponding to each host includes at least one of a <NUM>-tuple of the session, a byte of the session, a packet quantity of the session, a transmission control protocol flag of the session, start time of the session, or end time of the session. The data feature corresponding to each host includes at least one of a quantity of hosts whose port is scanned, a percentage of a request-packet byte quantity in a total packet byte quantity, a quantity of short sessions, a percentage of the quantity of short sessions in a quantity of all sessions, or a quantity of connected network segments. The quantity of hosts whose port is scanned is a maximum quantity of different hosts on which a same destination port is accessed by the first host. The short session is a session whose ratio of a byte quantity of the session to a packet quantity of the session is less than a threshold.

According to a second aspect, an embodiment of this application provides a worm detection method. The method includes the following steps: obtaining a byte quantity of each session corresponding to a first host in a first time window, where each session corresponding to the first host is a session generated when the first host actively connects to another host, and the first host is a worm-infected host; obtaining a byte quantity of each session corresponding to a second host in a second time window, where the second host is a host to which the first host actively connects in the first time window, the second host is a worm-infected host, each session corresponding to the second host is a session generated when the second host actively connects to another host, a time length of the second time window is the same as a time length of the first time window, and start time of the first time window is earlier than or equal to start time of the second time window; determining whether both the byte quantity of each session corresponding to the first host in the first time window and the byte quantity of each session corresponding to the second host in the second time window meet a first condition, where the first condition is used to describe a worm probe process and a worm load transfer process; if both the byte quantity of each session corresponding to the first host in the first time window and the byte quantity of each session corresponding to the second host in the second time window meet the first condition, calculating a similarity between the byte quantity of each session corresponding to the first host in the first time window and the byte quantity of each session corresponding to the second host in the second time window; and establishing a propagation chain between the first host and the second host when the similarity is greater than a threshold.

In the second aspect, this embodiment of this application provides a solution for constructing a worm propagation chain. The first condition is used in this method to describe the worm probe process and the worm load transfer process. Behavior of successively accessing each other between two worm-infected hosts conforming to the first condition is used to construct a propagation chain between the two hosts. Based on this, a propagation graph including several propagation chains can be further constructed. A propagation chain and a propagation graph can provide a user with richer and more intuitive information about worm propagation, helping accurately assess impact of a worm in a network in which an infected host is located.

Optionally, in a possible implementation of the second aspect, whether the first host and the second host are worm-infected is determined in the following manner. First session information of the first host in the first time window is obtained. The first session information is session information of the first host actively connecting to one or more other hosts. Second session information of the second host in the second time window is obtained. The second session information is session information of the second host actively connecting to one or more other hosts in the second time window. A data feature corresponding to the first host is determined based on the first session information, and a data feature corresponding to the second host is determined based on the second session information. The data feature corresponding to the first host is used to describe behavior of the first host accessing the one or more other hosts, and the data feature corresponding to the second host is used to describe behavior of the second host accessing the one or more other hosts. The data feature corresponding to the first host and the data feature corresponding to the second host are analyzed based on a worm detection model to obtain a prediction result. The worm detection model is a model generated by training, by using a preset training method, data features corresponding to a plurality of hosts in a first network in which the first host and the second host are located. The prediction result is used to indicate whether the first host and the second host are worm-infected.

In the second aspect, because the worm detection model pre-learns network behavior of each host in a network accessing one or more other hosts, the worm detection model may determine, based on network behavior of the first host and the second host in the network, whether the first host and the second host are worm-infected, and generate a prediction result for indicating whether the first host and the second host are worm-infected.

Optionally, in a possible implementation of the second aspect, the worm detection model is generated in the following manner. Session information corresponding to each of at least two hosts in a preset time period is obtained. The session information corresponding to each host is session information of each host actively connecting to one or more other hosts. The at least two hosts are hosts in the first network. A data feature corresponding to each host is determined based on the session information corresponding to each host. The data feature corresponding to each host is used to describe behavior of each host accessing the one or more other hosts. The data feature corresponding to each host is trained according to the preset training method to generate the worm detection model.

The worm detection model may learn network behavior of each host in a network accessing one or more other hosts, and a successfully trained worm detection model can determine, based on network behavior of a host in the network, whether the host is worm-infected. Compared with a conventional technology, the worm detection method according to this embodiment of this application may be applicable to different networks, and have higher worm identification accuracy.

Optionally, in a possible implementation of the second aspect, the data feature corresponding to each host is determined in the following manner. The preset time period is divided into a plurality of time windows, and a time length of each of the plurality of time windows is the same as a time length of the first time window. Session information corresponding to one host is selected from the session information corresponding to each of the at least two hosts, and data features corresponding to the selected host in the plurality of time windows are obtained respectively by using the following steps, until the session information corresponding to each of the at least two hosts is processed, so as to obtain data features corresponding to each host in the plurality of time windows respectively. The following steps include: allocating, based on start time of the session information corresponding to the selected host, the session information corresponding to the selected host to the plurality of time windows, to obtain session information corresponding to the selected host in the plurality of time windows respectively; determining, based on session information corresponding to the selected host in a third time window in the plurality of time windows, a data feature corresponding to the selected host in the third time window; and obtaining by analogy a data feature corresponding to the selected host in each of the plurality of time windows.

According to a third aspect, an embodiment of this application provides a network device. The network device includes a network interface, a memory, and a processor connected to the memory. The memory is configured to store instructions, and the processor is configured to execute the instructions, so that the network device performs the method in the first aspect or any one of the possible implementations of the first aspect, and the method in the second aspect or any one of the possible implementations of the second aspect. For details, refer to the foregoing detailed descriptions. Details are not repeated herein.

According to a fourth aspect, an embodiment of this application provides a worm detection apparatus. The apparatus has a function of implementing the method in the first aspect or any one of the possible implementations of the first aspect, and a function of implementing the method in the second aspect or any one of the possible implementations of the second aspect. The function may be implemented by hardware, or may be implemented by hardware executing corresponding software. The hardware or the software includes one or more modules corresponding to the function.

According to a fifth aspect, an embodiment of this application provides a computer storage medium, configured to store computer software instructions used by the foregoing network device. The computer storage medium includes a program designed for performing the first aspect, any one of the possible implementations of the first aspect, the second aspect, or any one of the possible implementations of the second aspect.

According to a sixth aspect, an embodiment of this application provides a computer program product including instructions. When the computer program product runs on a computer, the computer is enabled to perform the methods in the foregoing aspects.

According to a seventh aspect, an embodiment of this application provides a chip, including a memory and a processor. The memory is configured to store computer instructions, and the processor is configured to invoke and run the computer instructions from the memory, to perform the method in the first aspect or any one of the possible implementations of the first aspect, and the method in the second aspect or any one of the possible implementations of the second aspect.

<FIG> is a schematic diagram of a network scenario to which a worm detection solution according to an embodiment of this application is applicable. The schematic diagram of the network scenario shown in <FIG> is a specific example of an applicable scenario of the worm detection solution according to this embodiment of this application. The applicable scenario of the worm detection solution according to this embodiment of this application is not limited to the example shown in <FIG>.

The scenario shown in <FIG> includes a network X as an analysis object. Optionally, the network X is a network different from the Internet. For example, the network X is a local area network established by an organization such as an enterprise, a campus, or a home, or is a campus network (Campus network, CAN) including a plurality of local area networks. The network X as an analysis object is connected to the Internet by using a gateway device <NUM>. The network X includes at least one switch <NUM>, a server <NUM>, and a plurality of hosts. The plurality of hosts include a host A, a host B, a host C, a host X, and the like. The plurality of hosts may communicate with each other by using the switch <NUM>, and the plurality of hosts may also connect to an Internet <NUM> by using the switch <NUM> and the gateway device <NUM>. A plurality of switches may be included in the network X, and for brevity of illustration, at least one switch <NUM> is identified by using only one switch legend in <FIG>. The switch <NUM> generates, based on data packets sent between the plurality of hosts in a historical time period, session information corresponding to each of the plurality of hosts.

The historical time period is relative to a current time, and refers to a period of time that has passed before the current time. The session information corresponding to each host that is generated by the switch <NUM> refers to session information of each host actively connecting to one or more other hosts in the plurality of hosts in the network X. For example, the historical time period is last month, and session information corresponding to the host A is session information of the host A actively connecting to the host B, the host C, the host X, and the like. It may be understood that, the "one or more other hosts" are one or more hosts in the network X other than the host that actively initiates the connection. The range of the "one or more other hosts" varies with different hosts. For example, for the host A, the one or more other hosts include hosts such as the host B, the host C, and the host X, while for the host B, the one or more other hosts include hosts such as the host A, the host C, and the host X.

In the embodiment shown in <FIG>, the server <NUM> may obtain, from the switch <NUM>, the session information corresponding to each of the plurality of hosts in the network X in a preset time period in the historical time period. Then, the server <NUM> may determine, based on the session information corresponding to each host, a data feature corresponding to each host. Then, the server <NUM> may train, according to a preset training method, the data feature corresponding to each host in the network X, to generate a worm detection model. Finally, the server <NUM> may detect worm-infected hosts in the plurality of hosts in the network X in a current time window by using the worm detection model, and determine a worm propagation chain based on a network behavior similarity between the worm-infected hosts.

The preset time period may be a time period that is set in advance and that has passed before the current time. For example, the historical time period is last month, and the preset time period is last <NUM> days. Certainly, the preset time period may be set based on an actual situation. In this embodiment of this application, a time length of the preset time period is not limited, and a manner of selecting the preset time period from the historical time period is not limited.

For example, if the current time is <NUM>:<NUM> on October <NUM>, <NUM>, and the historical time period is from <NUM>:<NUM> on October <NUM>, <NUM> to <NUM>:<NUM> on October <NUM>, <NUM>, the preset time period may be set to from <NUM>:<NUM> on October <NUM>, <NUM> to <NUM>:<NUM> on October <NUM>, <NUM>.

Refer to <FIG> and <FIG> is a flowchart of a worm detection method according to an embodiment of this application. The worm detection method shown in <FIG> may be applied to the network scenario shown in <FIG>. In the network scenario shown in <FIG>, it is assumed that <NUM> hosts are included in the network X in <FIG>. The following describes how to use session information of the <NUM> hosts in the network X to generate a worm detection model. The worm detection method according to this embodiment of this application includes the following steps S101 to S103.

The server <NUM> obtains, from the switch <NUM>, session information corresponding to each of the <NUM> hosts in the network X in a preset time period.

Table <NUM> is an example table of the session information corresponding to each of the <NUM> hosts in the network X in the preset time period.

For example, in Table <NUM>, an IP address of the host A is <NUM>. <NUM>, and session information corresponding to the host A includes information about <NUM>,<NUM> sessions, such as the information about the session <NUM>, the information about the session <NUM>, and the information about the session m. The session information corresponding to the host A is session information of the host A actively connecting to a host other than the host A in the <NUM> hosts in the network X.

The session information corresponding to each host includes information about a plurality of sessions corresponding to each host. Information about each session in information about at least two sessions corresponding to each host includes at least one of a <NUM>-tuple of the session, a byte of the session, a packet quantity of the session, a transmission control protocol (transmission control protocol, TCP) flag (flag) of the session, start time of the session, or end time of the session.

For example, the session information of the host A includes information about <NUM>,<NUM> sessions, such as the information about the session <NUM>, the information about the session <NUM>, and the information about the session m. The information about the session <NUM> includes a <NUM>-tuple of the session <NUM>, a byte of the session <NUM>, a packet quantity of the session <NUM>, a transmission control protocol flag of the session <NUM>, start time of the session <NUM>, and end time of the session <NUM>.

Specifically, the <NUM>-tuple of the session <NUM> includes a source IP address (<NUM>. <NUM>), a source port number (<NUM>), a destination IP address (<NUM>. <NUM>), a destination port number (<NUM>), and a protocol type (TCP protocol). The bytes quantity of the session <NUM> are <NUM> MB, the packet quantity of the session <NUM> is <NUM>, the transmission control protocol flag of the session <NUM> is "SYN = <NUM>", the start time of the session <NUM> is <NUM>:<NUM> on October <NUM>, <NUM>, and the end time of the session <NUM> is <NUM>:<NUM> on October <NUM>, <NUM>.

The server <NUM> determines, based on the session information corresponding to each of the <NUM> hosts in the network X, a data feature corresponding to each of the <NUM> hosts in the network X.

The data feature corresponding to each host is used to describe behavior of each host accessing the one or more other hosts. For example, the data feature corresponding to each host includes at least one of a quantity of hosts whose port is scanned, a percentage of a request-packet byte quantity in a total packet byte quantity, a quantity of short sessions, a percentage of the quantity of short sessions in a quantity of all sessions, or a quantity of connected network segments. The total packet byte quantity is a sum of the request-packet byte quantity and a response-packet byte quantity. The quantity of all sessions is a sum of the quantity of short sessions and a quantity of common sessions.

The quantity of hosts whose port is scanned is a maximum quantity of different hosts on which a same destination port is accessed by the first host. The short session is a session whose ratio of a byte quantity of the session to a packet quantity of the session is less than a threshold. The common session is a session whose ratio of a byte quantity of the session to a packet quantity of the session is greater than or equal to the threshold. For example, the threshold is <NUM>. Certainly, parameters included in the data feature according to this embodiment of this application are not limited to the provided embodiments. A person skilled in the art may add or delete some parameters in the data feature.

For example, a data feature corresponding to the host A includes a quantity of hosts whose port is scanned that is corresponding to the host A, a percentage of a request-packet byte quantity in a total packet byte quantity that is corresponding to the host A, a quantity of short sessions that is corresponding to the host A, a percentage of the quantity of short sessions in a quantity of all sessions that is corresponding to the host A, and a quantity of connected network segments that is corresponding to the host A.

In the embodiment described in <FIG> of this application, a network device such as the server <NUM> trains a worm detection model by pre-learning network behavior of each host in a network accessing one or more other hosts, then determines, based on the worm detection model and network behavior of a host in the network, whether the host is worm-infected, and generates a prediction result for indicating whether the first host is worm-infected. The worm detection method according to this embodiment of this application may be applicable to different networks. In other words, a corresponding worm detection model is trained based on network behavior of hosts on each different network. Compared with a conventional technology of detecting and determining worm infection by using a same threshold for all networks without distinction, this method can reduce a false positive rate to some extent, thereby improving worm identification accuracy.

The following describes how to determine, based on the session information corresponding to each of the <NUM> hosts in the network X, the data feature corresponding to each of the <NUM> hosts in the network X. In other words, S102 includes the following steps S1021 to S1025.

The server <NUM> divides the preset time period into a plurality of time windows.

<FIG> is a schematic diagram of the preset time period and the plurality of time windows according to this embodiment of this application. For example, if the preset time period is last <NUM> days, a time length of each time window is <NUM> minutes, and the current time is <NUM>:<NUM> on October <NUM>, <NUM>, the preset time period is from <NUM>:<NUM> on October <NUM>, <NUM> to <NUM>:<NUM> on October <NUM>, <NUM>. Then, the <NUM> days can be split into <NUM> time windows.

The server <NUM> selects, from the session information corresponding to each of the <NUM> hosts in the network X, session information corresponding to the host A.

It is assumed that the session information corresponding to the host A includes information about <NUM>,<NUM> sessions, and the information about each session includes start time of the session. For the session information corresponding to the host A, refer to the first row of data in Table <NUM>.

The server <NUM> allocates, based on the start time of the session information corresponding to the host A, the session information corresponding to the host A to the <NUM> time windows, to obtain session information corresponding to the host A in the <NUM> time windows respectively.

Table <NUM> is a table of mapping relationships between the <NUM> time windows and the information about the <NUM>,<NUM> sessions of the host A.

For example, in Table <NUM>, it is assumed that the time window t1 corresponds to the information about the sessions <NUM> to <NUM> of the host A, the time window t2 corresponds to the information about the sessions <NUM> to <NUM> of the host A, the time window t3 corresponds to the information about the sessions <NUM> to <NUM> of the host A, and the time window t1440 corresponds to the information about the sessions <NUM> to <NUM> of the host A.

Specifically, with reference to Table <NUM>, if the time window t1 is from <NUM>:<NUM> on October <NUM>, <NUM> to <NUM>:<NUM> on October <NUM>, <NUM>, and start time of the sessions <NUM> to <NUM> all falls within the time window t1, the information about the sessions <NUM> to <NUM> of the host A is allocated to the time window t1, so that the time window t1 corresponds to the information about the sessions <NUM> to <NUM> of the host A separately.

Certainly, if the host A does not establish a session with any other hosts in some time windows, the host A does not have a corresponding session in these time windows.

The server <NUM> determines, based on the session information corresponding to the host A in the <NUM> time windows respectively, data features corresponding to the host A in the <NUM> time windows respectively.

Table <NUM> is a table of mapping relationships between the <NUM> time windows, the session information of the host A, and the data features of the host A.

In Table <NUM>, if the time window t1 corresponds to the information about the sessions <NUM> to <NUM> of the host A, the server <NUM> determines, based on the information about the sessions <NUM> to <NUM> corresponding to the host A in the time window t1, a data feature <NUM> corresponding to the host A in the time window t1.

With reference to Table <NUM>, the data feature <NUM> corresponding to the host A in the time window t1 includes: a quantity of hosts whose port "<NUM>" is scanned that is corresponding to the host A is "<NUM>", a percentage of a request-packet byte quantity in a total packet byte quantity that is corresponding to the host A is "<NUM>%", a quantity of short sessions that is corresponding to the host A is "<NUM>", a percentage of the quantity of short sessions in a quantity of all sessions that is corresponding to the host A is "<NUM>%", and a quantity of connected network segments that is corresponding to the host A is "<NUM>".

For example, with reference to Table <NUM>, the information about the sessions <NUM> to <NUM> corresponding to the host A in the time window t1 means that the host A accesses <NUM> hosts in total in the time window t1 and that the <NUM> hosts have different IP addresses. In addition, ports of nine hosts accessed by the host A in the time window t1 are all "<NUM>", and a port of one host accessed by the host A in the time window t1 is "<NUM>". Therefore, of the <NUM> different hosts, a quantity of different hosts on which the same destination port "<NUM>" is accessed by the host A is <NUM>.

For example, with reference to Table <NUM>, the information about the sessions <NUM> to <NUM> corresponding to the host A in the time window t1 means that the <NUM> sessions include <NUM> request packets and <NUM> response packets, that the <NUM> request packets have <NUM> MB, and that the <NUM> response packets have <NUM> MB. Therefore, the percentage of the request-packet byte quantity in the total packet byte quantity that is corresponding to the host A is equal to bytes quantity of the <NUM> request packets divided by a sum of the bytes quantity of the <NUM> request packets and bytes quantity of the <NUM> response packets, to <NUM> MB divided by a sum of <NUM> MB and <NUM> MB, and to <NUM>%. "All packets" refers to a sum of a request packet and a response packet.

For example, with reference to Table <NUM>, the information about the sessions <NUM> to <NUM> corresponding to the host A in the time window t1 means that the <NUM> sessions include <NUM> short sessions and <NUM> common session. Then, the quantity of short sessions is <NUM>.

For example, with reference to Table <NUM>, the information about the sessions <NUM> to <NUM> corresponding to the host A in the time window t1 means that the <NUM> sessions include <NUM> short sessions and <NUM> common session. The percentage of the quantity of short sessions in the quantity of all sessions is equal to the quantity of short sessions divided by a sum of the quantity of short sessions and the quantity of common sessions, to <NUM> divided by a sum of <NUM> and <NUM>, and to <NUM>%. "All sessions" refers to a sum of a quantity of short sessions and a quantity of common sessions.

For example, with reference to Table <NUM>, the information about the sessions <NUM> to <NUM> that is corresponding to the host A in the time window t1 means that <NUM> destination IP addresses corresponding to the information about the <NUM> sessions come from five network segments. The five network segments are <NUM>. XXX, <NUM>. XXX, <NUM>. XXX, <NUM>. XXX, and <NUM>.

The server <NUM> separately performs S1022 to S1024 on session information corresponding to the other hosts in the <NUM> hosts in the network X, to finally obtain data features corresponding to each of the <NUM> hosts in the network X in the <NUM> time windows respectively.

Table <NUM> is a table of mapping relationships between the <NUM> time windows and the data features of the <NUM> hosts in the network X.

For example, with reference to Table <NUM>, the <NUM> hosts in the network X may have a maximum of <NUM>,<NUM>,<NUM> data features in the <NUM> time windows by multiplying <NUM> hosts by <NUM> data features. Certainly, in some time windows, if the host does not have session information, there is no data feature. Therefore, in actual cases, a quantity of finally obtained data features may be less than <NUM>,<NUM>,<NUM>.

The server <NUM> trains, according to a preset training method, the data features corresponding to each of the <NUM> hosts in the network X in the <NUM> time windows respectively, to generate a worm detection model.

The preset training method is a training method that is set in advance. For example, the preset training method may be an isolation forest anomaly detection method. Certainly, this embodiment of this application is not limited to the isolation forest anomaly detection method, and may alternatively use another type of training method.

For example, with reference to Table <NUM>, the server <NUM> trains the data in Table <NUM> by using the isolation forest anomaly detection method to generate the worm detection model. It is assumed that the data feature corresponding to each host includes the quantity of hosts whose port is scanned, the percentage of a request-packet byte quantity in a total packet byte quantity, the quantity of short sessions, the percentage of the quantity of short sessions in a quantity of all sessions, and the quantity of connected network segments.

Table <NUM> is a table of mapping relationships between data features and data ranges of the <NUM> hosts in the network X.

For example, with reference to Table <NUM>, if <NUM>% of the data features of the <NUM> hosts in the network X fall within the data range <NUM>, and <NUM>% of the data features fall within the data range <NUM>, an abnormal data feature generated by a worm-infected host falls within the data range <NUM>, and a normal data feature generated by a worm-uninfected host falls within the data range <NUM>.

The server <NUM> trains the data in Table <NUM> by using the isolation forest anomaly detection method to generate the worm detection model, in other words, after the worm detection model learns the data features in Table <NUM>, a rule shown in Table <NUM> can be obtained. If the data feature of the host A in the time window t1 falls within the data range <NUM> in Table <NUM>, the host A has a worm-infected behavior feature, and the host A is more likely a worm-infected host. If the data feature of the host B in the time window t1 falls within the data range <NUM> in Table <NUM>, the host B does not have a worm-infected behavior feature, and the host B is more likely a worm-uninfected host.

Certainly, a successfully trained worm detection model may not store the data in Table <NUM>, and data in the successfully trained worm detection model may exist in another form. However, the successfully trained worm detection model can identify whether a data feature of a host falls within a normal range. If yes, that is, if the data feature of the host falls within the data range <NUM>, the worm detection model can determine that the host is more likely worm-uninfected. If not, that is, if the data feature of the host falls within the data range <NUM>, the worm detection model can determine that the host is more likely worm-infected.

In embodiments shown in <FIG>, the worm detection model may learn network behavior of each host in a network accessing one or more other hosts, and a successfully trained worm detection model can determine, based on network behavior of a host in the network, whether the host is worm-infected. Compared with a conventional technology, the worm detection method according to this embodiment of this application may be applicable to different networks, and have higher worm identification accuracy.

For example, an enterprise A has <NUM> hosts in an intranet <NUM> and an enterprise B has <NUM> hosts in an intranet <NUM>. It is assumed that the enterprise A can obtain a worm detection model X by learning network behavior of the <NUM> hosts in the intranet <NUM> by using the method shown in <FIG>, and the enterprise B can obtain a worm detection model Y by learning network behavior of the <NUM> hosts in the intranet <NUM> by using the method shown in <FIG>. Because a service type of the enterprise A is different from a service type of the enterprise B, the network behavior of the <NUM> hosts in the intranet <NUM> is different from the network behavior of the <NUM> hosts in the intranet <NUM>. Consequently, the worm detection model X and the worm detection model Y have different criteria for determining whether a host is worm-infected. Therefore, the worm detection method according to this embodiment of this application may be applicable to different types of networks. Moreover, the worm detection model can learn, based on historical data of the network, which network behavior is network behavior that is determined as "worm-infected" in the historical data and which network behavior is network behavior that is determined as "worm-uninfected" in the historical data. Therefore, the worm detection method according to this embodiment of this application can more accurately identify a worm-infected host.

Refer to <FIG> and <FIG> is a flowchart of another worm detection method according to an embodiment of this application. The worm detection method shown in <FIG> may be applied to the network scenario shown in <FIG>. In the example shown in <FIG>, a quantity of hosts in the network X in <FIG> is <NUM>. The following describes how the worm detection model generated by the embodiment shown in <FIG> is used to identify whether the host A is worm-infected. The worm detection method according to this embodiment of this application includes the following steps S201 to S203.

The server <NUM> obtains first session information of the host A in a time window ti from the switch <NUM>.

The first session information is session information of the host A actively connecting to one or more other hosts in the time window ti. The first session information includes information about at least two sessions. Information about each session in the information about the at least two sessions includes at least one of a <NUM>-tuple of the session, a byte of the session, a packet quantity of the session, a transmission control protocol flag of the session, start time of the session, or end time of the session.

Table <NUM> is an example table of the first session information corresponding to the host A in the time window ti.

For example, in Table <NUM>, an IP address of the host A is <NUM>. <NUM>, and the first session information of the host A in the time window ti includes the information about the sessions <NUM> to <NUM>. The information about the session <NUM> includes a <NUM>-tuple of the session <NUM>, a byte of the session <NUM>, a packet quantity of the session <NUM>, a transmission control protocol flag of the session <NUM>, start time of the session <NUM>, and end time of the session <NUM>.

<FIG> is a schematic diagram of a preset time period and the time window ti according to this embodiment of this application. In <FIG>, a preset time period T is from <NUM>:<NUM> on October <NUM>, <NUM> to <NUM>:<NUM> on October <NUM>, <NUM>, the preset time period includes <NUM> time windows, and a time length of each of the <NUM> time windows is <NUM> minutes. The time window ti is from <NUM>:<NUM> on October <NUM>, <NUM> to <NUM>:<NUM> on October <NUM>, <NUM>, and a time length of the time window ti is <NUM> minutes.

Based on embodiments shown in <FIG>, it can be learned that, by using an isolation forest anomaly detection method, the server <NUM> trains data features corresponding to each of the <NUM> hosts included in the network X in <NUM> time windows respectively, to generate a worm detection model. With reference to <FIG>, after the worm detection model is obtained, the server <NUM> may obtain, from the switch <NUM>, the first session information of the host A in the time window ti, and the server <NUM> determines, based on the first session information, a data feature corresponding to the host A, and then analyzes, based on the worm detection model, the data feature corresponding to the host A to obtain a prediction result.

The server <NUM> determines, based on the first session information, a data feature corresponding to the host A.

The data feature corresponding to the host A is used to describe behavior of the host A accessing the one or more other hosts. The data feature corresponding to the host A includes at least one of a maximum quantity of different hosts on which a same destination port accessed by the host A, a percentage of a request-packet byte quantity in a total packet byte quantity, a quantity of short sessions, a percentage of the quantity of short sessions in a quantity of all sessions, or a quantity of connected network segments.

For example, the data feature corresponding to the host A includes a maximum quantity "<NUM>" of hosts on which a same destination port accessed by the host A, a percentage "<NUM>%" of a request-packet byte quantity in a total packet byte quantity that is corresponding to the host A, a quantity "<NUM>" of short sessions that is corresponding to the host A, a percentage "<NUM>%" of the quantity of short sessions in a quantity of all sessions that is corresponding to the host A, and a quantity "<NUM>" of connected network segments that is corresponding to the host A.

The server <NUM> analyzes, based on the worm detection model, the data feature corresponding to the host A, to obtain a prediction result.

Embodiments shown in <FIG> describe how to generate the worm detection model. For a worm detection model generation process, refer to embodiments shown in <FIG>.

The prediction result is used to indicate whether the host A is worm-infected, and the prediction result may be displayed in different forms. For example, the prediction result may be a prediction score between [-<NUM>, <NUM>]. If the prediction score is between [-<NUM>, <NUM>], the host A may have been worm-infected. If the prediction score is between [<NUM>, <NUM>], the host A may be worm-uninfected. A smaller score indicates a higher probability that the host A is worm-infected. A larger score indicates a lower probability that the host A is worm-infected.

For example, the example of the data feature corresponding to the host A and the content shown in Table <NUM> indicate that the data feature of the host A falls within the data range <NUM> in Table <NUM>. Therefore, the host A has a worm-infected behavior feature, and the host A is more likely a worm-infected host. It is assumed that the prediction result is -<NUM>, the host A may have been worm-infected.

In embodiments shown in <FIG> and <FIG>, the worm detection model may determine, based on a data feature of a host in one time window, whether the host is worm-infected. Certainly, the worm detection model may determine a worm-infected host and a worm-uninfected host in a plurality of hosts based on data features of the plurality of hosts in one time window.

Refer to <FIG> and <FIG> is a flowchart of still another worm detection method according to an embodiment of this application. The worm detection method shown in <FIG> may be applied to the network scenario shown in <FIG>. In the example shown in <FIG>, it is assumed that a quantity of hosts in <FIG> is <NUM>. The worm detection model generated in the embodiment shown in <FIG> detects, among the <NUM> hosts in the network X, that both the host A and the host B are worm-infected. The following describes how to establish a worm propagation chain between the host A and the host B by using examples of the host A and the host B. The worm detection method according to this embodiment of this application includes the following steps S301 to S305.

The server <NUM> obtains, from the switch <NUM>, a byte quantity of each session corresponding to the host A in a time window ti.

The server <NUM> obtains, from the switch <NUM>, a byte quantity of each session corresponding to the host B in a time window tj.

In S301 and S302, each session corresponding to the host A is a session generated when the host A actively connects to another host, and each session corresponding to the host B is a session generated when the host B actively connects to another host. In addition, the host B is a host to which the host A actively connect in the time window ti.

Table <NUM> is an example table of byte quantities of sessions corresponding to the host A and byte quantities of sessions corresponding to the host B respectively.

In Table <NUM>, it is assumed that the host A has <NUM> sessions in the time window ti and the host B has <NUM> sessions in the time window tj.

<FIG> is a schematic diagram of a preset time period, a time window ti, and a time window tj according to this embodiment of this application. In <FIG>, a preset time period T is from <NUM>:<NUM> on October <NUM>, <NUM> to <NUM>:<NUM> on October <NUM>, <NUM>, the preset time period includes <NUM> time windows, and a time length of each of the <NUM> time windows is <NUM> minutes. The time window ti is from <NUM>:<NUM> on October <NUM>, <NUM> to <NUM>:<NUM> on October <NUM>, <NUM>, and the time window tj is from <NUM>:<NUM> on October <NUM>, <NUM> to <NUM>:<NUM> on October <NUM>, <NUM>. Time lengths of both the time window ti and the time window tj are <NUM> minutes.

The server <NUM> determines whether both the byte quantity of each session corresponding to the host A in the time window ti and the byte quantity of each session corresponding to the host B in the time window tj meet a first condition.

The first condition is used to describe a worm probe process and a worm load transfer process. Network behavior of a worm-infected host in a time window includes a worm probe process and a worm load transfer process. The worm probe process includes a port probe process and a vulnerability probe process. Among the three processes, in the port probe process, the host establishes the most sessions each with the least bytes. In the vulnerability probe process, the host establishes a relatively large quantity of sessions each with a relatively small quantity of bytes. In the load transfer process, the host establishes the least sessions each with the most bytes.

For example, the first condition is that a byte quantity of each session corresponding to a host falls in three byte ranges. A first byte range is from <NUM> to <NUM> bytes, a second byte range is from <NUM> bytes to <NUM> bytes, and a third byte range is from <NUM> bytes to <NUM> bytes. If a byte quantity of each session corresponding to a host falls in the three byte ranges, the byte quantity of each session corresponding to the host meets the first condition.

For example, of the <NUM> sessions corresponding to the host A in the time window ti, if there are <NUM> sessions each with a byte quantity in the range of <NUM> to <NUM> bytes, <NUM> sessions each with a byte quantity in the range of <NUM> to <NUM> bytes, and <NUM> session with a byte quantity in the range of <NUM> to <NUM> bytes, the byte quantities of the <NUM> sessions corresponding to the host A in the time window ti meet the first condition.

For example, of the <NUM> sessions corresponding to the host B in the time window tj, if there are <NUM> sessions each with a byte quantity in the range of <NUM> to <NUM> bytes, <NUM> sessions each with a byte quantity in the range of <NUM> to <NUM> bytes, and <NUM> sessions each with a byte quantity in the range of <NUM> to <NUM> bytes, the byte quantities of the <NUM> sessions corresponding to the host B in the time window tj meet the first condition.

If both the byte quantity of each session corresponding to the host A and the byte quantity of each session corresponding to the host B meet the first condition, the server <NUM> calculates a similarity between the byte quantity of each session corresponding to the host A in the time window ti and the byte quantity of each session corresponding to the host B in the time window tj.

The calculation of the similarity may be specifically calculation of a cosine similarity. Certainly, the similarity is not limited to a cosine similarity.

The server <NUM> establishes a propagation chain between the host A and the host B when the similarity is greater than a threshold.

With reference to Table <NUM>, it is assumed that the threshold is <NUM> and the server <NUM> calculates a cosine similarity between the byte quantities of the <NUM> sessions corresponding to the host A and the byte quantities of the <NUM> sessions corresponding to the host B. If the cosine similarity is greater than <NUM>, the server <NUM> establishes a propagation chain between the host A and the host B.

In the embodiment shown in <FIG>, start time of the time window ti corresponding to the host A is earlier than start time of the time window tj corresponding to the host B, the host A actively connects to the host B in the time window ti, and there is a high similarity between the byte quantity of each session corresponding to the host A and the byte quantity of each session corresponding to the host B. If the foregoing three conditions are met, the worm-infected host A probably propagates a worm virus to the host B. Therefore, a propagation chain can be established between the host A and the host B. A propagation chain can provide a user with richer and more intuitive information about worm propagation, helping accurately assess impact of a worm in a network intranet an infected host is located.

Refer to <FIG> and <FIG> is a schematic diagram of a worm propagation chain according to an embodiment of this application. It is assumed that a quantity of hosts in the network X in <FIG> is <NUM>. After checking, the host A, the host B, the host C, and the host D in the <NUM> hosts in the network X are determined as worm-infected.

In the embodiment shown in <FIG>, it is assumed that the server <NUM> obtains, from the switch <NUM>, a byte quantity of each session corresponding to the host A in a time window ti, a byte quantity of each session corresponding to the host B in a time window tj, a byte quantity of each session corresponding to the host C in a time window tm, and a byte quantity of each session corresponding to the host D in a time window tn. In addition, the host A actively connects to the host B and the host C in the time window ti, the host B actively connects to the host C and the host D in the time window tj, and the host C actively connects to the host D in the time window tm. Moreover, the byte quantity of each session corresponding to the host A, the byte quantity of each session corresponding to the host B, the byte quantity of each session corresponding to the host C, and the byte quantity of each session corresponding to the host D all meet the first condition.

Start time of the time window ti is earlier than start time of the time window tj, start time of the time window tm, and start time of the time window tn. The start time of the time window tj is earlier than the start time of the time window tm and the start time of the time window tn. The start time of the time window tm is earlier than the start time of the time window tn.

Table <NUM> is an example table of similarities between the host A, the host B, the host C, and the host D.

In Table <NUM>, the network behavior similarity may be calculated in the manner provided by S304 and S305 in <FIG>. Table <NUM> indicates that the host A probably propagates a worm virus to the host B and the host C, the host B probably propagates a worm virus to the host C and the host D, and the host C probably propagates a worm virus to the host D.

In the embodiment shown in <FIG>, how to establish a worm propagation chain is illustrated by using examples of the host A, the host B, the host C, and the host D. Based on a propagation chain between two hosts, a propagation graph including several propagation chains can be further constructed. A propagation chain and a propagation graph can provide a user with richer and more intuitive information about worm propagation, helping accurately assess impact of a worm in a network intranet an infected host is located.

<FIG> is a flowchart of yet another worm detection method according to an embodiment of this application. The method shown in <FIG> includes the following steps S401 to S403.

Obtain first session information of a first host in a first time window.

The first session information is session information of the first host actively connecting to one or more other hosts. The first session information includes information about at least two sessions. Information about each session in the information about the at least two sessions includes at least one of a <NUM>-tuple of the session, a byte of the session, a packet quantity of the session, a transmission control protocol flag of the session, start time of the session, or end time of the session. In addition, the first time window is a time period with a preset length.

For specific implementation of S401, refer to the description of S201 in the embodiment shown in <FIG>.

Determine, based on the first session information, a data feature corresponding to the first host.

The data feature corresponding to the first host is used to describe behavior of the first host accessing the one or more other hosts. The data feature corresponding to the first host includes at least one of a quantity of hosts whose port is scanned, a percentage of a request-packet byte quantity in a total packet byte quantity, a quantity of short sessions, a percentage of the quantity of short sessions in a quantity of all sessions, or a quantity of connected network segments.

For specific implementation of S402, refer to the description of S202 in the embodiment shown in <FIG>.

Analyze, based on a worm detection model, the data feature corresponding to the first host to obtain a prediction result.

The worm detection model is a model generated by training, by using a preset training method, data features corresponding to a plurality of hosts in a first network in which the first host is located. The prediction result is used to indicate whether the first host is worm-infected.

For specific implementation of S403, refer to the description of S203 in the embodiment shown in <FIG>.

In the embodiment shown in <FIG>, the worm detection model is a model generated by training, by using the preset training method, data features corresponding to a plurality of hosts in the first network in which the first host is located. Therefore, the worm detection model may accurately identify a worm-infected host and a worm-uninfected host in the first network based on data features of hosts in the first network.

<FIG> is a flowchart of still yet another worm detection method according to an embodiment of this application. The method shown in <FIG> includes the following steps S501 to S503.

Obtain session information corresponding to each of at least two hosts in a preset time period.

The session information corresponding to each host is session information of each host actively connecting to one or more other hosts, and the at least two hosts are hosts in a first network. The session information corresponding to each host includes information about at least two sessions corresponding to each host. Information about each session in the information about the at least two sessions corresponding to each host includes at least one of a <NUM>-tuple of the session, a byte of the session, a packet quantity of the session, a transmission control protocol flag of the session, start time of the session, or end time of the session.

For specific implementation of S501, refer to the description of S101 in the embodiment shown in <FIG>.

Determine, based on the session information corresponding to each host, a data feature corresponding to each host.

The data feature corresponding to each host is used to describe behavior of each host accessing the one or more other hosts. The data feature corresponding to each host includes at least one of a quantity of hosts whose port is scanned, a percentage of a request-packet byte quantity in a total packet byte quantity, a quantity of short sessions, a percentage of the quantity of short sessions in a quantity of all sessions, or a quantity of connected network segments.

For specific implementation of S502, refer to the description of S <NUM> in the embodiment shown in <FIG>.

Train, according to a preset training method, the data feature corresponding to each host to generate a worm detection model.

For specific implementation of S503, refer to the description of S103 in the embodiment shown in <FIG>.

In the embodiment shown in <FIG>, the worm detection model may learn network behavior of each host in a network accessing one or more other hosts, and a successfully trained worm detection model can determine, based on network behavior of a host in the network, whether the host is worm-infected. Compared with a conventional technology, the worm detection method according to this embodiment of this application may be applicable to different networks, and have higher worm identification accuracy.

In the embodiment shown in <FIG>, S502 may further include the following steps: dividing the preset time period into a plurality of time windows, where a time length of each of the plurality of time windows is the same as a time length of a first time window; and selecting, from the session information corresponding to each of the at least two hosts, session information corresponding to one host, and obtaining, by using the following steps, data features corresponding to the selected host in the plurality of time windows respectively until the session information corresponding to each of the at least two hosts is processed, so as to obtain data features corresponding to each host in the plurality of time windows respectively. The following steps include: allocating, based on start time of the session information corresponding to the selected host, the session information corresponding to the selected host to the plurality of time windows, to obtain session information corresponding to the selected host in the plurality of time windows respectively; determining, based on session information corresponding to the selected host in a second time window in the plurality of time windows, a data feature corresponding to the selected host in the second time window; and obtaining by analogy a data feature corresponding to the selected host in each of the plurality of time windows.

For specific implementation of S502, refer to the description of S1021 to S1025 in the embodiment shown in <FIG>.

<FIG> is a flowchart of a further worm detection method according to an embodiment of this application. The method shown in <FIG> includes the following steps S601 to S605.

Obtain a byte quantity of each session corresponding to a first host in a first time window.

Each session corresponding to the first host is a session generated when the first host actively connects to another host.

For specific implementation of S601, refer to the description of S301 in the embodiment shown in <FIG>.

Obtain a byte quantity of each session corresponding to a second host in a third time window.

The second host is a host to which the first host actively connects in the first time window. The second host is a worm-infected host. Each session corresponding to the second host is a session generated when the second host actively connects to another host. A time length of the third time window is the same as a time length of the first time window. Start time of the first time window is earlier than or equal to start time of the third time window.

For specific implementation of S602, refer to the description of S302 in the embodiment shown in <FIG>.

Determine whether both the byte quantity of each session corresponding to the first host in the first time window and the byte quantity of each session corresponding to the second host in the third time window meet a first condition.

The first condition is used to describe a worm probe process and a worm load transfer process.

For specific implementation of S603, refer to the description of S303 in the embodiment shown in <FIG>.

If both the byte quantity of each session corresponding to the first host and the byte quantity of each session corresponding to the second host meet the first condition, calculate a similarity between the byte quantity of each session corresponding to the first host and the byte quantity of each session corresponding to the second host.

The similarity may be a cosine similarity.

For specific implementation of S604, refer to the description of S304 in the embodiment shown in <FIG>.

Establish a propagation chain between the first host and the second host when the similarity is greater than a threshold.

For specific implementation of S605, refer to the description of S305 in the embodiment shown in <FIG>.

In the embodiment shown in <FIG>, the start time of the first time window corresponding to the first host is earlier than the start time of the third time window corresponding to the second host, the first host actively connects to the second host in the first time window, and there is a high similarity between the byte quantity of each session corresponding to the first host and the byte quantity of each session corresponding to the second host. When the foregoing three conditions are met, the worm-infected first host probably propagates a worm virus to the second host, and therefore a propagation chain is established between the first host and the second host.

Correspondingly, an embodiment of this application provides a network device, configured to perform the worm detection method according to the foregoing embodiments. <FIG> is a schematic diagram of a structure of a network device according to an embodiment of this application. Optionally, the network device shown in <FIG> is the server <NUM> in the application scenario shown in <FIG>, and the network device shown in <FIG> is also the server <NUM> in the procedures shown in <FIG>, and <FIG>. The network device includes a processor <NUM>, a memory <NUM>, and a network interface <NUM>.

The processor <NUM> may be one or more CPUs, and the CPU may be a single-core CPU, or may be a multi-core CPU.

The memory <NUM> includes but is not limited to a random access memory (random access memory, RAM), a read-only memory (read-only memory, ROM), an erasable programmable read-only memory (erasable programmable read-only memory, EPROM), a flash memory, an optical memory, and the like. The memory <NUM> stores code of an operating system.

The network interface <NUM> may be a wired interface, for example, a fiber distributed data interface (Fiber Distributed Data Interface, FDDI) or a gigabit Ethernet (Gigabit Ethernet, GE) interface. Alternatively, the network interface <NUM> may be a wireless interface. The network interface <NUM> is configured to receive a data flow from an internal network and/or an external network, and communicate with a switch in the internal network based on an indication of the processor <NUM>.

Optionally, the processor <NUM> implements the method in the foregoing embodiments by reading instructions stored in the memory <NUM>, or the processor <NUM> may implement the method in the foregoing embodiments by using internally stored instructions. When the processor <NUM> implements the method in the foregoing embodiments by reading the instructions stored in the memory <NUM>, the memory <NUM> stores the instructions for implementing the method according to the foregoing embodiments of this application.

After the processor <NUM> executes the instructions stored in the memory <NUM>, the network device is enabled to perform the following operations: obtaining first session information of a first host in a first time window from a switch through the network interface <NUM>, where the first session information is session information of the first host actively connecting to one or more other hosts; determining, based on the first session information, a data feature corresponding to the first host, where the data feature corresponding to the first host is used to describe behavior of the first host accessing the one or more other hosts; and analyzing, based on a worm detection model, the data feature corresponding to the first host to obtain a prediction result, where the worm detection model is a model generated by training, by using a preset training method, data features corresponding to a plurality of hosts in a first network in which the first host is located, and the prediction result is used to indicate whether the first host is worm-infected.

At least one processor <NUM> further performs the worm detection method in the foregoing method embodiments based on several correspondence tables (for example, Tables <NUM> to <NUM> in the foregoing embodiments) stored in the memory <NUM>. For more details of implementing the foregoing functions by the processor <NUM>, refer to descriptions in the foregoing method embodiments. Details are not repeated herein.

Optionally, the network device further includes a bus <NUM>. The processor <NUM> and the memory <NUM> are usually connected to each other by using the bus <NUM>, or may be connected to each other in another manner.

Optionally, the network device further includes an input/output interface <NUM>. The input/output interface <NUM> is configured to connect to an output device, and output the prediction result to an administrator, so as to notify the administrator whether the first host is worm-infected, and the like. The output device includes but is not limited to a display, a printer, and the like.

The input/output interface <NUM> is further configured to connect to an input device. The input device includes but is not limited to a keyboard, a touchscreen, a microphone, and the like.

<FIG> is a schematic diagram of a structure of a worm detection apparatus according to an embodiment of this application. The apparatus <NUM> includes a processing module <NUM> and an obtaining module <NUM>. The apparatus <NUM> is coupled and connected to the network device in the foregoing method embodiments. For example, the apparatus <NUM> is integrated into the network device, and is a software or hardware component in the network device. The apparatus shown in <FIG> is applied to the scenario shown in <FIG> in the method embodiments, to implement functions of the server <NUM>.

The obtaining module <NUM> is configured to obtain first session information of a first host in a first time window. The first session information is session information of the first host actively connecting to one or more other hosts.

The processing module <NUM> is configured to: determine, based on the first session information, a data feature corresponding to the first host, where the data feature corresponding to the first host is used to describe behavior of the first host accessing the one or more other hosts; and analyze, based on a worm detection model, the data feature corresponding to the first host to obtain a prediction result, where the worm detection model is a model generated by training, by using a preset training method, data features corresponding to a plurality of hosts in a first network in which the first host is located, and the prediction result is used to indicate whether the first host is worm-infected.

For additional functions that can be implemented by the processing module <NUM> and the obtaining module <NUM> and more details of implementing the foregoing functions, refer to descriptions in the foregoing method embodiments. Details are not repeated herein.

The apparatus embodiment shown in <FIG> is merely an example. For example, the module division is merely logical function division and may be other division during actual implementation. For example, a plurality of modules or components may be combined or integrated into another system, or some features may be ignored or not performed. Function modules in embodiments of this application may be integrated into one processing module, or each of the modules may exist alone physically, or two or more modules are integrated into one module. The foregoing modules in <FIG> may be implemented in a form of hardware, or may be implemented in a form of a software function unit. For example, when software is used for implementation, the processing module <NUM> and the obtaining module <NUM> may be implemented by a software function module generated after the processor <NUM> in <FIG> reads the program code stored in the memory. Alternatively, the foregoing modules in <FIG> may be separately implemented by different hardware on a network device. For example, the obtaining module <NUM> is implemented by using the network interface <NUM> in <FIG>, and the processing module <NUM> is implemented by using some processing resources (such as another core in the multi-core processor) in the processor <NUM> in <FIG>, or a programmable device such as a field-programmable gate array (Field-Programmable Gate Array, FPGA) or a coprocessor. Apparently, the foregoing function modules may be implemented by using a combination of software and hardware. For example, the obtaining module <NUM> is implemented by using the network interface <NUM>, and the processing module <NUM> is a software function module generated after a CPU reads instructions stored in a memory.

For other additional functions that can be implemented by the apparatus in <FIG>, a process of interaction with another network element device (such as an internal network device or a switch), technical effects that can be implemented by the apparatus, and more details of implementing the foregoing functions by the processing module <NUM> and the obtaining module <NUM>, refer to the description about the network device in the foregoing method embodiments. Details are not repeated herein.

Embodiments in this specification are all described in a progressive manner. For same or similar parts in embodiments, refer to each other. Each embodiment focuses on a difference from other embodiments. Especially, a system embodiment is basically similar to a method embodiment, and therefore is described briefly. For related parts, refer to some descriptions in the method embodiment.

A person of ordinary skill in the art may understand that when the various aspects or possible implementations of the various aspects of embodiments of this application are implemented by using software, all or some of the foregoing aspects or possible implementations of the various aspects may be implemented in a form of a computer program product. The computer program product refers to computer-readable instructions stored in a computer-readable medium. When the computer instructions are loaded and executed on a computer, all or some of the procedure or functions according to embodiments of this application are generated.

The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium includes but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or apparatus, or any suitable combination thereof. For example, the computer-readable storage medium is a random access memory (Random Access Memory, RAM), a read only memory (read only memory, ROM), an erasable programmable read only memory (Erasable Programmable Read Only Memory, EPROM), or a portable read only memory (Compact Disc Read-Only Memory, CD-ROM).

Claim 1:
A worm detection method, comprising:
obtaining (S201) first session information of a first host in a first time window, wherein the first session information is session information of the first host actively connecting to one or more other hosts;
determining (S202), based on the first session information, a data feature corresponding to the first host, wherein the data feature corresponding to the first host is used to describe behavior of the first host accessing the one or more other hosts; and
analyzing (S203), based on a worm detection model, the data feature corresponding to the first host to obtain a prediction result, wherein the worm detection model is a model generated by training, by using a preset training method and based on data features corresponding to a plurality of hosts in a first network in which the first host is located, and the prediction result is used to indicate whether the first host is worm-infected,
wherein the first session information comprises information about at least two sessions, and information about each session in the information about the at least two sessions comprises at least one of a <NUM>-tuple of the session, a byte quantity of the session, a packet quantity of the session, a transmission control protocol flag of the session, start time of the session, or end time of the session, and wherein the data feature corresponding to the first host comprises at least one of a quantity of short sessions, or a percentage of the quantity of short sessions in a quantity of all sessions; wherein the short session is a session whose ratio of a byte quantity of the session to a packet quantity of the session is less than a threshold.