CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims priority to Chinese Patent Application No. 201811188369.4, filed on Oct. 12, 2018, titled “Method and apparatus for analyzing cyber attack,” which is hereby incorporated by reference in its entirety.

TECHNICAL FIELD

The present disclosure relates to the computer field, specifically to the field of cyber security, and more specifically to a method and apparatus for analyzing a cyber attack.

BACKGROUND

It is necessary to carry out security analysis on an online web log, to timely sense web attack situation of an online service. At present, a result obtained from the security analysis is merely a statistical result, such as how many times of attacks happened, and fails to reflect specific web attack situation of the online service. In addition, an operation and maintenance engineer cannot further analyze the web attack situation of the online service in detail based on the analysis result.

SUMMARY

Embodiments of the present disclosure provide a method and apparatus for analyzing a cyber attack.

In a first aspect, an embodiment of the present disclosure provides a method for analyzing a cyber attack, including: acquiring a web blog of a server, the web blog of the server including: a hypertext transfer protocol request received by the server, and a data portion extracted from a response of hypertext transfer protocol corresponding to the hypertext transfer protocol request; and detecting whether the hypertext transfer protocol request in the web log is offensive, to obtain a detection result of the hypertext transfer protocol request, and storing the hypertext transfer protocol request, the detection result of the hypertext transfer protocol request, and the extracted data portion correspondingly.

In a second aspect, an embodiment of the present disclosure provides an apparatus for analyzing a cyber attack, including: an acquiring unit configured to acquire a web blog of a server, the web blog of the server including: a hypertext transfer protocol request received by the server, and a data portion extracted from a response of hypertext transfer protocol corresponding to the hypertext transfer protocol request; and an analyzing unit configured to detect whether the hypertext transfer protocol request in the web log is offensive, to obtain a detection result of the hypertext transfer protocol request, and store the hypertext transfer protocol request, the detection result of the hypertext transfer protocol request, and the extracted data portion correspondingly.

The method and apparatus for analyzing a cyber attack provided by the embodiments of the present disclosure acquire a web blog of a server; detect whether a hypertext transfer protocol request in the web log is offensive, to obtain a detection result of the hypertext transfer protocol request, and store the hypertext transfer protocol request, the detection result of the hypertext transfer protocol request, and extracted data portion correspondingly, thereby achieving storing data required for detailed analysis of web attack situation of an online service in the web log, and reflecting specific web attack situation of the online service, such that an operation and maintenance engineer may further analyze the web attack situation of the online service in detail. Further, the operation and maintenance engineer may comprehensively analyze the web attack situation of the online service in detail by accurately detecting web attacks, white list filtering, and replay attack.

